diff --git a/.cargo/config.toml b/.cargo/config.toml
index 9c9e20f089..5df8ea0c15 100644
--- a/.cargo/config.toml
+++ b/.cargo/config.toml
@@ -20,3 +20,7 @@ rustflags = ["-C", "target-feature=+aes,+sse2,+ssse3,+sse4.1,+sse4.2"]
 
 [target.x86_64-pc-windows-msvc]
 rustflags = ["-C", "target-feature=+aes,+sse2,+ssse3,+sse4.1,+sse4.2"]
+
+[env]
+# test threads get the 16 MB stack of the server's runtime threads (THREAD_STACK_SIZE); debug async code outgrows 2 MB
+RUST_MIN_STACK = "16777216"
diff --git a/.github/workflows/ai-code-review.yml b/.github/workflows/ai-code-review.yml
index 975fbc32ec..3114220bd4 100644
--- a/.github/workflows/ai-code-review.yml
+++ b/.github/workflows/ai-code-review.yml
@@ -68,7 +68,6 @@ jobs:
           - name: anthropic
             provider_id: anthropic-review
             model_id: claude-sonnet-5-5
-            model_variant: high
             api_key_env: ANTHROPIC_REVIEW_API_KEY
             marker: "<!-- ai-code-review -->"
     steps:
@@ -109,6 +108,11 @@ jobs:
           fi
           merge_base="$(gh api "repos/$REPO/compare/$base_sha...$head_sha" --jq '.merge_base_commit.sha' || true)"
           echo "merge_base=$merge_base" >> "$GITHUB_OUTPUT"
+          {
+            echo "author=$(jq -r '.user.login // ""' <<<"$pr_json")"
+            echo "changed_files=$(jq -r '.changed_files // ""' <<<"$pr_json")"
+            echo "commit_count=$(jq -r '.commits // ""' <<<"$pr_json")"
+          } >> "$GITHUB_OUTPUT"
           echo "REVIEW_RUN=true" >> "$GITHUB_ENV"
 
       # If minting fails (app not installed, bad key) the steps below fall back to github.token.
@@ -149,6 +153,37 @@ jobs:
             .claude/skills/ui-architect
             .claude/skills/eslint-error-handling
 
+      # Bills nothing and posts nothing; a hand-started run, a failed listing or a failed check always reviews.
+      - name: Skip PRs with nothing to review
+        if: env.REVIEW_RUN == 'true' && github.event_name == 'pull_request_target'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          REPO: ${{ github.repository }}
+          PR_NUMBER: ${{ steps.pr.outputs.number }}
+          PR_AUTHOR: ${{ steps.pr.outputs.author }}
+          # The listings are checked against these, as both endpoints stop at a cap however far they are paged.
+          EXPECTED_FILES: ${{ steps.pr.outputs.changed_files }}
+          EXPECTED_COMMITS: ${{ steps.pr.outputs.commit_count }}
+        run: |
+          set -uo pipefail
+          list="$RUNNER_TEMP/pr-files.tsv"
+          commits="$RUNNER_TEMP/pr-commits.tsv"
+          # One line per file with its rename source, so code moved under docs/ is not taken for docs and the count can be checked.
+          if ! gh api --paginate "repos/$REPO/pulls/$PR_NUMBER/files?per_page=100" --jq '.[] | [.filename, (.previous_filename // "")] | @tsv' > "$list"; then
+            echo "::warning::Could not list the PR's files; reviewing."
+            : > "$list"
+          fi
+          # One line per commit: author login, committer login, signature verified; a missing field lists as empty and reviews.
+          if ! gh api --paginate "repos/$REPO/pulls/$PR_NUMBER/commits?per_page=100" --jq '.[] | [(.author.login // ""), (.committer.login // ""), ((.commit.verification.verified // "") | tostring)] | @tsv' > "$commits"; then
+            echo "::warning::Could not list the PR's commits; reviewing."
+            : > "$commits"
+          fi
+          reason="$(node engine/scripts/ai-review/skip-check.mjs "$list" "$commits")" || reason=""
+          if [ -n "$reason" ]; then
+            echo "::notice::PR #$PR_NUMBER needs no review ($reason); skipped."
+            echo "REVIEW_RUN=false" >> "$GITHUB_ENV"
+          fi
+
       # Paired OSS+ENT changes are reviewed once, by the o2-enterprise workflow, which pulls this PR's diff in.
       - name: Defer to a paired o2-enterprise PR
         if: env.REVIEW_RUN == 'true' && !inputs.ignore_paired
@@ -291,10 +326,12 @@ jobs:
           FORCE_FULL: ${{ inputs.force_full || 'false' }}
           REVIEW_PROVIDER_ID: ${{ matrix.provider.provider_id }}
           REVIEW_MODEL_ID: ${{ matrix.provider.model_id }}
-          REVIEW_MODEL_VARIANT: ${{ matrix.provider.model_variant }}
+          # The effort is set here only, so the variable is the single source; each value must be a variant in opencode.ci.jsonc.
+          REVIEW_MODEL_VARIANT: ${{ vars.AI_REVIEW_EFFORT || 'high' }}
+          REVIEW_COORDINATOR_VARIANT: ${{ vars.AI_REVIEW_COORDINATOR_EFFORT || vars.AI_REVIEW_EFFORT || 'high' }}
           REVIEW_API_KEY_ENV: ${{ matrix.provider.api_key_env }}
           REVIEW_MARKER: ${{ matrix.provider.marker }}
-          # opencode.ci.jsonc: every tool (shell, edit, webfetch) allowed with no prompts; "default" is the read-only opencode.jsonc.
+          # opencode.ci.jsonc: file tools plus a read-only shell allowlist, no web or sub-agent tools, no prompts; "default" is the read-only opencode.jsonc.
           REVIEW_OPENCODE_CONFIG: ci-full
           # Empty under the github.token fallback: any workflow a same-repo PR adds can also post as github-actions[bot].
           REVIEW_BOT_LOGIN: ${{ steps.app_token.outputs.token && format('{0}[bot]', steps.app_token.outputs.app-slug) || '' }}
@@ -313,6 +350,8 @@ jobs:
           # Optional ceiling on automatic reviews per PR; unset means no cap, so each new commit gets one review. The manual input bypasses it for one run.
           REVIEW_MAX_PASSES: ${{ vars.AI_REVIEW_MAX_PASSES }}
           REVIEW_IGNORE_PASS_LIMIT: ${{ inputs.ignore_pass_limit || 'false' }}
+          # A hand-started run reviews even a diff the last review already read.
+          REVIEW_MANUAL_RUN: ${{ github.event_name == 'workflow_dispatch' }}
           # Independent reviewer sessions per area (1-3), merged by the coordinator; one cold pass misses findings a second catches.
           REVIEW_COLD_PASSES: ${{ vars.AI_REVIEW_COLD_PASSES || '2' }}
           # An unknown value means off, so a typo can never start approving.
diff --git a/.github/workflows/api-testing.yml b/.github/workflows/api-testing.yml
index 62a2425b6c..27694dcfd1 100644
--- a/.github/workflows/api-testing.yml
+++ b/.github/workflows/api-testing.yml
@@ -654,6 +654,8 @@ jobs:
           # 2. Nothing API-relevant changed → nothing ran → allow.
           if [ "${{ needs.check_changes.outputs.has_changes }}" != "true" ]; then
             echo "✅ No API-relevant changes — suite not required."
+            echo "::notice title=API tests skipped::No API-relevant changes — suite did not run."
+            echo "### ⏭️ API suite skipped — no API-relevant changes in this PR, so no tests ran." >> "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
 
diff --git a/.github/workflows/api_bugfix_regression.yml b/.github/workflows/api_bugfix_regression.yml
index 12b47b3b39..1336c9f5ac 100644
--- a/.github/workflows/api_bugfix_regression.yml
+++ b/.github/workflows/api_bugfix_regression.yml
@@ -156,7 +156,7 @@ jobs:
     name: "api_regression / ${{ matrix.config.label }}"
     needs: [check_main_changed, build_api_binary]
     if: ${{ needs.check_main_changed.outputs.should_run == 'true' }}
-    runs-on: ubicloud-standard-4
+    runs-on: eks-openobserve-standard-4
     permissions:
       actions: read
       contents: read
diff --git a/.github/workflows/audit-checker.yml b/.github/workflows/audit-checker.yml
index 734c1c1635..e473505950 100644
--- a/.github/workflows/audit-checker.yml
+++ b/.github/workflows/audit-checker.yml
@@ -27,7 +27,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - uses: ./.github/actions/github-auth
-      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+      - uses: taiki-e/install-action@1919c4a95903d2c33e4a221102edca87309fc14b # v2.89.0
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
diff --git a/.github/workflows/bug-checker.yml b/.github/workflows/bug-checker.yml
index 954d14e815..3179517f1a 100644
--- a/.github/workflows/bug-checker.yml
+++ b/.github/workflows/bug-checker.yml
@@ -144,7 +144,7 @@ jobs:
           fetch-depth: 1
 
       - name: Analyze bugs with Claude
-        uses: anthropics/claude-code-action@16f9f71ab9c490faf367f94dd294897edc25be33 # v1.0.261
+        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
 
diff --git a/.github/workflows/build-pr-image.yml b/.github/workflows/build-pr-image.yml
index 2e99917b89..695c129505 100644
--- a/.github/workflows/build-pr-image.yml
+++ b/.github/workflows/build-pr-image.yml
@@ -342,7 +342,7 @@ jobs:
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
 
-      - uses: int128/docker-manifest-create-action@a118e9fe12455375d4810aa318c20e6dba77288e # v2.29.0
+      - uses: int128/docker-manifest-create-action@d6ac360314337bbfb870747d9616b83118acb330 # v2.30.0
         with:
           tags: |
             public.ecr.aws/zinclabs/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}
@@ -350,7 +350,7 @@ jobs:
             public.ecr.aws/zinclabs/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-amd64
             public.ecr.aws/zinclabs/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}-arm64
 
-      - uses: int128/docker-manifest-create-action@a118e9fe12455375d4810aa318c20e6dba77288e # v2.29.0
+      - uses: int128/docker-manifest-create-action@d6ac360314337bbfb870747d9616b83118acb330 # v2.30.0
         with:
           tags: |
             ghcr.io/openobserve/openobserve-dev:${{ needs.build_frontend.outputs.GIT_TAG }}-${{ needs.build_frontend.outputs.GIT_HASH}}
diff --git a/.github/workflows/claude.yml b/.github/workflows/claude.yml
index 46e8ca44f5..10807ad51c 100644
--- a/.github/workflows/claude.yml
+++ b/.github/workflows/claude.yml
@@ -85,6 +85,6 @@ jobs:
 
       - name: Run Claude Code
         id: claude
-        uses: anthropics/claude-code-action@16f9f71ab9c490faf367f94dd294897edc25be33 # v1.0.261
+        uses: anthropics/claude-code-action@d535f5172dec02b204866b393d6b20b9b2aaf98d # v1.0.266
         with:
           anthropic_api_key: ${{ secrets.ANTHROPIC_API_KEY }}
diff --git a/.github/workflows/ent-e2e-gate.yml b/.github/workflows/ent-e2e-gate.yml
index 3935d9259a..17ccb58214 100644
--- a/.github/workflows/ent-e2e-gate.yml
+++ b/.github/workflows/ent-e2e-gate.yml
@@ -14,9 +14,9 @@ name: Playwright E2E Crosscheck
 #       · open sister ENT PR (same-named branch) → DEFER to that PR's checks (link it, don't build here)
 #       · sister ENT branch only (no PR)          → build the enterprise binary against that branch
 #       · PR base is a release line (not main) with a same-named ENT branch → build against THAT branch
-#       · no ENT counterpart                      → build against ENT main, testing the PR merged into
-#                                                   OSS main (refs/pull/N/merge; branch head if not mergeable)
-#     then POLL and mirror pass/fail. A lost test runner is re-run once before it is reported.
+#       · no ENT counterpart                      → build against ENT main, testing the merge commit SHA tied to
+#                                                   the event's head SHA (the head SHA itself if there is none)
+#     then POLL and mirror pass/fail. Only a lost test runner is re-run, up to twice, before it is reported.
 #
 # A single STICKY comment per PR (found by a hidden marker) reports running → passed / failed, lists the
 # failing specs, and links the sister ENT PR/branch + the ENT run. A build failure is attributed by the
@@ -31,65 +31,35 @@ name: Playwright E2E Crosscheck
 #   vars.ENT_E2E_GATE_DISABLED — 'true' kill switch: gate passes without dispatching.
 
 on:
+  # Opens, reopens, pushes, base changes and the gate's own labels run it; any other label or edit only mirrors its current result.
   pull_request:
-    types: [synchronize, labeled, unlabeled, ready_for_review, converted_to_draft]
-  # Runs on label changes of a ready-for-ci PR and on approval; pushes run only while approved.
-  pull_request_review:
-    types: [submitted]
+    types: [opened, reopened, synchronize, edited, labeled, unlabeled, ready_for_review, converted_to_draft]
   # A required check must also report on merge-queue commits; the gate already passed on the PR head.
   merge_group:
 
-# PR-scoped: a new push/label supersedes the previous gate attempt for the same PR.
+# PR-scoped: a new push or gate label supersedes the previous gate attempt for the same PR.
 concurrency:
-  # A non-approval review does nothing, so it must not cancel a running gate.
-  group: playwright-e2e-crosscheck-${{ github.event.pull_request.number || github.ref }}${{ github.event_name == 'pull_request_review' && github.event.review.state != 'approved' && format('-{0}', github.run_id) || '' }}
+  # Other labels (auto-requeue-* and the like) and title/body edits only mirror the gate's result, so they must not cancel a running gate; the newest mirror is enough.
+  group: playwright-e2e-crosscheck-${{ github.event.pull_request.number || github.ref }}${{ (((github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.event.label.name != 'ready-for-ci' && github.event.label.name != 'skip-ent-e2e') || (github.event.action == 'edited' && !github.event.changes.base)) && '-mirror' || '' }}
   cancel-in-progress: true
 
 permissions:
   contents: read
-  pull-requests: write
+  pull-requests: read
 
 jobs:
-  trigger:
-    # reviewDecision of a stacked PR is judged by the stack's merge rules, so it is what the merge will require.
-    if: ${{ github.event_name != 'merge_group' && (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false) && ((github.event_name == 'pull_request_review' && github.event.review.state == 'approved') || github.event_name == 'pull_request') }}
-    runs-on: ubuntu-latest
-    timeout-minutes: 5
-    permissions:
-      pull-requests: read
-    outputs:
-      dispatch: ${{ steps.check.outputs.dispatch }}
-    steps:
-      - id: check
-        env:
-          GH_TOKEN: ${{ github.token }}
-          GH_REPO: ${{ github.repository }}
-          PR: ${{ github.event.pull_request.number }}
-          ACTION: ${{ github.event_name == 'pull_request' && github.event.action || '' }}
-          LABEL: ${{ github.event.label.name }}
-        run: |
-          # Any label change cancels the running gate, so it must start a replacement; without approval only label events and ready_for_review do.
-          if [ "$ACTION" = "labeled" ] || [ "$ACTION" = "unlabeled" ] || [ "$ACTION" = "ready_for_review" ]; then
-            echo "Triggered by $ACTION; approval not required."
-            echo "dispatch=true" >> "$GITHUB_OUTPUT"
-            exit 0
-          fi
-          DECISION=$(gh pr view "$PR" --json reviewDecision --jq .reviewDecision)
-          echo "reviewDecision: $DECISION"
-          DISPATCH=false
-          if [ "$DECISION" = "APPROVED" ]; then DISPATCH=true; fi
-          echo "dispatch=$DISPATCH" >> "$GITHUB_OUTPUT"
-
   playwright-e2e-crosscheck:
-    needs: trigger
-    # A pre-merge gate: runs when ready-for-ci is added or the PR is approved, and on pushes only while approved.
-    if: ${{ !cancelled() && (github.event_name == 'merge_group' || needs.trigger.outputs.dispatch == 'true') }}
+    # Without ready-for-ci, or on a draft, the required ci-gate status stays pending, so skipping here cannot let a PR merge.
+    if: ${{ github.event_name == 'merge_group' || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false) }}
     name: Playwright E2E Crosscheck
     runs-on: ubuntu-latest
-    # ~5 min to find the ENT run + up to ~75 min to poll. Generous on purpose: normal is ~20 min,
-    # but a cold Rust cache can push the ENT build+run toward its own timeouts — don't false-fail
-    # the gate ("timed out") while ENT is still legitimately running. A lost runner adds one re-run.
-    timeout-minutes: 150
+    permissions:
+      contents: read
+      pull-requests: read
+      checks: read
+      actions: read
+    # Starting (5) + the first run's budget (165) + two lost-runner re-runs (80 each, plus 1 to see the new attempt), from the poll budgets below.
+    timeout-minutes: 340
     steps:
       - name: Triage — relevant paths? opted out?
         id: triage
@@ -99,6 +69,7 @@ jobs:
           HAS_SKIP: ${{ contains(github.event.pull_request.labels.*.name, 'skip-ent-e2e') }}
           DISABLED: ${{ vars.ENT_E2E_GATE_DISABLED }}
           IS_FORK: ${{ github.event.pull_request.head.repo.fork }}
+          MIRROR: ${{ ((github.event.action == 'labeled' || github.event.action == 'unlabeled') && github.event.label.name != 'ready-for-ci' && github.event.label.name != 'skip-ent-e2e') || (github.event.action == 'edited' && !github.event.changes.base) }}
         run: |
           set -euo pipefail
           if [ "${{ github.event_name }}" = "merge_group" ]; then
@@ -109,9 +80,7 @@ jobs:
             echo "::notice::ENT_E2E_GATE_DISABLED=true — passing without dispatch."
             echo "mode=pass" >> "$GITHUB_OUTPUT"; exit 0
           fi
-          # Fork PRs: head branch isn't in openobserve/openobserve and the PAT isn't available to
-          # forked-PR runs, so the ENT engine can't check it out. Pass with a notice; a maintainer
-          # re-runs from an internal branch if enterprise validation is needed.
+          # A fork's branch is not in this repo and its runs get no PAT, so the engine cannot check it out.
           if [ "$IS_FORK" = "true" ]; then
             echo "::notice::Fork PR — Playwright E2E Crosscheck can't run (no PAT / branch not in main repo). Passing."
             echo "mode=pass" >> "$GITHUB_OUTPUT"; exit 0
@@ -119,7 +88,12 @@ jobs:
 
           # Relevant = any changed file under web/ or tests/ui-testing/
           FILES=$(gh api "repos/${{ github.repository }}/pulls/$PR/files" --paginate -q '.[].filename')
-          if printf '%s\n' "$FILES" | grep -qE '^(web/|tests/ui-testing/)'; then
+          CHANGED=$(gh api "repos/${{ github.repository }}/pulls/$PR" -q .changed_files)
+          # The files API lists at most 3000 files, so a list it cut short cannot prove the PR is irrelevant.
+          if [ "$CHANGED" -ge 3000 ] || [ "$CHANGED" -gt "$(grep -c . <<<"$FILES")" ]; then
+            RELEVANT=true
+          # A here-string, not a pipe: grep -q exits early and the writer's SIGPIPE would fail the pipeline under pipefail.
+          elif grep -qE '^(web/|tests/ui-testing/)' <<<"$FILES"; then
             RELEVANT=true
           else
             RELEVANT=false
@@ -131,6 +105,8 @@ jobs:
           elif [ "$HAS_SKIP" = "true" ]; then
             echo "::warning::PR carries 'skip-ent-e2e' — enterprise gate explicitly opted out (auditable)."
             echo "mode=skip" >> "$GITHUB_OUTPUT"
+          elif [ "$MIRROR" = "true" ]; then
+            echo "mode=mirror" >> "$GITHUB_OUTPUT"
           else
             echo "mode=run" >> "$GITHUB_OUTPUT"
           fi
@@ -139,6 +115,60 @@ jobs:
         if: steps.triage.outputs.mode == 'pass' || steps.triage.outputs.mode == 'skip'
         run: echo "✅ Playwright E2E Crosscheck not required for this PR."
 
+      - name: Mirror — report the gate's current result for this head
+        if: steps.triage.outputs.mode == 'mirror'
+        env:
+          GH_TOKEN: ${{ github.token }}
+          HEAD_SHA: ${{ github.event.pull_request.head.sha }}
+          RUN_ID: ${{ github.run_id }}
+          GATE_ON: ${{ contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false }}
+        run: |
+          set -euo pipefail
+          CHECKS="repos/${{ github.repository }}/commits/$HEAD_SHA/check-runs?check_name=Playwright%20E2E%20Crosscheck&filter=all&per_page=100"
+          OWN=""
+          for _ in 1 2 3 4 5; do
+            OWN=$(gh api --paginate "$CHECKS" | jq -r --arg u "/actions/runs/$RUN_ID/" '.check_runs[] | select(.details_url | contains($u)) | .id' | sort -n | tail -n 1) && [ -n "$OWN" ] && break
+            sleep 10
+          done
+          [ -n "$OWN" ] || { echo "::error::Could not find this job's own check run."; exit 1; }
+          # Only older checks count: the newest check of this name is the required one, so a later gate run overrides this mirror anyway.
+          ERRORS=0; IGNORE="[]"
+          api_error() {
+            ERRORS=$((ERRORS + 1))
+            if [ "$ERRORS" -ge 10 ]; then echo "::error::The GitHub API kept failing — cannot report the gate's result."; exit 1; fi
+            sleep 30
+          }
+          while :; do
+            # An API error must not read as "no result", which would pass.
+            if ! LIST=$(gh api --paginate "$CHECKS" | jq -r --argjson own "$OWN" --argjson ignore "$IGNORE" \
+              '.check_runs[] | select(.id < $own and .conclusion != "skipped" and (.id as $i | $ignore | index($i) | not)) | "\(.id) \(.status) \(.conclusion // "")"'); then
+              api_error; continue
+            fi
+            read -r ID STATUS CONCL <<<"$(sort -n <<<"$LIST" | tail -n 1)"
+            if [ -z "$ID" ]; then
+              # This check is the newest, so passing here would make the required check green without the gate ever running.
+              if [ "$GATE_ON" = "true" ]; then
+                echo "::error::No Playwright E2E Crosscheck run exists for $HEAD_SHA, so there is no result to report. Re-apply the 'ready-for-ci' label or push a commit to run the gate."
+                exit 1
+              fi
+              echo "::notice::No gate result on $HEAD_SHA yet — nothing to mirror."
+              exit 0
+            fi
+            # Mirrors and failed triages share this check name, so only a check whose Run step started is a gate result; an unfinished one may still start it.
+            if ! RAN=$(gh api "repos/${{ github.repository }}/actions/jobs/$ID" -q '[.steps[]? | select(.status == "in_progress" or (.conclusion != null and .conclusion != "skipped")) | .name | split(" — ")[0]] | join(" ")'); then
+              api_error; continue
+            fi
+            if [[ " $RAN " == *" Run "* ]]; then
+              if [ "$STATUS" = "completed" ]; then break; fi
+            elif [[ " $RAN " == *" Mirror "* ]] || [ "$STATUS" = "completed" ]; then
+              IGNORE=$(jq -c --argjson i "$ID" '. + [$i]' <<<"$IGNORE"); continue
+            fi
+            # This check is newer than the running gate, so it must end with the gate's result, not before it.
+            ERRORS=0; sleep 30
+          done
+          echo "::notice::Mirroring gate check $ID on $HEAD_SHA: $CONCL."
+          [ "$CONCL" = "success" ] || { echo "::error::The gate's current result on this head is '$CONCL'."; exit 1; }
+
       - name: Run — dispatch ENT engine, poll, mirror result
         if: steps.triage.outputs.mode == 'run'
         env:
@@ -152,23 +182,30 @@ jobs:
           set -euo pipefail
           REPO="openobserve/o2-enterprise"; WF="oss-pr-ent-gate.yml"
           MARKER="<!-- playwright-e2e-crosscheck -->"
+          GATE_LOGIN=$(gh api user -q .login 2>/dev/null || echo "")
 
-          # Upsert ONE sticky gate comment per PR (located by the hidden marker) so status updates in
-          # place — pass AND fail — instead of spamming a fresh comment each run.
+          # One display-only status comment per PR; --paginate prints one array per page, so take the first matching id.
           sticky() {
-            local body="$1" cid
-            cid=$(gh api "repos/openobserve/openobserve/issues/$PR/comments" --paginate \
-              -q "[.[] | select(.body|contains(\"$MARKER\")) | .id][0]" 2>/dev/null || echo "")
-            if [ -n "$cid" ] && [ "$cid" != "null" ]; then
-              gh api -X PATCH "repos/openobserve/openobserve/issues/comments/$cid" -f body="$body" >/dev/null 2>&1 || true
+            STICKY_ID=${STICKY_ID:-$(gh api "repos/openobserve/openobserve/issues/$PR/comments" --paginate 2>/dev/null \
+              | jq -r --arg login "$GATE_LOGIN" --arg marker "$MARKER" '.[] | select(.user.login == $login and (.body | contains($marker))) | .id' | head -n 1 || true)}
+            if [ -n "$STICKY_ID" ]; then
+              gh api -X PATCH "repos/openobserve/openobserve/issues/comments/$STICKY_ID" -f body="$1" >/dev/null 2>&1 || true
             else
-              gh api -X POST "repos/openobserve/openobserve/issues/$PR/comments" -f body="$body" >/dev/null 2>&1 || true
+              STICKY_ID=$(gh api -X POST "repos/openobserve/openobserve/issues/$PR/comments" -f body="$1" -q .id 2>/dev/null || echo "")
             fi
           }
+          cannot_start() {
+          sticky "### 🚫 Playwright E2E Crosscheck — could not start
 
-          # Sister ENT resolution. An OPEN same-named ENT PR is the live counterpart — let ITS checks
-          # own enterprise validation; we DEFER (don't build here), just link. Only a branch (no PR) →
-          # build against that branch. Neither → the PR's base-line ENT branch if it exists, else main.
+          $MARKER
+          $1 The gate stays red until it runs — re-push or re-label to retry.
+
+          ${SISTER_NOTE:-}"
+            echo "::error::$1"
+            exit 1
+          }
+
+          # An open same-named ENT PR runs these specs itself, so the gate defers to its checks.
           SISTER_PR=$(gh pr list --repo "$REPO" --head "$HEAD_REF" --state open --json number -q '.[0].number' 2>/dev/null || echo "")
           if [ -n "$SISTER_PR" ] && [ "$SISTER_PR" != "null" ]; then
           sticky "### ⏭️ Playwright E2E Crosscheck — handled by the sister ENT PR
@@ -179,15 +216,12 @@ jobs:
             exit 0
           fi
 
-          # No sister branch/PR → build against the PR's base line, not blindly main. A PR onto a
-          # release branch (e.g. branch-v1.0.0) must build against the ENT branch of the same name;
-          # ENT main would fail to compile the release-line OSS code. Fall back to main only when
-          # the base is main or has no ENT counterpart.
-          if gh api "repos/$REPO/branches/$HEAD_REF" >/dev/null 2>&1; then
+          # A release-line PR needs the same-named ENT branch, and only plain names may reach API paths ("#", "?", "%" retarget them).
+          if [[ "$HEAD_REF" =~ ^[A-Za-z0-9._/-]+$ ]] && gh api "repos/$REPO/branches/$HEAD_REF" >/dev/null 2>&1; then
             ENT_CODE_REF="$HEAD_REF"
             SISTER_NOTE="Built against the matching ENT branch \`$HEAD_REF\` (no ENT PR yet)."
             echo "::notice::ENT branch '$HEAD_REF' exists (no PR) — building against it."
-          elif [ "$BASE_REF" != "main" ] && [ "$BASE_REF" != "master" ] && gh api "repos/$REPO/branches/$BASE_REF" >/dev/null 2>&1; then
+          elif [ "$BASE_REF" != "main" ] && [ "$BASE_REF" != "master" ] && [[ "$BASE_REF" =~ ^[A-Za-z0-9._/-]+$ ]] && gh api "repos/$REPO/branches/$BASE_REF" >/dev/null 2>&1; then
             ENT_CODE_REF="$BASE_REF"
             SISTER_NOTE="No same-named ENT branch — built against the PR's base line \`$BASE_REF\` on ENT."
             echo "::notice::No ENT branch '$HEAD_REF'; PR targets '$BASE_REF' which exists on ENT — building against it."
@@ -197,60 +231,74 @@ jobs:
             echo "::notice::No ENT counterpart for '$HEAD_REF' (base '$BASE_REF') — building against main."
           fi
 
+          # The run title names the exact ENT code and engine commits, so the gate can tell its own run from any other.
+          sha_of() {
+            local sha
+            for _ in 1 2 3; do
+              sha=$(gh api "repos/$REPO/commits/$1" -q .sha 2>/dev/null || true)
+              if [[ "$sha" =~ ^[0-9a-f]{40}$ ]]; then echo "$sha"; return 0; fi
+              sleep 5
+            done
+          }
+          ENT_SHA=$(sha_of "$ENT_CODE_REF")
+          [ -n "$ENT_SHA" ] || cannot_start "Could not resolve ENT \`$ENT_CODE_REF\` to a commit."
+
           # Against ENT main, test the PR merged into OSS main: a stale branch would miss OSS code ENT main already uses.
-          OSS_REF="$HEAD_REF"
+          TESTED_SHA="$HEAD_SHA"
           if [ "$ENT_CODE_REF" = "main" ] && [ "$BASE_REF" = "main" ]; then
-            MERGEABLE=""
+            MERGEABLE=""; MERGE_SHA=""; PR_HEAD=""
             for _ in 1 2 3 4 5; do
-              MERGEABLE=$(gh api "repos/openobserve/openobserve/pulls/$PR" -q '.mergeable' 2>/dev/null || echo "")
+              read -r MERGEABLE MERGE_SHA PR_HEAD < <(gh api "repos/openobserve/openobserve/pulls/$PR" -q '"\(.mergeable) \(.merge_commit_sha // "-") \(.head.sha)"' 2>/dev/null || echo "")
               if [ "$MERGEABLE" = "true" ] || [ "$MERGEABLE" = "false" ]; then break; fi
               sleep 6
             done
-            if [ "$MERGEABLE" = "true" ]; then
-              OSS_REF="refs/pull/$PR/merge"
+            # The merge commit belongs to this push only when the same response reports this head.
+            if [ "$MERGEABLE" = "true" ] && [[ "$MERGE_SHA" =~ ^[0-9a-f]{40}$ ]] && [ "$PR_HEAD" = "$HEAD_SHA" ]; then
+              TESTED_SHA="$MERGE_SHA"
               SISTER_NOTE="$SISTER_NOTE Tested as this PR merged into OSS \`main\`."
             else
-              echo "::warning::PR #$PR is not cleanly mergeable into main (mergeable=$MERGEABLE) — testing the branch head as-is."
+              echo "::warning::PR #$PR has no merge commit for head $HEAD_SHA (mergeable=$MERGEABLE, head=$PR_HEAD) — testing the branch head as-is."
             fi
           fi
 
-          # Stamp the time BEFORE dispatch so correlation can reject stale prior runs for this PR.
+          # The engine checks out oss_branch, so a commit SHA there makes it test exactly what its title names.
+          MATCH="Playwright E2E Crosscheck — OSS PR #$PR ("
+          # The engine commit is whatever ENT_REF points at when the run starts, so it is read from the title, not predicted.
+          TITLE="${MATCH}$TESTED_SHA) oss=$HEAD_SHA ent=$ENT_SHA engine="
+          newest_run() {
+            gh run list --repo "$REPO" --workflow "$WF" --event workflow_dispatch -L 40 --json databaseId,displayTitle,createdAt,event 2>/dev/null \
+              | jq -r --arg t "$TITLE" --arg old "${MATCH}$TESTED_SHA)" --argjson min "$1" \
+                '[.[] | select(.event == "workflow_dispatch" and ((.displayTitle | startswith($t) and (ltrimstr($t) | test("^[0-9a-f]{40}$"))) or .displayTitle == $old) and (.createdAt | fromdateiso8601) >= $min)] | sort_by(.databaseId) | last | .databaseId // empty' 2>/dev/null || true
+          }
           DISPATCH_TS=$(date -u +%s)
-          echo "::notice::Dispatching ENT engine ($REPO@$ENT_REF, code=$ENT_CODE_REF, oss=$OSS_REF) for OSS PR #$PR ($HEAD_REF)…"
+          echo "::notice::Dispatching ENT engine ($REPO@$ENT_REF, code=$ENT_CODE_REF@$ENT_SHA, oss=$TESTED_SHA) for OSS PR #$PR ($HEAD_REF)…"
           gh workflow run "$WF" --repo "$REPO" --ref "$ENT_REF" \
-            -f oss_branch="$OSS_REF" \
+            -f oss_branch="$TESTED_SHA" \
+            -f oss_head_ref="$HEAD_REF" \
             -f oss_pr="$PR" \
             -f oss_sha="$HEAD_SHA" \
-            -f enterprise_ref="$ENT_CODE_REF"
-
-          # Correlate by PR-scoped run-name ("Playwright E2E Crosscheck — OSS PR #<PR> ("; the "(" boundary keeps
-          # #12 from matching #123) AND createdAt >= dispatch time (minus 60s clock-skew), so a stale
-          # prior run for this PR is never picked. Take the NEWEST qualifying run.
-          MATCH="OSS PR #$PR ("
-          MIN_TS=$((DISPATCH_TS - 60))
+            -f enterprise_ref="$ENT_SHA"
           RUN_ID=""
-          sleep 8   # let the dispatched run register before the first lookup
-          for i in $(seq 1 30); do            # ~5 min to appear
-            RUN_ID=$(gh run list --repo "$REPO" --workflow "$WF" -L 40 \
-              --json databaseId,displayTitle,createdAt \
-              -q "[.[] | select(.displayTitle | contains(\"$MATCH\")) | select((.createdAt|fromdateiso8601) >= $MIN_TS)] | sort_by(.createdAt) | last | .databaseId" 2>/dev/null || echo "")
-            if [ -n "$RUN_ID" ] && [ "$RUN_ID" != "null" ]; then break; fi
-            sleep 10
+          sleep 8
+          for _ in $(seq 1 30); do
+            RUN_ID=$(newest_run "$((DISPATCH_TS - 60))")
+            if [[ "$RUN_ID" =~ ^[0-9]+$ ]]; then break; fi
+            RUN_ID=""; sleep 10
           done
-          if [ -z "$RUN_ID" ] || [ "$RUN_ID" = "null" ]; then
-          sticky "### 🚫 Playwright E2E Crosscheck — could not start
-
-          $MARKER
-          Dispatching the enterprise e2e engine failed or the run never appeared (check \`ORG_ADMIN_TOKEN\` / \`ENT_GATE_REF=$ENT_REF\`). The gate stays red until it runs — re-push or re-label to retry.
-
-          $SISTER_NOTE"
-            echo "::error::Could not locate the dispatched ENT run within 5 min — failing the gate (unverified)."
-            exit 1
-          fi
+          [ -n "$RUN_ID" ] || cannot_start "Dispatching the enterprise e2e engine failed or the run never appeared within 5 min (check \`ORG_ADMIN_TOKEN\` / \`ENT_GATE_REF=$ENT_REF\`)."
 
           RUN_URL="https://github.com/$REPO/actions/runs/$RUN_ID"
           echo "::notice::Tracking ENT run: $RUN_URL"
 
+          report_pass() {
+          sticky "### ✅ Playwright E2E Crosscheck — passed
+
+          $MARKER
+          The enterprise-only e2e specs passed against this PR. $SISTER_NOTE
+
+          [ENT run]($RUN_URL)"
+            echo "::notice::✅ Enterprise e2e specs passed against this PR."
+          }
           sticky "### 🔄 Playwright E2E Crosscheck — running
 
           $MARKER
@@ -259,15 +307,17 @@ jobs:
 
           [ENT run]($RUN_URL)"
 
-          # A lost runner is infra, not the PR: re-run the failed ENT job once before reporting it.
-          ATTEMPT=1
+          # A lost runner is infra, not the PR: re-run only the lost ENT jobs, up to 3 attempts of the run in all.
+          MAX_ATTEMPTS=3; RETRIES=0
+          # Poll budgets follow the engine's job timeouts: subset 10 + build 75 + shard 45 + aggregate 10 + report 10 min, plus 15 min of runner queueing.
+          SHARD_MIN=45; RUN_BUDGET_MIN=$((10 + 75 + SHARD_MIN + 10 + 10 + 15)); RERUN_BUDGET_MIN=$((SHARD_MIN + 10 + 10 + 15))
+          DEADLINE=$((SECONDS + RUN_BUDGET_MIN * 60))
           while :; do
-            # Poll to completion (~75 min budget — covers a cold-cache ENT build+run worst case).
             STATUS=""; CONCL=""
-            for i in $(seq 1 300); do           # 300 * 15s = 75 min
+            while :; do
               read -r STATUS CONCL < <(gh run view "$RUN_ID" --repo "$REPO" \
                 --json status,conclusion -q '.status + " " + (.conclusion // "")' 2>/dev/null || echo "unknown ")
-              if [ "$STATUS" = "completed" ]; then break; fi
+              if [ "$STATUS" = "completed" ] || [ "$SECONDS" -ge "$DEADLINE" ]; then break; fi
               sleep 15
             done
 
@@ -281,50 +331,68 @@ jobs:
               exit 1
             fi
 
-            if [ "$CONCL" = "success" ]; then
-          sticky "### ✅ Playwright E2E Crosscheck — passed
+            if [ "$CONCL" = "success" ]; then report_pass; exit 0; fi
+
+            # A run of this same test cancels ours (engine concurrency), so the gate follows it; anything else never finished the specs.
+            if [ "$CONCL" = "cancelled" ] || [ "$CONCL" = "skipped" ] || [ -z "$CONCL" ]; then
+              NEXT=$(newest_run "$((DISPATCH_TS - 60))")
+              if [[ "$NEXT" =~ ^[0-9]+$ ]] && [ "$NEXT" -gt "$RUN_ID" ]; then
+                echo "::notice::ENT run $RUN_ID was cancelled by run $NEXT of this same test — following it."
+                RUN_ID="$NEXT"; RUN_URL="https://github.com/$REPO/actions/runs/$RUN_ID"; DEADLINE=$((SECONDS + RUN_BUDGET_MIN * 60))
+                continue
+              fi
+          sticky "### 🚫 Playwright E2E Crosscheck — enterprise run was cancelled, re-run needed
 
           $MARKER
-          The enterprise-only e2e specs passed against this PR. $SISTER_NOTE
+          The [enterprise e2e run]($RUN_URL) was cancelled (conclusion: \`${CONCL:-none}\`) and no newer run of this same test replaced it, so the specs did not finish. Re-run the failed job of this check.
 
-          [ENT run]($RUN_URL)"
-              echo "::notice::✅ Enterprise e2e specs passed against this PR."
-              exit 0
+          $SISTER_NOTE"
+              echo "::error::ENT run concluded '${CONCL:-none}' with no newer run of this same test — failing the gate (unverified)."
+              exit 1
             fi
 
-            # cancelled/skipped/empty ≈ a newer push superseded this run (engine cancel-in-progress).
-            # NOT a failure — the newer run is authoritative and updates the sticky itself. Defer.
-            if [ "$CONCL" = "cancelled" ] || [ "$CONCL" = "skipped" ] || [ -z "$CONCL" ]; then
-              echo "::notice::ENT run concluded '$CONCL' (likely superseded by a newer push) — deferring, not failing."
-              exit 0
-            fi
-
-            # Genuine failure — distinguish an enterprise BUILD failure (compile) from SPEC failures,
-            # and for specs list the failing files from the engine's failed-specs artifact.
+            # A build failure and spec failures need different fixes, so the report tells them apart.
             BUILD_CONCL=$(gh run view "$RUN_ID" --repo "$REPO" --json jobs -q '.jobs[]|select(.name=="build_binary")|.conclusion' 2>/dev/null || echo "")
             # Single-job re-runs spread shard results over attempts, so each test job counts by its latest attempt; an aggregate counts only without shards.
             TEST_JOBS=$(gh api --paginate "repos/$REPO/actions/runs/$RUN_ID/jobs?filter=all&per_page=100" --jq '.jobs[]' 2>/dev/null | jq -s '[.[]|select(.name=="ent_gate_tests" or (.name|startswith("ent_gate_tests (")))] | group_by(.name) | map(max_by(.run_attempt)) | (map(select(.name|startswith("ent_gate_tests (")))) as $s | if ($s|length) > 0 then $s else . end' 2>/dev/null || echo '[]')
             TEST_CONCL=$(jq -r '[.[].conclusion]|if index("failure") then "failure" elif length > 0 then .[0] // "" else "" end' <<<"$TEST_JOBS")
-            # A test job that failed with no failed step lost its runner; one with a failed step had spec failures.
-            TEST_LOST=$(jq '[.[]|select(.conclusion=="failure" and ([.steps[]?|select(.conclusion=="failure")]|length)==0)]|length' <<<"$TEST_JOBS")
-            TEST_SPEC_FAILED=$(jq '[.[]|select(.conclusion=="failure" and ([.steps[]?|select(.conclusion=="failure")]|length)>0)]|length' <<<"$TEST_JOBS")
+            # A lost runner leaves its step running: no failed or cancelled step, and it ended before the job timeout, which cancels the step.
+            FAILED_JOBS=$(jq -c --argjson limit "$SHARD_MIN" '[.[] | select(.conclusion == "failure") | {id, lost: (([.steps[]? | select(.conclusion == "failure" or .conclusion == "cancelled")] | length) == 0 and .started_at != null and .completed_at != null and ((.completed_at | fromdateiso8601) - (.started_at | fromdateiso8601)) < ($limit * 60))}]' <<<"$TEST_JOBS" 2>/dev/null || echo '[]')
+            LOST_IDS=$(jq -r '.[] | select(.lost) | .id' <<<"$FAILED_JOBS")
+            TEST_LOST=$(jq '[.[] | select(.lost)] | length' <<<"$FAILED_JOBS")
+            TEST_SPEC_FAILED=$(jq '[.[] | select(.lost | not)] | length' <<<"$FAILED_JOBS")
             TEST_LOST=${TEST_LOST:-0}; TEST_SPEC_FAILED=${TEST_SPEC_FAILED:-0}
+            RUN_ATTEMPT=$(gh api "repos/$REPO/actions/runs/$RUN_ID" -q '.run_attempt' 2>/dev/null || echo "$MAX_ATTEMPTS")
 
-            if [ "$TEST_CONCL" = "failure" ] && [ "$TEST_LOST" != "0" ] && [ "$ATTEMPT" = "1" ]; then
-              ATTEMPT=2
-              echo "::warning::ENT test runner was lost — re-running the failed ENT job once."
-              if gh run rerun "$RUN_ID" --repo "$REPO" --failed; then
+            # A re-run would repeat the jobs with spec failures too, so only a lost-runner-only failure is retried.
+            if [ "$TEST_CONCL" = "failure" ] && [ "$TEST_LOST" != "0" ] && [ "$TEST_SPEC_FAILED" = "0" ] \
+              && [ "$RUN_ATTEMPT" -lt "$MAX_ATTEMPTS" ] && [ "$RETRIES" -lt $((MAX_ATTEMPTS - 1)) ]; then
+              RETRIES=$((RETRIES + 1))
+              echo "::warning::ENT test runner lost in $TEST_LOST job(s) — re-running them (attempt $((RUN_ATTEMPT + 1)) of $MAX_ATTEMPTS)."
+              # The jobs API re-runs one job; a run can't take a second job re-run while the first is going, and with no spec failures --failed holds only lost jobs.
+              if [ "$TEST_LOST" = "1" ]; then
+                RERUN=(gh api -X POST "repos/$REPO/actions/jobs/$LOST_IDS/rerun")
+              else
+                RERUN=(gh run rerun "$RUN_ID" --repo "$REPO" --failed)
+              fi
+              if "${RERUN[@]}" >/dev/null; then
           sticky "### 🔄 Playwright E2E Crosscheck — runner lost, re-running
 
           $MARKER
-          The enterprise test runner stopped before the specs finished (infra, not this PR), so the failed job is being re-run automatically.
+          The enterprise test runner stopped before the specs finished (infra, not this PR), so the lost job is being re-run automatically (attempt $((RUN_ATTEMPT + 1)) of $MAX_ATTEMPTS).
           $SISTER_NOTE
 
           [ENT run]($RUN_URL)"
-                sleep 20
+                # The poll must not read the finished attempt as the re-run's result.
+                for _ in $(seq 1 12); do
+                  NOW_ATTEMPT=$(gh api "repos/$REPO/actions/runs/$RUN_ID" -q '.run_attempt' 2>/dev/null || echo "$RUN_ATTEMPT")
+                  if [ "$NOW_ATTEMPT" -gt "$RUN_ATTEMPT" ]; then break; fi
+                  sleep 5
+                done
+                DEADLINE=$((SECONDS + RERUN_BUDGET_MIN * 60))
                 continue
               fi
-              echo "::warning::Could not re-run the ENT job — reporting the lost runner."
+              echo "::warning::Could not re-run the lost ENT job(s) — reporting the lost runner."
             fi
             break
           done
@@ -334,7 +402,10 @@ jobs:
 
           rm -rf /tmp/fs; SPEC_LIST=""
           if [ "$TEST_CONCL" = "failure" ] && gh run download "$RUN_ID" --repo "$REPO" -n failed-specs -D /tmp/fs >/dev/null 2>&1 && [ -f /tmp/fs/failed-specs.txt ]; then
-            SPEC_LIST=$(sed '/^[[:space:]]*$/d; s/^/- `/; s/$/`/' /tmp/fs/failed-specs.txt)
+            # A comment body is capped at 65536 characters, so a huge list would make the update fail.
+            SPEC_LIST=$(awk '!/^[[:space:]]*$/ && n < 50 { n++; print "- `" substr($0, 1, 200) "`" }' /tmp/fs/failed-specs.txt)
+            SPEC_N=$(grep -cv '^[[:space:]]*$' /tmp/fs/failed-specs.txt || true)
+            if [ "${SPEC_N:-0}" -gt 50 ]; then SPEC_LIST="$SPEC_LIST"$'\n'"- … $((SPEC_N - 50)) more"; fi
           fi
 
           # Spec failures in another shard outrank a lost runner; the artifact only lists their files.
@@ -342,7 +413,7 @@ jobs:
           sticky "### ⚠️ Playwright E2E Crosscheck — runner lost, re-run needed
 
           $MARKER
-          The enterprise test runner stopped before the specs finished (infra, not this PR), and the automatic re-run didn't get past it. Re-run the failed job of this check.
+          The enterprise test runner stopped before the specs finished (infra, not this PR), and the automatic re-runs didn't get past it. Re-run the failed job of this check.
 
           $SISTER_NOTE · [ENT run]($RUN_URL)"
           elif [ "$TEST_CONCL" = "failure" ]; then
diff --git a/.github/workflows/js-license-checker.yml b/.github/workflows/js-license-checker.yml
index 79e9814b79..79441f440d 100644
--- a/.github/workflows/js-license-checker.yml
+++ b/.github/workflows/js-license-checker.yml
@@ -23,7 +23,7 @@ jobs:
   js-license-check:
     # Paid CI runs only on PRs carrying the 'ready-for-ci' label; the merge queue runs unit tests on the merged code.
     if: ${{ github.event_name != 'pull_request' || (contains(github.event.pull_request.labels.*.name, 'ready-for-ci') && github.event.pull_request.draft == false) }}
-    runs-on: ubicloud-standard-4
+    runs-on: eks-openobserve-standard-4
     timeout-minutes: 10
     steps:
       - name: Checkout latest code
diff --git a/.github/workflows/mobile-sdk-e2e.yml b/.github/workflows/mobile-sdk-e2e.yml
index fbbbc78ace..a17a9139f3 100644
--- a/.github/workflows/mobile-sdk-e2e.yml
+++ b/.github/workflows/mobile-sdk-e2e.yml
@@ -486,7 +486,7 @@ jobs:
         with: { distribution: temurin, java-version: "17" }
       - uses: actions/setup-node@v4
         with: { node-version: "20" }
-      - uses: gradle/actions/setup-gradle@3f5f9adaf7d9fecd50b5935e54106014257a94e6 # v6.4.0
+      - uses: gradle/actions/setup-gradle@8da46b539cd8fe6ab27ca75128919a18d757604c # v6.4.1
       - name: Install Maestro
         run: |
           curl -Ls "https://get.maestro.mobile.dev" | bash
diff --git a/.github/workflows/playwright.yml b/.github/workflows/playwright.yml
index 3412776212..3bd77dea95 100644
--- a/.github/workflows/playwright.yml
+++ b/.github/workflows/playwright.yml
@@ -780,18 +780,32 @@ jobs:
           if-no-files-found: ignore
           retention-days: 1
 
+      # Playwright retries only a failed test, so a retry in a passing shard is a flaky test whose first failure the server log explains.
+      - name: Detect flaky tests
+        id: flaky
+        if: success()
+        continue-on-error: true
+        run: |
+          flaky=false
+          for z in tests/ui-testing/blob-report/*.zip; do
+            [ -f "$z" ] || continue
+            retries=$(unzip -p "$z" report.jsonl 2>/dev/null | grep -cE '"method":"onTestBegin".*"retry":[1-9]' || true)
+            if [ "${retries:-0}" -gt 0 ]; then flaky=true; echo "$z: $retries retried test attempt(s)"; fi
+          done
+          echo "flaky=$flaky" >> "$GITHUB_OUTPUT"
+
       - name: Show OpenObserve log tail
-        if: failure()
+        if: failure() || steps.flaky.outputs.flaky == 'true'
         run: tail -n 200 o2.log || true
 
       - name: Upload OpenObserve log
-        if: failure()
+        if: failure() || steps.flaky.outputs.flaky == 'true'
         continue-on-error: true
         uses: actions/upload-artifact@v4
         with:
           name: o2-log-${{ matrix.testfolder }}-attempt-${{ github.run_attempt }}
           path: o2.log
-          retention-days: 1
+          retention-days: 7
           if-no-files-found: ignore
 
   merge_reports:
@@ -1154,6 +1168,8 @@ jobs:
           # 2. Nothing Playwright-relevant changed → nothing ran → allow.
           if [ "${{ needs.check_changes.outputs.has_changes }}" != "true" ]; then
             echo "✅ No Playwright-relevant changes — suite not required."
+            echo "::notice title=Playwright tests skipped::No Playwright-relevant changes — suite did not run."
+            echo "### ⏭️ Playwright suite skipped — no Playwright-relevant changes in this PR, so no tests ran." >> "$GITHUB_STEP_SUMMARY"
             exit 0
           fi
 
diff --git a/.github/workflows/stuck-run-reaper.yml b/.github/workflows/stuck-run-reaper.yml
index 1999de9446..13c81dc154 100644
--- a/.github/workflows/stuck-run-reaper.yml
+++ b/.github/workflows/stuck-run-reaper.yml
@@ -53,7 +53,7 @@ jobs:
         env:
           # Comma-separated workflow file names to police (all use eks-openobserve-* runners).
           # Release workflows are intentionally excluded — a stuck release build is left for a human.
-          WORKFLOWS: "playwright.yml,playwright_bugfix_regression.yml"
+          WORKFLOWS: "playwright.yml,playwright_bugfix_regression.yml,unit-tests.yml,js-license-checker.yml,api_bugfix_regression.yml"
           DEFAULT_THRESHOLD_MINUTES: "60"
           # Separate, much longer cap for "zombie" runs stuck with no jobs ever dispatched
           # (these never held a runner, so 60m would be too aggressive — a brief GitHub
diff --git a/.github/workflows/unit-tests.yml b/.github/workflows/unit-tests.yml
index 191ddef6fa..2f3a2c0e75 100644
--- a/.github/workflows/unit-tests.yml
+++ b/.github/workflows/unit-tests.yml
@@ -67,7 +67,7 @@ jobs:
     needs: [check_changes]
     if: needs.check_changes.outputs.has_backend_changes == 'true'
     runs-on:
-      labels: ubicloud-standard-8
+      labels: eks-openobserve-standard-8
     permissions:
       contents: read
     steps:
@@ -92,6 +92,10 @@ jobs:
       - name: Install Protoc
         run: bash ./.github/protoc.sh
 
+      # The EKS runner image has no libclang, which bindgen needs to build custom-labels.
+      - name: Install libclang
+        run: sudo apt-get update && sudo apt-get install -y libclang-dev
+
       - name: Simulate building frontend code
         run: mkdir -p web/dist && touch web/dist/index.html
 
@@ -141,7 +145,7 @@ jobs:
           toolchain: nightly-2026-10-24
           targets: x86_64-unknown-linux-gnu
 
-      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+      - uses: taiki-e/install-action@1919c4a95903d2c33e4a221102edca87309fc14b # v2.89.0
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
@@ -210,7 +214,7 @@ jobs:
           toolchain: nightly-2026-10-24
           targets: x86_64-unknown-linux-gnu
 
-      - uses: taiki-e/install-action@1e29709c0ec63babbe8f266397a465f29a825f91 # v2.87.31
+      - uses: taiki-e/install-action@1919c4a95903d2c33e4a221102edca87309fc14b # v2.89.0
         env:
           GITHUB_TOKEN: ${{ github.token }}
         with:
@@ -272,7 +276,7 @@ jobs:
       matrix:
         shard: [1, 2, 3, 4]
     runs-on:
-      labels: ubicloud-standard-8
+      labels: eks-openobserve-standard-8
     permissions:
       contents: read
 
@@ -290,7 +294,7 @@ jobs:
 
       - name: Restore node_modules
         id: nm
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6
         with:
           path: web/node_modules
           key: node-modules-${{ runner.os }}-node24-${{ hashFiles('web/package-lock.json', 'web/package.json', 'web/patches/**') }}
@@ -304,7 +308,7 @@ jobs:
       # Only main saves it: a PR-saved cache is visible to that PR alone and fills the 10 GB repo cache.
       - name: Save node_modules
         if: github.ref == 'refs/heads/main' && steps.nm.outputs.cache-hit != 'true'
-        uses: actions/cache/save@v4
+        uses: actions/cache/save@v6
         with:
           path: web/node_modules
           key: node-modules-${{ runner.os }}-node24-${{ hashFiles('web/package-lock.json', 'web/package.json', 'web/patches/**') }}
@@ -333,7 +337,8 @@ jobs:
     needs: [check_changes, ui_unit_test_shards]
     if: always() && needs.check_changes.outputs.has_ui_changes == 'true'
     timeout-minutes: 20
-    runs-on: ubuntu-latest
+    runs-on:
+      labels: eks-openobserve-standard-4
     permissions:
       contents: read
 
@@ -354,7 +359,7 @@ jobs:
 
       - name: Restore node_modules
         id: nm
-        uses: actions/cache/restore@v4
+        uses: actions/cache/restore@v6
         with:
           path: web/node_modules
           key: node-modules-${{ runner.os }}-node24-${{ hashFiles('web/package-lock.json', 'web/package.json', 'web/patches/**') }}
@@ -379,7 +384,7 @@ jobs:
     needs: [check_changes]
     if: needs.check_changes.outputs.has_ui_changes == 'true'
     runs-on:
-      labels: ubicloud-standard-8
+      labels: eks-openobserve-standard-8
     permissions:
       contents: read
 
diff --git a/.gitignore b/.gitignore
index 25a38a8e65..2515c90a65 100644
--- a/.gitignore
+++ b/.gitignore
@@ -3,6 +3,7 @@
 .history
 /.idea/
 .vscode/
+/.zed/
 
 # ---------- node / web ----------
 node_modules/
diff --git a/Cargo.lock b/Cargo.lock
index 451cb5b4fb..e6f6936ecc 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8430,6 +8430,7 @@ dependencies = [
  "tikv-jemalloc-ctl",
  "time",
  "tokio",
+ "tokio-util",
  "tonic",
  "tracing",
  "tracing-opentelemetry",
diff --git a/Cargo.toml b/Cargo.toml
index 015d785250..b7ecf476e6 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -586,6 +586,7 @@ tiktoken-rs = "0.9.1"
 time = "0.3"
 tokio = { version = "1", features = ["full"] }
 tokio-stream = "0.1"
+tokio-util = "0.7"
 tonic = { version = "0.14", features = [
     "gzip",
     "zstd",
diff --git a/cross/Dockerfile.ent.musl b/cross/Dockerfile.ent.musl
index 40bb8e2539..31da190ff8 100644
--- a/cross/Dockerfile.ent.musl
+++ b/cross/Dockerfile.ent.musl
@@ -11,6 +11,7 @@ RUN cp protoc/bin/protoc /usr/local/bin/
 RUN cp -r protoc/include/google /usr/local/include/
 
 COPY --from=ent ./ /home/runner/work/o2-enterprise/o2-enterprise/o2-enterprise
+COPY --from=features ./ /home/runner/work/o2-enterprise/o2-enterprise/feature-definitions
 RUN test -n "${CROSS_SYSROOT:?CROSS_SYSROOT must be set by the base image}" && \
     { test -d "${CROSS_SYSROOT%/}/usr/include" || \
     { echo "Missing compiler include directory: ${CROSS_SYSROOT%/}/usr/include" >&2; exit 1; }; } && \
diff --git a/opencode.ci.jsonc b/opencode.ci.jsonc
index 339d07aef0..b3a3dc64fa 100644
--- a/opencode.ci.jsonc
+++ b/opencode.ci.jsonc
@@ -1,7 +1,5 @@
 {
-  // Loaded from the trusted base-branch checkout via OPENCODE_CONFIG when REVIEW_OPENCODE_CONFIG=ci-full.
-  // Same provider, model and agents as opencode.jsonc, but every tool (shell, edit, webfetch, ...) is allowed
-  // and nothing asks for permission. Keep the two files in step apart from the agent permissions.
+  // ci-full, loaded from the trusted base checkout: keep in step with opencode.jsonc except agent permissions (file tools, shell allowlist, no prompts).
   "$schema": "https://opencode.ai/config.json",
 
   // Nothing here may reach into the PR tree: no `instructions`, no `skills`, no plugins.
@@ -28,8 +26,14 @@
       "models": {
         "claude-sonnet-5-5": {
           "name": "Claude Sonnet 5.5",
-          // Selected with REVIEW_MODEL_VARIANT=high; opencode sends adaptive thinking and "output_config": { "effort": "high" }.
-          "variants": [{ "id": "high", "settings": { "thinking": { "type": "adaptive" }, "effort": "high" } }],
+          // REVIEW_MODEL_VARIANT and REVIEW_COORDINATOR_VARIANT pick one; opencode sends adaptive thinking and "output_config": { "effort": "<id>" }.
+          "variants": [
+            { "id": "low", "settings": { "thinking": { "type": "adaptive" }, "effort": "low" } },
+            { "id": "medium", "settings": { "thinking": { "type": "adaptive" }, "effort": "medium" } },
+            { "id": "high", "settings": { "thinking": { "type": "adaptive" }, "effort": "high" } },
+            { "id": "xhigh", "settings": { "thinking": { "type": "adaptive" }, "effort": "xhigh" } },
+            { "id": "max", "settings": { "thinking": { "type": "adaptive" }, "effort": "max" } }
+          ],
           "limit": { "context": 1000000, "output": 128000 }
         }
       }
@@ -46,7 +50,7 @@
       "models": {
         "deepseek-flash": {
           "name": "DeepSeek-V4.1-Flash",
-          // Selected with REVIEW_MODEL_VARIANT=max (the workflow matrix); opencode sends "reasoning_effort": "max".
+          // Selected with REVIEW_MODEL_VARIANT=max; opencode sends "reasoning_effort": "max".
           "variants": [{ "id": "max", "settings": { "reasoningEffort": "max" } }],
           "limit": { "context": 1048576, "output": 393216 }
         }
@@ -56,52 +60,907 @@
 
   "model": "anthropic-review/claude-sonnet-5-5",
 
-  // One allow-all rule: it comes after opencode's built-in defaults (last match wins), so no tool ever asks.
+  // Last match wins after opencode's built-in defaults, so nothing asks; the shell allowlist guards cost, not secrets (see README).
   "agents": {
     "ai-review-security": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     },
     "ai-review-correctness": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     },
     "ai-review-code-quality": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     },
     "ai-review-performance": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     },
     "ai-review-documentation": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     },
     "ai-review-release": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     },
     "ai-review-frontend": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     },
     "ai-review-qa": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     },
     "ai-review-coordinator": {
       "mode": "primary",
       "model": "anthropic-review/claude-sonnet-5-5",
-      "permissions": [{ "action": "*", "resource": "*", "effect": "allow" }]
+      "permissions": [
+        { "action": "*", "resource": "*", "effect": "allow" },
+        { "action": "webfetch", "resource": "*", "effect": "deny" },
+        { "action": "websearch", "resource": "*", "effect": "deny" },
+        { "action": "subagent", "resource": "*", "effect": "deny" },
+        { "action": "question", "resource": "*", "effect": "deny" },
+        { "action": "execute", "resource": "*", "effect": "deny" },
+        { "action": "skill", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "*", "effect": "deny" },
+        { "action": "shell", "resource": "git diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git log *", "effect": "allow" },
+        { "action": "shell", "resource": "git show *", "effect": "allow" },
+        { "action": "shell", "resource": "git blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git status *", "effect": "allow" },
+        { "action": "shell", "resource": "git rev-parse *", "effect": "allow" },
+        { "action": "shell", "resource": "git merge-base *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -p *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -t *", "effect": "allow" },
+        { "action": "shell", "resource": "git cat-file -s *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager diff *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager log *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager show *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager blame *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager ls-files *", "effect": "allow" },
+        { "action": "shell", "resource": "git --no-pager status *", "effect": "allow" },
+        { "action": "shell", "resource": "rg *", "effect": "allow" },
+        { "action": "shell", "resource": "grep *", "effect": "allow" },
+        { "action": "shell", "resource": "cat *", "effect": "allow" },
+        { "action": "shell", "resource": "ls *", "effect": "allow" },
+        { "action": "shell", "resource": "head *", "effect": "allow" },
+        { "action": "shell", "resource": "tail *", "effect": "allow" },
+        { "action": "shell", "resource": "find *", "effect": "allow" },
+        { "action": "shell", "resource": "sed -n *", "effect": "allow" },
+        { "action": "shell", "resource": "wc *", "effect": "allow" },
+        { "action": "shell", "resource": "tail -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -f *", "effect": "deny" },
+        { "action": "shell", "resource": "tail -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail * -F *", "effect": "deny" },
+        { "action": "shell", "resource": "tail --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * --follow*", "effect": "deny" },
+        { "action": "shell", "resource": "find -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -exec *", "effect": "deny" },
+        { "action": "shell", "resource": "find -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -execdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -ok *", "effect": "deny" },
+        { "action": "shell", "resource": "find -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -okdir *", "effect": "deny" },
+        { "action": "shell", "resource": "find -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -delete *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprint0 *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fprintf *", "effect": "deny" },
+        { "action": "shell", "resource": "find -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "find * -fls *", "effect": "deny" },
+        { "action": "shell", "resource": "cat /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat * /*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *../*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "cat *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "head /*", "effect": "deny" },
+        { "action": "shell", "resource": "head * /*", "effect": "deny" },
+        { "action": "shell", "resource": "head *../*", "effect": "deny" },
+        { "action": "shell", "resource": "head *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "head *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "tail /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail * /*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *../*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "tail *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "grep /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep * /*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *../*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "grep *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "rg /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg * /*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *../*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "rg *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "sed /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed * /*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *../*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "sed *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "wc /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc * /*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *../*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *=/*", "effect": "deny" },
+        { "action": "shell", "resource": "wc *environ*", "effect": "deny" },
+        { "action": "shell", "resource": "*>*", "effect": "deny" }
+      ]
     }
   }
 }
diff --git a/opencode.jsonc b/opencode.jsonc
index 18fef5e1a1..daf03d4660 100644
--- a/opencode.jsonc
+++ b/opencode.jsonc
@@ -27,8 +27,14 @@
       "models": {
         "claude-sonnet-5-5": {
           "name": "Claude Sonnet 5.5",
-          // Selected with REVIEW_MODEL_VARIANT=high; opencode sends adaptive thinking and "output_config": { "effort": "high" }.
-          "variants": [{ "id": "high", "settings": { "thinking": { "type": "adaptive" }, "effort": "high" } }],
+          // REVIEW_MODEL_VARIANT and REVIEW_COORDINATOR_VARIANT pick one; opencode sends adaptive thinking and "output_config": { "effort": "<id>" }.
+          "variants": [
+            { "id": "low", "settings": { "thinking": { "type": "adaptive" }, "effort": "low" } },
+            { "id": "medium", "settings": { "thinking": { "type": "adaptive" }, "effort": "medium" } },
+            { "id": "high", "settings": { "thinking": { "type": "adaptive" }, "effort": "high" } },
+            { "id": "xhigh", "settings": { "thinking": { "type": "adaptive" }, "effort": "xhigh" } },
+            { "id": "max", "settings": { "thinking": { "type": "adaptive" }, "effort": "max" } }
+          ],
           "limit": { "context": 1000000, "output": 128000 }
         }
       }
@@ -45,7 +51,7 @@
       "models": {
         "deepseek-flash": {
           "name": "DeepSeek-V4.1-Flash",
-          // Selected with REVIEW_MODEL_VARIANT=max (the workflow matrix); opencode sends "reasoning_effort": "max".
+          // Selected with REVIEW_MODEL_VARIANT=max; opencode sends "reasoning_effort": "max".
           "variants": [{ "id": "max", "settings": { "reasoningEffort": "max" } }],
           "limit": { "context": 1048576, "output": 393216 }
         }
diff --git a/scripts/ai-review/README.md b/scripts/ai-review/README.md
index 52c78f05ee..b1b3bbb36d 100644
--- a/scripts/ai-review/README.md
+++ b/scripts/ai-review/README.md
@@ -1,7 +1,7 @@
 # AI Code Review (`scripts/ai-review`)
 
 Automated PR review that posts a single consolidated comment on every pull request. Driven by
-`.github/workflows/ai-code-review.yml` → `run-review.mjs`, using Claude Sonnet 5.5 (`anthropic-review/claude-sonnet-5-5`) at high effort with adaptive thinking via `opencode`.
+`.github/workflows/ai-code-review.yml` → `run-review.mjs`, using Claude Sonnet 5.5 (`anthropic-review/claude-sonnet-5-5`) with adaptive thinking via `opencode`, at `high` effort unless the `AI_REVIEW_EFFORT` variable says otherwise (see Effort below).
 
 The posted comment is branded **OpenObserve Code Reviewer**. Branding is *cosmetic + identity
 only* — it does not change what the reviewer finds or decides.
@@ -18,12 +18,12 @@ whose marker still names the provider, such as o2-enterprise's older one, keeps
 ## How it works (one paragraph)
 
 On each PR the workflow fetches the diff, filters noise, picks a risk tier (`trivial` / `lite` /
-`full`), runs the tier's specialist agents (security, correctness, code-quality, performance,
+`full` / `test-only` / `ci-only`), runs the tier's specialist agents (security, correctness, code-quality, performance,
 documentation) in parallel — plus any *conditional* agent whose domain the diff touches (frontend,
 qa, and release for migrations, `Cargo.toml`/`package.json`, `src/config/src/config.rs`, `.github/`,
 `deploy/` and Docker files) — and a coordinator consolidates their findings into one comment with
 a decision. Correctness owns the PR's behaviour end to end (callers, sibling
-paths, state, the tests that prove the change); every tier runs it. Before the agents start, the
+paths, state, the tests that prove the change); every tier but `ci-only` runs it. Before the agents start, the
 runner greps the PR tree for where each symbol the diff changes is used outside the diff, and for
 other definitions of the same name (`src/impact.mjs`), and gives that map to every reviewer.
 Security and correctness also get `openobserve-checklist.md`, the defect classes that recur in
@@ -36,10 +36,54 @@ so one pass's misses can be another's catches (backtesting on an earlier model s
 findings two catch). The variable `AI_REVIEW_COLD_PASSES` sets the count (default `2`, clamped to
 1–3; `src/passes.mjs`). The coordinator gets every pass's report labelled `<Reviewer>, pass N/M`
 and keeps a finding raised by any pass, merging duplicates; the fallback comment unions the passes
-and folds findings at the same file and nearby line when one title's words contain the other's (two P0/P1 blockers fold only on the same title). An area counts as
+and folds findings at the same file and nearby line when one title's words contain the other's (two P0/P1 findings fold only on the same title). An area counts as
 reviewed when any of its passes finished, and the comment notes a lost pass. Each pass is billed,
 so the review costs about M times one pass; reviewer spans carry `review.pass`.
 
+### Risk tiers
+
+`assessRiskTier` in `run-review.mjs` picks the tier. More than 50 files, or any path that looks
+security-sensitive (`auth`, `token`, `secret`, `crypto`, `password`, `oauth`, `unsafe`, `acme`,
+`cert`), is `full`. Otherwise a PR whose every file is test code (`tests/`, `test/`, `e2e/`,
+`fixtures/`, `*.spec.*`, `*.test.*`, `*_test.rs`; `isTestOnlyPath` in `src/selection.mjs`) is
+`test-only` and runs correctness and code-quality, whatever its size (qa joins when Playwright files change); a rename counts by both its source and
+its destination, so code moved from `src/` into `tests/` is not test-only. A PR whose every file is CI
+definition (`.github/workflows/**`, `.github/actions/**` or a top-level `.github/*.yml`;
+`isCiOnlyPath`) is `ci-only` and runs security and release. Scripts, including this engine and the
+two opencode configs, are code and take the size tiers below. Everything else is `trivial` (at most 10
+lines), `lite` (at most 100 lines) or `full`. Conditional agents are added on top as before, and
+`force_full` still forces `full`.
+
+### Effort
+
+`AI_REVIEW_EFFORT` (`low`, `medium`, `high`, `xhigh` or `max`, default `high`) sets the reviewers' effort, and
+`AI_REVIEW_COORDINATOR_EFFORT` the coordinator's (default: the reviewers' value). The workflow
+passes them as `REVIEW_MODEL_VARIANT` and `REVIEW_COORDINATOR_VARIANT`, and the matrix carries no
+variant of its own, so the variables are the only source. Each value is a variant of
+`claude-sonnet-5-5` in both opencode configs, which opencode sends as adaptive thinking plus
+`"output_config": { "effort": "<value>" }`. A value that is not a declared variant stops the run
+before it claims a pass or calls the model, and the comment's earlier verdict and `Auto-approved`
+line give way to a 🔴 Low line saying the review did not run. Spans carry the effort in
+`gen_ai.request.reasoning_effort`.
+
+### PRs that are never reviewed
+
+The workflow's `Skip PRs with nothing to review` step runs right after the engine checkout and
+before anything is installed. It lists the PR's files (a rename lists its old path too) and the
+author login, committer login and signature state of each commit, and runs `skip-check.mjs` (`nothingToReviewReason` in
+`src/selection.mjs`). It skips nothing unless both listings match the PR's `changed_files` and
+`commits` counts and stay under the endpoints' caps (3000 files, 250 commits; `listingComplete`),
+since a listing cut short could hide a code file or a human commit. A PR is skipped, with nothing posted and no model called, when its author is
+`dependabot[bot]` or `renovate[bot]` and every commit is authored by that same bot, committed by
+it or by `web-flow` (how GitHub commits a bot's API-made commits) and carries a signature GitHub
+verified, when every file is docs (`*.md` or `docs/**`, but not markdown under `scripts/ai-review/` or
+`.github/`, nor any instruction loader the sanitizer strips, at any depth and in any case: `AGENTS.md`, `CLAUDE.md`,
+`CONTEXT.md` or a file under `.claude/`, `.agents/` or `.opencode/`; `isLoaderPath` in `src/sanitize.mjs`), or when every file is one the
+translation workflow commits (`web/src/locales/languages/*.json` other than `en-US.json`, which a
+person writes, and `scripts/translations/.translation_state.json`). Every other bot or App author
+is reviewed, and so is a dependency-bot PR someone else pushed to. A manual dispatch always
+reviews, and so does a run where the file or commit listing, or `skip-check.mjs` itself, fails.
+
 The coordinator also lists the findings it kept in a hidden JSON block, which the runner strips
 from the comment. Kept P0, P1 and P2 findings whose `file:line` is an added or context line of the
 diff are posted as one `COMMENT` review with inline threads (at most 10, never approve or request
@@ -47,7 +91,7 @@ changes). Each thread carries a hidden fingerprint of file and title, so a re-ru
 already posted by `REVIEW_BOT_LOGIN`. A failed inline post only logs a warning. The threads are
 off by default; set the variable `AI_REVIEW_INLINE` to `true` to turn them on.
 
-Findings are graded `p0` to `p3`. P0 and P1 are blockers and give the decision `blocked`; P2 and P3
+Findings are graded `p0` to `p3`. P0 (blocker) and P1 (major concern) both give the decision `blocked`; P2 and P3
 do not block, and only those give `approved_with_comments`; no findings gives `approved`. A review
 keeps at most 3 P2 and 2 P3 findings: the coordinator is told to drop the rest, and the runner
 enforces the cap itself only in the fallback comment it renders when the coordinator fails. Legacy
@@ -58,13 +102,34 @@ latest review is recorded, so a force-push back to an older reviewed head is rev
 finished review records what it covered in a hidden `o2-review-sha` tag (the head SHA, plus the paired head in a
 paired review, so a new commit on either side is new) and shows it in a visible `Reviewed commit`
 line with the review number. A run whose head matches the tag skips before any model call, which
-covers a queued run, a re-label and a plain dispatch, including the paired dispatch from
-openobserve. The tag is only written when it is true: the diff the reviewers read is rebuilt locally
+covers a queued run, a re-label and the paired dispatch from openobserve (o2-enterprise does not
+set `REVIEW_MANUAL_RUN`); a manual dispatch here, `force_full` or `ignore_pass_limit` reviews it again. The tag is only written when it is true: the diff the reviewers read is rebuilt locally
 from `MERGE_BASE_SHA` and `HEAD_SHA` (both sides of a paired review), because the API serves the
 branch as it is now. If that cannot be done, or no reviewer finished (each one failed or returned
 nothing parseable), the run writes no tag and names no commit, so that commit can be reviewed again.
 A run where no reviewer finished also reports `Not reviewed` and fails the check.
 
+A stamped review that was complete (every reviewer pass finished without a failure, timeout or
+wrap-up, and the coordinator merged them without falling back; `reviewComplete` in
+`src/passes.mjs`) also records a fingerprint of the unfiltered diff, in a hidden
+`o2-review-diff` tag (`diffFingerprint` in `src/pr-diff.mjs`: a SHA-256 of the diff with blob ids
+and hunk line numbers removed but each hunk's function context kept, so the same lines changed in another function differ, while a rebase or a merge from main that leaves the PR's own changed
+and context lines alone keeps it). Lockfiles, assets and generated files the reviewers never see are
+in it, so adding one reviews again instead of carrying the old merge confidence over. Equal text proves
+the same change only where it sits once in the base, so both the write and the skip also need every
+hunk's old lines (context and removed lines) to occur exactly once in its base file (`hunksLocatable`);
+an edit to one of two identical blocks, or a base file that cannot be read, reviews. When a new head's pinned diff has the same fingerprint, the run
+skips with `unchanged_diff` before any model call: it uses no pass, keeps the review and its merge
+confidence, and moves the `o2-review-sha` tag to the new head; the `Reviewed commit` line keeps the
+commit the findings' line numbers refer to. Binary files keep their blob ids and trailing spaces count, so
+both still change the fingerprint. The
+check runs ahead of the review cap, so such a push is skipped, not refused, after the cap. A manual
+dispatch (`REVIEW_MANUAL_RUN`), `force_full` or `ignore_pass_limit` always reviews, and so does a
+diff that is not pinned to the head. In `approve` mode the skip still dismisses the earlier
+approval, and the kept review's `Auto-approved` line becomes `Needs human review`, because a
+skip does not rerun the approval gate's checks. A partial review records no fingerprint, so the next push
+reviews again even when its diff is the same.
+
 There is no cap on reviews per PR unless the variable `AI_REVIEW_MAX_PASSES` is a positive integer;
 unset, empty, `0` or an invalid value means no cap. Reviews are counted either way, in a hidden
 `o2-review-pass` tag written before the reviewers start, so a run stopped by removing the label or
@@ -76,9 +141,9 @@ the list call fails) the run fails instead of reviewing, since neither the revie
 count can be checked.
 
 A push does not cancel a review in progress: the paid run finishes and only the newest push waits
-in the concurrency queue. To review a commit again, dispatch the workflow with `ignore_pass_limit`
-(it bypasses both the dedupe and the cap, and is forwarded to a paired o2-enterprise review) or with
-`force_full` (it bypasses the dedupe only), or delete the review comment to reset the count.
+in the concurrency queue. To review a commit again, dispatch the workflow (a plain dispatch or
+`force_full` bypasses the dedupe only; `ignore_pass_limit` bypasses both the dedupe and the cap; the
+two inputs are forwarded to a paired o2-enterprise review), or delete the review comment to reset the count.
 
 The comment marker is matched as a pattern, so a retired provider leg's comment is adopted and
 rewritten in place, including older comments whose marker was redacted to
@@ -204,8 +269,8 @@ A PR must never be able to run code next to the review secrets or weaken its own
 | `src/opencode.mjs` env allowlist | `opencode serve` runs in `./pr` with only `PATH`, a fresh temp `HOME`/XDG dirs, `OPENCODE_CONFIG` (this repo's `opencode.jsonc` or `opencode.ci.jsonc` from `./engine`), the `OPENCODE_*` disable flags, a random server password and the one provider key. No `GH_*`, `GITHUB_*`, `ACTIONS_*`, `RUNNER_*` or `O2_*` variables. |
 | Config selection | `REVIEW_OPENCODE_CONFIG` = `default` (`opencode.jsonc`) or `ci-full` (`opencode.ci.jsonc`); any other value stops the run. The workflow sets `ci-full`, which keeps `approve` ineligible (see Auto-approve). |
 | `opencode.jsonc` permissions | Each `ai-review-*` agent: deny `*`, then allow `read`, `glob`, `grep`; `external_directory` denied. A `provider.use` policy allows only `anthropic-review`. LSP, formatters, snapshots and sharing are off. |
-| `opencode.ci.jsonc` permissions | Same provider, model and agents, but each agent allows `*`: shell, edit, write and webfetch run with no prompt. The PR checkout is untrusted input to an agent that can run commands, and the provider key is in the opencode process environment, so a shell command can read it. |
-| Startup self-check | Refuses to review if any agent is missing, any non-built-in plugin or MCP server loaded, or a granted tool's plugin is not active. Under `default` it also refuses any agent that resolves to allow a tool other than `read`/`glob`/`grep` or any outside directory; under `ci-full` it refuses an agent that does not allow every tool without asking. Permission prompts are rejected under `default` and approved once under `ci-full`. |
+| `opencode.ci.jsonc` permissions | Same provider, model, variants and agents. Each agent allows `*` (read, glob, grep, edit, write run with no prompt), then denies `webfetch`, `websearch`, `subagent`, `question` (which would wait on an answer nobody in CI gives), `execute` (opencode 2.2.0's Code Mode: it runs JavaScript with `fetch`, so it would reach the network past the `webfetch` deny) and `skill` (reviewers read the skill copies with `read`). `shell` is kept to an allowlist: `git diff`, `git log`, `git show`, `git blame`, `git ls-files`, `git status` (each also after `git --no-pager`), `git rev-parse`, `git merge-base`, `git cat-file -p`/`-t`/`-s`, `rg`, `grep`, `cat`, `ls`, `head`, `tail`, `find`, `sed -n` and `wc`. Later deny rules refuse `find` with `-exec`, `-execdir`, `-ok`, `-okdir`, `-delete`, `-fprint`, `-fprint0`, `-fprintf` or `-fls` as a separate word; `tail -f`, `-F` and `--follow`; any absolute path, `../` path, `=/` argument or `environ` in `cat`, `head`, `tail`, `grep`, `rg`, `sed` and `wc` (so `/proc/*/environ` and `/dev/*` are not read through them); and any command containing `>` (an output redirect). `git grep` is not allowed (its `-O` runs a pager command). opencode checks every command in a pipeline, `&&` or `;` chain and inside `$(...)` or backticks, so the command runs only when every part is allowed, and a denied command fails outright, without a prompt. The allowlist stops builds, installs and long exploration. It is not a sandbox: `rg --pre` or a GNU `sed` `e` command can still run a program, a glob or a relative path inside the checkout is not inspected, and edit/write stay allowed in the disposable checkout. The PR checkout is untrusted input, and the provider key is in the opencode process environment, so a command that gets past these rules can read it. |
+| Startup self-check | Refuses to review if any agent is missing, any non-built-in plugin or MCP server loaded, or a granted tool's plugin is not active. Under `default` it also refuses any agent that resolves to allow a tool other than `read`/`glob`/`grep` or any outside directory; under `ci-full` it refuses an agent that does not allow read, glob, grep, edit and write without asking, that leaves webfetch, websearch, subagent, question, execute or skill enabled, or whose shell is denied or not restricted to an allowlist. Permission prompts are rejected under `default` and approved once under `ci-full`. |
 | `src/comments.mjs` | The previous review is only ever a marker comment by the reviewer app (`REVIEW_BOT_LOGIN` = `<app-slug>[bot]`), read across every page; anyone else's comment carrying the marker is never fed to the reviewers or edited. When the app token cannot be minted the review posts as `github-actions[bot]`, which any same-repo PR workflow can also post as, so that run uses no previous review and posts a fresh comment. |
 | `src/scrub.mjs` | Before posting: redacts values of secret-named env vars and token-shaped strings (inside code too), breaks forged `<!-- o2-review` markers, and neutralises `@mentions` outside code. |
 
@@ -230,6 +295,21 @@ blocking request that waits for the run dies at undici's 300 s `headersTimeout`
 A timed-out agent is interrupted server-side; transient provider errors are retried at most twice,
 each in a fresh session.
 
+A wrap-up keeps a long session's findings instead of discarding them at the 20-minute timeout. A
+reviewer still running 3 minutes before its timeout is interrupted, and once opencode confirms the
+interrupt the same session gets one more prompt asking for its verified findings in the required
+format with no further tools. The interrupt keeps the steps already run, so the answer comes from
+what the agent read, mostly from cache. If the interrupt is not confirmed, or the answer does not
+arrive in time, the session ends as a timeout, as before; a run that finished on its own just
+before the interrupt keeps its own answer. No agent sets opencode's `steps` cap: on 2.2.0 the capped
+turn ends the request on an assistant message (its "maximum steps reached" text), a prefill the
+model rejects with a 400 when thinking is on; `test/integration/opencode-sandbox.test.mjs` pins
+that. Reviewer
+spans carry `review.wrapped_up`. A wrapped-up answer counts as findings but not as a finished
+reviewer, so an area with no uninterrupted pass lowers merge confidence like an unfinished one and
+blocks auto-approval. Sessions shorter than 6 minutes, and the coordinator, get no
+wrap-up.
+
 The binary is pinned in `opencode-pin.env` and installed by `install-opencode.sh`, which verifies
 the release asset's SHA-256. Bump both lines together, to a release at least 14 days old (waived
 once, for 2.2.0).
diff --git a/scripts/ai-review/agents/coordinator.md b/scripts/ai-review/agents/coordinator.md
index 57f42dfacb..e5df906896 100644
--- a/scripts/ai-review/agents/coordinator.md
+++ b/scripts/ai-review/agents/coordinator.md
@@ -18,7 +18,7 @@ You are the **Review Coordinator** for the OpenObserve project. You receive find
 ## Severity Definitions
 
 - **p0** (blocker): An outage, data loss or corruption, an exploitable security hole, or a default path broken for all users.
-- **p1** (blocker): A real bug that normal use or normal config reaches: wrong results, a crash, a failed request, a regression. Also, for test changes, a coverage-integrity failure (a test that passes while asserting nothing real: a missing/vacuous/soft/un-awaited assertion, or a selector that matches no component).
+- **p1** (major concern): A real bug that normal use or normal config reaches: wrong results, a crash, a failed request, a regression. Also, for test changes, a coverage-integrity failure (a test that passes while asserting nothing real: a missing/vacuous/soft/un-awaited assertion, or a selector that matches no component).
 - **p2** (not blocking): A real bug that needs unusual input, rare timing or non-default config; a measurable regression off the hot path; a broken project rule with no runtime effect.
 - **p3** (not blocking): A likely bug with one unverified step.
 
@@ -64,7 +64,7 @@ PR is opened. Every line of the callout must begin with `> `.
 |----------|-------------|----------------|------------------------------|
 | `approved` | `> [!TIP]` | green | `> ### ✅ Approved` |
 | `approved_with_comments` | `> [!NOTE]` | blue | `> ### 💬 Approved with comments` |
-| `blocked` | `> [!CAUTION]` | red | `> ### ⛔ Blockers found` |
+| `blocked` | `> [!CAUTION]` | red | `> ### ⛔ Blockers found` if any `p0`, else `> ### ⚠️ Major concerns found` |
 
 Put the 1–2 sentence explanation on the callout lines directly after the heading.
 
@@ -101,7 +101,7 @@ If findings exist:
 - 🔒 `path/to/file.rs:42` **[Security]** One-sentence summary of the bug (→ concrete fix).
 <one line per p0 finding, or omit this whole section if zero>
 
-#### 🟠 P1 · Blockers
+#### 🟠 P1 · Major concerns
 - 🐞 `path/to/file.rs:88` **[Correctness]** One-sentence summary of the bug (→ concrete fix).
 <one line per p1 finding, or omit this whole section if zero>
 
@@ -119,13 +119,14 @@ If findings exist:
 
 | | |
 |---|---|
-| **Risk tier** | [trivial \| lite \| full] |
+| **Risk tier** | [trivial \| lite \| full \| test-only \| ci-only] |
 | **Reviewers** | [exactly the agents listed in `<reviewers_ran>`, each with its glyph] |
 
 </details>
 ```
 (Use the callout tag + heading that match the actual decision — the block above shows
-`blocked`; swap to `> [!NOTE]` / `> ### 💬 Approved with comments` etc. per the mapping table.)
+`blocked` with a `p0`; with only `p1` blocking findings the heading is `> ### ⚠️ Major concerns found`;
+swap to `> [!NOTE]` / `> ### 💬 Approved with comments` etc. per the mapping table.)
 
 If NO issues across all reviewers:
 ```
@@ -142,7 +143,7 @@ If NO issues across all reviewers:
 
 | | |
 |---|---|
-| **Risk tier** | [trivial \| lite \| full] |
+| **Risk tier** | [trivial \| lite \| full \| test-only \| ci-only] |
 | **Reviewers** | [exactly the agents listed in `<reviewers_ran>`, each with its glyph] |
 
 </details>
diff --git a/scripts/ai-review/run-review.mjs b/scripts/ai-review/run-review.mjs
index e5c45eb56f..5305febdd3 100644
--- a/scripts/ai-review/run-review.mjs
+++ b/scripts/ai-review/run-review.mjs
@@ -26,14 +26,17 @@ import {
   parseRawDiff,
   reviewerFacts,
   sizeReasons,
+  withoutCarriedApproval,
 } from "./src/auto-approve.mjs";
 import {
   ANY_REVIEW_MARKER,
   NOTICE_TAG,
   REVIEW_HEADING,
   REVIEW_TITLE,
+  bodyAtFailedRun,
   bodyAtPassLimit,
   bodyAtReviewedHead,
+  bodyAtUnchangedDiff,
   bodyAtUnreviewedHead,
   claimedReviewBody,
   finishReviewBody,
@@ -44,8 +47,10 @@ import {
   reviewKey,
   reviewPassCount,
   reviewSkipReason,
+  reviewedDiffFingerprint,
   sanitizeReviewBody,
   selectOwnReviewComment,
+  shouldSkipAsUnchangedDiff,
   withPassTag,
 } from "./src/comments.mjs";
 import {
@@ -56,10 +61,11 @@ import {
   selectInlineComments,
 } from "./src/inline.mjs";
 import { changedCodeEvidence, mergeConfidence, reviewerFinished, severityCounts, unfinishedReviewers } from "./src/confidence.mjs";
-import { OpencodeServer, resolveOpencodeConfig, selfCheck, shouldRetry } from "./src/opencode.mjs";
-import { lostPasses, lostPassesNote, mergePassResults, parseColdPasses, passLabel, passPlan, runPooled } from "./src/passes.mjs";
+import { OpencodeServer, modelVariantIds, resolveOpencodeConfig, selfCheck, shouldRetry } from "./src/opencode.mjs";
+import { stripJsonc } from "./src/jsonc.mjs";
+import { lostPasses, lostPassesNote, mergePassResults, parseColdPasses, passLabel, passPlan, reviewComplete, runPooled } from "./src/passes.mjs";
 import { MAX_USER_PROMPT_CHARS, fitCoordinatorPrompt } from "./src/coordinator-input.mjs";
-import { fetchPinnedDiff, prefixDiffPaths, reviewerDiff } from "./src/pr-diff.mjs";
+import { diffFingerprint, fetchPinnedDiff, hunksLocatable, prefixDiffPaths, reviewerDiff, runFile } from "./src/pr-diff.mjs";
 import {
   buildFallbackReview,
   partialFindingsBlock,
@@ -73,7 +79,7 @@ import {
 } from "./src/report.mjs";
 import { sanitizePrTree } from "./src/sanitize.mjs";
 import { scrubReviewBody, scrubSecrets } from "./src/scrub.mjs";
-import { isReleaseFile, resolveRulesFiles } from "./src/selection.mjs";
+import { isReleaseFile, narrowTier, resolveRulesFiles } from "./src/selection.mjs";
 import { buildImpactContext } from "./src/impact.mjs";
 
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -81,7 +87,7 @@ const __dirname = dirname(fileURLToPath(import.meta.url));
 // ENGINE_DIR is the trusted base-branch checkout; PR_DIR is the PR head, which is data only and never executed.
 const ENGINE_DIR = resolve(process.env.ENGINE_DIR || resolve(__dirname, "../.."));
 const PR_DIR = process.env.PR_DIR ? resolve(process.env.PR_DIR) : "";
-// REVIEW_OPENCODE_CONFIG: "default" (opencode.jsonc, read-only tools) or "ci-full" (opencode.ci.jsonc, every tool allowed).
+// REVIEW_OPENCODE_CONFIG: "default" (opencode.jsonc, read-only tools) or "ci-full" (opencode.ci.jsonc, file tools and a shell allowlist).
 const OPENCODE_CONFIG = resolveOpencodeConfig(process.env.REVIEW_OPENCODE_CONFIG);
 const OPENCODE_CONFIG_PATH = resolve(ENGINE_DIR, OPENCODE_CONFIG.file);
 // A same-named PR in another repo reviewed together with this one (the OSS side of an ENT pair).
@@ -102,13 +108,14 @@ const PAIRED = {
 //
 // - REVIEW_PROVIDER_ID / REVIEW_MODEL_ID: opencode provider+model IDs (must match a
 //   provider/model registered in opencode.jsonc).
-// - REVIEW_MODEL_VARIANT: opencode `variant` on session.prompt (empty ⇒ omit).
+// - REVIEW_MODEL_VARIANT / REVIEW_COORDINATOR_VARIANT: opencode `variant` (effort) of reviewers / coordinator (coordinator defaults to reviewers').
 // - REVIEW_API_KEY_ENV: name of the env var holding the provider API key (checked for presence).
 // - REVIEW_MARKER: HTML comment marker that identifies this provider's comment on the PR, so
 //   providers post/update independent comments and never clobber each other.
 const PROVIDER_ID = process.env.REVIEW_PROVIDER_ID || "anthropic-review";
 const MODEL_ID = process.env.REVIEW_MODEL_ID || "claude-sonnet-5-5";
 const MODEL_VARIANT = process.env.REVIEW_MODEL_VARIANT ?? "";
+const COORDINATOR_VARIANT = process.env.REVIEW_COORDINATOR_VARIANT || MODEL_VARIANT;
 const GEN_AI_PROVIDER_NAME = process.env.REVIEW_GEN_AI_PROVIDER_NAME || genAiProviderName(PROVIDER_ID);
 // REVIEW_API_KEY_ENV holds the NAME of the env var carrying the key (e.g. "ANTHROPIC_REVIEW_API_KEY"),
 // never the key itself — the value is read only via apiKey() below and is never logged or
@@ -135,6 +142,8 @@ const REVIEW_INLINE = (process.env.REVIEW_INLINE || "false").toLowerCase() === "
 // Optional ceiling on paid reviews per PR, 0 for none; the count lives in the review comment, so deleting that comment resets it.
 const REVIEW_MAX_PASSES = parseMaxPasses(process.env.REVIEW_MAX_PASSES);
 const REVIEW_IGNORE_PASS_LIMIT = process.env.REVIEW_IGNORE_PASS_LIMIT === "true";
+// A run someone started by hand always reviews, even a diff the last review already read.
+const REVIEW_MANUAL_RUN = process.env.REVIEW_MANUAL_RUN === "true";
 // Anything but an exact known mode is "off": the gate must be opted into.
 const AUTO_APPROVE_MODE = parseAutoApproveMode(process.env.REVIEW_AUTO_APPROVE);
 // Only the workflow's "no open PR on this branch" path sets this; any failed or skipped pairing lookup leaves it unset.
@@ -151,6 +160,11 @@ const OVERALL_TIMEOUT_MS = 40 * 60 * 1000;
 // Kept free at the end of the run for rendering and posting the comment.
 const POST_RESERVE_MS = 2 * 60 * 1000;
 const MIN_COORDINATOR_MS = 60 * 1000;
+// A reviewer still running this long before its timeout is interrupted and asked for its findings, which a hard timeout throws away.
+const REVIEWER_WRAP_UP = {
+  ms: 3 * 60 * 1000,
+  text: "Time is up for this review. Do not call any more tools. Reply now with your final output in the exact format your instructions require: a <findings> block with every issue you have already verified, or the no-issues marker if you verified none. Do not report anything you have not checked.",
+};
 // Covers every area of two passes at once (8 reviewers at most); a third pass queues instead of adding to provider rate limits.
 const REVIEWER_CONCURRENCY = 16;
 const TRACE_SERVICE_NAME = "github-actions.ai-code-review";
@@ -255,6 +269,15 @@ const RISK_TIERS = {
     agents: ["security", "correctness", "code-quality", "performance", "documentation"],
     coordinatorAgent: COORDINATOR_AGENT,
   },
+  "test-only": {
+    // qa reviews Playwright only, and is added by CONDITIONAL_AGENTS when those files change.
+    agents: ["correctness", "code-quality"],
+    coordinatorAgent: COORDINATOR_AGENT,
+  },
+  "ci-only": {
+    agents: ["security", "release"],
+    coordinatorAgent: COORDINATOR_AGENT,
+  },
 };
 
 // Agents added on top of the tier's set when the diff touches their domain, regardless of size.
@@ -301,6 +324,20 @@ function execErrorText(err) {
   return [err?.message, err?.stderr?.toString(), err?.stdout?.toString()].filter(Boolean).join(" ");
 }
 
+// cat-file reads the raw blob, so the PR's own attributes cannot reshape the base text a hunk is matched against.
+function readBaseFile(path) {
+  const paired = Boolean(PAIRED.dir) && path.startsWith(`${PAIRED.dir}/`);
+  const rel = paired ? path.slice(PAIRED.dir.length + 1) : path;
+  const dir = paired ? resolve(PR_DIR, PAIRED.dir) : PR_DIR;
+  const base = paired ? PAIRED.mergeBase : process.env.MERGE_BASE_SHA;
+  if (!dir || !base) return null;
+  try {
+    return runFile("git", ["-C", dir, "cat-file", "blob", `${base}:${rel}`]);
+  } catch {
+    return null;
+  }
+}
+
 // The API refuses diffs over 20k lines; the workflow fetches the merge base into PR_DIR so the same three-dot diff can be built locally.
 function fetchPrDiff(prNumber) {
   const log = message => console.log(`[${isoNow()}] ${message}`);
@@ -739,9 +776,13 @@ function filterDiff(diff) {
 function assessRiskTier(filteredDiff) {
   const totalLines = filteredDiff.totalAdded + filteredDiff.totalRemoved;
   const fileCount = filteredDiff.files.length;
-  const hasSecurityFiles = filteredDiff.files.some(f => isSecuritySensitiveFile(f.newPath));
+  // A rename's source counts too: moving code out of production or CI removes it from there.
+  const paths = filteredDiff.files.flatMap(f => [f.oldPath, f.newPath]);
+  const hasSecurityFiles = paths.some(isSecuritySensitiveFile);
 
   if (fileCount > 50 || hasSecurityFiles) return "full";
+  const narrow = narrowTier(paths.map(logicalPath));
+  if (narrow) return narrow;
   if (totalLines <= 10 && fileCount <= 20) return "trivial";
   if (totalLines <= 100 && fileCount <= 20) return "lite";
   return "full";
@@ -782,7 +823,7 @@ async function opencodeClient() {
   const client = await OPENCODE.ensureStarted();
   if (!selfChecks.has(client)) {
     const check = selfCheck(client, reviewOpencodeAgents(), { readOnly: OPENCODE_CONFIG.readOnly }).then(result => {
-      const grant = OPENCODE_CONFIG.readOnly ? "only read/glob/grep allowed" : "every tool allowed (ci-full)";
+      const grant = OPENCODE_CONFIG.readOnly ? "only read/glob/grep allowed" : "file tools and a shell allowlist (ci-full)";
       console.log(`[${isoNow()}] opencode self-check passed: ${result.plugins} built-in plugins, ${grant} for ${result.agents} agents`);
       return result;
     });
@@ -797,11 +838,12 @@ function remainingRunMs() {
 }
 
 async function callOpencode(agentName, systemPrompt, userPrompt, timeoutMs = AGENT_TIMEOUT_MS, traceOptions = {}) {
+  const variant = traceOptions.agentKey === "coordinator" ? COORDINATOR_VARIANT : MODEL_VARIANT;
   const llmSpan = TRACE.startSpan("gen_ai.chat", {
     "gen_ai.operation.name": "chat",
     "gen_ai.provider.name": GEN_AI_PROVIDER_NAME,
     "gen_ai.request.model": MODEL_ID,
-    "gen_ai.request.reasoning_effort": MODEL_VARIANT || "default",
+    "gen_ai.request.reasoning_effort": variant || "default",
     "ai.review.operation.name": traceOptions.operationName || "chat",
     "ai.agent.key": traceOptions.agentKey,
     "ai.agent.name": traceOptions.agentName,
@@ -826,12 +868,14 @@ async function callOpencode(agentName, systemPrompt, userPrompt, timeoutMs = AGE
         const result = await client.prompt({
           agent: agentName,
           model: { providerID: PROVIDER_ID, modelID: MODEL_ID },
-          variant: MODEL_VARIANT,
+          variant,
           system: truncatedSystem,
           text: truncatedUser,
           title: `ai-review:${traceOptions.agentKey || agentName}${traceOptions.pass ? `:pass-${traceOptions.pass}` : ""}`,
           timeoutMs,
+          wrapUp: traceOptions.wrapUp,
         });
+        if (result.wrappedUp) console.warn(`[${isoNow()}] ${agentName}: interrupted near its timeout and asked for its findings`);
         if (result.rejectedPermissions > 0) {
           console.warn(`[${isoNow()}] ${agentName}: rejected ${result.rejectedPermissions} permission request(s)`);
         }
@@ -844,8 +888,9 @@ async function callOpencode(agentName, systemPrompt, userPrompt, timeoutMs = AGE
           "ai.review.output.chars": result.text.length,
           "ai.review.attempts": attempt,
           "opencode.permission_rejections": result.rejectedPermissions,
+          "ai.review.wrapped_up": Boolean(result.wrappedUp),
         });
-        return { text: result.text, responseId: result.responseId };
+        return { text: result.text, responseId: result.responseId, wrappedUp: Boolean(result.wrappedUp) };
       } catch (err) {
         failedUsage = addUsage(failedUsage, err?.usage);
         const retry = shouldRetry({
@@ -945,6 +990,7 @@ async function runReviewer(agentKey, agentDef, diff, prContext, existingReview,
         agentName: agentDef.name,
         pass,
         operationName: "code_review",
+        wrapUp: REVIEWER_WRAP_UP,
       },
     );
     const text = completion.text;
@@ -964,9 +1010,10 @@ async function runReviewer(agentKey, agentDef, diff, prContext, existingReview,
       "review.elapsed_seconds": Number(elapsed),
       "review.findings": findings.length,
       "review.raw_text_length": text.length,
+      "review.wrapped_up": completion.wrappedUp,
       "gen_ai.response.id": completion.responseId,
     });
-    return { agentKey, agentName: agentDef.name, pass, findings, rawText: text, error: null, genAIResponseId: completion.responseId, fullDiff, parsed };
+    return { agentKey, agentName: agentDef.name, pass, findings, rawText: text, error: null, genAIResponseId: completion.responseId, fullDiff, parsed, wrappedUp: completion.wrappedUp };
   } catch (err) {
     const elapsed = ((Date.now() - start) / 1000).toFixed(1);
     console.error(`[${isoNow()}] ${label} FAILED after ${elapsed}s: ${err.message}`);
@@ -1146,6 +1193,10 @@ function noteReviewedHead(prNumber, comment) {
   noteOnComment(prNumber, comment, bodyAtReviewedHead(comment.body, REVIEW_MAX_PASSES));
 }
 
+function noteFailedRun(prNumber, comment, key) {
+  if (comment) noteOnComment(prNumber, comment, bodyAtFailedRun(comment.body, key));
+}
+
 function noteSkippedPush(prNumber, comment, key) {
   noteOnComment(prNumber, comment, bodyAtPassLimit(comment.body, REVIEW_MAX_PASSES, key));
 }
@@ -1262,6 +1313,34 @@ function writeFindingsArtifact(prNumber, tier, results, coordinatorResult, inlin
 
 // ─── Main ──────────────────────────────────────────────────────────────────
 
+// A variant the config does not declare would fail every session, so the run stops before it claims a pass.
+function variantProblem() {
+  let config;
+  try {
+    config = JSON.parse(stripJsonc(readFileSync(OPENCODE_CONFIG_PATH, "utf-8")));
+  } catch (err) {
+    return `cannot read ${OPENCODE_CONFIG.file}: ${err.message}`;
+  }
+  const known = modelVariantIds(config, PROVIDER_ID, MODEL_ID);
+  const unknown = [...new Set([MODEL_VARIANT, COORDINATOR_VARIANT])].filter(v => v && !known.includes(v));
+  return unknown.length > 0 ? `variant "${unknown.join('", "')}" is not declared for ${MODEL_SLUG} in ${OPENCODE_CONFIG.file} (declared: ${known.join(", ") || "none"})` : "";
+}
+
+// Fetched ahead of the cap check, and only when the comment holds a fingerprint, so a push that changed nothing is skipped even past the cap.
+function unchangedDiffCheck(prNumber, comment) {
+  const force = REVIEW_MANUAL_RUN || REVIEW_IGNORE_PASS_LIMIT || process.env.FORCE_FULL === "true";
+  if (force || !reviewedDiffFingerprint(comment?.body)) return null;
+  try {
+    const fetched = fetchPrDiff(prNumber);
+    const fingerprint = diffFingerprint(fetched.diff);
+    const unchanged = shouldSkipAsUnchangedDiff(comment.body, fingerprint, { pinned: fetched.pinned, force }) && hunksLocatable(fetched.diff, readBaseFile);
+    return { fetched, unchanged };
+  } catch (err) {
+    console.warn(`[${isoNow()}] Could not fetch the diff to compare with the last review, so it is reviewed: ${execErrorText(err).slice(0, 300)}`);
+    return null;
+  }
+}
+
 function prepareReviewTree(rootSpan) {
   if (!PR_DIR) {
     if (process.env.GITHUB_ACTIONS === "true") throw new Error("PR_DIR is required in CI: the PR must be reviewed from its own sanitized checkout");
@@ -1323,6 +1402,7 @@ async function main() {
       maxPasses: REVIEW_MAX_PASSES,
       ignorePassLimit: REVIEW_IGNORE_PASS_LIMIT,
       forceFull: process.env.FORCE_FULL === "true",
+      manual: REVIEW_MANUAL_RUN,
     });
     const gate = createAutoApproveGate({
       mode: AUTO_APPROVE_MODE,
@@ -1333,6 +1413,15 @@ async function main() {
     });
     // Ahead of the cap skip too: a push the cap leaves unreviewed must still lose the earlier approval.
     if (skipReason !== "already_reviewed") gate.start();
+    const early = skipReason === "already_reviewed" ? null : unchangedDiffCheck(prNumber, existingComment);
+    if (early?.unchanged) {
+      console.log(`[${isoNow()}] PR #${prNumber} skipped (unchanged_diff): ${headKey} changes the same lines the last review read. Dispatch the workflow to review it again.`);
+      const kept = bodyAtUnchangedDiff(existingComment.body, headKey, REVIEW_MAX_PASSES);
+      noteOnComment(prNumber, existingComment, AUTO_APPROVE_MODE === "approve" ? withoutCarriedApproval(kept) : kept);
+      outcome = "skipped";
+      TRACE.setSpanAttributes(rootSpan, { "review.skipped": true, "review.skip_reason": "unchanged_diff" });
+      return;
+    }
     if (skipReason) {
       console.log(`[${isoNow()}] PR #${prNumber} skipped (${skipReason}): ${headKey || "no head"}, ${passesDone} review(s) so far. Dispatch the workflow with ignore_pass_limit to review again.`);
       if (skipReason === "pass_limit_reached") noteSkippedPush(prNumber, existingComment, headKey);
@@ -1366,7 +1455,14 @@ async function main() {
       throw new Error(message);
     }
 
-    console.log(`[${isoNow()}] ${MODEL_SLUG} (via opencode serve): configured`);
+    const variantError = variantProblem();
+    if (variantError) {
+      outcome = "misconfigured";
+      TRACE.setSpanAttributes(rootSpan, { "review.skipped": true, "review.skip_reason": "unknown_variant" });
+      noteFailedRun(prNumber, existingComment, headKey);
+      throw new Error(`${variantError}; fix AI_REVIEW_EFFORT or AI_REVIEW_COORDINATOR_EFFORT.`);
+    }
+    console.log(`[${isoNow()}] ${MODEL_SLUG} (via opencode serve): configured, reviewers at "${MODEL_VARIANT || "default"}", coordinator at "${COORDINATOR_VARIANT || "default"}"`);
 
     // 1. Get PR diff
     console.log(`[${isoNow()}] Fetching PR diff...`);
@@ -1376,7 +1472,7 @@ async function main() {
     let diffPinned = false;
     const diffSpan = TRACE.startSpan("github.pr.diff", { "github.pr.number": prNumber }, rootSpan);
     try {
-      ({ diff, own: ownDiff, pinned: diffPinned } = fetchPrDiff(prNumber));
+      ({ diff, own: ownDiff, pinned: diffPinned } = early?.fetched ?? fetchPrDiff(prNumber));
       const diffStats = diff.split("\n").length;
       TRACE.endSpan(diffSpan, { "diff.raw_lines": diffStats });
       console.log(`[${isoNow()}] Raw diff: ${diffStats} lines`);
@@ -1393,7 +1489,10 @@ async function main() {
     const rawFiles = parseDiffFiles(diff);
     const filtered = filterDiff(diff);
     const changedLines = filtered.totalAdded + filtered.totalRemoved;
+    // The unfiltered diff: a lockfile or asset the filter hides still changes what the verdict covers.
+    const fingerprint = diffFingerprint(diff);
     TRACE.endSpan(filterSpan, {
+      "diff.fingerprint": fingerprint,
       "diff.changed_lines": changedLines,
       "diff.filtered_files": filtered.files.length,
       "diff.skipped_files": rawFiles.length - filtered.files.length,
@@ -1651,8 +1750,12 @@ async function main() {
     // A run where no reviewer finished reviewed nothing, so it does not use up a pass.
     const reviewed = completedAgents.length > 0;
     const passes = reviewed ? passesDone + 1 : passesDone;
+    const complete = reviewComplete(passResults, coordinatorResult);
+    // A reviewer reads at most MAX_DIFF_TOKENS chars of diff, so a longer one was never fully reviewed.
+    const fullyRead = diff.length <= MAX_DIFF_TOKENS;
+    if (reviewed && !complete) console.warn(`[${isoNow()}] The review was partial, so the next push re-reviews even an unchanged diff`);
     if (reviewed && !diffPinned) console.warn(`[${isoNow()}] The reviewed diff is not tied to ${headKey}, so the commit stays reviewable`);
-    finalReview = finishReviewBody(sanitizedReview, { key: headKey, passes, maxPasses: REVIEW_MAX_PASSES, reviewed: reviewed && diffPinned, confidence, gateLine: autoApproveLine(autoApprove) });
+    finalReview = finishReviewBody(sanitizedReview, { key: headKey, passes, maxPasses: REVIEW_MAX_PASSES, reviewed: reviewed && diffPinned, confidence, gateLine: autoApproveLine(autoApprove), diffFingerprint: complete && fullyRead && diffPinned && hunksLocatable(diff, readBaseFile) ? fingerprint : "" });
     TRACE.setSpanAttributes(rootSpan, { "review.final_length": finalReview.length });
     console.log(`[${isoNow()}] Final review length: ${finalReview.length} chars`);
 
diff --git a/scripts/ai-review/shared-rules.md b/scripts/ai-review/shared-rules.md
index 4dc2ca48e6..7cd607cf97 100644
--- a/scripts/ai-review/shared-rules.md
+++ b/scripts/ai-review/shared-rules.md
@@ -10,7 +10,7 @@ These rules apply to ALL reviewers. Violating any of these will cause your findi
 4. **No flattery.** Do not include "Great job", "Thanks for", "Nice work", or any non-actionable commentary.
 5. **Severity must be justified, and is graded by who can reach the failure.** Use one of four levels:
    - `p0` (blocker): an outage, data loss or corruption, an exploitable security hole, or a default path broken for all users.
-   - `p1` (blocker): a real bug that normal use or normal config reaches: wrong results, a crash, a failed request, a regression. Also, for test code, **a coverage-integrity failure: a test that passes while verifying nothing real** (a missing, vacuous, or soft assertion; an un-awaited assertion that resolves after the test ends; or a `data-test` selector that matches no component). A green check with no coverage behind it is false confidence, so it blocks.
+   - `p1` (major concern): a real bug that normal use or normal config reaches: wrong results, a crash, a failed request, a regression. Also, for test code, **a coverage-integrity failure: a test that passes while verifying nothing real** (a missing, vacuous, or soft assertion; an un-awaited assertion that resolves after the test ends; or a `data-test` selector that matches no component). A green check with no coverage behind it is false confidence, so it blocks.
    - `p2` (not blocking): a real bug that needs unusual input, rare timing or non-default config; a measurable regression off the hot path; a broken project rule with no runtime effect.
    - `p3` (not blocking): a likely bug with one unverified step (rule 2).
 
diff --git a/scripts/ai-review/skip-check.mjs b/scripts/ai-review/skip-check.mjs
new file mode 100644
index 0000000000..1bc3bb66e8
--- /dev/null
+++ b/scripts/ai-review/skip-check.mjs
@@ -0,0 +1,21 @@
+// Runs before npm ci and opencode are installed, so it may import node built-ins and src/ modules that import only built-ins.
+import { readFileSync } from "node:fs";
+
+import { listingComplete, nothingToReviewReason } from "./src/selection.mjs";
+
+const TSV_ESCAPES = { "\\t": "\t", "\\n": "\n", "\\r": "\r", "\\\\": "\\" };
+const lines = file => {
+  const out = file ? readFileSync(file, "utf-8").split("\n").map(line => line.replace(/\r$/, "")) : [];
+  if (out.at(-1) === "") out.pop();
+  return out;
+};
+const unescapeTsv = field => field.replace(/\\[tnr\\]/g, seq => TSV_ESCAPES[seq]);
+const [listFile, commitsFile] = process.argv.slice(2);
+const fileLines = lines(listFile).filter(line => line.trim());
+const paths = fileLines.flatMap(line => line.split("\t").map(unescapeTsv).filter(Boolean));
+const commits = lines(commitsFile).map(line => {
+  const [author = "", committer = "", verified = ""] = line.split("\t");
+  return { author, committer, verified: verified === "true" };
+});
+const complete = listingComplete({ files: fileLines.length, commits: commits.length, expectedFiles: process.env.EXPECTED_FILES, expectedCommits: process.env.EXPECTED_COMMITS });
+process.stdout.write(complete ? nothingToReviewReason({ author: process.env.PR_AUTHOR || "", commits, paths }) : "");
diff --git a/scripts/ai-review/src/auto-approve.mjs b/scripts/ai-review/src/auto-approve.mjs
index a13c32f3f7..f8005f4e6e 100644
--- a/scripts/ai-review/src/auto-approve.mjs
+++ b/scripts/ai-review/src/auto-approve.mjs
@@ -1,4 +1,5 @@
 import { removeRepeatedly } from "./comments.mjs";
+import { reviewerCompleted } from "./confidence.mjs";
 import { LOADER_DIRS, LOADER_FILES } from "./sanitize.mjs";
 
 export const MAX_APPROVE_LINES = 100;
@@ -62,6 +63,7 @@ const SUBMODULE_MODE = "160000";
 const KNOWN_HEADER_RE = /^(?:index |--- |\+\+\+ |similarity index |dissimilarity index |rename |copy |old mode |new mode |new file mode |deleted file mode |Binary files |GIT binary patch|\\ |$)/;
 const HUNK_RE = /^@@ -\d+(?:,(\d+))? \+\d+(?:,(\d+))? @@/;
 const APPROVED_LINE = "**Auto-approved** — small change, all gates passed.";
+const UNCHANGED_DIFF_APPROVAL_LINE = "**Needs human review** — an approval does not carry over to a new commit, even one with the same reviewed diff";
 const APPROVAL_BODY = "Auto-approved by the review gate: small change, all gates passed. CI must still pass before merge.";
 const DISMISSAL_MESSAGE = "New commits arrived; an automatic approval does not carry over.";
 
@@ -234,7 +236,7 @@ function reviewerReasons(reviewers) {
 
 // Parsed reviewer output is the only proof a reviewer looked; a clean exit with empty text is not.
 export function reviewerFacts(results) {
-  return results.map(r => ({ key: r.agentKey, ran: !r.skipped, finished: !r.skipped && !r.error && r.parsed === true, fullDiff: r.fullDiff === true }));
+  return results.map(r => ({ key: r.agentKey, ran: !r.skipped, finished: reviewerCompleted(r), fullDiff: r.fullDiff === true }));
 }
 
 function pairingReasons({ paired, pairClear }) {
@@ -386,3 +388,8 @@ export function autoApproveLine(result) {
   if (result?.mode !== "approve") return "";
   return result.approved ? APPROVED_LINE : `**Needs human review** — ${result.reasons.join("; ")}`;
 }
+
+// The unchanged-diff skip still dismisses the approval: the fingerprint ignores lockfiles and other noise the approval gate checks.
+export function withoutCarriedApproval(body) {
+  return String(body ?? "").split(APPROVED_LINE).join(UNCHANGED_DIFF_APPROVAL_LINE);
+}
diff --git a/scripts/ai-review/src/comments.mjs b/scripts/ai-review/src/comments.mjs
index de4ac6fcef..e2388aee73 100644
--- a/scripts/ai-review/src/comments.mjs
+++ b/scripts/ai-review/src/comments.mjs
@@ -1,4 +1,4 @@
-import { isSettledConfidenceLine, mergeConfidenceLine, reviewingConfidenceLine, staleConfidenceLine } from "./confidence.mjs";
+import { isSettledConfidenceLine, mergeConfidenceLine, notRunConfidenceLine, reviewingConfidenceLine, staleConfidenceLine } from "./confidence.mjs";
 import { scrubReviewBody } from "./scrub.mjs";
 
 export const REVIEW_PASS_TAG = "<!--\\s*o2-review-pass:(\\d+)\\s*-->";
@@ -6,6 +6,8 @@ export const REVIEW_PASS_TAG = "<!--\\s*o2-review-pass:(\\d+)\\s*-->";
 export const REVIEW_SHA_TAG = "<!--\\s*o2-review-sha:([^\\s<>]+)\\s*-->";
 // The verdict a later head's line replaced, kept in case the head returns to the reviewed commit.
 export const REVIEW_HELD_TAG = "<!--\\s*o2-review-held:([^\\s<>]+)\\s*-->";
+// Fingerprint of the diff the sha tag's review read, so a later head with the same changes (rebase, merge from main) needs no new review.
+export const REVIEW_DIFF_TAG = "<!--\\s*o2-review-diff:([0-9a-f]{64})\\s*-->";
 // Matched as a pattern so a retired leg's comment is still adopted; `[redacted]` is what redaction left in comments whose marker named the provider.
 export const ANY_REVIEW_MARKER = "<!--\\s*ai-code-review[a-z0-9-]*(?:\\[redacted\\])?\\s*-->";
 // Tags a comment that stands in for a review (post-paired-pointer.sh, the "key not set" notice, the in-progress claim); it is replaced in place but is not a previous review.
@@ -26,7 +28,7 @@ const AUTO_APPROVE_LINE_RE = /^(?:[^\w\n`]|<\/?[a-z]+>)*(?:auto[- ]?approved|nee
 const FORGED_LINE_RE = /mergeconfidence|autoapproved|needshumanreview|reviewedcommit/;
 // The fixed head of a finding line, glyph and location then category, which leaves no room for a status phrase ahead of the category.
 const FINDING_LINE_RE = /^\s*- (?:[^\w\s`*<]+\s+)?(?:`[^`\n]+`\s+)?\*\*\[[^\]\n]+\]\*\*/;
-const TRAILING_TAGS_RE = /(?:\s*<!--\s*o2-review-(?:(?:sha|held):[^\s<>]+|pass:\d+)\s*-->)+\s*$/i;
+const TRAILING_TAGS_RE = /(?:\s*<!--\s*o2-review-(?:(?:sha|held|diff):[^\s<>]+|pass:\d+)\s*-->)+\s*$/i;
 const HTML_COMMENT_RE = /<!--[\s\S]*?--!?>/g;
 const MARKUP_RE = /<!--[\s\S]*?--!?>|<[^>]*>|&[a-z]+;/gi;
 // "summary" stays out: it would strip the <summary> of the findings fold, and a leaked finding field sits inside a stripped <finding> block.
@@ -87,8 +89,30 @@ export function withReviewShaTag(body, key) {
   return `${withoutTag(body, REVIEW_SHA_TAG)}\n${reviewShaTag(key)}`;
 }
 
-export function shouldSkipAsReviewed(body, key, { ignorePassLimit = false, forceFull = false } = {}) {
-  if (!key || ignorePassLimit || forceFull) return false;
+// Only a body whose sha tag names a reviewed head can vouch for a diff.
+export function reviewedDiffFingerprint(body) {
+  if (!reviewedKey(body)) return "";
+  return (body || "").match(new RegExp(REVIEW_DIFF_TAG, "i"))?.[1] ?? "";
+}
+
+export function withReviewDiffTag(body, fingerprint) {
+  const bare = withoutTag(body, REVIEW_DIFF_TAG);
+  return fingerprint ? `${bare}\n<!-- o2-review-diff:${fingerprint} -->` : bare;
+}
+
+// A forced run (dispatch, force_full, ignore_pass_limit) always reviews; otherwise a pinned diff equal to the reviewed one is skipped.
+export function shouldSkipAsUnchangedDiff(body, fingerprint, { pinned = false, force = false } = {}) {
+  if (force || !pinned || !fingerprint) return false;
+  return reviewedDiffFingerprint(body) === fingerprint;
+}
+
+// Costs no pass; the visible commit stays the reviewed one because finding line numbers refer to it, while the tag moves so the next push compares against this head.
+export function bodyAtUnchangedDiff(body, key, maxPasses) {
+  return withReviewShaTag(bodyAtReviewedHead(body, maxPasses), key);
+}
+
+export function shouldSkipAsReviewed(body, key, { ignorePassLimit = false, forceFull = false, manual = false } = {}) {
+  if (!key || ignorePassLimit || forceFull || manual) return false;
   return reviewedKey(body) === key;
 }
 
@@ -103,8 +127,8 @@ export function passLimitReached(passes, maxPasses) {
 }
 
 // Dedupe comes first so a queued run on a reviewed head stays silent instead of rewriting the limit note.
-export function reviewSkipReason({ body, key, passesDone, maxPasses, ignorePassLimit = false, forceFull = false }) {
-  if (shouldSkipAsReviewed(body, key, { ignorePassLimit, forceFull })) return "already_reviewed";
+export function reviewSkipReason({ body, key, passesDone, maxPasses, ignorePassLimit = false, forceFull = false, manual = false }) {
+  if (shouldSkipAsReviewed(body, key, { ignorePassLimit, forceFull, manual })) return "already_reviewed";
   if (!ignorePassLimit && passLimitReached(passesDone, maxPasses)) return "pass_limit_reached";
   return "";
 }
@@ -207,20 +231,25 @@ export function bodyAtPassLimit(body, maxPasses, head) {
   return bodyAtUnreviewedHead(withPassLimitNote(body, passLimitNote(maxPasses, reviewedKey(body), head)), head);
 }
 
+// Even on the covered commit: the run already dismissed the approval, so the old verdict and gate line must not read as current.
+export function bodyAtFailedRun(body, head) {
+  return head ? withConfidenceLine(withHeldVerdict(body), notRunConfidenceLine(shortKey(head))) : body;
+}
+
 // The sha tag says that exact commit was read and stops it being reviewed again, so a run that cannot prove that leaves it off.
-export function finishReviewBody(body, { key, passes, maxPasses, reviewed, confidence, gateLine = "" }) {
+export function finishReviewBody(body, { key, passes, maxPasses, reviewed, confidence, gateLine = "", diffFingerprint = "" }) {
   const stamped = reviewed && key;
   const lines = [confidence ? mergeConfidenceLine(confidence) : "", gateLine].filter(Boolean);
   let out = insertAfterCallout(body, lines.join("\n\n"));
   if (stamped) out += `\n\n${reviewedCommitLine(key, passes, maxPasses)}`;
   if (passLimitReached(passes, maxPasses)) out += `\n\n${passLimitNote(maxPasses)}`;
-  if (stamped) out = withReviewShaTag(out, key);
+  if (stamped) out = withReviewDiffTag(withReviewShaTag(out, key), diffFingerprint);
   return withPassTag(out, passes);
 }
 
 // What the reviewers see as <previous_review>: the review alone, none of the runner's bookkeeping.
 export function previousReviewText(body) {
-  return [REVIEW_SHA_TAG, REVIEW_PASS_TAG, REVIEW_HELD_TAG].reduce(withoutTag, stripRunnerLines(String(body ?? "")));
+  return [REVIEW_SHA_TAG, REVIEW_PASS_TAG, REVIEW_HELD_TAG, REVIEW_DIFF_TAG].reduce(withoutTag, stripRunnerLines(String(body ?? "")));
 }
 
 // Yields the text after each pass, last the first that changed nothing: a removal can splice a new match out of what surrounds it.
@@ -303,7 +332,7 @@ function unwrapJsonBody(body) {
 export function sanitizeReviewBody(body, { marker, providerId, modelId, env }) {
   if (!body) return { text: "", secretHits: 0 };
   const anyMarker = new RegExp(ANY_REVIEW_MARKER, "gi");
-  const runnerTags = new RegExp(`${ANY_REVIEW_MARKER}|${REVIEW_PASS_TAG}|${REVIEW_SHA_TAG}|${REVIEW_HELD_TAG}`, "gi");
+  const runnerTags = new RegExp(`${ANY_REVIEW_MARKER}|${REVIEW_PASS_TAG}|${REVIEW_SHA_TAG}|${REVIEW_HELD_TAG}|${REVIEW_DIFF_TAG}`, "gi");
 
   let cleaned = unwrapJsonBody(body)
     .replace(/\\n/g, "\n")
diff --git a/scripts/ai-review/src/confidence.mjs b/scripts/ai-review/src/confidence.mjs
index 9345a11008..428d814ee6 100644
--- a/scripts/ai-review/src/confidence.mjs
+++ b/scripts/ai-review/src/confidence.mjs
@@ -25,8 +25,13 @@ export function reviewerFinished(r) {
   return !r.skipped && !r.error && r.parsed === true;
 }
 
+// A reviewer interrupted at its soft deadline answered in haste, so its output counts as findings but not as a finished review.
+export function reviewerCompleted(r) {
+  return reviewerFinished(r) && !r.wrappedUp;
+}
+
 export function unfinishedReviewers(ranResults) {
-  return ranResults.filter(r => !reviewerFinished(r)).map(r => r.agentName);
+  return ranResults.filter(r => !reviewerCompleted(r)).map(r => r.agentName);
 }
 
 function plural(count, noun) {
@@ -50,12 +55,14 @@ export function mergeConfidence({
   if (ranCount === 0) return { level: "low", reasons: ["no reviewer ran"] };
   if (ranCount > 0 && failedReviewers.length >= ranCount) return { level: "low", reasons: ["no reviewer finished"] };
 
-  const blockers = (counts.p0 ?? 0) + (counts.p1 ?? 0);
+  const blockers = counts.p0 ?? 0;
+  const major = counts.p1 ?? 0;
   const core = failedReviewers.filter(name => CORE_REVIEWER_RE.test(shortName(name)));
   const other = failedReviewers.filter(name => !core.includes(name));
   const unfinished = name => `${shortName(name)} reviewer did not finish`;
   const low = [
-    ...(blockers > 0 ? [`${plural(blockers, "blocker")} (P0/P1)`] : []),
+    ...(blockers > 0 ? [`${plural(blockers, "blocker")} (P0)`] : []),
+    ...(major > 0 ? [`${plural(major, "major concern")} (P1)`] : []),
     ...(findingsKnown ? [] : ["findings could not be counted"]),
     ...core.map(unfinished),
   ];
@@ -78,6 +85,10 @@ export function staleConfidenceLine(shortHead) {
   return `**Merge confidence: ${CONFIDENCE_LABEL.low}** — \`${shortHead}\` has not been reviewed`;
 }
 
+export function notRunConfidenceLine(shortHead) {
+  return `**Merge confidence: ${CONFIDENCE_LABEL.low}** — the review did not run because of a CI configuration error; \`${shortHead}\` has not been reviewed`;
+}
+
 export function reviewingConfidenceLine(shortHead) {
   return `**Merge confidence: 🟡 Reviewing** — \`${shortHead}\` is being reviewed`;
 }
diff --git a/scripts/ai-review/src/jsonc.mjs b/scripts/ai-review/src/jsonc.mjs
new file mode 100644
index 0000000000..3fd4bb70ad
--- /dev/null
+++ b/scripts/ai-review/src/jsonc.mjs
@@ -0,0 +1,18 @@
+// Comments and trailing commas out, so the opencode configs parse as JSON.
+export function stripJsonc(text) {
+  let out = "";
+  for (let i = 0; i < text.length; i++) {
+    const c = text[i];
+    if (c === '"') {
+      const start = i;
+      for (i++; i < text.length && text[i] !== '"'; i++) if (text[i] === "\\") i++;
+      out += text.slice(start, i + 1);
+    } else if (c === "/" && text[i + 1] === "/") {
+      while (i < text.length && text[i] !== "\n") i++;
+      out += "\n";
+    } else {
+      out += c;
+    }
+  }
+  return out.replace(/,(\s*[}\]])/g, "$1");
+}
diff --git a/scripts/ai-review/src/opencode.mjs b/scripts/ai-review/src/opencode.mjs
index abe6174c79..6ecc0e7141 100644
--- a/scripts/ai-review/src/opencode.mjs
+++ b/scripts/ai-review/src/opencode.mjs
@@ -23,7 +23,11 @@ export const BUILTIN_TOOL_IDS = new Set([
 const ALLOWED_TOOL_IDS = new Set(["read", "glob", "grep"]);
 const EDIT_TOOL_IDS = new Set(["edit", "write"]);
 // What ci-full must actually grant without asking; a config that fell back to the defaults fails here.
-const CI_FULL_TOOL_IDS = ["read", "glob", "grep", "edit", "write", "shell", "webfetch"];
+const CI_FULL_TOOL_IDS = ["read", "glob", "grep", "edit", "write"];
+// question waits on an answer nobody in CI gives; execute runs JavaScript with fetch, so it would bypass the webfetch deny.
+const CI_FULL_DENIED_TOOL_IDS = ["webfetch", "websearch", "subagent", "question", "execute", "skill"];
+// Offered, but only for the commands the config allowlists.
+const CI_FULL_RESTRICTED_TOOL_IDS = ["shell"];
 
 // 2.x dropped OPENCODE_PURE and the plugin, skill and LSP-download flags; sanitizePrTree covers what they did.
 const SANDBOX_FLAGS = {
@@ -42,6 +46,7 @@ const INTERRUPTED_ERROR = { type: "interrupted", message: "opencode interrupted
 const DEFAULT_REQUEST_HEADERS_TIMEOUT_MS = 30_000;
 const STATUS_POLL_MS = 15_000;
 const STREAM_RETRY_MS = 1_000;
+const INTERRUPT_SETTLE_MS = 20_000;
 const TRANSIENT_ERROR_RE = /ECONNRESET|ECONNREFUSED|ETIMEDOUT|EPIPE|socket hang up|overloaded|rate limit|too many requests|temporarily unavailable|bad gateway|service unavailable|gateway timeout/i;
 // opencode 2.x StructuredError types; the first set is worth a fresh session, the second never is, whatever the message says.
 const TRANSIENT_ERROR_TYPES = new Set(["provider.rate-limit", "provider.transport", "provider.timeout", "provider.internal"]);
@@ -217,7 +222,7 @@ export class OpencodeClient {
   }
 
   // Sends the prompt (2.x admits it and returns at once) and waits on the event stream, so no request ever blocks for the length of an agent run (undici's 300 s headersTimeout killed every long review).
-  async prompt({ agent, model, variant, system, text, title, timeoutMs }) {
+  async prompt({ agent, model, variant, system, text, title, timeoutMs, wrapUp = null }) {
     await this.ensureEventStream();
     // 2.x binds agent, model and variant to the session; the prompt itself carries only text.
     const session = (await this.json("POST", "/api/session", {
@@ -233,17 +238,20 @@ export class OpencodeClient {
       if (system) {
         await this.json("PUT", `/api/experimental/session/${session.id}/instructions/entries/${SYSTEM_ENTRY_KEY}`, { value: system });
       }
+      const softMs = wrapUpStartMs(timeoutMs, wrapUp);
       // Armed before the POST: the run can fail before the prompt call returns, and nothing would replay it.
-      const finished = waiter.wait(timeoutMs);
+      const finished = waiter.wait(softMs);
       await this.json("POST", `/api/session/${session.id}/prompt`, { text });
-      const outcome = await finished;
+      let outcome = await finished;
+      let wrappedUp = false;
+      if (outcome.timedOut && softMs < timeoutMs) ({ outcome, wrappedUp } = await this.wrapUpSession(session.id, waiter, wrapUp.text, timeoutMs - softMs));
       if (outcome.timedOut) {
         await this.request("POST", `/api/session/${session.id}/interrupt`).catch(() => {});
         throw new OpencodeError(`opencode agent ${agent} timed out after ${timeoutMs}ms`, { name: "TimeoutError" });
       }
       const messages = await this.json("GET", `/api/session/${session.id}/message?type=assistant&order=desc&limit=1`);
       totals = await this.json("GET", `/api/session/${session.id}`).catch(() => null);
-      return finalAssistantResult(messages?.data, totals?.data, outcome.error, waiter.rejectedPermissions);
+      return { ...finalAssistantResult(messages?.data, totals?.data, outcome.error, waiter.rejectedPermissions), wrappedUp };
     } catch (err) {
       // A failed or timed-out session was still billed; its totals are gone once the session is deleted.
       totals ??= await this.json("GET", `/api/session/${session.id}`).catch(() => null);
@@ -256,6 +264,23 @@ export class OpencodeClient {
     }
   }
 
+  // The interrupt keeps the finished steps in the session, so the follow-up prompt answers from everything the agent already read.
+  async wrapUpSession(sessionID, waiter, text, budgetMs) {
+    const deadline = Date.now() + budgetMs;
+    const stopped = waiter.wait(Math.min(INTERRUPT_SETTLE_MS, budgetMs));
+    await this.request("POST", `/api/session/${sessionID}/interrupt`).catch(() => {});
+    const stop = await stopped;
+    // An unconfirmed interrupt ends as the hard timeout; a run that ended on its own keeps its own outcome.
+    if (stop.timedOut || stop.error?.type !== "interrupted") return { outcome: stop, wrappedUp: false };
+    // Nothing interrupts the follow-up before its wait ends, so a late interrupted event or idle record is the first run's.
+    waiter.ignoreInterrupted = true;
+    const remainingMs = deadline - Date.now();
+    if (remainingMs <= 0) return { outcome: { timedOut: true, error: null }, wrappedUp: true };
+    const finished = waiter.wait(remainingMs);
+    await this.json("POST", `/api/session/${sessionID}/prompt`, { text });
+    return { outcome: await finished, wrappedUp: true };
+  }
+
   close() {
     this.closed = true;
     this.stream?.close();
@@ -270,6 +295,7 @@ class SessionWaiter {
     this.sessionID = sessionID;
     this.rejectedPermissions = 0;
     this.settle = null;
+    this.ignoreInterrupted = false;
   }
 
   wait(timeoutMs) {
@@ -291,6 +317,7 @@ class SessionWaiter {
   }
 
   onError(error) {
+    if (this.ignoreInterrupted && error?.type === "interrupted") return;
     this.settle?.({ timedOut: false, error: error || { type: "unknown", message: "opencode run failed" } });
   }
 
@@ -353,11 +380,13 @@ function permissionAction(toolId) {
   return EDIT_TOOL_IDS.has(toolId) ? "edit" : toolId;
 }
 
+// Same as opencode 2.2.0: a trailing " *" also matches the bare command, so "git diff *" covers "git diff".
 export function wildcardMatch(input, pattern) {
-  const escaped = pattern
+  let escaped = pattern
     .replace(/[.+^${}()|[\]\\]/g, "\\$&")
     .replace(/\*/g, ".*")
     .replace(/\?/g, ".");
+  if (escaped.endsWith(" .*")) escaped = `${escaped.slice(0, -3)}( .*)?`;
   return new RegExp(`^${escaped}$`, "s").test(input);
 }
 
@@ -375,7 +404,7 @@ export async function selfCheck(client, expectedAgents, { readOnly = true } = {}
   const broken = plugins.filter(p => p.state?.status !== "active");
   if (broken.length > 0) throw new OpencodeError(`opencode plugins failed to load: ${broken.map(p => `${p.id}: ${p.state?.error || "unknown"}`).join("; ")}`);
   const active = new Set(plugins.map(p => p.id));
-  const missing = (readOnly ? [...ALLOWED_TOOL_IDS] : CI_FULL_TOOL_IDS).filter(id => !active.has(`opencode.tool.${id}`));
+  const missing = (readOnly ? [...ALLOWED_TOOL_IDS] : [...CI_FULL_TOOL_IDS, ...CI_FULL_RESTRICTED_TOOL_IDS]).filter(id => !active.has(`opencode.tool.${id}`));
   if (missing.length > 0) throw new OpencodeError(`opencode tools did not load: ${missing.join(", ")}`);
   const mcp = (await client.json("GET", "/api/mcp"))?.data || [];
   if (mcp.length > 0) throw new OpencodeError(`opencode loaded MCP servers; refusing to review`);
@@ -397,9 +426,7 @@ export async function selfCheck(client, expectedAgents, { readOnly = true } = {}
       const problem = externalDirectoryProblem(ruleset);
       if (problem) problems.push(`${name}: ${problem}`);
     } else {
-      for (const toolId of CI_FULL_TOOL_IDS) {
-        if (!toolAllowedWithoutAsking(toolId, ruleset)) problems.push(`${name}: ${toolId} not fully allowed`);
-      }
+      problems.push(...ciFullProblems(ruleset).map(problem => `${name}: ${problem}`));
     }
   }
   if (problems.length > 0) throw new OpencodeError(`opencode permission self-check failed: ${problems.join("; ")}`);
@@ -415,6 +442,28 @@ export function externalDirectoryProblem(ruleset) {
   return extra.length > 0 ? `external_directory allows ${extra.map(r => r.resource).join(", ")}` : "";
 }
 
+// ci-full grants the file tools outright, denies the tools that only cost time, and keeps the shell on an allowlist.
+export function ciFullProblems(ruleset) {
+  const problems = CI_FULL_TOOL_IDS.filter(id => !toolAllowedWithoutAsking(id, ruleset)).map(id => `${id} not fully allowed`);
+  problems.push(...CI_FULL_DENIED_TOOL_IDS.filter(id => toolEnabled(id, ruleset)).map(id => `${id} allowed`));
+  for (const id of CI_FULL_RESTRICTED_TOOL_IDS) {
+    if (!toolEnabled(id, ruleset)) problems.push(`${id} denied`);
+    else if (toolAllowedWithoutAsking(id, ruleset)) problems.push(`${id} allows every command`);
+  }
+  return problems;
+}
+
+// The follow-up only gets a slot when the first run keeps at least as long as the follow-up; shorter sessions run to the hard timeout.
+export function wrapUpStartMs(timeoutMs, wrapUp) {
+  return wrapUp?.ms > 0 && wrapUp.text && timeoutMs >= 2 * wrapUp.ms ? timeoutMs - wrapUp.ms : timeoutMs;
+}
+
+// The variant ids a model declares in an opencode config; a variant opencode does not know must fail the run before any session starts.
+export function modelVariantIds(config, providerId, modelId) {
+  const variants = config?.providers?.[providerId]?.models?.[modelId]?.variants;
+  return Array.isArray(variants) ? variants.map(v => v?.id).filter(Boolean) : [];
+}
+
 // A retry must leave room for its own full timeout plus whatever still has to run after it (the coordinator).
 export function shouldRetry({ err, attempt, maxRetries, remainingMs, timeoutMs, reserveMs = 0 }) {
   return attempt <= maxRetries && isTransientError(err) && remainingMs > timeoutMs + reserveMs;
diff --git a/scripts/ai-review/src/passes.mjs b/scripts/ai-review/src/passes.mjs
index a262e13886..c0048a7039 100644
--- a/scripts/ai-review/src/passes.mjs
+++ b/scripts/ai-review/src/passes.mjs
@@ -1,4 +1,4 @@
-import { reviewerFinished, shortName } from "./confidence.mjs";
+import { reviewerCompleted, reviewerFinished, shortName } from "./confidence.mjs";
 
 export const DEFAULT_COLD_PASSES = 2;
 export const MAX_COLD_PASSES = 3;
@@ -43,8 +43,9 @@ export async function runPooled(items, limit, worker) {
 
 function mergeArea(group) {
   const finished = group.filter(reviewerFinished);
+  const completed = finished.filter(reviewerCompleted);
   const ran = group.filter(r => !r.skipped);
-  const base = finished[0] ?? ran[0] ?? group[0];
+  const base = completed[0] ?? finished[0] ?? ran[0] ?? group[0];
   const covered = finished.length > 0;
   return {
     agentKey: base.agentKey,
@@ -58,6 +59,8 @@ function mergeArea(group) {
     skipped: group.every(r => r.skipped),
     fullDiff: base.fullDiff,
     parsed: covered,
+    // Only an uninterrupted pass completes an area; wrapped-up output still counts as findings.
+    wrappedUp: covered && completed.length === 0,
     passes: group.length,
     passesFinished: finished.length,
     passResults: group,
@@ -78,6 +81,12 @@ export function lostPasses(results) {
   return results.filter(r => !r.skipped && r.passesFinished > 0 && r.passesFinished < r.passes);
 }
 
+// Only a review with every pass finished in time and a real coordinator merge may let the next push with the same diff skip.
+export function reviewComplete(passResults, coordinatorResult) {
+  if (!coordinatorResult || coordinatorResult.fallback) return false;
+  return passResults.every(r => r.skipped || reviewerCompleted(r));
+}
+
 // Written by code like the failed-reviewers line, so a reader learns an area got less scrutiny than the rest.
 export function lostPassesNote(results) {
   const lost = lostPasses(results);
diff --git a/scripts/ai-review/src/pr-diff.mjs b/scripts/ai-review/src/pr-diff.mjs
index 0563222bf3..0359400737 100644
--- a/scripts/ai-review/src/pr-diff.mjs
+++ b/scripts/ai-review/src/pr-diff.mjs
@@ -1,4 +1,5 @@
 import { execFileSync } from "node:child_process";
+import { createHash } from "node:crypto";
 
 const MAX_BUFFER = 200 * 1024 * 1024;
 const TOO_LARGE_RE = /exceeded the maximum number of lines|too_large|HTTP 406|HTTP 422/i;
@@ -55,6 +56,39 @@ export function fetchPinnedDiff(params) {
   return pinDiff({ ...params, diff: fetchDiff(params) });
 }
 
+// Blob ids and hunk line numbers move with the base, so a rebase keeps the fingerprint; the function context after `@@` stays, as the same lines in another function are another change.
+export function diffFingerprint(diff) {
+  const text = String(diff ?? "");
+  // A binary file has no hunks, so its blob ids are the only record of its content.
+  const keepBlobIds = /^(Binary files .* differ|GIT binary patch)$/m.test(text);
+  const normalized = text
+    .split("\n")
+    .map(line => (keepBlobIds ? line : line.replace(/^index [0-9a-f]+\.\.[0-9a-f]+/, "index")))
+    .map(line => line.replace(/^@@ -\d+(?:,\d+)? \+\d+(?:,\d+)? @@/, "@@"))
+    .join("\n")
+    .replace(/\n+$/, "");
+  return createHash("sha256").update(normalized).digest("hex");
+}
+
+// Equal text names one change only where each hunk's old lines sit once in the base, so an edit to one of two identical blocks cannot pass for the other.
+export function hunksLocatable(diff, readBase) {
+  for (const section of String(diff ?? "").split(/^diff --git /m).slice(1)) {
+    const firstHunk = section.search(/^@@ /m);
+    if (firstHunk === -1) continue;
+    const header = section.slice(0, firstHunk);
+    if (/^--- \/dev\/null$/m.test(header)) continue;
+    const path = header.match(/^--- a\/(.*?)\t?$/m)?.[1];
+    const base = path ? readBase(path) : null;
+    if (typeof base !== "string") return false;
+    const baseLines = base.split("\n");
+    for (const hunk of section.slice(firstHunk).split(/^@@ [^\n]*(?:\n|$)/m).slice(1)) {
+      const old = hunk.split("\n").filter(line => line.startsWith(" ") || line.startsWith("-")).map(line => line.slice(1));
+      if (old.length === 0 ? base !== "" : occurrences(baseLines, old) !== 1) return false;
+    }
+  }
+  return true;
+}
+
 // `unfocused` keeps the whole diff for a gate candidate, whose approval must rest on reviewers that saw every file; requiresFocus agents still opt out.
 export function reviewerDiff(diff, { fileFocus, requiresFocus }, { unfocused = false, pathOf = path => path } = {}) {
   if (!fileFocus) return { diff, skipped: false, fullDiff: true };
@@ -107,3 +141,12 @@ function prefixGitHeader(line, p) {
 function prefixBinaryLine(line, p) {
   return line.replace(/(^Binary files |and )("?)([ab])\//g, `$1$2$3/${p}/`);
 }
+
+// Stops at two: the caller only needs to know whether a block is unique.
+function occurrences(lines, block) {
+  let found = 0;
+  for (let i = 0; i + block.length <= lines.length && found < 2; i += 1) {
+    if (lines[i] === block[0] && block.every((line, j) => lines[i + j] === line)) found += 1;
+  }
+  return found;
+}
diff --git a/scripts/ai-review/src/report.mjs b/scripts/ai-review/src/report.mjs
index e188203c07..3b0572a462 100644
--- a/scripts/ai-review/src/report.mjs
+++ b/scripts/ai-review/src/report.mjs
@@ -28,7 +28,7 @@ const BLOCKQUOTE_LINE_RE = /^[ \t]*>.*$/gm;
 const SEVERITY_GLYPH = { p0: "🔴", p1: "🟠", p2: "🟡", p3: "🔵" };
 const SEVERITY_SECTION = {
   p0: "#### 🔴 P0 · Blockers",
-  p1: "#### 🟠 P1 · Blockers",
+  p1: "#### 🟠 P1 · Major concerns",
   p2: "#### 🟡 P2 · Should fix",
   p3: "#### 🔵 P3 · Worth a look",
 };
@@ -280,7 +280,8 @@ ${failedLine}
   const bySeverity = groupBySeverity(shown);
   const sections = severitySections(bySeverity);
   const blocked = bySeverity.p0.length + bySeverity.p1.length > 0;
-  const callout = blocked ? "> [!CAUTION]\n> ### ⛔ Blockers found" : "> [!NOTE]\n> ### 💬 Approved with comments";
+  const heading = bySeverity.p0.length > 0 ? "⛔ Blockers found" : "⚠️ Major concerns found";
+  const callout = blocked ? `> [!CAUTION]\n> ### ${heading}` : "> [!NOTE]\n> ### 💬 Approved with comments";
   const rawCount = agentResults.flatMap(r => r.findings).length;
   const dedupNote = fallbackDedupNote(rawCount, dedupeFindings(agentResults).length, shown.length);
 
diff --git a/scripts/ai-review/src/sanitize.mjs b/scripts/ai-review/src/sanitize.mjs
index fc9ad5666f..4357a57629 100644
--- a/scripts/ai-review/src/sanitize.mjs
+++ b/scripts/ai-review/src/sanitize.mjs
@@ -38,6 +38,12 @@ export function sanitizePrTree(prDir, contextSourceDir) {
   return { removed, contextFiles: copied };
 }
 
+// The same names the walk strips, so a PR touching only these still steers a reviewer and is never docs-only.
+export function isLoaderPath(filePath) {
+  const parts = String(filePath ?? "").toLowerCase().split("/");
+  return LOADER_FILES.has(parts.at(-1)) || parts.some(part => LOADER_DIRS.has(part));
+}
+
 function walk(dir, root, removed) {
   for (const entry of readdirSync(dir, { withFileTypes: true })) {
     const path = join(dir, entry.name);
diff --git a/scripts/ai-review/src/selection.mjs b/scripts/ai-review/src/selection.mjs
index 1ddd11c8c5..9bc977444a 100644
--- a/scripts/ai-review/src/selection.mjs
+++ b/scripts/ai-review/src/selection.mjs
@@ -1,5 +1,12 @@
 import { existsSync } from "node:fs";
 import { basename, dirname, join } from "node:path";
+import { isLoaderPath } from "./sanitize.mjs";
+
+// Dependency bots whose PRs only bump versions; any other bot or App can write code and is reviewed.
+const DEPENDENCY_BOTS = new Set(["dependabot[bot]", "renovate[bot]"]);
+// GitHub's files and commits endpoints stop at these counts however far they are paged.
+const MAX_LISTED_FILES = 3000;
+const MAX_LISTED_COMMITS = 250;
 
 // Diffs that can affect a release: migrations, dependency manifests, server config, CI and deployment files.
 export function isReleaseFile(filePath) {
@@ -22,3 +29,57 @@ export function resolveRulesFiles(files, exists = existsSync) {
   }
   return out;
 }
+
+// Test code only: test trees, spec/test files and fixtures, in any language.
+export function isTestOnlyPath(filePath) {
+  if (isCiOnlyPath(filePath)) return false;
+  if (/(^|\/)(tests?|__tests__|e2e|fixtures?|testdata)\//.test(filePath)) return true;
+  if (/\.(spec|test)\.[cm]?[jt]sx?$/.test(filePath)) return true;
+  return /(^|\/)[^/]+_test\.(rs|go|py)$/.test(filePath) || /(^|\/)test_[^/]+\.py$/.test(filePath);
+}
+
+// Workflows, actions and .github config only; scripts, the review engine and its opencode configs are code and take the normal tiers.
+export function isCiOnlyPath(filePath) {
+  return /^\.github\/((workflows|actions)\/|[^/]+\.ya?ml$)/.test(filePath);
+}
+
+export function narrowTier(paths) {
+  if (paths.length === 0) return "";
+  if (paths.every(isTestOnlyPath)) return "test-only";
+  if (paths.every(isCiOnlyPath)) return "ci-only";
+  return "";
+}
+
+// Prompt, agent-rule and workflow markdown steers the AI or CI, so it is reviewed like code.
+export function isDocsPath(filePath) {
+  if (/^(scripts\/ai-review\/|\.github\/)/.test(filePath) || isLoaderPath(filePath)) return false;
+  return /\.md$/i.test(filePath) || /^docs\//.test(filePath);
+}
+
+// What update-translations.yml commits; en-US.json is the English source a person writes, so it is still reviewed.
+export function isTranslationPath(filePath) {
+  if (filePath === "scripts/translations/.translation_state.json") return true;
+  return /^web\/src\/locales\/languages\/[^/]+\.json$/.test(filePath) && !filePath.endsWith("/en-US.json");
+}
+
+// A listing is whole only when it matches the PR's own counts below each endpoint's cap; anything else may hide a file or commit.
+export function listingComplete({ files, commits, expectedFiles, expectedCommits }) {
+  const count = value => (/^\d+$/.test(String(value ?? "").trim()) ? Number(value) : Number.NaN);
+  const wantFiles = count(expectedFiles);
+  const wantCommits = count(expectedCommits);
+  return files === wantFiles && commits === wantCommits && wantFiles < MAX_LISTED_FILES && wantCommits < MAX_LISTED_COMMITS;
+}
+
+// GitHub commits a bot's API-made commits as web-flow, so the committer is either the bot or web-flow, and GitHub must have verified the signature.
+export function botCommit(commit, bot) {
+  return commit?.author === bot && (commit.committer === bot || commit.committer === "web-flow") && commit.verified === true;
+}
+
+// Why a PR needs no review at all, or "" when it does; a PR with no listed files is reviewed so a failed listing never skips one.
+export function nothingToReviewReason({ author = "", commits = [], paths = [] }) {
+  if (DEPENDENCY_BOTS.has(author) && commits.length > 0 && commits.every(c => botCommit(c, author))) return "bot_author";
+  if (paths.length === 0) return "";
+  if (paths.every(isDocsPath)) return "docs_only";
+  if (paths.every(isTranslationPath)) return "translation_only";
+  return "";
+}
diff --git a/scripts/ai-review/src/severity.mjs b/scripts/ai-review/src/severity.mjs
index cd872c527e..33ba5be12a 100644
--- a/scripts/ai-review/src/severity.mjs
+++ b/scripts/ai-review/src/severity.mjs
@@ -1,5 +1,5 @@
 export const SEVERITIES = ["p0", "p1", "p2", "p3"];
-// Per-review limits; p0 and p1 are never capped because a blocker must always be reported.
+// Per-review limits; p0 and p1 are never capped because a finding that blocks must always be reported.
 export const SEVERITY_CAPS = { p2: 3, p3: 2 };
 const LEGACY_SEVERITIES = new Map([
   ["critical", "p0"],
diff --git a/scripts/ai-review/test/comments.test.mjs b/scripts/ai-review/test/comments.test.mjs
index 3b5e3bd080..0da4a7e729 100644
--- a/scripts/ai-review/test/comments.test.mjs
+++ b/scripts/ai-review/test/comments.test.mjs
@@ -1,12 +1,14 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 import { spawnSync } from "node:child_process";
+import { readFileSync } from "node:fs";
 
 import {
   ANY_REVIEW_MARKER,
   REVIEW_HEADING,
   bodyAtPassLimit,
   bodyAtReviewedHead,
+  bodyAtUnchangedDiff,
   bodyAtUnreviewedHead,
   claimedReviewBody,
   finishReviewBody,
@@ -20,16 +22,18 @@ import {
   reviewShaTag,
   reviewSkipReason,
   reviewedCommitLine,
+  reviewedDiffFingerprint,
   reviewedKey,
   sanitizeReviewBody,
   selectOwnReviewComment,
   shouldSkipAsReviewed,
+  shouldSkipAsUnchangedDiff,
   withPassLimitNote,
   withPassTag,
   withReviewShaTag,
   withoutAutoApproveLine,
 } from "../src/comments.mjs";
-import { autoApproveLine } from "../src/auto-approve.mjs";
+import { autoApproveLine, withoutCarriedApproval } from "../src/auto-approve.mjs";
 import { mergeConfidence } from "../src/confidence.mjs";
 
 const MARKER = ANY_REVIEW_MARKER;
@@ -637,3 +641,75 @@ test("a reviewed head drops a limit note once the cap no longer applies", () =>
   }
   assert.equal(bodyAtReviewedHead(body, 2), body);
 });
+
+const FP_A = "a".repeat(64);
+const FP_B = "b".repeat(64);
+const HEAD_1 = "1".repeat(40);
+const HEAD_2 = "2".repeat(40);
+const stampedReview = (fingerprint = FP_A, extra = {}) => finishReviewBody("## 🔎 OpenObserve Code Review\n\n> [!TIP]\n> ### ✅ Approved", {
+  key: HEAD_1, passes: 1, maxPasses: 0, reviewed: true, confidence: { level: "high", reasons: ["no blockers"] }, diffFingerprint: fingerprint, ...extra,
+});
+
+test("a stamped review carries the fingerprint of the diff it read; an unstamped one vouches for none", () => {
+  assert.equal(reviewedDiffFingerprint(stampedReview()), FP_A);
+  assert.equal(reviewedDiffFingerprint(stampedReview(FP_A, { reviewed: false })), "");
+  assert.equal(reviewedDiffFingerprint(stampedReview("")), "");
+  assert.equal(reviewedDiffFingerprint(`plain text <!-- o2-review-diff:${FP_A} -->`), "", "without a sha tag no head was reviewed");
+});
+
+test("an unchanged diff is skipped unless the run is forced or the diff is not pinned to the head", () => {
+  const body = stampedReview();
+  assert.equal(shouldSkipAsUnchangedDiff(body, FP_A, { pinned: true }), true);
+  assert.equal(shouldSkipAsUnchangedDiff(body, FP_B, { pinned: true }), false);
+  assert.equal(shouldSkipAsUnchangedDiff(body, FP_A, { pinned: false }), false);
+  assert.equal(shouldSkipAsUnchangedDiff(body, FP_A, { pinned: true, force: true }), false);
+  assert.equal(shouldSkipAsUnchangedDiff(body, "", { pinned: true }), false);
+});
+
+test("an unchanged-diff skip in approve mode keeps the review but not the auto-approval it can no longer back", () => {
+  const approved = autoApproveLine({ mode: "approve", approved: true, reasons: [] });
+  const body = stampedReview(FP_A, { gateLine: approved });
+  assert.ok(body.includes(approved));
+  const next = withoutCarriedApproval(bodyAtUnchangedDiff(body, HEAD_2, 0));
+  assert.equal(next.includes("Auto-approved"), false);
+  assert.match(next, /Needs human review/);
+  assert.equal(reviewedKey(next), HEAD_2);
+  assert.equal(reviewedDiffFingerprint(next), FP_A);
+  assert.equal(withoutCarriedApproval(stampedReview()), stampedReview(), "a body with no approval line is unchanged");
+  const source = readFileSync(new URL("../run-review.mjs", import.meta.url), "utf-8");
+  assert.match(source, /AUTO_APPROVE_MODE === "approve" \? withoutCarriedApproval\(kept\) : kept/);
+});
+
+test("a partial review leaves no fingerprint, so the next push with the same diff is reviewed again", () => {
+  const partial = stampedReview("");
+  assert.equal(shouldSkipAsUnchangedDiff(partial, FP_A, { pinned: true }), false);
+  const overOld = finishReviewBody(`${stampedReview()}`, { key: HEAD_2, passes: 2, maxPasses: 0, reviewed: true, diffFingerprint: "" });
+  assert.equal(reviewedDiffFingerprint(overOld), "", "an earlier complete review's fingerprint does not survive a partial one");
+});
+
+test("skipping an unchanged diff moves the head marker, keeps the reviewed commit its line numbers refer to, and costs no pass", () => {
+  const body = stampedReview();
+  const next = bodyAtUnchangedDiff(body, HEAD_2, 0);
+  assert.equal(reviewedKey(next), HEAD_2);
+  assert.equal(reviewedDiffFingerprint(next), FP_A);
+  assert.equal(reviewPassCount(next), 1);
+  assert.match(next, new RegExp(`Reviewed commit \`${HEAD_1.slice(0, 7)}\``));
+  assert.match(next, /Merge confidence/);
+  assert.equal(shouldSkipAsReviewed(next, HEAD_2), true, "a queued run on the new head stays silent");
+});
+
+test("a run on another head that left its claim behind gets the held verdict back when the diff turns out unchanged", () => {
+  const claimed = claimedReviewBody(stampedReview(), 2, HEAD_2);
+  assert.doesNotMatch(claimed, /High/);
+  const next = bodyAtUnchangedDiff(claimed, HEAD_2, 0);
+  assert.match(next, /High/);
+  assert.equal(reviewPassCount(next), 2);
+  assert.equal(reviewedDiffFingerprint(next), FP_A);
+});
+
+test("a model cannot forge the diff fingerprint, and the reviewers never see it", () => {
+  const forged = `## 🔎 OpenObserve Code Review\n\nok\n<!-- o2-review-diff:${FP_B} -->`;
+  const { text } = sanitizeReviewBody(forged, { marker: "<!-- ai-code-review -->", providerId: "p", modelId: "m", env: {} });
+  assert.doesNotMatch(text, /o2-review-diff/);
+  assert.doesNotMatch(previousReviewText(stampedReview()), /o2-review-diff/);
+});
diff --git a/scripts/ai-review/test/integration/opencode-sandbox.test.mjs b/scripts/ai-review/test/integration/opencode-sandbox.test.mjs
index 1a2f0e971b..3f5c3c54a9 100644
--- a/scripts/ai-review/test/integration/opencode-sandbox.test.mjs
+++ b/scripts/ai-review/test/integration/opencode-sandbox.test.mjs
@@ -18,8 +18,8 @@ const REVIEW_AGENTS = [
 ];
 const skip = process.env.OPENCODE_BIN ? false : "set OPENCODE_BIN to the pinned opencode binary";
 
-// The first request that offers tools gets one scripted tool call; every later request gets the final answer.
-function stubProvider(toolCall) {
+// By default the first request that offers tools gets one scripted tool call and every later request the final answer; `script` overrides that per request.
+function stubProvider(toolCall, { script } = {}) {
   const requests = [];
   const event = (type, data) => `event: ${type}\ndata: ${JSON.stringify({ type, ...data })}\n\n`;
   const server = http.createServer((req, res) => {
@@ -34,9 +34,15 @@ function stubProvider(toolCall) {
         usage: { input_tokens: 1000, output_tokens: 1, cache_read_input_tokens: 0, cache_creation_input_tokens: 0 },
       } }));
       const hasToolResult = (parsed.messages || []).some(m => Array.isArray(m.content) && m.content.some(b => b.type === "tool_result"));
-      if (parsed.tools?.length && !hasToolResult) {
-        res.write(event("content_block_start", { index: 0, content_block: { type: "tool_use", id: "toolu_1", name: toolCall.name, input: {} } }));
-        res.write(event("content_block_delta", { index: 0, delta: { type: "input_json_delta", partial_json: JSON.stringify(toolCall.args) } }));
+      const step = script ? script(parsed, requests.length) : { tool: parsed.tools?.length && !hasToolResult ? toolCall : null };
+      if (step.hangMs) {
+        const timer = setTimeout(() => res.end(), step.hangMs);
+        res.on("close", () => clearTimeout(timer));
+        return;
+      }
+      if (step.tool) {
+        res.write(event("content_block_start", { index: 0, content_block: { type: "tool_use", id: `toolu_${requests.length}`, name: step.tool.name, input: {} } }));
+        res.write(event("content_block_delta", { index: 0, delta: { type: "input_json_delta", partial_json: JSON.stringify(step.tool.args) } }));
         res.write(event("content_block_stop", { index: 0 }));
         res.write(event("message_delta", { delta: { stop_reason: "tool_use" }, usage: { output_tokens: 100 } }));
       } else {
@@ -102,9 +108,10 @@ async function withServer(prDir, configPath, run, { readOnly = true } = {}) {
   }
 }
 
-function stubConfig(file, stub, configDir) {
+function stubConfig(file, stub, configDir, edit = () => {}) {
   const config = JSON.parse(stripJsonc(readFileSync(join(ENGINE_DIR, file), "utf-8")));
   config.providers["anthropic-review"].settings = { baseURL: stub.url };
+  edit(config);
   const configPath = join(configDir, "opencode.json");
   writeFileSync(configPath, JSON.stringify(config));
   return configPath;
@@ -189,12 +196,17 @@ test("without sanitize, the env flags still keep project config, tools and agent
   assert.deepEqual(toolNames, ["glob", "grep", "read", "skill"]);
 });
 
-test("ci-full: every tool is offered and runs without a prompt, and the shell sees no GitHub token", { skip, timeout: 120_000 }, async t => {
+const allowShell = (...commands) => config => {
+  config.agents["ai-review-correctness"].permissions.push(...commands.map(resource => ({ action: "shell", resource, effect: "allow" })));
+};
+
+test("ci-full: file tools and the shell are offered without a prompt, and the shell sees no GitHub token", { skip, timeout: 120_000 }, async t => {
   const pr = plantedPr();
   const stub = await stubProvider({ name: "shell", args: { command: "echo ran-$((6*7)); env", description: "probe" } });
   const configDir = mkdtempSync(join(tmpdir(), "ai-review-config-"));
   cleanup(t, stub, pr, configDir);
-  const configPath = stubConfig(OPENCODE_CONFIGS["ci-full"].file, stub, configDir);
+  // The allowlist refuses echo and env, so this probe of the shell's environment adds them for the test alone.
+  const configPath = stubConfig(OPENCODE_CONFIGS["ci-full"].file, stub, configDir, allowShell("echo *", "env *"));
   sanitizePrTree(pr.root, ENGINE_DIR);
 
   await withServer(pr.root, configPath, async client => {
@@ -206,8 +218,128 @@ test("ci-full: every tool is offered and runs without a prompt, and the shell se
   }, { readOnly: false });
 
   const toolNames = (stub.requests[0].body.tools || []).map(tool => tool.name);
-  for (const name of ["read", "glob", "grep", "edit", "write", "shell", "webfetch"]) assert.ok(toolNames.includes(name), name);
+  for (const name of ["read", "glob", "grep", "edit", "write", "shell"]) assert.ok(toolNames.includes(name), name);
+  for (const name of ["webfetch", "websearch", "subagent", "question", "execute"]) assert.equal(toolNames.includes(name), false, `${name} is offered`);
   const content = toolResultOf(stub.requests.at(-1));
   assert.match(content, /ran-42/);
   assert.doesNotMatch(content, /ghs_must_not_leak/);
 });
+
+test("the real self-check passes the shipped ci-full config and refuses it with execute or the whole shell re-allowed", { skip, timeout: 120_000 }, async t => {
+  for (const [extra, problem] of [[null, null], [{ action: "execute", resource: "*", effect: "allow" }, /ai-review-qa: execute allowed/], [{ action: "shell", resource: "*", effect: "allow" }, /ai-review-qa: shell allows every command/]]) {
+    const pr = plantedPr();
+    const stub = await stubProvider(null);
+    const configDir = mkdtempSync(join(tmpdir(), "ai-review-config-"));
+    cleanup(t, stub, pr, configDir);
+    const configPath = stubConfig(OPENCODE_CONFIGS["ci-full"].file, stub, configDir, config => { if (extra) config.agents["ai-review-qa"].permissions.push(extra); });
+    sanitizePrTree(pr.root, ENGINE_DIR);
+    await withServer(pr.root, configPath, async client => {
+      const check = selfCheck(client, REVIEW_AGENTS, { readOnly: false });
+      if (problem) await assert.rejects(check, problem);
+      else assert.equal((await check).agents, REVIEW_AGENTS.length);
+    }, { readOnly: false });
+  }
+});
+
+test("ci-full offers skill only because opencode appends a narrower rule, and refuses every skill", { skip, timeout: 120_000 }, async t => {
+  const pr = plantedPr();
+  const stub = await stubProvider({ name: "skill", args: { id: "browser" } });
+  const configDir = mkdtempSync(join(tmpdir(), "ai-review-config-"));
+  cleanup(t, stub, pr, configDir);
+  const configPath = stubConfig(OPENCODE_CONFIGS["ci-full"].file, stub, configDir);
+  sanitizePrTree(pr.root, ENGINE_DIR);
+  await withServer(pr.root, configPath, async client => {
+    const result = await client.prompt({ ...PROMPT, title: "skill" });
+    assert.equal(result.rejectedPermissions, 0);
+  }, { readOnly: false });
+  assert.match(toolResultOf(stub.requests.at(-1)), /Permission denied: skill/);
+});
+
+test("ci-full shell runs an allowlisted command and refuses a build outright, without asking", { skip, timeout: 120_000 }, async t => {
+  // A RegExp is the output an allowed command must print; null means opencode must refuse it.
+  const ONE = /(?<!\d)1(?!\d)/;
+  const cases = [
+    ["cat src/main.rs | wc -l", ONE], ["grep -c main src/main.rs", ONE], ["find src -name '*.rs' | wc -l", ONE], ["tail -n 1 src/main.rs | wc -l", ONE],
+    ["ls src && wc -l src/main.rs", ONE], ["find src -name '*-executor*' | wc -l", /(?<!\d)0(?!\d)/], ["cargo build", null], ["ls && touch built.txt", null],
+    ["find . -name main.rs -exec touch built.txt ;", null], ["find src -fprint built.txt", null], ["git grep -nOsh main", null],
+    ["cat $(touch built.txt)", null], ["cat `touch built.txt`", null], ["cat src/main.rs > built.txt", null], ["cat /proc/self/environ", null],
+  ];
+  for (const [command, output] of cases) {
+    const pr = plantedPr();
+    const stub = await stubProvider({ name: "shell", args: { command, description: "probe" } });
+    const configDir = mkdtempSync(join(tmpdir(), "ai-review-config-"));
+    cleanup(t, stub, pr, configDir);
+    const configPath = stubConfig(OPENCODE_CONFIGS["ci-full"].file, stub, configDir);
+    sanitizePrTree(pr.root, ENGINE_DIR);
+    await withServer(pr.root, configPath, async client => {
+      const result = await client.prompt({ ...PROMPT, title: "shell" });
+      assert.equal(result.rejectedPermissions, 0, "a denied command must not reach a prompt that ci-full would approve");
+    }, { readOnly: false });
+    const content = toolResultOf(stub.requests.at(-1));
+    assert.match(content, output ?? /Permission denied: shell/, command);
+    assert.equal(existsSync(join(pr.root, "built.txt")), false, command);
+  }
+});
+
+// Why neither config sets `steps`: if opencode ever stops ending the capped turn on an assistant message, this fails and the cap can come back.
+test("opencode 2.2.0's step cap ends the capped turn on an assistant prefill, which the model rejects with thinking on", { skip, timeout: 120_000 }, async t => {
+  const pr = plantedPr();
+  // Asks for another tool call on every turn that allows one, so only the cap can end the loop.
+  const stub = await stubProvider(null, { script: parsed => ({ tool: parsed.tool_choice?.type === "none" ? null : { name: "glob", args: { pattern: "*.rs" } } }) });
+  const configDir = mkdtempSync(join(tmpdir(), "ai-review-config-"));
+  cleanup(t, stub, pr, configDir);
+  const configPath = stubConfig(OPENCODE_CONFIGS["ci-full"].file, stub, configDir, config => { config.agents["ai-review-correctness"].steps = 3; });
+  sanitizePrTree(pr.root, ENGINE_DIR);
+  await withServer(pr.root, configPath, client => client.prompt({ ...PROMPT, title: "steps" }), { readOnly: false });
+  assert.equal(stub.requests.length, 3);
+  const capped = stub.requests.at(-1).body;
+  assert.deepEqual(capped.tool_choice, { type: "none" });
+  assert.equal(capped.messages.at(-1).role, "assistant");
+  assert.match(JSON.stringify(capped.messages.at(-1).content), /MAXIMUM STEPS REACHED/);
+  for (const request of stub.requests.slice(0, -1)) assert.equal(request.body.messages.at(-1).role, "user");
+});
+
+test("each effort variant reaches the provider as its own effort level", { skip, timeout: 120_000 }, async t => {
+  for (const variant of ["low", "medium", "xhigh", "max"]) {
+    const pr = plantedPr();
+    const stub = await stubProvider({ name: "glob", args: { pattern: "*.rs" } });
+    const configDir = mkdtempSync(join(tmpdir(), "ai-review-config-"));
+    cleanup(t, stub, pr, configDir);
+    const configPath = stubConfig(OPENCODE_CONFIGS["ci-full"].file, stub, configDir);
+    sanitizePrTree(pr.root, ENGINE_DIR);
+    await withServer(pr.root, configPath, client => client.prompt({ ...PROMPT, variant, title: variant }), { readOnly: false });
+    for (const request of stub.requests) {
+      assert.deepEqual(request.body.output_config, { effort: variant });
+      assert.equal(request.body.thinking?.type, "adaptive");
+      for (const field of ["temperature", "top_p", "top_k", "tool_choice"]) assert.equal(request.body[field], undefined, field);
+    }
+  }
+});
+
+test("a session still running at its soft deadline is interrupted and answers the wrap-up prompt from the same context", { skip, timeout: 120_000 }, async t => {
+  const pr = plantedPr();
+  const wrapText = "WRAP-UP-NOW-5d1e";
+  // A tool step, then a model turn that never returns; only the wrap-up prompt gets an answer.
+  const stub = await stubProvider(null, {
+    script: (parsed, n) => {
+      if (parsed.messages?.some(m => JSON.stringify(m.content).includes(wrapText))) return { tool: null };
+      return n === 1 ? { tool: { name: "glob", args: { pattern: "*.rs" } } } : { hangMs: 60_000 };
+    },
+  });
+  const configDir = mkdtempSync(join(tmpdir(), "ai-review-config-"));
+  cleanup(t, stub, pr, configDir);
+  const configPath = stubConfig(OPENCODE_CONFIGS["ci-full"].file, stub, configDir);
+  sanitizePrTree(pr.root, ENGINE_DIR);
+  await withServer(pr.root, configPath, async client => {
+    const result = await client.prompt({ ...PROMPT, title: "wrap-up", timeoutMs: 20_000, wrapUp: { ms: 10_000, text: wrapText } });
+    assert.equal(result.wrappedUp, true);
+    assert.equal(result.text, "<no-issues/>");
+  }, { readOnly: false });
+  const last = stub.requests.at(-1);
+  assert.match(last.raw, new RegExp(wrapText));
+  assert.ok(last.body.messages.some(m => Array.isArray(m.content) && m.content.some(b => b.type === "tool_result")), "the wrap-up lost the steps the agent had already run");
+  for (const request of stub.requests) {
+    for (const field of ["temperature", "top_p", "top_k", "tool_choice"]) assert.equal(request.body[field], undefined, field);
+    assert.equal(request.body.messages.at(-1).role, "user", "the wrap-up must not end on an assistant prefill");
+  }
+});
diff --git a/scripts/ai-review/test/jsonc.mjs b/scripts/ai-review/test/jsonc.mjs
index 670c1bbac1..9adbc3e55a 100644
--- a/scripts/ai-review/test/jsonc.mjs
+++ b/scripts/ai-review/test/jsonc.mjs
@@ -1,18 +1 @@
-// Comments and trailing commas out, so the opencode configs parse as JSON in tests.
-export function stripJsonc(text) {
-  let out = "";
-  for (let i = 0; i < text.length; i++) {
-    const c = text[i];
-    if (c === '"') {
-      const start = i;
-      for (i++; i < text.length && text[i] !== '"'; i++) if (text[i] === "\\") i++;
-      out += text.slice(start, i + 1);
-    } else if (c === "/" && text[i + 1] === "/") {
-      while (i < text.length && text[i] !== "\n") i++;
-      out += "\n";
-    } else {
-      out += c;
-    }
-  }
-  return out.replace(/,(\s*[}\]])/g, "$1");
-}
+export { stripJsonc } from "../src/jsonc.mjs";
diff --git a/scripts/ai-review/test/opencode.test.mjs b/scripts/ai-review/test/opencode.test.mjs
index 6e48eb3d32..cd1bdafeb1 100644
--- a/scripts/ai-review/test/opencode.test.mjs
+++ b/scripts/ai-review/test/opencode.test.mjs
@@ -11,15 +11,19 @@ import {
   OPENCODE_CONFIGS,
   OpencodeClient,
   buildServerEnv,
+  ciFullProblems,
   createSseParser,
   externalDirectoryProblem,
   httpRequest,
   isTransientError,
+  modelVariantIds,
   resolveOpencodeConfig,
   selfCheck,
   shouldRetry,
   toolAllowedWithoutAsking,
   toolEnabled,
+  wildcardMatch,
+  wrapUpStartMs,
 } from "../src/opencode.mjs";
 import { stripJsonc } from "./jsonc.mjs";
 
@@ -28,15 +32,16 @@ const REPO_ROOT = resolve(dirname(fileURLToPath(import.meta.url)), "../../..");
 const AGENT_RUN_MS = 1500;
 const HEADERS_TIMEOUT_MS = 1000;
 
-function fakeOpencode({ idleAfterMs = AGENT_RUN_MS, finalEvent = "session.execution.succeeded", error = null, errorBeforeAck = null, eventStream = true } = {}) {
+function fakeOpencode({ idleAfterMs = AGENT_RUN_MS, finalEvent = "session.execution.succeeded", error = null, errorBeforeAck = null, eventStream = true, wrapUpAfterMs = null, interruptEventDelayMs = 50 } = {}) {
   const calls = [];
+  let prompts = 0;
   const streams = new Set();
   let idle = null;
   const emit = (type, data) => {
     for (const res of streams) res.write(`data: ${JSON.stringify({ id: "evt", type, data })}\n\n`);
   };
   const finishRun = () => {
-    idle = { type: "idle", outcome: finalEvent === "session.execution.succeeded" ? "succeeded" : "failed", ...(error ? { error } : {}) };
+    idle = { id: `idle_${prompts}`, type: "idle", outcome: finalEvent === "session.execution.succeeded" ? "succeeded" : "failed", ...(error ? { error } : {}) };
     if (eventStream) emit(finalEvent, { sessionID: "ses_1", ...(error ? { error } : {}) });
   };
   const server = http.createServer((req, res) => {
@@ -73,7 +78,13 @@ function fakeOpencode({ idleAfterMs = AGENT_RUN_MS, finalEvent = "session.execut
           setTimeout(() => send(200, { data: { id: "msg_u1" } }), 200);
           return;
         }
-        send(200, { data: { id: "msg_u1" } });
+        prompts += 1;
+        send(200, { data: { id: `msg_u${prompts}` } });
+        // The second prompt is the wrap-up: it answers, where the first ran on until interrupted.
+        if (wrapUpAfterMs !== null && prompts > 1) {
+          setTimeout(finishRun, wrapUpAfterMs);
+          return;
+        }
         setTimeout(() => emit("permission.asked", { id: "per_1", sessionID: "ses_1", action: "shell", resources: ["*"] }), 50);
         if (idleAfterMs !== null) setTimeout(finishRun, idleAfterMs);
         return;
@@ -103,7 +114,11 @@ function fakeOpencode({ idleAfterMs = AGENT_RUN_MS, finalEvent = "session.execut
         res.end();
         return;
       }
-      if (req.method === "POST" && req.url === "/api/session/ses_1/interrupt") return send(200, { interrupted: true });
+      if (req.method === "POST" && req.url === "/api/session/ses_1/interrupt") {
+        idle = { id: `idle_${prompts}`, type: "idle", outcome: "interrupted" };
+        setTimeout(() => emit("session.execution.interrupted", { sessionID: "ses_1" }), interruptEventDelayMs);
+        return send(200, { interrupted: true });
+      }
       if (req.method === "DELETE" && req.url === "/api/session/ses_1") {
         res.writeHead(204);
         res.end();
@@ -216,6 +231,61 @@ test("a timed-out agent is interrupted server-side and not reported as transient
   }
 });
 
+test("a reviewer still running near its timeout is interrupted and asked for its findings in the same session", async () => {
+  const fake = await fakeOpencode({ idleAfterMs: null, wrapUpAfterMs: 100 });
+  try {
+    const client = new OpencodeClient({ baseUrl: fake.baseUrl, password: "pw", statusPollMs: 100 });
+    const started = Date.now();
+    const result = await client.prompt({ ...PROMPT, timeoutMs: 3000, wrapUp: { ms: 1000, text: "wrap up now" } });
+    client.close();
+    assert.ok(Date.now() - started < 3000, "waited for the hard timeout instead of the wrap-up answer");
+    assert.equal(result.wrappedUp, true);
+    assert.equal(result.text, "<no-issues/>");
+    assert.equal(result.info.tokens.input, 2000, "tokens are the whole session's, both prompts included");
+    const prompts = fake.calls.filter(c => c.url === "/api/session/ses_1/prompt");
+    assert.deepEqual(prompts.map(c => c.body.text), ["", "wrap up now"]);
+    assert.equal(fake.calls.filter(c => c.url === "/api/session/ses_1/interrupt").length, 1);
+  } finally {
+    await fake.close();
+  }
+});
+
+test("an interrupted event that arrives after the wrap-up prompt went out does not end the wrap-up", async () => {
+  // The poll confirms the interrupt first; the stream's interrupted event lands while the follow-up is running.
+  const fake = await fakeOpencode({ idleAfterMs: null, wrapUpAfterMs: 600, interruptEventDelayMs: 400 });
+  try {
+    const client = new OpencodeClient({ baseUrl: fake.baseUrl, password: "pw", statusPollMs: 100 });
+    const result = await client.prompt({ ...PROMPT, timeoutMs: 4000, wrapUp: { ms: 2000, text: "wrap up now" } });
+    client.close();
+    assert.equal(result.wrappedUp, true);
+    assert.equal(result.text, "<no-issues/>");
+    assert.equal(fake.calls.filter(c => c.url === "/api/session/ses_1/prompt").length, 2);
+  } finally {
+    await fake.close();
+  }
+});
+
+test("a wrap-up that does not answer in its slot still ends as a hard timeout", async () => {
+  const fake = await fakeOpencode({ idleAfterMs: null });
+  try {
+    const client = new OpencodeClient({ baseUrl: fake.baseUrl, password: "pw", statusPollMs: 100 });
+    await assert.rejects(client.prompt({ ...PROMPT, timeoutMs: 1600, wrapUp: { ms: 800, text: "wrap up now" } }), err => err.name === "TimeoutError");
+    client.close();
+    assert.equal(fake.calls.filter(c => c.url === "/api/session/ses_1/prompt").length, 2);
+  } finally {
+    await fake.close();
+  }
+});
+
+test("the wrap-up slot is taken only from a session at least twice its length", () => {
+  const wrapUp = { ms: 3 * 60_000, text: "wrap" };
+  assert.equal(wrapUpStartMs(20 * 60_000, wrapUp), 17 * 60_000);
+  assert.equal(wrapUpStartMs(6 * 60_000, wrapUp), 3 * 60_000);
+  assert.equal(wrapUpStartMs(5 * 60_000, wrapUp), 5 * 60_000);
+  assert.equal(wrapUpStartMs(20 * 60_000, null), 20 * 60_000);
+  assert.equal(wrapUpStartMs(20 * 60_000, { ms: 60_000, text: "" }), 20 * 60_000);
+});
+
 test("a provider rate limit surfaced as session.execution.failed is transient", async () => {
   const error = { type: "provider.rate-limit", message: "Too Many Requests", status: 429 };
   const fake = await fakeOpencode({ idleAfterMs: 100, finalEvent: "session.execution.failed", error });
@@ -354,6 +424,14 @@ const READ_ONLY = [
   rule("skill", "browser", "deny"),
 ];
 const FULL = [...BASE, rule("*", "*", "allow"), rule("browser", "*", "deny")];
+const CI_FULL = [
+  ...BASE,
+  rule("*", "*", "allow"),
+  ...["webfetch", "websearch", "subagent", "question", "execute", "skill"].map(id => rule(id, "*", "deny")),
+  rule("shell", "*", "deny"),
+  rule("shell", "git diff *", "allow"),
+  rule("browser", "*", "deny"),
+];
 const agent = (permissions, id = "ai-review-security") => ({ id, name: id, mode: "primary", permissions });
 
 test("self-check passes only for read-only agents and built-in plugins", async () => {
@@ -379,17 +457,21 @@ test("self-check passes only for read-only agents and built-in plugins", async (
   await assert.rejects(selfCheck(fakeClient({ agents: [agent(FULL)] }), names), /shell allowed/, "the default config must refuse a full grant");
 });
 
-test("ci-full self-check wants every agent registered with the full grant, and still refuses foreign plugins", async () => {
+test("ci-full self-check wants file tools granted, web and sub-agent tools denied and the shell allowlisted", async () => {
   const names = ["ai-review-security", "ai-review-correctness"];
-  const agents = [agent(FULL), agent(FULL, "ai-review-correctness")];
+  const agents = [agent(CI_FULL), agent(CI_FULL, "ai-review-correctness")];
   const result = await selfCheck(fakeClient({ agents }), names, { readOnly: false });
   assert.equal(result.agents, 2);
 
-  await assert.rejects(selfCheck(fakeClient({ agents: [agent(FULL)] }), names, { readOnly: false }), /ai-review-correctness: not registered/);
+  await assert.rejects(selfCheck(fakeClient({ agents: [agent(CI_FULL)] }), names, { readOnly: false }), /ai-review-correctness: not registered/);
   await assert.rejects(
-    selfCheck(fakeClient({ agents: [agent(READ_ONLY), agent(FULL, "ai-review-correctness")] }), names, { readOnly: false }),
+    selfCheck(fakeClient({ agents: [agent(READ_ONLY), agent(CI_FULL, "ai-review-correctness")] }), names, { readOnly: false }),
     /ai-review-security: edit not fully allowed/,
   );
+  assert.deepEqual(ciFullProblems(FULL), ["webfetch allowed", "websearch allowed", "subagent allowed", "question allowed", "execute allowed", "skill allowed", "shell allows every command"]);
+  assert.deepEqual(ciFullProblems([...CI_FULL, rule("execute", "*", "allow")]), ["execute allowed"]);
+  assert.deepEqual(ciFullProblems([...CI_FULL, rule("shell", "*", "deny")]), ["shell denied"]);
+  assert.deepEqual(ciFullProblems(CI_FULL), []);
   await assert.rejects(
     selfCheck(fakeClient({ agents, plugins: [...BUILTIN_PLUGINS, { id: "p", source: { type: "package", target: "evil" }, state: { status: "active" } }] }), names, { readOnly: false }),
     /non-built-in plugins/,
@@ -427,10 +509,44 @@ test("both configs register the same agents, provider and model; only the defaul
     for (const toolId of BUILTIN_TOOL_IDS) assert.equal(toolEnabled(toolId, readOnly), ["read", "glob", "grep"].includes(toolId), `${name} ${toolId}`);
     assert.equal(externalDirectoryProblem(readOnly), "", name);
     const full = [...BASE, ...ci.agents[name].permissions];
-    for (const toolId of BUILTIN_TOOL_IDS) assert.equal(toolAllowedWithoutAsking(toolId, full), true, `${name} ${toolId}`);
+    assert.deepEqual(ciFullProblems(full), [], name);
+    // opencode 2.2.0 ends the capped turn on an assistant message, a prefill the model rejects, so no agent sets a step cap.
+    for (const config of [base, ci]) for (const key of ["steps", "maxSteps"]) assert.equal(config.agents[name][key], undefined, `${name} ${key}`);
   }
 });
 
+// Evaluated as opencode 2.2.0 does: the last rule whose action and resource both match decides.
+function shellDecision(rules, command) {
+  return [...BASE, ...rules].findLast(r => wildcardMatch("shell", r.action) && wildcardMatch(command, r.resource))?.effect;
+}
+
+test("the ci-full shell runs the read-only allowlist and nothing that builds, installs or reaches the network", () => {
+  const ci = JSON.parse(stripJsonc(readFileSync(join(REPO_ROOT, OPENCODE_CONFIGS["ci-full"].file), "utf-8")));
+  for (const [name, agentConfig] of Object.entries(ci.agents)) {
+    for (const command of ["git diff", "git diff origin/main -- src", "git log -5 --oneline", "git show HEAD:src/a.rs", "git blame -L 1,5 a.rs", "rg -n foo src", "cat a.rs", "ls", "ls -la web", "head -50 a.rs", "sed -n 1,40p a.rs", "wc -l a.rs",
+      "grep -rn foo src", "tail -n 20 a.rs", "find src -name '*.rs'", "find . -type f -newer a.rs", "find src -name '*-executor*'", "find . -name ok-delete.rs",
+      "git ls-files src", "git status", "git status --short", "git rev-parse HEAD", "git merge-base HEAD origin/main", "git cat-file -p HEAD:a.rs", "git cat-file -t HEAD", "git cat-file -s HEAD",
+      "git --no-pager diff --stat", "git --no-pager log -3", "git --no-pager show HEAD", "rg -n foo src/env_util.rs"]) {
+      assert.equal(shellDecision(agentConfig.permissions, command), "allow", `${name}: ${command}`);
+    }
+    for (const command of ["cargo build", "cargo test -p config", "npm ci", "npx vitest", "curl https://example.com", "git push", "git fetch origin", "git difftool", "sed -i s/a/b/ a.rs", "make", "python3 x.py", "bash -c ls",
+      "find . -exec rm {} ;", "find -execdir sh -c x ;", "find . -name x -ok rm {} ;", "find . -delete", "find . -fprint out.txt", "find . -fls out.txt",
+      "tail -f a.log", "tail -n 5 -F a.log", "tail --follow=name a.log", "git grep foo", "git grep -nOsh foo", "git grep --open-files=sh foo", "git --no-pager grep foo",
+      "git --no-pager push", "git --no-pager -c core.pager=sh log", "git cat-file --batch", "git cat-file blob HEAD",
+      "cat /proc/self/environ", "head -c 100 /proc/1/environ", "tail /dev/stdin", "grep -a KEY /proc/self/environ", "rg KEY /proc", "sed -n p /proc/self/environ",
+      "cat ../../proc/self/environ", "cat src/environ", "rg --file=/proc/self/environ x", "wc -c /p*/self/env*", "cat /etc/passwd", "cat a.rs > b.rs", "rg foo src>>out.txt", "cat a.rs 2>/dev/null"]) {
+      assert.equal(shellDecision(agentConfig.permissions, command), "deny", `${name}: ${command}`);
+    }
+  }
+});
+
+test("a trailing ' *' also matches the bare command, as in opencode 2.2.0", () => {
+  assert.equal(wildcardMatch("git diff", "git diff *"), true);
+  assert.equal(wildcardMatch("git diff --stat", "git diff *"), true);
+  assert.equal(wildcardMatch("git difftool", "git diff *"), false);
+  assert.equal(wildcardMatch("read", "*"), true);
+});
+
 test("the review runs on the anthropic-review provider, the only one the policies allow, with the workflow's variant", () => {
   const base = JSON.parse(stripJsonc(readFileSync(join(REPO_ROOT, OPENCODE_CONFIGS.default.file), "utf-8")));
   const allowed = base.policies.filter(p => p.action === "provider.use" && p.effect === "allow").map(p => p.resource);
@@ -441,9 +557,14 @@ test("the review runs on the anthropic-review provider, the only one the policie
   assert.equal(provider.package, "@opencode/ai/providers/anthropic");
   assert.deepEqual(provider.env, ["ANTHROPIC_REVIEW_API_KEY"]);
   const model = provider.models["claude-sonnet-5-5"];
-  assert.deepEqual(model.variants, [{ id: "high", settings: { thinking: { type: "adaptive" }, effort: "high" } }]);
+  assert.deepEqual(model.variants, ["low", "medium", "high", "xhigh", "max"].map(id => ({ id, settings: { thinking: { type: "adaptive" }, effort: id } })));
+  assert.deepEqual(modelVariantIds(base, "anthropic-review", "claude-sonnet-5-5"), ["low", "medium", "high", "xhigh", "max"]);
+  assert.deepEqual(modelVariantIds(base, "anthropic-review", "no-such-model"), []);
   const workflow = readFileSync(join(REPO_ROOT, ".github/workflows/ai-code-review.yml"), "utf-8");
-  assert.match(workflow, /provider_id: anthropic-review\n\s+model_id: claude-sonnet-5-5\n\s+model_variant: high\n\s+api_key_env: ANTHROPIC_REVIEW_API_KEY\n/);
+  assert.match(workflow, /provider_id: anthropic-review\n\s+model_id: claude-sonnet-5-5\n\s+api_key_env: ANTHROPIC_REVIEW_API_KEY\n/);
+  assert.doesNotMatch(workflow, /model_variant/, "the effort variable is the only source of the variant");
+  assert.match(workflow, /REVIEW_MODEL_VARIANT: \$\{\{ vars\.AI_REVIEW_EFFORT \|\| 'high' \}\}/);
+  assert.match(workflow, /REVIEW_COORDINATOR_VARIANT: \$\{\{ vars\.AI_REVIEW_COORDINATOR_EFFORT \|\| vars\.AI_REVIEW_EFFORT \|\| 'high' \}\}/);
   assert.match(workflow, /ANTHROPIC_REVIEW_API_KEY: \$\{\{ secrets\.USAGE_CREDIT_API_KEY \}\}/);
 });
 
diff --git a/scripts/ai-review/test/passes.test.mjs b/scripts/ai-review/test/passes.test.mjs
index 72c022adfd..94680e6c96 100644
--- a/scripts/ai-review/test/passes.test.mjs
+++ b/scripts/ai-review/test/passes.test.mjs
@@ -1,5 +1,6 @@
 import test from "node:test";
 import assert from "node:assert/strict";
+import { readFileSync } from "node:fs";
 
 import { mergeConfidence, unfinishedReviewers } from "../src/confidence.mjs";
 import { reviewerFacts } from "../src/auto-approve.mjs";
@@ -10,6 +11,7 @@ import {
   parseColdPasses,
   passLabel,
   passPlan,
+  reviewComplete,
   runPooled,
 } from "../src/passes.mjs";
 import { buildFallbackReview, partialFindingsBlock, selectFallbackFindings } from "../src/report.mjs";
@@ -137,3 +139,22 @@ test("the fallback never merges two different blockers that share most of their
   ]);
   assert.equal(selectFallbackFindings(same).length, 1);
 });
+
+test("only a review whose every pass finished in time and whose coordinator merged may skip an unchanged diff next time", () => {
+  const coordinator = { fallback: false };
+  const skippedPass = { agentKey: "frontend", agentName: "frontend Reviewer", pass: 1, findings: [], error: null, skipped: true };
+  assert.equal(reviewComplete([done("security", 1), done("security", 2), skippedPass], coordinator), true);
+  assert.equal(reviewComplete([done("security", 1), failed("security", 2)], coordinator), false, "a lost cold pass is a partial review");
+  assert.equal(reviewComplete([done("security", 1), failed("security", 2, { timedOut: true })], coordinator), false);
+  assert.equal(reviewComplete([done("security", 1), { ...done("qa", 1), parsed: false }], coordinator), false, "unparseable output is unfinished");
+  assert.equal(reviewComplete([done("security", 1), { ...done("qa", 1), wrappedUp: true }], coordinator), false, "a reviewer cut short at its soft deadline");
+  assert.equal(reviewComplete([done("security", 1)], { fallback: true }), false, "the coordinator fell back");
+  assert.equal(reviewComplete([done("security", 1)], null), false, "the coordinator never ran");
+});
+
+test("run-review writes the diff fingerprint only for a complete review", () => {
+  const source = readFileSync(new URL("../run-review.mjs", import.meta.url), "utf-8");
+  assert.match(source, /const complete = reviewComplete\(passResults, coordinatorResult\);/);
+  assert.match(source, /diffFingerprint: complete && fullyRead && diffPinned && hunksLocatable\(diff, readBaseFile\) \? fingerprint : ""/);
+  assert.equal((source.match(/diffFingerprint:/g) || []).length, 1, "every finishReviewBody call goes through the completeness check");
+});
diff --git a/scripts/ai-review/test/pr-diff.test.mjs b/scripts/ai-review/test/pr-diff.test.mjs
index 2d7551e9a1..dc75c557f8 100644
--- a/scripts/ai-review/test/pr-diff.test.mjs
+++ b/scripts/ai-review/test/pr-diff.test.mjs
@@ -6,7 +6,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 
 import { parseRawDiff, sizeReasons } from "../src/auto-approve.mjs";
-import { fetchDiff, fetchPinnedDiff, localDiff, pinDiff, prefixDiffPaths } from "../src/pr-diff.mjs";
+import { diffFingerprint, fetchDiff, fetchPinnedDiff, hunksLocatable, localDiff, pinDiff, prefixDiffPaths } from "../src/pr-diff.mjs";
 
 const DIFF = [
   "diff --git a/src/lib.rs b/src/lib.rs",
@@ -199,3 +199,114 @@ test("a renamed symlink or submodule whose header carries no mode cannot pass as
   assert.match(edited, /^index \S+ 100644$/m);
   assert.deepEqual(parseRawDiff(edited).problems, []);
 });
+
+test("a rebase that moves the PR's lines keeps its diff fingerprint, a changed line does not", () => {
+  const dir = mkdtempSync(join(tmpdir(), "ai-review-fingerprint-"));
+  const git = (...args) => execFileSync("git", ["-C", dir, "-c", "user.name=t", "-c", "user.email=t@t", "-c", "commit.gpgsign=false", ...args], { encoding: "utf-8" });
+  try {
+    git("init", "-q", "-b", "main");
+    const lines = Array.from({ length: 40 }, (_, i) => `line ${i}`);
+    writeFileSync(join(dir, "a.rs"), `${lines.join("\n")}\n`);
+    git("add", ".");
+    git("commit", "-qm", "base");
+    git("checkout", "-qb", "pr");
+    writeFileSync(join(dir, "a.rs"), `${lines.map((l, i) => (i === 30 ? "line 30 changed" : l)).join("\n")}\n`);
+    git("commit", "-qam", "pr change");
+    const before = localDiff(dir, "main", "pr");
+    git("checkout", "-q", "main");
+    writeFileSync(join(dir, "a.rs"), `head 1\nhead 2\nhead 3\n${lines.join("\n")}\n`);
+    git("commit", "-qam", "main moves on");
+    git("checkout", "-q", "pr");
+    git("rebase", "-q", "main");
+    const after = localDiff(dir, "main", "pr");
+    assert.notEqual(before, after, "the rebase must change hunk numbers and blob ids, or this test proves nothing");
+    assert.equal(diffFingerprint(after), diffFingerprint(before));
+    writeFileSync(join(dir, "a.rs"), `head 1\nhead 2\nhead 3\n${lines.map((l, i) => (i === 30 ? "line 30 changed again" : l)).join("\n")}\n`);
+    git("commit", "-qam", "another change");
+    assert.notEqual(diffFingerprint(localDiff(dir, "main", "pr")), diffFingerprint(before));
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("the fingerprint ignores only blob ids and hunk numbers", () => {
+  const base = "diff --git a/a b/a\nindex 1111111..2222222 100644\n--- a/a\n+++ b/a\n@@ -1,2 +1,2 @@ fn x\n ctx\n-old\n+new\n";
+  assert.equal(diffFingerprint(base.replace("1111111..2222222", "3333333..4444444").replace("-1,2 +1,2 @@ fn x", "-9,2 +12,2 @@ fn x")), diffFingerprint(base));
+  assert.notEqual(diffFingerprint(base.replace("@@ fn x", "@@ fn y")), diffFingerprint(base), "the function a hunk sits in is part of what was reviewed");
+  assert.notEqual(diffFingerprint(base.replace("+new", "+newer")), diffFingerprint(base));
+  assert.notEqual(diffFingerprint(base.replace("diff --git a/a b/a", "diff --git a/b b/b")), diffFingerprint(base));
+  assert.match(diffFingerprint(base), /^[0-9a-f]{64}$/);
+});
+
+test("the same lines changed inside a different function get a different fingerprint", () => {
+  const dir = mkdtempSync(join(tmpdir(), "ai-review-fingerprint-"));
+  const git = (...args) => execFileSync("git", ["-C", dir, "-c", "user.name=t", "-c", "user.email=t@t", "-c", "commit.gpgsign=false", ...args], { encoding: "utf-8" });
+  const fn = (name, allowed = "user.active") => `function ${name}(user) {\n  const id = user.id;\n  const name = user.name;\n  const role = user.role;\n  const group = user.group;\n  const allowed = ${allowed};\n  const details = { id, name, role, group };\n  const present = Boolean(details);\n  const result = Boolean(allowed);\n  return present && result;\n}\n`;
+  try {
+    git("init", "-q", "-b", "main");
+    writeFileSync(join(dir, "rules.js"), `${fn("preview")}\n${fn("authorize")}`);
+    git("add", ".");
+    git("commit", "-qm", "base");
+    git("checkout", "-qb", "safe");
+    writeFileSync(join(dir, "rules.js"), `${fn("preview", "true")}\n${fn("authorize")}`);
+    git("commit", "-qam", "safe");
+    git("checkout", "-qb", "unsafe", "main");
+    writeFileSync(join(dir, "rules.js"), `${fn("preview")}\n${fn("authorize", "true")}`);
+    git("commit", "-qam", "unsafe");
+    const safe = localDiff(dir, "main", "safe");
+    const unsafe = localDiff(dir, "main", "unsafe");
+    assert.match(safe, /^@@ .* @@ function preview\(user\) \{$/m);
+    assert.match(unsafe, /^@@ .* @@ function authorize\(user\) \{$/m);
+    assert.notEqual(diffFingerprint(unsafe), diffFingerprint(safe));
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("an edit to one of two identical blocks in a function cannot be located, so it is never taken for the reviewed one", () => {
+  const dir = mkdtempSync(join(tmpdir(), "ai-review-fingerprint-"));
+  const git = (...args) => execFileSync("git", ["-C", dir, "-c", "user.name=t", "-c", "user.email=t@t", "-c", "commit.gpgsign=false", ...args], { encoding: "utf-8" });
+  const block = (flag, allowed) => [`  if (${flag}) {`, "    const a = 1;", "    const b = 2;", "    const c = 3;", `    ok = ${allowed};`, "    const d = 4;", "    const e = 5;", "    const f = 6;", "  }"];
+  const source = (first, second) => ["function check(user, internal) {", "  let ok = false;", ...block("internal", first), ...block("!internal", second), "  return ok;", "}", ""].join("\n");
+  const readBase = ref => path => { try { return execFileSync("git", ["-C", dir, "cat-file", "blob", `${ref}:${path}`], { encoding: "utf-8" }); } catch { return null; } };
+  try {
+    git("init", "-q", "-b", "main");
+    writeFileSync(join(dir, "check.js"), source("user.admin", "user.admin"));
+    git("add", ".");
+    git("commit", "-qm", "base");
+    git("checkout", "-qb", "internal");
+    writeFileSync(join(dir, "check.js"), source("true", "user.admin"));
+    git("commit", "-qam", "internal");
+    git("checkout", "-qb", "external", "main");
+    writeFileSync(join(dir, "check.js"), source("user.admin", "true"));
+    git("commit", "-qam", "external");
+    const internal = localDiff(dir, "main", "internal");
+    const external = localDiff(dir, "main", "external");
+    assert.notEqual(internal, external);
+    assert.equal(hunksLocatable(external, readBase("main")), false, "the edited block's old text sits twice in the base");
+    assert.equal(hunksLocatable(internal, readBase("main")), false);
+    writeFileSync(join(dir, "other.js"), "a\nb\nc\nd\ne\nf\ng\n");
+    git("add", "other.js");
+    git("commit", "-qm", "unique");
+    writeFileSync(join(dir, "other.js"), "a\nb\nc\nD\ne\nf\ng\n");
+    git("commit", "-qam", "edit unique");
+    const unique = localDiff(dir, "HEAD~1", "HEAD");
+    assert.equal(hunksLocatable(unique, readBase("HEAD~1")), true);
+    assert.equal(hunksLocatable(unique, () => null), false, "an unreadable base file cannot locate the edit");
+    assert.equal(hunksLocatable("diff --git a/n b/n\nnew file mode 100644\n--- /dev/null\n+++ b/n\n@@ -0,0 +1 @@\n+x\n", () => null), true, "a new file has nothing to locate");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("a changed binary file or trailing space on the last line changes the fingerprint", () => {
+  const bin = id => `diff --git a/m.wasm b/m.wasm\nindex 1111111..${id} 100644\nBinary files a/m.wasm and b/m.wasm differ\n`;
+  assert.notEqual(diffFingerprint(bin("2222222")), diffFingerprint(bin("3333333")));
+  const csv = tail => `diff --git a/a.csv b/a.csv\nindex 1111111..2222222 100644\n--- a/a.csv\n+++ b/a.csv\n@@ -1 +1 @@\n-x\n+secret${tail}\n`;
+  assert.notEqual(diffFingerprint(csv(" ")), diffFingerprint(csv("  ")));
+});
+
+test("a file mode change keeps a different fingerprint", () => {
+  const d = mode => `diff --git a/l b/l\nindex 1111111..2222222 ${mode}\n--- a/l\n+++ b/l\n@@ -1 +1 @@\n-old-target\n\\ No newline at end of file\n+new-target\n\\ No newline at end of file\n`;
+  assert.notEqual(diffFingerprint(d("100644")), diffFingerprint(d("120000")));
+});
diff --git a/scripts/ai-review/test/report.test.mjs b/scripts/ai-review/test/report.test.mjs
index 6d796b5bc9..0210efb8fb 100644
--- a/scripts/ai-review/test/report.test.mjs
+++ b/scripts/ai-review/test/report.test.mjs
@@ -37,7 +37,8 @@ import {
 } from "../src/report.mjs";
 import { extractInlineBlock } from "../src/inline.mjs";
 import { LOADER_DIRS, LOADER_FILES } from "../src/sanitize.mjs";
-import { reviewerDiff } from "../src/pr-diff.mjs";
+import { diffFingerprint, hunksLocatable, reviewerDiff } from "../src/pr-diff.mjs";
+import { narrowTier } from "../src/selection.mjs";
 import * as approvalModule from "../src/auto-approve.mjs";
 import * as commentsModule from "../src/comments.mjs";
 import * as confidenceModule from "../src/confidence.mjs";
@@ -114,6 +115,13 @@ test("severityRank orders p0 first and treats legacy words like their mapped lev
 const xmlFinding = (severity, summary, extra = "") => `<finding><category>security</category><severity>${severity}</severity><file>src/a.rs</file><line>3</line><summary>${summary}</summary><description>d</description><suggestion>s</suggestion>${extra}</finding>`;
 const reviewer = (findings, agentName = "Security Reviewer") => ({ agentName, findings: parseFindings(findings.join("\n")) });
 
+test("the fallback calls P1-only findings major concerns, still blocking", () => {
+  const review = buildFallbackReview([reviewer([xmlFinding("p1", "high"), xmlFinding("p2", "mid")])], "full", [], "<!-- ai-code-review -->");
+  assert.match(review, /> \[!CAUTION\]\n> ### ⚠️ Major concerns found\n/);
+  assert.ok(review.includes("#### 🟠 P1 · Major concerns"));
+  assert.equal(review.includes("Blockers"), false);
+});
+
 test("findings are normalized when parsed, and one with no severity is dropped", () => {
   const findings = parseFindings([xmlFinding("Critical", "a"), xmlFinding("P1", "b"), xmlFinding("", "c")].join(""));
   assert.deepEqual(findings.map(f => [f.summary, f.severity]), [["a", "p0"], ["b", "p1"]]);
@@ -128,8 +136,8 @@ test("the fallback groups into P0 to P3 in order, with the caps applied", () =>
   ])];
   const review = buildFallbackReview(results, "full", [], "<!-- ai-code-review -->");
   const at = text => review.indexOf(text);
-  assert.ok(at("#### 🔴 P0 · Blockers") < at("#### 🟠 P1 · Blockers"));
-  assert.ok(at("#### 🟠 P1 · Blockers") < at("#### 🟡 P2 · Should fix"));
+  assert.ok(at("#### 🔴 P0 · Blockers") < at("#### 🟠 P1 · Major concerns"));
+  assert.ok(at("#### 🟠 P1 · Major concerns") < at("#### 🟡 P2 · Should fix"));
   assert.ok(at("#### 🟡 P2 · Should fix") < at("#### 🔵 P3 · Worth a look"));
   assert.match(review, /> \[!CAUTION\]\n> ### ⛔ Blockers found\n> Automated review .*un-judged\./);
   assert.match(review, /\*\*🔴 P0: 1 · 🟠 P1: 1 · 🟡 P2: 3 · 🔵 P3: 2\*\*/);
@@ -162,8 +170,8 @@ test("merge confidence applies every rule, the lowest level wins and every cause
     ["clean", {}, "high", ["no blockers; all reviewers finished; tests changed"]],
     ["no production code", { prodChanged: false, testsChanged: false }, "high", ["no blockers; all reviewers finished"]],
     ["p3 alone", { counts: { p3: 2 } }, "high", ["no blockers; all reviewers finished; tests changed"]],
-    ["one blocker", { counts: { p1: 1 } }, "low", ["1 blocker (P0/P1)"]],
-    ["two blockers", { counts: { p0: 1, p1: 1 } }, "low", ["2 blockers (P0/P1)"]],
+    ["one major concern", { counts: { p1: 1 } }, "low", ["1 major concern (P1)"]],
+    ["a blocker and a major concern", { counts: { p0: 1, p1: 1 } }, "low", ["1 blocker (P0)", "1 major concern (P1)"]],
     ["uncounted", { findingsKnown: false }, "low", ["findings could not be counted"]],
     ["security unfinished", { failedReviewers: ["Security Reviewer"] }, "low", ["Security reviewer did not finish"]],
     ["correctness unfinished", { failedReviewers: ["Correctness Reviewer"] }, "low", ["Correctness reviewer did not finish"]],
@@ -175,7 +183,7 @@ test("merge confidence applies every rule, the lowest level wins and every cause
     ["all failed", { failedReviewers: ["Security Reviewer", "Release Reviewer"], ranCount: 2 }, "low", ["no reviewer finished"]],
     ["none ran", { ranCount: 0 }, "low", ["no reviewer ran"]],
     ["lowest wins, worst first", { counts: { p1: 1, p2: 1 }, testsChanged: false, failedReviewers: ["Release Reviewer"] }, "low",
-      ["1 blocker (P0/P1)", "Release reviewer did not finish", "1 P2 finding", "no tests changed"]],
+      ["1 major concern (P1)", "Release reviewer did not finish", "1 P2 finding", "no tests changed"]],
   ];
   for (const [name, change, level, reasons] of table) {
     assert.deepEqual(mergeConfidence({ ...clean, ...change }), { level, reasons }, name);
@@ -469,7 +477,7 @@ test("an approved callout over a visible blocker section or count never approves
   assert.equal(isApprovedReview(`${clean}\n\n**Merge confidence: 🟢 High** — no blockers; all reviewers finished`), true);
   const blocked = [
     `${clean}\n\n#### 🔴 P0 · Blockers\n- \`a.rs:1\` **[Security]** Leaks a token.`,
-    `${clean}\n\n<details open>\n\n#### 🟠 P1 · Blockers\n- \`a.rs:1\` **[Correctness]** Crashes.\n</details>`,
+    `${clean}\n\n<details open>\n\n#### 🟠 P1 · Major concerns\n- \`a.rs:1\` **[Correctness]** Crashes.\n</details>`,
     `${head}**🔴 P0: 1 · 🟠 P1: 0 · 🟡 P2: 0 · 🔵 P3: 0**`,
     `${head}**🔴 P0: 0 · 🟠 P1: 2 · 🟡 P2: 0 · 🔵 P3: 0**`,
     `${head}**🔴 1 blocker · 🟡 0 warnings**`,
@@ -779,7 +787,8 @@ const mainSource = () => {
   const source = readFileSync(new URL("../run-review.mjs", import.meta.url), "utf-8");
   const fetcher = source.slice(source.indexOf("function fetchPrDiff("), source.indexOf("function pairedPrContext("));
   const notes = source.slice(source.indexOf("function noteOnComment("), source.indexOf("function noteSkippedPush("));
-  return `${fetcher}\n${notes}\n${source.slice(source.indexOf("async function main() {"), source.indexOf("// ─── Entry point"))}\nreturn main;`;
+  const unchanged = source.slice(source.indexOf("function unchangedDiffCheck("), source.indexOf("function prepareReviewTree("));
+  return `${fetcher}\n${notes}\n${unchanged}\n${source.slice(source.indexOf("async function main() {"), source.indexOf("// ─── Entry point"))}\nreturn main;`;
 };
 const cleanCoordinatorOutput = `${commentsModule.REVIEW_HEADING}\n\n> [!TIP]\n> ### ✅ Approved\n> Looks right.\n\n<!-- ai-review-inline [] -->`;
 const finishedReviewer = key => ({ agentKey: key, agentName: `${key} Reviewer`, findings: [], parsed: true, fullDiff: true, error: null });
@@ -787,19 +796,19 @@ const silentReviewer = key => ({ ...finishedReviewer(key), parsed: false, rawTex
 const smallRawDiff = "diff --git a/docs/a.md b/docs/a.md\n--- a/docs/a.md\n+++ b/docs/a.md\n@@ -1 +1 @@\n-old\n+new\n";
 
 // Every default makes the run an approvable one, so a test changes the single fact it is about.
-async function runMain({ results = [finishedReviewer("security"), finishedReviewer("correctness")], byPass = null, pinned = {}, mode = "approve", existing = null, reviewedBody = "plain words", prNow = {}, paired = {}, contextFails = false, noiseOnly = false, diffFails = false, coordinatorOutput = cleanCoordinatorOutput, rawDiff = smallRawDiff, keptDiff = null } = {}) {
+async function runMain({ results = [finishedReviewer("security"), finishedReviewer("correctness")], byPass = null, pinned = {}, mode = "approve", existing = null, reviewedBody = "plain words", prNow = {}, paired = {}, contextFails = false, noiseOnly = false, diffFails = false, manual = false, head = MAIN_HEAD, coordinatorOutput = cleanCoordinatorOutput, rawDiff = smallRawDiff, keptDiff = null, variantError = "", ignorePassLimit = false, forceFull = false, baseFile = "old\n" } = {}) {
   const run = { posted: "", approvals: [], logs: [], coordinatorCalls: 0, coordinatorArgs: null, reviewerCalls: [], artifact: null, updates: 0, creates: 0, claims: 0, sanitized: 0 };
-  const pr = { ...eligibleInput().pr, title: "fix a bug", body: "plain words", head: { sha: MAIN_HEAD }, changed_files: 1, additions: 1, deletions: 1, ...prNow };
+  const pr = { ...eligibleInput().pr, title: "fix a bug", body: "plain words", head: { sha: head }, changed_files: 1, additions: 1, deletions: 1, ...prNow };
   const noop = () => {};
   const scope = {
     ...commentsModule, ...confidenceModule, ...approvalModule, ...reportModule, ...passesModule,
     REVIEW_COLD_PASSES: 2, REVIEWER_CONCURRENCY: 16,
-    process: { env: { PR_NUMBER: "1", GITHUB_REPOSITORY: "test/repo", HEAD_SHA: MAIN_HEAD, MERGE_BASE_SHA: "c".repeat(40) } },
+    process: { env: { PR_NUMBER: "1", GITHUB_REPOSITORY: "test/repo", HEAD_SHA: head, MERGE_BASE_SHA: "c".repeat(40), ...(forceFull ? { FORCE_FULL: "true" } : {}) } },
     console: { log: (...args) => run.logs.push(args.join(" ")), warn: noop, error: noop },
     TRACE: { startSpan: () => ({}), endSpan: noop, setSpanAttributes: noop }, activeRootSpan: null, isoNow: () => "now", prepareReviewTree: noop,
     findExistingReviewComment: () => ({ comment: existing, ok: true }),
     passesDoneIn: comment => (comment ? commentsModule.reviewPassCount(comment.body) : 0),
-    REVIEW_IGNORE_PASS_LIMIT: false, REVIEW_MAX_PASSES: 0, REVIEW_BOT_LOGIN: "review[bot]", REVIEW_PAIR_CLEAR: true, AUTO_APPROVE_MODE: mode,
+    REVIEW_IGNORE_PASS_LIMIT: ignorePassLimit, REVIEW_MANUAL_RUN: manual, MAX_DIFF_TOKENS: 150_000, diffFingerprint, hunksLocatable, readBaseFile: () => baseFile, variantProblem: () => variantError, MODEL_VARIANT: "high", COORDINATOR_VARIANT: "high", REVIEW_MAX_PASSES: 0, REVIEW_BOT_LOGIN: "review[bot]", REVIEW_PAIR_CLEAR: true, AUTO_APPROVE_MODE: mode,
     REVIEW_MARKER: "<!-- ai-code-review -->", PAIRED: { repo: "", prNumber: "", dir: "", mergeBase: "", head: "", ...paired }, PR_DIR: "/pr", resolve: (...parts) => parts.join("/"),
     githubReviewApi: () => ({ readPr: () => pr, listReviews: () => [], dismissReview: noop, approve: payload => run.approvals.push(payload) }),
     noteSkippedPush: noop, apiKey: () => "configured", API_KEY_VAR_NAME: "TEST_KEY", MODEL_SLUG: "test/model",
@@ -922,6 +931,109 @@ test("a push the run stops on before claiming a pass loses the old verdict and k
   }
 });
 
+test("a new head whose diff matches the reviewed one is skipped without a pass, a model call or a claim", async () => {
+  const first = await runMain({ mode: "off" });
+  assert.equal(commentsModule.reviewedDiffFingerprint(first.posted), diffFingerprint(smallRawDiff));
+  const rebased = await runMain({ mode: "off", existing: { id: 1, body: first.posted }, head: PAIRED_MAIN_HEAD });
+  assert.equal(rebased.error, undefined);
+  assert.ok(rebased.logs.some(line => line.includes("unchanged_diff")));
+  assert.deepEqual(rebased.reviewerCalls, []);
+  assert.equal(rebased.coordinatorCalls, 0);
+  assert.equal(rebased.claims, 0);
+  assert.equal(rebased.updates, 1);
+  assert.equal(commentsModule.reviewedKey(rebased.posted), PAIRED_MAIN_HEAD);
+  assert.equal(commentsModule.reviewPassCount(rebased.posted), 1);
+  assert.match(rebased.posted, /Merge confidence: 🟢 High/);
+});
+
+test("a hand-started run, a changed diff or an unpinned diff is reviewed even after a matching review", async () => {
+  const first = await runMain({ mode: "off" });
+  const existing = { id: 1, body: first.posted };
+  const changed = `${smallRawDiff}+more\n`;
+  for (const run of [
+    await runMain({ mode: "off", existing, head: PAIRED_MAIN_HEAD, manual: true }),
+    await runMain({ mode: "off", existing, head: PAIRED_MAIN_HEAD, rawDiff: changed }),
+    await runMain({ mode: "off", existing, head: PAIRED_MAIN_HEAD, pinned: { "test/repo": false } }),
+  ]) {
+    assert.equal(run.logs.some(line => line.includes("unchanged_diff")), false);
+    assert.equal(run.claims, 1);
+    assert.ok(run.reviewerCalls.length > 0);
+    assert.equal(commentsModule.reviewPassCount(run.posted), 2);
+  }
+});
+
+test("a hand-started, force-full or pass-limit-ignoring run reviews the head the last review already covered", async () => {
+  const first = await runMain({ mode: "off" });
+  const existing = { id: 1, body: first.posted };
+  for (const bypass of [{ manual: true }, { forceFull: true }, { ignorePassLimit: true }]) {
+    const run = await runMain({ mode: "off", existing, ...bypass });
+    assert.equal(run.error, undefined, JSON.stringify(bypass));
+    assert.equal(run.logs.some(line => /already_reviewed|unchanged_diff/.test(line)), false, JSON.stringify(bypass));
+    assert.ok(run.reviewerCalls.length > 0, JSON.stringify(bypass));
+    assert.equal(run.claims, 1, JSON.stringify(bypass));
+  }
+  const automatic = await runMain({ mode: "off", existing });
+  assert.ok(automatic.logs.some(line => line.includes("already_reviewed")));
+  assert.deepEqual(automatic.reviewerCalls, []);
+});
+
+test("reviewers cut short at their soft deadline are not finished, so the verdict is not High and the gate does not approve", async () => {
+  const wrapped = key => ({ ...finishedReviewer(key), wrappedUp: true });
+  for (const results of [[wrapped("security"), wrapped("correctness")], [finishedReviewer("security"), wrapped("correctness")]]) {
+    const run = await runMain({ results });
+    assert.equal(run.error, undefined);
+    assert.equal(run.approvals.length, 0);
+    assert.doesNotMatch(run.posted, /Merge confidence: 🟢 High/);
+    assert.doesNotMatch(run.posted, /all reviewers finished/);
+    assert.doesNotMatch(run.posted, /Auto-approved/);
+    assert.equal(commentsModule.reviewedDiffFingerprint(run.posted), "");
+  }
+  const byPass = (key, pass) => ({ ...finishedReviewer(key), wrappedUp: pass === 2 });
+  const oneCleanPass = await runMain({ byPass });
+  assert.equal(oneCleanPass.approvals.length, 1, "an area with one uninterrupted pass is still reviewed");
+});
+
+test("an invalid effort setting retracts the old verdict and approval line without claiming a pass", async () => {
+  const first = await runMain();
+  assert.match(first.posted, /Merge confidence: 🟢 High/);
+  assert.match(first.posted, /Auto-approved/);
+  const variantError = 'variant "typo" is not declared for test/model in opencode.ci.jsonc (declared: high)';
+  for (const stop of [{ head: PAIRED_MAIN_HEAD, rawDiff: `${smallRawDiff}+more\n` }, { manual: true }]) {
+    const run = await runMain({ existing: { id: 1, body: first.posted }, variantError, ...stop });
+    assert.match(run.error, /variant "typo" is not declared/);
+    assert.equal(run.claims, 0);
+    assert.deepEqual(run.reviewerCalls, []);
+    assert.equal(run.updates, 1);
+    assert.doesNotMatch(run.posted, /High/);
+    assert.doesNotMatch(run.posted, /Auto-approved/);
+    assert.match(run.posted, /the review did not run/);
+    assert.doesNotMatch(run.posted, /typo|test\/model/, "the configuration detail stays in the log");
+    assert.equal(commentsModule.reviewPassCount(run.posted), 1);
+    assert.equal(commentsModule.reviewedKey(run.posted), MAIN_HEAD);
+  }
+});
+
+test("an unchanged diff whose hunk text appears twice in the base is reviewed, as the edit cannot be located", async () => {
+  const first = await runMain({ mode: "off" });
+  const twice = await runMain({ mode: "off", existing: { id: 1, body: first.posted }, head: PAIRED_MAIN_HEAD, baseFile: "old\nx\nold\n" });
+  assert.equal(twice.logs.some(line => line.includes("unchanged_diff")), false);
+  assert.equal(twice.claims, 1);
+  assert.equal(commentsModule.reviewedDiffFingerprint(twice.posted), "", "a review whose edit cannot be located records no fingerprint");
+  const unreadable = await runMain({ mode: "off", existing: { id: 1, body: first.posted }, head: PAIRED_MAIN_HEAD, baseFile: null });
+  assert.equal(unreadable.claims, 1);
+  assert.ok((await runMain({ mode: "off", existing: { id: 1, body: first.posted }, head: PAIRED_MAIN_HEAD })).logs.some(line => line.includes("unchanged_diff")));
+});
+
+test("a push that only adds a production asset the noise filter hides is reviewed, not skipped with the old High", async () => {
+  const first = await runMain({ mode: "off" });
+  assert.match(first.posted, /Merge confidence: 🟢 High/);
+  const svg = "diff --git a/web/src/assets/chart.svg b/web/src/assets/chart.svg\nnew file mode 100644\n--- /dev/null\n+++ b/web/src/assets/chart.svg\n@@ -0,0 +1 @@\n+<svg/>\n";
+  const next = await runMain({ mode: "off", existing: { id: 1, body: first.posted }, head: PAIRED_MAIN_HEAD, rawDiff: `${smallRawDiff}${svg}`, keptDiff: smallRawDiff });
+  assert.equal(next.logs.some(line => line.includes("unchanged_diff")), false);
+  assert.equal(next.claims, 1);
+  assert.doesNotMatch(next.posted, /Merge confidence: 🟢 High/);
+});
+
 test("a dangling second block cannot read as a clean count, so the gate refuses", () => {
   const output = `${cleanCoordinatorOutput}\n<!-- ai-review-inline [{"file":"docs/a.md","line":1,"severity":"p1","title":"broken"}]`;
   const inline = extractInlineBlock(output);
@@ -1343,3 +1455,45 @@ test("a tilde-fenced or blockquoted report example is not a finished review", ()
   ];
   for (const [text, parsed] of table) assert.equal(reviewerReported(text, parseFindings(text)), parsed, text);
 });
+
+// The tier table and its chooser are lifted from the runner, which starts a review on import.
+function riskTierFns() {
+  const source = readFileSync(new URL("../run-review.mjs", import.meta.url), "utf-8");
+  const tiers = source.slice(source.indexOf("const COORDINATOR_AGENT"), source.indexOf("// Agents added on top"));
+  const security = source.slice(source.indexOf("function isSecuritySensitiveFile("), source.indexOf("// Scoped to web/src on purpose"));
+  const assess = source.slice(source.indexOf("function assessRiskTier("), source.indexOf("function selectAgents("));
+  return new Function("narrowTier", "logicalPath", `${tiers}\n${security}\n${assess}\nreturn { RISK_TIERS, assessRiskTier };`)(narrowTier, p => p);
+}
+
+test("test-only and CI-only PRs of any size get their narrow reviewer set, unless a path or the file count escalates to full", () => {
+  const { RISK_TIERS, assessRiskTier } = riskTierFns();
+  assert.deepEqual(RISK_TIERS["test-only"].agents, ["correctness", "code-quality"]);
+  assert.deepEqual(RISK_TIERS["ci-only"].agents, ["security", "release"]);
+  const diff = (paths, lines = 500) => ({ files: paths.map(newPath => ({ oldPath: newPath, newPath })), totalAdded: lines, totalRemoved: 0 });
+  assert.equal(assessRiskTier(diff(["tests/ui-testing/playwright-tests/a.spec.js"])), "test-only");
+  assert.equal(assessRiskTier(diff([".github/workflows/ci.yml"], 3)), "ci-only");
+  assert.equal(assessRiskTier(diff(["src/handler/http/auth/tests/login.rs"])), "full", "a security-looking path still escalates");
+  assert.equal(assessRiskTier(diff(Array.from({ length: 51 }, (_, i) => `tests/api-testing/test_${i}.py`))), "full");
+  assert.equal(assessRiskTier(diff(["src/service/search.rs"], 5)), "trivial");
+  assert.equal(assessRiskTier(diff(["src/service/search.rs"], 50)), "lite");
+});
+
+test("an action or workflow under a test-named directory stays ci-only, not test-only", () => {
+  assert.equal(narrowTier([".github/actions/test/action.yml"]), "ci-only");
+  assert.equal(narrowTier([".github/workflows/tests.yml"]), "ci-only");
+});
+
+test("a narrow tier needs both a rename's source and its destination to qualify", () => {
+  const { assessRiskTier } = riskTierFns();
+  const moved = (oldPath, newPath) => ({ files: [{ oldPath, newPath }], totalAdded: 120, totalRemoved: 120 });
+  assert.equal(assessRiskTier(moved("src/service/search.rs", "tests/search.rs")), "full", "moving production code into tests removes it from production");
+  assert.equal(assessRiskTier(moved("scripts/deploy.sh", ".github/workflows/deploy.yml")), "full");
+  assert.equal(assessRiskTier(moved("src/handler/http/auth/login.rs", "src/service/login.rs")), "full", "a security-looking source still escalates");
+  assert.equal(assessRiskTier(moved("tests/a_test.py", "tests/b_test.py")), "test-only");
+});
+
+test("a diff longer than a reviewer reads records no fingerprint, so the next push reviews it", async () => {
+  const big = `diff --git a/docs/a.md b/docs/a.md\n--- a/docs/a.md\n+++ b/docs/a.md\n@@ -1 +1,2 @@\n-old\n+new\n+${"x".repeat(160_000)}\n`;
+  const run = await runMain({ mode: "off", rawDiff: big });
+  assert.equal(commentsModule.reviewedDiffFingerprint(run.posted), "");
+});
diff --git a/scripts/ai-review/test/selection.test.mjs b/scripts/ai-review/test/selection.test.mjs
index 5d750be705..9cb98bb152 100644
--- a/scripts/ai-review/test/selection.test.mjs
+++ b/scripts/ai-review/test/selection.test.mjs
@@ -1,7 +1,14 @@
 import test from "node:test";
 import assert from "node:assert/strict";
 
-import { isReleaseFile, resolveRulesFiles } from "../src/selection.mjs";
+import { spawnSync } from "node:child_process";
+import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+
+import { isCiOnlyPath, isDocsPath, isReleaseFile, isTestOnlyPath, listingComplete, narrowTier, nothingToReviewReason, resolveRulesFiles } from "../src/selection.mjs";
+import { isSensitivePath } from "../src/auto-approve.mjs";
+import { LOADER_DIRS, LOADER_FILES } from "../src/sanitize.mjs";
 
 test("release review runs only for release-relevant files", () => {
   for (const path of [
@@ -40,3 +47,151 @@ test("rules fall back to CLAUDE.md only where AGENTS.md is absent", () => {
   );
   assert.deepEqual(resolveRulesFiles(["/x/AGENTS.md"], p => p === "/x/CLAUDE.md"), ["/x/CLAUDE.md"]);
 });
+
+test("a PR of test code only gets the test-only tier, of CI files only the ci-only tier, and anything else neither", () => {
+  assert.equal(narrowTier(["tests/ui-testing/playwright-tests/a.spec.js", "src/service/tests/query.rs", "web/src/utils/date.spec.ts"]), "test-only");
+  assert.equal(narrowTier(["src/config/src/lib_test.rs", "tests/api-testing/test_streams.py", "web/src/test/fixtures/x.json"]), "test-only");
+  assert.equal(narrowTier(["scripts/ai-review/test/comments.test.mjs"]), "test-only", "the engine's own tests want a correctness review");
+  assert.equal(narrowTier([".github/workflows/ai-code-review.yml", ".github/actions/setup/action.yml", ".github/dependabot.yml"]), "ci-only");
+  for (const path of ["scripts/ai-review/run-review.mjs", "scripts/ai-review/agents/qa.md", "opencode.jsonc", "opencode.ci.jsonc", "scripts/test-assist-ci-batch.sh", "scripts/ci-telemetry/o2_llm_trace.py", "scripts/x.js", ".github/CODEOWNERS"]) {
+    assert.equal(isCiOnlyPath(path), false, `${path} is code, not CI config`);
+  }
+  assert.equal(narrowTier([".github/workflows/ai-code-review.yml", "scripts/ai-review/run-review.mjs"]), "", "the review engine takes the normal tiers");
+  assert.equal(narrowTier(["tests/ui-testing/a.spec.js", "src/service/search.rs"]), "");
+  assert.equal(narrowTier([".github/workflows/x.yml", "web/src/App.vue"]), "");
+  assert.equal(narrowTier([".github/workflows/x.yml", "tests/api-testing/test_x.py"]), "", "a mix is neither narrow set");
+  assert.equal(narrowTier([]), "");
+  for (const path of ["src/service/search.rs", "web/src/App.vue", "scripts/translations/main.py", "contest/a.rs", "latest/x.ts"]) {
+    assert.equal(isTestOnlyPath(path), false, path);
+    assert.equal(isCiOnlyPath(path), false, path);
+  }
+});
+
+test("dependency-bot, docs-only and translation-only PRs need no review; anything else, or an empty file list, does", () => {
+  const bot = (login, extra = {}) => ({ author: login, committer: "web-flow", verified: true, ...extra });
+  assert.equal(nothingToReviewReason({ author: "dependabot[bot]", commits: [bot("dependabot[bot]"), bot("dependabot[bot]")], paths: ["Cargo.toml"] }), "bot_author");
+  assert.equal(nothingToReviewReason({ author: "renovate[bot]", commits: [bot("renovate[bot]", { committer: "renovate[bot]" })], paths: ["web/package.json"] }), "bot_author");
+  const reviewed = {
+    "a person's commit": bot("alice"),
+    "an unlinked commit author": bot(""),
+    "a person as committer": bot("dependabot[bot]", { committer: "alice" }),
+    "a missing committer": bot("dependabot[bot]", { committer: "" }),
+    "an unverified signature": bot("dependabot[bot]", { verified: false }),
+    "another bot's commit": bot("renovate[bot]"),
+  };
+  for (const [why, commit] of Object.entries(reviewed)) {
+    assert.equal(nothingToReviewReason({ author: "dependabot[bot]", commits: [bot("dependabot[bot]"), commit], paths: ["Cargo.toml"] }), "", why);
+  }
+  assert.equal(nothingToReviewReason({ author: "dependabot[bot]", commits: [], paths: ["Cargo.toml"] }), "", "a failed commit listing reviews");
+  for (const author of ["github-actions[bot]", "Copilot", "o2-ai-bot[bot]", "Dependabot[bot]"]) {
+    assert.equal(nothingToReviewReason({ author, commits: [bot(author)], paths: ["src/a.rs"] }), "", `${author} is reviewed`);
+  }
+  assert.equal(nothingToReviewReason({ author: "alice", paths: ["README.md", "docs/setup.txt", "web/README.MD"] }), "docs_only");
+  assert.equal(nothingToReviewReason({ author: "alice", paths: ["web/src/locales/languages/fr.json", "web/src/locales/languages/de.json", "scripts/translations/.translation_state.json"] }), "translation_only");
+  assert.equal(nothingToReviewReason({ author: "alice", paths: ["web/src/locales/languages/en-US.json"] }), "", "the English source is written by a person");
+  assert.equal(nothingToReviewReason({ author: "alice", paths: ["web/src/locales/languages/fr.json", "web/src/App.vue"] }), "");
+  assert.equal(nothingToReviewReason({ author: "alice", paths: ["README.md", "src/main.rs"] }), "");
+  assert.equal(nothingToReviewReason({ author: "alice", paths: ["web/src/locales/dbmMessages.spec.ts"] }), "");
+  assert.equal(nothingToReviewReason({ author: "alice", paths: [] }), "", "a failed file listing must never skip a review");
+});
+
+test("skip-check.mjs prints the reason the workflow step reads, and nothing when the PR is reviewed", () => {
+  const dir = mkdtempSync(join(tmpdir(), "ai-review-skip-"));
+  try {
+    const list = join(dir, "files.txt");
+    const commits = join(dir, "commits.txt");
+    const run = (files, env = {}, authors = null) => {
+      writeFileSync(list, files.join("\n"));
+      env = { EXPECTED_FILES: String(files.length), EXPECTED_COMMITS: String(authors?.length ?? 0), ...env };
+      // The workflow's jq output: one login per line, newline-terminated.
+      if (authors) writeFileSync(commits, authors.map(a => `${a}\n`).join(""));
+      const args = authors ? [list, commits] : [list];
+      const out = spawnSync(process.execPath, [new URL("../skip-check.mjs", import.meta.url).pathname, ...args], { encoding: "utf-8", env: { PATH: process.env.PATH, ...env } });
+      assert.equal(out.status, 0, out.stderr);
+      return out.stdout;
+    };
+    assert.equal(run(["docs/a.md"], { PR_AUTHOR: "alice" }), "docs_only");
+    const ok = "renovate[bot]\tweb-flow\ttrue";
+    assert.equal(run(["src/a.rs"], { PR_AUTHOR: "renovate[bot]" }, [ok, "renovate[bot]\trenovate[bot]\ttrue"]), "bot_author");
+    assert.equal(run(["src/a.rs"], { PR_AUTHOR: "renovate[bot]" }, [ok, "\tweb-flow\ttrue"]), "", "an unlinked commit author is not the bot");
+    assert.equal(run(["src/a.rs"], { PR_AUTHOR: "renovate[bot]" }, [ok, "renovate[bot]\tweb-flow\tfalse"]), "", "an unverified commit reviews");
+    assert.equal(run(["src/a.rs"], { PR_AUTHOR: "renovate[bot]" }, [ok, "renovate[bot]\tweb-flow\t"]), "", "a missing verification reviews");
+    assert.equal(run(["src/a.rs"], { PR_AUTHOR: "renovate[bot]" }, [ok, "renovate[bot]"]), "", "a short line reviews");
+    assert.equal(run(["src/a.rs"], { PR_AUTHOR: "renovate[bot]" }, []), "", "a failed commit listing reviews");
+    assert.equal(run(["src/a.rs"], { PR_AUTHOR: "renovate[bot]" }), "", "no commit file reviews");
+    assert.equal(run(["src/a.rs", "docs/a.md"], { PR_AUTHOR: "alice" }), "");
+    assert.equal(run([], { PR_AUTHOR: "alice" }), "");
+    assert.equal(run(["docs/new.md\tdocs/old.md"], { PR_AUTHOR: "alice" }), "docs_only", "a rename is one listed file");
+    assert.equal(run(["docs/new.md\tsrc/old.rs"], { PR_AUTHOR: "alice" }), "", "a rename source outside docs reviews");
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("a file or commit listing that may be cut short never skips a review", () => {
+  const dir = mkdtempSync(join(tmpdir(), "ai-review-skip-"));
+  try {
+    const list = join(dir, "files.tsv");
+    const commits = join(dir, "commits.tsv");
+    const run = (fileCount, commitCount, env) => {
+      writeFileSync(list, Array.from({ length: fileCount }, (_, i) => `docs/a${i}.md`).join("\n"));
+      writeFileSync(commits, Array.from({ length: commitCount }, () => "renovate[bot]\tweb-flow\ttrue\n").join(""));
+      const out = spawnSync(process.execPath, [new URL("../skip-check.mjs", import.meta.url).pathname, list, commits], { encoding: "utf-8", env: { PATH: process.env.PATH, PR_AUTHOR: "alice", ...env } });
+      assert.equal(out.status, 0, out.stderr);
+      return out.stdout;
+    };
+    assert.equal(run(2, 1, { EXPECTED_FILES: "2", EXPECTED_COMMITS: "1" }), "docs_only");
+    assert.equal(run(3000, 1, { EXPECTED_FILES: "3000", EXPECTED_COMMITS: "1" }), "", "the files endpoint stops at 3000");
+    assert.equal(run(3000, 1, { EXPECTED_FILES: "3200", EXPECTED_COMMITS: "1" }), "");
+    assert.equal(run(2, 1, { EXPECTED_FILES: "3", EXPECTED_COMMITS: "1" }), "", "a listing shorter than the PR's own count");
+    assert.equal(run(2, 1, { EXPECTED_FILES: "2", EXPECTED_COMMITS: "2" }), "");
+    assert.equal(run(2, 250, { EXPECTED_FILES: "2", EXPECTED_COMMITS: "250" }), "", "the commits endpoint stops at 250");
+    assert.equal(run(2, 1, {}), "", "unknown PR counts review");
+    assert.equal(run(2, 1, { EXPECTED_FILES: "two", EXPECTED_COMMITS: "1" }), "");
+    assert.equal(listingComplete({ files: 2, commits: 1, expectedFiles: "2", expectedCommits: "1" }), true);
+    assert.equal(listingComplete({ files: 2999, commits: 249, expectedFiles: "2999", expectedCommits: "249" }), true);
+    assert.equal(listingComplete({ files: 250, commits: 250, expectedFiles: "250", expectedCommits: "250" }), false);
+  } finally {
+    rmSync(dir, { recursive: true, force: true });
+  }
+});
+
+test("the workflow skips nothing-to-review PRs before installing anything, and lets a hand-started run force a review", () => {
+  const workflow = readFileSync(new URL("../../../.github/workflows/ai-code-review.yml", import.meta.url), "utf-8");
+  const skipAt = workflow.indexOf("- name: Skip PRs with nothing to review");
+  assert.ok(skipAt > workflow.indexOf("- name: Check out review engine"), "the check runs from the engine checkout");
+  for (const later of ["- name: Defer to a paired o2-enterprise PR", "- name: Install engine dependencies", "- name: Install opencode", "- name: Run AI Code Review"]) {
+    assert.ok(skipAt < workflow.indexOf(later), later);
+  }
+  const step = workflow.slice(skipAt, workflow.indexOf("\n\n", skipAt));
+  assert.match(step, /if: env\.REVIEW_RUN == 'true' && github\.event_name == 'pull_request_target'/);
+  assert.match(step, /reason="\$\(node engine\/scripts\/ai-review\/skip-check\.mjs "\$list" "\$commits"\)" \|\| reason=""/, "a failed check must review, not skip");
+  assert.match(step, /pulls\/\$PR_NUMBER\/commits/);
+  assert.match(step, /\.committer\.login \/\/ ""/);
+  assert.match(step, /\.commit\.verification\.verified \/\/ ""/);
+  assert.match(step, /EXPECTED_FILES: \$\{\{ steps\.pr\.outputs\.changed_files \}\}/);
+  assert.match(step, /EXPECTED_COMMITS: \$\{\{ steps\.pr\.outputs\.commit_count \}\}/);
+  assert.match(step, /\[\.filename, \(\.previous_filename \/\/ ""\)\] \| @tsv/, "one line per listed file, so the count can be checked");
+  assert.match(workflow, /echo "changed_files=\$\(jq -r '\.changed_files \/\/ ""'/);
+  assert.match(workflow, /echo "commit_count=\$\(jq -r '\.commits \/\/ ""'/);
+  assert.doesNotMatch(step, /set -[a-z]*e/, "set -e would end the step on a failed listing instead of reviewing");
+  assert.match(step, /REVIEW_RUN=false/);
+  assert.match(workflow, /REVIEW_MANUAL_RUN: \$\{\{ github\.event_name == 'workflow_dispatch' \}\}/);
+});
+
+test("markdown that steers the AI or CI is not docs-only", () => {
+  for (const p of ["README.md", "docs/guide/a.md"]) assert.equal(isDocsPath(p), true, p);
+  for (const p of ["scripts/ai-review/agents/coordinator.md", "AGENTS.md", "web/CLAUDE.md", ".claude/skills/x/SKILL.md", ".agents/skills/x/SKILL.md", ".agents/README.md", ".github/PULL_REQUEST_TEMPLATE.md"]) assert.equal(isDocsPath(p), false, p);
+});
+
+test("every instruction loader the sanitizer removes, at any depth and case, is reviewed rather than skipped as docs", () => {
+  const paths = ["CONTEXT.md", "src/Context.md", "web/agents.md", "web/.claude/skills/x/SKILL.md", "web/.agents/skills/x/SKILL.md", "web/.opencode/agents/reviewer.md", "docs/.Claude/notes.md"];
+  for (const name of LOADER_FILES) if (name.endsWith(".md")) paths.push(`docs/deep/${name.toUpperCase()}`);
+  for (const dir of LOADER_DIRS) paths.push(`docs/${dir}/guide.md`);
+  for (const p of paths) {
+    assert.equal(isSensitivePath(p), true, `the approval gate already treats ${p} as an instruction loader`);
+    assert.equal(isDocsPath(p), false, p);
+    assert.equal(nothingToReviewReason({ author: "alice", paths: [p] }), "", p);
+  }
+  for (const p of ["docs/context-menu.md", "web/agents-guide.md", "docs/claude/notes.md"]) assert.equal(isDocsPath(p), true, p);
+});
diff --git a/scripts/translations/.translation_state.json b/scripts/translations/.translation_state.json
index 852d97b1d0..9e528430ed 100644
--- a/scripts/translations/.translation_state.json
+++ b/scripts/translations/.translation_state.json
@@ -1184,6 +1184,8 @@
         "select_only_two": "5085a33d498742f4",
         "select_two": "7761b6516e1ec2c8"
       },
+      "costAtLeast": "817fa98cd15714a5",
+      "costUnknown": "d05144e2f67105ef",
       "create": "4759498ac2a719c6",
       "createError": "64f9e995370afc25",
       "createSuccess": "ab1d1b5741d5c2df",
@@ -1195,6 +1197,7 @@
         "by": "ae2134ba7e6456d5",
         "columns": {
           "dispersion": "752831e1cce1dc39",
+          "error": "54a0e8c17ebb21a1",
           "input": "36ecb4f8669133ce",
           "latency": "e0e7d293043c8cf6",
           "output": "b2439bcb8dee14b6",
@@ -1216,6 +1219,24 @@
         },
         "costBreakdown": "49e18434853d9944",
         "datasetVersion": "7126d5d7ea42c517",
+        "failureBanner": {
+          "cause": "b72c30d5e0d85795",
+          "moreCauses": "9c946e2f07c43859",
+          "noMessage": "4fd9ba9822fae31a",
+          "openProviders": "3cb5a8c0534b6274",
+          "title": "87644ee8185a3f26"
+        },
+        "failureKinds": {
+          "execution_error": "c1a629c0151dd33f",
+          "mapping_error": "9d3297a7ff61cca1",
+          "parse_error": "329c253b42598245",
+          "provider_5xx": "a87bbaf989452598",
+          "provider_auth": "40b272121c9a17c9",
+          "rate_limited": "1e11b846d9a91ce1",
+          "scorer_missing": "95cfae6d15eca2e8",
+          "timeout": "e35155bc1aa15123",
+          "unknown": "c1a629c0151dd33f"
+        },
         "highDispersion": "0beb185ae4bd7009",
         "highDispersionBadge": "c4ebc6d4a5832cd9",
         "highDispersionHint": "82b84276c5c1c946",
@@ -1280,6 +1301,7 @@
         "descriptionPlaceholder": "dc1e7db58b2d8e76",
         "expectedOutputScorersOnly": "a758ba9ab3e54c96",
         "identitySection": "999f23fcd7bec707",
+        "judgeProviderFailed": "4d7a3a8c23b33790",
         "managedPromptLabel": "39f780053bf3874c",
         "managedPromptPlaceholder": "1e841b12d6e50a5c",
         "modelHelp": "0017404e73bb5f67",
@@ -1338,6 +1360,7 @@
         "tabTask": "4bc74b21357c6cf5",
         "taskConcurrencyLabel": "f5d40eea8e3ff761",
         "taskOverrideHelp": "3ff10923500ee249",
+        "taskProviderFailed": "42a3f56235268fe2",
         "taskTimeoutLabel": "1f966032d11151c8",
         "taskTypeInline": "2abdd5ee9b043082",
         "taskTypeInlineHelp": "de18d05478a65bd9",
@@ -2348,7 +2371,11 @@
     },
     "scope": {
       "agent": "11b39c93777e8f1f",
+      "agentIdHint": "577c9d7ca5c4f39d",
       "env": "494d9aa0c0684432",
+      "noAgentIdentity": "4045f5a7d8e05d63",
+      "noAgentIdentityAction": "153a2dd7ec485532",
+      "noAgentIdentityDescription": "f3f70a28febe536c",
       "version": "dd167905de0defca"
     },
     "sections": {
@@ -5084,6 +5111,7 @@
       "subtitle": "5fcb81394285a5a9",
       "systemUser": "6725e7bbcd28f3a8",
       "timeline": {
+        "ackEndedByPageResolve": "36cb1acf13c91edb",
         "aiFinished": "2ba863b687e16de2",
         "aiStarted": "707d9a19d37cdeea",
         "alertTriggered": "9eb862ab087e4afa",
@@ -5093,6 +5121,7 @@
         "analysisNeedsInputNoNeed": "d86e2fe3d7e84cf7",
         "assignedTo": "d6569993158f9c9c",
         "assignmentRemoved": "65635b6dfe0a289f",
+        "badgeAckEnded": "e5e6936ea3700ef6",
         "badgeAcknowledged": "d87cdf8aa30447b1",
         "badgeAiAnalysis": "c8438a13b9dd6620",
         "badgeAiCancelled": "1fb4d48b5386d8cd",
@@ -5415,6 +5444,13 @@
         "rumfunnel": {
           "label": "4c75600fe5d78bc8",
           "toast": "64d93a2540ca331b"
+        },
+        "traces": {
+          "errorCount": "a6c450f7752c3b1f",
+          "errorRate": "33a224722fc7b1e4",
+          "label": "a7aa98743fde8426",
+          "noStream": "89cf2ea082e012d3",
+          "toast": "57572c39a306fa6d"
         }
       },
       "warnings": {
@@ -5447,6 +5483,20 @@
         "textFilterDropped": "1af3560e95f9e483",
         "thresholdColumnGuessed": "4595598009f195f5",
         "thresholdNotCarried": "386d5f1dc39548e0",
+        "tracesErrorRatioMinSpans": "2b5eb9d30ce5f182",
+        "tracesErrorRatioMinTraces": "0a48e91a68610396",
+        "tracesNoMatches": "a3a883fe8d51faaa",
+        "tracesNotRun": "153a5867ff5b6841",
+        "tracesPeriodCapped": "d85febb31cf3f13d",
+        "tracesSeedDuration": "86a5310dd9829c69",
+        "tracesSeedErrorRatio": "6482c9b0e280236f",
+        "tracesSeedErrorSpans": "b7223652d982387b",
+        "tracesSeedErrorTraces": "6b6a2da0f49cbf2a",
+        "tracesSeedMatches": "6d5f6bf70a261bfe",
+        "tracesSeedSpans": "b0c7da48cb7e6be0",
+        "tracesSeedTraces": "65efc9318192f33e",
+        "tracesSeedUnavailable": "0eeb0bb9b1a96b48",
+        "tracesStoredSpans": "76b5019e760436d4",
         "unresolvedQuery": "4cd999a9b4222ad7",
         "unsupportedPanelType": "1f9928c4b86b85bb"
       }
@@ -9355,6 +9405,15 @@
       "queryFields": "bedff62661a6f43b",
       "titleRequired": "7c15e7448e6f4d1c"
     },
+    "date": "99c40ab405926cb5",
+    "dateFormat": "16b1ff0fd29e0b60",
+    "dateFormatDmy": "0c6ff1231a8aa208",
+    "dateFormatEpoch": "53660b5bc2209228",
+    "dateFormatEpochms": "5389bb9f6f36e8ac",
+    "dateFormatEpochus": "9044784c02e163ff",
+    "dateFormatHelp": "9a3857e3a591b7c7",
+    "dateFormatIso": "bd203cdfbc050d8f",
+    "dateFormatMdy": "497319b9a2f9bdb6",
     "days": "e08c0aa8f558f39f",
     "decimals": "74672912045e226a",
     "decimalsMustBeBetween": "7fea01108f16d056",
@@ -9960,6 +10019,8 @@
       "addAnnotations": "cef84932bd0f98d2",
       "dependentAdhocVariableWarning": "a49d6008392505a5",
       "exitAnnotationsMode": "f7926a15fd7336d3",
+      "exploreAddToDashboard": "81c5e9c7bb53cc85",
+      "exploreCreateAlert": "a7aa98743fde8426",
       "pleaseWait": "2dfd888fdd5e8018",
       "redirectingToLogs": "11687f03a8f7d474",
       "refreshCacheReload": "2ac4f8a9601ba6c7",
@@ -11387,6 +11448,7 @@
       "lineCountedToBehind": "fda756c37a0ee644",
       "lineExact": "22fc00c3268448a7",
       "lineExactEstimated": "3abdcfd5183d925a",
+      "lineExactSlowestSchema": "ef3365493b226924",
       "lineGap": "71db3c726692dd2f",
       "lineHealthy": "ad6f89d68992ae3f",
       "lineHealthyAll": "9724ad1e593159ca",
@@ -11439,6 +11501,7 @@
       "failedChip": "cd8f5051cba3686a",
       "moreServices": "ecadd87ff0e5d0aa",
       "openQueries": "1cc7003257a55ac4",
+      "schemaCount": "af8b06d8319b5766",
       "searchPlaceholder": "5b5e4ae9bc9f4827",
       "summary": {
         "calls": "b73a5e2ca6458665",
@@ -12597,9 +12660,14 @@
       "title": "275814da8d3d0fc0"
     },
     "noLLMInsights": {
-      "action": "bbefb1e0d359b886",
-      "actionDesc": "10143ef7e46421e8",
+      "action": "077f797f300db0bd",
+      "actionDesc": "500ad6f2550cb2fe",
+      "codingAgent": "a0187dc59f83a81b",
+      "codingAgentDesc": "a9f892db0b444d97",
       "description": "19ec2da72c6b2477",
+      "startFrom": "5f3285e4fbdb83f5",
+      "suggested": "7b89ba0bd02cea17",
+      "suggestedDesc": "450da62ec7cef9f1",
       "title": "c390a136b67c5c2a"
     },
     "noLLMSessions": {
@@ -12995,7 +13063,6 @@
     "addCollector": "6d30a69cb01ed55a",
     "audit": {
       "allObjects": "77b8112ecb4eb493",
-      "assignedFleetConfig": "f2edb905b6ae3905",
       "autoRollback": "759dfb52f2d180e8",
       "createdConfig": "4f7f1ee2671cb679",
       "createdFleet": "b68cda33862cfd6c",
@@ -13039,7 +13106,8 @@
       "progressive": "c21bea0c6d590524",
       "rolledBack": "71592236d852c8a3",
       "scheduled": "4724f344c1c0e4a1",
-      "superseded": "e5830d265452f1ed"
+      "superseded": "e5830d265452f1ed",
+      "waiting": "6e293a8c009e0011"
     },
     "collectorMetrics": {
       "chartFailures": "216322e91817a15f",
@@ -13401,6 +13469,7 @@
       "receiverRefused": "edcf8cddc0293bee",
       "rollingOut": "1034b2f3c8519a6e",
       "rolloutHalted": "8a2afc80498adcd1",
+      "rolloutWaiting": "4eb9605c57a8efaf",
       "throughput": "286c8abb332b94d1",
       "viewCollectors": "09362e686190000d"
     },
@@ -13468,7 +13537,7 @@
       "confirmRollbackNoStable": "76cba5181ffc44a2",
       "confirmSkip": "fbf2627372d3e0cc",
       "confirmed": "fe00b67b6dd1143f",
-      "emptyFleet": "c83174a9b6a438d5",
+      "emptyFleet": "40e87c8e8e200c76",
       "eventConverged": "496a7f78a878cf75",
       "eventDeployingAll": "bc466962bfa87a7e",
       "eventDeployingPhase": "48b3a2550d7da3be",
@@ -13483,6 +13552,7 @@
       "eventStarted": "ecbc89cd37a03734",
       "eventSuperseded": "52ef7e19237d3ce6",
       "eventTimedOut": "c47d17f78f06c3c5",
+      "eventWaiting": "e4264c0e69310006",
       "excluded": "bef1fd9e5caea8b5",
       "exitDone": "e1094f3cf7f677e3",
       "exitFixForward": "470104b45177a3ae",
@@ -13507,11 +13577,13 @@
       "noneTargeted": "ff39f3ad54f4fc2d",
       "notFound": "860e2a125f52a2c9",
       "notFoundDescription": "86178a756a81856d",
+      "notStarted": "ba35f0c47d862763",
       "oneBatch": "c19b328d9c33d82c",
       "outcomeCompleted": "ecbca3631908722a",
-      "outcomeNoneTargeted": "46fc62713b771684",
+      "outcomeNoneTargeted": "962415e5e360c27e",
       "outcomeRolledBack": "b87a2b40dc59b1f9",
       "outcomeSuperseded": "2b19b3756928b29e",
+      "outcomeWaiting": "33b4615fa201ed60",
       "phase": "46342ec1eec9d78d",
       "phaseConverging": "5d83a1cdbc3ece78",
       "phaseDeploying": "4338bdb0808bff1b",
@@ -13528,8 +13600,9 @@
       "pickConfig": "90ea303d63b6e1b9",
       "pickFleet": "198dc9fab289dce0",
       "pickVersion": "63615c1367bcaffc",
-      "planEmpty": "e2d85223a4128d4a",
+      "planEmpty": "abc88f694f3d0380",
       "planOne": "a383f777ba3f4045",
+      "planStable": "5ce689ffe91deeb2",
       "planText": "1f056a0132545164",
       "planUnavailable": "59be1a0417cc69d6",
       "progress": "4664827f8e890192",
@@ -13561,7 +13634,8 @@
       "version": "dd167905de0defca",
       "versionChange": "d3f8f2614d634511",
       "versionFailedBefore": "9239d93df9ca801f",
-      "versionTo": "9dfbfacb677a4b76"
+      "versionTo": "9dfbfacb677a4b76",
+      "waitingForCollector": "6ade5abc8ce0ffc9"
     },
     "settings": {
       "action": "64cff1319d2fd2cb",
@@ -15155,6 +15229,18 @@
     "adminRegion": "0ffda4cfc0650beb",
     "aerospike": "ce7999e71cdee64f",
     "ai": {
+      "codingAgent": {
+        "envButton": "8594d2ee749572c4",
+        "envHelp": "a674c8b69df5e79c",
+        "envTitle": "08d3da57e11a658c",
+        "promptCopied": "c55394776b1492cf",
+        "promptLabel": "5c39123805ffb4e2",
+        "promptTitle": "c36d206528dfdcd8",
+        "streamHelp": "83f9edcc4f1358f3",
+        "streamLabel": "cdb84491f9d46fdd",
+        "tabAgent": "790f1f1068bb1941",
+        "tabSteps": "e8d00a9b9ef410c6"
+      },
       "selectIntegrationPrompt": "a0ce42f3b966249c",
       "viewDocsLinkLabel": "fcec91509759ad99",
       "viewDocsPrefix": "95ba4ed9329f4a25",
@@ -16350,6 +16436,78 @@
     "tabLabel": "4fc52a3c4c558b51",
     "title": "2a932f90172e99ea"
   },
+  "llmDataTrust": {
+    "chart": {
+      "addPrice": "a569afba541a4546",
+      "costMissing": "15719aeadc9a4433",
+      "costMissingPricedSince": "ccbcc443db252b66",
+      "pricedSinceModels": "4b41efe0a1b586bf",
+      "unpricedModels": "9d02ff6116a21199"
+    },
+    "cost": {
+      "addPrice": "a569afba541a4546",
+      "atLeast": "817fa98cd15714a5",
+      "partial": "9834a14ab9bcaa0f",
+      "partialTooltip": "7eb940bd52a38991",
+      "scopeSession": "3f3af1ecebbd1410",
+      "scopeTrace": "eafe895eb8119e6e",
+      "unknown": "d05144e2f67105ef",
+      "unknownModel": "b38aca5bdef50e36",
+      "unknownTooltip": "37d532fec09f7454"
+    },
+    "health": {
+      "checkedAgo": "a969a64149949bb1",
+      "checks": {
+        "missing_agent_identity": {
+          "detail": "56be6f448f66fc25",
+          "fix": "153a2dd7ec485532",
+          "label": "534909c4fe3161d5",
+          "pass": "f7ac036ebd3d13c4"
+        },
+        "missing_session_id": {
+          "detail": "71a7176e6a2d8e37",
+          "fix": "02a0a9e2c23ddca5",
+          "label": "7a2ac980813d4490",
+          "pass": "0e6992464dd45463"
+        },
+        "unpriced_models": {
+          "detail": "720a8d0a56bda95a",
+          "fix": "a458f3394499824e",
+          "label": "09fe601e257b445a",
+          "pass": "6c7db283854bf953",
+          "truncated": "6803449513cad9e7"
+        },
+        "zero_duration_spans": {
+          "detail": "fc8b55118ef803ef",
+          "fix": "a039dd154df91827",
+          "label": "08016c2977c1d921",
+          "pass": "e5fd7080ffeafe48"
+        }
+      },
+      "close": "7d9eb7acb13e2462",
+      "copyLink": "4d3369b8d181aa30",
+      "drawerSubtitle": "a540f007210cda31",
+      "drawerTitle": "f918ce9614900771",
+      "linkCopied": "d12860c21e78baa5",
+      "loadError": "112e1f96291d4d42",
+      "passing": "e32467f0609830f4",
+      "rerun": "9df526d3b6303b71",
+      "samples": "9d7b125807dd8026",
+      "status": {
+        "error": "54a0e8c17ebb21a1",
+        "pass": "83e6fbaec303ef43",
+        "warning": "e981ddae45d8f4ca"
+      },
+      "title": "6e5625b8c13013a0"
+    },
+    "noModelName": "6e2cf4b2b853869d",
+    "tile": {
+      "pricedSinceTooltip": "057c2112c955e970",
+      "unpricedTokens": "12d5d476475b2caa",
+      "unpricedTooltip": "20b54d2be1ea235f"
+    },
+    "topModels": "49c7abc42e15a381"
+  },
   "llmProviders": {
     "columns": {
       "defaultModel": "8b4e8774ddf69ec7",
@@ -16944,6 +17102,7 @@
       "errorAddingPanel": "6f1badcb000b2865",
       "panelAdded": "5f65a956a6f6ad9c",
       "panelsAdded": "95b99ef8ae8d477d",
+      "panelsToAdd": "d4b7e809147d7eca",
       "selectDashboard": "f82c269f36cec57f",
       "selectTab": "096913133b1c0d72"
     },
@@ -17203,6 +17362,8 @@
       "noMatch": "8fd65271addeef96",
       "noMatchHint": "f7270f66f0f6e1ad",
       "noMatchHintFavorites": "7d314816dbd9af58",
+      "noMatchYet": "4f985b77f0ddbf74",
+      "noMatchYetHint": "a58d01523b497cbc",
       "noMetrics": "9c1aac7f7110a396",
       "queryFailed": "222d8657e6ce5036",
       "railsAriaLabel": "e1fceb2e0a1984cf",
@@ -17407,6 +17568,11 @@
     "attributeRules": "e4bd97e927d96924",
     "attributeRulesDesc": "cf5a248e89b24c2b",
     "builtInPricesSynced": "eb9885c889598521",
+    "builtInStatus": {
+      "lastSynced": "66b7f514840b3ffc",
+      "neverSynced": "4d28bcc9c238aeac",
+      "seed": "0d9fee9d2de7a134"
+    },
     "cancel": "19766ed6ccb2f4a3",
     "capturedModelsEmpty": "b97acb252c89e6fa",
     "capturedModelsMore": "ecccea94c62457a7",
@@ -17573,6 +17739,45 @@
     "tooManyRules": "1560079ec4011946",
     "tooManyTiers": "8c5f8e5ab314ee15",
     "troubleshootingTitle": "c59293ca3a3db64c",
+    "unpriced": {
+      "approximate": "78b9b22ebb6f5156",
+      "banner": "f5a8b26344e5eba3",
+      "bannerTruncated": "04c63fac69c125a8",
+      "colActions": "ff8059dc6752afdd",
+      "colCost": "7dee9df582ec20aa",
+      "colModel": "748fb9ab8099b3d6",
+      "colPricedAs": "181e4ae9e35a2002",
+      "colTokens": "a039dfb9628b53dd",
+      "createPrice": "5834e581200ba482",
+      "defaultTierPrices": "fc52b31ebbf086cc",
+      "emptyTitle": "5d5ae6accdf9641a",
+      "errLoad": "368bb48f479cb76c",
+      "errSave": "6d5ce40b8951af75",
+      "historicalGap": "0a1d1b0597440254",
+      "instrumentationDocs": "6f50e36585535ffc",
+      "keepPrices": "ae8f1c1c6ac489da",
+      "keptNotif": "cb1793b3a662a59b",
+      "moreAgents": "ecccea94c62457a7",
+      "mute": "8dd6857baf026850",
+      "muteConfirmMessage": "84367224ba1d13ae",
+      "muteConfirmTitle": "fa1be2ff9025507c",
+      "mutedNotif": "b75f8f814bcec848",
+      "noActionNeeded": "6a6527dda190a006",
+      "noMatch": "cd8d844d2c3dedc1",
+      "noModelHint": "da5b59a35e5d5ed9",
+      "noModelName": "6e2cf4b2b853869d",
+      "noStreamsDesc": "8cf4bf6441c1549a",
+      "noStreamsTitle": "e4c51dcda2093282",
+      "notPriced": "5805ffba6946917c",
+      "pricedNow": "763cb445aed37244",
+      "recordedCostNote": "76837cb622d7118d",
+      "spans": "7c048203171e0876",
+      "streamLabel": "1eec3071dd26e224",
+      "subtitle": "08f38ded20b5a9a2",
+      "title": "2a0a598ff51711b5",
+      "window": "5c37cf8f018b4ac5",
+      "windowRange": "603aaefffcd2060b"
+    },
     "urlImportTab": "c4402d38a92d1c09",
     "usageKeyCol": "5e046807c81ec9dc",
     "usageKeyContainsSpaces": "eafd75e5ea847a68",
@@ -17960,6 +18165,7 @@
     "escalationEditing": "27e39fff96e0b4e8",
     "escalationHeld": "6eb2dc1844144383",
     "escalationLoading": "d441577128d7f2a1",
+    "escalationNobodyPaged": "cd1fc03ae9d071e5",
     "escalationNotStarted": "e626cc87c1c4a26c",
     "escalationPagesNobody": "760137c721470566",
     "escalationPagingStep": "1a1a433a79fa9dc9",
@@ -18509,6 +18715,7 @@
     "removeMemberFailed": "af28d51aed3a83d8",
     "removeMemberHandsOver": "4a9c9cda70d29445",
     "removeMemberLeavesGap": "656a7ac9de0c7886",
+    "removeMemberReorders": "8744a543b4facebb",
     "removeMemberTitleNamed": "13a85193691c916c",
     "removeMemberTitlePerson": "01c1f0250884f593",
     "removeRotationBlocked": "bbc3c91dfe484667",
@@ -18613,13 +18820,14 @@
     "rotationOpenMembers": "6e5e1e137765681a",
     "rotationOrderHint": "fe09e9fc139c1309",
     "rotationPreviewEmpty": "e9da2a6f8981aa03",
+    "rotationPreviewNow": "00174097054e8787",
     "rotationPreviewPairLegend": "7f1739c73bac3a77",
     "rotationRestrictionAdd": "b7283e2a89b85b34",
     "rotationRestrictionDays": "e08c0aa8f558f39f",
     "rotationRestrictionFrom": "218197693424e015",
     "rotationRestrictionRemove": "c3812fc4acb861d5",
     "rotationRestrictionTo": "f4b06ef6d3c81436",
-    "rotationRestrictionZeroLength": "62df11bf4852e883",
+    "rotationRestrictionZeroLength": "f9b1b36b936f9a5a",
     "rotationRetiredTag": "a9f71bc2404c9193",
     "rotationRuleCount": "ff07023b114bde98",
     "rotationSectionRules": "9cb43d33ba6744d4",
@@ -18704,7 +18912,7 @@
     "ruleEditorConflictKeptBy": "74be5c72b7d753aa",
     "ruleEditorConflictSameTeam": "884d0e10ac781669",
     "ruleEditorConflictTakesOver": "16ac75b9b76a18fc",
-    "ruleEditorConflictUnclaimed": "27d5e24d428ffc85",
+    "ruleEditorConflictUnclaimed": "bff6bd6c7ad32bd3",
     "ruleEditorDiscardCondition": "eb1a70e39274bb76",
     "ruleEditorEmpty": "b4099d03179c1240",
     "ruleEditorFieldPlaceholder": "e867f9b7c5ea6bf9",
@@ -18799,6 +19007,7 @@
     "scopePathEmpty": "db4fd2a829db4309",
     "scopeServiceHelp": "177357ac04c01152",
     "scopeValuePlaceholder": "0b24aed53ab654ea",
+    "scopeValuesSeen": "d9b779ee40d035ed",
     "searchResponses": "9b56eff16ec33c42",
     "searchTeams": "3ad7e221faf10419",
     "searchTeamsPeople": "84bc7b36a4e6ff5f",
@@ -18808,6 +19017,7 @@
     "sectionHint_resolved": "7ccc927dd026552c",
     "sectionHint_ringing": "267e1c559487547e",
     "sectionHint_ringingRouted": "eed6237eeccd471c",
+    "sectionHint_ringingStopped": "8ca9ade8957410db",
     "sectionHint_ringingUnrouted": "5fd68e3f69e31c51",
     "sectionHint_snoozed": "632057805efe13d1",
     "section_handled": "1e7536d56c45d9cd",
@@ -19107,6 +19317,10 @@
     "unroutedSignal": "1e9806e4227ba3b9",
     "unroutedTitle": "c0f5487da1e37214",
     "unroutedWriteRule": "75f7e48ed0927929",
+    "unsnooze": "94798842ac921e31",
+    "unsnoozeFailed": "a9e896a723df69d0",
+    "unsnoozeHint": "0f39fce573e74e53",
+    "unsnoozed": "ba964e0ca1d094b3",
     "upcoming": "cd41bc1383278f4a",
     "upcomingFrom": "51449acb1f33eb7e",
     "upcomingNoChange": "c3e7c9ebaf11435d",
@@ -19145,6 +19359,10 @@
     "deleteError": "4e1252dd62c17a4b",
     "deleteTitle": "0f81c0d86606f518",
     "deleted": "053cce198e4c5f50",
+    "disabled": {
+      "description": "81eee881644382fd",
+      "title": "91aea42163f5c2c6"
+    },
     "failedToDeriveSchema": "7c0920d61024a096",
     "failedToFetchCatalog": "3d180cc1e30ede2e",
     "failedToImportScoreConfig": "cea17a4a8ef74d36",
@@ -19172,7 +19390,7 @@
     "importTypeRequired": "69bc45f13263fda6",
     "invalidJsonFormat": "70410685471d0577",
     "job": {
-      "backTo": "c27068e179c5a5a9",
+      "backTo": "b9f4405cc53cea2c",
       "columns": {
         "actions": "ff8059dc6752afdd",
         "created": "d70b9e24bca26b40",
@@ -19291,6 +19509,7 @@
         "checked": "d5963b914e843b1f",
         "degraded": "a8494c12f2243903",
         "healthy": "7f1e323b6272c620",
+        "lastScored": "0409ebe70cb2950b",
         "noRecentRuns": "060b3875c66ccf92",
         "since": "8dbe1c0bde15c300",
         "summary": "d308c48030d712ba",
@@ -19519,7 +19738,7 @@
       "authEditNote": "e8fff442aa27b600",
       "authSection": "66880d2d8216260d",
       "availableModelsLabel": "9dbfd0478bd51235",
-      "backTo": "9f73d5ebe9024c6b",
+      "backTo": "996c32b35f2182a9",
       "cannotRename": "1219ec44a131d522",
       "createTitle": "917817050bd786f8",
       "defaultModelLabel": "3840d9d29421c46c",
@@ -19800,7 +20019,7 @@
       "authConfigured": "20158224750041d6",
       "authLabel": "e3b389c6838e46ca",
       "authSection": "66880d2d8216260d",
-      "backTo": "ec7bdbca67479176",
+      "backTo": "d8598427499abb65",
       "badgeLlm": "c7b08a64bb5189e8",
       "badgeRemote": "ffa98e02f7ce33fc",
       "columns": {
@@ -19991,6 +20210,9 @@
       "saveError": "20354bc384081c3f",
       "searchPlaceholder": "b73c243999e70f74",
       "selectedPrefix": "bef9d85df8ea13fe",
+      "temperatureHelp": "159b6f26f887d3e5",
+      "temperatureLabel": "b958ce8b871ab36b",
+      "temperaturePlaceholder": "5feceb66ffc86f38",
       "testPanel": {
         "disabledHint": "af9dfbb4c32b55f3",
         "emptyPrefix": "5244a9d3af4c95c3",
@@ -20023,6 +20245,7 @@
         "nameRequired": "0e277315963f1277",
         "providerRequired": "caa0c95d885aab0c",
         "retriesInvalid": "12b3bb4259e8ce7d",
+        "temperatureInvalid": "1ad25a87a7426b05",
         "timeoutInvalid": "1a85eee09fd39cf2"
       },
       "versionsLoadError": "211bf839fb3e9353"
@@ -20332,6 +20555,13 @@
       "constant": "8ab253e4aab66e2a",
       "csv": "90afcf937330e97f",
       "custom": "494ca78f7374e46f",
+      "date": "99c40ab405926cb5",
+      "dateDmy": "9c7d6e0f947c2cdc",
+      "dateEpoch": "595572802984f2ff",
+      "dateEpochms": "65720c8b01f4753f",
+      "dateEpochus": "0caeb49eaed902cf",
+      "dateIso": "3b3dd31839bb4468",
+      "dateMdy": "ec48d7101d123086",
       "doublequote": "0e1af56126edd381",
       "list": "e547bf4f1b91ebb8",
       "pipe": "b2114e05a8ef3080",
@@ -24623,6 +24853,7 @@
       "outboundEmpty": "322ad255e684c217",
       "outboundQueue": "164d6d484caf393a",
       "refreshTokenKept": "bb4cab940d1dea50",
+      "refusedPosts": "95b8e76abaf0d6bb",
       "reinstall": "c630a782a9eb8569",
       "reinstalled": "cffd0c1d3780790e",
       "sockets": "9ed979d196a60475",
@@ -27821,6 +28052,7 @@
     },
     "workflows": {
       "chooseATriggerNodeToStart": "7904798bda88e090",
+      "endpointUrlCopied": "2f9b25cbd02e98a8",
       "onlyOneIncomingConnectionToA": "b2624193ef7b83f2",
       "thisBranchAlreadyEndsInA": "2c04309c6063252a",
       "thisConnectionWouldCreateALoop": "1bfe0227517d5d1d"
@@ -27836,6 +28068,13 @@
     "applyAndSearchEquals": "0957a5c642435266",
     "applyAndSearchNotEquals": "f27e9d0b738f3717",
     "applyPendingFilters": "ce1202e0d05abe3b",
+    "askAi": {
+      "askAboutSpan": "0c4630fa1207852b",
+      "explainTrace": "e70067d9b76c657b",
+      "explainTraceHint": "0ddeb2fc8e242088",
+      "spanChip": "1e19b7d756495f48",
+      "traceChip": "f52267dc28d9470a"
+    },
     "backToLogs": "ed627b7ddd4e0cca",
     "backToResults": "c7ef0e278b1e08c0",
     "backToTraces": "f03da00bbeb8113f",
@@ -28038,6 +28277,7 @@
       "tool": "783d36e81261aee8"
     },
     "lLMErrorTable": {
+      "loadFailed": "938bec8eff1825c7",
       "noData": "3b41ba9c7cb8c5d6",
       "noErrorsInRange": "fbbc2eb15f5981f1",
       "operation": "0f044feb6ca7d676",
@@ -28103,6 +28343,7 @@
       }
     },
     "nextMatch": "825e5abd0762be6e",
+    "nlNeedsSql": "effe40b58861fd76",
     "noCorrelatedLogsFound": "643231c56fd2784d",
     "noData": {
       "askAi": "0dd9b2668db5d2c3",
@@ -28147,6 +28388,23 @@
     "operation": "0f044feb6ca7d676",
     "p50Median": "76661f0c8ac6ce54",
     "previousMatch": "daa2f8c3fc897cc7",
+    "redActions": {
+      "addRedToDashboard": "f9995c951ada8920",
+      "bucketNotice": {
+        "days": "4dbd138c5b05a855",
+        "hours": "7e91f22901a70179",
+        "minutes": "d429f1479eca3f89",
+        "seconds": "65cac4f4920546e5"
+      },
+      "bucketNoticeSingle": {
+        "days": "e941f1e462b76056",
+        "hours": "b9ff968eedf27ef7",
+        "minutes": "e3290078adb23ed8",
+        "seconds": "f72027031f9cacbd"
+      },
+      "durationActions": "604c22760aaacfb3",
+      "menuGroupDashboards": "a53bcafb67d960df"
+    },
     "redMetrics": "a9d1ab9a2d6d4dac",
     "results": {
       "errorColumn": "54a0e8c17ebb21a1",
@@ -28374,7 +28632,7 @@
         "estimatedWithoutCache": "bcd4cd46920456b4",
         "filterErrors": "4eac71524e3ed530",
         "grossCacheReadSavings": "e39d337acfe8718d",
-        "latencyLead": "bff1c3d5d14f51ce",
+        "latencyLead": "3fb271649a2b7693",
         "netCacheImpact": "4bdd0ac6e0dadd9c",
         "resetFilters": "660f3d76f4f2802d",
         "tokens": "e7d163813b8a11d0",
@@ -28760,6 +29018,10 @@
     "folder": "74ccd43303847f26",
     "header": "e2073645cb0dbbdd",
     "history": {
+      "alertFiredEmptyTitle": "817e727c68262cf8",
+      "allTriggers": "93b7f47d48675fef",
+      "detailsNoKey": "07b1ae92b6fde2e4",
+      "detailsWithKey": "86d2daf01b268871",
       "duration": "4fc52a3c4c558b51",
       "durationHoursMinutes": "425dc6c72de6fdc5",
       "durationMinutesSeconds": "c4521614d0a2513f",
@@ -28768,25 +29030,327 @@
       "ended": "7cdc804e6996997d",
       "error": "54a0e8c17ebb21a1",
       "failed": "031a8f0f659df890",
+      "filterEmptyDimmed": "9b00c21e02ed1ae1",
+      "filterEmptyTitle": "c7a5be937e62a70f",
       "hideTestRuns": "39ef1b67cd8d8c06",
+      "incidentEventEmptyTitle": "d736cf98147a0ceb",
       "loadError": "762d0146abbad86f",
       "loadRunError": "a6300f95d9e4e4aa",
       "open": "0e76960093379060",
       "openFullView": "fd43711ac463dacb",
+      "openRun": "95fe7393c85ec788",
+      "reasonExpired": "555b5a57d6f0ab77",
+      "reasonRunTimeout": "86f367a202f28c1c",
+      "reasonWorkerLost": "00698d7c48b1fafe",
+      "reasonWorkflowDisabled": "8715207062f345f0",
       "retry": "942087cc2d41e013",
       "retryError": "1ff77ecb8550b8f3",
       "retryMessage": "abcfc90ca7b23fa9",
+      "retryOf": "f1dc656b1bd5c5d4",
       "retryStarted": "ca21bfeee92fdf35",
       "retryTitle": "e3399695e101743e",
       "retryTooltip": "ce203c4a3bbbe229",
+      "run": "00d60e31a4e6b834",
       "runType": "baaddf70fb5d432b",
+      "searchEmptyAction": "3b7ea51793e9d906",
+      "searchEmptyTitle": "813c63791d953182",
+      "searchRuns": "f93a3e32be86c829",
       "showTestRuns": "5261cabacd0dba01",
+      "source": "0e570ca6fabe24f9",
+      "sourceAlertFired": "4a2b79784a7b2c42",
+      "sourceDetails": "95de492834d708ef",
+      "sourceHttp": "f1ee1152c8b29ea2",
+      "sourceIncidentEvent": "a7b1ea3b90935a8c",
+      "sourceManual": "84a2e40670df461b",
+      "sourceOther": "f97e9da0e3b879f0",
+      "sourceRetry": "2f9c439b3b7e705c",
       "started": "ecbc89cd37a03734",
       "status": "920e413c7d411b61",
+      "statusExpired": "424a2551d356754c",
+      "statusQueued": "661ff40a07e037bb",
+      "statusRunning": "f4ccae29e1bb0c20",
       "success": "c88a0b907419a70c",
       "testRun": "fe9e2fc32433289d",
       "testRunTooltip": "a350cfc8353cff85",
-      "title": "74c90dadee1b9dff"
+      "timelineAgoDays": "02ee8a8b0b7869f7",
+      "timelineAgoHours": "a852514c755e2aa0",
+      "timelineAgoMinutes": "1695a4da57d5776d",
+      "timelineNow": "ed5eb9a37e2d8231",
+      "title": "74c90dadee1b9dff",
+      "triggerFilter": "8b9c643731c94119"
+    },
+    "http": {
+      "acceptRequests": "3cc264203f3e1279",
+      "active": "92340695899bd2d8",
+      "advanced": "9f088dbebd6c3c70",
+      "advancedSummary": "9a2f2b2aa43ce830",
+      "authAbout": "3220ba9a4dd64473",
+      "authInfo": "732a42bf45eceac6",
+      "authLabel": "80ee37242dc6e62d",
+      "authSigned": "b6cc80d300c385f7",
+      "authToken": "d2089be672953d11",
+      "bodySizeBytes": "7b315b762548b35b",
+      "bodySizeKiB": "e6d5832839cceed2",
+      "bodySizeMiB": "fcebbf180a73d0ff",
+      "changeFailed": "912a8e5f6a6dbe10",
+      "colActions": "ff8059dc6752afdd",
+      "colCreated": "d70b9e24bca26b40",
+      "colLastUsed": "830ec7f812f9d862",
+      "colSecret": "7e32a729b1226ed1",
+      "colStatus": "920e413c7d411b61",
+      "colToken": "d2089be672953d11",
+      "commandCopied": "e5c02424e511e1ef",
+      "copyCommandFailed": "7a820eb530322b2d",
+      "copyCredentialChanged": "8fa5d36afff4a1c4",
+      "copySecret": "9b80d4b38e70c8c5",
+      "copyToken": "d35b4ef7c618415a",
+      "copyUrl": "fa26011bf19e1198",
+      "copyUrlDraftHint": "156f2342d5347b2b",
+      "copyUrlFailed": "c4858d355d69b7da",
+      "createForbidden": "945cad3763fad357",
+      "creatorGone": "a20f7dd7ec9e5c62",
+      "deleteBody": "34687f0a6c2d1e71",
+      "deleteButton": "6772d678942a3f79",
+      "deleteFailed": "746079e0af29c480",
+      "deleteMeta": "864130edac832e4e",
+      "deleteTitle": "77a7901069cca1d0",
+      "disableBody": "704424a23fa25a47",
+      "disableConfirm": "06f0e210b27d4d62",
+      "disableTitle": "51d730dcadce4a68",
+      "disabledBanner": "da203b3cb4b1c44d",
+      "done": "11a6767d5674c7e4",
+      "draftBanner": "de322c663fcaefee",
+      "dryRunAccepted": "b47d43594a5ceade",
+      "dryRunFailed": "6a09aecdacb8cd19",
+      "dryRunInput": "1e1aec27e370bdc6",
+      "dryRunMeta": "c68f730740081514",
+      "dryRunRateLimited": "9456b05c8d09541a",
+      "dryRunRefused": "29dff3e9aecda49c",
+      "dryRunRefusedPaused": "1221589dfc7065fc",
+      "dryRunStatus": "cb609f2cb8bd987a",
+      "editorButton": "9175da02d25c7b55",
+      "editorButtonOff": "ca7981b46ecf2c17",
+      "editorButtonOn": "130011756125313c",
+      "editorButtonRefusedDraft": "82ef1aad083c253c",
+      "editorButtonRefusedPaused": "bfb25e742fb6c00f",
+      "editorButtonTooltip": "3469d34ee7dcb761",
+      "endpointExistsHint": "ea4b1b3981c729a7",
+      "endpointExistsHintSigned": "ab98fd4d3b859b94",
+      "endpointUrl": "2578179d177903e1",
+      "errorNoLiveCredential": "87f27efdc67df9cb",
+      "errorNotAllowed": "7db15c5ce04c9b80",
+      "errorNotConfigured": "e86bbf9c69347b02",
+      "exampleActiveSecret": "5632f0f02fb77a6d",
+      "exampleActiveToken": "8e9746411032ddc5",
+      "exampleHintSigned": "2981e1413d06f5a0",
+      "exampleHintSignedPlaceholder": "2e4b4f0a0b5fd31b",
+      "exampleHintToken": "e03506daef6440d1",
+      "exampleHintTokenPlaceholder": "e6d0b3bf9749bd74",
+      "exampleRequest": "ba15af9e002393bc",
+      "expired": "424a2551d356754c",
+      "expiresInDays": "da3b526ec02bb68c",
+      "expiresInHours": "cf5e5e97f6a66453",
+      "fieldGroup": "f1ee1152c8b29ea2",
+      "fieldGroupBodyHint": "b6f6cb95ff15cdc6",
+      "fieldGroupQueryHint": "088f9b97cb821261",
+      "headerName": "dcd1d5223f73b3a9",
+      "headerValue": "8e37953d23daca5f",
+      "headers": "194e9fe656a1bcab",
+      "headersKept": "5b48d0229dcb6ff6",
+      "kindNote": "79b46f794b73b152",
+      "kindNotePayload": "3ae28c7412d6a4ee",
+      "kindNotePayloadHide": "0db5f0cba18f2d02",
+      "lastCall": "216689da1c52bf4f",
+      "lastCallNone": "97838d7724882b07",
+      "lastCallNoneRefused": "e0fc67bb703564fc",
+      "lastCallStatus": {
+        "expired": "fa64ea1e82e1206f",
+        "failed": "5d28a90f4498a814",
+        "queued": "d36be6494248ee06",
+        "running": "c071cf5f5ed6f884",
+        "succeeded": "5dceaeceb6d8a49d"
+      },
+      "listMenuItem": "3cc0f1ee2da02e48",
+      "listTag": "56d6f32151ad8474",
+      "listTagTooltip": "037f01286a33aab5",
+      "loadError": "361318790da4cf42",
+      "maxBody": "198c607c2fcd6e5c",
+      "maxBodyHint": "5d4ded1f1ec22b8c",
+      "maxBodyRange": "e3549f9f86858835",
+      "needsAdmin": "b4d4fce3546efbdd",
+      "needsEdit": "a000127857e9a71f",
+      "never": "6300ef800bb88429",
+      "newSecretLabel": "c08c84dbb0cb4fc7",
+      "newTokenLabel": "fe46cb83ad1c5a35",
+      "nodeBadge": "cc5eaa11c684a30b",
+      "offBody": "e540546366294c8d",
+      "offExistingBody": "b2dcc2dacb5e1082",
+      "onMeta": "fed6287a4b973884",
+      "openStep": "463ad0ca73f8f4f4",
+      "outputCaption": "1e98c9dc3f8b5fbe",
+      "overlapDay": "f0514e8df84107f4",
+      "overlapHour": "f8b8883f0c9d8d82",
+      "overlapNow": "24a5d1cd7649d755",
+      "overlapWeek": "7f920bb639c93075",
+      "panelSubtitle": "3b1fec9ffcfc9e63",
+      "panelTitle": "9175da02d25c7b55",
+      "payloadFrom": "e64a6482125e8f6f",
+      "payloadHttp": "f1ee1152c8b29ea2",
+      "pickerCue": "0bf4a26c86ee6816",
+      "raiseLimit": "3bdea189a52695ed",
+      "rateLimit": "aa6d477fff29576b",
+      "rateLimitHint": "852659db035dc921",
+      "rateLimitRange": "748b3466f6b8cc93",
+      "readOnlyOnMeta": "f0ea7fe4f448fb28",
+      "reason": {
+        "credential_in_url": {
+          "fix": "fde4cf14cc9be644",
+          "title": "41805d7e323055c7"
+        },
+        "endpoint_disabled": {
+          "fix": "957a2133fa4c1163",
+          "title": "310f36c6306d4469"
+        },
+        "idempotency_key_reused": {
+          "fix": "3bfd0c548277cca9",
+          "title": "f6a5f27cbcba7be5"
+        },
+        "invalid_idempotency_key": {
+          "fix": "96709b3d11df60ba",
+          "title": "a3d2a892413b9971"
+        },
+        "invalid_signature": {
+          "fix": "5512fc3bcdbd7e2a",
+          "title": "97b096319f1c128b"
+        },
+        "invalid_token": {
+          "fix": "f8e8eed7b229ca08",
+          "title": "086efea7640e6806"
+        },
+        "payload_too_large": {
+          "fix": "0eefeb2f57a45ab2",
+          "title": "c3123ec25291b935"
+        },
+        "queue_full": {
+          "fix": "8ee9cadfe4b71ea8",
+          "title": "4ad672a94c1af12d"
+        },
+        "rate_limited": {
+          "fix": "559bb643b0911245",
+          "title": "a06130a5a2818ae5"
+        },
+        "stale_timestamp": {
+          "fix": "de9286cb2791bc18",
+          "title": "526d8400134898e3"
+        },
+        "worker_unavailable": {
+          "fix": "69cd89d5d1f8c516",
+          "title": "be65838a2c9df8a9"
+        },
+        "workflow_disabled": {
+          "fix": "c5a3b8eee8f425df",
+          "title": "533631053f3864bf"
+        },
+        "workflow_not_published": {
+          "fix": "0b9ae7f66b3ada69",
+          "title": "7f626c86b88eb6ac"
+        }
+      },
+      "regionBanner": "94cbb3b56a79bc8c",
+      "regionTag": "9c516d4563be01e4",
+      "rejectionMeta": "665bb7a6e1028e75",
+      "rejectionsCaption": "92af1abe4eb8c381",
+      "rejectionsHide": "ac20a57bfde0bbc4",
+      "rejectionsLine": "5b35ad1e9a78b17a",
+      "rejectionsLoadError": "0571e6b78444c5ce",
+      "rejectionsShow": "0df6f1cad36c49da",
+      "rejectionsTitle": "3486ecce0d1ddc1a",
+      "request": "59f03d642b41e22f",
+      "requestBodySize": "895fec844e359f4c",
+      "requestCallerIp": "cc8f4f4a308c78bf",
+      "requestContentType": "6f51cb0403204b19",
+      "requestIdempotencyKey": "e904f4599aa01bf8",
+      "requestReceived": "49f19beeecf442ef",
+      "requestToken": "d2089be672953d11",
+      "retiring": "fd2b42810f6b4d83",
+      "revealBannerBody": "53d7d500858d0e9c",
+      "revealBannerBodySigned": "1d7803265dc1e4f5",
+      "revealBannerTitle": "a6f921fabd574f78",
+      "revealDenied": "b126c72b919fba7d",
+      "revealFailed": "6efd01b4c3d5ac96",
+      "revealFailedSigned": "98866207d6a91bad",
+      "revoke": "87e6d00bbf53ec5a",
+      "revokeFailed": "b7e634223402ed50",
+      "revokeNow": "581e15bd3fcf5a3a",
+      "revokeTitle": "b840925a7ecddfa5",
+      "rotate": "c3613b1704f54c8b",
+      "rotateBannerBody": "da801b4fee507396",
+      "rotateBannerBodyFresh": "7eb873184b6208ba",
+      "rotateBannerBodyFreshSigned": "ee624a55ecab5eab",
+      "rotateBannerBodyRevoked": "ecab40fb07e4cb33",
+      "rotateBannerBodyRevokedSigned": "98ba812645669ee5",
+      "rotateBannerBodySigned": "2aa63c54f2aa7a65",
+      "rotateBannerTitle": "499360406bcbd4a2",
+      "rotateBannerTitleSigned": "ae2310454ff61733",
+      "rotateBlocked": "cd6525a96b01bd5d",
+      "rotateBlockedSigned": "a49e5568af5fdf92",
+      "rotateConfirm": "4ade788283fe9a33",
+      "rotateConfirmSigned": "ca38c242319770f6",
+      "rotateConsequence": "73a9612eaae73a20",
+      "rotateConsequenceNow": "cf03588511c5f9ab",
+      "rotateConsequenceNowSigned": "25e077ce94930d8d",
+      "rotateConsequenceSigned": "a059892362ef0b40",
+      "rotateFailed": "1ed1e49a57c647f7",
+      "rotateLead": "b9f7594e1c806386",
+      "rotateLeadNone": "8a8a18bb31fa2981",
+      "rotateLeadNoneSigned": "bfd5eca9e538d7a9",
+      "rotateLeadSigned": "a32df55035f99b20",
+      "rotateLeadUnused": "c17f8983e70ef5ef",
+      "rotateLeadUnusedSigned": "3c142807e208c876",
+      "rotateLink": "c3613b1704f54c8b",
+      "rotateTitle": "4ade788283fe9a33",
+      "rotateTitleSigned": "ca38c242319770f6",
+      "runExpiredBanner": "29b5e42c19354b80",
+      "runFailedAt": "9fa3375cdfb43ac7",
+      "runGuardHint": "1dcad435ba54bae6",
+      "runTest": "e031e0df30c9898f",
+      "runTestHint": "608d160dcbb88dfb",
+      "runTestHintList": "b9d55d8957013535",
+      "runTestInstead": "c2f14a4b48e42849",
+      "runWorkerLostBanner": "c6bece3713bb606a",
+      "runsEmptyAction": "c6f6e25fc8a4902a",
+      "runsEmptyBody": "f2cb2f033bbf7d7e",
+      "runsEmptyTitle": "7cef77a71d7dd563",
+      "saveAndCreate": "5f5d85b59343b9a7",
+      "saveLimitsFailed": "17a15ea8a14e487d",
+      "secretCopied": "704aed35a6feded1",
+      "secretHint": "1ebbb4569e65cf09",
+      "secretLabel": "e7ee22e117a12ad8",
+      "secretStorageWarning": "26443323470d640b",
+      "secretsTitle": "37364fc41ded5401",
+      "sendTest": "5d2372e63ec25729",
+      "sendTestHint": "aaf9e310393d92b4",
+      "sendTestHintPaused": "192b439940d2f64d",
+      "sendTestSigned": "7861ceb0624b45cb",
+      "snippetsLabel": "ba15af9e002393bc",
+      "switchToSignedBody": "a0882a162191a445",
+      "switchToSignedTitle": "094adfc152298a2d",
+      "switchToTokenBody": "c35928b6d2c2105b",
+      "switchToTokenTitle": "1e28c9f6e0346c24",
+      "switchedBannerTitle": "96993ffc5037d390",
+      "switchedBannerTitleSigned": "5b31071a6b92c710",
+      "tokenCopied": "c9feac7acc32ee92",
+      "tokenHint": "c48da8cbbe1a2614",
+      "tokenLabel": "d2089be672953d11",
+      "tokensTitle": "a039dfb9628b53dd",
+      "triggerLinkOff": "5ca56d9aca5f5e51",
+      "triggerLinkOffAction": "bb9c27d72fa44e74",
+      "triggerLinkOn": "e3dd331f610bb066",
+      "triggerLinkOnAction": "695ff3927de6f267",
+      "turnOnFailed": "fcd76bcbf00c543a",
+      "unsavedBody": "066ff1cac3a503d8",
+      "useAsTestInput": "1a478a159532c84a",
+      "viewRun": "aaf7fccc7d1315f2"
     },
     "linkAlerts": {
       "alertsLabel": "f62e9267d196c761",
@@ -29008,6 +29572,8 @@
       "lastTestRun": "585b1ab789dddea8",
       "notConfigured": "c5418aa5e0f85e5b",
       "notVerified": "ec3edb8410037a74",
+      "payloadFrom": "e64a6482125e8f6f",
+      "payloadFromHint": "c50945a0b865fc7c",
       "recordedFailure": "d4f33864645e20c9",
       "recordsUnavailable": "9d86d83b1749c16f",
       "rehearsalOnly": "fa849ce09502071d",
diff --git a/skills/openobserve-instrument/SKILL.md b/skills/openobserve-instrument/SKILL.md
new file mode 100644
index 0000000000..dcdd745f7f
--- /dev/null
+++ b/skills/openobserve-instrument/SKILL.md
@@ -0,0 +1,313 @@
+---
+name: openobserve-instrument
+description: Instrument an LLM or AI-agent app to send OpenTelemetry traces to OpenObserve, run one sample request, print the link to the first trace, and run the OpenObserve AI data health checks. Use when the user asks to instrument, trace, or connect an AI app to OpenObserve, or to check that its AI telemetry is complete.
+---
+
+# Instrument an AI app for OpenObserve and verify the data
+
+You edit the user's project so every LLM call is traced to OpenObserve, prove it with one real
+request, and report what is still missing. Work in the project root. Print what you change at each
+step; leave the diff for the user to review and commit.
+
+Helper script: `scripts/verify.py` next to this file (Python 3 standard library only). If you
+fetched this file by URL, fetch the script from the same directory:
+`https://raw.githubusercontent.com/openobserve/openobserve/main/skills/openobserve-instrument/scripts/verify.py`
+and save it outside the project (for example `/tmp/openobserve-verify.py`).
+
+## Rules
+
+- Never print, echo, log or paste a secret value. Mention variable **names** only. Do not `cat` the
+  `.env`; read it with code that prints names, or let `verify.py` read it.
+- Never put the token in source code, the chat, or a command line you show. The app reads it from
+  the environment (`load_dotenv()`).
+- Do not commit. Do not change unrelated code.
+- The org and stream named in the user's prompt win over values in `.env`.
+
+## 1. Read the configuration
+
+The user downloads a `.env` from the OpenObserve AI integration card into the project root. It holds:
+
+| Variable | Required | Meaning |
+|---|---|---|
+| `OPENOBSERVE_URL` | yes | OpenObserve API base URL, e.g. `https://api.openobserve.ai` |
+| `OPENOBSERVE_ORG` | yes | Organization identifier |
+| `OPENOBSERVE_AUTH_TOKEN` | yes | `Basic <base64>` (or `Bearer <token>`) |
+| `OPENOBSERVE_TRACES_STREAM_NAME` | no | Traces stream; `OPENOBSERVE_STREAM` is accepted too. Default `default` |
+| `OPENOBSERVE_UI_URL` | no | Web UI root when it differs from `OPENOBSERVE_URL`, used for links only (links are `<root>/web/…`) |
+
+Check which names exist, for example:
+
+```bash
+python3 -c "import re;print(', '.join(m.group(1) for l in open('.env') if (m:=re.match(r'\s*(?:export\s+)?(OPENOBSERVE_\w+)\s*=',l))))"
+```
+
+Print `✓ .env found: <names>`. If a required name is missing, stop and tell the user to download
+the `.env` from the integration card (Data Sources → AI Integrations → *their SDK* → *With a coding
+agent*). If the user named an org or a stream, set `OPENOBSERVE_ORG=<org>` or
+`OPENOBSERVE_TRACES_STREAM_NAME=<stream>` in `.env` (the SDK reads these names). Make sure `.env`
+is listed in `.gitignore`; add it if not.
+
+## 2. Read the project
+
+Find and print one line, e.g. `Python 3.12 · openai 1.54 · entry point app/main.py · agent name "research-agent"`:
+
+- **Language and runtime**: `pyproject.toml`, `requirements*.txt`, `setup.py`, `package.json`, `go.mod`, …
+- **LLM SDK / framework** in use: imports and dependencies (`openai`, `anthropic`, `google-genai`,
+  `langchain`, `crewai`, `google-adk`, `openai-agents`, `litellm`, `claude-agent-sdk`, OpenRouter
+  via the `openai` client, …).
+- **Entry point**: the module that starts the app (`__main__`, `main.py`, CLI script in
+  `pyproject.toml`, server startup file).
+- **Agent name**: the project or service name (`[project].name`, package name, directory name).
+- **Version source**: `[project].version`, `__version__`, `package.json` `version`, or the git
+  short SHA (`git rev-parse --short HEAD`) when nothing else exists.
+- **Session id**: whatever identifies one conversation or request in the app (chat/thread/session
+  id, request id). If the app has none, generate one per run with `uuid.uuid4()`.
+
+## 3. Install
+
+### Python, supported SDK — use the OpenObserve installer
+
+Run the installer the integration card uses, pinned to a reviewed commit: download it to a temp
+directory, check its SHA-256 against the one below, and run it from there only if they match;
+never pipe a URL into a shell. A mismatch means the file is not the reviewed one: stop and tell
+the user instead of running it or retrying another way. It installs the packages into the
+interpreter it finds and verifies the imports. It takes the token only as a command-line argument,
+which other local processes can read, so it never gets the real one: the project's `.env` already
+holds the token. Give it a placeholder and point its env file into the temp directory, so it
+cannot overwrite the project's `.env`. The URL is not a secret; read it from `.env` inside the
+command. Do not `source` the `.env`: the token value `Basic <base64>` contains an unquoted space,
+which a shell reads as a command.
+
+```bash
+env_get() { python3 -c 'import sys
+for l in open(".env"):
+    k, _, v = l.strip().removeprefix("export ").partition("=")
+    if k.strip() == sys.argv[1]: print(v.strip().strip("\"'\''")); break' "$1"; }
+O2_INSTALLER_RAW=https://raw.githubusercontent.com/openobserve/o2-datasource/9fdf2ca60b03a43273677a875140cfd19e29262b/ai
+O2_INSTALLER_SHA256=307c0d275c8b91f270d557d41524d438f799934fe8502b513e3a22e6b2fcb0af
+O2_INSTALLER_DIR="$(mktemp -d)"
+mkdir "$O2_INSTALLER_DIR/frameworks"
+curl -fsSL "$O2_INSTALLER_RAW/frameworks/setup.sh" -o "$O2_INSTALLER_DIR/frameworks/setup.sh"
+if command -v sha256sum >/dev/null; then o2_sha256() { sha256sum "$@"; }
+else o2_sha256() { shasum -a 256 "$@"; }; fi
+if echo "$O2_INSTALLER_SHA256  $O2_INSTALLER_DIR/frameworks/setup.sh" | o2_sha256 -c -; then
+  REPO_RAW="$O2_INSTALLER_RAW" bash "$O2_INSTALLER_DIR/frameworks/setup.sh" \
+    --integration=<integration> \
+    --url="$(env_get OPENOBSERVE_URL)" \
+    --org=<org> \
+    --token="Bearer placeholder" \
+    --env-file="$O2_INSTALLER_DIR/.env" \
+    --quiet
+else
+  echo "setup.sh does not match the reviewed SHA-256; not running it" >&2
+fi
+```
+
+The SHA-256 is that of `ai/frameworks/setup.sh` at the pinned commit. Moving the pin to a newer
+reviewed commit means updating both lines: `O2_INSTALLER_RAW`, and `O2_INSTALLER_SHA256` from
+`gh api -H "Accept: application/vnd.github.raw"
+"repos/openobserve/o2-datasource/contents/ai/frameworks/setup.sh?ref=<commit>" | shasum -a 256`.
+
+`REPO_RAW` makes the installer fetch its helper library and integration list from the same
+commit. `<integration>` is one of `openai`, `anthropic`, `gemini`, `langchain`, `crewai`,
+`google-adk`, `claude-agent-sdk`, `openai-agents`, `openrouter`, `litellm`. If the project uses a
+virtualenv, uv, poetry or pipenv, install into that environment instead and add the packages to
+the project's dependency file. Packages and init lines per integration:
+
+| Integration | Packages (plus `openobserve-telemetry-sdk python-dotenv`) | Instrumentor |
+|---|---|---|
+| openai | `opentelemetry-instrumentation-openai` | `from opentelemetry.instrumentation.openai import OpenAIInstrumentor` |
+| anthropic | `opentelemetry-instrumentation-anthropic` | `from opentelemetry.instrumentation.anthropic import AnthropicInstrumentor` |
+| gemini | `opentelemetry-instrumentation-google-generativeai` | `from opentelemetry.instrumentation.google_generativeai import GoogleGenerativeAiInstrumentor` |
+| langchain | `opentelemetry-instrumentation-langchain` | `from opentelemetry.instrumentation.langchain import LangchainInstrumentor` |
+| crewai | `openinference-instrumentation-crewai` | `from openinference.instrumentation.crewai import CrewAIInstrumentor` (set `CREWAI_TELEMETRY_OPT_OUT=true`; call `openobserve_init()` first) |
+| google-adk | `openinference-instrumentation-google-adk` | `from openinference.instrumentation.google_adk import GoogleADKInstrumentor` |
+| openai-agents | `openinference-instrumentation-openai-agents` | `from openinference.instrumentation.openai_agents import OpenAIAgentsInstrumentor` |
+| openrouter | `openinference-instrumentation-openai` | `from openinference.instrumentation.openai import OpenAIInstrumentor` |
+| litellm | `openinference-instrumentation-litellm` | `from openinference.instrumentation.litellm import LiteLLMInstrumentor` |
+| claude-agent-sdk | — | wrap each `query()` in a span (see the snippet the installer saves, below) |
+
+The installer's env file holds the placeholder token; never copy its `OPENOBSERVE_*` lines.
+Merge only the integration's extra variables (for example `CREWAI_TELEMETRY_OPT_OUT`) into the
+project's `.env`, keep the snippet it saved (`paste_me_<integration>.py`) if you need it, then
+remove the temp directory:
+
+```bash
+python3 - "$O2_INSTALLER_DIR/.env" <<'PY'
+import sys
+def name(line):
+    return line.strip().removeprefix("export ").partition("=")[0].strip()
+text = open(".env").read()
+have = {name(l) for l in text.splitlines() if "=" in l}
+extra = [l.strip() for l in open(sys.argv[1])
+         if "=" in l and not l.lstrip().startswith("#")
+         and not name(l).startswith("OPENOBSERVE_") and name(l) not in have]
+if extra:
+    with open(".env", "a") as f:
+        f.write(("" if not text or text.endswith("\n") else "\n") + "\n".join(extra) + "\n")
+print("extra env:", ", ".join(name(x) for x in extra) or "none")
+PY
+cat "$O2_INSTALLER_DIR/paste_me_<integration>.py"
+rm -rf "$O2_INSTALLER_DIR"
+```
+
+Print `✓ setup.sh@9fdf2ca --integration=<integration>` and the extra env names (no values).
+
+### Anything else — plain OTLP/HTTP
+
+For other languages or SDKs without an instrumentor, use the standard OpenTelemetry SDK with the
+OTLP/HTTP exporter and an OpenInference or OpenTelemetry GenAI instrumentor where one exists:
+
+- Endpoint: `<OPENOBSERVE_URL>/api/<org>/v1/traces` (protobuf or JSON over HTTP).
+- Headers: `Authorization: <OPENOBSERVE_AUTH_TOKEN>` and `stream-name: <stream>`.
+- Environment form, read by every OpenTelemetry SDK:
+  `OTEL_EXPORTER_OTLP_TRACES_ENDPOINT=<url>/api/<org>/v1/traces`,
+  `OTEL_EXPORTER_OTLP_TRACES_HEADERS=Authorization=Basic%20<base64>,stream-name=<stream>`
+  (write these into `.env` from the existing values; do not print them).
+- If no instrumentor exists, wrap each LLM call in a span named `chat <model>` with
+  `gen_ai.operation.name=chat`, `gen_ai.provider.name`, `gen_ai.request.model`,
+  `gen_ai.response.model`, `gen_ai.usage.input_tokens` and `gen_ai.usage.output_tokens`.
+
+## 4. Edit the entry point
+
+Put the init lines at the very top of the entry point, **before** any import of the LLM client
+(instrumentors patch the client at import time). Python with the OpenAI SDK:
+
+```python
+import os
+import uuid
+from contextlib import contextmanager
+from typing import Optional  # Python 3.9: no `str | None`
+
+from dotenv import load_dotenv
+load_dotenv()  # openobserve_init() reads OPENOBSERVE_* from the environment
+
+from opentelemetry import baggage, context
+from opentelemetry.sdk.trace import SpanProcessor
+from opentelemetry.instrumentation.openai import OpenAIInstrumentor
+from openobserve import get_tracer_provider, openobserve_init
+
+AGENT_NAME = "research-agent"          # from step 2
+AGENT_VERSION = "1.4.0"                # from step 2 (read it at runtime when you can)
+
+
+class ConversationIdProcessor(SpanProcessor):
+    """Copy the request's conversation id onto every span started inside it."""
+
+    def on_start(self, span, parent_context=None):
+        conversation_id = baggage.get_baggage("gen_ai.conversation.id", parent_context)
+        if conversation_id:
+            span.set_attribute("gen_ai.conversation.id", str(conversation_id))
+
+
+OpenAIInstrumentor().instrument()
+openobserve_init(
+    agent_name=AGENT_NAME,
+    resource_attributes={
+        "service.name": AGENT_NAME,
+        "gen_ai.agent.name": AGENT_NAME,
+        "gen_ai.agent.version": AGENT_VERSION,
+    },
+)
+get_tracer_provider().add_span_processor(ConversationIdProcessor())
+
+
+@contextmanager
+def conversation(conversation_id: Optional[str] = None):
+    """Wrap one request / chat turn: `with conversation(session_id): ...`."""
+    token = context.attach(
+        baggage.set_baggage("gen_ai.conversation.id", conversation_id or str(uuid.uuid4()))
+    )
+    try:
+        yield
+    finally:
+        context.detach(token)
+
+
+from openai import OpenAI  # client imports come after the init lines
+```
+
+Then wrap the code that handles one request or conversation turn in `with conversation(<the app's
+session id>):`. These three attributes are what two of the data health checks look for:
+`gen_ai.agent.name` (missing agent identity), `gen_ai.agent.version`, and
+`gen_ai.conversation.id` (spans without session id). Short-lived scripts must exit normally (the
+SDK flushes at exit) or call `openobserve_flush()` before exiting.
+
+Print each edit, e.g.:
+
+```
+✓ OpenAIInstrumentor().instrument() and openobserve_init() above "from openai import"
+✓ gen_ai.agent.name = research-agent, version from pyproject.toml
+✓ gen_ai.conversation.id = the request's session id
+```
+
+## 5. Run one sample request
+
+Record the start time, then run the smallest real request the app supports (a CLI flag, a test
+script, or one HTTP call to the running server). Use the app's own credentials (`OPENAI_API_KEY`
+etc.); never ask for them in chat.
+
+```bash
+START=$(date +%s)
+python -m app.main --once "Summarize the EU AI Act disclosure rules"
+```
+
+If the app cannot make a real call (no API key), tell the user and stop; do not fake spans.
+`load_dotenv()` never overrides a variable that is already set, even to an empty string; if the
+app reports a missing key that `.env` has, `unset` the empty variable in the shell first.
+
+## 6. Verify: first trace and data health
+
+```bash
+python3 <skill dir>/scripts/verify.py --env-file .env --stream <stream> --since "$START" --service <agent name> --agent <agent name>
+```
+
+`--agent` scopes the data-health checks to this app; without it they cover every app on the stream.
+
+The script waits up to 120 s for GenAI spans (those with `gen_ai.operation.name`; HTTP or database
+spans alone do not count), prints the span count and the link to the first trace, then calls
+`GET <url>/api/<org>/gen_ai/data_health?stream_name=…&start_time=…&end_time=…&refresh=true&include_samples=true`
+and prints each check with the page that fixes it. Show its output to the user as is:
+
+```
+    ✓ 14 spans arrived in 6.2 s
+
+  First trace
+    https://<openobserve>/web/traces/trace-details?stream=default&trace_id=4e0c91d7…&from=…&to=…&org_identifier=default
+
+  Data health
+    ✓ Missing agent identity    0 of 14 spans
+    ✓ Spans without session id  0 of 14 spans
+    ✓ Zero-duration spans       0 of 14 spans
+    ✗ Unpriced models           acme-internal-llm · 3,420 tokens counted as $0
+                                Fix in LLM Model Pricing: https://<openobserve>/web/settings/model_pricing/gaps?stream=default&org_identifier=default
+
+  3 of 4 checks pass. Fix the items above, then run the checks again.
+  Exit code: 1 (data-health checks found an error).
+```
+
+Exit codes: `0` GenAI spans arrived and no check is in error, `1` a check is in error, `2`
+configuration problem, a server without the data health API (upgrade it), or no GenAI span before
+the timeout (every check covering 0 spans counts as
+none). On `2` with no GenAI spans: confirm the OpenAI/Anthropic instrumentor is installed, the init
+lines run before the client import, the process exits cleanly, and the stream name matches.
+
+What each failed check means and where to fix it:
+
+| Check | Fix |
+|---|---|
+| Missing agent identity | Set `gen_ai.agent.name` (step 4) or map an existing attribute in Settings → GenAI Agent Mapping |
+| Spans without session id | Wrap each request in `conversation(...)` (step 4) |
+| Zero-duration spans | Spans ended before the work did — usually a span closed before a streamed response was consumed. See the AI integration docs |
+| Unpriced models | Add the model's price in Settings → LLM Model Pricing (the link opens the unpriced list) |
+
+When the user fixes something and asks to check again, rerun only the checks:
+
+```bash
+python3 <skill dir>/scripts/verify.py --env-file .env --stream <stream> --since "$START" --agent <agent name> --health-only
+```
+
+## 7. Report
+
+End with: the files you changed, the first trace link, the health summary line, and the fixes left
+for the user.
diff --git a/skills/openobserve-instrument/scripts/verify.py b/skills/openobserve-instrument/scripts/verify.py
new file mode 100755
index 0000000000..a1fbdee8c6
--- /dev/null
+++ b/skills/openobserve-instrument/scripts/verify.py
@@ -0,0 +1,338 @@
+#!/usr/bin/env python3
+# Copyright 2026 OpenObserve Inc.
+# SPDX-License-Identifier: AGPL-3.0-or-later
+"""Wait for an instrumented app's first GenAI spans in OpenObserve, print the
+first trace link, then run the OpenObserve AI data health checks.
+
+Only spans with gen_ai.operation.name count: HTTP or database spans alone mean
+the LLM client is not instrumented.
+
+Python 3 standard library only. Credentials come from the project's .env (or
+the process environment); the script prints variable names, never values.
+
+Exit codes:
+  0  GenAI spans arrived and no health check is in error
+  1  GenAI spans arrived but at least one health check is in error
+  2  configuration problem, no GenAI span arrived before the timeout, or the server
+     has no data health API (upgrade OpenObserve)
+"""
+
+import argparse
+import json
+import os
+import sys
+import time
+import urllib.error
+import urllib.parse
+import urllib.request
+
+REQUIRED_VARS = ("OPENOBSERVE_URL", "OPENOBSERVE_ORG", "OPENOBSERVE_AUTH_TOKEN")
+STREAM_VARS = ("OPENOBSERVE_TRACES_STREAM_NAME", "OPENOBSERVE_STREAM")
+DOCS_URL = "https://openobserve.ai/docs/integration/ai/"
+
+CHECK_ORDER = (
+    "missing_agent_identity",
+    "missing_session_id",
+    "zero_duration_spans",
+    "unpriced_models",
+)
+CHECK_LABELS = {
+    "missing_agent_identity": "Missing agent identity",
+    "missing_session_id": "Spans without session id",
+    "zero_duration_spans": "Zero-duration spans",
+    "unpriced_models": "Unpriced models",
+}
+STATUS_MARKS = {"pass": "✓", "warning": "!", "error": "✗"}
+
+
+def parse_env_file(path):
+    """Parse KEY=VALUE lines (optional `export`, quotes and comments)."""
+    values = {}
+    with open(path, encoding="utf-8") as fh:
+        for raw_line in fh:
+            line = raw_line.strip()
+            if not line or line.startswith("#") or "=" not in line:
+                continue
+            if line.startswith("export "):
+                line = line[len("export ") :].lstrip()
+            key, _, value = line.partition("=")
+            key = key.strip()
+            value = value.strip()
+            if len(value) >= 2 and value[0] == value[-1] and value[0] in ("'", '"'):
+                value = value[1:-1]
+            elif " #" in value:
+                value = value.split(" #", 1)[0].rstrip()
+            values[key] = value
+    return values
+
+
+def load_config(env_file):
+    file_values = {}
+    if os.path.isfile(env_file):
+        file_values = parse_env_file(env_file)
+        found = [k for k in REQUIRED_VARS + STREAM_VARS + ("OPENOBSERVE_UI_URL",) if k in file_values]
+        print(f"  .env found ({env_file}): {', '.join(found) if found else 'no OPENOBSERVE_* variables'}")
+    else:
+        print(f"  No .env at {env_file}; using the process environment")
+
+    def get(name):
+        return os.environ.get(name) or file_values.get(name) or ""
+
+    missing = [name for name in REQUIRED_VARS if not get(name)]
+    if missing:
+        print(f"✗ Missing {', '.join(missing)}. Download the .env from the AI integration card.")
+        sys.exit(2)
+    return get
+
+
+def auth_header(token):
+    token = token.strip()
+    if token.split(" ", 1)[0] in ("Basic", "Bearer"):
+        return token
+    return f"Basic {token}"
+
+
+class Client:
+    def __init__(self, base_url, org, token):
+        self.base_url = base_url.rstrip("/")
+        self.org = org
+        self.auth = auth_header(token)
+
+    def request(self, method, path, query=None, body=None):
+        url = f"{self.base_url}/api/{urllib.parse.quote(self.org, safe='')}/{path}"
+        if query:
+            url += "?" + urllib.parse.urlencode(query)
+        data = json.dumps(body).encode("utf-8") if body is not None else None
+        req = urllib.request.Request(url, data=data, method=method)
+        req.add_header("Authorization", self.auth)
+        req.add_header("Accept", "application/json")
+        if data is not None:
+            req.add_header("Content-Type", "application/json")
+        with urllib.request.urlopen(req, timeout=30) as resp:
+            return json.loads(resp.read().decode("utf-8") or "{}")
+
+    def search_traces(self, sql, start_us, end_us, size):
+        body = {
+            "query": {
+                "sql": sql,
+                "start_time": start_us,
+                "end_time": end_us,
+                "from": 0,
+                "size": size,
+            }
+        }
+        return self.request("POST", "_search", {"type": "traces"}, body).get("hits", [])
+
+
+def sql_string(value):
+    return "'" + value.replace("'", "''") + "'"
+
+
+def first_trace(client, stream, service, start_us, end_us):
+    """Return (span_count, first_trace_id) for GenAI spans in the window, or (0, None)."""
+    where = " WHERE gen_ai_operation_name IS NOT NULL"
+    if service:
+        where += f" AND service_name = {sql_string(service)}"
+    table = '"' + stream.replace('"', '""') + '"'
+    count_hits = client.search_traces(
+        f"SELECT count(*) AS spans FROM {table}{where}", start_us, end_us, 1
+    )
+    spans = int(count_hits[0].get("spans", 0)) if count_hits else 0
+    if spans == 0:
+        return 0, None
+    trace_hits = client.search_traces(
+        f"SELECT trace_id, min(_timestamp) AS first_ts FROM {table}{where} "
+        "GROUP BY trace_id ORDER BY first_ts ASC LIMIT 1",
+        start_us,
+        end_us,
+        1,
+    )
+    return spans, (trace_hits[0].get("trace_id") if trace_hits else None)
+
+
+def wait_for_spans(client, stream, service, start_us, timeout_s):
+    started = time.monotonic()
+    last_error = None
+    while True:
+        end_us = int(time.time() * 1_000_000)
+        try:
+            spans, trace_id = first_trace(client, stream, service, start_us, end_us)
+            if spans and trace_id:
+                return spans, trace_id, time.monotonic() - started
+        except urllib.error.HTTPError as err:
+            # 401/403 never heal; anything else (e.g. the stream does not exist yet) may.
+            if err.code in (401, 403):
+                print(f"✗ OpenObserve rejected the credentials (HTTP {err.code}). Check OPENOBSERVE_AUTH_TOKEN.")
+                sys.exit(2)
+            last_error = f"HTTP {err.code}"
+        except urllib.error.URLError as err:
+            last_error = str(err.reason)
+        if time.monotonic() - started >= timeout_s:
+            reason = f" (last error: {last_error})" if last_error else ""
+            print(f"✗ No GenAI spans on stream '{stream}' after {timeout_s:.0f} s{reason}.")
+            print("  Only spans with gen_ai.operation.name count. Check that the OpenAI/Anthropic")
+            print("  instrumentor is installed, that the init lines run before the LLM client is")
+            print("  imported, and that the process exits cleanly or calls openobserve_flush().")
+            sys.exit(2)
+        time.sleep(3)
+
+
+def trace_url(ui_url, org, stream, trace_id, start_us, end_us):
+    query = urllib.parse.urlencode(
+        {
+            "stream": stream,
+            "trace_id": trace_id,
+            "from": start_us,
+            "to": end_us,
+            "org_identifier": org,
+        }
+    )
+    return f"{ui_url}/web/traces/trace-details?{query}"
+
+
+def fix_link(check_id, ui_url, org, stream):
+    org_q = urllib.parse.quote(org, safe="")
+    if check_id == "unpriced_models":
+        stream_q = urllib.parse.quote(stream, safe="")
+        return (
+            "Fix in LLM Model Pricing",
+            f"{ui_url}/web/settings/model_pricing/gaps?stream={stream_q}&org_identifier={org_q}",
+        )
+    if check_id == "missing_agent_identity":
+        return (
+            "Fix in GenAI Agent Mapping",
+            f"{ui_url}/web/settings/gen_ai_agent_mapping?org_identifier={org_q}",
+        )
+    return ("See", DOCS_URL)
+
+
+def describe(check):
+    check_id = check.get("id", "")
+    affected = int(check.get("affected", 0))
+    total = int(check.get("total", 0))
+    if check_id == "unpriced_models" and check.get("models"):
+        parts = [
+            f"{m.get('model') or '(no model name)'} · {int(m.get('tokens', 0)):,} tokens counted as $0"
+            for m in check["models"]
+        ]
+        if check.get("models_truncated"):
+            # The server lists the models with the most tokens; the totals cover all of them.
+            parts.append(
+                f"top {len(check['models'])} of {int(check.get('model_count', 0)):,} models, "
+                f"{int(check.get('unpriced_tokens', 0)):,} tokens in all"
+            )
+        return ", ".join(parts)
+    return f"{affected:,} of {plural(total, 'span')}"
+
+
+def plural(count, noun):
+    return f"{count:,} {noun}" + ("" if count == 1 else "s")
+
+
+def run_health(client, ui_url, org, stream, start_us, end_us, agent):
+    query = {
+        "stream_name": stream,
+        "start_time": start_us,
+        "end_time": end_us,
+        "refresh": "true",
+        # The script prints a sample trace per failing check.
+        "include_samples": "true",
+    }
+    if agent:
+        query["agent"] = agent
+    try:
+        result = client.request("GET", "gen_ai/data_health", query)
+    except urllib.error.HTTPError as err:
+        if err.code == 404:
+            print("✗ This OpenObserve server has no AI data health API yet; upgrade it to run the checks.")
+            return 2
+        print(f"✗ Data health request failed (HTTP {err.code}).")
+        return 2
+    except urllib.error.URLError as err:
+        print(f"✗ Data health request failed ({err.reason}).")
+        return 2
+
+    checks = {c.get("id"): c for c in result.get("checks", [])}
+    if not any(int(c.get("total", 0)) for c in checks.values()):
+        scope = f" for agent '{agent}'" if agent else ""
+        print(f"✗ No GenAI spans on stream '{stream}'{scope} in this window: every check covered 0 spans.")
+        if agent:
+            print("  Check the agent name and time window, or omit --agent to inspect the whole stream.")
+        else:
+            print("  No span carries gen_ai.operation.name, so the LLM client is not instrumented.")
+            print(f"  Install the OpenAI/Anthropic instrumentor: {DOCS_URL}")
+        return 2
+    ordered = [checks[i] for i in CHECK_ORDER if i in checks]
+    ordered += [c for i, c in checks.items() if i not in CHECK_ORDER]
+    width = max(len(CHECK_LABELS.get(c.get("id"), c.get("id", ""))) for c in ordered) if ordered else 0
+    passed = 0
+    has_error = False
+    for check in ordered:
+        check_id = check.get("id", "")
+        status = check.get("status", "pass")
+        label = CHECK_LABELS.get(check_id, check_id)
+        print(f"    {STATUS_MARKS.get(status, '?')} {label.ljust(width)}  {describe(check)}")
+        if status == "pass":
+            passed += 1
+            continue
+        has_error = has_error or status == "error"
+        text, link = fix_link(check_id, ui_url, org, stream)
+        print(f"      {' ' * width}  {text}: {link}")
+        samples = check.get("samples") or []
+        if samples:
+            print(f"      {' ' * width}  Sample trace: {trace_url(ui_url, org, stream, samples[0], start_us, end_us)}")
+
+    print()
+    if passed == len(ordered):
+        print(f"  All {len(ordered)} checks pass.")
+    else:
+        print(f"  {passed} of {len(ordered)} checks pass. Fix the items above, then run the checks again.")
+    return 1 if has_error else 0
+
+
+def main():
+    parser = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
+    parser.add_argument("--env-file", default=".env", help="path to the project .env (default: ./.env)")
+    parser.add_argument("--stream", help="traces stream (default: OPENOBSERVE_TRACES_STREAM_NAME, OPENOBSERVE_STREAM, then 'default')")
+    parser.add_argument("--since", type=float, help="Unix seconds the sample run started (default: 15 minutes ago)")
+    parser.add_argument("--timeout", type=float, default=120, help="seconds to wait for spans (default: 120)")
+    parser.add_argument("--service", help="only count spans whose service.name is this value")
+    parser.add_argument("--agent", help="scope the health checks to this agent name")
+    parser.add_argument("--ui-url", help="OpenObserve web URL when it differs from OPENOBSERVE_URL (or set OPENOBSERVE_UI_URL)")
+    parser.add_argument("--health-only", action="store_true", help="skip waiting for spans and rerun the health checks")
+    args = parser.parse_args()
+
+    get = load_config(args.env_file)
+    base_url = get("OPENOBSERVE_URL").rstrip("/")
+    org = get("OPENOBSERVE_ORG")
+    stream = args.stream or next((get(v) for v in STREAM_VARS if get(v)), "") or "default"
+    ui_url = (args.ui_url or get("OPENOBSERVE_UI_URL") or base_url).rstrip("/")
+    client = Client(base_url, org, get("OPENOBSERVE_AUTH_TOKEN"))
+
+    since = args.since if args.since is not None else time.time() - 15 * 60
+    # One minute of slack covers clock skew between this machine and the server.
+    start_us = int((since - 60) * 1_000_000)
+    print(f"  Org {org} · stream {stream}")
+
+    if not args.health_only:
+        print(f"  Waiting for GenAI spans on '{stream}' (up to {args.timeout:.0f} s)…")
+        spans, trace_id, elapsed = wait_for_spans(client, stream, args.service, start_us, args.timeout)
+        # Give the exporter's trailing batch a moment, then recount so the
+        # printed total and the checks cover the whole run.
+        time.sleep(3)
+        end_us = int((time.time() + 60) * 1_000_000)
+        spans = first_trace(client, stream, args.service, start_us, end_us)[0] or spans
+        print(f"    ✓ {plural(spans, 'span')} arrived in {elapsed:.1f} s")
+        print()
+        print("  First trace")
+        print(f"    {trace_url(ui_url, org, stream, trace_id, start_us, end_us)}")
+        print()
+    else:
+        end_us = int((time.time() + 60) * 1_000_000)
+
+    print("  Data health")
+    return run_health(client, ui_url, org, stream, start_us, end_us, args.agent)
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/src/api/common/src/auth/delegation.rs b/src/api/common/src/auth/delegation.rs
index ce89ce4a0f..66d24af3c4 100644
--- a/src/api/common/src/auth/delegation.rs
+++ b/src/api/common/src/auth/delegation.rs
@@ -150,6 +150,7 @@ const ASSISTANT_SCOPE: &[ScopeRoute] = &[
     v1(&[Param, Lit("oncall"), Lit("incidents"), Param, Lit("responses")], GET),
     v1(&[Param, Lit("oncall"), Lit("responses"), Param, Lit("acknowledge")], POST),
     v1(&[Param, Lit("oncall"), Lit("responses"), Param, Lit("snooze")], POST),
+    v1(&[Param, Lit("oncall"), Lit("responses"), Param, Lit("unsnooze")], POST),
     v1(&[Param, Lit("oncall"), Lit("responses"), Param, Lit("resolve")], POST),
     v1(&[Param, Lit("ai"), Lit("chat")], POST),
     v1(&[Param, Lit("ai"), Lit("chat_stream")], POST),
@@ -708,6 +709,7 @@ mod tests {
         );
         for reason in [
             DisabledReason::Edition,
+            DisabledReason::License,
             DisabledReason::Flag,
             DisabledReason::MasterKey,
             DisabledReason::SuperCluster,
@@ -715,6 +717,7 @@ mod tests {
             // A new reason must join this list: the match stops compiling until it does.
             match reason {
                 DisabledReason::Edition
+                | DisabledReason::License
                 | DisabledReason::Flag
                 | DisabledReason::MasterKey
                 | DisabledReason::SuperCluster => {}
@@ -1001,6 +1004,7 @@ mod tests {
             (Method::GET, "acme/oncall/teams/t1/on-call"),
             (Method::POST, "acme/oncall/responses/r1/acknowledge"),
             (Method::POST, "acme/oncall/responses/r1/snooze"),
+            (Method::POST, "acme/oncall/responses/r1/unsnooze"),
             (Method::POST, "acme/oncall/responses/r1/resolve"),
             (Method::POST, "acme/ai/chat_stream"),
             (Method::POST, "acme/ai/confirm/s1"),
diff --git a/src/api/common/src/auth/validator.rs b/src/api/common/src/auth/validator.rs
index ba27148a08..68ec812aa6 100644
--- a/src/api/common/src/auth/validator.rs
+++ b/src/api/common/src/auth/validator.rs
@@ -1539,6 +1539,7 @@ CN5lTowpVXP2OIiiNTGa75Fj
             use_all_org: false,
             use_self_context: false,
             use_self_parent: false,
+            feature: None,
         };
 
         let result = oo_validator(&req_data, &auth_info).await;
@@ -1627,6 +1628,7 @@ CN5lTowpVXP2OIiiNTGa75Fj
             use_all_org: false,
             use_self_context: false,
             use_self_parent: false,
+            feature: None,
         };
 
         let result = oo_validator(&req_data, &auth_info).await;
@@ -2155,6 +2157,7 @@ CN5lTowpVXP2OIiiNTGa75Fj
             use_all_org: false,
             use_self_context: false,
             use_self_parent: false,
+            feature: None,
         };
         assert!(
             oo_validator(&req_data, &plain).await.is_err(),
diff --git a/src/api/http/src/handler/http/router/mod.rs b/src/api/http/src/handler/http/router/mod.rs
index b2aa1fc96e..a9eaabdf97 100644
--- a/src/api/http/src/handler/http/router/mod.rs
+++ b/src/api/http/src/handler/http/router/mod.rs
@@ -23,7 +23,7 @@ use axum::{
     response::{IntoResponse, Redirect, Response},
     routing::{delete, get, patch, post, put},
 };
-use config::get_config;
+use config::{get_config, meta::feature::Feature};
 use openobserve_api_common::{X_O2_ASSISTANT_SESSION_ID, X_O2_ASSISTANT_TURN_ID};
 use openobserve_api_ingest::request::{clusters, logs, metrics, profiles, rum};
 #[cfg(feature = "cloud")]
@@ -31,10 +31,10 @@ use openobserve_api_management::request::org_domains;
 #[cfg(feature = "cpu-profiling")]
 use openobserve_api_management::request::profiling;
 use openobserve_api_management::request::{
-    alerts, announcements, authz, dashboards, db_monitoring, downtimes, folders, ingest_rejections,
-    kv, metrics_usage, model_pricing, organization, public_dashboards, query_history,
-    rum_analytics, service_accounts, short_url, slack, slos, sourcemaps, status, status_pages,
-    stream, synthetics, users,
+    alerts, announcements, authz, dashboards, db_monitoring, downtimes, folders, gen_ai_health,
+    ingest_rejections, kv, metrics_usage, model_pricing, organization, public_dashboards,
+    query_history, rum_analytics, service_accounts, short_url, slack, slos, sourcemaps, status,
+    status_pages, stream, synthetics, users,
 };
 #[cfg(feature = "cloud")]
 use openobserve_api_management::request::{cloud, organization::billing_group};
@@ -53,13 +53,15 @@ use utoipa_swagger_ui::SwaggerUi;
 use {
     audit::audit,
     axum::body::{Body, to_bytes},
+    common::meta::http::HttpResponse as MetaHttpResponse,
     config::utils::time::now_micros,
     o2_enterprise::enterprise::{
         common::{
-            auditor::{AuditMessage, DelegatedAudit, Protocol, ResponseMeta},
+            auditor::{AuditMessage, AuditTarget, DelegatedAudit, Protocol, ResponseMeta},
             config::get_config as get_o2_config,
         },
         fleet::opamp,
+        license::check_features,
     },
     openobserve_api_common::auth::delegation::DelegatedCaller,
     openobserve_api_management::request::{
@@ -298,6 +300,32 @@ async fn validate_routed_org(parts: &mut Parts) -> Result<(), AuthError> {
     Ok(())
 }
 
+/// 403 naming the required features the license does not entitle.
+#[cfg(feature = "enterprise")]
+fn license_denial(required: &[Feature]) -> Option<Response> {
+    if check_features(required) {
+        return None;
+    }
+    let missing: Vec<&str> = required
+        .iter()
+        .filter(|f| !check_features(std::slice::from_ref(f)))
+        .map(|f| (*f).into())
+        .collect();
+    let err = infra::errors::ErrorCodes::LicenseFeatureNotEntitled(missing.join(", "));
+    Some(
+        (
+            StatusCode::FORBIDDEN,
+            axum::Json(MetaHttpResponse::error_code(err)),
+        )
+            .into_response(),
+    )
+}
+
+#[cfg(not(feature = "enterprise"))]
+fn license_denial(_required: &[Feature]) -> Option<Response> {
+    None
+}
+
 /// Authentication middleware for API routes.
 ///
 /// Pair it with `password_policy_middleware` layered inside it on every router that uses it: this
@@ -324,36 +352,53 @@ pub async fn auth_middleware(request: Request, next: Next) -> Response {
     };
 
     // Validate authentication using extracted data
-    match oo_validator(&req_data, &auth_info).await {
-        Ok(result) => {
-            // Insert user_id into request headers for downstream handlers
-            parts.headers.insert(
-                header::HeaderName::from_static("user_id"),
-                header::HeaderValue::from_str(&result.user_email)
-                    .unwrap_or_else(|_| header::HeaderValue::from_static("")),
-            );
+    let result = match oo_validator(&req_data, &auth_info).await {
+        Ok(result) => result,
+        Err(e) => return maybe_add_mcp_www_authenticate(&uri, e.into_response()),
+    };
 
-            // Handle Prometheus POST hack - add content-type if missing
-            if parts.method.eq(&Method::POST) && !parts.headers.contains_key(header::CONTENT_TYPE) {
-                parts.headers.insert(
-                    header::CONTENT_TYPE,
-                    header::HeaderValue::from_static("application/x-www-form-urlencoded"),
-                );
-            }
+    // Outside oo_validator so the license gate holds with OpenFGA off and on bypass routes.
+    if let Some(denied) = auth_info.feature.and_then(license_denial) {
+        return denied;
+    }
 
-            if let Some(caller) = result.delegation {
-                parts.extensions.insert(caller);
-            }
+    // Insert user_id into request headers for downstream handlers
+    parts.headers.insert(
+        header::HeaderName::from_static("user_id"),
+        header::HeaderValue::from_str(&result.user_email)
+            .unwrap_or_else(|_| header::HeaderValue::from_static("")),
+    );
 
-            let mut response = next.run(Request::from_parts(parts, body)).await;
-            if let Some(token_name) = result.token_name {
-                response.extensions_mut().insert(
-                    openobserve_core::ingestion::rejections::RejectionTokenName(token_name),
-                );
-            }
-            response
-        }
-        Err(e) => maybe_add_mcp_www_authenticate(&uri, e.into_response()),
+    // Handle Prometheus POST hack - add content-type if missing
+    if parts.method.eq(&Method::POST) && !parts.headers.contains_key(header::CONTENT_TYPE) {
+        parts.headers.insert(
+            header::CONTENT_TYPE,
+            header::HeaderValue::from_static("application/x-www-form-urlencoded"),
+        );
+    }
+
+    if let Some(caller) = result.delegation {
+        parts.extensions.insert(caller);
+    }
+
+    let mut response = next.run(Request::from_parts(parts, body)).await;
+    if let Some(token_name) = result.token_name {
+        response.extensions_mut().insert(
+            openobserve_core::ingestion::rejections::RejectionTokenName(token_name),
+        );
+    }
+    response
+}
+
+/// License gate for routes that authenticate outside `auth_middleware`; layer it inside the auth.
+pub async fn require_features(
+    required: &'static [Feature],
+    request: Request,
+    next: Next,
+) -> Response {
+    match license_denial(required) {
+        Some(denied) => denied,
+        None => next.run(request).await,
     }
 }
 
@@ -464,6 +509,10 @@ fn is_secret_write(method: &Method, path: &str) -> bool {
     if method == Method::PUT && segments.ends_with(&["prompts", "settings", "secret"]) {
         return true;
     }
+    // Sample data for an endpoint test is often a pasted real call, credentials included.
+    if method == Method::POST && segments.ends_with(&["http_trigger", "test"]) {
+        return true;
+    }
     if let Some(slack) = slack_path(&segments) {
         return is_slack_secret_write(method, slack);
     }
@@ -726,6 +775,7 @@ pub async fn audit_middleware(request: Request, next: Next) -> Response {
 
         // ERROR_HEADER is an internal detail channel for the auditor and must never reach a client.
         response.headers_mut().remove(ERROR_HEADER);
+        let named = response.extensions_mut().remove::<AuditTarget>();
 
         if response.status().is_success() || response.status().is_redirection() {
             let slack_chat = delegated_chat_audit_body(
@@ -759,6 +809,8 @@ pub async fn audit_middleware(request: Request, next: Next) -> Response {
                     trace_id: None,
                 },
                 delegated,
+                fleet_id: named.as_ref().and_then(|n| n.fleet_id.clone()),
+                target: named.map(|n| n.target),
             })
             .await;
             if fleet_mutation(&http_method, &path) {
@@ -947,9 +999,7 @@ pub fn basic_routes() -> Router {
     // Auth routes (no authentication required)
     let auth_routes = Router::new()
         .route("/login", post(users::authentication).get(users::get_auth))
-        .route("/presigned-url", get(users::get_presigned_url))
-        .route("/invites", get(users::list_invitations))
-        .route("/invites/{token}", delete(users::decline_invitation));
+        .route("/presigned-url", get(users::get_presigned_url));
     router = router.nest("/auth", auth_routes);
 
     let node_routes = node_routes()
@@ -992,17 +1042,24 @@ pub fn basic_routes() -> Router {
     );
 
     // Static `/api/v2`: a param beside the router's `/api/{*path}` panics axum at startup.
+    // Registered on the operator's flag, not the license's, so a new license needs no restart.
     #[cfg(feature = "enterprise")]
     if get_o2_config().oncall.enabled {
         // Unauthenticated HMAC link; GET only renders, so a gateway prefetch cannot ack a page.
         router = router.route(
             "/api/v2/{org_id}/oncall/ack",
-            get(oncall::ack_page).post(oncall::acknowledge),
+            get(oncall::ack_page)
+                .post(oncall::acknowledge)
+                .route_layer(middleware::from_fn(|req, next| {
+                    require_features(&[Feature::Oncall], req, next)
+                })),
         );
         // Unauthenticated like the email link: the signed token in the path is the credential.
         router = router.route(
             "/api/v2/{org_id}/oncall/ack/voice/{token}",
-            post(oncall::voice_ack),
+            post(oncall::voice_ack).route_layer(middleware::from_fn(|req, next| {
+                require_features(&[Feature::Oncall], req, next)
+            })),
         );
     }
 
@@ -1013,16 +1070,28 @@ pub fn basic_routes() -> Router {
     router = router
         .route(
             "/api/v2/{org_id}/incidents/events",
-            post(alerts::external_events::ingest_events),
+            post(alerts::external_events::ingest_events).route_layer(middleware::from_fn(
+                |req, next| require_features(&[Feature::Incidents], req, next),
+            )),
         )
         .route(
             "/api/v2/{org_id}/incidents/events/{token}",
-            post(alerts::external_events::ingest_events_url_token),
+            post(alerts::external_events::ingest_events_url_token).route_layer(
+                middleware::from_fn(|req, next| require_features(&[Feature::Incidents], req, next)),
+            ),
         )
         .route_layer(DefaultBodyLimit::max(
             alerts::external_events::MAX_BODY_BYTES,
         ));
 
+    // Merged after the route_layer above, so the incident body limit does not wrap these routes.
+    #[cfg(feature = "enterprise")]
+    if get_o2_config().common.workflows_enabled
+        && openobserve_core::workflows::http_trigger::hooks_enabled()
+    {
+        router = router.merge(workflow_hook_routes());
+    }
+
     // Slack signs these requests; ENT verifies the signature, so they stay out of auth_middleware.
     router = router
         .route(
@@ -1046,7 +1115,7 @@ pub fn basic_routes() -> Router {
     // handlers are pure meta-store point-reads (no search, storage, or
     // cross-node calls on this plane).
     if get_config().synthetics.enabled {
-        router = router
+        let public = Router::new()
             .route(
                 "/api/status_pages_public/{slug}",
                 get(status_pages::public::snapshot),
@@ -1065,12 +1134,16 @@ pub fn basic_routes() -> Router {
                 "/api/status_pages_public/{slug}/feed.xml",
                 get(status_pages::public::feed),
             )
-            .route("/status/{slug}", get(status_pages::public::page));
+            .route("/status/{slug}", get(status_pages::public::page))
+            .route_layer(middleware::from_fn(|req, next| {
+                require_features(&[Feature::Synthetics], req, next)
+            }));
+        router = router.merge(public);
     }
 
     // Not on routers: they have no result files, so these paths fall to the slug-keyed proxy.
     if !config::cluster::LOCAL_NODE.is_router() {
-        router = router
+        let public = Router::new()
             .route(
                 "/api/public_dashboards/{slug}",
                 get(public_dashboards::public::config),
@@ -1078,7 +1151,11 @@ pub fn basic_routes() -> Router {
             .route(
                 "/api/public_dashboards/{slug}/data",
                 get(public_dashboards::public::data),
-            );
+            )
+            .route_layer(middleware::from_fn(|req, next| {
+                require_features(&[Feature::Dashboards], req, next)
+            }));
+        router = router.merge(public);
     }
 
     // Unauthenticated like status pages: the share token is checked in the handler.
@@ -1086,13 +1163,34 @@ pub fn basic_routes() -> Router {
     if get_config().public_ai_chat.enabled {
         router = router.route(
             "/api/public/ai_chats/{token}",
-            get(openobserve_api_management::request::ai::shares::get_public),
+            get(openobserve_api_management::request::ai::shares::get_public).route_layer(
+                middleware::from_fn(|req, next| {
+                    require_features(&[Feature::AiAssistant], req, next)
+                }),
+            ),
         );
     }
 
     router
 }
 
+/// Public workflow hooks; the handler reads the body itself, this limit is only defence in depth.
+#[cfg(feature = "enterprise")]
+fn workflow_hook_routes() -> Router {
+    Router::new()
+        .route(
+            "/api/v2/{org_id}/workflows/hooks/{trigger_id}",
+            post(workflows::hooks::invoke),
+        )
+        .route(
+            "/api/v2/{org_id}/workflows/hooks/{trigger_id}/runs/{run_id}",
+            get(workflows::hooks::run_status),
+        )
+        .layer(DefaultBodyLimit::max(
+            openobserve_core::workflows::http_trigger::HARD_BODY_CAP,
+        ))
+}
+
 /// Create config routes. `/` is served WITHOUT auth (the login page bootstraps
 /// from it), so it must expose only [`status::zo_config_bootstrap`]'s minimal
 /// payload — the full config lives at the authenticated `/api/{org_id}/config`.
@@ -1346,6 +1444,9 @@ pub fn service_routes() -> Router {
         // NOTE: named routes MUST be registered before {model_id} or they match as a model ID
         .route("/{org_id}/llm/models/built-in", get(model_pricing::get_built_in))
         .route("/{org_id}/llm/models/refresh-built-in", post(model_pricing::refresh_built_in))
+        .route("/{org_id}/llm/models/unpriced", get(model_pricing::list_unpriced))
+        // AI data health checks (LLM Insights strip, instrument skill)
+        .route("/{org_id}/gen_ai/data_health", get(gen_ai_health::get_data_health))
         .route("/{org_id}/llm/models/test", post(model_pricing::test_model_match))
         .route("/{org_id}/llm/models/{model_id}", get(model_pricing::get).put(model_pricing::update).delete(model_pricing::delete))
 
@@ -1924,6 +2025,31 @@ pub fn service_routes() -> Router {
                     "/{org_id}/workflows/promote/{id}",
                     post(workflows::promote_draft),
                 );
+            if openobserve_core::workflows::http_trigger::hooks_enabled() {
+                router = router
+                    .route(
+                        "/{org_id}/workflows/{id}/http_trigger",
+                        get(workflows::http_trigger::get_http_trigger)
+                            .put(workflows::http_trigger::put_http_trigger)
+                            .delete(workflows::http_trigger::delete_http_trigger),
+                    )
+                    .route(
+                        "/{org_id}/workflows/{id}/http_trigger/credentials",
+                        post(workflows::http_trigger::rotate_http_credential),
+                    )
+                    .route(
+                        "/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}",
+                        delete(workflows::http_trigger::revoke_http_credential),
+                    )
+                    .route(
+                        "/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}/secret",
+                        get(workflows::http_trigger::reveal_http_credential_secret),
+                    )
+                    .route(
+                        "/{org_id}/workflows/{id}/http_trigger/test",
+                        post(workflows::http_trigger::test_http_trigger),
+                    );
+            }
         }
     }
 
@@ -2413,6 +2539,10 @@ fn oncall_routes(router: Router) -> Router {
             "/{org_id}/oncall/responses/{response_id}/snooze",
             post(oncall::snooze_response),
         )
+        .route(
+            "/{org_id}/oncall/responses/{response_id}/unsnooze",
+            post(oncall::unsnooze_response),
+        )
         .route(
             "/{org_id}/oncall/responses/{response_id}/handoff",
             post(oncall::handoff_response),
@@ -2680,6 +2810,9 @@ pub fn other_service_routes() -> Router {
             post(logs::ingest::handle_kinesis_request),
         )
         .route_layer(middleware::from_fn(blocked_org_param))
+        .layer(middleware::from_fn(|req, next| {
+            require_features(&[Feature::Logs], req, next)
+        }))
         .layer(middleware::from_fn(aws_auth_middleware))
         .layer(RequestDecompressionLayer::new());
 
@@ -2689,6 +2822,9 @@ pub fn other_service_routes() -> Router {
             post(logs::ingest::handle_gcp_request),
         )
         .route_layer(middleware::from_fn(blocked_org_param))
+        .layer(middleware::from_fn(|req, next| {
+            require_features(&[Feature::Logs], req, next)
+        }))
         .layer(middleware::from_fn(gcp_auth_middleware))
         .layer(RequestDecompressionLayer::new());
 
@@ -2697,6 +2833,9 @@ pub fn other_service_routes() -> Router {
         .route("/v1/{org_id}/replay", post(rum::ingest::sessionreplay))
         .route("/v1/{org_id}/rum", post(rum::ingest::data))
         .route_layer(middleware::from_fn(blocked_org_param))
+        .layer(middleware::from_fn(|req, next| {
+            require_features(&[Feature::Rum], req, next)
+        }))
         .layer(middleware::from_fn(RumExtraData::extractor_middleware))
         .layer(middleware::from_fn(rum_auth_middleware))
         .layer(RequestDecompressionLayer::new());
@@ -2723,6 +2862,9 @@ pub fn splunk_collector_routes() -> Router {
     // rather than both leaking as 401.
     let event_handler = || {
         post(hec_collector::collector_event)
+            .route_layer(middleware::from_fn(|req, next| {
+                require_features(&[Feature::Logs], req, next)
+            }))
             .route_layer(middleware::from_fn(hec_collector::splunk_auth_middleware))
             .fallback(hec_collector::collector_method_not_allowed)
     };
@@ -3096,6 +3238,27 @@ mod tests {
         }
     }
 
+    #[test]
+    fn workflow_endpoint_test_bodies_are_redacted() {
+        for path in [
+            "org/workflows/wf1/http_trigger/test",
+            "api/org/workflows/wf1/http_trigger/test",
+        ] {
+            assert!(is_secret_write(&Method::POST, path), "{path}");
+            assert_eq!(
+                audited(Method::POST, path, r#"{"data":[{"password":"p"}]}"#),
+                "[REDACTED: secret write]"
+            );
+        }
+        for (method, path) in [
+            (Method::PUT, "org/workflows/wf1/http_trigger"),
+            (Method::POST, "org/workflows/wf1/http_trigger/credentials"),
+            (Method::POST, "org/workflows/test"),
+        ] {
+            assert!(!is_secret_write(&method, path), "{method} {path}");
+        }
+    }
+
     #[test]
     fn slack_secret_writes_are_redacted() {
         for (method, path) in [
@@ -3734,6 +3897,71 @@ mod tests {
         );
     }
 
+    // Refused before any lookup, so a 400 proves the hook handler owns the path without a DB.
+    #[cfg(feature = "enterprise")]
+    fn credential_in_url_probe() -> Request<Body> {
+        Request::builder()
+            .method(Method::POST)
+            .uri("/api/v2/o/workflows/hooks/x?token=a")
+            .body(Body::empty())
+            .unwrap()
+    }
+
+    // basic_routes already holds the hook routes when the process runs with hooks on.
+    #[cfg(feature = "enterprise")]
+    fn hook_routes_unless_registered() -> Router {
+        if get_o2_config().common.workflows_enabled
+            && openobserve_core::workflows::http_trigger::hooks_enabled()
+        {
+            Router::new()
+        } else {
+            workflow_hook_routes()
+        }
+    }
+
+    #[cfg(feature = "enterprise")]
+    #[tokio::test]
+    async fn create_app_router_builds_with_workflow_hook_routes() {
+        let app = Router::new()
+            .merge(basic_routes())
+            .merge(hook_routes_unless_registered())
+            .merge(splunk_collector_routes())
+            .nest("/config", config_routes())
+            .nest("/api", service_routes())
+            .merge(other_service_routes())
+            .merge(proxy_routes(true));
+        let status = app
+            .oneshot(credential_in_url_probe())
+            .await
+            .unwrap()
+            .status();
+        assert_eq!(status, StatusCode::BAD_REQUEST);
+    }
+
+    #[cfg(feature = "enterprise")]
+    #[tokio::test]
+    async fn router_node_app_builds_with_workflow_hook_routes() {
+        let router_routes = Router::new()
+            .merge(crate::router::http::create_router_routes())
+            .nest("/config", config_routes())
+            .merge(proxy_routes(true));
+        let app = Router::new()
+            .merge(basic_routes())
+            .merge(hook_routes_unless_registered())
+            .merge(crate::router::http::create_splunk_collector_proxy_routes())
+            .merge(router_routes);
+        let status = app
+            .oneshot(credential_in_url_probe())
+            .await
+            .unwrap()
+            .status();
+        assert_eq!(
+            status,
+            StatusCode::BAD_REQUEST,
+            "the hook route wins over /api/{{*path}}"
+        );
+    }
+
     #[tokio::test]
     async fn non_router_node_shape_serves_the_collector_locally() {
         let app = Router::new()
@@ -5210,6 +5438,7 @@ mod tests {
             "POST /{org_id}/oncall/responses/{response_id}/acknowledge",
             "POST /{org_id}/oncall/responses/{response_id}/resolve",
             "POST /{org_id}/oncall/responses/{response_id}/snooze",
+            "POST /{org_id}/oncall/responses/{response_id}/unsnooze",
             "POST /{org_id}/prometheus/api/v1/query",
             "POST /{org_id}/prometheus/api/v1/query_range",
             "POST /{org_id}/{stream_name}/_around",
@@ -5311,6 +5540,28 @@ mod tests {
         assert_eq!(status, StatusCode::UNAUTHORIZED);
     }
 
+    #[tokio::test]
+    async fn invites_are_not_served_unauthenticated_with_a_forged_identity_header() {
+        let app = Router::new()
+            .merge(basic_routes())
+            .nest("/api", service_routes());
+        for (method, uri, expected) in [
+            (Method::GET, "/auth/invites", StatusCode::NOT_FOUND),
+            (Method::DELETE, "/auth/invites/x", StatusCode::NOT_FOUND),
+            (Method::GET, "/api/invites", StatusCode::UNAUTHORIZED),
+            (Method::DELETE, "/api/invites/x", StatusCode::UNAUTHORIZED),
+        ] {
+            let req = Request::builder()
+                .method(method.clone())
+                .uri(uri)
+                .header("user_id", "someone@example.com")
+                .body(Body::empty())
+                .unwrap();
+            let status = app.clone().oneshot(req).await.unwrap().status();
+            assert_eq!(status, expected, "{method} {uri}");
+        }
+    }
+
     #[tokio::test]
     async fn the_public_link_take_over_route_is_mounted_for_post_only() {
         let app = public_dashboard_admin_routes(Router::new());
diff --git a/src/api/http/src/handler/http/router/one_ack_tests.rs b/src/api/http/src/handler/http/router/one_ack_tests.rs
index a302714181..b4565441cc 100644
--- a/src/api/http/src/handler/http/router/one_ack_tests.rs
+++ b/src/api/http/src/handler/http/router/one_ack_tests.rs
@@ -1488,40 +1488,331 @@ async fn openfga_edit_on_any_alert_of_an_incident_admits() {
     assert!(!ack::may_edit_any_alert_with(&problem, only("none".into())).await);
 }
 
+/// Presses Resolve as an admin on the page route (UI, bulk, Slack), incident PATCH or phone key 6.
+async fn resolve_on(surface: Surface, f: &IncidentFixture) {
+    let (status, body) = match surface {
+        Surface::IncidentRoute => {
+            let uri = format!(
+                "/api/v2/{}/alerts/incidents/{}/update",
+                org(),
+                f.incident_id
+            );
+            let (status, body) = call_as(
+                admin(),
+                Method::PATCH,
+                &uri,
+                Some(json!({"status": "resolved"})),
+            )
+            .await;
+            (status, body.to_string())
+        }
+        Surface::PageRoute => {
+            let uri = format!("/api/{}/oncall/responses/{}/resolve", org(), f.owner);
+            let (status, body) = post(admin(), &uri, json!({})).await;
+            (status, body.to_string())
+        }
+        Surface::PhoneKey => {
+            let tok = token_for(&f.owner, admin(), token::TokenPurpose::Voice).await;
+            post_form(
+                &format!("/api/v2/{}/oncall/ack/voice/{tok}", org()),
+                "Digits=6",
+            )
+            .await
+        }
+        Surface::AlertRoute | Surface::EmailLink => unreachable!("no Resolve on {surface:?}"),
+    };
+    assert_eq!(status, StatusCode::OK, "{surface:?}: {body}");
+}
+
+/// R7: a person's Resolve on every surface ends the problem's ack and restarts no page.
+async fn every_resolve_ends_the_acknowledgement() {
+    for surface in [
+        Surface::PageRoute,
+        Surface::IncidentRoute,
+        Surface::PhoneKey,
+    ] {
+        let f = incident_with_owner_and_impacted_pages(&format!("r7-{surface:?}")).await;
+        let ack = format!("/api/v2/{}/alerts/{}/ack", org(), f.alert_id);
+        let (status, body) = post(member(), &ack, json!({})).await;
+        assert_eq!(status, StatusCode::OK, "{surface:?}: {body}");
+        resolve_on(surface, &f).await;
+        assert_eq!(row_holder(&f.alert_id).await, None, "{surface:?}");
+        assert_eq!(
+            incident_holder(&f.incident_id).await.0,
+            match surface {
+                Surface::IncidentRoute => "resolved",
+                _ => "open",
+            },
+            "{surface:?}"
+        );
+        if !matches!(surface, Surface::IncidentRoute) {
+            let kinds: Vec<String> = infra::table::incident_events::get(org(), &f.incident_id)
+                .await
+                .unwrap()
+                .iter()
+                .map(|e| serde_json::to_value(e).unwrap()["type"].to_string())
+                .collect();
+            assert!(
+                kinds.contains(&"\"AckEndedByPageResolve\"".to_string())
+                    && !kinds.contains(&"\"Reopened\"".to_string()),
+                "{surface:?}: the timeline says why the ack ended: {kinds:?}"
+            );
+            assert_eq!(page(&f.owner).await.state, ResponseState::Resolved);
+            let left = page(&f.impacted).await;
+            assert_eq!(
+                (left.state, left.acked_by.as_deref()),
+                (ResponseState::Acknowledged, Some(member())),
+                "{surface:?}: the problem's other pages are left as they are"
+            );
+        }
+    }
+}
+
+/// R7 [weak]: the page closes first; a failed clear is an error and a retried Resolve clears it.
+async fn a_failed_clear_is_an_error_and_a_retried_resolve_clears_it() {
+    for retry in [Surface::PageRoute, Surface::PhoneKey] {
+        let name = format!("r7-clear-fails-{retry:?}");
+        let alert_id = firing_alert(&name).await;
+        let response = alert_page(&alert_id, Some(&team(&name, &[admin()]).await)).await;
+        let (status, body) = post(
+            admin(),
+            &format!("/api/v2/{}/alerts/{alert_id}/ack", org()),
+            json!({}),
+        )
+        .await;
+        assert_eq!(status, StatusCode::OK, "{body}");
+        let uri = format!("/api/{}/oncall/responses/{}/resolve", org(), response.id);
+        let stuck = "r7_clear_fails";
+        fail_updates(stuck, "alert_acks", "alert_id", &alert_id).await;
+        let (status, body) = post(admin(), &uri, json!({})).await;
+        unfail(stuck).await;
+        assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR, "{body}");
+        assert_eq!(page(&response.id).await.state, ResponseState::Resolved);
+        assert_eq!(
+            row_holder(&alert_id).await.map(|(who, _)| who).as_deref(),
+            Some(admin())
+        );
+        let (status, body) = match retry {
+            Surface::PhoneKey => {
+                let tok = token_for(&response.id, admin(), token::TokenPurpose::Voice).await;
+                post_form(
+                    &format!("/api/v2/{}/oncall/ack/voice/{tok}", org()),
+                    "Digits=6",
+                )
+                .await
+            }
+            _ => {
+                let (status, body) = post(admin(), &uri, json!({})).await;
+                (status, body.to_string())
+            }
+        };
+        assert_eq!(status, StatusCode::OK, "{retry:?}: {body}");
+        assert_eq!(row_holder(&alert_id).await, None, "{retry:?}");
+    }
+}
+
+/// R7 [weak] on the incident: a re-sent Resolve finishes a failed clear with no second event.
+async fn a_failed_incident_clear_is_finished_by_resolving_again() {
+    let f = incident_with_owner_and_impacted_pages("r7-incident-clear-fails").await;
+    let (status, body) = post(
+        member(),
+        &format!("/api/v2/{}/alerts/{}/ack", org(), f.alert_id),
+        json!({}),
+    )
+    .await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    let patch = format!(
+        "/api/v2/{}/alerts/incidents/{}/update",
+        org(),
+        f.incident_id
+    );
+    let resolve = || {
+        call_as(
+            admin(),
+            Method::PATCH,
+            &patch,
+            Some(json!({"status": "resolved"})),
+        )
+    };
+    let stuck = "r7_incident_clear_fails";
+    fail_updates(stuck, "alert_acks", "alert_id", &f.alert_id).await;
+    let (status, body) = resolve().await;
+    unfail(stuck).await;
+    assert_eq!(status, StatusCode::INTERNAL_SERVER_ERROR, "{body}");
+    assert_eq!(incident_holder(&f.incident_id).await.0, "resolved");
+    assert!(row_holder(&f.alert_id).await.is_some());
+
+    let (status, body) = resolve().await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(row_holder(&f.alert_id).await, None);
+    let resolved = infra::table::incident_events::get(org(), &f.incident_id)
+        .await
+        .unwrap()
+        .iter()
+        .filter(|e| serde_json::to_value(e).unwrap()["type"] == "Resolved")
+        .count();
+    assert_eq!(resolved, 1, "the retry writes no second resolved event");
+}
+
+/// Re-fires the alert's one row at `at`, as a firing after a recovery does.
+async fn refire(alert_id: &str, at: i64) {
+    let state = AlertState {
+        last_outcome: Some(RunOutcome::Firing),
+        last_outcome_at: Some(at),
+        since: Some(at),
+        firing_started_at: Some(at),
+        ..AlertState::empty(alert_id, "")
+    };
+    alert_states::persist(
+        &StateUpdate {
+            state: Some(state),
+            transition: None,
+        },
+        None,
+    )
+    .await
+    .unwrap();
+}
+
+/// Who holds the ack of the alert's firing that started at `firing`.
+async fn holder_of(alert_id: &str, firing: i64) -> Option<String> {
+    alert_acks::get(org(), alert_id, "")
+        .await
+        .unwrap()
+        .filter(|a| a.in_force_for(Some(firing)))
+        .map(|a| a.acked_by)
+}
+
+/// N1: a page covers firings up to its close, so a gate-held open page covers a re-fire.
+async fn a_resolve_ends_the_firings_its_page_covered_up_to_its_close() {
+    let alert_id = firing_alert("n1-cover").await;
+    let page_of = alert_page(&alert_id, Some(&team("n1-cover", &[admin()]).await)).await;
+    let ack = format!("/api/v2/{}/alerts/{alert_id}/ack", org());
+    let uri = format!("/api/{}/oncall/responses/{}/resolve", org(), page_of.id);
+
+    let during_gate = page_of.opened_at + 1;
+    refire(&alert_id, during_gate).await;
+    let (status, body) = post(admin(), &ack, json!({})).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    let (status, body) = post(admin(), &uri, json!({})).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(
+        holder_of(&alert_id, during_gate).await,
+        None,
+        "the open page was the re-fire's page"
+    );
+
+    let after_close = page(&page_of.id).await.closed_at.unwrap() + 1_000_000;
+    refire(&alert_id, after_close).await;
+    let (status, body) = post(admin(), &ack, json!({})).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    let (status, body) = post(admin(), &uri, json!({})).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(
+        holder_of(&alert_id, after_close).await.as_deref(),
+        Some(admin()),
+        "a closed page does not cover a later firing"
+    );
+}
+
+/// N2: a re-sent incident Resolve re-runs the on-call repair a first failure only logged.
+async fn a_resent_incident_resolve_repairs_its_pages() {
+    use sea_orm::ConnectionTrait;
+    let f = incident_with_owner_and_impacted_pages("n2-repair").await;
+    let patch = format!(
+        "/api/v2/{}/alerts/incidents/{}/update",
+        org(),
+        f.incident_id
+    );
+    let resolve = || {
+        call_as(
+            admin(),
+            Method::PATCH,
+            &patch,
+            Some(json!({"status": "resolved"})),
+        )
+    };
+    let recovered = || async {
+        oncall_responses::list_events(&f.owner)
+            .await
+            .unwrap()
+            .iter()
+            .any(|e| e.kind == ResponseEventKind::Recovery)
+    };
+    let stuck = "n2_recovery_fails";
+    unfail(stuck).await;
+    infra::db::get_orm_client_rw()
+        .await
+        .execute_unprepared(&format!(
+            "CREATE TRIGGER {stuck} BEFORE INSERT ON oncall_response_events \
+             WHEN NEW.response_id = '{}' BEGIN SELECT RAISE(ABORT, 'insert fails'); END",
+            f.owner
+        ))
+        .await
+        .expect("fault");
+    let (status, body) = resolve().await;
+    unfail(stuck).await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert!(!recovered().await, "the first recovery failed");
+
+    let (status, body) = resolve().await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert!(recovered().await, "the re-sent Resolve repaired the page");
+    let resolved = infra::table::incident_events::get(org(), &f.incident_id)
+        .await
+        .unwrap()
+        .iter()
+        .filter(|e| serde_json::to_value(e).unwrap()["type"] == "Resolved")
+        .count();
+    assert_eq!(resolved, 1);
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 4)]
 async fn one_ack_end_to_end() {
+    // Boxed: inline, debug builds give each step its own slot here and overflow a 2 MB thread.
     let _oncall = oncall(true).await;
-    meta_store().await;
-    seed().await;
-    the_problem_is_the_incident_when_there_is_one_else_the_firing().await;
-    every_page_action_runs_the_one_rule().await;
-    a_teamless_page_refuses_escalate_and_snooze_and_can_be_handed_off().await;
-    let f = incident_with_owner_and_impacted_pages("ak8").await;
-    an_alert_ack_acknowledges_its_incident_and_stops_every_page(&f).await;
-    a_take_over_moves_every_record(&f).await;
-    an_unack_clears_every_record(&f).await;
-    the_incident_routes_admit_a_paged_member_and_refuse_a_stranger(&f).await;
-    a_firing_joining_an_acknowledged_incident_is_acknowledged(&f).await;
-    a_refused_hand_off_keeps_the_ack_and_the_page().await;
-    a_hand_off_clears_the_ack_and_moves_the_page().await;
-    a_mute_snoozes_the_open_page().await;
-    an_impacted_page_acknowledges_the_whole_problem().await;
-    a_page_whose_alert_stopped_firing_still_stops_and_restarts().await;
-    promote_runs_the_one_rule().await;
-    a_failed_page_step_is_finished_by_the_next_press().await;
-    a_mute_says_why_a_page_was_not_snoozed().await;
-    a_failed_release_stops_the_hand_off().await;
-    a_hand_off_to_a_person_clears_the_ack().await;
-    every_surface_reaches_the_one_ack().await;
-    the_phone_and_the_link_refuse_someone_the_rule_refuses().await;
-    openfga_edit_on_any_alert_of_an_incident_admits().await;
-    a_page_whose_alert_is_gone_can_be_taken_over().await;
-    a_failed_incident_read_is_an_error().await;
-    a_press_on_a_closed_page_answers_from_the_page().await;
-    a_press_on_an_older_open_page_stops_it().await;
-    a_leftover_page_stays_stopped_on_unack_and_take_over().await;
-    a_leftover_pages_team_is_a_responder().await;
-    a_press_that_changes_nothing_says_so().await;
-    an_unack_whose_restart_lost_its_trigger_still_reports_it().await;
-    a_failed_page_read_is_an_error().await;
+    Box::pin(meta_store()).await;
+    Box::pin(seed()).await;
+    Box::pin(the_problem_is_the_incident_when_there_is_one_else_the_firing()).await;
+    Box::pin(every_page_action_runs_the_one_rule()).await;
+    Box::pin(a_teamless_page_refuses_escalate_and_snooze_and_can_be_handed_off()).await;
+    let f = Box::pin(incident_with_owner_and_impacted_pages("ak8")).await;
+    Box::pin(an_alert_ack_acknowledges_its_incident_and_stops_every_page(
+        &f,
+    ))
+    .await;
+    Box::pin(a_take_over_moves_every_record(&f)).await;
+    Box::pin(an_unack_clears_every_record(&f)).await;
+    Box::pin(the_incident_routes_admit_a_paged_member_and_refuse_a_stranger(&f)).await;
+    Box::pin(a_firing_joining_an_acknowledged_incident_is_acknowledged(
+        &f,
+    ))
+    .await;
+    Box::pin(a_refused_hand_off_keeps_the_ack_and_the_page()).await;
+    Box::pin(a_hand_off_clears_the_ack_and_moves_the_page()).await;
+    Box::pin(a_mute_snoozes_the_open_page()).await;
+    Box::pin(an_impacted_page_acknowledges_the_whole_problem()).await;
+    Box::pin(a_page_whose_alert_stopped_firing_still_stops_and_restarts()).await;
+    Box::pin(promote_runs_the_one_rule()).await;
+    Box::pin(a_failed_page_step_is_finished_by_the_next_press()).await;
+    Box::pin(a_mute_says_why_a_page_was_not_snoozed()).await;
+    Box::pin(a_failed_release_stops_the_hand_off()).await;
+    Box::pin(a_hand_off_to_a_person_clears_the_ack()).await;
+    Box::pin(every_surface_reaches_the_one_ack()).await;
+    Box::pin(the_phone_and_the_link_refuse_someone_the_rule_refuses()).await;
+    Box::pin(openfga_edit_on_any_alert_of_an_incident_admits()).await;
+    Box::pin(a_page_whose_alert_is_gone_can_be_taken_over()).await;
+    Box::pin(a_failed_incident_read_is_an_error()).await;
+    Box::pin(a_press_on_a_closed_page_answers_from_the_page()).await;
+    Box::pin(a_press_on_an_older_open_page_stops_it()).await;
+    Box::pin(a_leftover_page_stays_stopped_on_unack_and_take_over()).await;
+    Box::pin(a_leftover_pages_team_is_a_responder()).await;
+    Box::pin(a_press_that_changes_nothing_says_so()).await;
+    Box::pin(an_unack_whose_restart_lost_its_trigger_still_reports_it()).await;
+    Box::pin(a_failed_page_read_is_an_error()).await;
+    Box::pin(every_resolve_ends_the_acknowledgement()).await;
+    Box::pin(a_failed_clear_is_an_error_and_a_retried_resolve_clears_it()).await;
+    Box::pin(a_failed_incident_clear_is_finished_by_resolving_again()).await;
+    Box::pin(a_resolve_ends_the_firings_its_page_covered_up_to_its_close()).await;
+    Box::pin(a_resent_incident_resolve_repairs_its_pages()).await;
 }
diff --git a/src/api/http/src/handler/http/router/openapi.rs b/src/api/http/src/handler/http/router/openapi.rs
index 001f2e4dc4..633ad6dd72 100644
--- a/src/api/http/src/handler/http/router/openapi.rs
+++ b/src/api/http/src/handler/http/router/openapi.rs
@@ -315,6 +315,8 @@ use crate::{
         gen_ai::get_agent_mapping,
         gen_ai::list_scored_agents,
         gen_ai::save_agent_mapping,
+        openobserve_api_management::request::gen_ai_health::get_data_health,
+        openobserve_api_management::request::model_pricing::list_unpriced,
         openobserve_api_management::request::alerts::deduplication::get_semantic_groups,
         openobserve_api_management::request::alerts::deduplication::preview_semantic_groups_diff,
         openobserve_api_management::request::alerts::deduplication::save_semantic_groups,
@@ -607,6 +609,18 @@ use crate::{
             config::meta::gen_ai::GenAiAgentMappingConfig,
             gen_ai::GenAiAgentListItem,
             gen_ai::GenAiAgentListResponse,
+            openobserve_api_management::request::gen_ai_health::DataHealthResponse,
+            openobserve_api_management::request::gen_ai_health::HealthCheck,
+            openobserve_api_management::request::gen_ai_health::ModelUsage,
+            openobserve_api_management::request::gen_ai_health::CheckId,
+            openobserve_api_management::request::gen_ai_health::CheckStatus,
+            openobserve_api_management::request::model_pricing::UnpricedModelsResponse,
+            openobserve_api_management::request::model_pricing::UnpricedModel,
+            openobserve_api_management::request::model_pricing::UnpricedModelMatch,
+            openobserve_api_management::request::gen_ai_health::UnpricedModelRow,
+            config::meta::model_pricing::CostStatus,
+            config::meta::model_pricing::PricingSource,
+            config::meta::model_pricing::PricingTierDefinition,
             config::meta::dashboards::Dashboard,
             config::meta::dashboards::v1::AxisItem,
             config::meta::dashboards::v1::Dashboard,
@@ -945,6 +959,7 @@ use crate::{
             config::meta::fleet::ValidationFailed,
             config::meta::fleet::AuditEvent,
             config::meta::fleet::AuditList,
+            config::meta::fleet::AuditModule,
             config::meta::fleet::DeliveryState,
             config::meta::fleet::RolloutStart,
             config::meta::fleet::Batching,
@@ -1050,6 +1065,7 @@ use crate::{
         (name = "Domain Management", description = "Allowed email domains for sign-in (enterprise)"),
         (name = "EvalJobs", description = "Online evaluation jobs (enterprise)"),
         (name = "Experiments", description = "LLM evaluation experiments (enterprise)"),
+        (name = "GenAI Settings", description = "GenAI agent mapping, the agent list and AI data health"),
         (name = "Groups", description = "User group management"),
         (name = "Keys", description = "Cipher key management (enterprise)"),
         (name = "LLM", description = "LLM model pricing definitions"),
@@ -1173,6 +1189,13 @@ pub struct ApiDoc;
     openobserve_api_management::request::workflows::enable_workflow,
     openobserve_api_management::request::workflows::get_workflow_history,
     openobserve_api_management::request::workflows::promote_draft,
+    openobserve_api_management::request::workflows::http_trigger::get_http_trigger,
+    openobserve_api_management::request::workflows::http_trigger::put_http_trigger,
+    openobserve_api_management::request::workflows::http_trigger::delete_http_trigger,
+    openobserve_api_management::request::workflows::http_trigger::rotate_http_credential,
+    openobserve_api_management::request::workflows::http_trigger::revoke_http_credential,
+    openobserve_api_management::request::workflows::http_trigger::reveal_http_credential_secret,
+    openobserve_api_management::request::workflows::http_trigger::test_http_trigger,
     crate::handler::http::request::ratelimit::api_modules,
     openobserve_api_management::request::ai::chat::cancel,
     openobserve_api_management::request::ai::chat::chat,
@@ -1313,6 +1336,7 @@ pub struct ApiDoc;
     openobserve_api_management::request::oncall::snooze_response,
     openobserve_api_management::request::oncall::test_team_slack_channel,
     openobserve_api_management::request::oncall::unacknowledge_response,
+    openobserve_api_management::request::oncall::unsnooze_response,
     openobserve_api_management::request::oncall::update_ownership_rule,
     openobserve_api_management::request::oncall::update_team,
     openobserve_api_management::request::oncall::who_is_on_call,
@@ -1702,6 +1726,22 @@ mod tests {
         ("/api/{org_id}/workflows/{id}/enable", "put"),
         ("/api/{org_id}/workflows/{id}/history", "get"),
         ("/api/{org_id}/workflows/promote/{id}", "post"),
+        ("/api/{org_id}/workflows/{id}/http_trigger", "get"),
+        ("/api/{org_id}/workflows/{id}/http_trigger", "put"),
+        ("/api/{org_id}/workflows/{id}/http_trigger", "delete"),
+        (
+            "/api/{org_id}/workflows/{id}/http_trigger/credentials",
+            "post",
+        ),
+        (
+            "/api/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}",
+            "delete",
+        ),
+        (
+            "/api/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}/secret",
+            "get",
+        ),
+        ("/api/{org_id}/workflows/{id}/http_trigger/test", "post"),
     ];
 
     /// Canonical `ApiGroupOperation` values; anything else is an alias or drops the route.
@@ -1723,6 +1763,33 @@ mod tests {
         ("/api/{org_id}/workflows/{id}/enable", "put", "update"),
         ("/api/{org_id}/workflows/{id}/history", "get", "get"),
         ("/api/{org_id}/workflows/promote/{id}", "post", "update"),
+        ("/api/{org_id}/workflows/{id}/http_trigger", "get", "get"),
+        ("/api/{org_id}/workflows/{id}/http_trigger", "put", "update"),
+        (
+            "/api/{org_id}/workflows/{id}/http_trigger",
+            "delete",
+            "delete",
+        ),
+        (
+            "/api/{org_id}/workflows/{id}/http_trigger/credentials",
+            "post",
+            "update",
+        ),
+        (
+            "/api/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}",
+            "delete",
+            "delete",
+        ),
+        (
+            "/api/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}/secret",
+            "get",
+            "get",
+        ),
+        (
+            "/api/{org_id}/workflows/{id}/http_trigger/test",
+            "post",
+            "create",
+        ),
     ];
 
     const SLACK_OPERATIONS: &[(&str, &str)] = &[
@@ -2156,6 +2223,34 @@ mod tests {
         }
     }
 
+    #[test]
+    fn unpriced_models_path_and_schemas_are_registered() {
+        let spec = serde_json::to_value(ApiDoc::openapi()).unwrap();
+        let op = &spec["paths"]["/api/{org_id}/llm/models/unpriced"]["get"];
+        assert_eq!(op["operationId"], "ListUnpricedModels", "{op}");
+        assert_eq!(
+            op["responses"]["200"]["content"]["application/json"]["schema"]["$ref"],
+            "#/components/schemas/UnpricedModelsResponse"
+        );
+        for code in ["403", "429"] {
+            assert!(op["responses"][code].is_object(), "{code}");
+            assert!(
+                spec["paths"]["/api/{org_id}/gen_ai/data_health"]["get"]["responses"][code]
+                    .is_object(),
+                "data_health {code}"
+            );
+        }
+        let schemas = spec["components"]["schemas"].as_object().unwrap();
+        for name in [
+            "UnpricedModelsResponse",
+            "UnpricedModel",
+            "UnpricedModelMatch",
+            "UnpricedModelRow",
+        ] {
+            assert!(schemas.contains_key(name), "schema {name} missing");
+        }
+    }
+
     #[test]
     fn fleet_reads_are_documented_with_their_403() {
         let spec = serde_json::to_value(ApiDoc::openapi()).unwrap();
@@ -2533,6 +2628,9 @@ mod tests {
     fn workflows_document_the_statuses_their_handlers_return() {
         let base = "/api/{org_id}/workflows";
         let by_id = "/api/{org_id}/workflows/{id}";
+        let http_trigger = "/api/{org_id}/workflows/{id}/http_trigger";
+        let credentials = "/api/{org_id}/workflows/{id}/http_trigger/credentials";
+        let credential = "/api/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}";
         assert_documented_statuses(&[
             (base, "post", &["200", "400", "403", "500"]),
             (base, "get", &["200", "403", "404", "500"]),
@@ -2547,7 +2645,7 @@ mod tests {
             (
                 "/api/{org_id}/workflows/{id}/trigger",
                 "post",
-                &["200", "400"],
+                &["200", "400", "409"],
             ),
             (
                 "/api/{org_id}/workflows/{id}/errors/{run_id}",
@@ -2574,6 +2672,29 @@ mod tests {
                 "post",
                 &["201", "400", "403", "500"],
             ),
+            (http_trigger, "get", &["200", "404", "500"]),
+            (
+                http_trigger,
+                "put",
+                &["200", "201", "400", "403", "404", "500"],
+            ),
+            (http_trigger, "delete", &["204", "404", "500"]),
+            (
+                credentials,
+                "post",
+                &["201", "400", "403", "404", "409", "500"],
+            ),
+            (credential, "delete", &["204", "404", "500"]),
+            (
+                "/api/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}/secret",
+                "get",
+                &["200", "403", "404", "500"],
+            ),
+            (
+                "/api/{org_id}/workflows/{id}/http_trigger/test",
+                "post",
+                &["200", "400", "404", "500"],
+            ),
         ]);
     }
 
diff --git a/src/api/http/src/handler/http/router/openapi_coverage/baseline.txt b/src/api/http/src/handler/http/router/openapi_coverage/baseline.txt
index 268163b5b5..db900afea0 100644
--- a/src/api/http/src/handler/http/router/openapi_coverage/baseline.txt
+++ b/src/api/http/src/handler/http/router/openapi_coverage/baseline.txt
@@ -203,7 +203,6 @@ all ratelimit POST /api/{org_id}/functions/test
 all mcp GET /api/{org_id}/gen_ai/agents
 all ratelimit GET /api/{org_id}/gen_ai/agents
 all summary GET /api/{org_id}/gen_ai/agents
-all tag GET /api/{org_id}/gen_ai/agents
 all mcp GET /api/{org_id}/groups
 all ratelimit GET /api/{org_id}/groups
 all mcp POST /api/{org_id}/groups
@@ -280,15 +279,12 @@ all summary PUT /api/{org_id}/service_streams/config/identity
 all mcp GET /api/{org_id}/settings/gen_ai/agent_mapping
 all ratelimit GET /api/{org_id}/settings/gen_ai/agent_mapping
 all summary GET /api/{org_id}/settings/gen_ai/agent_mapping
-all tag GET /api/{org_id}/settings/gen_ai/agent_mapping
 all mcp PUT /api/{org_id}/settings/gen_ai/agent_mapping
 all ratelimit PUT /api/{org_id}/settings/gen_ai/agent_mapping
 all summary PUT /api/{org_id}/settings/gen_ai/agent_mapping
-all tag PUT /api/{org_id}/settings/gen_ai/agent_mapping
 all mcp DELETE /api/{org_id}/settings/gen_ai/agent_registry
 all ratelimit DELETE /api/{org_id}/settings/gen_ai/agent_registry
 all summary DELETE /api/{org_id}/settings/gen_ai/agent_registry
-all tag DELETE /api/{org_id}/settings/gen_ai/agent_registry
 all security POST /api/{org_id}/short
 all security GET /api/{org_id}/short/{short_id}
 all response POST /api/{org_id}/slack/link-requests/{request_id}/resend
diff --git a/src/api/http/src/handler/http/router/openapi_coverage/excluded_routes.txt b/src/api/http/src/handler/http/router/openapi_coverage/excluded_routes.txt
index f5f5376f54..bb93408ba8 100644
--- a/src/api/http/src/handler/http/router/openapi_coverage/excluded_routes.txt
+++ b/src/api/http/src/handler/http/router/openapi_coverage/excluded_routes.txt
@@ -14,6 +14,8 @@ GET /api/v2/{org_id}/alerts/charts/render | signed image URL embedded in notific
 GET /api/v2/{org_id}/oncall/ack | browser-only HTML page behind an emailed link
 POST /api/v2/{org_id}/oncall/ack | browser-only form post of the HTML ack page
 POST /api/v2/{org_id}/oncall/ack/voice/{token} | third-party voice provider callback
+POST /api/v2/{org_id}/workflows/hooks/{trigger_id} | third-party callback authenticated by a workflow endpoint credential
+GET /api/v2/{org_id}/workflows/hooks/{trigger_id}/runs/{run_id} | run status for that third-party callback, same credential
 GET /api/{org_id}/ | wire-compatibility handshake used by log shipper agents
 HEAD /api/{org_id}/ | wire-compatibility handshake used by log shipper agents
 GET /api/{org_id}/_data_stream/{name} | wire-compatibility handshake used by log shipper agents
@@ -41,8 +43,6 @@ POST /api/{org_id}/traces | second mount of the published POST /api/{org_id}/v1/
 GET /api/{org_id}/v1/opamp | OpAMP agent protocol
 POST /api/{org_id}/v1/opamp | OpAMP agent protocol
 POST /api/{org_id}/v1development/profiles | second mount of POST /api/{org_id}/v1/profiles
-GET /auth/invites | second mount of the published GET /api/invites
-DELETE /auth/invites/{token} | second mount of the published DELETE /api/invites/{token}
 GET /auth/login | browser-only login redirect
 GET /config/ | unauthenticated bootstrap of the browser login page
 GET /config/dex_login | browser-only SSO redirect
diff --git a/src/api/http/src/handler/http/router/openapi_coverage/mod.rs b/src/api/http/src/handler/http/router/openapi_coverage/mod.rs
index af3bda5e2e..6c3f728d85 100644
--- a/src/api/http/src/handler/http/router/openapi_coverage/mod.rs
+++ b/src/api/http/src/handler/http/router/openapi_coverage/mod.rs
@@ -65,6 +65,7 @@ const ROUTER_PREFIXES: &[(&str, &str)] = &[
     ("fleet_router", "/api"),
     ("slack_routes", "/api"),
     ("es_compat_routes", "/api"),
+    ("workflow_hook_routes", ""),
 ];
 
 /// Only serves UI redirects, computed from `base_uri` at startup.
diff --git a/src/api/http/src/router/http/mod.rs b/src/api/http/src/router/http/mod.rs
index 008cb1c137..bb12eb6d95 100644
--- a/src/api/http/src/router/http/mod.rs
+++ b/src/api/http/src/router/http/mod.rs
@@ -897,6 +897,11 @@ mod tests {
         assert!(is_querier_route("/api/default/config"));
         assert!(!is_querier_route("/api/default/config/_json"));
         assert!(is_querier_route("/api/default/ai/chat_stream"));
+        assert!(is_querier_route(
+            "/api/default/gen_ai/data_health?stream_name=default&start_time=1&end_time=2"
+        ));
+        assert!(is_querier_route("/api/default/llm/models/unpriced"));
+        assert!(!is_querier_route("/api/default/llm/models"));
     }
 
     #[test]
diff --git a/src/api/http/src/server.rs b/src/api/http/src/server.rs
index 46c983a6cc..a56c9b32d8 100644
--- a/src/api/http/src/server.rs
+++ b/src/api/http/src/server.rs
@@ -121,7 +121,16 @@ pub async fn serve(haddr: SocketAddr, app: axum::Router) -> Result<(), anyhow::E
 }
 
 fn otel_layer() -> OtelAxumLayer {
-    OtelAxumLayer::default().filter(config::meta::logger::otel_middleware_enabled)
+    OtelAxumLayer::default().filter(otel_span_filter)
+}
+
+fn otel_span_filter(path: &str) -> bool {
+    otel_span_wanted(path, config::meta::logger::otel_middleware_enabled(path))
+}
+
+/// The span records the raw path and query, and a hook URL may hold a pasted credential.
+fn otel_span_wanted(path: &str, enabled: bool) -> bool {
+    enabled && !path.contains("/workflows/hooks/")
 }
 
 async fn shutdown_signal() {
@@ -199,6 +208,20 @@ mod tests {
         *warnings.lock().unwrap()
     }
 
+    #[test]
+    fn hook_routes_never_get_a_request_span() {
+        assert!(!otel_span_wanted(
+            "/api/v2/acme/workflows/hooks/o2wh_abc",
+            true
+        ));
+        assert!(!otel_span_wanted(
+            "/base/api/v2/acme/workflows/hooks/t1/runs/r1",
+            true
+        ));
+        assert!(otel_span_wanted("/api/acme/_search", true));
+        assert!(!otel_span_wanted("/api/acme/_search", false));
+    }
+
     #[tokio::test]
     async fn otel_layer_is_silent_when_tracing_is_off() {
         for level in [LevelFilter::INFO, LevelFilter::TRACE] {
diff --git a/src/api/http/tests/support/workflow_hooks.rs b/src/api/http/tests/support/workflow_hooks.rs
new file mode 100644
index 0000000000..9695cd33ff
--- /dev/null
+++ b/src/api/http/tests/support/workflow_hooks.rs
@@ -0,0 +1,689 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Shared boot and seeding for the workflow hook test binaries, one server config per binary.
+
+#![allow(dead_code)]
+
+use std::{collections::HashMap, net::IpAddr, sync::LazyLock};
+
+use axum::{
+    Router,
+    body::{Body, Bytes},
+    http::{HeaderMap, Method, Request, StatusCode},
+};
+use config::{
+    axum::middlewares::RealIp,
+    cluster::LOCAL_NODE,
+    meta::{
+        organization::OrganizationType,
+        user::{UserRole, UserType},
+    },
+    utils::{base64, time::now_micros},
+};
+use infra::{
+    db::{NO_NEED_WATCH, get_orm_client_rw},
+    secrets,
+    table::{
+        cipher,
+        entity::{
+            workflow_http_trigger_credentials::Model as CredentialRow,
+            workflow_http_triggers::Model as TriggerRow,
+        },
+        org_users, organizations, users,
+        workflow_http_trigger_requests::{self as ledger, LedgerInsert, NewHookRequest},
+        workflow_http_triggers::{
+            self as triggers, AuthMode, CredentialKind, CredentialState, ReplicatedCredential,
+            ReplicatedTrigger, TriggerSnapshot,
+        },
+        workflows::{self, Workflow},
+    },
+};
+use openobserve_core::workflows::http_trigger::{
+    HEARTBEAT_KEY,
+    credentials::{
+        MintedSecret, display_prefix, mint_signing_secret, mint_token, prepare_secret, sha256_hex,
+    },
+    signature::{SignedContent, decode_secret, sign},
+    worker::Heartbeat,
+};
+use tokio::sync::OnceCell;
+use tower::ServiceExt;
+
+pub static RUNTIME: LazyLock<tokio::runtime::Runtime> = LazyLock::new(|| {
+    tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(4)
+        .enable_all()
+        .build()
+        .unwrap()
+});
+
+static APP: OnceCell<Router> = OnceCell::const_new();
+static AUDITS: std::sync::Mutex<Vec<serde_json::Value>> = std::sync::Mutex::new(Vec::new());
+
+pub const PASSWORD: &str = "Complexpass#123";
+const SALT: &str = "0123456789abcdef";
+
+pub struct Seeded {
+    pub org: String,
+    pub trigger_id: String,
+    pub workflow_id: String,
+    pub secret: String,
+}
+
+impl Seeded {
+    pub fn invoke_path(&self) -> String {
+        format!("/api/v2/{}/workflows/hooks/{}", self.org, self.trigger_id)
+    }
+
+    pub fn poll_path(&self, run_id: &str) -> String {
+        format!("{}/runs/{run_id}", self.invoke_path())
+    }
+}
+
+pub struct Reply {
+    pub status: StatusCode,
+    pub headers: HeaderMap,
+    pub body: Bytes,
+}
+
+impl Reply {
+    pub fn json(&self) -> serde_json::Value {
+        serde_json::from_slice(&self.body).unwrap_or(serde_json::Value::Null)
+    }
+
+    pub fn header(&self, name: &str) -> Option<&str> {
+        self.headers.get(name).and_then(|v| v.to_str().ok())
+    }
+}
+
+/// Runs a test case on the binary's one runtime, so the meta-store pool outlives every case.
+pub fn run<F: std::future::Future<Output = ()>>(
+    env: &'static [(&'static str, &'static str)],
+    case: F,
+) {
+    RUNTIME.block_on(async {
+        boot(env).await;
+        case.await;
+    });
+}
+
+pub async fn boot(env: &'static [(&'static str, &'static str)]) {
+    APP.get_or_init(|| async {
+        let data_dir = std::env::temp_dir().join(format!(
+            "o2-workflow-hooks-{}-{}",
+            std::process::id(),
+            now_micros()
+        ));
+        std::fs::create_dir_all(data_dir.join("db")).unwrap();
+        let dir = format!("{}/", data_dir.display());
+        set_env("ZO_LOCAL_MODE", "true");
+        set_env("ZO_META_STORE", "sqlite");
+        set_env("ZO_DATA_DIR", &dir);
+        set_env("ZO_DATA_DB_DIR", &format!("{dir}db/"));
+        set_env("ZO_WEB_URL", "https://o2.example.com");
+        set_env("O2_WORKFLOWS_ENABLED", "true");
+        for (key, value) in env {
+            set_env(key, value);
+        }
+        infra::db::create_table().await.unwrap();
+        infra::db_init().await.unwrap();
+        infra::table::migrate().await.unwrap();
+        let master_key = env
+            .iter()
+            .find(|(key, _)| *key == "O2_MASTER_ENCRYPTION_KEY")
+            .map(|(_, value)| *value);
+        cipher::boot(master_key).await.unwrap();
+        openobserve_api_http::handler::http::router::create_app_router(stub_ui)
+    })
+    .await;
+}
+
+pub fn app() -> Router {
+    APP.get().expect("boot first").clone()
+}
+
+pub async fn send(req: Request<Body>) -> Reply {
+    let resp = app().oneshot(req).await.unwrap();
+    let status = resp.status();
+    let headers = resp.headers().clone();
+    let body = axum::body::to_bytes(resp.into_body(), 16 * 1024 * 1024)
+        .await
+        .unwrap();
+    Reply {
+        status,
+        headers,
+        body,
+    }
+}
+
+pub fn request(
+    method: Method,
+    uri: &str,
+    ip: &str,
+    headers: &[(&str, &str)],
+    body: Body,
+) -> Request<Body> {
+    let mut builder = Request::builder().method(method).uri(uri);
+    for (name, value) in headers {
+        builder = builder.header(*name, *value);
+    }
+    if !ip.is_empty() {
+        builder = builder.extension(RealIp(ip.parse::<IpAddr>().unwrap()));
+    }
+    builder.body(body).unwrap()
+}
+
+pub fn post_token(
+    path: &str,
+    ip: &str,
+    token: &str,
+    extra: &[(&str, &str)],
+    body: &[u8],
+) -> Request<Body> {
+    let bearer = format!("Bearer {token}");
+    let mut headers = vec![
+        ("authorization", bearer.as_str()),
+        ("content-type", "application/json"),
+    ];
+    headers.extend_from_slice(extra);
+    request(Method::POST, path, ip, &headers, Body::from(body.to_vec()))
+}
+
+pub fn get_token(path: &str, ip: &str, token: &str) -> Request<Body> {
+    let bearer = format!("Bearer {token}");
+    request(
+        Method::GET,
+        path,
+        ip,
+        &[("authorization", bearer.as_str())],
+        Body::empty(),
+    )
+}
+
+/// Signs at `ts` with the trigger's secret over the body for a POST or over `GET {path}` for a GET.
+pub fn signed(
+    method: Method,
+    path: &str,
+    ip: &str,
+    secret: &str,
+    id: &str,
+    ts: i64,
+    body: &[u8],
+) -> Request<Body> {
+    let key = decode_secret(secret).unwrap();
+    let content = if method == Method::GET {
+        SignedContent::Poll(path)
+    } else {
+        SignedContent::Invoke(body)
+    };
+    let signature = sign(&key, id, ts, content);
+    let ts = ts.to_string();
+    request(
+        method,
+        path,
+        ip,
+        &[
+            ("webhook-id", id),
+            ("webhook-timestamp", ts.as_str()),
+            ("webhook-signature", signature.as_str()),
+            ("content-type", "application/json"),
+        ],
+        Body::from(body.to_vec()),
+    )
+}
+
+pub fn now_secs() -> i64 {
+    now_micros() / 1_000_000
+}
+
+pub async fn seed_org(org: &str) {
+    if organizations::find(org).await.unwrap().is_none() {
+        organizations::add(org, org, OrganizationType::Custom)
+            .await
+            .unwrap();
+    }
+}
+
+pub async fn seed_workflow(org: &str, id: &str, enabled: bool) {
+    workflows::save_workflow(workflow(org, id, enabled))
+        .await
+        .unwrap();
+}
+
+pub async fn seed_draft(org: &str, id: &str) {
+    workflows::save_draft(workflow(org, id, true))
+        .await
+        .unwrap();
+}
+
+/// A published Alert Fired workflow linked to `alert_id` the way the alerts API links it.
+pub async fn seed_alert_workflow(org: &str, id: &str, alert_id: &str) {
+    let mut workflow = workflow(org, id, true);
+    workflow.nodes[0].meta = Some(HashMap::from([(
+        "trigger_kind".to_string(),
+        "alert_fired".to_string(),
+    )]));
+    workflows::save_workflow(workflow).await.unwrap();
+    workflows::add_workflow_association(workflows::WorkflowAssociation {
+        id: 0,
+        org_id: org.to_string(),
+        entity_id: alert_id.to_string(),
+        entity_type: workflows::WorkflowTriggerEntity::Alert.to_string(),
+        workflow_id: id.to_string(),
+        trigger_type: "AlertFired".to_string(),
+        created_at: now_micros(),
+    })
+    .await
+    .unwrap();
+}
+
+/// The trigger node's kind and the workflow's (entity, entity type, trigger type) links.
+pub async fn kind_and_links(
+    org: &str,
+    id: &str,
+) -> (Option<String>, Vec<(String, String, String)>) {
+    let workflow = workflows::get_by_org_wid(org, id).await.unwrap().unwrap();
+    let kind = workflow.nodes[0]
+        .meta
+        .as_ref()
+        .and_then(|meta| meta.get("trigger_kind").cloned());
+    let links = workflows::get_all_associations_for_workflow(org, id)
+        .await
+        .unwrap()
+        .into_iter()
+        .map(|link| (link.entity_id, link.entity_type, link.trigger_type))
+        .collect();
+    (kind, links)
+}
+
+/// A token-mode trigger with one active credential, on a published, enabled workflow.
+pub async fn seed_token_trigger(org: &str, name: &str) -> Seeded {
+    seed_token_trigger_with(org, name, |_| {}).await
+}
+
+/// Each trigger gets its own workflow, since `workflow_id` is UNIQUE among triggers.
+pub async fn seed_token_trigger_with(
+    org: &str,
+    name: &str,
+    edit: impl FnOnce(&mut TriggerRow),
+) -> Seeded {
+    seed_org(org).await;
+    let workflow_id = format!("wf-{name}");
+    seed_workflow(org, &workflow_id, true).await;
+    seed_token_trigger_for(org, name, &workflow_id, edit).await
+}
+
+pub async fn seed_token_trigger_for(
+    org: &str,
+    name: &str,
+    workflow_id: &str,
+    edit: impl FnOnce(&mut TriggerRow),
+) -> Seeded {
+    let trigger_id = format!("trg{name}");
+    let mut row = trigger_row(org, &trigger_id, workflow_id, AuthMode::Token);
+    edit(&mut row);
+    let rw = get_orm_client_rw().await;
+    triggers::insert_trigger(rw, row).await.unwrap();
+    let minted = mint_token();
+    add_token_credential(
+        &trigger_id,
+        org,
+        &format!("cred-{name}"),
+        &minted.plaintext,
+        CredentialState::Active,
+        None,
+    )
+    .await;
+    Seeded {
+        org: org.to_string(),
+        trigger_id,
+        workflow_id: workflow_id.to_string(),
+        secret: minted.plaintext,
+    }
+}
+
+pub async fn add_token_credential(
+    trigger_id: &str,
+    org: &str,
+    credential_id: &str,
+    token: &str,
+    state: CredentialState,
+    expires_at: Option<i64>,
+) {
+    let now = now_micros();
+    let rw = get_orm_client_rw().await;
+    let minted = MintedSecret {
+        plaintext: token.to_string(),
+        display_prefix: display_prefix(token),
+        token_sha256: Some(sha256_hex(token)),
+    };
+    // A revoked token keeps no secret, as after a real revoke.
+    let secret_ref = match state {
+        CredentialState::Revoked => None,
+        _ => {
+            let prepared = prepare_secret(org, credential_id, CredentialKind::Token, &minted)
+                .await
+                .unwrap();
+            let written = secrets::insert_prepared(rw, prepared).await.unwrap();
+            Some(written.metadata.secret_ref)
+        }
+    };
+    triggers::insert_credential(
+        rw,
+        CredentialRow {
+            id: credential_id.to_string(),
+            trigger_id: trigger_id.to_string(),
+            org_id: org.to_string(),
+            kind: CredentialKind::Token.as_str().to_string(),
+            display_prefix: minted.display_prefix,
+            token_sha256: minted.token_sha256,
+            secret_ref,
+            state: state.as_str().to_string(),
+            expires_at,
+            revoked_at: (state == CredentialState::Revoked).then_some(now),
+            created_by: "a@acme.io".to_string(),
+            created_at: now,
+            updated_at: now,
+            last_used_at: None,
+        },
+    )
+    .await
+    .unwrap();
+}
+
+pub async fn seed_signed_trigger(org: &str, name: &str) -> Seeded {
+    seed_signed_trigger_with(org, name, 1024 * 1024).await
+}
+
+/// A signature-mode trigger stored as a replicated snapshot stores it, secret encrypted locally.
+pub async fn seed_signed_trigger_with(org: &str, name: &str, max_body_bytes: i64) -> Seeded {
+    seed_org(org).await;
+    let workflow_id = format!("wf-{name}");
+    seed_workflow(org, &workflow_id, true).await;
+    let trigger_id = format!("trg{name}");
+    let minted = mint_signing_secret();
+    let now = now_micros();
+    let snapshot = TriggerSnapshot {
+        version: 1,
+        origin_cluster: "local".to_string(),
+        deleted: false,
+        trigger: ReplicatedTrigger {
+            id: trigger_id.clone(),
+            org_id: org.to_string(),
+            workflow_id: workflow_id.clone(),
+            enabled: true,
+            auth_mode: AuthMode::Signature,
+            max_body_bytes,
+            rate_limit_per_minute: 60,
+            created_by: "a@acme.io".to_string(),
+            created_at: now,
+            updated_at: now,
+            deleted_at: None,
+        },
+        credentials: vec![ReplicatedCredential {
+            id: format!("cred-{name}"),
+            kind: CredentialKind::SigningSecret,
+            display_prefix: minted.display_prefix.clone(),
+            token_sha256: None,
+            state: CredentialState::Active,
+            expires_at: None,
+            revoked_at: None,
+            created_by: "a@acme.io".to_string(),
+            created_at: now,
+            updated_at: now,
+            secret: Some(minted.plaintext.clone()),
+        }],
+    };
+    triggers::apply_snapshot(snapshot).await.unwrap();
+    Seeded {
+        org: org.to_string(),
+        trigger_id,
+        workflow_id,
+        secret: minted.plaintext,
+    }
+}
+
+pub fn trigger_row(org: &str, trigger_id: &str, workflow_id: &str, mode: AuthMode) -> TriggerRow {
+    let now = now_micros();
+    TriggerRow {
+        id: trigger_id.to_string(),
+        org_id: org.to_string(),
+        workflow_id: workflow_id.to_string(),
+        enabled: true,
+        auth_mode: mode.as_str().to_string(),
+        max_body_bytes: 1024 * 1024,
+        rate_limit_per_minute: 60,
+        created_by: "a@acme.io".to_string(),
+        created_at: now,
+        updated_at: now,
+        version: 1,
+        origin_cluster: "local".to_string(),
+        deleted_at: None,
+        last_invoked_at: None,
+        rejections: None,
+    }
+}
+
+pub async fn write_heartbeat() {
+    let beat = Heartbeat {
+        node_uuid: LOCAL_NODE.uuid.clone(),
+        ts: now_micros(),
+    };
+    infra::db::get_db()
+        .await
+        .put(
+            HEARTBEAT_KEY,
+            serde_json::to_vec(&beat).unwrap().into(),
+            NO_NEED_WATCH,
+            None,
+        )
+        .await
+        .unwrap();
+}
+
+pub async fn ledger_rows(seeded: &Seeded) -> usize {
+    ledger::list_for_workflow(
+        get_orm_client_rw().await,
+        &seeded.org,
+        &seeded.workflow_id,
+        0,
+        i64::MAX,
+        10_000,
+    )
+    .await
+    .unwrap()
+    .iter()
+    .filter(|r| r.trigger_id == seeded.trigger_id)
+    .count()
+}
+
+pub async fn run_row(
+    trigger_id: &str,
+    run_id: &str,
+) -> Option<infra::table::entity::workflow_http_trigger_requests::Model> {
+    ledger::get_run(get_orm_client_rw().await, trigger_id, run_id)
+        .await
+        .unwrap()
+}
+
+pub async fn seed_ledger_row(seeded: &Seeded, run_id: &str) {
+    let inserted = ledger::enqueue(
+        get_orm_client_rw().await,
+        NewHookRequest {
+            trigger_id: seeded.trigger_id.clone(),
+            org_id: seeded.org.clone(),
+            workflow_id: seeded.workflow_id.clone(),
+            run_id: run_id.to_string(),
+            idem_key: None,
+            body_sha256: "ab".repeat(32),
+            body_bytes: 2,
+            content_type: Some("application/json".to_string()),
+            meta: "{}".to_string(),
+            credential_id: "cred".to_string(),
+            credential_prefix: "o2wh_abcd…wxyz".to_string(),
+            caller_ip: "203.0.113.1".to_string(),
+            received_at: now_micros(),
+        },
+        r#"{"meta":{},"data":[]}"#.to_string(),
+    )
+    .await
+    .unwrap();
+    assert!(matches!(inserted, LedgerInsert::Inserted));
+}
+
+/// A password user in `org`; Basic auth reaches the management routes through `auth_middleware`.
+pub async fn seed_user(org: &str, email: &str, role: UserRole) {
+    seed_org(org).await;
+    let _ = users::add(users::UserRecord {
+        email: email.to_string(),
+        first_name: "T".to_string(),
+        last_name: "U".to_string(),
+        password: openobserve_core::auth::get_hash(PASSWORD, SALT),
+        salt: SALT.to_string(),
+        is_root: false,
+        password_ext: None,
+        user_type: UserType::Internal,
+        created_at: 0,
+        updated_at: 0,
+        must_reset_password: false,
+        password_reset_reason: None,
+        flagged_at: None,
+        password_updated_at: Some(now_micros()),
+    })
+    .await;
+    let _ = org_users::add(org, email, role, &format!("tok-{org}-{email}"), None).await;
+}
+
+pub fn as_user(
+    method: Method,
+    uri: &str,
+    email: &str,
+    body: Option<serde_json::Value>,
+) -> Request<Body> {
+    let basic = format!("Basic {}", base64::encode(&format!("{email}:{PASSWORD}")));
+    let mut headers = vec![("authorization", basic.as_str())];
+    if body.is_some() {
+        headers.push(("content-type", "application/json"));
+    }
+    let body = body.map_or_else(Body::empty, |b| Body::from(b.to_string()));
+    request(method, uri, "203.0.113.200", &headers, body)
+}
+
+/// Audit rows since the last drain; needs `O2_AUDIT_ENABLED` and a batch larger than the test.
+pub async fn drained_audits() -> Vec<serde_json::Value> {
+    o2_enterprise::enterprise::common::auditor::publish_existing_audits(
+        "_meta",
+        |request| async move {
+            let data = request.data.map(|d| d.data).unwrap_or_default();
+            let rows: Vec<serde_json::Value> = serde_json::from_slice(&data).unwrap_or_default();
+            AUDITS.lock().unwrap().extend(rows);
+            Ok(Default::default())
+        },
+    )
+    .await;
+    std::mem::take(&mut *AUDITS.lock().unwrap())
+}
+
+pub async fn claim_run(trigger_id: &str, run_id: &str, node: &str) {
+    let row = run_row(trigger_id, run_id).await.unwrap();
+    assert!(
+        ledger::claim(get_orm_client_rw().await, row.id, node, now_micros())
+            .await
+            .unwrap()
+    );
+}
+
+/// Reaps as a node that sees no live claimer, so every running row is reaped.
+pub async fn reap_runs() -> u64 {
+    let no_runs = Default::default();
+    let local = ledger::LocalClaims {
+        node_uuid: "",
+        in_flight: &no_runs,
+        stale_before_us: i64::MAX,
+    };
+    ledger::reap(
+        get_orm_client_rw().await,
+        &Default::default(),
+        local,
+        now_micros(),
+    )
+    .await
+    .unwrap()
+}
+
+pub async fn finish_queued_run(trigger_id: &str, run_id: &str, status: ledger::HookRunStatus) {
+    let row = run_row(trigger_id, run_id).await.unwrap();
+    assert!(
+        ledger::finish_unclaimed(
+            get_orm_client_rw().await,
+            row.id,
+            status,
+            None,
+            now_micros()
+        )
+        .await
+        .unwrap()
+    );
+}
+
+/// A ledger row for any trigger id, whether or not that trigger still has a row.
+pub async fn seed_run(org: &str, workflow_id: &str, trigger_id: &str, run_id: &str) {
+    let seeded = Seeded {
+        org: org.to_string(),
+        trigger_id: trigger_id.to_string(),
+        workflow_id: workflow_id.to_string(),
+        secret: String::new(),
+    };
+    seed_ledger_row(&seeded, run_id).await;
+}
+
+fn workflow(org: &str, id: &str, enabled: bool) -> Workflow {
+    serde_json::from_value(serde_json::json!({
+        "id": id,
+        "org_id": org,
+        "created_at": 0,
+        "updated_at": 0,
+        "created_by": "a@acme.io",
+        "enabled": enabled,
+        "name": id,
+        "description": "",
+        "nodes": [
+            {
+                "id": "trigger-1",
+                "data": {"node_type": "workflow_trigger"},
+                "position": {"x": 100, "y": 100},
+                "io_type": "input",
+            },
+            {
+                "id": "dest-1",
+                "data": {"node_type": "destination", "destination_id": "absent", "template_override": null},
+                "position": {"x": 400, "y": 100},
+                "io_type": "output",
+            },
+        ],
+        "edges": [{"id": "e1", "source": "trigger-1", "target": "dest-1"}],
+    }))
+    .unwrap()
+}
+
+fn set_env(key: &str, value: &str) {
+    // SAFETY: set once, inside the first boot, before any thread reads the config.
+    unsafe { std::env::set_var(key, value) };
+}
+
+fn stub_ui(_web_path: &str) -> Router {
+    Router::new()
+}
diff --git a/src/api/http/tests/workflow_hooks.rs b/src/api/http/tests/workflow_hooks.rs
new file mode 100644
index 0000000000..39e6240fe1
--- /dev/null
+++ b/src/api/http/tests/workflow_hooks.rs
@@ -0,0 +1,1287 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Own test binary: hooks on, no worker, a small per-IP budget; every case uses its own IP and org.
+
+#![cfg(feature = "enterprise")]
+#![allow(linker_messages)]
+
+#[path = "support/workflow_hooks.rs"]
+mod support;
+
+use axum::{
+    body::Body,
+    http::{Method, StatusCode},
+};
+use common::{infra::config::ORG_STATUS_CACHE, meta::organization::OrgStatus};
+use config::utils::time::now_micros;
+use db::workflow_http_triggers::{TRIGGER_KEY_PREFIX, notify_local};
+use infra::{
+    coordinator::get_coordinator,
+    db::get_orm_client_rw,
+    secrets::{self, SecretMaterial, SecretOwnerKind, SecretPurpose},
+    table::{
+        workflow_http_trigger_requests::{
+            self as ledger, HookRunStatus, LedgerInsert, NewHookRequest,
+        },
+        workflow_http_triggers::{self as triggers, CredentialState, TOMBSTONE_TTL_US},
+    },
+};
+use openobserve_core::workflows::http_trigger::{
+    credentials::{mint_signing_secret, sha256_hex},
+    sweeper,
+};
+use support::*;
+
+const ENV: &[(&str, &str)] = &[
+    ("O2_WORKFLOW_HOOKS_ENABLED", "true"),
+    ("ZO_WORKFLOW_HOOK_WORKER_DISABLED", "true"),
+    ("ZO_WORKFLOW_HOOK_IP_RPM", "200"),
+];
+const UNAUTHORIZED: &str = r#"{"code":401,"message":"Unauthorized","error_detail":"unauthorized"}"#;
+const BODY: &[u8] = br#"{"event":"deploy"}"#;
+const MIB: usize = 1024 * 1024;
+
+fn assert_uniform_401(reply: &Reply, case: &str) -> String {
+    assert_eq!(reply.status, StatusCode::UNAUTHORIZED, "{case}");
+    assert_eq!(
+        std::str::from_utf8(&reply.body).unwrap(),
+        UNAUTHORIZED,
+        "{case}"
+    );
+    reply
+        .header("www-authenticate")
+        .unwrap_or_else(|| panic!("{case}: no WWW-Authenticate"))
+        .to_string()
+}
+
+fn assert_reason(reply: &Reply, status: StatusCode, reason: &str) {
+    assert_eq!(reply.status, status, "{:?}", reply.json());
+    assert_eq!(reply.json()["error_detail"], reason, "{:?}", reply.json());
+    assert_eq!(reply.json()["code"], status.as_u16());
+}
+
+#[test]
+fn create_app_router_builds_with_workflow_hook_routes() {
+    run(ENV, async {
+        let reply = send(post_token(
+            "/api/v2/o/workflows/hooks/x",
+            "203.0.113.1",
+            "o2wh_x",
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_uniform_401(&reply, "unknown trigger on the real app");
+    });
+}
+
+#[test]
+fn prepare_secret_encrypts_under_the_org_dek() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let seeded = seed_token_trigger("prepsecret", "prepsecret").await;
+        let rw = get_orm_client_rw().await;
+        let row = triggers::list_credentials(rw, &seeded.trigger_id)
+            .await
+            .unwrap()
+            .remove(0);
+        assert_eq!(row.token_sha256, Some(sha256_hex(&seeded.secret)));
+        let secret_ref = row
+            .secret_ref
+            .clone()
+            .expect("a token row holds its secret_ref");
+        let held = secrets::list_for_owner(&seeded.org, SecretOwnerKind::WorkflowTrigger, &row.id)
+            .await
+            .unwrap();
+        assert_eq!(held.len(), 1);
+        assert_eq!(
+            (held[0].secret_ref.as_str(), held[0].purpose),
+            (secret_ref.as_str(), SecretPurpose::Auth)
+        );
+        let (_, material) = secrets::resolve_record(
+            &seeded.org,
+            &secret_ref,
+            SecretOwnerKind::WorkflowTrigger,
+            &row.id,
+            secrets::CURRENT,
+        )
+        .await
+        .unwrap();
+        assert!(matches!(material, SecretMaterial::Token { value } if value == seeded.secret));
+        let accepted = send(post_token(
+            &seeded.invoke_path(),
+            "203.0.113.90",
+            &seeded.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(
+            accepted.status,
+            StatusCode::ACCEPTED,
+            "{:?}",
+            accepted.json()
+        );
+    });
+}
+
+#[test]
+fn a_get_on_the_invoke_url_is_405() {
+    run(ENV, async {
+        let reply = send(get_token(
+            "/api/v2/o/workflows/hooks/x",
+            "203.0.113.2",
+            "o2wh_x",
+        ))
+        .await;
+        assert_eq!(reply.status, StatusCode::METHOD_NOT_ALLOWED);
+        let reply = send(request(
+            Method::PUT,
+            "/api/v2/o/workflows/hooks/x",
+            "203.0.113.2",
+            &[],
+            Body::empty(),
+        ))
+        .await;
+        assert_eq!(reply.status, StatusCode::METHOD_NOT_ALLOWED);
+    });
+}
+
+#[test]
+fn every_identity_failure_returns_the_same_401() {
+    run(ENV, async {
+        let ip = "203.0.113.3";
+        let a = seed_token_trigger("idn", "idA").await;
+        let expired = "o2wh_expiredExpiredExpiredExpiredExpiredExpi";
+        let revoked = "o2wh_revokedRevokedRevokedRevokedRevokedRevo";
+        add_token_credential(
+            &a.trigger_id,
+            "idn",
+            "cred-idA-exp",
+            expired,
+            CredentialState::Retiring,
+            Some(now_micros() - 1),
+        )
+        .await;
+        add_token_credential(
+            &a.trigger_id,
+            "idn",
+            "cred-idA-rev",
+            revoked,
+            CredentialState::Revoked,
+            None,
+        )
+        .await;
+        let tomb =
+            seed_token_trigger_with("idn", "idTomb", |row| row.deleted_at = Some(now_micros()))
+                .await;
+        seed_workflow("ghost", "wf-idGhost", true).await;
+        let ghost = seed_token_trigger_for("ghost", "idGhost", "wf-idGhost", |_| {}).await;
+        seed_org("idn2").await;
+        let signed = seed_signed_trigger("idn", "idSig").await;
+        let wrong_secret = mint_signing_secret().plaintext;
+
+        let cases = vec![
+            (
+                "unknown trigger",
+                post_token("/api/v2/idn/workflows/hooks/nope", ip, &a.secret, &[], BODY),
+            ),
+            (
+                "other org",
+                post_token(
+                    &format!("/api/v2/idn2/workflows/hooks/{}", a.trigger_id),
+                    ip,
+                    &a.secret,
+                    &[],
+                    BODY,
+                ),
+            ),
+            (
+                "tombstoned trigger",
+                post_token(&tomb.invoke_path(), ip, &tomb.secret, &[], BODY),
+            ),
+            (
+                "missing org row",
+                post_token(&ghost.invoke_path(), ip, &ghost.secret, &[], BODY),
+            ),
+            (
+                "missing credential",
+                request(Method::POST, &a.invoke_path(), ip, &[], Body::from(BODY)),
+            ),
+            (
+                "invalid token",
+                post_token(&a.invoke_path(), ip, "o2wh_wrong", &[], BODY),
+            ),
+            (
+                "expired credential",
+                post_token(&a.invoke_path(), ip, expired, &[], BODY),
+            ),
+            (
+                "revoked credential",
+                post_token(&a.invoke_path(), ip, revoked, &[], BODY),
+            ),
+            (
+                "token on a signed trigger",
+                post_token(&signed.invoke_path(), ip, &a.secret, &[], BODY),
+            ),
+            (
+                "bad signature",
+                signed_request(&signed.invoke_path(), ip, &wrong_secret, now_secs(), BODY),
+            ),
+            (
+                "stale timestamp",
+                signed_request(
+                    &signed.invoke_path(),
+                    ip,
+                    &signed.secret,
+                    now_secs() - 301,
+                    BODY,
+                ),
+            ),
+        ];
+        let mut challenges = Vec::new();
+        for (case, req) in cases {
+            challenges.push(assert_uniform_401(&send(req).await, case));
+        }
+        challenges.dedup();
+        assert_eq!(
+            challenges.len(),
+            1,
+            "one WWW-Authenticate for every case: {challenges:?}"
+        );
+        let ok = send(signed_request(
+            &signed.invoke_path(),
+            ip,
+            &signed.secret,
+            now_secs(),
+            BODY,
+        ))
+        .await;
+        assert_ne!(
+            ok.status,
+            StatusCode::UNAUTHORIZED,
+            "the control call verifies: {:?}",
+            ok.json()
+        );
+    });
+}
+
+#[test]
+fn an_org_being_deleted_answers_the_uniform_401() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.240";
+        for (org, status) in [
+            ("orgdel", OrgStatus::Deleting),
+            ("orgpend", OrgStatus::PendingDeletion),
+        ] {
+            let a = seed_token_trigger(org, &format!("{org}A")).await;
+            let run_id = format!("{org}-run");
+            seed_ledger_row(&a, &run_id).await;
+            ORG_STATUS_CACHE.insert(org.to_string(), status);
+            let dry_path = format!("{}?dry_run=true", a.invoke_path());
+            for (case, req) in [
+                (
+                    "invoke",
+                    post_token(&a.invoke_path(), ip, &a.secret, &[], BODY),
+                ),
+                ("dry run", post_token(&dry_path, ip, &a.secret, &[], BODY)),
+                (
+                    "run status",
+                    get_token(&a.poll_path(&run_id), ip, &a.secret),
+                ),
+            ] {
+                assert_uniform_401(&send(req).await, &format!("{org} {case}"));
+            }
+            assert_eq!(ledger_rows(&a).await, 1, "{org}: nothing new is queued");
+            ORG_STATUS_CACHE.remove(org);
+            let control = send(post_token(&a.invoke_path(), ip, &a.secret, &[], BODY)).await;
+            assert_eq!(
+                control.status,
+                StatusCode::ACCEPTED,
+                "{org}: the same call is accepted once the org is active: {:?}",
+                control.json()
+            );
+        }
+    });
+}
+
+#[test]
+fn credential_in_url_is_400_before_lookup() {
+    run(ENV, async {
+        let ip = "203.0.113.4";
+        let a = seed_token_trigger("ciu", "ciuA").await;
+        let existing = send(post_token(
+            &format!("{}?token=x", a.invoke_path()),
+            ip,
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_reason(&existing, StatusCode::BAD_REQUEST, "credential_in_url");
+        let unknown = send(post_token(
+            "/api/v2/ciu/workflows/hooks/nope?Api_Key=x",
+            ip,
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(
+            (unknown.status, &unknown.body),
+            (existing.status, &existing.body)
+        );
+        let in_path = send(post_token(
+            "/api/v2/ciu/workflows/hooks/o2wh_abc",
+            ip,
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_reason(&in_path, StatusCode::BAD_REQUEST, "credential_in_url");
+        let value = send(get_token(
+            &format!("{}?x=whsec_abc", a.poll_path("r")),
+            ip,
+            &a.secret,
+        ))
+        .await;
+        assert_reason(&value, StatusCode::BAD_REQUEST, "credential_in_url");
+        let key_param = send(post_token(
+            &format!("{}?key=deploy&dry_run=true", a.invoke_path()),
+            ip,
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(key_param.status, StatusCode::OK, "{:?}", key_param.json());
+    });
+}
+
+#[test]
+fn a_token_in_x_api_key_is_401() {
+    run(ENV, async {
+        let a = seed_token_trigger("xak", "xakA").await;
+        let req = request(
+            Method::POST,
+            &a.invoke_path(),
+            "203.0.113.5",
+            &[("x-api-key", &a.secret)],
+            Body::from(BODY),
+        );
+        assert_uniform_401(&send(req).await, "x-api-key");
+        let basic = format!("Basic {}", a.secret);
+        let req = request(
+            Method::POST,
+            &a.invoke_path(),
+            "203.0.113.5",
+            &[("authorization", &basic)],
+            Body::from(BODY),
+        );
+        assert_uniform_401(&send(req).await, "basic scheme");
+    });
+}
+
+#[test]
+fn a_session_cookie_alone_is_401() {
+    run(ENV, async {
+        let a = seed_token_trigger("cookie", "cookieA").await;
+        let cookie = format!("auth_tokens={}; auth_ext=x", a.secret);
+        let req = request(
+            Method::POST,
+            &a.invoke_path(),
+            "203.0.113.6",
+            &[("cookie", &cookie)],
+            Body::from(BODY),
+        );
+        assert_uniform_401(&send(req).await, "cookie");
+    });
+}
+
+#[test]
+fn preauth_answers_do_not_depend_on_the_trigger_id() {
+    run(ENV, async {
+        let ip = "198.51.100.200";
+        let a = seed_token_trigger("pre", "preA").await;
+        let unknown = "/api/v2/pre/workflows/hooks/nope".to_string();
+        let oversized = |path: &str| {
+            let len = (MIB + 1).to_string();
+            request(
+                Method::POST,
+                path,
+                "198.51.100.201",
+                &[("authorization", "Bearer o2wh_x"), ("content-length", &len)],
+                Body::from(BODY),
+            )
+        };
+        let big_existing = send(oversized(&a.invoke_path())).await;
+        let big_unknown = send(oversized(&unknown)).await;
+        assert_reason(
+            &big_existing,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+        );
+        assert_eq!(
+            (big_existing.status, &big_existing.body),
+            (big_unknown.status, &big_unknown.body)
+        );
+
+        let mut last = None;
+        for _ in 0..200 {
+            last = Some(
+                send(post_token(
+                    &format!("{}?secret=1", a.invoke_path()),
+                    ip,
+                    "o2wh_x",
+                    &[],
+                    BODY,
+                ))
+                .await
+                .status,
+            );
+        }
+        assert_eq!(last, Some(StatusCode::BAD_REQUEST));
+        let limited_existing = send(post_token(&a.invoke_path(), ip, &a.secret, &[], BODY)).await;
+        let limited_unknown = send(post_token(&unknown, ip, &a.secret, &[], BODY)).await;
+        assert_reason(
+            &limited_existing,
+            StatusCode::TOO_MANY_REQUESTS,
+            "rate_limited",
+        );
+        assert_eq!(
+            (limited_existing.status, &limited_existing.body),
+            (limited_unknown.status, &limited_unknown.body)
+        );
+        assert!(limited_existing.header("retry-after").is_some());
+        assert_eq!(
+            limited_existing.header("retry-after"),
+            limited_unknown.header("retry-after")
+        );
+    });
+}
+
+#[test]
+fn payload_too_large_ordering_in_both_modes() {
+    run(ENV, async {
+        let ip = "203.0.113.8";
+        let token = seed_token_trigger_with("ptl", "ptlTok", |row| row.max_body_bytes = 1024).await;
+        let big = vec![b'x'; 2048];
+        assert_uniform_401(
+            &send(post_token(
+                &token.invoke_path(),
+                ip,
+                "o2wh_wrong",
+                &[],
+                &big,
+            ))
+            .await,
+            "token mode checks the token first",
+        );
+        assert_reason(
+            &send(post_token(
+                &token.invoke_path(),
+                ip,
+                &token.secret,
+                &[],
+                &big,
+            ))
+            .await,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+        );
+
+        let signed = seed_signed_trigger_with("ptl", "ptlSig", 1024).await;
+        let wrong = mint_signing_secret().plaintext;
+        assert_reason(
+            &send(signed_request(
+                &signed.invoke_path(),
+                ip,
+                &wrong,
+                now_secs(),
+                &big,
+            ))
+            .await,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+        );
+        assert_reason(
+            &send(signed_request(
+                &signed.invoke_path(),
+                ip,
+                &signed.secret,
+                now_secs(),
+                &big,
+            ))
+            .await,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+        );
+        assert_uniform_401(
+            &send(signed_request(
+                &signed.invoke_path(),
+                ip,
+                &wrong,
+                now_secs(),
+                BODY,
+            ))
+            .await,
+            "signature mode under the cap",
+        );
+    });
+}
+
+#[test]
+fn a_body_over_the_trigger_cap_is_413_after_auth() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.9";
+        let a = seed_token_trigger_with("cap", "capA", |row| row.max_body_bytes = 1024).await;
+        let over = vec![b' '; 1025];
+        assert_reason(
+            &send(post_token(&a.invoke_path(), ip, &a.secret, &[], &over)).await,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+        );
+        let exact = vec![b' '; 1024];
+        let reply = send(post_token(&a.invoke_path(), ip, &a.secret, &[], &exact)).await;
+        assert_eq!(reply.status, StatusCode::ACCEPTED, "{:?}", reply.json());
+    });
+}
+
+#[test]
+fn a_content_length_over_one_mib_is_413() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.10";
+        let a = seed_token_trigger("clen", "clenA").await;
+        let len = (MIB + 1).to_string();
+        let req = request(
+            Method::POST,
+            &a.invoke_path(),
+            ip,
+            &[
+                ("authorization", &format!("Bearer {}", a.secret)),
+                ("content-length", &len),
+            ],
+            Body::from(BODY),
+        );
+        assert_reason(
+            &send(req).await,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+        );
+        let mut body = vec![b' '; MIB];
+        body[0] = b'"';
+        body[MIB - 1] = b'"';
+        let reply = send(post_token(&a.invoke_path(), ip, &a.secret, &[], &body)).await;
+        assert_eq!(
+            reply.status,
+            StatusCode::ACCEPTED,
+            "exactly the hard cap fits: {:?}",
+            reply.json()
+        );
+    });
+}
+
+#[test]
+fn a_chunked_body_over_one_mib_without_content_length_is_413() {
+    run(ENV, async {
+        let ip = "203.0.113.11";
+        let a = seed_token_trigger("chunk", "chunkA").await;
+        let chunks =
+            (0..17).map(|_| Ok::<_, std::io::Error>(bytes::Bytes::from(vec![b'x'; 64 * 1024])));
+        let body = Body::from_stream(futures::stream::iter(chunks));
+        let bearer = format!("Bearer {}", a.secret);
+        let req = request(
+            Method::POST,
+            &a.invoke_path(),
+            ip,
+            &[("authorization", &bearer)],
+            body,
+        );
+        assert!(req.headers().get("content-length").is_none());
+        assert_reason(
+            &send(req).await,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+        );
+        let signed = seed_signed_trigger("chunk", "chunkSig").await;
+        let chunks =
+            (0..17).map(|_| Ok::<_, std::io::Error>(bytes::Bytes::from(vec![b'x'; 64 * 1024])));
+        let ts = now_secs().to_string();
+        let req = request(
+            Method::POST,
+            &signed.invoke_path(),
+            ip,
+            &[
+                ("webhook-id", "msg_chunk"),
+                ("webhook-timestamp", &ts),
+                ("webhook-signature", "v1,AAAA"),
+            ],
+            Body::from_stream(futures::stream::iter(chunks)),
+        );
+        assert_reason(
+            &send(req).await,
+            StatusCode::PAYLOAD_TOO_LARGE,
+            "payload_too_large",
+        );
+    });
+}
+
+#[test]
+fn the_trigger_limit_answers_429_with_retry_after() {
+    run(ENV, async {
+        let ip = "203.0.113.12";
+        let a = seed_token_trigger_with("lim", "limA", |row| row.rate_limit_per_minute = 2).await;
+        let dry = format!("{}?dry_run=true", a.invoke_path());
+        for _ in 0..2 {
+            assert_eq!(
+                send(post_token(&dry, ip, &a.secret, &[], BODY))
+                    .await
+                    .status,
+                StatusCode::OK
+            );
+        }
+        let limited = send(post_token(&dry, ip, &a.secret, &[], BODY)).await;
+        assert_reason(&limited, StatusCode::TOO_MANY_REQUESTS, "rate_limited");
+        assert!(
+            limited
+                .header("retry-after")
+                .unwrap()
+                .parse::<u64>()
+                .unwrap()
+                >= 1
+        );
+        let polls: Vec<StatusCode> = futures::future::join_all(
+            (0..9).map(|_| send(get_token(&a.poll_path("none"), ip, &a.secret))),
+        )
+        .await
+        .into_iter()
+        .map(|r| r.status)
+        .collect();
+        assert_eq!(
+            polls
+                .iter()
+                .filter(|s| **s == StatusCode::NOT_FOUND)
+                .count(),
+            8,
+            "polls get four times the trigger limit: {polls:?}"
+        );
+        assert_eq!(
+            polls
+                .iter()
+                .filter(|s| **s == StatusCode::TOO_MANY_REQUESTS)
+                .count(),
+            1
+        );
+    });
+}
+
+#[test]
+fn a_dry_run_writes_nothing_and_counts_against_the_limit() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.13";
+        let a = seed_token_trigger_with("dry", "dryA", |row| row.rate_limit_per_minute = 1).await;
+        let reply = send(post_token(
+            &format!("{}?dry_run=true", a.invoke_path()),
+            ip,
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(reply.status, StatusCode::OK, "{:?}", reply.json());
+        assert_eq!(reply.json()["dry_run"], true);
+        assert_eq!(reply.json()["accepted"], true);
+        assert_eq!(ledger_rows(&a).await, 0, "a dry run writes no ledger row");
+        let next = send(post_token(&a.invoke_path(), ip, &a.secret, &[], BODY)).await;
+        assert_reason(&next, StatusCode::TOO_MANY_REQUESTS, "rate_limited");
+        assert_eq!(ledger_rows(&a).await, 0);
+    });
+}
+
+#[test]
+fn the_dry_run_input_has_the_hook_shape() {
+    run(ENV, async {
+        let a = seed_token_trigger("shape", "shapeA").await;
+        let reply = send(post_token(
+            &format!("{}?k=v&dry_run=true", a.invoke_path()),
+            "203.0.113.14",
+            &a.secret,
+            &[("x-o2-dry-run", "true"), ("x-custom", "dropped")],
+            BODY,
+        ))
+        .await;
+        assert_eq!(reply.status, StatusCode::OK, "{:?}", reply.json());
+        let input = &reply.json()["input"];
+        let meta = &input["meta"];
+        assert_eq!(meta["event_type"], "webhook");
+        assert_eq!(meta["trigger_source"], "http");
+        assert_eq!(meta["trigger_id"], a.trigger_id.as_str());
+        assert!(!meta["run_id"].as_str().unwrap().is_empty());
+        assert!(meta["received_at"].as_i64().unwrap() > 1_000_000_000_000_000);
+        assert_eq!(meta["query"], serde_json::json!({"k": "v"}));
+        assert_eq!(meta["headers"]["content-type"], "application/json");
+        assert!(meta["headers"].get("x-o2-dry-run").is_none());
+        assert!(meta["headers"].get("authorization").is_none());
+        assert!(meta["headers"].get("x-custom").is_none());
+        assert_eq!(input["data"], serde_json::json!([{"event": "deploy"}]));
+        assert_eq!(input.as_object().unwrap().len(), 2);
+    });
+}
+
+#[test]
+fn an_invoke_returns_202_with_location() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let a = seed_token_trigger("acc", "accA").await;
+        let reply = send(post_token(
+            &a.invoke_path(),
+            "203.0.113.15",
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(reply.status, StatusCode::ACCEPTED, "{:?}", reply.json());
+        let body = reply.json();
+        let run_id = body["run_id"].as_str().unwrap().to_string();
+        let status_url = format!(
+            "https://o2.example.com/api/v2/acc/workflows/hooks/{}/runs/{run_id}",
+            a.trigger_id
+        );
+        assert_eq!(
+            body,
+            serde_json::json!({"run_id": run_id, "status": "queued", "status_url": status_url})
+        );
+        assert_eq!(reply.header("location"), Some(status_url.as_str()));
+        let row = run_row(&a.trigger_id, &run_id).await.unwrap();
+        assert_eq!(row.status, "queued");
+        assert_eq!(row.credential_id, "cred-accA");
+        assert_eq!(row.caller_ip, "203.0.113.15");
+        assert_eq!(row.body_bytes, BODY.len() as i64);
+        let payload =
+            ledger::read_payload(get_orm_client_rw().await, "acc", &a.workflow_id, &run_id)
+                .await
+                .unwrap()
+                .unwrap();
+        let payload: serde_json::Value = serde_json::from_str(&payload).unwrap();
+        assert_eq!(payload["data"], serde_json::json!([{"event": "deploy"}]));
+        assert_eq!(payload["meta"]["run_id"], run_id.as_str());
+    });
+}
+
+#[test]
+fn an_alert_fired_workflow_accepts_http_runs_and_keeps_its_alert_link() {
+    run(ENV, async {
+        write_heartbeat().await;
+        seed_org("kind").await;
+        seed_alert_workflow("kind", "wf-kindA", "alert-kindA").await;
+        let before = kind_and_links("kind", "wf-kindA").await;
+        assert_eq!(
+            before,
+            (
+                Some("alert_fired".to_string()),
+                vec![(
+                    "alert-kindA".to_string(),
+                    "alert".to_string(),
+                    "AlertFired".to_string()
+                )]
+            )
+        );
+        let a = seed_token_trigger_for("kind", "kindA", "wf-kindA", |_| {}).await;
+        let dry = send(post_token(
+            &format!("{}?dry_run=true", a.invoke_path()),
+            "203.0.113.40",
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(dry.status, StatusCode::OK, "{:?}", dry.json());
+        assert_eq!(dry.json()["dry_run"], true);
+        assert_eq!(dry.json()["input"]["meta"]["trigger_source"], "http");
+        assert_eq!(dry.json()["input"]["meta"]["query"], serde_json::json!({}));
+        let reply = send(post_token(
+            &a.invoke_path(),
+            "203.0.113.40",
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(reply.status, StatusCode::ACCEPTED, "{:?}", reply.json());
+        let run_id = reply.json()["run_id"].as_str().unwrap().to_string();
+        let payload = ledger::read_payload(get_orm_client_rw().await, "kind", "wf-kindA", &run_id)
+            .await
+            .unwrap()
+            .unwrap();
+        let payload: serde_json::Value = serde_json::from_str(&payload).unwrap();
+        assert_eq!(payload["meta"]["trigger_source"], "http");
+        assert_eq!(payload["data"], serde_json::json!([{"event": "deploy"}]));
+        assert_eq!(kind_and_links("kind", "wf-kindA").await, before);
+    });
+}
+
+#[test]
+fn a_replay_returns_the_same_run_id_with_idempotent_replayed() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.16";
+        let a = seed_token_trigger("rep", "repA").await;
+        let key = [("idempotency-key", "deploy-42")];
+        let first = send(post_token(&a.invoke_path(), ip, &a.secret, &key, BODY)).await;
+        assert_eq!(first.status, StatusCode::ACCEPTED, "{:?}", first.json());
+        let again = send(post_token(&a.invoke_path(), ip, &a.secret, &key, BODY)).await;
+        assert_eq!(again.status, StatusCode::OK, "{:?}", again.json());
+        assert_eq!(again.json()["run_id"], first.json()["run_id"]);
+        assert_eq!(again.json()["status"], "queued");
+        assert_eq!(again.header("idempotent-replayed"), Some("true"));
+        assert_eq!(again.header("location"), first.header("location"));
+        assert_eq!(ledger_rows(&a).await, 1);
+    });
+}
+
+#[test]
+fn a_replay_of_an_expired_original_starts_a_new_run() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.17";
+        let a = seed_token_trigger("exp", "expA").await;
+        let key = [("idempotency-key", "deploy-43")];
+        let first = send(post_token(&a.invoke_path(), ip, &a.secret, &key, BODY)).await;
+        let first_run = first.json()["run_id"].as_str().unwrap().to_string();
+        let row = run_row(&a.trigger_id, &first_run).await.unwrap();
+        assert!(
+            ledger::finish_unclaimed(
+                get_orm_client_rw().await,
+                row.id,
+                HookRunStatus::Expired,
+                None,
+                now_micros()
+            )
+            .await
+            .unwrap()
+        );
+        let again = send(post_token(&a.invoke_path(), ip, &a.secret, &key, BODY)).await;
+        assert_eq!(again.status, StatusCode::ACCEPTED, "{:?}", again.json());
+        let second_run = again.json()["run_id"].as_str().unwrap().to_string();
+        assert_ne!(second_run, first_run);
+        assert!(again.header("idempotent-replayed").is_none());
+        assert_eq!(
+            run_row(&a.trigger_id, &first_run).await.unwrap().idem_key,
+            None
+        );
+        assert_eq!(
+            run_row(&a.trigger_id, &second_run)
+                .await
+                .unwrap()
+                .idem_key
+                .as_deref(),
+            Some("deploy-43")
+        );
+    });
+}
+
+#[test]
+fn the_same_key_with_a_different_body_is_422() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.18";
+        let a = seed_token_trigger("reuse", "reuseA").await;
+        let key = [("idempotency-key", "deploy-44")];
+        assert_eq!(
+            send(post_token(&a.invoke_path(), ip, &a.secret, &key, BODY))
+                .await
+                .status,
+            StatusCode::ACCEPTED
+        );
+        let other = send(post_token(
+            &a.invoke_path(),
+            ip,
+            &a.secret,
+            &key,
+            br#"{"event":"other"}"#,
+        ))
+        .await;
+        assert_reason(
+            &other,
+            StatusCode::UNPROCESSABLE_ENTITY,
+            "idempotency_key_reused",
+        );
+    });
+}
+
+#[test]
+fn an_invalid_idempotency_key_is_400() {
+    run(ENV, async {
+        let a = seed_token_trigger("badkey", "badkeyA").await;
+        let long = "k".repeat(256);
+        let reply = send(post_token(
+            &a.invoke_path(),
+            "203.0.113.19",
+            &a.secret,
+            &[("idempotency-key", &long)],
+            BODY,
+        ))
+        .await;
+        assert_reason(&reply, StatusCode::BAD_REQUEST, "invalid_idempotency_key");
+    });
+}
+
+#[test]
+fn a_disabled_endpoint_is_403() {
+    run(ENV, async {
+        let a = seed_token_trigger_with("off", "offA", |row| row.enabled = false).await;
+        let reply = send(post_token(
+            &a.invoke_path(),
+            "203.0.113.20",
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_reason(&reply, StatusCode::FORBIDDEN, "endpoint_disabled");
+        assert_eq!(
+            reply.json()["hint"],
+            "Turn the endpoint on in the workflow's HTTP endpoint settings"
+        );
+        let bad = send(post_token(
+            &a.invoke_path(),
+            "203.0.113.20",
+            "o2wh_wrong",
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_uniform_401(&bad, "403 only after a valid credential");
+    });
+}
+
+#[test]
+fn a_draft_only_workflow_is_403_not_published() {
+    run(ENV, async {
+        seed_org("draft").await;
+        seed_draft("draft", "wf-draftA").await;
+        let a = seed_token_trigger_for("draft", "draftA", "wf-draftA", |_| {}).await;
+        let reply = send(post_token(
+            &a.invoke_path(),
+            "203.0.113.21",
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_reason(&reply, StatusCode::FORBIDDEN, "workflow_not_published");
+    });
+}
+
+#[test]
+fn a_disabled_workflow_is_403() {
+    run(ENV, async {
+        seed_org("paused").await;
+        seed_workflow("paused", "wf-pausedA", false).await;
+        let a = seed_token_trigger_for("paused", "pausedA", "wf-pausedA", |_| {}).await;
+        let reply = send(post_token(
+            &a.invoke_path(),
+            "203.0.113.22",
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_reason(&reply, StatusCode::FORBIDDEN, "workflow_disabled");
+    });
+}
+
+#[test]
+fn the_status_poll_returns_the_stored_status() {
+    run(ENV, async {
+        let ip = "203.0.113.23";
+        let a = seed_token_trigger("poll", "pollA").await;
+        seed_ledger_row(&a, "run-poll-1").await;
+        let reply = send(get_token(&a.poll_path("run-poll-1"), ip, &a.secret)).await;
+        assert_eq!(reply.status, StatusCode::OK, "{:?}", reply.json());
+        let body = reply.json();
+        assert_eq!(body["run_id"], "run-poll-1");
+        assert_eq!(body["status"], "queued");
+        assert!(body["received_at"].as_i64().unwrap() > 0);
+        assert!(body["finished_at"].is_null());
+        assert!(body["error"].is_null());
+        assert!(body["idempotency_key"].is_null());
+        let row = run_row(&a.trigger_id, "run-poll-1").await.unwrap();
+        ledger::finish_unclaimed(
+            get_orm_client_rw().await,
+            row.id,
+            HookRunStatus::Failed,
+            Some("workflow_disabled"),
+            now_micros(),
+        )
+        .await
+        .unwrap();
+        let body = send(get_token(&a.poll_path("run-poll-1"), ip, &a.secret))
+            .await
+            .json();
+        assert_eq!(
+            (body["status"].as_str(), body["error"].as_str()),
+            (Some("failed"), Some("workflow_disabled"))
+        );
+        let missing = send(get_token(&a.poll_path("run-nope"), ip, &a.secret)).await;
+        assert_reason(&missing, StatusCode::NOT_FOUND, "run_not_found");
+        assert_uniform_401(
+            &send(get_token(&a.poll_path("run-poll-1"), ip, "o2wh_wrong")).await,
+            "poll with a bad token",
+        );
+    });
+}
+
+#[test]
+fn a_run_received_before_the_trigger_was_created_is_404() {
+    run(ENV, async {
+        let ip = "203.0.113.94";
+        let a = seed_token_trigger("prerev", "prerevA").await;
+        let rw = get_orm_client_rw().await;
+        let created_at = triggers::get(rw, &a.trigger_id)
+            .await
+            .unwrap()
+            .unwrap()
+            .created_at;
+        let old = NewHookRequest {
+            trigger_id: a.trigger_id.clone(),
+            org_id: a.org.clone(),
+            workflow_id: a.workflow_id.clone(),
+            run_id: "run-before-revive".to_string(),
+            idem_key: Some("old-key".to_string()),
+            body_sha256: "ab".repeat(32),
+            body_bytes: 2,
+            content_type: None,
+            meta: "{}".to_string(),
+            credential_id: "old-cred".to_string(),
+            credential_prefix: "o2wh_abcd…wxyz".to_string(),
+            caller_ip: "203.0.113.1".to_string(),
+            received_at: created_at - 1,
+        };
+        let inserted = ledger::enqueue(rw, old, "{}".to_string()).await.unwrap();
+        assert!(matches!(inserted, LedgerInsert::Inserted));
+        let reply = send(get_token(&a.poll_path("run-before-revive"), ip, &a.secret)).await;
+        assert_reason(&reply, StatusCode::NOT_FOUND, "run_not_found");
+    });
+}
+
+#[test]
+fn sweeping_a_tombstone_drops_its_cache_key() {
+    run(ENV, async {
+        let a = seed_token_trigger("sweepkey", "sweepkeyA").await;
+        let rw = get_orm_client_rw().await;
+        let long_ago = now_micros() - TOMBSTONE_TTL_US - 1_000_000;
+        triggers::tombstone_for_workflow(rw, &a.workflow_id, long_ago)
+            .await
+            .unwrap();
+        notify_local(&a.trigger_id).await.unwrap();
+        let key = format!("{TRIGGER_KEY_PREFIX}{}", a.trigger_id);
+        assert!(get_coordinator().await.get(&key).await.is_ok());
+        sweeper::sweep_tombstones(now_micros()).await.unwrap();
+        assert!(triggers::get(rw, &a.trigger_id).await.unwrap().is_none());
+        assert!(
+            get_coordinator().await.get(&key).await.is_err(),
+            "the swept trigger leaves no coordinator key behind"
+        );
+    });
+}
+
+#[test]
+fn another_triggers_run_is_404() {
+    run(ENV, async {
+        let ip = "203.0.113.24";
+        let a = seed_token_trigger("scope", "scopeA").await;
+        let b = seed_token_trigger("scope", "scopeB").await;
+        seed_ledger_row(&b, "run-of-b").await;
+        assert_reason(
+            &send(get_token(&a.poll_path("run-of-b"), ip, &a.secret)).await,
+            StatusCode::NOT_FOUND,
+            "run_not_found",
+        );
+        assert_eq!(
+            send(get_token(&b.poll_path("run-of-b"), ip, &b.secret))
+                .await
+                .status,
+            StatusCode::OK
+        );
+    });
+}
+
+#[test]
+fn a_credential_cannot_invoke_another_trigger() {
+    run(ENV, async {
+        let a = seed_token_trigger("cross", "crossA").await;
+        let b = seed_token_trigger("cross", "crossB").await;
+        assert_uniform_401(
+            &send(post_token(
+                &b.invoke_path(),
+                "203.0.113.25",
+                &a.secret,
+                &[],
+                BODY,
+            ))
+            .await,
+            "A's token on B",
+        );
+    });
+}
+
+#[test]
+fn a_credential_cannot_read_another_triggers_run() {
+    run(ENV, async {
+        let a = seed_token_trigger("crossread", "crossreadA").await;
+        let b = seed_token_trigger("crossread", "crossreadB").await;
+        seed_ledger_row(&b, "run-b").await;
+        assert_uniform_401(
+            &send(get_token(&b.poll_path("run-b"), "203.0.113.26", &a.secret)).await,
+            "A's token on B's poll",
+        );
+        assert_reason(
+            &send(get_token(&a.poll_path("run-b"), "203.0.113.26", &a.secret)).await,
+            StatusCode::NOT_FOUND,
+            "run_not_found",
+        );
+    });
+}
+
+#[test]
+fn a_signed_invoke_and_poll_are_accepted() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.27";
+        let s = seed_signed_trigger("sig", "sigA").await;
+        let reply = send(signed(
+            Method::POST,
+            &s.invoke_path(),
+            ip,
+            &s.secret,
+            "msg_sig_1",
+            now_secs(),
+            BODY,
+        ))
+        .await;
+        assert_eq!(reply.status, StatusCode::ACCEPTED, "{:?}", reply.json());
+        let run_id = reply.json()["run_id"].as_str().unwrap().to_string();
+        assert_eq!(
+            run_row(&s.trigger_id, &run_id)
+                .await
+                .unwrap()
+                .idem_key
+                .as_deref(),
+            Some("msg_sig_1")
+        );
+        let poll_path = s.poll_path(&run_id);
+        let poll = send(signed(
+            Method::GET,
+            &poll_path,
+            ip,
+            &s.secret,
+            "msg_poll_1",
+            now_secs(),
+            b"",
+        ))
+        .await;
+        assert_eq!(poll.status, StatusCode::OK, "{:?}", poll.json());
+        assert_eq!(poll.json()["idempotency_key"], "msg_sig_1");
+        let replay = send(signed(
+            Method::POST,
+            &s.invoke_path(),
+            ip,
+            &s.secret,
+            "msg_sig_1",
+            now_secs(),
+            BODY,
+        ))
+        .await;
+        assert_eq!(
+            replay.status,
+            StatusCode::OK,
+            "the webhook-id is the idempotency key"
+        );
+        assert_eq!(replay.json()["run_id"], run_id.as_str());
+    });
+}
+
+#[test]
+fn a_signed_poll_cannot_replay_as_an_invoke() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.28";
+        let s = seed_signed_trigger("sigx", "sigxA").await;
+        seed_ledger_row(&s, "run-x").await;
+        let poll_path = s.poll_path("run-x");
+        let poll = signed(
+            Method::GET,
+            &poll_path,
+            ip,
+            &s.secret,
+            "msg_x",
+            now_secs(),
+            b"",
+        );
+        let headers = poll.headers().clone();
+        let mut invoke = request(
+            Method::POST,
+            &s.invoke_path(),
+            ip,
+            &[],
+            Body::from(format!("GET {poll_path}")),
+        );
+        for name in ["webhook-id", "webhook-timestamp", "webhook-signature"] {
+            invoke.headers_mut().insert(name, headers[name].clone());
+        }
+        assert_uniform_401(&send(invoke).await, "a poll signature on the invoke URL");
+        let signed_invoke = signed(
+            Method::POST,
+            &s.invoke_path(),
+            ip,
+            &s.secret,
+            "msg_y",
+            now_secs(),
+            BODY,
+        );
+        let headers = signed_invoke.headers().clone();
+        let mut get = request(Method::GET, &poll_path, ip, &[], Body::empty());
+        for name in ["webhook-id", "webhook-timestamp", "webhook-signature"] {
+            get.headers_mut().insert(name, headers[name].clone());
+        }
+        assert_uniform_401(&send(get).await, "an invoke signature on the poll URL");
+    });
+}
+
+fn signed_request(
+    path: &str,
+    ip: &str,
+    secret: &str,
+    ts: i64,
+    body: &[u8],
+) -> axum::http::Request<Body> {
+    signed(
+        Method::POST,
+        path,
+        ip,
+        secret,
+        &format!("msg_{}", now_micros()),
+        ts,
+        body,
+    )
+}
diff --git a/src/api/http/tests/workflow_hooks_history.rs b/src/api/http/tests/workflow_hooks_history.rs
new file mode 100644
index 0000000000..39fa611277
--- /dev/null
+++ b/src/api/http/tests/workflow_hooks_history.rs
@@ -0,0 +1,134 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Own test binary: hooks on, no worker, audit off and no master key; no `triggers` stream exists.
+
+#![cfg(feature = "enterprise")]
+#![allow(linker_messages)]
+
+#[path = "support/workflow_hooks.rs"]
+mod support;
+
+use axum::http::{Method, StatusCode};
+use config::meta::user::UserRole;
+use infra::table::workflow_http_trigger_requests::HookRunStatus;
+use serde_json::{Value, json};
+use support::*;
+
+const ENV: &[(&str, &str)] = &[
+    ("O2_WORKFLOW_HOOKS_ENABLED", "true"),
+    ("ZO_WORKFLOW_HOOK_WORKER_DISABLED", "true"),
+    ("O2_AUDIT_ENABLED", "false"),
+];
+const ORG: &str = "hist";
+const ADMIN: &str = "admin@hist.io";
+
+async fn history(workflow_id: &str) -> Vec<Value> {
+    let reply = send(as_user(
+        Method::GET,
+        &format!("/api/{ORG}/workflows/{workflow_id}/history"),
+        ADMIN,
+        None,
+    ))
+    .await;
+    assert_eq!(reply.status, StatusCode::OK, "{:?}", reply.json());
+    reply.json().as_array().cloned().unwrap_or_default()
+}
+
+fn by_run<'a>(rows: &'a [Value], run_id: &str) -> &'a Value {
+    rows.iter()
+        .find(|row| row["run_id"] == run_id)
+        .unwrap_or_else(|| panic!("{run_id} missing from {rows:#?}"))
+}
+
+#[test]
+fn history_lists_queued_running_expired_and_worker_lost_rows() {
+    run(ENV, async {
+        seed_user(ORG, ADMIN, UserRole::Admin).await;
+        let seeded = seed_token_trigger(ORG, "hist1").await;
+        for run_id in ["r-queued", "r-running", "r-expired", "r-lost"] {
+            seed_ledger_row(&seeded, run_id).await;
+        }
+        claim_run(&seeded.trigger_id, "r-lost", "node-gone").await;
+        assert_eq!(reap_runs().await, 1);
+        claim_run(&seeded.trigger_id, "r-running", "node-a").await;
+        finish_queued_run(&seeded.trigger_id, "r-expired", HookRunStatus::Expired).await;
+
+        let rows = history(&seeded.workflow_id).await;
+        assert_eq!(rows.len(), 4, "{rows:#?}");
+        for (run_id, status, error) in [
+            ("r-queued", "queued", Value::Null),
+            ("r-running", "running", Value::Null),
+            ("r-expired", "expired", Value::Null),
+            ("r-lost", "failed", json!("worker_lost")),
+        ] {
+            let row = by_run(&rows, run_id);
+            assert_eq!(row["status"], status, "{run_id}");
+            assert_eq!(row["error"], error, "{run_id}");
+            assert_eq!(row["event_type"], "Webhook", "{run_id}");
+            assert_eq!(
+                row["source_id"],
+                format!("hook:{}", seeded.trigger_id),
+                "{run_id}"
+            );
+            let facts = &row["http_request"];
+            assert_eq!(facts["credential_prefix"], "o2wh_abcd…wxyz");
+            assert_eq!(facts["caller_ip"], "203.0.113.1");
+            assert_eq!(facts["content_type"], "application/json");
+            assert_eq!(facts["body_bytes"], 2);
+            assert_eq!(facts["status"], status);
+        }
+    });
+}
+
+#[test]
+fn ledger_rows_show_in_history_without_their_trigger_row() {
+    run(ENV, async {
+        seed_user(ORG, ADMIN, UserRole::Admin).await;
+        seed_workflow(ORG, "wf-swept", true).await;
+        seed_run(ORG, "wf-swept", "trgSweptAway", "r-old").await;
+        let rows = history("wf-swept").await;
+        assert_eq!(rows.len(), 1, "{rows:#?}");
+        assert_eq!(rows[0]["run_id"], "r-old");
+        assert_eq!(rows[0]["status"], "queued");
+    });
+}
+
+#[test]
+fn reveal_works_without_audit_or_encryption() {
+    run(ENV, async {
+        seed_user(ORG, ADMIN, UserRole::Admin).await;
+        seed_workflow(ORG, "wf-quiet", true).await;
+        let url = format!("/api/{ORG}/workflows/wf-quiet/http_trigger");
+        let created = send(as_user(
+            Method::PUT,
+            &url,
+            ADMIN,
+            Some(json!({"enabled": true, "auth_mode": "token"})),
+        ))
+        .await
+        .json();
+        assert_eq!(created["secrets_encrypted_at_rest"], false);
+        let id = created["credentials"][0]["id"].as_str().unwrap();
+        let reveal = send(as_user(
+            Method::GET,
+            &format!("{url}/credentials/{id}/secret"),
+            ADMIN,
+            None,
+        ))
+        .await;
+        assert_eq!(reveal.status, StatusCode::OK);
+    });
+}
diff --git a/src/api/http/tests/workflow_hooks_isolation.rs b/src/api/http/tests/workflow_hooks_isolation.rs
new file mode 100644
index 0000000000..259816d28f
--- /dev/null
+++ b/src/api/http/tests/workflow_hooks_isolation.rs
@@ -0,0 +1,181 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Own test binary: it sets the hook concurrency to one before the process reads its config.
+
+#![cfg(feature = "enterprise")]
+
+use std::time::Duration;
+
+use config::{cluster::LOCAL_NODE, utils::time::now_micros};
+use infra::{
+    db::get_orm_client_rw,
+    table::{
+        workflow_http_trigger_requests::{self as ledger, LedgerInsert, NewHookRequest},
+        workflows::{self, Workflow},
+    },
+};
+use openobserve_core::workflows::{http_trigger::worker, runtime, trigger_workflow};
+
+const ORG: &str = "acme";
+
+fn set_env(key: &str, value: &str) {
+    // SAFETY: the single test in this binary sets variables before reading config.
+    unsafe { std::env::set_var(key, value) };
+}
+
+async fn boot() {
+    let data_dir = std::env::temp_dir().join(format!("o2-hook-isolation-{}", std::process::id()));
+    std::fs::create_dir_all(data_dir.join("db")).unwrap();
+    let dir = format!("{}/", data_dir.display());
+    set_env("ZO_LOCAL_MODE", "true");
+    set_env("ZO_META_STORE", "sqlite");
+    set_env("ZO_DATA_DIR", &dir);
+    set_env("ZO_DATA_DB_DIR", &format!("{dir}db/"));
+    set_env("O2_WORKFLOWS_ENABLED", "true");
+    set_env("O2_WORKFLOW_HOOKS_ENABLED", "true");
+    set_env("ZO_WORKFLOW_HOOK_CONCURRENCY", "1");
+    infra::db::create_table().await.unwrap();
+    infra::db_init().await.unwrap();
+    infra::table::migrate().await.unwrap();
+}
+
+fn workflow(id: &str) -> Workflow {
+    serde_json::from_value(serde_json::json!({
+        "id": id,
+        "org_id": ORG,
+        "created_at": 0,
+        "updated_at": 0,
+        "created_by": "a@acme.io",
+        "enabled": true,
+        "name": id,
+        "description": "",
+        "nodes": [
+            {
+                "id": "trigger-1",
+                "data": {"node_type": "workflow_trigger"},
+                "position": {"x": 100, "y": 100},
+                "io_type": "input",
+            },
+            {
+                "id": "dest-1",
+                "data": {"node_type": "destination", "destination_id": "absent", "template_override": null},
+                "position": {"x": 400, "y": 100},
+                "io_type": "output",
+            },
+        ],
+        "edges": [{"id": "e1", "source": "trigger-1", "target": "dest-1"}],
+    }))
+    .unwrap()
+}
+
+fn hook_request(run_id: &str) -> NewHookRequest {
+    NewHookRequest {
+        trigger_id: "t1".to_string(),
+        org_id: ORG.to_string(),
+        workflow_id: "wf-hook".to_string(),
+        run_id: run_id.to_string(),
+        idem_key: None,
+        body_sha256: "cd".repeat(32),
+        body_bytes: 2,
+        content_type: Some("application/json".to_string()),
+        meta: "{}".to_string(),
+        credential_id: "c1".to_string(),
+        credential_prefix: "o2wh_abcd…wxyz".to_string(),
+        caller_ip: "203.0.113.7".to_string(),
+        received_at: now_micros(),
+    }
+}
+
+async fn status_of(run_id: &str) -> String {
+    ledger::get_run(get_orm_client_rw().await, "t1", run_id)
+        .await
+        .unwrap()
+        .unwrap()
+        .status
+}
+
+/// The hook lane holds its one slot with a running row and has more queued behind it.
+async fn saturate_the_hook_lane() {
+    let rw = get_orm_client_rw().await;
+    for run_id in ["hook-slow", "hook-queued-1", "hook-queued-2"] {
+        let inserted = ledger::enqueue(rw, hook_request(run_id), r#"{"meta":{},"data":[]}"#.into())
+            .await
+            .unwrap();
+        assert!(matches!(inserted, LedgerInsert::Inserted));
+    }
+    let slow = ledger::get_run(rw, "t1", "hook-slow")
+        .await
+        .unwrap()
+        .unwrap();
+    assert!(
+        ledger::claim(rw, slow.id, &LOCAL_NODE.uuid, now_micros())
+            .await
+            .unwrap()
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 4)]
+async fn a_manual_run_completes_while_the_hook_lane_is_saturated() {
+    boot().await;
+    workflows::save_workflow(workflow("wf-hook")).await.unwrap();
+    workflows::save_workflow(workflow("wf-manual"))
+        .await
+        .unwrap();
+    saturate_the_hook_lane().await;
+    tokio::spawn(runtime::watch_workflow_triggers());
+    tokio::spawn(worker::run_supervisor());
+
+    let mut beating = false;
+    for _ in 0..100 {
+        if worker::heartbeat_is_fresh().await {
+            beating = true;
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    assert!(
+        beating,
+        "the hook worker took the lock and writes its heartbeat"
+    );
+
+    let run = trigger_workflow(
+        ORG,
+        "wf-manual",
+        vec![serde_json::json!({"k": 1})],
+        "a@acme.io",
+    )
+    .await
+    .unwrap();
+    let mut finished = false;
+    for _ in 0..300 {
+        let pending = workflows::get_run_data(ORG, "wf-manual", &run.run_id)
+            .await
+            .unwrap();
+        if pending.is_none() {
+            finished = true;
+            break;
+        }
+        tokio::time::sleep(Duration::from_millis(100)).await;
+    }
+    assert!(
+        finished,
+        "the manual run never finished behind the full hook lane"
+    );
+
+    assert_eq!(status_of("hook-slow").await, "running");
+    assert_eq!(status_of("hook-queued-1").await, "queued");
+    assert_eq!(status_of("hook-queued-2").await, "queued");
+}
diff --git a/src/api/http/tests/workflow_hooks_manage.rs b/src/api/http/tests/workflow_hooks_manage.rs
new file mode 100644
index 0000000000..5ac229b87d
--- /dev/null
+++ b/src/api/http/tests/workflow_hooks_manage.rs
@@ -0,0 +1,577 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Own test binary: hooks on, audit on, a master key installed and OpenFGA off.
+
+#![cfg(feature = "enterprise")]
+#![allow(linker_messages)]
+
+#[path = "support/workflow_hooks.rs"]
+mod support;
+
+use axum::http::{Method, StatusCode};
+use config::meta::user::UserRole;
+use infra::{
+    secrets::{self, SecretMaterial, SecretOwnerKind},
+    table::{workflow_http_trigger_requests::HookRunStatus, workflow_http_triggers as triggers},
+};
+use openobserve_core::workflows::http_trigger::credentials::sha256_hex;
+use serde_json::{Value, json};
+use support::*;
+
+const ENV: &[(&str, &str)] = &[
+    ("O2_WORKFLOW_HOOKS_ENABLED", "true"),
+    ("ZO_WORKFLOW_HOOK_WORKER_DISABLED", "true"),
+    ("O2_AUDIT_ENABLED", "true"),
+    ("O2_AUDIT_BATCH_SIZE", "100000"),
+    (
+        "O2_MASTER_ENCRYPTION_KEY",
+        "CQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQkJCQ==",
+    ),
+];
+const ORG: &str = "mgmt";
+const ADMIN: &str = "admin@mgmt.io";
+const EDITOR: &str = "editor@mgmt.io";
+
+fn base(workflow_id: &str) -> String {
+    format!("/api/{ORG}/workflows/{workflow_id}/http_trigger")
+}
+
+async fn call(method: Method, uri: &str, email: &str, body: Option<Value>) -> Reply {
+    send(as_user(method, uri, email, body)).await
+}
+
+async fn setup(workflow_id: &str) {
+    seed_user(ORG, ADMIN, UserRole::Admin).await;
+    seed_user(ORG, EDITOR, UserRole::Editor).await;
+    seed_workflow(ORG, workflow_id, true).await;
+}
+
+/// Creates a token endpoint as the admin and returns the PUT reply.
+async fn create(workflow_id: &str) -> Reply {
+    setup(workflow_id).await;
+    let reply = call(
+        Method::PUT,
+        &base(workflow_id),
+        ADMIN,
+        Some(json!({"enabled": true, "auth_mode": "token"})),
+    )
+    .await;
+    assert_eq!(reply.status, StatusCode::CREATED, "{:?}", reply.json());
+    reply
+}
+
+async fn dry_run(org: &str, trigger_id: &str, token: &str) -> StatusCode {
+    let path = format!("/api/v2/{org}/workflows/hooks/{trigger_id}?dry_run=true");
+    send(post_token(&path, "203.0.113.9", token, &[], b"{}"))
+        .await
+        .status
+}
+
+fn credential_id(view: &Value) -> String {
+    view["credentials"][0]["id"].as_str().unwrap().to_string()
+}
+
+/// Cases share the audit queue, so each counts only the events on its own workflow.
+fn reveal_events(audits: &[Value], workflow_id: &str) -> Vec<Value> {
+    audits
+        .iter()
+        .filter(|row| {
+            row["http_body"]
+                .as_str()
+                .is_some_and(|body| body.contains("credential_revealed"))
+                && row["http_path"]
+                    .as_str()
+                    .is_some_and(|path| path.contains(&format!("/workflows/{workflow_id}/")))
+        })
+        .cloned()
+        .collect()
+}
+
+#[test]
+fn reveal_sets_no_store() {
+    run(ENV, async {
+        let created = create("wf-reveal").await.json();
+        let token = created["secret"].as_str().unwrap().to_string();
+        let id = credential_id(&created);
+        let reveal = call(
+            Method::GET,
+            &format!("{}/credentials/{id}/secret", base("wf-reveal")),
+            ADMIN,
+            None,
+        )
+        .await;
+        assert_eq!(reveal.status, StatusCode::OK);
+        assert_eq!(reveal.header("cache-control"), Some("no-store, private"));
+        let json = reveal.json();
+        assert_eq!(json["secret"], token);
+        assert_eq!(json["id"], id);
+        assert_eq!(json["kind"], "token");
+        assert_eq!(json["state"], "active");
+        assert_eq!(
+            json["display_prefix"],
+            created["credentials"][0]["display_prefix"]
+        );
+        let trigger_id = created["id"].as_str().unwrap();
+        assert_eq!(dry_run(ORG, trigger_id, &token).await, StatusCode::OK);
+    });
+}
+
+#[test]
+fn secret_bearing_mints_set_no_store() {
+    run(ENV, async {
+        let created = create("wf-nostore").await;
+        assert_eq!(created.header("cache-control"), Some("no-store, private"));
+        let update = call(
+            Method::PUT,
+            &base("wf-nostore"),
+            ADMIN,
+            Some(json!({"enabled": false, "auth_mode": "token", "rate_limit_per_minute": 5})),
+        )
+        .await;
+        assert_eq!(update.status, StatusCode::OK);
+        assert_eq!(update.json()["secret"], Value::Null);
+        assert_eq!(update.json()["rate_limit_per_minute"], 5);
+        assert_eq!(update.header("cache-control"), None);
+        let switch = call(
+            Method::PUT,
+            &base("wf-nostore"),
+            ADMIN,
+            Some(json!({"enabled": true, "auth_mode": "signature"})),
+        )
+        .await;
+        assert_eq!(switch.status, StatusCode::OK);
+        assert_eq!(switch.header("cache-control"), Some("no-store, private"));
+        assert!(
+            switch.json()["secret"]
+                .as_str()
+                .unwrap()
+                .starts_with("whsec_")
+        );
+        let rotate = call(
+            Method::POST,
+            &format!("{}/credentials", base("wf-nostore")),
+            ADMIN,
+            Some(json!({"overlap_seconds": 3600})),
+        )
+        .await;
+        assert_eq!(rotate.status, StatusCode::CREATED);
+        assert_eq!(rotate.header("cache-control"), Some("no-store, private"));
+        let rotated = rotate.json();
+        assert_eq!(rotated["kind"], "signing_secret");
+        assert_eq!(rotated["state"], "active");
+        assert!(rotated["secret"].as_str().unwrap().starts_with("whsec_"));
+        let again = call(
+            Method::POST,
+            &format!("{}/credentials", base("wf-nostore")),
+            ADMIN,
+            Some(json!({"overlap_seconds": 0})),
+        )
+        .await;
+        assert_eq!(again.status, StatusCode::CONFLICT);
+        assert_eq!(again.json()["error_detail"], "credential_retiring");
+    });
+}
+
+#[test]
+fn reveal_writes_one_audit_event_without_the_value() {
+    run(ENV, async {
+        let created = create("wf-audit").await.json();
+        let token = created["secret"].as_str().unwrap().to_string();
+        let id = credential_id(&created);
+        drained_audits().await;
+        let path = format!("{}/credentials/{id}/secret", base("wf-audit"));
+        assert_eq!(
+            call(Method::GET, &path, ADMIN, None).await.status,
+            StatusCode::OK
+        );
+        let audits = drained_audits().await;
+        assert!(
+            audits.iter().all(|row| !row.to_string().contains(&token)),
+            "an audit row carries the value"
+        );
+        let events = reveal_events(&audits, "wf-audit");
+        assert_eq!(events.len(), 1, "{audits:#?}");
+        let event = events[0].to_string();
+        for expected in [
+            ADMIN,
+            "credential_revealed",
+            created["id"].as_str().unwrap(),
+            id.as_str(),
+            created["credentials"][0]["display_prefix"]
+                .as_str()
+                .unwrap(),
+            &format!("{ORG}/workflows/wf-audit/http_trigger/credentials/{id}/secret"),
+        ] {
+            assert!(event.contains(expected), "{expected} missing from {event}");
+        }
+    });
+}
+
+#[test]
+fn a_denied_reveal_is_not_audited() {
+    run(ENV, async {
+        let created = create("wf-denied").await.json();
+        let id = credential_id(&created);
+        drained_audits().await;
+        let path = format!("{}/credentials/{id}/secret", base("wf-denied"));
+        assert_eq!(
+            call(Method::GET, &path, EDITOR, None).await.status,
+            StatusCode::FORBIDDEN
+        );
+        let missing = format!("{}/credentials/unknown/secret", base("wf-denied"));
+        assert_eq!(
+            call(Method::GET, &missing, ADMIN, None).await.status,
+            StatusCode::NOT_FOUND
+        );
+        assert!(reveal_events(&drained_audits().await, "wf-denied").is_empty());
+    });
+}
+
+/// OpenFGA off: every member may edit and test, only Admin/Root may obtain a credential value.
+#[test]
+fn a_member_cannot_reveal_or_mint_without_admin() {
+    run(ENV, async {
+        setup("wf-member").await;
+        let url = base("wf-member");
+        let body = json!({"enabled": true, "auth_mode": "token"});
+        let refused = call(Method::PUT, &url, EDITOR, Some(body.clone())).await;
+        assert_eq!(refused.status, StatusCode::FORBIDDEN);
+        assert_eq!(refused.json()["error_detail"], "credential_access_required");
+        let unconfigured = call(Method::GET, &url, EDITOR, None).await;
+        assert_eq!(unconfigured.status, StatusCode::NOT_FOUND);
+        assert_eq!(unconfigured.json()["error_detail"], "not_configured");
+        assert_eq!(
+            unconfigured.json()["permissions"],
+            json!({"edit": true, "test": true, "reveal": false})
+        );
+        let created = call(Method::PUT, &url, ADMIN, Some(body)).await.json();
+        let id = credential_id(&created);
+        assert_eq!(
+            created["permissions"],
+            json!({"edit": true, "test": true, "reveal": true})
+        );
+        let seen = call(Method::GET, &url, EDITOR, None).await;
+        assert_eq!(seen.status, StatusCode::OK);
+        assert_eq!(seen.json()["permissions"]["reveal"], false);
+        let reveal = format!("{url}/credentials/{id}/secret");
+        assert_eq!(
+            call(Method::GET, &reveal, EDITOR, None).await.status,
+            StatusCode::FORBIDDEN
+        );
+        let rotate = call(
+            Method::POST,
+            &format!("{url}/credentials"),
+            EDITOR,
+            Some(json!({"overlap_seconds": 0})),
+        )
+        .await;
+        assert_eq!(rotate.status, StatusCode::FORBIDDEN);
+        let switch = call(
+            Method::PUT,
+            &url,
+            EDITOR,
+            Some(json!({"enabled": true, "auth_mode": "signature"})),
+        )
+        .await;
+        assert_eq!(switch.status, StatusCode::FORBIDDEN);
+        let update = call(
+            Method::PUT,
+            &url,
+            EDITOR,
+            Some(json!({"enabled": false, "auth_mode": "token"})),
+        )
+        .await;
+        assert_eq!(update.status, StatusCode::OK);
+        let revoke = call(
+            Method::DELETE,
+            &format!("{url}/credentials/{id}"),
+            EDITOR,
+            None,
+        )
+        .await;
+        assert_eq!(revoke.status, StatusCode::NO_CONTENT);
+        assert_eq!(
+            call(Method::GET, &reveal, ADMIN, None).await.status,
+            StatusCode::NOT_FOUND
+        );
+        assert_eq!(
+            call(Method::DELETE, &url, EDITOR, None).await.status,
+            StatusCode::NO_CONTENT
+        );
+    });
+}
+
+#[test]
+fn minting_a_token_stores_it_encrypted_and_hashed() {
+    run(ENV, async {
+        let created = create("wf-stored").await.json();
+        let token = created["secret"].as_str().unwrap().to_string();
+        assert_eq!(created["secrets_encrypted_at_rest"], true);
+        let trigger_id = created["id"].as_str().unwrap();
+        let rw = infra::db::get_orm_client_rw().await;
+        let row = triggers::list_credentials(rw, trigger_id)
+            .await
+            .unwrap()
+            .remove(0);
+        assert_eq!(
+            row.token_sha256.as_deref(),
+            Some(sha256_hex(&token).as_str())
+        );
+        let secret_ref = row.secret_ref.clone().expect("a stored secret");
+        let (meta, material) = secrets::resolve_record(
+            ORG,
+            &secret_ref,
+            SecretOwnerKind::WorkflowTrigger,
+            &row.id,
+            secrets::CURRENT,
+        )
+        .await
+        .unwrap();
+        assert_eq!(meta.purpose, secrets::SecretPurpose::Auth);
+        assert!(matches!(material, SecretMaterial::Token { value } if value == token));
+    });
+}
+
+#[test]
+fn get_put_validation_and_not_configured() {
+    run(ENV, async {
+        setup("wf-valid").await;
+        let url = base("wf-valid");
+        let missing = call(Method::GET, &url, ADMIN, None).await;
+        assert_eq!(missing.status, StatusCode::NOT_FOUND);
+        let body = missing.json();
+        assert_eq!(body["error_detail"], "not_configured");
+        assert!(body["org_rate_limit_per_minute"].as_u64().is_some());
+        assert_eq!(body["secrets_encrypted_at_rest"], true);
+        for (payload, code) in [
+            (
+                json!({"enabled": true, "auth_mode": "basic"}),
+                "invalid_auth_mode",
+            ),
+            (
+                json!({"enabled": true, "auth_mode": "token", "max_body_bytes": 2_000_000}),
+                "invalid_limit",
+            ),
+            (
+                json!({"enabled": true, "auth_mode": "token", "rate_limit_per_minute": 1_000_000}),
+                "invalid_limit",
+            ),
+        ] {
+            let reply = call(Method::PUT, &url, ADMIN, Some(payload)).await;
+            assert_eq!(reply.status, StatusCode::BAD_REQUEST, "{code}");
+            assert_eq!(reply.json()["error_detail"], code);
+        }
+        let nowhere = call(
+            Method::PUT,
+            &base("wf-does-not-exist"),
+            ADMIN,
+            Some(json!({"enabled": true, "auth_mode": "token"})),
+        )
+        .await;
+        assert_eq!(nowhere.status, StatusCode::NOT_FOUND);
+        assert_eq!(nowhere.json()["error_detail"], "workflow_not_found");
+        seed_draft(ORG, "wf-draft-only").await;
+        let draft = call(
+            Method::PUT,
+            &base("wf-draft-only"),
+            ADMIN,
+            Some(json!({"enabled": true, "auth_mode": "token"})),
+        )
+        .await;
+        assert_eq!(draft.status, StatusCode::CREATED);
+    });
+}
+
+#[test]
+fn delete_then_invoke_401_and_recreate_revives_the_endpoint() {
+    run(ENV, async {
+        let created = create("wf-delete").await.json();
+        let token = created["secret"].as_str().unwrap().to_string();
+        let trigger_id = created["id"].as_str().unwrap().to_string();
+        let url = base("wf-delete");
+        assert_eq!(
+            call(Method::DELETE, &url, ADMIN, None).await.status,
+            StatusCode::NO_CONTENT
+        );
+        assert_eq!(
+            dry_run(ORG, &trigger_id, &token).await,
+            StatusCode::UNAUTHORIZED
+        );
+        assert_eq!(
+            call(Method::DELETE, &url, ADMIN, None).await.status,
+            StatusCode::NOT_FOUND
+        );
+        assert_eq!(
+            call(Method::GET, &url, ADMIN, None).await.status,
+            StatusCode::NOT_FOUND
+        );
+        let again = call(
+            Method::PUT,
+            &url,
+            ADMIN,
+            Some(json!({"enabled": true, "auth_mode": "token"})),
+        )
+        .await;
+        assert_eq!(again.status, StatusCode::CREATED);
+        let again = again.json();
+        assert_eq!(again["id"], trigger_id.as_str());
+        assert_eq!(again["credentials"].as_array().unwrap().len(), 1);
+        let fresh = again["secret"].as_str().unwrap();
+        assert_eq!(dry_run(ORG, &trigger_id, fresh).await, StatusCode::OK);
+        assert_eq!(
+            dry_run(ORG, &trigger_id, &token).await,
+            StatusCode::UNAUTHORIZED
+        );
+    });
+}
+
+#[test]
+fn a_revived_endpoint_cannot_read_runs_from_before_its_tombstone() {
+    run(ENV, async {
+        let created = create("wf-revive-runs").await.json();
+        let old = Seeded {
+            org: ORG.to_string(),
+            trigger_id: created["id"].as_str().unwrap().to_string(),
+            workflow_id: "wf-revive-runs".to_string(),
+            secret: created["secret"].as_str().unwrap().to_string(),
+        };
+        seed_ledger_row(&old, "run-before-delete").await;
+        finish_queued_run(
+            &old.trigger_id,
+            "run-before-delete",
+            HookRunStatus::Succeeded,
+        )
+        .await;
+        let poll = old.poll_path("run-before-delete");
+        let before = send(get_token(&poll, "203.0.113.95", &old.secret)).await;
+        assert_eq!(before.status, StatusCode::OK, "{:?}", before.json());
+        let url = base("wf-revive-runs");
+        assert_eq!(
+            call(Method::DELETE, &url, ADMIN, None).await.status,
+            StatusCode::NO_CONTENT
+        );
+        let again = call(
+            Method::PUT,
+            &url,
+            ADMIN,
+            Some(json!({"enabled": true, "auth_mode": "token"})),
+        )
+        .await
+        .json();
+        assert_eq!(
+            again["id"],
+            old.trigger_id.as_str(),
+            "the endpoint is revived"
+        );
+        let fresh = again["secret"].as_str().unwrap();
+        let after = send(get_token(&poll, "203.0.113.95", fresh)).await;
+        assert_eq!(after.status, StatusCode::NOT_FOUND, "{:?}", after.json());
+        assert_eq!(after.json()["error_detail"], "run_not_found");
+    });
+}
+
+#[test]
+fn the_list_marks_http_endpoint_enabled() {
+    run(ENV, async {
+        create("wf-listed").await;
+        seed_workflow(ORG, "wf-unlisted", true).await;
+        let list = call(
+            Method::GET,
+            &format!("/api/{ORG}/workflows?all_folders=true"),
+            ADMIN,
+            None,
+        )
+        .await;
+        assert_eq!(list.status, StatusCode::OK);
+        let items = list.json();
+        let flag = |id: &str| {
+            items
+                .as_array()
+                .unwrap()
+                .iter()
+                .find(|item| item["id"] == id)
+                .map(|item| item["http_endpoint_enabled"].clone())
+        };
+        assert_eq!(flag("wf-listed"), Some(Value::Bool(true)));
+        assert_eq!(flag("wf-unlisted"), Some(Value::Bool(false)));
+    });
+}
+
+#[test]
+fn the_test_route_runs_the_hook_shaped_input_with_destinations_suppressed() {
+    run(ENV, async {
+        let created = create("wf-test").await.json();
+        let destination = call(
+            Method::POST,
+            &format!("/api/{ORG}/alerts/destinations?module=pipeline"),
+            ADMIN,
+            Some(json!({"name": "absent", "url": "http://example.com/sink", "method": "post", "type": "http"})),
+        )
+        .await;
+        assert!(destination.status.is_success(), "{:?}", destination.json());
+        let reply = call(
+            Method::POST,
+            &format!("{}/test", base("wf-test")),
+            ADMIN,
+            Some(json!({"data": [{"event": "deploy"}]})),
+        )
+        .await;
+        assert_eq!(reply.status, StatusCode::OK, "{:?}", reply.json());
+        let body = reply.json().to_string();
+        assert!(body.contains("\"event_type\":\"webhook\""), "{body}");
+        assert!(body.contains("\"trigger_source\":\"http\""), "{body}");
+        assert!(body.contains(created["id"].as_str().unwrap()), "{body}");
+        assert!(body.contains("deploy"), "{body}");
+        assert!(body.contains("\"suppressed\":true"), "{body}");
+    });
+}
+
+#[test]
+fn revoking_a_credential_of_another_trigger_is_404() {
+    run(ENV, async {
+        let first = create("wf-scope-a").await.json();
+        create("wf-scope-b").await;
+        let foreign = credential_id(&first);
+        let reply = call(
+            Method::DELETE,
+            &format!("{}/credentials/{foreign}", base("wf-scope-b")),
+            ADMIN,
+            None,
+        )
+        .await;
+        assert_eq!(reply.status, StatusCode::NOT_FOUND);
+        assert_eq!(reply.json()["error_detail"], "credential_not_found");
+        let reveal = call(
+            Method::GET,
+            &format!("{}/credentials/{foreign}/secret", base("wf-scope-b")),
+            ADMIN,
+            None,
+        )
+        .await;
+        assert_eq!(reveal.status, StatusCode::NOT_FOUND);
+    });
+}
+
+#[test]
+fn config_exposes_workflow_hooks_enabled() {
+    run(ENV, async {
+        seed_user(ORG, ADMIN, UserRole::Admin).await;
+        let config = call(Method::GET, &format!("/api/{ORG}/config"), ADMIN, None).await;
+        assert_eq!(config.status, StatusCode::OK);
+        assert_eq!(config.json()["workflow_hooks_enabled"], true);
+        assert_eq!(config.json()["workflows_enabled"], true);
+    });
+}
diff --git a/src/api/http/tests/workflow_hooks_no_worker.rs b/src/api/http/tests/workflow_hooks_no_worker.rs
new file mode 100644
index 0000000000..25887cf141
--- /dev/null
+++ b/src/api/http/tests/workflow_hooks_no_worker.rs
@@ -0,0 +1,109 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Own test binary: hooks on and no worker heartbeat, so nothing may be enqueued.
+
+#![cfg(feature = "enterprise")]
+#![allow(linker_messages)]
+
+#[path = "support/workflow_hooks.rs"]
+mod support;
+
+use std::time::Duration;
+
+use axum::{
+    body::{Body, Bytes},
+    http::{Method, StatusCode},
+};
+use futures::StreamExt;
+use openobserve_api_management::request::workflows::hook_limits::LIMITERS;
+use support::*;
+
+const ENV: &[(&str, &str)] = &[
+    ("O2_WORKFLOW_HOOKS_ENABLED", "true"),
+    ("ZO_WORKFLOW_HOOK_WORKER_DISABLED", "true"),
+];
+const BODY: &[u8] = br#"{"event":"deploy"}"#;
+
+#[test]
+fn a_hook_without_a_live_worker_is_503_worker_unavailable() {
+    run(ENV, async {
+        let a = seed_token_trigger("nowork", "noworkA").await;
+        let reply = send(post_token(
+            &a.invoke_path(),
+            "203.0.113.40",
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(
+            reply.status,
+            StatusCode::SERVICE_UNAVAILABLE,
+            "{:?}",
+            reply.json()
+        );
+        assert_eq!(reply.json()["error_detail"], "worker_unavailable");
+        assert_eq!(reply.header("retry-after"), Some("30"));
+        assert_eq!(
+            ledger_rows(&a).await,
+            0,
+            "nothing is enqueued without a worker"
+        );
+        let dry = send(post_token(
+            &format!("{}?dry_run=true", a.invoke_path()),
+            "203.0.113.40",
+            &a.secret,
+            &[],
+            BODY,
+        ))
+        .await;
+        assert_eq!(dry.status, StatusCode::OK, "a dry run needs no worker");
+    });
+}
+
+#[test]
+fn a_stalled_body_releases_its_preauth_permit() {
+    run(ENV, async {
+        let full = LIMITERS.preauth.available_permits();
+        let signed = seed_signed_trigger("stall", "stallA").await;
+        let unknown = "/api/v2/stall/workflows/hooks/no-such-trigger".to_string();
+        for (path, expected) in [
+            (signed.invoke_path(), StatusCode::REQUEST_TIMEOUT),
+            (unknown, StatusCode::UNAUTHORIZED),
+        ] {
+            let first = futures::stream::once(async { Ok::<_, std::io::Error>(Bytes::from("{")) });
+            let stalled = Body::from_stream(first.chain(futures::stream::pending()));
+            let ts = now_secs().to_string();
+            let headers = [
+                ("content-type", "application/json"),
+                ("content-length", "65536"),
+                ("webhook-id", "msg_stalled"),
+                ("webhook-timestamp", ts.as_str()),
+                ("webhook-signature", "v1,c3RhbGxlZA=="),
+            ];
+            let req = request(Method::POST, &path, "203.0.113.93", &headers, stalled);
+            let reply = tokio::time::timeout(Duration::from_secs(20), send(req))
+                .await
+                .unwrap_or_else(|_| panic!("{path}: no answer within the body read deadline"));
+            assert_eq!(reply.status, expected, "{path}: {:?}", reply.json());
+        }
+        assert_eq!(
+            LIMITERS.preauth.available_permits(),
+            full,
+            "every pre-auth permit is back"
+        );
+    });
+}
diff --git a/src/api/http/tests/workflow_hooks_off.rs b/src/api/http/tests/workflow_hooks_off.rs
new file mode 100644
index 0000000000..8e71711b22
--- /dev/null
+++ b/src/api/http/tests/workflow_hooks_off.rs
@@ -0,0 +1,118 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Own test binary: workflows on, hooks off, so the hook routes are never registered.
+
+#![cfg(feature = "enterprise")]
+#![allow(linker_messages)]
+
+#[path = "support/workflow_hooks.rs"]
+mod support;
+
+use axum::{
+    body::Body,
+    http::{Method, StatusCode},
+};
+use config::meta::user::UserRole;
+use support::*;
+
+const ENV: &[(&str, &str)] = &[("O2_WORKFLOW_HOOKS_ENABLED", "false")];
+
+/// Unmatched `/api` paths fall to the authenticated plane, which answers before any route lookup.
+#[test]
+fn hook_routes_are_404_when_hooks_are_off() {
+    run(ENV, async {
+        for (method, path) in [
+            (Method::POST, "/api/v2/acme/workflows/hooks/t1?token=x"),
+            (
+                Method::GET,
+                "/api/v2/acme/workflows/hooks/t1/runs/r1?token=x",
+            ),
+        ] {
+            let reply = send(request(method, path, "203.0.113.42", &[], Body::empty())).await;
+            assert!(
+                matches!(
+                    reply.status,
+                    StatusCode::NOT_FOUND | StatusCode::UNAUTHORIZED
+                ),
+                "{path}: {}",
+                reply.status
+            );
+            assert!(
+                !String::from_utf8_lossy(&reply.body).contains("credential_in_url"),
+                "{path}: the hook handler answered"
+            );
+        }
+    });
+}
+
+/// The proxy auth layer also guards the fallback, so an unknown route answers as this control does.
+#[test]
+fn management_routes_are_404_when_hooks_are_off() {
+    run(ENV, async {
+        seed_user("acme", "admin@acme.io", UserRole::Admin).await;
+        seed_workflow("acme", "wf-off", true).await;
+        let control = send(as_user(
+            Method::GET,
+            "/api/acme/workflows/wf-off/no_such_route",
+            "admin@acme.io",
+            None,
+        ))
+        .await;
+        assert!(
+            matches!(
+                control.status,
+                StatusCode::NOT_FOUND | StatusCode::UNAUTHORIZED
+            ),
+            "{}",
+            control.status
+        );
+        let base = "/api/acme/workflows/wf-off/http_trigger";
+        let put = serde_json::json!({"enabled": true, "auth_mode": "token"});
+        for (method, path, body) in [
+            (Method::GET, base.to_string(), None),
+            (Method::PUT, base.to_string(), Some(put)),
+            (Method::DELETE, base.to_string(), None),
+            (
+                Method::POST,
+                format!("{base}/credentials"),
+                Some(serde_json::json!({"overlap_seconds": 0})),
+            ),
+            (Method::DELETE, format!("{base}/credentials/c1"), None),
+            (Method::GET, format!("{base}/credentials/c1/secret"), None),
+            (
+                Method::POST,
+                format!("{base}/test"),
+                Some(serde_json::json!({"data": []})),
+            ),
+        ] {
+            let reply = send(as_user(method.clone(), &path, "admin@acme.io", body)).await;
+            assert_eq!(
+                (reply.status, &reply.body),
+                (control.status, &control.body),
+                "{method} {path}"
+            );
+        }
+        let config = send(as_user(
+            Method::GET,
+            "/api/acme/config",
+            "admin@acme.io",
+            None,
+        ))
+        .await;
+        assert_eq!(config.status, StatusCode::OK);
+        assert_eq!(config.json()["workflow_hooks_enabled"], false);
+    });
+}
diff --git a/src/api/http/tests/workflow_hooks_queue_cap.rs b/src/api/http/tests/workflow_hooks_queue_cap.rs
new file mode 100644
index 0000000000..6b11d2a46a
--- /dev/null
+++ b/src/api/http/tests/workflow_hooks_queue_cap.rs
@@ -0,0 +1,105 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Own test binary: an org queue of one, a written heartbeat and no worker to drain the queue.
+
+#![cfg(feature = "enterprise")]
+#![allow(linker_messages)]
+
+#[path = "support/workflow_hooks.rs"]
+mod support;
+
+use axum::http::StatusCode;
+use support::*;
+
+const ENV: &[(&str, &str)] = &[
+    ("O2_WORKFLOW_HOOKS_ENABLED", "true"),
+    ("ZO_WORKFLOW_HOOK_WORKER_DISABLED", "true"),
+    ("ZO_WORKFLOW_HOOK_ORG_QUEUE_MAX", "1"),
+];
+const BODY: &[u8] = br#"{"event":"deploy"}"#;
+
+#[test]
+fn a_full_org_queue_answers_503_queue_full() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let ip = "203.0.113.41";
+        let a = seed_token_trigger("qcap", "qcapA").await;
+        let key = [("idempotency-key", "first")];
+        let first = send(post_token(&a.invoke_path(), ip, &a.secret, &key, BODY)).await;
+        assert_eq!(first.status, StatusCode::ACCEPTED, "{:?}", first.json());
+        let full = send(post_token(&a.invoke_path(), ip, &a.secret, &[], BODY)).await;
+        assert_eq!(
+            full.status,
+            StatusCode::SERVICE_UNAVAILABLE,
+            "{:?}",
+            full.json()
+        );
+        assert_eq!(full.json()["error_detail"], "queue_full");
+        assert_eq!(full.header("retry-after"), Some("30"));
+        let replay = send(post_token(&a.invoke_path(), ip, &a.secret, &key, BODY)).await;
+        assert_eq!(
+            replay.status,
+            StatusCode::OK,
+            "a replay is answered before the queue check"
+        );
+        assert_eq!(ledger_rows(&a).await, 1);
+    });
+}
+
+#[test]
+fn concurrent_calls_never_overshoot_the_org_queue() {
+    run(ENV, async {
+        write_heartbeat().await;
+        let a = seed_token_trigger("qcap2", "qcap2A").await;
+        let calls: Vec<_> = (0..8)
+            .map(|i| {
+                let key = format!("concurrent-{i}");
+                let req = post_token(
+                    &a.invoke_path(),
+                    "203.0.113.43",
+                    &a.secret,
+                    &[("idempotency-key", key.as_str())],
+                    BODY,
+                );
+                tokio::task::spawn(send(req))
+            })
+            .collect();
+        let mut statuses = Vec::new();
+        for call in calls {
+            let resp = call.await.unwrap();
+            if resp.status == StatusCode::SERVICE_UNAVAILABLE {
+                assert_eq!(
+                    resp.header("retry-after"),
+                    Some("30"),
+                    "every 503 queue_full"
+                );
+            }
+            statuses.push(resp.status);
+        }
+        let accepted = statuses
+            .iter()
+            .filter(|s| **s == StatusCode::ACCEPTED)
+            .count();
+        assert_eq!(accepted, 1, "{statuses:?}");
+        assert!(
+            statuses
+                .iter()
+                .all(|s| *s == StatusCode::ACCEPTED || *s == StatusCode::SERVICE_UNAVAILABLE),
+            "{statuses:?}"
+        );
+        assert_eq!(ledger_rows(&a).await, 1);
+    });
+}
diff --git a/src/api/management/src/models/datasets/mod.rs b/src/api/management/src/models/datasets/mod.rs
index 49ce9c6861..50438befe0 100644
--- a/src/api/management/src/models/datasets/mod.rs
+++ b/src/api/management/src/models/datasets/mod.rs
@@ -69,7 +69,10 @@ pub struct DatasetResponseBody {
     pub name: String,
     pub description: Option<String>,
     pub tags: Vec<String>,
+    /// Per-row MVCC counter: the value an Experiment pins and a Snapshot reads.
     pub global_version: i64,
+    /// The Dataset version to display: one per write request.
+    pub write_version: i64,
     /// Live (non-deleted) Items, counted once per logical Item rather than once
     /// per stored revision.
     pub item_count: i64,
@@ -115,8 +118,14 @@ impl From<ListDatasetItemsQuery> for ListDatasetItems {
 #[into_params(parameter_in = Query)]
 #[serde(deny_unknown_fields)]
 pub struct DatasetSnapshotRowsQuery {
-    /// Snapshot version to resolve. Defaults to the Dataset's current version.
+    /// Row-level Snapshot/pin key. When both this and `write_version` are
+    /// omitted, reads the Dataset's current row version.
     pub version: Option<i64>,
+    /// Displayed write version W to pin. Resolves to the highest row version
+    /// among rows whose write version is at or below W (labels and row versions
+    /// are separate counters); cannot be combined with `version`. Use the
+    /// returned `snapshotVersion` as the Experiment's `datasetVersion`.
+    pub write_version: Option<i64>,
     /// Zero-based result offset. Defaults to 0.
     pub from: Option<usize>,
     /// Page size from 1 through 100. Defaults to 20.
@@ -128,6 +137,7 @@ impl From<DatasetSnapshotRowsQuery> for ReadSnapshotRows {
         let defaults = ReadSnapshotRows::default();
         Self {
             snapshot_version: value.version,
+            write_version: value.write_version,
             from: value.from.unwrap_or(defaults.from),
             size: value.size.unwrap_or(defaults.size),
         }
@@ -251,6 +261,8 @@ pub struct DatasetItemResponseBody {
     pub input: Value,
     pub expected_output: Option<Value>,
     pub global_version: i64,
+    /// The Dataset version of the write request that stored this row.
+    pub write_version: i64,
     pub is_deleted: bool,
     pub source: DatasetItemSourceResponseBody,
     pub source_ref: Option<String>,
@@ -442,6 +454,7 @@ impl From<Dataset> for DatasetResponseBody {
             description: value.description,
             tags: value.tags,
             global_version: value.global_version,
+            write_version: value.write_version,
             item_count: value.item_count,
             sources: value.sources.into(),
             created_by: value.created_by,
@@ -558,6 +571,7 @@ impl From<DatasetItem> for DatasetItemResponseBody {
             input: value.input,
             expected_output: value.expected_output,
             global_version: value.global_version,
+            write_version: value.write_version,
             is_deleted: value.is_deleted,
             source: value.source.into(),
             source_ref: value.source_ref,
diff --git a/src/api/management/src/models/experiment_comparison.rs b/src/api/management/src/models/experiment_comparison.rs
index f7fda97322..705e8313c5 100644
--- a/src/api/management/src/models/experiment_comparison.rs
+++ b/src/api/management/src/models/experiment_comparison.rs
@@ -32,7 +32,8 @@ pub struct ExperimentComparisonQuery {
     pub baseline_id: String,
     pub candidate_id: String,
     pub threshold: Option<f64>,
-    /// Comma-separated dimension IDs; omitted selects all eligible columns, empty selects none.
+    /// Comma-separated dimension IDs; omitted selects every eligible Score column (cost and
+    /// latency gate only when listed), empty selects none.
     pub outcome_dimensions: Option<String>,
 }
 
diff --git a/src/api/management/src/models/experiments.rs b/src/api/management/src/models/experiments.rs
index 8b24de7dd2..177e4e7114 100644
--- a/src/api/management/src/models/experiments.rs
+++ b/src/api/management/src/models/experiments.rs
@@ -30,11 +30,11 @@ use openobserve_core::llm_evaluations::{
             RecordBatch, RecordBatchResult,
         },
         results::{
-            ExperimentAggregateSummary, ExperimentClientScoreSummary, ExperimentProgress,
-            ExperimentResultScore, ExperimentResultScoreStatus, ExperimentResultSlot,
-            ExperimentResultTaskStatus, ExperimentScoreOutcomes, ExperimentScoreSummary,
-            ExperimentSkipSummary, ExperimentSlotStatus, ExperimentSummaryStatus,
-            ExperimentTaskOutcomes, ScoringStatus,
+            ExperimentAggregateSummary, ExperimentClientScoreSummary, ExperimentFailureCause,
+            ExperimentProgress, ExperimentResultScore, ExperimentResultScoreStatus,
+            ExperimentResultSlot, ExperimentResultTaskStatus, ExperimentScoreOutcomes,
+            ExperimentScoreSummary, ExperimentSkipSummary, ExperimentSlotStatus,
+            ExperimentSummaryStatus, ExperimentTaskOutcomes, ScoringStatus,
         },
     },
 };
@@ -78,6 +78,8 @@ pub struct ExperimentResultRowBody {
     pub output: Option<Value>,
     pub score_summaries: Vec<ExperimentScoreSummaryBody>,
     pub p50_latency_ms: Option<u64>,
+    /// Sample message of the row's largest failure cause (grouped by kind, else by first line).
+    pub error_message: Option<String>,
     pub dispersion: Option<ExperimentRowDispersionBody>,
 }
 
@@ -1022,7 +1024,10 @@ pub struct ExperimentResponseBody {
     /// Resolved from the Dataset the experiment pinned, so callers do not have
     /// to fetch the Dataset list just to label a run. None when it was deleted.
     pub dataset_name: Option<String>,
+    /// The pinned `global_version`: the row cut every Slot reads.
     pub dataset_version: i64,
+    /// The Dataset version to display for that pin: one per write request.
+    pub dataset_write_version: i64,
     pub dataset_filter: Option<DatasetSnapshotFilterBody>,
     pub task: ExperimentTaskBody,
     pub scorers: Vec<PinnedExperimentScorerBody>,
@@ -1053,10 +1058,10 @@ impl ExperimentResponseBody {
         self.dataset_name = dataset_name;
         self
     }
-}
 
-impl From<Experiment> for ExperimentResponseBody {
-    fn from(value: Experiment) -> Self {
+    /// `dataset_write_version` is what the pin shows as, resolved by the
+    /// handler from the Dataset's rows.
+    pub fn new(value: Experiment, dataset_write_version: i64) -> Self {
         Self {
             id: value.id,
             org_id: value.org_id,
@@ -1065,6 +1070,7 @@ impl From<Experiment> for ExperimentResponseBody {
             dataset_id: value.dataset_id,
             dataset_name: None,
             dataset_version: value.dataset_version,
+            dataset_write_version,
             dataset_filter: value.dataset_filter.map(Into::into),
             task: value.task.into(),
             scorers: value.scorers.into_iter().map(Into::into).collect(),
@@ -1149,6 +1155,7 @@ pub struct ExperimentRowDetailResponseBody {
 pub struct ExperimentRowSnapshotBody {
     pub dataset_id: String,
     pub dataset_version: i64,
+    pub dataset_write_version: i64,
 }
 
 #[derive(Debug, Clone, Serialize, ToSchema)]
@@ -1404,6 +1411,31 @@ pub struct ExperimentAggregateSummaryBody {
     pub incomplete_task_slots: u64,
     pub incomplete_score_dimensions: u64,
     pub error_task_slots: u64,
+    /// Top 3 failure causes, largest first: errored slots grouped by kind, by first line if none.
+    pub failure_causes: Vec<ExperimentFailureCauseBody>,
+    /// Distinct failure causes across every errored slot.
+    pub failure_cause_count: u64,
+}
+
+#[derive(Debug, Clone, Serialize, ToSchema)]
+#[serde(rename_all = "camelCase")]
+pub struct ExperimentFailureCauseBody {
+    /// Shared failure taxonomy (`provider_auth`, `timeout`, `execution_error`, …); absent
+    /// when the producer did not classify the failure, including current SDK/client paths.
+    pub kind: Option<String>,
+    /// The group's most common first error line.
+    pub message: String,
+    pub slot_count: u64,
+}
+
+impl From<ExperimentFailureCause> for ExperimentFailureCauseBody {
+    fn from(value: ExperimentFailureCause) -> Self {
+        Self {
+            kind: value.kind,
+            message: value.message,
+            slot_count: value.slot_count,
+        }
+    }
 }
 
 impl From<ExperimentSlotStatus> for ExperimentSlotStatusBody {
@@ -1573,6 +1605,8 @@ impl From<ExperimentAggregateSummary> for ExperimentAggregateSummaryBody {
             incomplete_task_slots: value.incomplete_task_slots,
             incomplete_score_dimensions: value.incomplete_score_dimensions,
             error_task_slots: value.error_task_slots,
+            failure_causes: value.failure_causes.into_iter().map(Into::into).collect(),
+            failure_cause_count: value.failure_cause_count,
         }
     }
 }
@@ -1585,10 +1619,10 @@ pub struct CreateExperimentResponseBody {
     pub created: bool,
 }
 
-impl From<CreateExperimentResult> for CreateExperimentResponseBody {
-    fn from(value: CreateExperimentResult) -> Self {
+impl CreateExperimentResponseBody {
+    pub fn new(value: CreateExperimentResult, dataset_write_version: i64) -> Self {
         Self {
-            experiment: value.experiment.into(),
+            experiment: ExperimentResponseBody::new(value.experiment, dataset_write_version),
             preview: value.preview.into(),
             created: value.created,
         }
@@ -1769,37 +1803,40 @@ mod tests {
 
     #[test]
     fn execution_only_response_uses_explicit_execution_field_names() {
-        let body = ExperimentResponseBody::from(Experiment {
-            id: "experiment-1".to_string(),
-            org_id: "org-1".to_string(),
-            name: "Contract".to_string(),
-            description: None,
-            dataset_id: "dataset-1".to_string(),
-            dataset_version: 1,
-            dataset_filter: None,
-            task: ExperimentTaskConfig::Sdk {
-                task_fingerprint: "sha256:test".to_string(),
-                config: serde_json::json!({}),
+        let body = ExperimentResponseBody::new(
+            Experiment {
+                id: "experiment-1".to_string(),
+                org_id: "org-1".to_string(),
+                name: "Contract".to_string(),
+                description: None,
+                dataset_id: "dataset-1".to_string(),
+                dataset_version: 1,
+                dataset_filter: None,
+                task: ExperimentTaskConfig::Sdk {
+                    task_fingerprint: "sha256:test".to_string(),
+                    config: serde_json::json!({}),
+                },
+                scorers: Vec::new(),
+                trial_count: 1,
+                metadata: None,
+                status: ExperimentStatus::Completed,
+                status_reason: Some("done".to_string()),
+                deadline_at: 1,
+                completed_at: Some(2),
+                lifecycle_version: 1,
+                retry_count: 0,
+                scores_settled_at: Some(2),
+                idempotency_key: None,
+                is_baseline: false,
+                prompt_id: Some("prompt-1".to_string()),
+                prompt_name: Some("Support answer".to_string()),
+                prompt_version: Some(3),
+                prompt_content_hash: Some("sha256:content".to_string()),
+                created_by: "owner@example.com".to_string(),
+                created_at: 1,
             },
-            scorers: Vec::new(),
-            trial_count: 1,
-            metadata: None,
-            status: ExperimentStatus::Completed,
-            status_reason: Some("done".to_string()),
-            deadline_at: 1,
-            completed_at: Some(2),
-            lifecycle_version: 1,
-            retry_count: 0,
-            scores_settled_at: Some(2),
-            idempotency_key: None,
-            is_baseline: false,
-            prompt_id: Some("prompt-1".to_string()),
-            prompt_name: Some("Support answer".to_string()),
-            prompt_version: Some(3),
-            prompt_content_hash: Some("sha256:content".to_string()),
-            created_by: "owner@example.com".to_string(),
-            created_at: 1,
-        });
+            1,
+        );
 
         let value = serde_json::to_value(body).unwrap();
 
@@ -1831,6 +1868,7 @@ mod tests {
             dataset_id: "dataset-1".to_string(),
             dataset_name: Some("Dataset".to_string()),
             dataset_version: 1,
+            dataset_write_version: 1,
             dataset_filter: None,
             task: ExperimentTaskBody::Sdk {
                 task_fingerprint: "sha256:test".to_string(),
diff --git a/src/api/management/src/models/scorers/mod.rs b/src/api/management/src/models/scorers/mod.rs
index b40a8a1ac4..4de049e000 100644
--- a/src/api/management/src/models/scorers/mod.rs
+++ b/src/api/management/src/models/scorers/mod.rs
@@ -32,7 +32,11 @@ pub struct LlmJudgeScorerParams {
     pub provider_id: String,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub model: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[serde(
+        default,
+        skip_serializing_if = "Option::is_none",
+        deserialize_with = "deserialize_optional_f64"
+    )]
     pub temperature: Option<f64>,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub max_tokens: Option<u32>,
@@ -46,6 +50,25 @@ pub struct LlmJudgeScorerParams {
     pub extra_metadata_fields: Option<Vec<ExtraMetadataField>>,
 }
 
+/// Deserializes an optional float through `serde_json::Number`.
+///
+/// The workspace enables `serde_json/arbitrary_precision`, under which a
+/// non-integer number is handed to visitors as a private map. Inside an
+/// internally tagged enum (`#[serde(tag = "type")]`) that map is buffered and
+/// a plain `f64` field rejects it with `invalid type: map, expected f64`.
+/// `Number` understands both the buffered map and a plain number.
+fn deserialize_optional_f64<'de, D>(deserializer: D) -> Result<Option<f64>, D::Error>
+where
+    D: serde::Deserializer<'de>,
+{
+    Option::<serde_json::Number>::deserialize(deserializer)?
+        .map(|n| {
+            n.as_f64()
+                .ok_or_else(|| serde::de::Error::custom(format!("{n} is not a valid f64")))
+        })
+        .transpose()
+}
+
 #[derive(Clone, Debug, Serialize, Deserialize, PartialEq, ToSchema)]
 #[serde(rename_all = "snake_case", deny_unknown_fields)]
 pub struct RemoteScorerParams {
@@ -748,6 +771,54 @@ mod tests {
         );
     }
 
+    /// Issue #3143: with `serde_json/arbitrary_precision`, a float inside the
+    /// internally tagged scorer config used to fail with
+    /// `invalid type: map, expected f64`. Parse from raw JSON, as the HTTP
+    /// extractor does.
+    #[test]
+    fn test_llm_judge_scorer_accepts_float_temperature() {
+        let scorer_json = r#"{
+            "type": "llm_judge",
+            "producesScoreConfigVersion": 2,
+            "template": "Judge {{input}}",
+            "params": {
+                "provider_id": "p1",
+                "temperature": 0.1,
+                "max_tokens": 256,
+                "timeout_ms": 30000
+            }
+        }"#;
+
+        let create: ScorerRequestBody =
+            serde_json::from_str(&format!(r#"{{"name": "judge", "scorer": {scorer_json}}}"#))
+                .unwrap();
+        let scorer = infra::table::scorers::Scorer::from(create);
+        assert_eq!(scorer.params["temperature"].as_f64(), Some(0.1));
+        assert_eq!(scorer.params["max_tokens"].as_u64(), Some(256));
+        let stored: LlmJudgeScorerParams = serde_json::from_value(scorer.params).unwrap();
+        assert_eq!(stored.temperature, Some(0.1));
+
+        let update: ScorerUpdateRequestBody =
+            serde_json::from_str(&format!(r#"{{"scorer": {scorer_json}}}"#)).unwrap();
+        let ScorerUpdateConfig::LlmJudge(update) = update.scorer else {
+            panic!("expected llm_judge");
+        };
+        assert_eq!(update.params.temperature, Some(0.1));
+
+        let test: ScorerTestRequestBody = serde_json::from_str(&format!(
+            r#"{{"name": "judge", "scorer": {scorer_json}, "inputVariables": {{}}}}"#
+        ))
+        .unwrap();
+        let ScorerCreateConfig::LlmJudge(test) = test.scorer else {
+            panic!("expected llm_judge");
+        };
+        assert_eq!(test.params.temperature, Some(0.1));
+
+        let omitted: LlmJudgeScorerParams =
+            serde_json::from_str(r#"{"provider_id": "p1"}"#).unwrap();
+        assert_eq!(omitted.temperature, None);
+    }
+
     #[test]
     fn test_remote_scorer_request_deserialize_rejects_response_paths() {
         let result: Result<ScorerRequestBody, _> = serde_json::from_value(serde_json::json!({
diff --git a/src/api/management/src/request/ai/chat.rs b/src/api/management/src/request/ai/chat.rs
index 6bc3115545..d6cae41edb 100644
--- a/src/api/management/src/request/ai/chat.rs
+++ b/src/api/management/src/request/ai/chat.rs
@@ -156,6 +156,8 @@ impl ChatAudit {
                 trace_id: Some(self.trace_id.clone()),
             },
             delegated: self.delegated.clone(),
+            fleet_id: None,
+            target: None,
         }
     }
 
diff --git a/src/api/management/src/request/alerts/ack.rs b/src/api/management/src/request/alerts/ack.rs
index cf29f18d0a..040977f0b0 100644
--- a/src/api/management/src/request/alerts/ack.rs
+++ b/src/api/management/src/request/alerts/ack.rs
@@ -300,7 +300,7 @@ pub(crate) async fn act_on(
     }
 }
 
-/// The verb's answer as JSON: an `AckResponse`, or an `UnackResponse` for an unack.
+/// The verb's answer as JSON: an `AckResponse`, or an `UnackResponse` for a verb that clears.
 pub(crate) async fn act(
     problem: &Problem,
     actor: &str,
@@ -314,6 +314,7 @@ pub(crate) async fn act(
         Verb::HandOff => {
             serde_json::to_value(ack::release_for_hand_off(problem, actor, source).await?)
         }
+        Verb::Resolve => serde_json::to_value(ack::resolve(problem, actor, source, None).await?),
     };
     body.map_err(|e| AckError::Internal(e.to_string()))
 }
diff --git a/src/api/management/src/request/alerts/incidents.rs b/src/api/management/src/request/alerts/incidents.rs
index e560e9949e..c0ee8165e5 100644
--- a/src/api/management/src/request/alerts/incidents.rs
+++ b/src/api/management/src/request/alerts/incidents.rs
@@ -285,6 +285,9 @@ pub async fn update_incident(
             )
             .await
             {
+                Ok(incident) if status == IncidentStatus::Resolved => {
+                    end_ack_after_resolve(org_id, incident_id, &user_id, incident).await
+                }
                 Ok(incident) => MetaHttpResponse::json(incident),
                 Err(e) => {
                     if e.to_string().contains("not found") {
@@ -527,12 +530,12 @@ pub async fn trigger_incident_rca(
         return MetaHttpResponse::bad_request("RCA is not enabled");
     }
 
-    if !o2_cfg.ai.has_agent_target() {
+    if !openobserve_core::alerts::incidents::rca_agent_available() {
         return axum::response::Response::builder()
             .status(axum::http::StatusCode::SERVICE_UNAVAILABLE)
             .header(axum::http::header::CONTENT_TYPE, "application/json")
             .body(axum::body::Body::from(
-                serde_json::json!({"error": "RCA agent URL is not configured"}).to_string(),
+                serde_json::json!({"error": "RCA agent is not available"}).to_string(),
             ))
             .unwrap();
     }
@@ -755,6 +758,33 @@ fn json_status_response(status: axum::http::StatusCode, body: serde_json::Value)
         .unwrap()
 }
 
+/// A person resolved the incident: end the ack its alerts carry, then answer with the incident.
+#[cfg(feature = "enterprise")]
+async fn end_ack_after_resolve(
+    org_id: String,
+    incident_id: String,
+    actor: &str,
+    incident: impl Serialize,
+) -> Response {
+    use openobserve_core::alerts::ack::{self, Problem};
+
+    let problem = Problem::Incident {
+        org_id,
+        incident_id,
+    };
+    match ack::resolve(
+        &problem,
+        actor,
+        config::meta::alerts::ack::AckSource::Incident,
+        None,
+    )
+    .await
+    {
+        Ok(_) => MetaHttpResponse::json(incident),
+        Err(e) => crate::request::alerts::ack::error_response(e),
+    }
+}
+
 #[cfg(feature = "enterprise")]
 /// CancelIncidentRca
 #[utoipa::path(
@@ -1284,10 +1314,10 @@ async fn resume_run(
     if !o2_cfg.incidents.enabled || !o2_cfg.incidents.rca_enabled {
         return MetaHttpResponse::bad_request("RCA is not enabled");
     }
-    if !o2_cfg.ai.has_agent_target() {
+    if !openobserve_core::alerts::incidents::rca_agent_available() {
         return rca_error_response(
             StatusCode::SERVICE_UNAVAILABLE,
-            "RCA agent URL is not configured",
+            "RCA agent is not available",
             Some("agent_not_configured"),
             None,
         );
diff --git a/src/api/management/src/request/alerts/mod.rs b/src/api/management/src/request/alerts/mod.rs
index d2cbf1dc73..f93021327f 100644
--- a/src/api/management/src/request/alerts/mod.rs
+++ b/src/api/management/src/request/alerts/mod.rs
@@ -3738,7 +3738,7 @@ pub async fn enable_alert_bulk(
     tag = "Alerts",
     operation_id = "TriggerAlert",
     summary = "Manually trigger alert",
-    description = "Manually triggers an alert to test its functionality and notification delivery. Useful for testing alert configurations, verifying notification channels, and ensuring alerts work as expected before relying on them for monitoring. For an anomaly detection alert it runs detection now and returns `message`, `claim_lost`, `ineligible`, `anomaly_id`, `anomalies_found`, `points_scored` and `anomalies`; `claim_lost: true` means another detection run for this alert is in progress, and `ineligible: true` means the detector is disabled or untrained (`message` says which), so nothing was scored.",
+    description = "Manually triggers an alert to test its functionality and notification delivery. Useful for testing alert configurations, verifying notification channels, and ensuring alerts work as expected before relying on them for monitoring. When a destination or the on-call page could not be delivered, the response also carries `warning` with the reason. For an anomaly detection alert it runs detection now and returns `message`, `claim_lost`, `ineligible`, `anomaly_id`, `anomalies_found`, `points_scored` and `anomalies`; `claim_lost: true` means another detection run for this alert is in progress, and `ineligible: true` means the detector is disabled or untrained (`message` says which), so nothing was scored.",
     security(
         ("Authorization"= [])
     ),
@@ -3779,7 +3779,14 @@ pub async fn trigger_alert(
     }
     let client = get_orm_client_ro().await;
     match alert::trigger_by_id(client, &org_id, alert_id).await {
-        Ok(triggered) => MetaHttpResponse::ok(triggered.response_message()),
+        Ok(triggered) => match triggered.warning() {
+            Some(warning) => MetaHttpResponse::json(serde_json::json!({
+                "code": 200,
+                "message": triggered.response_message(),
+                "warning": warning,
+            })),
+            None => MetaHttpResponse::ok(triggered.response_message()),
+        },
         Err(AlertError::AlertNotFound) => {
             if let Some(_composite) =
                 openobserve_core::alerts::composite::get_composite(&org_id, &alert_id.to_string())
diff --git a/src/api/management/src/request/datasets/mod.rs b/src/api/management/src/request/datasets/mod.rs
index 5c2fa997f0..96ee57482a 100644
--- a/src/api/management/src/request/datasets/mod.rs
+++ b/src/api/management/src/request/datasets/mod.rs
@@ -134,7 +134,7 @@ pub async fn list_dataset_items(
     tag = "Datasets",
     operation_id = "GetDatasetSnapshotRows",
     summary = "Read the row set of a pinned Dataset Snapshot",
-    description = "Resolves the Dataset's MVCC history at `version` and returns one page of the live rows that Snapshot contains. Omitting `version` reads the current Snapshot and answers with the version it resolved. This is the read an Experiment pins at creation, so it is also how a client inspects the exact rows a historical Experiment ran against.",
+    description = "Resolves the Dataset's MVCC history at row-level `version` and returns one page of live rows. Alternatively, `write_version` W resolves to the highest row version among rows whose write version is at or below W; write versions and row versions are separate counters. Omitting both reads the current Snapshot. The response's `snapshotVersion` is always a row-level pin key: use it as the Experiment's `datasetVersion`. Existing pins and `version` reads retain their original semantics.",
     security(("Authorization" = [])),
     params(
         ("org_id" = String, Path, description = "Organization name"),
diff --git a/src/api/management/src/request/experiments.rs b/src/api/management/src/request/experiments.rs
index c8f63d3cbb..9692fffe63 100644
--- a/src/api/management/src/request/experiments.rs
+++ b/src/api/management/src/request/experiments.rs
@@ -90,6 +90,29 @@ impl ScorerSelection<'_> {
     }
 }
 
+/// What an Experiment's pinned `global_version` shows as. When the Dataset's
+/// rows cannot be read the pin shows as itself, as it does for a deleted
+/// Dataset; the response describes an action that already happened.
+async fn pinned_write_version(org_id: &str, dataset_id: &str, pin: i64) -> i64 {
+    datasets::pinned_write_version(org_id, dataset_id, pin)
+        .await
+        .unwrap_or_else(|error| {
+            log::error!(
+                "[Experiment] failed to resolve the write version of Dataset {dataset_id} at {pin}: {error}"
+            );
+            pin
+        })
+}
+
+async fn experiment_body(
+    org_id: &str,
+    experiment: experiments::Experiment,
+) -> ExperimentResponseBody {
+    let shown =
+        pinned_write_version(org_id, &experiment.dataset_id, experiment.dataset_version).await;
+    ExperimentResponseBody::new(experiment, shown)
+}
+
 fn experiment_error_response(error: ExperimentError) -> Response {
     match error {
         ExperimentError::Database(error) => {
@@ -333,6 +356,11 @@ fn experiment_result_rows(
                     score_configs,
                 ),
                 p50_latency_ms: aggregate.p50_latency_ms,
+                error_message: aggregate
+                    .failure_causes
+                    .into_iter()
+                    .next()
+                    .map(|cause| cause.message),
                 dispersion: dispersions.remove(&first.row_id).map(Into::into),
             })
         })
@@ -602,7 +630,13 @@ pub async fn create_experiment(
     match experiments::create(&org_id, &user.user_id, input, &canonical_request).await {
         Ok(result) => {
             set_ownership(&org_id, "experiments", Authz::new(&result.experiment.id)).await;
-            MetaHttpResponse::json(CreateExperimentResponseBody::from(result))
+            let shown = pinned_write_version(
+                &org_id,
+                &result.experiment.dataset_id,
+                result.experiment.dataset_version,
+            )
+            .await;
+            MetaHttpResponse::json(CreateExperimentResponseBody::new(result, shown))
         }
         Err(error) => experiment_error_response(error),
     }
@@ -636,15 +670,8 @@ pub async fn list_experiments(
         Ok(list) => list,
         Err(error) => return MetaHttpResponse::forbidden(error.to_string()),
     };
-    // One Dataset query for the whole list — a lookup per experiment would be N+1.
-    let dataset_names: std::collections::HashMap<String, String> = datasets::list(&org_id)
-        .await
-        .map(|list| {
-            list.into_iter()
-                .map(|dataset| (dataset.id, dataset.name))
-                .collect()
-        })
-        .unwrap_or_default();
+    // One names-only Dataset query for the whole list — no per-experiment lookups or aggregates.
+    let dataset_names = datasets::list_names(&org_id).await.unwrap_or_default();
     let dataset_id = query
         .dataset_id
         .as_deref()
@@ -700,14 +727,27 @@ pub async fn list_experiments(
     } else {
         Vec::new()
     };
+    // One query for every pin in the list, not one per experiment.
+    let pins: Vec<(String, i64)> = experiments
+        .iter()
+        .map(|experiment| (experiment.dataset_id.clone(), experiment.dataset_version))
+        .collect();
+    let shown_versions = datasets::pinned_write_versions(&org_id, &pins)
+        .await
+        .unwrap_or_else(|error| {
+            log::error!("[Experiment] failed to resolve pinned Dataset write versions: {error}");
+            HashMap::new()
+        });
     MetaHttpResponse::json(ListExperimentsResponseBody {
         list: experiments
             .into_iter()
             .map(|experiment| {
                 let id = experiment.id.clone();
                 let dataset_name = dataset_names.get(&experiment.dataset_id).cloned();
+                let pin = (experiment.dataset_id.clone(), experiment.dataset_version);
+                let shown = shown_versions.get(&pin).copied().unwrap_or(pin.1);
                 ExperimentViewResponseBody {
-                    experiment: ExperimentResponseBody::from(experiment)
+                    experiment: ExperimentResponseBody::new(experiment, shown)
                         .with_dataset_name(dataset_name),
                     summary: include_summary.then(|| {
                         experiment_summary_body(
@@ -877,9 +917,12 @@ pub async fn get_experiment(
         summaries.remove(&experiment.id).unwrap_or_default(),
         &score_configs,
     );
+    let shown =
+        pinned_write_version(&org_id, &experiment.dataset_id, experiment.dataset_version).await;
     MetaHttpResponse::json(ExperimentDetailResponseBody {
         experiment: ExperimentViewResponseBody {
-            experiment: ExperimentResponseBody::from(experiment).with_dataset_name(dataset_name),
+            experiment: ExperimentResponseBody::new(experiment, shown)
+                .with_dataset_name(dataset_name),
             summary: Some(summary),
         },
         preview: preview.into(),
@@ -1231,11 +1274,14 @@ pub async fn get_experiment_row(
         .slots
         .first()
         .expect("a resolved Experiment row always contains at least one trial");
+    let dataset_write_version =
+        pinned_write_version(&org_id, &experiment.dataset_id, experiment.dataset_version).await;
     let response = ExperimentRowDetailResponseBody {
         experiment_id: experiment.id,
         snapshot: ExperimentRowSnapshotBody {
             dataset_id: experiment.dataset_id,
             dataset_version: experiment.dataset_version,
+            dataset_write_version,
         },
         navigation: ExperimentRowNavigationBody {
             row_index: row.row_index,
@@ -1279,7 +1325,7 @@ pub async fn get_experiment_row(
 )]
 pub async fn cancel_experiment(Path((org_id, experiment_id)): Path<(String, String)>) -> Response {
     match experiments::cancel(&org_id, &experiment_id).await {
-        Ok(experiment) => MetaHttpResponse::json(ExperimentResponseBody::from(experiment)),
+        Ok(experiment) => MetaHttpResponse::json(experiment_body(&org_id, experiment).await),
         Err(error) => experiment_error_response(error),
     }
 }
@@ -1314,7 +1360,7 @@ pub async fn set_experiment_baseline(
     }
     match baseline::set_baseline(&org_id, &experiment_id, &user.user_id).await {
         Ok(change) => MetaHttpResponse::json(ExperimentBaselineResponseBody {
-            experiment: ExperimentResponseBody::from(change.experiment),
+            experiment: experiment_body(&org_id, change.experiment).await,
             previous_baseline_id: change.previous_baseline_id,
         }),
         Err(error) => experiment_error_response(error),
@@ -1349,7 +1395,7 @@ pub async fn clear_experiment_baseline(
         return response;
     }
     match baseline::clear_baseline(&org_id, &experiment_id, &user.user_id).await {
-        Ok(experiment) => MetaHttpResponse::json(ExperimentResponseBody::from(experiment)),
+        Ok(experiment) => MetaHttpResponse::json(experiment_body(&org_id, experiment).await),
         Err(error) => experiment_error_response(error),
     }
 }
@@ -1433,7 +1479,7 @@ pub async fn retry_experiment(
     )
     .await
     {
-        Ok(experiment) => MetaHttpResponse::json(ExperimentResponseBody::from(experiment)),
+        Ok(experiment) => MetaHttpResponse::json(experiment_body(&org_id, experiment).await),
         Err(error) => experiment_error_response(error),
     }
 }
@@ -1563,7 +1609,7 @@ pub async fn clone_experiment(
     match experiments::clone_sealed(&org_id, &experiment_id, &user.user_id, overrides).await {
         Ok(experiment) => {
             set_ownership(&org_id, "experiments", Authz::new(&experiment.id)).await;
-            MetaHttpResponse::json(ExperimentResponseBody::from(experiment))
+            MetaHttpResponse::json(experiment_body(&org_id, experiment).await)
         }
         Err(error) => experiment_error_response(error),
     }
@@ -1705,7 +1751,7 @@ pub async fn finalize_experiment(
         return response;
     }
     match ingest::finalize(&org_id, &experiment_id).await {
-        Ok(experiment) => MetaHttpResponse::json(ExperimentResponseBody::from(experiment)),
+        Ok(experiment) => MetaHttpResponse::json(experiment_body(&org_id, experiment).await),
         Err(error) => ingest_error_response(error),
     }
 }
@@ -1749,6 +1795,7 @@ mod tests {
             output: None,
             score_summaries: Vec::new(),
             p50_latency_ms: None,
+            error_message: None,
             dispersion: Some(crate::models::experiments::ExperimentRowDispersionBody {
                 row_id,
                 logical_id: format!("case-{row_index}"),
diff --git a/src/api/management/src/request/fleet/mod.rs b/src/api/management/src/request/fleet/mod.rs
index fa715fe203..ee1f88a4bf 100644
--- a/src/api/management/src/request/fleet/mod.rs
+++ b/src/api/management/src/request/fleet/mod.rs
@@ -34,6 +34,8 @@ use config::meta::fleet::{
 #[cfg(feature = "enterprise")]
 use config::meta::folder::{Folder, FolderType};
 #[cfg(feature = "enterprise")]
+use o2_enterprise::enterprise::common::auditor::AuditTarget;
+#[cfg(feature = "enterprise")]
 use openobserve_api_common::extractors::Headers;
 use openobserve_api_common::extractors::ValidatedJson;
 
@@ -186,7 +188,13 @@ pub async fn rename_collector(
             Err(e) => return MetaHttpResponse::bad_request(e),
         };
         match service::rename_collector(&org_id, &id, req.name.trim()).await {
-            Ok(collector) => MetaHttpResponse::json(collector),
+            Ok(collector) => {
+                let fleet = AuditTarget {
+                    fleet_id: Some(collector.fleet.id.clone()),
+                    target: collector.name.clone(),
+                };
+                audited(MetaHttpResponse::json(collector), fleet)
+            }
             Err(e) => to_response(e),
         }
     }
@@ -223,13 +231,15 @@ pub async fn delete_collector(
     {
         use o2_enterprise::enterprise::fleet::service;
 
-        if let Err(refused) = collector_write(&org_id, &user_email.user_id, &id).await {
-            return refused;
-        }
-        match service::delete_collector(&org_id, &id).await {
+        let fleet = match collector_write(&org_id, &user_email.user_id, &id).await {
+            Ok(fleet) => fleet,
+            Err(refused) => return refused,
+        };
+        let res = match service::delete_collector(&org_id, &id).await {
             Ok(()) => StatusCode::NO_CONTENT.into_response(),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -265,13 +275,15 @@ pub async fn restart_collector(
     {
         use o2_enterprise::enterprise::fleet::service;
 
-        if let Err(refused) = collector_write(&org_id, &user_email.user_id, &id).await {
-            return refused;
-        }
-        match service::restart_collector(&org_id, &id).await {
+        let fleet = match collector_write(&org_id, &user_email.user_id, &id).await {
+            Ok(fleet) => fleet,
+            Err(refused) => return refused,
+        };
+        let res = match service::restart_collector(&org_id, &id).await {
             Ok(queued) => (StatusCode::ACCEPTED, axum::Json(queued)).into_response(),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -307,13 +319,15 @@ pub async fn redeliver_collector(
     {
         use o2_enterprise::enterprise::fleet::service;
 
-        if let Err(refused) = collector_write(&org_id, &user_email.user_id, &id).await {
-            return refused;
-        }
-        match service::redeliver_collector(&org_id, &id).await {
+        let fleet = match collector_write(&org_id, &user_email.user_id, &id).await {
+            Ok(fleet) => fleet,
+            Err(refused) => return refused,
+        };
+        let res = match service::redeliver_collector(&org_id, &id).await {
             Ok(redelivered) => (StatusCode::ACCEPTED, axum::Json(redelivered)).into_response(),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -424,7 +438,12 @@ pub async fn create_fleet(
         };
         match db::folders::save_folder(&org_id, folder, FolderType::Fleets, false).await {
             Ok(folder) => {
-                (StatusCode::CREATED, axum::Json(fleet_item(folder, &[]))).into_response()
+                let fleet = AuditTarget {
+                    fleet_id: Some(folder.folder_id.clone()),
+                    target: folder.name.clone(),
+                };
+                let res = (StatusCode::CREATED, axum::Json(fleet_item(folder, &[])));
+                audited(res.into_response(), fleet)
             }
             Err(e) => folder_response(e),
         }
@@ -523,22 +542,30 @@ pub async fn rename_fleet(
         if name.is_empty() {
             return MetaHttpResponse::bad_request("name must not be empty");
         }
-        let mut folder = match db::folders::get_folder(&org_id, &fleet_id, FolderType::Fleets).await
-        {
-            Ok(folder) => folder,
-            Err(e) => return folder_response(e),
+        let fleet = AuditTarget {
+            fleet_id: Some(fleet_id.clone()),
+            target: name.to_string(),
         };
-        folder.name = name.to_string();
-        let renamed =
-            db::folders::update_folder(&org_id, &fleet_id, FolderType::Fleets, folder).await;
-        let folder = match renamed {
-            Ok(folder) => folder,
-            Err(e) => return folder_response(e),
-        };
-        match o2_enterprise::enterprise::fleet::fleets::list_fleets(&org_id).await {
-            Ok(states) => MetaHttpResponse::json(fleet_item(folder, &states)),
-            Err(e) => to_response(e),
+        let res = async {
+            let mut folder =
+                match db::folders::get_folder(&org_id, &fleet_id, FolderType::Fleets).await {
+                    Ok(folder) => folder,
+                    Err(e) => return folder_response(e),
+                };
+            folder.name = name.to_string();
+            let renamed =
+                db::folders::update_folder(&org_id, &fleet_id, FolderType::Fleets, folder).await;
+            let folder = match renamed {
+                Ok(folder) => folder,
+                Err(e) => return folder_response(e),
+            };
+            match o2_enterprise::enterprise::fleet::fleets::list_fleets(&org_id).await {
+                Ok(states) => MetaHttpResponse::json(fleet_item(folder, &states)),
+                Err(e) => to_response(e),
+            }
         }
+        .await;
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -579,10 +606,13 @@ pub async fn delete_fleet(
         if fleet_id == config::meta::folder::DEFAULT_FOLDER {
             return MetaHttpResponse::conflict("the default fleet cannot be deleted");
         }
-        match db::folders::delete_folder(&org_id, &fleet_id, FolderType::Fleets).await {
+        // Named before the delete: afterwards the fleet has no name to record.
+        let fleet = fleet_scope(&org_id, &fleet_id).await;
+        let res = match db::folders::delete_folder(&org_id, &fleet_id, FolderType::Fleets).await {
             Ok(()) => StatusCode::NO_CONTENT.into_response(),
             Err(e) => folder_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -673,10 +703,12 @@ pub async fn put_fleet_settings(
         if let Err(e) = req.validate() {
             return MetaHttpResponse::bad_request(e);
         }
-        match settings::put_fleet_settings(&org_id, &fleet_id, req).await {
+        let fleet = fleet_scope(&org_id, &fleet_id).await;
+        let res = match settings::put_fleet_settings(&org_id, &fleet_id, req).await {
             Ok(settings) => MetaHttpResponse::json(settings),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -713,19 +745,20 @@ pub async fn set_desired(
 ) -> Response {
     #[cfg(feature = "enterprise")]
     {
+        use o2_enterprise::enterprise::fleet::{audit, rollouts};
+
         let user_id = &user_email.user_id;
         let req = match desired_request(&org_id, user_id, &fleet_id, body).await {
             Ok(req) => req,
             Err(refused) => return refused,
         };
-        match o2_enterprise::enterprise::fleet::rollouts::set_desired(
-            &org_id, user_id, &fleet_id, req,
-        )
-        .await
-        {
+        let mut fleet = fleet_scope(&org_id, &fleet_id).await;
+        fleet.target = audit::version_target(&fleet.target, &req.config, req.version);
+        let res = match rollouts::set_desired(&org_id, user_id, &fleet_id, req).await {
             Ok(rollout) => MetaHttpResponse::json(rollout),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -858,10 +891,18 @@ pub async fn create_token(
         if let Some(refused) = fleet_write(&org_id, user_id, &req.fleet, "PUT").await {
             return refused;
         }
-        match o2_enterprise::enterprise::fleet::service::create_token(&org_id, user_id, req).await {
-            Ok(created) => (StatusCode::CREATED, axum::Json(created)).into_response(),
-            Err(e) => to_response(e),
-        }
+        let fleet = AuditTarget {
+            fleet_id: Some(req.fleet.clone()),
+            target: req.name.clone(),
+        };
+        let res =
+            match o2_enterprise::enterprise::fleet::service::create_token(&org_id, user_id, req)
+                .await
+            {
+                Ok(created) => (StatusCode::CREATED, axum::Json(created)).into_response(),
+                Err(e) => to_response(e),
+            };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -905,7 +946,13 @@ pub async fn revoke_token(
             return refused;
         }
         match service::revoke_token(&org_id, &id).await {
-            Ok(token) => MetaHttpResponse::json(token),
+            Ok(token) => {
+                let fleet = AuditTarget {
+                    fleet_id: Some(token.fleet.id.clone()),
+                    target: token.name.clone(),
+                };
+                audited(MetaHttpResponse::json(token), fleet)
+            }
             Err(e) => to_response(e),
         }
     }
@@ -987,7 +1034,8 @@ pub async fn create_config(
         if !allowed_on(FLEET_CONFIGS, &org_id, &user_email.user_id, "POST").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        match o2_enterprise::enterprise::fleet::configs::create_config(
+        let named = org_target(&body.id);
+        let res = match o2_enterprise::enterprise::fleet::configs::create_config(
             &org_id,
             &user_email.user_id,
             body,
@@ -996,7 +1044,8 @@ pub async fn create_config(
         {
             Ok(detail) => (StatusCode::CREATED, axum::Json(detail)).into_response(),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, named)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -1084,10 +1133,12 @@ pub async fn delete_config(
         if !allowed_on(FLEET_CONFIGS, &org_id, &user_email.user_id, "DELETE").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        match o2_enterprise::enterprise::fleet::configs::delete_config(&org_id, &id).await {
+        let res = match o2_enterprise::enterprise::fleet::configs::delete_config(&org_id, &id).await
+        {
             Ok(()) => StatusCode::NO_CONTENT.into_response(),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, org_target(&id))
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -1125,7 +1176,7 @@ pub async fn save_config_draft(
         if !allowed_on(FLEET_CONFIGS, &org_id, &user_email.user_id, "PUT").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        match o2_enterprise::enterprise::fleet::configs::save_draft(
+        let res = match o2_enterprise::enterprise::fleet::configs::save_draft(
             &org_id,
             &user_email.user_id,
             &id,
@@ -1135,7 +1186,8 @@ pub async fn save_config_draft(
         {
             Ok(saved) => MetaHttpResponse::json(saved),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, org_target(&id))
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -1176,7 +1228,7 @@ pub async fn publish_config_version(
         if !allowed_on(FLEET_CONFIGS, &org_id, &user_email.user_id, "POST").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        match o2_enterprise::enterprise::fleet::configs::publish(
+        let res = match o2_enterprise::enterprise::fleet::configs::publish(
             &org_id,
             &user_email.user_id,
             &id,
@@ -1186,7 +1238,8 @@ pub async fn publish_config_version(
         {
             Ok(published) => (StatusCode::CREATED, axum::Json(published)).into_response(),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, org_target(&id))
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -1405,13 +1458,15 @@ pub async fn resume_rollout(
         use o2_enterprise::enterprise::fleet::rollouts;
 
         let user_id = &user_email.user_id;
-        if let Err(refused) = rollout_write(&org_id, user_id, &id).await {
-            return refused;
-        }
-        match rollouts::resume(&org_id, &id, user_id).await {
+        let fleet = match rollout_write(&org_id, user_id, &id).await {
+            Ok(fleet) => fleet,
+            Err(refused) => return refused,
+        };
+        let res = match rollouts::resume(&org_id, &id, user_id).await {
             Ok(rollout) => MetaHttpResponse::json(rollout),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -1451,9 +1506,10 @@ pub async fn skip_rollout(
         use o2_enterprise::enterprise::fleet::rollouts;
 
         let user_id = &user_email.user_id;
-        if let Err(refused) = rollout_write(&org_id, user_id, &id).await {
-            return refused;
-        }
+        let fleet = match rollout_write(&org_id, user_id, &id).await {
+            Ok(fleet) => fleet,
+            Err(refused) => return refused,
+        };
         let req = match serde_json::from_value::<SkipRequest>(body) {
             Ok(req) => req,
             Err(e) => return MetaHttpResponse::bad_request(e),
@@ -1461,10 +1517,11 @@ pub async fn skip_rollout(
         if req.collector_ids.is_empty() {
             return MetaHttpResponse::bad_request("collector_ids must not be empty");
         }
-        match rollouts::skip(&org_id, &id, user_id, &req.collector_ids).await {
+        let res = match rollouts::skip(&org_id, &id, user_id, &req.collector_ids).await {
             Ok(rollout) => MetaHttpResponse::json(rollout),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -1501,13 +1558,15 @@ pub async fn rollback_rollout(
         use o2_enterprise::enterprise::fleet::rollouts;
 
         let user_id = &user_email.user_id;
-        if let Err(refused) = rollout_write(&org_id, user_id, &id).await {
-            return refused;
-        }
-        match rollouts::rollback(&org_id, &id, user_id).await {
+        let fleet = match rollout_write(&org_id, user_id, &id).await {
+            Ok(fleet) => fleet,
+            Err(refused) => return refused,
+        };
+        let res = match rollouts::rollback(&org_id, &id, user_id).await {
             Ok(rollout) => MetaHttpResponse::json(rollout),
             Err(e) => to_response(e),
-        }
+        };
+        audited(res, fleet)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -1607,12 +1666,12 @@ pub async fn get_pipelines(
     context_path = "/api",
     tag = "Fleet",
     operation_id = "ListFleetAudit",
-    summary = "The fleet audit trail from the audit stream: the newest 500 events of the last 30 days or of a period",
+    summary = "One page of the fleet audit trail, newest first, from the last 30 days or a period",
     security(("Authorization" = [])),
     params(("org_id" = String, Path, description = "Organization name"), AuditQuery),
     responses(
         (status = 200, description = "Success", content_type = "application/json", body = config::meta::fleet::AuditList),
-        (status = 400, description = "Invalid period", content_type = "application/json", body = Object),
+        (status = 400, description = "Invalid period or filter", content_type = "application/json", body = Object),
         (status = 403, description = "Forbidden", content_type = "application/json", body = Object),
     ),
 )]
@@ -1623,18 +1682,20 @@ pub async fn list_audit(
 ) -> Response {
     #[cfg(feature = "enterprise")]
     {
-        if !allowed_on(FLEET_MANAGEMENT, &org_id, &user_email.user_id, "GET").await {
+        let user_id = &user_email.user_id;
+        if !allowed_on(FLEET_MANAGEMENT, &org_id, user_id, "GET").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        let permitted = match permitted_fleets(&org_id, &user_email.user_id).await {
+        let permitted = match permitted_fleets(&org_id, user_id).await {
             Ok(permitted) => permitted,
             Err(refused) => return refused,
         };
-        match openobserve_core::fleet::list_audit(&org_id, query, permitted.as_ref()).await {
-            Ok(mut list) => {
-                list.total = list.items.len();
-                MetaHttpResponse::json(list)
-            }
+        let fleets = match &query.fleet {
+            None => permitted,
+            Some(fleet) => Some(in_fleet(&org_id, user_id, fleet.clone(), permitted).await),
+        };
+        match openobserve_core::fleet::list_audit(&org_id, query, fleets.as_ref()).await {
+            Ok(list) => MetaHttpResponse::json(list),
             Err(e) => to_response(e),
         }
     }
@@ -1715,7 +1776,13 @@ pub async fn update_settings(
             return MetaHttpResponse::bad_request(e);
         }
         match o2_enterprise::enterprise::fleet::settings::update_settings(&org_id, req).await {
-            Ok(settings) => MetaHttpResponse::json(settings),
+            Ok(settings) => {
+                use o2_enterprise::enterprise::fleet::audit::settings_target;
+
+                let stored = serde_json::to_value(&settings).unwrap_or_default();
+                let named = org_target(&settings_target(&stored));
+                audited(MetaHttpResponse::json(settings), named)
+            }
             Err(e) => to_response(e),
         }
     }
@@ -1783,14 +1850,13 @@ async fn fleet_allowed(org_id: &str, user_id: &str, fleet: &str, verb: &str) ->
     .await
 }
 
-/// Every collector write is `PUT` on the collector's current fleet.
+/// Every collector write is `PUT` on the collector's current fleet, which audits it.
 #[cfg(feature = "enterprise")]
-async fn collector_write(org_id: &str, user_id: &str, id: &str) -> Result<String, Response> {
-    use o2_enterprise::enterprise::fleet::{fleets, service::FleetError};
+async fn collector_write(org_id: &str, user_id: &str, id: &str) -> Result<AuditTarget, Response> {
+    use o2_enterprise::enterprise::fleet::{audit, service::FleetError};
 
-    let ids = [id.to_string()];
-    let fleet = match fleets::collector_fleets(org_id, &ids).await {
-        Ok(found) => found.get(id).cloned(),
+    let fleet = match audit::collector_scope(org_id, id).await {
+        Ok(found) => found,
         Err(e) => return Err(to_response(e)),
     };
     let Some(fleet) = fleet else {
@@ -1798,22 +1864,51 @@ async fn collector_write(org_id: &str, user_id: &str, id: &str) -> Result<String
             FleetError::CollectorNotFound(id.to_string()).into(),
         ));
     };
-    match fleet_write(org_id, user_id, &fleet, "PUT").await {
+    let fleet_id = fleet.fleet_id.as_deref().unwrap_or_default();
+    match fleet_write(org_id, user_id, fleet_id, "PUT").await {
         Some(refused) => Err(refused),
         None => Ok(fleet),
     }
 }
 
-/// A rollout exit is `PUT` on the rollout's fleet.
+/// A rollout exit is `PUT` on the rollout's fleet, which audits it.
 #[cfg(feature = "enterprise")]
-async fn rollout_write(org_id: &str, user_id: &str, id: &str) -> Result<(), Response> {
-    let rollout = match o2_enterprise::enterprise::fleet::rollouts::get_rollout(org_id, id).await {
+async fn rollout_write(org_id: &str, user_id: &str, id: &str) -> Result<AuditTarget, Response> {
+    use o2_enterprise::enterprise::fleet::{audit, rollouts};
+
+    let rollout = match rollouts::get_rollout(org_id, id).await {
         Ok(rollout) => rollout,
         Err(e) => return Err(to_response(e)),
     };
     match fleet_write(org_id, user_id, &rollout.fleet.id, "PUT").await {
         Some(refused) => Err(refused),
-        None => Ok(()),
+        None => Ok(audit::rollout_scope(&rollout)),
+    }
+}
+
+/// The audit layer records the event as `named`; an extension never reaches the client.
+#[cfg(feature = "enterprise")]
+fn audited(mut res: Response, named: AuditTarget) -> Response {
+    res.extensions_mut().insert(named);
+    res
+}
+
+/// Configurations and the org's settings belong to no fleet, so every reader sees their events.
+#[cfg(feature = "enterprise")]
+fn org_target(target: &str) -> AuditTarget {
+    AuditTarget {
+        fleet_id: None,
+        target: target.to_string(),
+    }
+}
+
+/// A fleet named as it is now; a fleet not found keeps its id.
+#[cfg(feature = "enterprise")]
+async fn fleet_scope(org_id: &str, fleet_id: &str) -> AuditTarget {
+    let found = db::folders::get_folder(org_id, fleet_id, FolderType::Fleets).await;
+    AuditTarget {
+        fleet_id: Some(fleet_id.to_string()),
+        target: found.map_or_else(|_| fleet_id.to_string(), |f| f.name),
     }
 }
 
@@ -2658,4 +2753,209 @@ mod tests {
         assert_eq!(empty.state, Some(FleetState::default()));
         assert_eq!(empty.settings, FleetSettings::default());
     }
+
+    /// Nothing else in this binary migrates the meta store the handlers write to.
+    async fn meta_store() {
+        static ONCE: tokio::sync::OnceCell<()> = tokio::sync::OnceCell::const_new();
+        ONCE.get_or_init(|| async {
+            std::fs::create_dir_all(&config::get_config().common.data_db_dir).expect("db dir");
+            infra::db_init().await.expect("meta store");
+            infra::table::migrate().await.expect("migrations");
+        })
+        .await;
+    }
+
+    /// Shared by the audit tests and never forgotten, since they run in parallel.
+    const AUDIT_ROOT: &str = "audit-root@fleet-audit-scope.test";
+
+    /// A fresh org with one fleet, written by a root caller, so every check passes for real.
+    async fn audit_org(label: &str) -> (String, String) {
+        meta_store().await;
+        openfga_off();
+        seed_member(
+            AUDIT_ROOT,
+            config::meta::user::UserRole::Root,
+            config::DEFAULT_ORG,
+        );
+        let org = format!("fleet-audit-{label}-{}", config::utils::time::now_micros());
+        let res = create_fleet(
+            Path(org.clone()),
+            root(),
+            ValidatedJson(serde_json::json!({"name": "edge hosts"})),
+        )
+        .await;
+        assert_eq!(res.status(), StatusCode::CREATED);
+        let (fleet, target) = recorded(&res).expect("a created fleet is audited under itself");
+        assert_eq!(target, "edge hosts");
+        (org, fleet.expect("a fleet event names its fleet"))
+    }
+
+    fn root() -> Headers<UserEmail> {
+        Headers(UserEmail {
+            user_id: AUDIT_ROOT.to_string(),
+        })
+    }
+
+    /// What the audit layer would record as the event's fleet and target.
+    fn recorded(res: &Response) -> Option<(Option<String>, String)> {
+        res.extensions()
+            .get::<AuditTarget>()
+            .map(|f| (f.fleet_id.clone(), f.target.clone()))
+    }
+
+    fn named(fleet: &str, target: &str) -> Option<(Option<String>, String)> {
+        Some((Some(fleet.to_string()), target.to_string()))
+    }
+
+    fn org_wide(target: &str) -> Option<(Option<String>, String)> {
+        Some((None, target.to_string()))
+    }
+
+    #[tokio::test]
+    async fn fleet_and_token_writes_hand_their_fleet_to_the_audit_layer() {
+        let (org, edge) = audit_org("fleets").await;
+        let body = |v: serde_json::Value| ValidatedJson(v);
+        let at = || Path((org.clone(), edge.clone()));
+
+        let res = rename_fleet(at(), root(), body(serde_json::json!({"name": "edge"}))).await;
+        assert_eq!(res.status(), StatusCode::OK);
+        assert_eq!(recorded(&res), named(&edge, "edge"));
+        let res = put_fleet_settings(at(), root(), body(serde_json::json!({}))).await;
+        assert_eq!(res.status(), StatusCode::OK);
+        assert_eq!(recorded(&res), named(&edge, "edge"));
+        let desired = serde_json::json!({"config": "otel", "version": 3});
+        let res = set_desired(at(), root(), body(desired)).await;
+        assert_eq!(recorded(&res), named(&edge, "edge: otel v3"));
+
+        let token = serde_json::json!({"name": "k8s", "fleet": edge});
+        let res = create_token(Path(org.clone()), root(), body(token)).await;
+        assert_eq!(res.status(), StatusCode::CREATED);
+        assert_eq!(recorded(&res), named(&edge, "k8s"));
+        let created: serde_json::Value = serde_json::from_str(&body_text(res).await).unwrap();
+        let token_id = created["id"].as_str().unwrap().to_string();
+        let res = revoke_token(Path((org.clone(), token_id)), root()).await;
+        assert_eq!(res.status(), StatusCode::OK);
+        assert_eq!(recorded(&res), named(&edge, "k8s"));
+
+        let res = delete_fleet(at(), root()).await;
+        assert_eq!(
+            recorded(&res),
+            named(&edge, "edge"),
+            "named before the delete removes the name"
+        );
+    }
+
+    #[tokio::test]
+    async fn collector_writes_hand_the_collectors_fleet_to_the_audit_layer() {
+        use infra::table::entity::fleet_collectors::{ActiveModel, Entity, Model};
+        use sea_orm::EntityTrait;
+
+        let (org, edge) = audit_org("collectors").await;
+        let row = Model {
+            org_id: org.clone(),
+            id: "c1".to_string(),
+            fleet_id: edge.clone(),
+            hostname: Some("web-1".to_string()),
+            enrolled_at: 1,
+            last_seen_at: 1,
+            ..Default::default()
+        };
+        Entity::insert(ActiveModel::from(row))
+            .exec_without_returning(infra::db::get_orm_client_rw().await)
+            .await
+            .unwrap();
+        let at = || Path((org.clone(), "c1".to_string()));
+
+        let res = restart_collector(at(), root()).await;
+        assert_eq!(recorded(&res), named(&edge, "web-1"), "{}", res.status());
+        let res = redeliver_collector(at(), root()).await;
+        assert_eq!(recorded(&res), named(&edge, "web-1"), "{}", res.status());
+        let name = ValidatedJson(serde_json::json!({"name": "edge-a"}));
+        let res = rename_collector(at(), root(), name).await;
+        assert_eq!(res.status(), StatusCode::OK);
+        assert_eq!(recorded(&res), named(&edge, "edge-a"));
+        let res = delete_collector(at(), root()).await;
+        assert_eq!(res.status(), StatusCode::NO_CONTENT);
+        assert_eq!(
+            recorded(&res),
+            named(&edge, "edge-a"),
+            "named before the delete removes the row"
+        );
+    }
+
+    #[tokio::test]
+    async fn configuration_and_settings_writes_name_their_target_without_a_fleet() {
+        let (org, _) = audit_org("configs").await;
+        let config = || Path((org.clone(), "otel".to_string()));
+        let yaml = "receivers: {}\n";
+
+        let created = CreateConfigRequest {
+            id: "otel".to_string(),
+            description: String::new(),
+            yaml: String::new(),
+        };
+        let res = create_config(Path(org.clone()), root(), ValidatedJson(created)).await;
+        assert_eq!(res.status(), StatusCode::CREATED);
+        assert_eq!(recorded(&res), org_wide("otel"));
+        let draft = SaveDraftRequest {
+            yaml: yaml.to_string(),
+        };
+        let res = save_config_draft(config(), root(), ValidatedJson(draft)).await;
+        assert_eq!(recorded(&res), org_wide("otel"), "{}", res.status());
+        let version = PublishRequest {
+            yaml: yaml.to_string(),
+            message: String::new(),
+        };
+        let res = publish_config_version(config(), root(), ValidatedJson(version)).await;
+        assert_eq!(recorded(&res), org_wide("otel"), "{}", res.status());
+        let res = delete_config(config(), root()).await;
+        assert_eq!(recorded(&res), org_wide("otel"), "{}", res.status());
+
+        let settings = serde_json::json!({"restricted_components": ["debug"]});
+        let res = update_settings(Path(org.clone()), root(), ValidatedJson(settings)).await;
+        assert_eq!(res.status(), StatusCode::OK);
+        assert_eq!(
+            recorded(&res),
+            org_wide("target version default; restricted: debug")
+        );
+    }
+
+    #[tokio::test]
+    async fn rollout_exits_hand_the_rollouts_fleet_to_the_audit_layer() {
+        use infra::table::fleet_rollouts::{self, Model};
+
+        let (org, edge) = audit_org("rollouts").await;
+        let row = Model {
+            id: "r1".to_string(),
+            org_id: org.clone(),
+            config_id: "otel".to_string(),
+            from_version: Some(1),
+            to_version: 2,
+            fleet_id: edge.clone(),
+            strategy: "immediate".to_string(),
+            status: "halted".to_string(),
+            phases: "[]".to_string(),
+            failure: None,
+            events: "[]".to_string(),
+            started_at: 1,
+            started_by: AUDIT_ROOT.to_string(),
+            rev: 0,
+            auto_rollback: false,
+            scheduled_for: None,
+            gates: None,
+        };
+        fleet_rollouts::insert_with(infra::db::get_orm_client_rw().await, row, vec![])
+            .await
+            .unwrap();
+        let at = || Path((org.clone(), "r1".to_string()));
+        let want = named(&edge, "edge hosts: otel v2");
+
+        let res = resume_rollout(at(), root()).await;
+        assert_eq!(recorded(&res), want, "{}", res.status());
+        let skip = ValidatedJson(serde_json::json!({"collector_ids": ["c1"]}));
+        let res = skip_rollout(at(), root(), skip).await;
+        assert_eq!(recorded(&res), want, "{}", res.status());
+        let res = rollback_rollout(at(), root()).await;
+        assert_eq!(recorded(&res), want, "{}", res.status());
+    }
 }
diff --git a/src/api/management/src/request/gen_ai_health.rs b/src/api/management/src/request/gen_ai_health.rs
new file mode 100644
index 0000000000..21c3f4542e
--- /dev/null
+++ b/src/api/management/src/request/gen_ai_health.rs
@@ -0,0 +1,1716 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! AI data health: checks that make LLM pages look empty or numbers look wrong (unpriced
+//! models, spans without agent identity, zero-duration spans, spans without a session id),
+//! plus the per-model unpriced / approximate listing behind Model Pricing's Unpriced tab.
+//!
+//! The checks run on request against the trace stream and are cached in memory for
+//! [`CACHE_TTL_MICROS`] per (org, stream, scope, window after the caller's max query range,
+//! rounded to the minute): Insights loads them on every visit, and a short cache keeps
+//! refreshes cheap without a scheduled job or a results stream. A stream whose schema lacks a
+//! column is handled per check, never an error.
+
+use std::{
+    collections::HashMap,
+    sync::{LazyLock, Mutex},
+};
+
+use axum::{extract::Path, response::Response};
+use config::{
+    meta::{
+        model_pricing::{COST_STATUS_COLUMN, CostStatus, MatchKind},
+        search::{Query as SearchQuery, Request as SearchRequest, RequestEncoding},
+        stream::StreamType,
+    },
+    utils::{json, time::now_micros},
+};
+use db::model_pricing::DefinitionMatch;
+use serde::{Deserialize, Serialize};
+use utoipa::{IntoParams, ToSchema};
+
+use crate::common::meta::http::HttpResponse as MetaHttpResponse;
+
+const CACHE_TTL_MICROS: i64 = 60 * 1_000_000;
+const CACHE_MAX_ENTRIES: usize = 512;
+const WINDOW_QUANTUM_MICROS: i64 = 60 * 1_000_000;
+const MAX_SAMPLES: usize = 3;
+/// Recent matching spans scanned for sample trace ids; deduped in Rust down to `MAX_SAMPLES`.
+const SAMPLE_SCAN_ROWS: usize = 100;
+const MAX_MODELS: usize = 20;
+const MAX_UNPRICED_ROWS: usize = 100;
+/// Agent names listed per unpriced model row; `agent_count` keeps the full distinct count.
+pub const MAX_AGENT_NAMES: usize = 10;
+
+const LLM_SPAN_COLUMN: &str = "gen_ai_operation_name";
+const AGENT_NAME_COLUMN: &str = "gen_ai_agent_name";
+const AGENT_ID_COLUMN: &str = "gen_ai_agent_id";
+const AGENT_ENV_COLUMN: &str = "gen_ai_agent_env";
+const AGENT_VERSION_COLUMN: &str = "gen_ai_agent_version";
+const TOKENS_COLUMN: &str = "gen_ai_usage_total_tokens";
+const COST_COLUMN: &str = "gen_ai_usage_cost";
+
+#[derive(Debug, Clone, Deserialize, IntoParams)]
+#[into_params(parameter_in = Query)]
+pub struct DataHealthQuery {
+    /// Trace stream to check.
+    pub stream_name: String,
+    /// Window start, microseconds.
+    pub start_time: i64,
+    /// Window end, microseconds.
+    pub end_time: i64,
+    /// Only spans of this agent name (`gen_ai_agent_name`); ignored when `agent_id` is set.
+    #[serde(default)]
+    pub agent: Option<String>,
+    /// Only spans of this agent id (`gen_ai_agent_id`). Agents that emit only an id are
+    /// listed with the id as their name, so the id is the filter that matches their spans.
+    #[serde(default)]
+    pub agent_id: Option<String>,
+    /// Only spans of this environment (`gen_ai_agent_env`).
+    #[serde(default)]
+    pub env: Option<String>,
+    /// Only spans of this agent version (`gen_ai_agent_version`).
+    #[serde(default)]
+    pub version: Option<String>,
+    /// Skip the short server-side cache.
+    #[serde(default)]
+    pub refresh: bool,
+    /// Also return up to three recent trace ids per failing check; off by default, one query each.
+    #[serde(default)]
+    pub include_samples: bool,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum CheckStatus {
+    Pass,
+    Warning,
+    Error,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum CheckId {
+    UnpricedModels,
+    MissingAgentIdentity,
+    ZeroDurationSpans,
+    MissingSessionId,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Serialize, ToSchema)]
+pub struct ModelUsage {
+    /// Null for spans that carry no model name.
+    pub model: Option<String>,
+    pub spans: i64,
+    pub tokens: i64,
+}
+
+#[derive(Debug, Clone, PartialEq, Serialize, ToSchema)]
+pub struct HealthCheck {
+    pub id: CheckId,
+    pub status: CheckStatus,
+    /// LLM spans the problem touches.
+    pub affected: i64,
+    /// LLM spans checked.
+    pub total: i64,
+    /// Unpriced check only: the 20 models with the most unpriced tokens.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub models: Option<Vec<ModelUsage>>,
+    /// Unpriced check only: every distinct model behind the unpriced spans (spans without a
+    /// model name count as one), however many `models` lists.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model_count: Option<i64>,
+    /// Unpriced check only: tokens on every unpriced span.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub unpriced_tokens: Option<i64>,
+    /// Unpriced check only: `models` leaves some of the `model_count` models out.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub models_truncated: Option<bool>,
+    /// Up to three recent trace ids with the problem; present only with `include_samples`.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub samples: Option<Vec<String>>,
+}
+
+impl HealthCheck {
+    /// A check with no breakdown yet: the unpriced one starts with an empty, complete one.
+    fn new(id: CheckId, affected: i64, total: i64, include_samples: bool) -> Self {
+        let unpriced = id == CheckId::UnpricedModels;
+        Self {
+            id,
+            status: status_for(id, affected),
+            affected,
+            total,
+            models: unpriced.then(Vec::new),
+            model_count: unpriced.then_some(0),
+            unpriced_tokens: unpriced.then_some(0),
+            models_truncated: unpriced.then_some(false),
+            samples: include_samples.then(Vec::new),
+        }
+    }
+}
+
+#[derive(Debug, Clone, Serialize, ToSchema)]
+pub struct DataHealthResponse {
+    /// When the checks ran, microseconds.
+    pub checked_at: i64,
+    pub checks: Vec<HealthCheck>,
+}
+
+/// How a check selects affected spans on a given stream schema.
+#[derive(Debug, Clone, PartialEq, Eq)]
+enum Pred {
+    /// The column the check reads is absent, so no span can have the problem.
+    Never,
+    /// The column that would prove the span healthy is absent, so every span has it.
+    Always,
+    Sql(String),
+}
+
+/// Columns of the stream schema the checks read.
+struct Columns(std::collections::HashSet<String>);
+
+impl Columns {
+    fn from_schema(schema: &arrow_schema::Schema) -> Self {
+        Self(schema.fields().iter().map(|f| f.name().clone()).collect())
+    }
+
+    fn has(&self, name: &str) -> bool {
+        self.0.contains(name)
+    }
+
+    fn model_column(&self) -> Option<&'static str> {
+        ["gen_ai_response_model", "gen_ai_request_model"]
+            .into_iter()
+            .find(|c| self.has(c))
+    }
+
+    fn tokens_expr(&self) -> &'static str {
+        if self.has(TOKENS_COLUMN) {
+            "COALESCE(SUM(gen_ai_usage_total_tokens), 0)"
+        } else {
+            "0"
+        }
+    }
+}
+
+const CHECK_IDS: [CheckId; 4] = [
+    CheckId::UnpricedModels,
+    CheckId::MissingAgentIdentity,
+    CheckId::ZeroDurationSpans,
+    CheckId::MissingSessionId,
+];
+
+fn quote_str(value: &str) -> String {
+    format!("'{}'", value.replace('\'', "''"))
+}
+
+fn quote_ident(value: &str) -> String {
+    format!("\"{}\"", value.replace('"', "\"\""))
+}
+
+fn blank(column: &str) -> String {
+    format!("({column} IS NULL OR {column} = '')")
+}
+
+/// The predicate of check `id`. With model pricing disabled nothing is priced, so no span is
+/// unpriced: the check passes and does not point at the hidden Model Pricing page.
+fn check_pred(id: CheckId, cols: &Columns, pricing_enabled: bool) -> Pred {
+    match id {
+        CheckId::UnpricedModels if pricing_enabled && cols.has(COST_STATUS_COLUMN) => {
+            Pred::Sql(format!(
+                "{COST_STATUS_COLUMN} = {}",
+                quote_str(CostStatus::Unpriced.as_str())
+            ))
+        }
+        CheckId::UnpricedModels => Pred::Never,
+        CheckId::MissingAgentIdentity => {
+            let present: Vec<String> = [AGENT_NAME_COLUMN, AGENT_ID_COLUMN]
+                .into_iter()
+                .filter(|c| cols.has(c))
+                .map(blank)
+                .collect();
+            if present.is_empty() {
+                Pred::Always
+            } else {
+                Pred::Sql(present.join(" AND "))
+            }
+        }
+        CheckId::ZeroDurationSpans if cols.has("duration") => Pred::Sql("duration = 0".into()),
+        CheckId::ZeroDurationSpans => Pred::Never,
+        CheckId::MissingSessionId => {
+            // A span has a session when any of the stream's session columns is set.
+            let present: Vec<String> = config::meta::traces::session::SESSION_ID_COLUMNS
+                .iter()
+                .filter(|c| cols.has(c))
+                .map(|c| blank(&quote_ident(c)))
+                .collect();
+            if present.is_empty() {
+                Pred::Always
+            } else {
+                Pred::Sql(present.join(" AND "))
+            }
+        }
+    }
+}
+
+fn non_empty(value: &Option<String>) -> Option<&str> {
+    value.as_deref().filter(|v| !v.is_empty())
+}
+
+/// The LLM-span and scope predicates every check query shares; `None` when the stream has no
+/// LLM spans in scope at all (a scope column or the operation column is absent).
+///
+/// The agent is matched on `gen_ai_agent_id` when an id is given, else on its name, as the
+/// Insights panels do.
+fn base_where(cols: &Columns, query: &DataHealthQuery) -> Option<String> {
+    if !cols.has(LLM_SPAN_COLUMN) {
+        return None;
+    }
+    let agent = match non_empty(&query.agent_id) {
+        Some(id) => (AGENT_ID_COLUMN, Some(id)),
+        None => (AGENT_NAME_COLUMN, non_empty(&query.agent)),
+    };
+    let mut preds = vec![format!("{LLM_SPAN_COLUMN} IS NOT NULL")];
+    for (column, value) in [
+        agent,
+        (AGENT_ENV_COLUMN, non_empty(&query.env)),
+        (AGENT_VERSION_COLUMN, non_empty(&query.version)),
+    ] {
+        let Some(value) = value else {
+            continue;
+        };
+        if !cols.has(column) {
+            return None;
+        }
+        preds.push(format!("{column} = {}", quote_str(value)));
+    }
+    Some(preds.join(" AND "))
+}
+
+fn counts_sql(stream: &str, base: &str, preds: &[Pred], cols: &Columns) -> String {
+    let mut selects = vec!["COUNT(*) AS total".to_string()];
+    for (i, pred) in preds.iter().enumerate() {
+        if let Pred::Sql(p) = pred {
+            selects.push(format!("SUM(CASE WHEN {p} THEN 1 ELSE 0 END) AS c{i}"));
+        }
+    }
+    if let Some(Pred::Sql(unpriced)) = preds.first() {
+        let model = cols.model_column();
+        let distinct = model.map_or_else(
+            || "0".to_string(),
+            |column| format!("COUNT(DISTINCT CASE WHEN {unpriced} THEN {column} END)"),
+        );
+        let no_model = model.map_or_else(
+            || unpriced.clone(),
+            |column| format!("({unpriced}) AND {column} IS NULL"),
+        );
+        let tokens = if cols.has(TOKENS_COLUMN) {
+            TOKENS_COLUMN
+        } else {
+            "0"
+        };
+        selects.push(format!("{distinct} AS distinct_models"));
+        selects.push(format!(
+            "SUM(CASE WHEN {no_model} THEN 1 ELSE 0 END) AS no_model_spans"
+        ));
+        selects.push(format!(
+            "SUM(CASE WHEN {unpriced} THEN {tokens} ELSE 0 END) AS tokens"
+        ));
+    }
+    format!(
+        "SELECT {} FROM {} WHERE {base}",
+        selects.join(", "),
+        quote_ident(stream)
+    )
+}
+
+fn samples_sql(stream: &str, base: &str, pred: &Pred) -> String {
+    let filter = match pred {
+        Pred::Sql(p) => format!(" AND {p}"),
+        _ => String::new(),
+    };
+    format!(
+        "SELECT trace_id FROM {} WHERE {base}{filter} \
+         ORDER BY _timestamp DESC LIMIT {SAMPLE_SCAN_ROWS}",
+        quote_ident(stream)
+    )
+}
+
+/// The first `MAX_SAMPLES` distinct trace ids of rows ordered newest first.
+fn distinct_trace_ids(hits: &[json::Value]) -> Vec<String> {
+    let mut ids: Vec<String> = Vec::with_capacity(MAX_SAMPLES);
+    for id in hits
+        .iter()
+        .filter_map(|h| h.get("trace_id").and_then(|v| v.as_str()))
+    {
+        if ids.len() == MAX_SAMPLES {
+            break;
+        }
+        if !ids.iter().any(|seen| seen == id) {
+            ids.push(id.to_string());
+        }
+    }
+    ids
+}
+
+/// The `model` select item and grouping key. A stream with no model column holds only spans
+/// without a model name: they form one group, read back with no `model` value.
+fn model_grouping(cols: &Columns) -> (String, Option<&'static str>) {
+    match cols.model_column() {
+        Some(model) => (format!("{model} AS model, "), Some(model)),
+        None => (String::new(), None),
+    }
+}
+
+/// A model name from a result row; `None` when the spans carry none.
+fn model_from(hit: &json::Value) -> Option<String> {
+    hit.get("model")
+        .and_then(|v| v.as_str())
+        .filter(|m| !m.is_empty())
+        .map(str::to_string)
+}
+
+fn unpriced_models_sql(
+    stream: &str,
+    base: &str,
+    pred: &str,
+    cols: &Columns,
+    limit: usize,
+) -> String {
+    let (select, model) = model_grouping(cols);
+    let group = model.map(|m| format!(" GROUP BY {m}")).unwrap_or_default();
+    format!(
+        "SELECT {select}COUNT(*) AS spans, {} AS tokens FROM {} \
+         WHERE {base} AND {pred}{group} ORDER BY tokens DESC LIMIT {limit}",
+        cols.tokens_expr(),
+        quote_ident(stream)
+    )
+}
+
+/// A model's pricing gap is closed when today's definitions match its name exactly; a
+/// family-pattern match only approximates it. Pricing gaps marks such rows "Priced for new
+/// spans" by the same rule, so the check and the page agree.
+pub(crate) fn priced_now(resolved: Option<&DefinitionMatch>) -> bool {
+    resolved.is_some_and(|r| r.match_kind == MatchKind::Exact)
+}
+
+/// Whether every model behind the unpriced spans has a price now: the check then passes, while
+/// its counts keep the spans recorded at $0, which the cost tile still reads as a lower bound.
+/// Spans without a model name, or models past the listed rows, keep it failing.
+fn every_model_priced_now(
+    model_hits: &[json::Value],
+    model_count: i64,
+    priced: impl Fn(&str) -> bool,
+) -> bool {
+    !model_hits.is_empty()
+        && model_count <= model_hits.len() as i64
+        && model_hits
+            .iter()
+            .all(|h| model_from(h).is_some_and(|m| priced(&m)))
+}
+
+/// The uncapped totals behind a capped per-model breakdown of the spans matching `filter`:
+/// distinct model names, spans without one (the breakdown's null-model row), and tokens.
+fn breakdown_totals_sql(stream: &str, filter: &str, cols: &Columns) -> String {
+    let models = match cols.model_column() {
+        Some(m) => format!(
+            "COUNT(DISTINCT {m}) AS distinct_models, \
+             SUM(CASE WHEN {m} IS NULL THEN 1 ELSE 0 END) AS no_model_spans"
+        ),
+        None => "0 AS distinct_models, COUNT(*) AS no_model_spans".to_string(),
+    };
+    format!(
+        "SELECT {models}, {} AS tokens FROM {} WHERE {filter}",
+        cols.tokens_expr(),
+        quote_ident(stream)
+    )
+}
+
+/// Rows the uncapped breakdown has and their tokens, from a [`breakdown_totals_sql`] row.
+fn breakdown_totals(row: Option<&json::Value>) -> (i64, i64) {
+    let int = |key: &str| row.and_then(|r| r.get(key)).map_or(0, json::get_int_value);
+    let models = int("distinct_models") + i64::from(int("no_model_spans") > 0);
+    (models, int("tokens"))
+}
+
+/// Fills the unpriced check from the capped per-model rows and the uncapped totals row, so
+/// the counts stay right when the list is cut at [`MAX_MODELS`].
+fn set_unpriced_breakdown(
+    check: &mut HealthCheck,
+    model_hits: &[json::Value],
+    totals: Option<&json::Value>,
+) {
+    let models: Vec<ModelUsage> = model_hits
+        .iter()
+        .map(|h| ModelUsage {
+            model: model_from(h),
+            spans: h.get("spans").map_or(0, json::get_int_value),
+            tokens: h.get("tokens").map_or(0, json::get_int_value),
+        })
+        .collect();
+    let (model_count, tokens) = breakdown_totals(totals);
+    // Spans ingested between the two queries can only add models, never hide listed ones.
+    let model_count = model_count.max(models.len() as i64);
+    check.models_truncated = Some(model_count > models.len() as i64);
+    check.model_count = Some(model_count);
+    check.unpriced_tokens = Some(tokens);
+    check.models = Some(models);
+}
+
+fn status_for(id: CheckId, affected: i64) -> CheckStatus {
+    match (id, affected) {
+        (_, 0) => CheckStatus::Pass,
+        (CheckId::UnpricedModels, _) => CheckStatus::Error,
+        _ => CheckStatus::Warning,
+    }
+}
+
+/// Affected count of check `i` from the counts row.
+fn affected_from(pred: &Pred, row: &json::Value, i: usize, total: i64) -> i64 {
+    match pred {
+        Pred::Never => 0,
+        Pred::Always => total,
+        Pred::Sql(_) => row.get(format!("c{i}")).map_or(0, json::get_int_value),
+    }
+}
+
+fn all_pass(total: i64, include_samples: bool) -> Vec<HealthCheck> {
+    CHECK_IDS
+        .iter()
+        .map(|&id| HealthCheck::new(id, 0, total, include_samples))
+        .collect()
+}
+
+/// The search window after the caller's max query range for the stream is applied.
+#[derive(Debug)]
+struct Window {
+    start: i64,
+    end: i64,
+    /// The note the search attaches when the start was moved; empty when it was not.
+    range_error: String,
+}
+
+impl Window {
+    async fn for_stream(org_id: &str, user_id: &str, stream: &str, start: i64, end: i64) -> Self {
+        let max_hours = search_service::query_range::get_max_query_range(
+            &[stream.to_string()],
+            org_id,
+            user_id,
+            StreamType::Traces,
+        )
+        .await;
+        Self::clamped(start, end, max_hours)
+    }
+
+    fn clamped(start: i64, end: i64, max_hours: i64) -> Self {
+        let max_micros = max_hours * 3600 * 1_000_000;
+        if max_hours > 0 && end - start > max_micros {
+            Self {
+                start: end - max_micros,
+                end,
+                range_error: format!(
+                    "Query duration is modified due to query range restriction of {max_hours} hours"
+                ),
+            }
+        } else {
+            Self {
+                start,
+                end,
+                range_error: String::new(),
+            }
+        }
+    }
+
+    /// Whether a response is missing data. The search also flags a window clamped to the max
+    /// query range as partial, with only the range note in `function_error`; its hits are
+    /// complete for the clamped window, so that alone is not a failure.
+    fn is_real_partial(&self, resp: &config::meta::search::Response) -> bool {
+        resp.is_partial
+            && (self.range_error.is_empty()
+                || resp.function_error.iter().any(|e| *e != self.range_error))
+    }
+}
+
+async fn run_sql(
+    org_id: &str,
+    user_id: &str,
+    sql: String,
+    window: &Window,
+    size: usize,
+) -> Result<Vec<json::Value>, anyhow::Error> {
+    let req = SearchRequest {
+        query: SearchQuery {
+            sql,
+            from: 0,
+            size: size as i64,
+            start_time: window.start,
+            end_time: window.end,
+            ..Default::default()
+        },
+        encoding: RequestEncoding::Empty,
+        ..Default::default()
+    };
+    let trace_id = config::ider::generate_trace_id();
+    let resp = search_service::cache::search(
+        &trace_id,
+        org_id,
+        StreamType::Traces,
+        Some(user_id.to_string()),
+        &req,
+        window.range_error.clone(),
+        false,
+        None,
+        false,
+    )
+    .await?;
+    if window.is_real_partial(&resp) {
+        anyhow::bail!("partial search result: {}", resp.function_error.join("; "));
+    }
+    Ok(resp.hits)
+}
+
+async fn stream_columns(org_id: &str, stream: &str) -> Option<Columns> {
+    infra::schema::get_stream_schema_from_cache(org_id, stream, StreamType::Traces)
+        .await
+        .map(|s| Columns::from_schema(&s))
+}
+
+/// The queries that follow the counts: sample trace ids per failing check, only when the
+/// caller asked for samples, and the unpriced model breakdown.
+fn follow_up_sql(
+    stream: &str,
+    base: &str,
+    cols: &Columns,
+    preds: &[Pred],
+    checks: &[HealthCheck],
+    include_samples: bool,
+) -> (Vec<(usize, String)>, Option<String>) {
+    let samples = if include_samples {
+        checks
+            .iter()
+            .zip(preds)
+            .enumerate()
+            .filter(|(_, (c, _))| c.affected > 0)
+            .map(|(i, (_, pred))| (i, samples_sql(stream, base, pred)))
+            .collect()
+    } else {
+        vec![]
+    };
+    let unpriced = match (&preds[0], checks[0].affected > 0) {
+        (Pred::Sql(p), true) => Some(unpriced_models_sql(
+            stream,
+            base,
+            p,
+            cols,
+            MAX_UNPRICED_ROWS,
+        )),
+        _ => None,
+    };
+    (samples, unpriced)
+}
+
+/// Enrich cached strip checks without repeating the window-wide aggregations.
+async fn populate_samples(
+    org_id: &str,
+    user_id: &str,
+    query: &DataHealthQuery,
+    window: &Window,
+    checks: &mut [HealthCheck],
+) -> Result<(), anyhow::Error> {
+    for check in checks.iter_mut() {
+        check.samples = Some(Vec::new());
+    }
+    let Some(cols) = stream_columns(org_id, &query.stream_name).await else {
+        return Ok(());
+    };
+    let Some(base) = base_where(&cols, query) else {
+        return Ok(());
+    };
+    let pricing_enabled = config::get_config().common.model_pricing_enabled;
+    let jobs = checks
+        .iter()
+        .enumerate()
+        .filter(|(_, check)| check.status != CheckStatus::Pass)
+        .map(|(i, check)| {
+            let pred = check_pred(check.id, &cols, pricing_enabled);
+            let sql = samples_sql(&query.stream_name, &base, &pred);
+            async move {
+                (
+                    i,
+                    run_sql(org_id, user_id, sql, window, SAMPLE_SCAN_ROWS).await,
+                )
+            }
+        })
+        .collect::<Vec<_>>();
+    for (i, hits) in futures::future::join_all(jobs).await {
+        checks[i].samples = Some(distinct_trace_ids(&hits?));
+    }
+    Ok(())
+}
+
+async fn compute_checks(
+    org_id: &str,
+    user_id: &str,
+    query: &DataHealthQuery,
+    window: &Window,
+) -> Result<Vec<HealthCheck>, anyhow::Error> {
+    let include_samples = query.include_samples;
+    let Some(cols) = stream_columns(org_id, &query.stream_name).await else {
+        return Ok(all_pass(0, include_samples));
+    };
+    let Some(base) = base_where(&cols, query) else {
+        return Ok(all_pass(0, include_samples));
+    };
+    let stream = &query.stream_name;
+    let pricing_enabled = config::get_config().common.model_pricing_enabled;
+    let preds: Vec<Pred> = CHECK_IDS
+        .iter()
+        .map(|&id| check_pred(id, &cols, pricing_enabled))
+        .collect();
+
+    let rows = run_sql(
+        org_id,
+        user_id,
+        counts_sql(stream, &base, &preds, &cols),
+        window,
+        1,
+    )
+    .await?;
+    let row = rows.into_iter().next().unwrap_or_default();
+    let total = row.get("total").map_or(0, json::get_int_value);
+
+    let mut checks: Vec<HealthCheck> = CHECK_IDS
+        .iter()
+        .zip(&preds)
+        .enumerate()
+        .map(|(i, (&id, pred))| {
+            HealthCheck::new(
+                id,
+                affected_from(pred, &row, i, total),
+                total,
+                include_samples,
+            )
+        })
+        .collect();
+
+    let (sample_sqls, unpriced_sql) =
+        follow_up_sql(stream, &base, &cols, &preds, &checks, include_samples);
+    let sample_jobs = sample_sqls
+        .into_iter()
+        .map(|(i, sql)| async move {
+            (
+                i,
+                run_sql(org_id, user_id, sql, window, SAMPLE_SCAN_ROWS).await,
+            )
+        })
+        .collect::<Vec<_>>();
+    let unpriced_job = async {
+        let Some(sql) = unpriced_sql else {
+            return Ok(None);
+        };
+        run_sql(org_id, user_id, sql, window, MAX_UNPRICED_ROWS)
+            .await
+            .map(Some)
+    };
+    let (samples, unpriced) = tokio::join!(futures::future::join_all(sample_jobs), unpriced_job);
+
+    for (i, hits) in samples {
+        checks[i].samples = Some(distinct_trace_ids(&hits?));
+    }
+    if let Some(model_hits) = unpriced? {
+        let listed = &model_hits[..model_hits.len().min(MAX_MODELS)];
+        set_unpriced_breakdown(&mut checks[0], listed, Some(&row));
+        let entries = db::model_pricing::get_org_pricing_entries(org_id);
+        let now = now_micros();
+        let model_count = checks[0].model_count.unwrap_or(0);
+        if every_model_priced_now(&model_hits, model_count, |m| {
+            priced_now(db::model_pricing::find_pricing_sync_at(&entries, m, Some(now)).as_ref())
+        }) {
+            checks[0].status = CheckStatus::Pass;
+            // Samples are per failing check, as the cached path returns them.
+            checks[0].samples = include_samples.then(Vec::new);
+        }
+    }
+
+    // Worst first, so the strip and the skill lead with what matters.
+    checks.sort_by_key(|c| match c.status {
+        CheckStatus::Error => 0,
+        CheckStatus::Warning => 1,
+        CheckStatus::Pass => 2,
+    });
+    Ok(checks)
+}
+
+/// A cached value and the time it was computed, for the [`CACHE_TTL_MICROS`] caches here.
+trait CheckedAt {
+    fn checked_at(&self) -> i64;
+}
+
+impl CheckedAt for DataHealthResponse {
+    fn checked_at(&self) -> i64 {
+        self.checked_at
+    }
+}
+
+type TtlCache<V> = LazyLock<Mutex<HashMap<String, V>>>;
+
+static CACHE: TtlCache<DataHealthResponse> = LazyLock::new(|| Mutex::new(HashMap::new()));
+
+/// Keyed by the window after the caller's max query range, so callers with different range
+/// limits never share an entry.
+fn cache_key(org_id: &str, q: &DataHealthQuery, window: &Window) -> String {
+    format!(
+        "{org_id}\u{1f}{}\u{1f}{}\u{1f}{}\u{1f}{}\u{1f}{}\u{1f}{}\u{1f}{}\u{1f}{}",
+        q.stream_name,
+        q.agent.as_deref().unwrap_or(""),
+        q.agent_id.as_deref().unwrap_or(""),
+        q.env.as_deref().unwrap_or(""),
+        q.version.as_deref().unwrap_or(""),
+        window.start / WINDOW_QUANTUM_MICROS,
+        window.end / WINDOW_QUANTUM_MICROS,
+        q.include_samples,
+    )
+}
+
+fn cache_get<V: CheckedAt + Clone>(
+    cache: &Mutex<HashMap<String, V>>,
+    key: &str,
+    now: i64,
+) -> Option<V> {
+    let cache = cache.lock().unwrap_or_else(|e| e.into_inner());
+    cache
+        .get(key)
+        .filter(|r| now - r.checked_at() < CACHE_TTL_MICROS)
+        .cloned()
+}
+
+/// Inserts `value`, first dropping expired entries and then, if the map is still full, only
+/// the oldest entry, so one new scope never evicts every warm one.
+fn insert_bounded<V: CheckedAt>(
+    cache: &mut HashMap<String, V>,
+    key: String,
+    value: V,
+    max_entries: usize,
+) {
+    let now = value.checked_at();
+    cache.retain(|_, r| now - r.checked_at() < CACHE_TTL_MICROS);
+    if cache.len() >= max_entries
+        && !cache.contains_key(&key)
+        && let Some(oldest) = cache
+            .iter()
+            .min_by_key(|(_, r)| r.checked_at())
+            .map(|(k, _)| k.clone())
+    {
+        cache.remove(&oldest);
+    }
+    cache.insert(key, value);
+}
+
+fn cache_put<V: CheckedAt>(cache: &Mutex<HashMap<String, V>>, key: String, value: V) {
+    let mut cache = cache.lock().unwrap_or_else(|e| e.into_inner());
+    insert_bounded(&mut cache, key, value, CACHE_MAX_ENTRIES);
+}
+
+fn validate_window(start_time: i64, end_time: i64) -> Result<(), &'static str> {
+    if start_time <= 0 || end_time <= 0 || start_time >= end_time {
+        return Err("start_time and end_time must be positive and start_time < end_time");
+    }
+    Ok(())
+}
+
+/// The gates the trace endpoints apply on enterprise: the license search allowance (429), then
+/// read access to the trace stream (403).
+async fn authorize_read(org_id: &str, user_id: &str, stream: &str) -> Result<(), Response> {
+    #[cfg(feature = "enterprise")]
+    {
+        if let Err(e) = search_service::check_search_allowed(org_id, Some(stream)) {
+            return Err(MetaHttpResponse::too_many_requests(e.to_string()));
+        }
+        if let Some(denied) = openobserve_core::authz::check_stream_permissions(
+            stream,
+            org_id,
+            user_id,
+            &StreamType::Traces,
+            openobserve_core::authz::StreamPermissionResourceType::Search,
+        )
+        .await
+        {
+            return Err(denied);
+        }
+    }
+    #[cfg(not(feature = "enterprise"))]
+    let _ = (org_id, user_id, stream);
+    Ok(())
+}
+
+/// GetGenAiDataHealth
+///
+/// #{"ratelimit_module":"Traces", "ratelimit_module_operation":"list"}#
+#[utoipa::path(
+    get,
+    path = "/{org_id}/gen_ai/data_health",
+    context_path = "/api",
+    tag = "GenAI Settings",
+    operation_id = "GetGenAiDataHealth",
+    summary = "AI data health checks",
+    description = "Counts LLM spans with no model price, no agent identity, zero duration, or no session id in a trace stream and window. Pass include_samples=true for sample trace ids per failing check. Results are cached for about a minute; pass refresh=true to recompute.",
+    params(("org_id" = String, Path, description = "Organization ID"), DataHealthQuery),
+    responses(
+        (status = 200, description = "Data health checks", body = DataHealthResponse),
+        (status = 400, description = "Invalid query"),
+        (status = 403, description = "Forbidden"),
+        (status = 429, description = "Search not allowed for the organization"),
+        (status = 500, description = "Internal server error")
+    ),
+    security(("Authorization" = [])),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Traces", "operation": "list"})),
+        ("x-o2-mcp" = json!({"enabled": false}))
+    )
+)]
+pub async fn get_data_health(
+    Path(org_id): Path<String>,
+    openobserve_api_common::extractors::Headers(user_email): openobserve_api_common::extractors::Headers<
+        openobserve_core::auth::UserEmail,
+    >,
+    axum::extract::Query(query): axum::extract::Query<DataHealthQuery>,
+) -> Response {
+    if let Err(e) = validate_window(query.start_time, query.end_time) {
+        return MetaHttpResponse::bad_request(e);
+    }
+    let user_id = &user_email.user_id;
+    if let Err(resp) = authorize_read(&org_id, user_id, &query.stream_name).await {
+        return resp;
+    }
+
+    let window = Window::for_stream(
+        &org_id,
+        user_id,
+        &query.stream_name,
+        query.start_time,
+        query.end_time,
+    )
+    .await;
+    let key = cache_key(&org_id, &query, &window);
+    let now = now_micros();
+    if !query.refresh
+        && let Some(cached) = cache_get(&CACHE, &key, now)
+    {
+        return MetaHttpResponse::json(cached);
+    }
+    let result = async {
+        if query.include_samples && !query.refresh {
+            let mut aggregate_query = query.clone();
+            aggregate_query.include_samples = false;
+            let aggregate_key = cache_key(&org_id, &aggregate_query, &window);
+            if let Some(mut cached) = cache_get(&CACHE, &aggregate_key, now) {
+                populate_samples(&org_id, user_id, &query, &window, &mut cached.checks).await?;
+                return Ok::<_, anyhow::Error>(cached);
+            }
+        }
+        let checks = compute_checks(&org_id, user_id, &query, &window).await?;
+        Ok(DataHealthResponse {
+            checked_at: now,
+            checks,
+        })
+    }
+    .await;
+    match result {
+        Ok(resp) => {
+            cache_put(&CACHE, key, resp.clone());
+            MetaHttpResponse::json(resp)
+        }
+        Err(e) => {
+            log::error!(
+                "[gen_ai_health] checks failed for {org_id}/{}: {e}",
+                query.stream_name
+            );
+            MetaHttpResponse::internal_error("Failed to run data health checks")
+        }
+    }
+}
+
+#[derive(Debug, Clone, Deserialize, IntoParams)]
+#[into_params(parameter_in = Query)]
+pub struct UnpricedModelsQuery {
+    pub stream_name: String,
+    pub start_time: i64,
+    pub end_time: i64,
+}
+
+/// A model whose spans in the window were priced approximately or not at all.
+#[derive(Debug, Clone, Serialize, ToSchema)]
+pub struct UnpricedModelRow {
+    /// Null for spans that carry no model name: they have tokens but nothing to price.
+    pub model: Option<String>,
+    pub status: CostStatus,
+    pub spans: i64,
+    pub tokens: i64,
+    /// Cost recorded at ingest (0 for unpriced spans).
+    pub cost: f64,
+    /// Up to [`MAX_AGENT_NAMES`] agent names that sent the model.
+    pub agents: Vec<String>,
+    /// Distinct agent names behind the row, including those past the cap.
+    pub agent_count: i64,
+}
+
+/// The spans the Unpriced tab lists: marked unpriced or approximate. `free` spans have a price.
+fn listed_status_pred() -> String {
+    format!(
+        "{COST_STATUS_COLUMN} IN ({}, {})",
+        quote_str(CostStatus::Unpriced.as_str()),
+        quote_str(CostStatus::Approximate.as_str())
+    )
+}
+
+fn unpriced_list_sql(stream: &str, cols: &Columns) -> Option<String> {
+    if !cols.has(COST_STATUS_COLUMN) {
+        return None;
+    }
+    let (select, model) = model_grouping(cols);
+    let group = match model {
+        Some(m) => format!("{m}, {COST_STATUS_COLUMN}"),
+        None => COST_STATUS_COLUMN.to_string(),
+    };
+    let cost = if cols.has(COST_COLUMN) {
+        "COALESCE(SUM(gen_ai_usage_cost), 0)"
+    } else {
+        "0"
+    };
+    let (agents, agent_count) = if cols.has(AGENT_NAME_COLUMN) {
+        (
+            format!(
+                "array_slice(array_agg(DISTINCT gen_ai_agent_name) FILTER (WHERE \
+                 gen_ai_agent_name IS NOT NULL AND gen_ai_agent_name != ''), 1, {MAX_AGENT_NAMES})"
+            ),
+            "COUNT(DISTINCT NULLIF(gen_ai_agent_name, ''))",
+        )
+    } else {
+        ("NULL".to_string(), "0")
+    };
+    Some(format!(
+        "SELECT {select}{COST_STATUS_COLUMN} AS status, COUNT(*) AS spans, {} AS tokens, \
+         {cost} AS cost, {agents} AS agents, {agent_count} AS agent_count FROM {} WHERE {} \
+         GROUP BY {group} ORDER BY tokens DESC LIMIT {MAX_UNPRICED_ROWS}",
+        cols.tokens_expr(),
+        quote_ident(stream),
+        listed_status_pred(),
+    ))
+}
+
+fn parse_unpriced_row(hit: &json::Value) -> Option<UnpricedModelRow> {
+    let status = match hit.get("status")?.as_str()? {
+        "unpriced" => CostStatus::Unpriced,
+        "approximate" => CostStatus::Approximate,
+        _ => return None,
+    };
+    let mut agents: Vec<String> = match hit.get("agents") {
+        Some(json::Value::Array(items)) => items
+            .iter()
+            .filter_map(|v| v.as_str().map(str::to_string))
+            .collect(),
+        // Some engines return the aggregated array as a JSON string.
+        Some(json::Value::String(s)) => json::from_str::<Vec<String>>(s).unwrap_or_default(),
+        _ => vec![],
+    };
+    agents.truncate(MAX_AGENT_NAMES);
+    let agent_count = hit
+        .get("agent_count")
+        .map_or(0, json::get_int_value)
+        .max(agents.len() as i64);
+    Some(UnpricedModelRow {
+        model: model_from(hit),
+        status,
+        spans: hit.get("spans").map_or(0, json::get_int_value),
+        tokens: hit.get("tokens").map_or(0, json::get_int_value),
+        cost: hit.get("cost").map_or(0.0, json::get_float_value),
+        agents,
+        agent_count,
+    })
+}
+
+/// The models ingest marked unpriced or approximate in a window: the [`MAX_UNPRICED_ROWS`]
+/// (model, status) rows with the most tokens, and totals over every marked span.
+#[derive(Debug, Default, Clone)]
+pub struct UnpricedModels {
+    pub rows: Vec<UnpricedModelRow>,
+    /// Distinct models behind every marked span (spans without a model name count as one).
+    pub model_count: i64,
+    /// Tokens on every marked span.
+    pub tokens: i64,
+    /// `rows` leaves some of the `model_count` models out.
+    pub truncated: bool,
+}
+
+fn unpriced_listing(hits: &[json::Value], totals: Option<&json::Value>) -> UnpricedModels {
+    // The raw value, so a '' model and a missing one stay apart as they do in the totals.
+    let listed = hits
+        .iter()
+        .map(|h| h.get("model").and_then(|v| v.as_str()))
+        .collect::<std::collections::HashSet<_>>()
+        .len() as i64;
+    let (model_count, tokens) = breakdown_totals(totals);
+    // Spans ingested between the two queries can only add models, never hide listed ones.
+    let model_count = model_count.max(listed);
+    UnpricedModels {
+        rows: hits.iter().filter_map(parse_unpriced_row).collect(),
+        model_count,
+        tokens,
+        truncated: model_count > listed,
+    }
+}
+
+/// A cached [`UnpricedModels`] listing; today's prices are applied after the cache, so a
+/// price added or muted shows on the next request.
+#[derive(Clone)]
+struct CachedUnpriced {
+    checked_at: i64,
+    listing: UnpricedModels,
+}
+
+impl CheckedAt for CachedUnpriced {
+    fn checked_at(&self) -> i64 {
+        self.checked_at
+    }
+}
+
+static UNPRICED_CACHE: TtlCache<CachedUnpriced> = LazyLock::new(|| Mutex::new(HashMap::new()));
+
+/// Keyed by org, stream and the window after the caller's max query range, to the minute.
+fn unpriced_cache_key(org_id: &str, stream: &str, window: &Window) -> String {
+    format!(
+        "{org_id}\u{1f}{stream}\u{1f}{}\u{1f}{}",
+        window.start / WINDOW_QUANTUM_MICROS,
+        window.end / WINDOW_QUANTUM_MICROS,
+    )
+}
+
+/// The cached listing under `key` when it is younger than [`CACHE_TTL_MICROS`], else the
+/// result of `compute`, cached on success.
+async fn cached_unpriced(
+    key: String,
+    now: i64,
+    compute: impl Future<Output = Result<UnpricedModels, anyhow::Error>>,
+) -> Result<UnpricedModels, anyhow::Error> {
+    if let Some(cached) = cache_get(&UNPRICED_CACHE, &key, now) {
+        return Ok(cached.listing);
+    }
+    let listing = compute.await?;
+    cache_put(
+        &UNPRICED_CACHE,
+        key,
+        CachedUnpriced {
+            checked_at: now,
+            listing: listing.clone(),
+        },
+    );
+    Ok(listing)
+}
+
+/// Models in `stream` that ingest marked unpriced or approximate during the window, cached
+/// for [`CACHE_TTL_MICROS`] per org, stream and window.
+pub async fn unpriced_models(
+    org_id: &str,
+    user_id: &str,
+    query: &UnpricedModelsQuery,
+) -> Result<UnpricedModels, anyhow::Error> {
+    let Some(cols) = stream_columns(org_id, &query.stream_name).await else {
+        return Ok(UnpricedModels::default());
+    };
+    let Some(sql) = unpriced_list_sql(&query.stream_name, &cols) else {
+        return Ok(UnpricedModels::default());
+    };
+    let totals_sql = breakdown_totals_sql(&query.stream_name, &listed_status_pred(), &cols);
+    let window = Window::for_stream(
+        org_id,
+        user_id,
+        &query.stream_name,
+        query.start_time,
+        query.end_time,
+    )
+    .await;
+    let key = unpriced_cache_key(org_id, &query.stream_name, &window);
+    cached_unpriced(key, now_micros(), async {
+        let (hits, totals) = tokio::try_join!(
+            run_sql(org_id, user_id, sql, &window, MAX_UNPRICED_ROWS),
+            run_sql(org_id, user_id, totals_sql, &window, 1),
+        )?;
+        Ok(unpriced_listing(&hits, totals.first()))
+    })
+    .await
+}
+
+/// Validates the window and applies the trace endpoints' search allowance and stream access
+/// gates.
+pub async fn authorize_unpriced(
+    org_id: &str,
+    user_id: &str,
+    query: &UnpricedModelsQuery,
+) -> Result<(), Response> {
+    validate_window(query.start_time, query.end_time).map_err(MetaHttpResponse::bad_request)?;
+    authorize_read(org_id, user_id, &query.stream_name).await
+}
+
+#[cfg(test)]
+mod tests {
+    use arrow_schema::{DataType, Field, Schema};
+
+    use super::*;
+
+    fn cols(names: &[&str]) -> Columns {
+        Columns::from_schema(&Schema::new(
+            names
+                .iter()
+                .map(|n| Field::new(*n, DataType::Utf8, true))
+                .collect::<Vec<_>>(),
+        ))
+    }
+
+    fn query() -> DataHealthQuery {
+        DataHealthQuery {
+            stream_name: "default".into(),
+            start_time: 1,
+            end_time: 2,
+            agent: None,
+            agent_id: None,
+            env: None,
+            version: None,
+            refresh: false,
+            include_samples: false,
+        }
+    }
+
+    const FULL: &[&str] = &[
+        "gen_ai_operation_name",
+        "gen_ai_agent_name",
+        "gen_ai_agent_id",
+        "gen_ai_agent_env",
+        "gen_ai_agent_version",
+        "gen_ai_conversation_id",
+        "gen_ai_response_model",
+        "gen_ai_usage_total_tokens",
+        "gen_ai_usage_cost",
+        "gen_ai_usage_cost_status",
+        "duration",
+    ];
+
+    #[test]
+    fn missing_columns_degrade_per_check() {
+        // A stream written before the cost marker, with no agent or session columns.
+        let c = cols(&["gen_ai_operation_name", "duration"]);
+        assert_eq!(check_pred(CheckId::UnpricedModels, &c, true), Pred::Never);
+        assert_eq!(
+            check_pred(CheckId::MissingAgentIdentity, &c, true),
+            Pred::Always
+        );
+        assert_eq!(
+            check_pred(CheckId::MissingSessionId, &c, true),
+            Pred::Always
+        );
+        assert_eq!(
+            check_pred(CheckId::ZeroDurationSpans, &c, true),
+            Pred::Sql("duration = 0".into())
+        );
+        // Only the present identity column is tested.
+        let c = cols(&["gen_ai_operation_name", "gen_ai_agent_name"]);
+        assert_eq!(
+            check_pred(CheckId::MissingAgentIdentity, &c, true),
+            Pred::Sql("(gen_ai_agent_name IS NULL OR gen_ai_agent_name = '')".into())
+        );
+    }
+
+    #[test]
+    fn missing_session_check_reads_every_session_column() {
+        // A stream that keeps sessions in `session_id` alone must not flag every span.
+        let c = cols(&["gen_ai_operation_name", "session_id"]);
+        assert_eq!(
+            check_pred(CheckId::MissingSessionId, &c, true),
+            Pred::Sql("(\"session_id\" IS NULL OR \"session_id\" = '')".into())
+        );
+        // A span is missing a session only when every present session column is blank.
+        let c = cols(&["gen_ai_operation_name", "session_id", "llm_session_id"]);
+        assert_eq!(
+            check_pred(CheckId::MissingSessionId, &c, true),
+            Pred::Sql(
+                "(\"session_id\" IS NULL OR \"session_id\" = '') AND (\"llm_session_id\" IS NULL \
+                 OR \"llm_session_id\" = '')"
+                    .into()
+            )
+        );
+    }
+
+    #[test]
+    fn the_unpriced_check_passes_only_once_every_found_model_is_priced() {
+        let hits = |models: &[Option<&str>]| -> Vec<json::Value> {
+            models
+                .iter()
+                .map(|m| json::json!({"model": m, "spans": 1, "tokens": 1}))
+                .collect()
+        };
+        let priced = |m: &str| m != "open";
+        assert!(every_model_priced_now(
+            &hits(&[Some("a"), Some("b")]),
+            2,
+            priced
+        ));
+        assert!(!every_model_priced_now(
+            &hits(&[Some("a"), Some("open")]),
+            2,
+            priced
+        ));
+        // Spans without a model name can never be priced.
+        assert!(!every_model_priced_now(
+            &hits(&[Some("a"), None]),
+            2,
+            priced
+        ));
+        // Models past the listed rows are unknown.
+        assert!(!every_model_priced_now(&hits(&[Some("a")]), 2, priced));
+        assert!(!every_model_priced_now(&[], 0, priced));
+        assert!(!priced_now(None));
+    }
+
+    #[test]
+    fn unpriced_check_passes_when_pricing_is_disabled() {
+        let c = cols(FULL);
+        assert!(matches!(
+            check_pred(CheckId::UnpricedModels, &c, true),
+            Pred::Sql(_)
+        ));
+        // Spans marked unpriced before pricing was turned off do not count.
+        let pred = check_pred(CheckId::UnpricedModels, &c, false);
+        assert_eq!(pred, Pred::Never);
+        let row = json::json!({ "total": 10, "c0": 7 });
+        let check = HealthCheck::new(
+            CheckId::UnpricedModels,
+            affected_from(&pred, &row, 0, 10),
+            10,
+            false,
+        );
+        assert_eq!(check.status, CheckStatus::Pass);
+        assert_eq!(check.affected, 0);
+        // No breakdown query runs, so there is no model to fix.
+        let base = base_where(&c, &query()).unwrap();
+        let preds: Vec<Pred> = CHECK_IDS
+            .iter()
+            .map(|&id| check_pred(id, &c, false))
+            .collect();
+        let (_, unpriced) = follow_up_sql("default", &base, &c, &preds, &[check], false);
+        assert!(unpriced.is_none());
+    }
+
+    #[test]
+    fn affected_counts_follow_predicate_semantics() {
+        let c = cols(&["gen_ai_operation_name", "duration"]);
+        let preds: Vec<Pred> = CHECK_IDS
+            .iter()
+            .map(|&id| check_pred(id, &c, true))
+            .collect();
+        let row = json::json!({"total": 10, "c2": 4});
+        assert_eq!(affected_from(&preds[0], &row, 0, 10), 0);
+        assert_eq!(affected_from(&preds[1], &row, 1, 10), 10);
+        assert_eq!(affected_from(&preds[2], &row, 2, 10), 4);
+    }
+
+    #[test]
+    fn scope_filters_quote_values_and_require_columns() {
+        let mut q = query();
+        q.agent = Some("o'brien".into());
+        q.version = Some("1.2".into());
+        let base = base_where(&cols(FULL), &q).unwrap();
+        assert_eq!(
+            base,
+            "gen_ai_operation_name IS NOT NULL AND gen_ai_agent_name = 'o''brien' \
+             AND gen_ai_agent_version = '1.2'"
+        );
+        // Scoped to a version the stream has no column for: nothing is in scope.
+        assert!(base_where(&cols(&["gen_ai_operation_name", "gen_ai_agent_name"]), &q).is_none());
+        // No LLM spans at all.
+        assert!(base_where(&cols(&["duration"]), &query()).is_none());
+    }
+
+    #[test]
+    fn agent_id_scopes_on_the_id_column() {
+        // An id-only agent is listed with its id as the name; the id is what its spans carry.
+        let mut q = query();
+        q.agent = Some("a23ca1dd38a1ff350".into());
+        q.agent_id = Some("a23ca1dd38a1ff350".into());
+        q.env = Some("prod".into());
+        assert_eq!(
+            base_where(&cols(FULL), &q).unwrap(),
+            "gen_ai_operation_name IS NOT NULL AND gen_ai_agent_id = 'a23ca1dd38a1ff350' \
+             AND gen_ai_agent_env = 'prod'"
+        );
+        // An empty id falls back to the name.
+        q.agent_id = Some(String::new());
+        assert!(
+            base_where(&cols(FULL), &q)
+                .unwrap()
+                .contains("gen_ai_agent_name = 'a23ca1dd38a1ff350'")
+        );
+        // A stream without the id column has none of that agent's spans.
+        q.agent_id = Some("a23ca1dd38a1ff350".into());
+        assert!(base_where(&cols(&["gen_ai_operation_name", "gen_ai_agent_name"]), &q).is_none());
+    }
+
+    #[test]
+    fn a_range_clamp_alone_is_not_a_partial_result() {
+        const HOUR: i64 = 3600 * 1_000_000;
+        let end = 1_000 * HOUR;
+        // Seven days on a stream capped at 24 h: the start moves and the note is set.
+        let w = Window::clamped(end - 7 * 24 * HOUR, end, 24);
+        assert_eq!((w.start, w.end), (end - 24 * HOUR, end));
+        let clamp_only = config::meta::search::Response {
+            is_partial: true,
+            function_error: vec![w.range_error.clone()],
+            ..Default::default()
+        };
+        assert!(!w.is_real_partial(&clamp_only));
+        // A real gap on top of the clamp still fails.
+        let mut gap = clamp_only.clone();
+        gap.function_error.insert(
+            0,
+            config::meta::search::PARTIAL_ERROR_RESPONSE_MESSAGE.into(),
+        );
+        assert!(w.is_real_partial(&gap));
+        // Without a clamp every partial result fails.
+        let w = Window::clamped(end - HOUR, end, 24);
+        assert!(w.range_error.is_empty());
+        assert_eq!(w.start, end - HOUR);
+        assert!(w.is_real_partial(&clamp_only));
+        // No cap configured.
+        assert_eq!(Window::clamped(1, end, 0).start, 1);
+    }
+
+    #[test]
+    fn unpriced_is_an_error_others_warn() {
+        assert_eq!(status_for(CheckId::UnpricedModels, 1), CheckStatus::Error);
+        assert_eq!(
+            status_for(CheckId::MissingAgentIdentity, 5),
+            CheckStatus::Warning
+        );
+        assert_eq!(status_for(CheckId::MissingSessionId, 0), CheckStatus::Pass);
+    }
+
+    #[test]
+    fn unpriced_list_needs_the_marker_column() {
+        assert!(unpriced_list_sql("default", &cols(&["gen_ai_response_model"])).is_none());
+        let sql = unpriced_list_sql("default", &cols(FULL)).unwrap();
+        assert!(sql.contains("GROUP BY gen_ai_response_model, gen_ai_usage_cost_status"));
+        // Model-less spans are listed too, as one row per status.
+        assert!(!sql.contains("gen_ai_response_model IS NOT NULL"));
+        // Free (exact $0) spans have a price: they are not listed or counted.
+        assert!(sql.contains("WHERE gen_ai_usage_cost_status IN ('unpriced', 'approximate')"));
+        assert!(
+            parse_unpriced_row(&json::json!({
+                "model": "acme-internal-llm", "status": "free", "spans": 1, "tokens": 10
+            }))
+            .is_none()
+        );
+        let row = parse_unpriced_row(&json::json!({
+            "model": "acme-internal-llm", "status": "unpriced", "spans": 3, "tokens": 900,
+            "cost": null, "agents": ["research-agent"]
+        }))
+        .unwrap();
+        assert_eq!(row.model.as_deref(), Some("acme-internal-llm"));
+        assert_eq!(row.status, CostStatus::Unpriced);
+        assert_eq!(row.agents, vec!["research-agent".to_string()]);
+        assert_eq!(row.cost, 0.0);
+    }
+
+    #[test]
+    fn spans_without_a_model_name_form_a_null_model_row() {
+        let row = parse_unpriced_row(&json::json!({
+            "model": null, "status": "unpriced", "spans": 2, "tokens": 300, "cost": null
+        }))
+        .unwrap();
+        assert_eq!(row.model, None);
+        assert_eq!(row.tokens, 300);
+        // A stream that never saw a model column groups by status alone.
+        let c = cols(&["gen_ai_operation_name", "gen_ai_usage_cost_status"]);
+        let sql = unpriced_list_sql("default", &c).unwrap();
+        assert!(sql.starts_with("SELECT gen_ai_usage_cost_status AS status,"));
+        assert!(sql.contains("GROUP BY gen_ai_usage_cost_status ORDER BY"));
+        let sql = unpriced_models_sql("default", "b", "p", &c, MAX_MODELS);
+        assert!(sql.starts_with("SELECT COUNT(*) AS spans,"));
+        assert!(!sql.contains("GROUP BY"));
+        assert_eq!(model_from(&json::json!({"spans": 2})), None);
+        assert_eq!(model_from(&json::json!({"model": ""})), None);
+    }
+
+    fn failing_checks(cols: &Columns) -> (Vec<Pred>, Vec<HealthCheck>) {
+        let preds: Vec<Pred> = CHECK_IDS
+            .iter()
+            .map(|&id| check_pred(id, cols, true))
+            .collect();
+        let checks = CHECK_IDS
+            .iter()
+            .map(|&id| HealthCheck::new(id, 5, 10, false))
+            .collect();
+        (preds, checks)
+    }
+
+    /// Per-model rows as the engine returns them: most tokens first, at most `limit`.
+    fn top_rows(models: &[(Option<String>, i64)], limit: usize) -> Vec<json::Value> {
+        let mut sorted = models.to_vec();
+        sorted.sort_by_key(|(_, tokens)| std::cmp::Reverse(*tokens));
+        sorted
+            .into_iter()
+            .take(limit)
+            .map(|(model, tokens)| json::json!({ "model": model, "spans": 1, "tokens": tokens }))
+            .collect()
+    }
+
+    #[test]
+    fn unpriced_totals_cover_models_past_the_list_cap() {
+        // 25 unpriced models, one of them spans without a model name.
+        let models: Vec<(Option<String>, i64)> = (1..=25)
+            .map(|i| ((i != 7).then(|| format!("model-{i:02}")), i * 100))
+            .collect();
+        let all_tokens: i64 = models.iter().map(|(_, t)| t).sum();
+
+        let mut check = HealthCheck::new(CheckId::UnpricedModels, 25, 40, false);
+        let totals =
+            json::json!({ "distinct_models": 24, "no_model_spans": 1, "tokens": all_tokens });
+        set_unpriced_breakdown(&mut check, &top_rows(&models, MAX_MODELS), Some(&totals));
+        assert_eq!(check.models.as_ref().unwrap().len(), MAX_MODELS);
+        assert_eq!(check.model_count, Some(25));
+        assert_eq!(check.unpriced_tokens, Some(all_tokens));
+        assert_eq!(check.models_truncated, Some(true));
+        // Every model fits: nothing is cut.
+        let few = &models[..3];
+        let mut check = HealthCheck::new(CheckId::UnpricedModels, 3, 40, false);
+        let totals = json::json!({ "distinct_models": 3, "no_model_spans": 0, "tokens": 600 });
+        set_unpriced_breakdown(&mut check, &top_rows(few, MAX_MODELS), Some(&totals));
+        assert_eq!(check.model_count, Some(3));
+        assert_eq!(check.models_truncated, Some(false));
+        // The wire form carries the totals on the unpriced check only.
+        let wire = json::to_value(&check).unwrap();
+        assert_eq!(wire["model_count"], 3);
+        assert_eq!(wire["unpriced_tokens"], 600);
+        assert_eq!(wire["models_truncated"], false);
+        let other = json::to_value(HealthCheck::new(CheckId::ZeroDurationSpans, 1, 4, false));
+        assert!(other.unwrap().get("model_count").is_none());
+    }
+
+    #[test]
+    fn unpriced_list_totals_cover_rows_past_the_cap() {
+        let models: Vec<(Option<String>, i64)> = (1..=120)
+            .map(|i| (Some(format!("model-{i:03}")), i))
+            .collect();
+        let mut rows = top_rows(&models, MAX_UNPRICED_ROWS);
+        for row in &mut rows {
+            row["status"] = json::json!("unpriced");
+        }
+        let totals = json::json!({ "distinct_models": 120, "no_model_spans": 0, "tokens": 7260 });
+        let listing = unpriced_listing(&rows, Some(&totals));
+        assert_eq!(listing.rows.len(), MAX_UNPRICED_ROWS);
+        assert_eq!((listing.model_count, listing.tokens), (120, 7260));
+        assert!(listing.truncated);
+        // One model seen both unpriced and approximate is two rows but one model.
+        let rows = vec![
+            json::json!({ "model": "m", "status": "unpriced", "spans": 1, "tokens": 5 }),
+            json::json!({ "model": "m", "status": "approximate", "spans": 1, "tokens": 5 }),
+        ];
+        let totals = json::json!({ "distinct_models": 1, "no_model_spans": 0, "tokens": 10 });
+        assert!(!unpriced_listing(&rows, Some(&totals)).truncated);
+        // A stream without a model column: every marked span is the one null-model row.
+        let sql = breakdown_totals_sql("default", "x", &cols(&["gen_ai_usage_cost_status"]));
+        assert!(sql.starts_with("SELECT 0 AS distinct_models, COUNT(*) AS no_model_spans, 0 AS"));
+    }
+
+    #[test]
+    fn samples_are_queried_only_when_asked_for() {
+        let c = cols(FULL);
+        let (preds, checks) = failing_checks(&c);
+        let (samples, unpriced) = follow_up_sql("default", "b", &c, &preds, &checks, false);
+        assert!(samples.is_empty());
+        // The unpriced model breakdown is part of the strip, so it always runs.
+        assert!(unpriced.is_some());
+        let (samples, _) = follow_up_sql("default", "b", &c, &preds, &checks, true);
+        assert_eq!(samples.len(), CHECK_IDS.len());
+        // Bounded to the newest spans, not an aggregate over every span in the window.
+        assert!(samples.iter().all(|(_, sql)| {
+            sql.contains(&format!(
+                "ORDER BY _timestamp DESC LIMIT {SAMPLE_SCAN_ROWS}"
+            )) && !sql.contains("GROUP BY")
+        }));
+        // Without samples the field is left out of the response.
+        let check = &all_pass(0, false)[0];
+        assert!(json::to_value(check).unwrap().get("samples").is_none());
+        let check = &all_pass(0, true)[0];
+        assert_eq!(
+            json::to_value(check).unwrap().get("samples"),
+            Some(&json::json!([]))
+        );
+    }
+
+    #[test]
+    fn sample_trace_ids_are_distinct_and_capped() {
+        let hits: Vec<json::Value> = ["t1", "t1", "t2", "t1", "t3", "t4"]
+            .iter()
+            .map(|id| json::json!({ "trace_id": id }))
+            .collect();
+        assert_eq!(distinct_trace_ids(&hits), ["t1", "t2", "t3"]);
+        let hits = vec![
+            json::json!({ "trace_id": "t1" }),
+            json::json!({}),
+            json::json!({ "trace_id": "t1" }),
+        ];
+        assert_eq!(distinct_trace_ids(&hits), ["t1"]);
+    }
+
+    #[test]
+    fn cache_key_rounds_the_window_to_the_minute() {
+        let mut a = query();
+        a.start_time = 120_000_000;
+        a.end_time = 180_000_001;
+        let wa = Window::clamped(a.start_time, a.end_time, 0);
+        let mut b = a.clone();
+        b.start_time += 1_000_000;
+        let wb = Window::clamped(b.start_time, b.end_time, 0);
+        assert_eq!(cache_key("o", &a, &wa), cache_key("o", &b, &wb));
+        b.agent = Some("x".into());
+        assert_ne!(cache_key("o", &a, &wa), cache_key("o", &b, &wb));
+        let mut c = a.clone();
+        c.agent_id = Some("x".into());
+        assert_ne!(cache_key("o", &a, &wa), cache_key("o", &c, &wa));
+        let mut d = a.clone();
+        d.include_samples = true;
+        assert_ne!(cache_key("o", &a, &wa), cache_key("o", &d, &wa));
+    }
+
+    #[test]
+    fn callers_with_different_range_limits_get_different_keys() {
+        const HOUR: i64 = 3600 * 1_000_000;
+        let mut q = query();
+        q.end_time = 1_000 * HOUR;
+        q.start_time = q.end_time - 7 * 24 * HOUR;
+        let capped = Window::clamped(q.start_time, q.end_time, 1);
+        let uncapped = Window::clamped(q.start_time, q.end_time, 0);
+        assert_ne!(capped.start, uncapped.start);
+        assert_ne!(cache_key("o", &q, &capped), cache_key("o", &q, &uncapped));
+        // The same cap on the same request shares the entry.
+        let capped_again = Window::clamped(q.start_time, q.end_time, 1);
+        assert_eq!(
+            cache_key("o", &q, &capped),
+            cache_key("o", &q, &capped_again)
+        );
+    }
+
+    fn resp(checked_at: i64) -> DataHealthResponse {
+        DataHealthResponse {
+            checked_at,
+            checks: vec![],
+        }
+    }
+
+    #[test]
+    fn a_full_cache_evicts_expired_then_only_the_oldest() {
+        let now = 10 * CACHE_TTL_MICROS;
+        let mut cache = HashMap::new();
+        insert_bounded(&mut cache, "old".into(), resp(now - 3), 3);
+        insert_bounded(&mut cache, "mid".into(), resp(now - 2), 3);
+        insert_bounded(&mut cache, "new".into(), resp(now - 1), 3);
+        // Full: the oldest goes, the warm entries stay.
+        insert_bounded(&mut cache, "next".into(), resp(now), 3);
+        let mut keys: Vec<_> = cache.keys().cloned().collect();
+        keys.sort();
+        assert_eq!(keys, ["mid", "new", "next"]);
+        // Replacing a present key evicts nothing.
+        insert_bounded(&mut cache, "mid".into(), resp(now), 3);
+        assert_eq!(cache.len(), 3);
+        // Expired entries are dropped before any live one.
+        insert_bounded(
+            &mut cache,
+            "late".into(),
+            resp(now - 1 + CACHE_TTL_MICROS),
+            3,
+        );
+        let mut keys: Vec<_> = cache.keys().cloned().collect();
+        keys.sort();
+        assert_eq!(keys, ["late", "mid", "next"]);
+    }
+
+    #[test]
+    fn an_insert_drops_every_expired_entry_and_keeps_every_live_one() {
+        let now = 10 * CACHE_TTL_MICROS;
+        let mut cache = HashMap::new();
+        insert_bounded(&mut cache, "live".into(), resp(now - 1), 4);
+        insert_bounded(
+            &mut cache,
+            "staler".into(),
+            resp(now - CACHE_TTL_MICROS - 5),
+            4,
+        );
+        insert_bounded(
+            &mut cache,
+            "stale".into(),
+            resp(now - CACHE_TTL_MICROS - 3),
+            4,
+        );
+        assert_eq!(cache.len(), 3);
+        // Not full, so only the TTL sweep can remove anything.
+        insert_bounded(&mut cache, "next".into(), resp(now), 4);
+        let mut keys: Vec<_> = cache.keys().cloned().collect();
+        keys.sort();
+        assert_eq!(keys, ["live", "next"]);
+    }
+
+    #[tokio::test]
+    async fn unpriced_listing_is_cached_per_org_stream_and_window() {
+        use std::sync::atomic::{AtomicUsize, Ordering};
+
+        let runs = AtomicUsize::new(0);
+        let compute = |tokens: i64| {
+            let runs = &runs;
+            async move {
+                runs.fetch_add(1, Ordering::SeqCst);
+                Ok(UnpricedModels {
+                    tokens,
+                    ..Default::default()
+                })
+            }
+        };
+        let window = Window::clamped(120_000_000, 86_520_000_000, 0);
+        let key = unpriced_cache_key("cache_hit_org", "default", &window);
+        let now = 1_000 * CACHE_TTL_MICROS;
+
+        let first = cached_unpriced(key.clone(), now, compute(7)).await.unwrap();
+        assert_eq!(first.tokens, 7);
+        // Within the TTL: served from the cache, the search does not run again.
+        let hit = cached_unpriced(key.clone(), now + CACHE_TTL_MICROS - 1, compute(9))
+            .await
+            .unwrap();
+        assert_eq!(hit.tokens, 7);
+        assert_eq!(runs.load(Ordering::SeqCst), 1);
+        // Another stream misses.
+        let other = unpriced_cache_key("cache_hit_org", "other", &window);
+        assert_eq!(
+            cached_unpriced(other, now, compute(3))
+                .await
+                .unwrap()
+                .tokens,
+            3
+        );
+        assert_eq!(runs.load(Ordering::SeqCst), 2);
+        // Expired: recomputed.
+        let fresh = cached_unpriced(key, now + CACHE_TTL_MICROS, compute(9))
+            .await
+            .unwrap();
+        assert_eq!(fresh.tokens, 9);
+        assert_eq!(runs.load(Ordering::SeqCst), 3);
+    }
+}
diff --git a/src/api/management/src/request/license/mod.rs b/src/api/management/src/request/license/mod.rs
index fcfcf3153f..b6d983c530 100644
--- a/src/api/management/src/request/license/mod.rs
+++ b/src/api/management/src/request/license/mod.rs
@@ -106,6 +106,7 @@ async fn check_license_permission(user_id: &str, method: &str) -> Result<(), any
                 use_all_org: true,
                 use_self_context: false,
                 use_self_parent: false,
+                feature: None,
             },
             user.role,
             user.is_external,
@@ -148,6 +149,7 @@ where
                 use_all_org: route.use_all_org,
                 use_self_context: route.use_self_context,
                 use_self_parent: route.use_self_parent,
+                feature: route.feature,
             },
             role,
         )
diff --git a/src/api/management/src/request/mod.rs b/src/api/management/src/request/mod.rs
index cd5e8d45be..e084768e0b 100644
--- a/src/api/management/src/request/mod.rs
+++ b/src/api/management/src/request/mod.rs
@@ -45,6 +45,7 @@ pub mod fleet;
 #[allow(deprecated)]
 pub mod folders;
 pub mod gen_ai;
+pub mod gen_ai_health;
 pub mod ingest_rejections;
 pub mod keys;
 pub mod kv;
diff --git a/src/api/management/src/request/model_pricing.rs b/src/api/management/src/request/model_pricing.rs
index 0bfe3613d5..ddd4eb1a63 100644
--- a/src/api/management/src/request/model_pricing.rs
+++ b/src/api/management/src/request/model_pricing.rs
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-use std::collections::{BTreeSet, HashMap};
+use std::collections::{BTreeSet, HashMap, HashSet};
 
 use axum::{
     Json,
@@ -33,7 +33,9 @@ use {
     openobserve_core::auth::{UserEmail, check_permissions},
 };
 
-use crate::common::meta::http::HttpResponse as MetaHttpResponse;
+use crate::{
+    common::meta::http::HttpResponse as MetaHttpResponse, request::gen_ai_health::MAX_AGENT_NAMES,
+};
 
 fn source_priority(source: &PricingSource) -> u8 {
     match source {
@@ -449,6 +451,8 @@ pub async fn delete(
 pub struct BuiltInQuery {
     #[serde(default)]
     pub search: String,
+    #[serde(default)]
+    pub metadata_only: bool,
 }
 
 /// A model pricing entry from the community/built-in source.
@@ -468,7 +472,10 @@ pub struct BuiltInModelPricingEntry {
 pub struct BuiltInModelPricingResponse {
     pub models: Vec<BuiltInModelPricingEntry>,
     pub source_url: String,
+    /// Unix seconds of this server's last successful online sync; 0 = none since startup.
     pub last_updated: i64,
+    /// Date of the seed price list compiled into this binary.
+    pub seed_date: &'static str,
 }
 
 /// GetBuiltInModelPricing
@@ -486,6 +493,7 @@ pub struct BuiltInModelPricingResponse {
     params(
         ("org_id" = String, Path, description = "Organization name"),
         ("search" = Option<String>, Query, description = "Filter by name"),
+        ("metadata_only" = Option<bool>, Query, description = "Return seed/sync metadata without loading the catalogue"),
     ),
     responses(
         (status = 200, description = "Success", content_type = "application/json", body = Object),
@@ -519,6 +527,14 @@ pub async fn get_built_in(
     }
 
     let source_url = config::get_config().common.model_pricing_source_url.clone();
+    if query.metadata_only {
+        return MetaHttpResponse::json(BuiltInModelPricingResponse {
+            models: Vec::new(),
+            source_url,
+            last_updated: openobserve_builtins::model_pricing::last_sync_timestamp(),
+            seed_date: openobserve_builtins::model_pricing::SEED_DATE,
+        });
+    }
 
     // Read from DB (synced by background job) instead of making a live HTTP call.
     let all_built_in = match model_pricing::list(BUILT_IN_ORG).await {
@@ -553,6 +569,7 @@ pub async fn get_built_in(
         models,
         source_url,
         last_updated,
+        seed_date: openobserve_builtins::model_pricing::SEED_DATE,
     })
 }
 
@@ -623,6 +640,180 @@ pub async fn refresh_built_in(
     }
 }
 
+/// The pricing definition a listed model resolves to today.
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+pub struct UnpricedModelMatch {
+    pub name: String,
+    pub match_pattern: String,
+    pub source: PricingSource,
+    pub tiers: Vec<PricingTierDefinition>,
+}
+
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+pub struct UnpricedModel {
+    #[serde(flatten)]
+    pub row: crate::request::gen_ai_health::UnpricedModelRow,
+    /// Null when no definition matches the model today.
+    pub matched: Option<UnpricedModelMatch>,
+    /// An exact definition covers new spans; these older spans retain their recorded cost.
+    pub priced_now: bool,
+}
+
+#[derive(Debug, Serialize, utoipa::ToSchema)]
+pub struct UnpricedModelsResponse {
+    /// Models with recorded pricing gaps, including those priced since ingestion.
+    pub models: Vec<UnpricedModel>,
+    /// Distinct models ingest marked in the window, uncapped and before today's prices are
+    /// applied; spans without a model name count as one.
+    pub model_count: i64,
+    /// Tokens on every span ingest marked in the window.
+    pub tokens: i64,
+    /// The server listed only the models with the most tokens; `model_count` has them all.
+    pub models_truncated: bool,
+}
+
+/// Joins recorded pricing gaps with today's definitions without hiding historical gaps.
+fn resolve_unpriced(
+    rows: Vec<crate::request::gen_ai_health::UnpricedModelRow>,
+    entries: &[CachedModelPricing],
+    now_micros: i64,
+) -> Vec<UnpricedModel> {
+    let mut by_model: HashMap<Option<String>, UnpricedModel> = HashMap::new();
+    let mut order = Vec::new();
+    for row in rows {
+        let resolved = row
+            .model
+            .as_deref()
+            .and_then(|m| model_pricing::find_pricing_sync_at(entries, m, Some(now_micros)));
+        let priced_now = crate::request::gen_ai_health::priced_now(resolved.as_ref());
+        // A model seen both unpriced and approximate (a price was added mid-window) is one row.
+        if let Some(existing) = by_model.get_mut(&row.model) {
+            existing.row.spans += row.spans;
+            existing.row.tokens += row.tokens;
+            existing.row.cost += row.cost;
+            // Counts per status overlap, so the larger is a floor for the merged distinct count.
+            existing.row.agent_count = existing.row.agent_count.max(row.agent_count);
+            let mut seen: HashSet<String> = existing.row.agents.iter().cloned().collect();
+            for agent in row.agents {
+                if existing.row.agents.len() >= MAX_AGENT_NAMES {
+                    break;
+                }
+                if seen.insert(agent.clone()) {
+                    existing.row.agents.push(agent);
+                }
+            }
+            existing.row.agent_count = existing
+                .row
+                .agent_count
+                .max(existing.row.agents.len() as i64);
+            continue;
+        }
+        let matched = resolved.map(|r| UnpricedModelMatch {
+            name: r.definition.name,
+            match_pattern: r.definition.match_pattern,
+            source: r.definition.source,
+            tiers: r.definition.tiers,
+        });
+        let mut row = row;
+        if !priced_now {
+            row.status = if matched.is_some() {
+                config::meta::model_pricing::CostStatus::Approximate
+            } else {
+                config::meta::model_pricing::CostStatus::Unpriced
+            };
+        }
+        order.push(row.model.clone());
+        by_model.insert(
+            row.model.clone(),
+            UnpricedModel {
+                row,
+                matched,
+                priced_now,
+            },
+        );
+    }
+    order
+        .into_iter()
+        .filter_map(|m| by_model.remove(&m))
+        .collect()
+}
+
+/// ListUnpricedModels
+///
+/// #{"ratelimit_module":"ModelPricing", "ratelimit_module_operation":"list"}#
+#[utoipa::path(
+    get,
+    path = "/{org_id}/llm/models/unpriced",
+    context_path = "/api",
+    tag = "LLM",
+    operation_id = "ListUnpricedModels",
+    summary = "List models seen in traces with no price or an approximate one",
+    description = "Models in the stream's spans that ingest marked unpriced or approximately priced during the window, with spans, tokens and recorded cost. Historical gaps remain after adding an exact price and are marked priced_now; old costs are not backfilled. Spans with tokens but no model name are listed as one row with a null model.",
+    security(("Authorization" = [])),
+    params(
+        ("org_id" = String, Path, description = "Organization name"),
+        crate::request::gen_ai_health::UnpricedModelsQuery,
+    ),
+    responses(
+        (status = 200, description = "Success", body = UnpricedModelsResponse),
+        (status = 400, description = "Invalid query"),
+        (status = 403, description = "Forbidden"),
+        (status = 429, description = "Search not allowed for the organization"),
+        (status = 500, description = "Internal server error"),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "LLM", "operation": "list"})),
+        ("x-o2-mcp" = json!({"enabled": false}))
+    ),
+)]
+pub async fn list_unpriced(
+    Path(org_id): Path<String>,
+    openobserve_api_common::extractors::Headers(user_email): openobserve_api_common::extractors::Headers<
+        openobserve_core::auth::UserEmail,
+    >,
+    Query(query): Query<crate::request::gen_ai_health::UnpricedModelsQuery>,
+) -> Response {
+    let user_id = &user_email.user_id;
+    #[cfg(feature = "enterprise")]
+    if !check_permissions(
+        &org_id,
+        &org_id,
+        user_id,
+        "model_pricing",
+        "LIST",
+        None,
+        true,
+        false,
+        false,
+    )
+    .await
+    {
+        return MetaHttpResponse::forbidden("Unauthorized Access");
+    }
+    if let Err(resp) =
+        crate::request::gen_ai_health::authorize_unpriced(&org_id, user_id, &query).await
+    {
+        return resp;
+    }
+    match crate::request::gen_ai_health::unpriced_models(&org_id, user_id, &query).await {
+        Ok(listing) => {
+            let entries = model_pricing::get_org_pricing_entries(&org_id);
+            let models =
+                resolve_unpriced(listing.rows, &entries, config::utils::time::now_micros());
+            MetaHttpResponse::json(UnpricedModelsResponse {
+                models,
+                model_count: listing.model_count,
+                tokens: listing.tokens,
+                models_truncated: listing.truncated,
+            })
+        }
+        Err(e) => {
+            log::error!("[model_pricing] unpriced models for {org_id}: {e}");
+            MetaHttpResponse::internal_error("Failed to list unpriced models")
+        }
+    }
+}
+
 /// Strip leading inline flag groups like `(?i)`, `(?ms)`, `(?-i)` from a regex pattern.
 fn strip_leading_flags(s: &str) -> &str {
     let mut rest = s;
@@ -1489,6 +1680,90 @@ mod tests {
         ]
     }
 
+    fn unpriced_row(
+        model: &str,
+        status: config::meta::model_pricing::CostStatus,
+        tokens: i64,
+    ) -> crate::request::gen_ai_health::UnpricedModelRow {
+        crate::request::gen_ai_health::UnpricedModelRow {
+            model: Some(model.to_string()),
+            status,
+            spans: 1,
+            tokens,
+            cost: 0.0,
+            agents: vec!["a".to_string()],
+            agent_count: 1,
+        }
+    }
+
+    #[test]
+    fn test_resolve_unpriced_keeps_historical_gaps_and_merges_statuses() {
+        use config::meta::model_pricing::CostStatus;
+        let mut entries = built_in_gpt_4o();
+        // Approximate today: `gpt-5.4` covers only part of `gpt-5.4-mini`.
+        entries.push(entry("GPT-5.4", r"(?i)gpt-5\.4", PricingSource::BuiltIn));
+        let rows = vec![
+            unpriced_row("acme-internal-llm", CostStatus::Unpriced, 100),
+            // Now exactly priced, but the historical gap must remain visible.
+            unpriced_row("gpt-4o", CostStatus::Unpriced, 50),
+            unpriced_row("gpt-5.4-mini", CostStatus::Approximate, 30),
+            // Seen unpriced earlier in the window, approximate since: one row.
+            unpriced_row("gpt-5.4-mini", CostStatus::Unpriced, 20),
+        ];
+        let out = resolve_unpriced(rows, &entries, 0);
+        let models: Vec<_> = out.iter().map(|m| m.row.model.as_deref()).collect();
+        assert_eq!(
+            models,
+            [
+                Some("acme-internal-llm"),
+                Some("gpt-4o"),
+                Some("gpt-5.4-mini")
+            ]
+        );
+        assert!(out[0].matched.is_none());
+        assert!(!out[0].priced_now);
+        assert!(out[1].priced_now);
+        assert_eq!(out[2].row.status, CostStatus::Approximate);
+        assert!(!out[2].priced_now);
+        assert_eq!(out[2].row.tokens, 50);
+        assert_eq!(out[2].matched.as_ref().unwrap().name, "GPT-5.4");
+    }
+
+    #[test]
+    fn test_resolve_unpriced_keeps_spans_without_a_model_name() {
+        use config::meta::model_pricing::CostStatus;
+        let mut no_model = unpriced_row("x", CostStatus::Unpriced, 70);
+        no_model.model = None;
+        let mut no_model_again = no_model.clone();
+        no_model_again.tokens = 30;
+        let out = resolve_unpriced(vec![no_model, no_model_again], &built_in_gpt_4o(), 0);
+        assert_eq!(out.len(), 1);
+        assert_eq!(out[0].row.model, None);
+        assert_eq!(out[0].row.status, CostStatus::Unpriced);
+        assert_eq!(out[0].row.tokens, 100);
+        assert!(out[0].matched.is_none());
+        // The model is null on the wire, not an empty name.
+        let wire = config::utils::json::to_value(&out[0]).unwrap();
+        assert_eq!(wire.get("model"), Some(&config::utils::json::Value::Null));
+    }
+
+    #[test]
+    fn test_resolve_unpriced_caps_merged_agent_names_and_keeps_the_count() {
+        use config::meta::model_pricing::CostStatus;
+        let names = |range: std::ops::Range<usize>| range.map(|i| format!("agent-{i}")).collect();
+        let mut unpriced = unpriced_row("m", CostStatus::Unpriced, 10);
+        unpriced.agents = names(0..8);
+        unpriced.agent_count = 25;
+        let mut approximate = unpriced_row("m", CostStatus::Approximate, 10);
+        approximate.agents = names(4..10);
+        approximate.agent_count = 6;
+        let out = resolve_unpriced(vec![unpriced, approximate], &[], 0);
+        let agents = &out[0].row.agents;
+        assert_eq!(agents.len(), MAX_AGENT_NAMES);
+        assert_eq!(agents.iter().collect::<HashSet<_>>().len(), MAX_AGENT_NAMES);
+        assert_eq!(out[0].row.agent_count, 25);
+    }
+
     #[test]
     fn test_captured_models_prefix_rule_also_catches_other_models() {
         let captured = captured_models(&built_in_gpt_4o(), &org_candidate(r"(?i)^gpt-4o"));
diff --git a/src/api/management/src/request/oncall/mod.rs b/src/api/management/src/request/oncall/mod.rs
index 6c706a9f15..b8147dd692 100644
--- a/src/api/management/src/request/oncall/mod.rs
+++ b/src/api/management/src/request/oncall/mod.rs
@@ -2277,7 +2277,12 @@ async fn act_by_phone(
             PhoneAction::Acknowledge => {
                 service::phone_ack_outcome(&org_id, &response_id, &actor).await
             }
-            PhoneAction::Resolve | PhoneAction::Escalate => {
+            PhoneAction::Resolve => {
+                // A retried press 6 finishes a clear the first press could not.
+                end_ack_by_phone(&org_id, &response_id, problem.as_ref(), &actor).await?;
+                Ok(o2_enterprise::enterprise::oncall::notify::PressOutcome::Closed)
+            }
+            PhoneAction::Escalate => {
                 Ok(o2_enterprise::enterprise::oncall::notify::PressOutcome::Closed)
             }
         };
@@ -2301,11 +2306,46 @@ async fn act_by_phone(
             }
             service::phone_ack_outcome(&org_id, &response_id, &actor).await
         }
-        PhoneAction::Resolve => service::phone_resolve(&org_id, &response_id, &actor).await,
+        PhoneAction::Resolve => {
+            let outcome = service::phone_resolve(&org_id, &response_id, &actor).await?;
+            end_ack_by_phone(&org_id, &response_id, problem.as_ref(), &actor).await?;
+            Ok(outcome)
+        }
         PhoneAction::Escalate => service::phone_escalate(&org_id, &response_id, &actor).await,
     }
 }
 
+/// Press 6 ends the problem's ack once the page is closed; a page whose alert is gone has none.
+#[cfg(feature = "enterprise")]
+async fn end_ack_by_phone(
+    org_id: &str,
+    response_id: &str,
+    problem: Option<&openobserve_core::alerts::ack::Problem>,
+    actor: &str,
+) -> Result<(), anyhow::Error> {
+    use openobserve_core::alerts::ack;
+
+    let Some(p) = problem else {
+        return Ok(());
+    };
+    let Some(page) = infra::table::oncall_responses::get(org_id, response_id).await? else {
+        return Ok(());
+    };
+    let closed_at = page
+        .closed_at
+        .unwrap_or_else(config::utils::time::now_micros);
+    let cover = ack::page_cover(&page.subject, closed_at);
+    ack::resolve(
+        p,
+        actor,
+        config::meta::alerts::ack::AckSource::Oncall,
+        cover,
+    )
+    .await
+    .map(|_| ())
+    .map_err(|e| anyhow::anyhow!("end the ack after a resolve by phone: {e:?}"))
+}
+
 /// TwiML refusal for an inactive or unreadable org, as `inactive_org_response` refuses email acks.
 #[cfg(feature = "enterprise")]
 fn voice_status_refusal(
@@ -2575,18 +2615,25 @@ pub async fn get_response(
 pub async fn resolve_response(
     Path((org_id, response_id)): Path<(String, String)>,
     #[cfg(feature = "enterprise")] Headers(user_email): Headers<UserEmail>,
+    #[cfg(feature = "enterprise")] delegated: Option<
+        axum::Extension<openobserve_api_common::auth::delegation::DelegatedCaller>,
+    >,
+    #[cfg(feature = "enterprise")] headers: axum::http::HeaderMap,
     ValidatedJson(body): ValidatedJson<Option<ResolveRequest>>,
 ) -> Response {
     #[cfg(feature = "enterprise")]
     {
+        use crate::request::alerts::ack::{ack_source, error_response};
+
         if !allowed(&org_id, &user_email.user_id, RESPONSES, "POST").await {
             return MetaHttpResponse::forbidden("Forbidden");
         }
-        if let Err(resp) = page_problem(&org_id, &response_id, &user_email.user_id).await {
-            return resp;
-        }
+        let problem = match page_problem(&org_id, &response_id, &user_email.user_id).await {
+            Ok(p) => p,
+            Err(resp) => return resp,
+        };
         let body = body.unwrap_or_default();
-        match o2_enterprise::enterprise::oncall::escalation::resolve(
+        let record = match o2_enterprise::enterprise::oncall::escalation::resolve(
             &org_id,
             &response_id,
             &user_email.user_id,
@@ -2595,9 +2642,23 @@ pub async fn resolve_response(
         )
         .await
         {
-            Ok(record) => MetaHttpResponse::json(record),
-            Err(e) => to_response(e),
+            Ok(record) => record,
+            Err(e) => return to_response(e),
+        };
+        // Closed first, so a failed clear is retried by resolving the closed page again.
+        if let Some(p) = problem.as_ref() {
+            let source = ack_source(delegated.as_deref(), &headers);
+            let closed_at = record
+                .closed_at
+                .unwrap_or_else(config::utils::time::now_micros);
+            let cover = openobserve_core::alerts::ack::page_cover(&record.subject, closed_at);
+            if let Err(e) =
+                openobserve_core::alerts::ack::resolve(p, &user_email.user_id, source, cover).await
+            {
+                return error_response(e);
+            }
         }
+        MetaHttpResponse::json(record)
     }
     #[cfg(not(feature = "enterprise"))]
     {
@@ -3020,6 +3081,56 @@ pub async fn snooze_response(
     }
 }
 
+#[utoipa::path(
+    post,
+    path = "/{org_id}/oncall/responses/{response_id}/unsnooze",
+    context_path = "/api",
+    tag = "OnCall",
+    operation_id = "UnsnoozeOnCallResponse",
+    summary = "End a snooze now, so paging continues from the current step",
+    security(("Authorization" = [])),
+    params(
+        ("org_id" = String, Path, description = "Organization name"),
+        ("response_id" = String, Path, description = "Response record ID"),
+    ),
+    responses((status = 200, description = "Success", content_type = "application/json", body = Object)),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "OnCall", "operation": "create"})),
+        ("x-o2-mcp" = json!({"enabled": false}))
+    )
+)]
+pub async fn unsnooze_response(
+    Path((org_id, response_id)): Path<(String, String)>,
+    #[cfg(feature = "enterprise")] Headers(user_email): Headers<UserEmail>,
+) -> Response {
+    #[cfg(feature = "enterprise")]
+    {
+        if !allowed(&org_id, &user_email.user_id, RESPONSES, "POST").await {
+            return MetaHttpResponse::forbidden("Forbidden");
+        }
+        if let Err(resp) = page_problem(&org_id, &response_id, &user_email.user_id).await {
+            return resp;
+        }
+        match o2_enterprise::enterprise::oncall::escalation::unsnooze(
+            &org_id,
+            &response_id,
+            &user_email.user_id,
+            config::utils::time::now_micros(),
+        )
+        .await
+        {
+            Ok(Some(r)) => MetaHttpResponse::json(r),
+            Ok(None) => MetaHttpResponse::not_found("Response record not found"),
+            Err(e) => to_response(e),
+        }
+    }
+    #[cfg(not(feature = "enterprise"))]
+    {
+        let _ = (org_id, response_id);
+        MetaHttpResponse::forbidden("Not Supported")
+    }
+}
+
 #[utoipa::path(
     post,
     path = "/{org_id}/oncall/responses/{response_id}/handoff",
diff --git a/src/api/management/src/request/public_rate_limit.rs b/src/api/management/src/request/public_rate_limit.rs
index 926ed28118..8b9af6a6e9 100644
--- a/src/api/management/src/request/public_rate_limit.rs
+++ b/src/api/management/src/request/public_rate_limit.rs
@@ -31,12 +31,13 @@ use crate::common::meta::http::HttpResponse as MetaHttpResponse;
 
 /// How a client whose `RealIp` was not resolved shows up in logs.
 pub const UNKNOWN_IP: &str = "unknown";
-const MAX_KEYS: usize = 65_536;
+pub const MAX_KEYS: usize = 65_536;
 
 /// Hit counts per key in fixed windows, holding at most a fixed number of keys; a full map evicts
 /// the oldest window.
 pub struct Counters {
     max_keys: usize,
+    fail_open: bool,
     state: Mutex<CounterState>,
 }
 
@@ -44,13 +45,27 @@ impl Counters {
     pub fn new(max_keys: usize) -> Self {
         Self {
             max_keys,
+            fail_open: false,
             state: Mutex::new(CounterState::default()),
         }
     }
 
+    /// Fails open: a new key while the map is full is admitted untracked instead of evicting one.
+    pub fn fail_open(max_keys: usize) -> Self {
+        Self {
+            fail_open: true,
+            ..Self::new(max_keys)
+        }
+    }
+
     /// Counts one hit for `key`; true past its budget.
     pub fn over_budget(&self, key: &str, window: Duration, max: u32) -> bool {
-        self.over_budget_at(key, window, max, Instant::now())
+        self.over_budget_at(key, window, max, 1, Instant::now())
+    }
+
+    /// Counts `amount` units for `key`, for budgets measured in bytes rather than calls.
+    pub fn over_budget_by(&self, key: &str, window: Duration, max: u32, amount: u32) -> bool {
+        self.over_budget_at(key, window, max, amount, Instant::now())
     }
 
     /// Whether `key` already spent `max` hits in its window; counts nothing.
@@ -64,7 +79,14 @@ impl Counters {
             .is_some_and(|(n, at)| Instant::now().duration_since(*at) < window && *n >= max)
     }
 
-    fn over_budget_at(&self, key: &str, window: Duration, max: u32, now: Instant) -> bool {
+    fn over_budget_at(
+        &self,
+        key: &str,
+        window: Duration,
+        max: u32,
+        amount: u32,
+        now: Instant,
+    ) -> bool {
         let Ok(mut state) = self.state.lock() else {
             return false;
         };
@@ -83,7 +105,7 @@ impl Counters {
             if renewed {
                 *entry = (0, now);
             }
-            entry.0 = entry.0.saturating_add(1);
+            entry.0 = entry.0.saturating_add(amount);
             let over = entry.0 > max;
             if renewed {
                 state.order.push_back((key.to_owned(), now));
@@ -91,11 +113,14 @@ impl Counters {
             return over;
         }
         if state.hits.len() >= self.max_keys {
+            if self.fail_open {
+                return false;
+            }
             state.evict_oldest();
         }
-        state.hits.insert(key.to_owned(), (1, now));
+        state.hits.insert(key.to_owned(), (amount, now));
         state.order.push_back((key.to_owned(), now));
-        max == 0
+        amount > max
     }
 }
 
@@ -158,9 +183,9 @@ mod tests {
         let counters = Counters::new(2);
         let window = Duration::from_secs(60);
         let t0 = Instant::now();
-        assert!(!counters.over_budget_at("a", window, 1, t0));
-        assert!(!counters.over_budget_at("b", window, 1, t0 + Duration::from_secs(1)));
-        assert!(!counters.over_budget_at("c", window, 1, t0 + Duration::from_secs(2)));
+        assert!(!counters.over_budget_at("a", window, 1, 1, t0));
+        assert!(!counters.over_budget_at("b", window, 1, 1, t0 + Duration::from_secs(1)));
+        assert!(!counters.over_budget_at("c", window, 1, 1, t0 + Duration::from_secs(2)));
         {
             let state = counters.state.lock().unwrap();
             assert_eq!(state.hits.len(), 2);
@@ -168,13 +193,40 @@ mod tests {
             assert!(state.hits.contains_key("b") && state.hits.contains_key("c"));
         }
         assert!(
-            counters.over_budget_at("b", window, 1, t0 + Duration::from_secs(3)),
+            counters.over_budget_at("b", window, 1, 1, t0 + Duration::from_secs(3)),
             "a kept key keeps its count"
         );
-        assert!(!counters.over_budget_at("a", window, 1, t0 + Duration::from_secs(4)));
+        assert!(!counters.over_budget_at("a", window, 1, 1, t0 + Duration::from_secs(4)));
         assert!(!counters.state.lock().unwrap().hits.contains_key("b"));
     }
 
+    #[test]
+    fn a_full_ip_map_fails_open() {
+        let counters = Counters::fail_open(2);
+        let window = Duration::from_secs(60);
+        let t0 = Instant::now();
+        assert!(!counters.over_budget_at("a", window, 1, 1, t0));
+        assert!(!counters.over_budget_at("b", window, 1, 1, t0));
+        assert!(!counters.over_budget_at("c", window, 1, 1, t0));
+        assert!(!counters.over_budget_at("c", window, 1, 1, t0));
+        assert!(
+            counters.over_budget_at("a", window, 1, 1, t0),
+            "keys already tracked keep their budget"
+        );
+        assert_eq!(counters.state.lock().unwrap().hits.len(), 2);
+    }
+
+    #[test]
+    fn byte_budget_counts_bytes_not_calls() {
+        let counters = Counters::default();
+        let window = Duration::from_secs(60);
+        assert!(!counters.over_budget_by("org", window, 1000, 600));
+        assert!(!counters.over_budget_by("org", window, 1000, 400));
+        assert!(counters.over_budget_by("org", window, 1000, 1));
+        assert!(!counters.over_budget_by("other", window, 1000, 1000));
+        assert!(counters.over_budget_by("big", window, 1000, 1001));
+    }
+
     #[tokio::test]
     async fn too_many_requests_is_json_with_retry_after() {
         let resp = too_many_requests(Duration::from_secs(60));
diff --git a/src/api/management/src/request/status/mod.rs b/src/api/management/src/request/status/mod.rs
index 6716f77631..abaf8c730e 100644
--- a/src/api/management/src/request/status/mod.rs
+++ b/src/api/management/src/request/status/mod.rs
@@ -32,6 +32,7 @@ use config::{
     get_config, get_instance_id,
     meta::{
         cluster::{NodeStatus, Role, RoleGroup},
+        feature::{Feature, FeatureState},
         function::ZoFunction,
         search::{HashFileRequest, HashFileResponse},
         slack::DisabledReason,
@@ -76,7 +77,8 @@ use {
         settings::{get_logo, get_logo_dark, get_logo_text},
     },
     o2_enterprise::enterprise::license::{
-        block_feature_for_report_failure, last_reported_timestamp,
+        block_feature_for_report_failure, check_features, last_reported_timestamp,
+        runtime_definition,
     },
     o2_openfga::config::{
         get_config as get_openfga_config, refresh_config as refresh_openfga_config,
@@ -269,6 +271,11 @@ struct ConfigResponse<'a> {
     billing_group_allowed_orgs: String,
     #[cfg(feature = "enterprise")]
     workflows_enabled: bool,
+    workflow_hooks_enabled: bool,
+    #[cfg(feature = "enterprise")]
+    feature_revision: u32,
+    features: HashMap<Feature, FeatureState>,
+    feature_names: HashMap<String, String>,
 }
 
 #[cfg(feature = "enterprise")]
@@ -537,33 +544,51 @@ pub async fn zo_config(
     let custom_hide_menus = enterprise_value!("", &o2cfg.common.custom_hide_menus);
     let custom_hide_self_logo = enterprise_value!(false, o2cfg.common.custom_hide_self_logo);
     // AI needs o2-ai to answer; with no agent target its buttons could only fail, so report it off.
-    let ai_enabled = enterprise_value!(false, o2cfg.ai.enabled && o2cfg.ai.has_agent_target());
-    let ai_chat_persistence_enabled = enterprise_value!(
+    let ai_enabled = enterprise_value!(
         false,
-        o2cfg.ai.enabled && o2cfg.ai.has_agent_target() && o2cfg.ai.chat_persistence_enabled
+        o2cfg.ai.enabled && o2cfg.ai.has_agent_target() && check_features(&[Feature::AiAssistant])
+    );
+    let ai_chat_persistence_enabled =
+        enterprise_value!(false, ai_enabled && o2cfg.ai.chat_persistence_enabled);
+    let incidents_enabled = enterprise_value!(
+        false,
+        o2cfg.incidents.enabled && check_features(&[Feature::Incidents])
+    );
+    let downtimes_enabled = enterprise_value!(
+        false,
+        o2cfg.downtimes.enabled && check_features(&[Feature::Alerts])
+    );
+    let alert_calibration_enabled = enterprise_value!(
+        false,
+        o2cfg.alert_calibration.enabled && check_features(&[Feature::Alerts])
     );
-    let incidents_enabled = enterprise_value!(false, o2cfg.incidents.enabled);
     // Incident analysis needs RCA on and an agent to answer.
     let incidents_rca_enabled = enterprise_value!(
         false,
-        o2cfg.incidents.enabled && o2cfg.incidents.rca_enabled && o2cfg.ai.has_agent_target()
+        incidents_enabled
+            && o2cfg.incidents.rca_enabled
+            && openobserve_core::alerts::incidents::rca_agent_available()
     );
-    let downtimes_enabled = enterprise_value!(false, o2cfg.downtimes.enabled);
     let fleet_enabled = enterprise_value!(false, openobserve_core::fleet::enabled());
-    let alert_calibration_enabled = enterprise_value!(false, o2cfg.alert_calibration.enabled);
     let service_streams_enabled = enterprise_value!(false, o2cfg.service_streams.enabled);
     // Enterprise builds have it unless O2_ANOMALY_DETECTION_DISABLED turns it off.
     let anomaly_detection_enabled = enterprise_value!(false, !o2cfg.anomaly_detection.disabled);
     // Composite alerts are not available in super-cluster mode (§18, §19.2).
     let composite_alerts_available =
         config::get_config().alert_composite.writes_enabled && !super_cluster_enabled;
-    let online_evals_enabled = enterprise_value!(false, o2cfg.llm_eval_config.enabled);
+    let online_evals_enabled = enterprise_value!(
+        false,
+        o2cfg.llm_eval_config.enabled && check_features(&[Feature::AiObservability])
+    );
     let synthetics_enabled = cfg.synthetics.enabled;
     // Private agents stay enterprise, so an OSS build shows synthetics without them.
     let synthetics_private_locations_enabled = enterprise_value!(false, cfg.synthetics.enabled);
     let synthetics_recorder_extension_url = &cfg.synthetics.recorder_extension_url;
     let synthetics_browser_max_steps = cfg.synthetics.browser_max_steps;
-    let oncall_enabled = enterprise_value!(false, o2cfg.oncall.enabled);
+    let oncall_enabled = enterprise_value!(
+        false,
+        o2cfg.oncall.enabled && check_features(&[Feature::Oncall])
+    );
     let slack_disabled_reason = enterprise_value!(
         Some(DisabledReason::Edition),
         o2_enterprise::enterprise::slack::disabled_reason(&org_id)
@@ -593,7 +618,59 @@ pub async fn zo_config(
     let billing_group_allowed_orgs = o2cfg.cloud.billing_group_allowed_orgs.clone();
 
     #[cfg(feature = "enterprise")]
-    let workflows_enabled = o2cfg.common.workflows_enabled;
+    let workflows_enabled = o2cfg.common.workflows_enabled && check_features(&[Feature::Workflows]);
+    #[cfg(feature = "enterprise")]
+    let workflow_hooks_enabled = openobserve_core::workflows::http_trigger::hooks_enabled();
+    #[cfg(not(feature = "enterprise"))]
+    let workflow_hooks_enabled = false;
+
+    #[cfg(feature = "enterprise")]
+    let featuremap: HashMap<Feature, FeatureState> = Feature::all()
+        .map(|variant| {
+            // operator-off hides whatever the license says; operator-on but unlicensed locks
+            let switched_on = match variant {
+                Feature::AiAssistant => o2cfg.ai.enabled,
+                Feature::Incidents => o2cfg.incidents.enabled,
+                Feature::Oncall => o2cfg.oncall.enabled,
+                Feature::Workflows => o2cfg.common.workflows_enabled,
+                _ => true,
+            };
+            let entitled = check_features(&[variant]);
+            let key: &str = variant.into();
+            let listed = o2cfg
+                .common
+                .custom_hide_menus
+                .split(',')
+                .any(|m| m.trim() == key);
+            let state = if listed || !switched_on {
+                FeatureState::Hidden
+            } else if entitled {
+                FeatureState::Enabled
+            } else {
+                FeatureState::Locked
+            };
+            (variant, state)
+        })
+        .collect();
+    #[cfg(not(feature = "enterprise"))]
+    let featuremap: HashMap<Feature, FeatureState> = [
+        Feature::AiAssistant,
+        Feature::AiObservability,
+        Feature::Incidents,
+        Feature::Oncall,
+        Feature::Workflows,
+    ]
+    .into_iter()
+    .map(|variant| (variant, FeatureState::Locked))
+    .collect();
+    #[cfg(feature = "enterprise")]
+    let feature_names: HashMap<String, String> = runtime_definition()
+        .features
+        .iter()
+        .filter_map(|(key, gate)| Some((key.clone(), gate.display_name.clone()?)))
+        .collect();
+    #[cfg(not(feature = "enterprise"))]
+    let feature_names: HashMap<String, String> = HashMap::new();
 
     axum::Json(ConfigResponse {
         version: config::VERSION.to_string(),
@@ -709,6 +786,11 @@ pub async fn zo_config(
         billing_group_allowed_orgs,
         #[cfg(feature = "enterprise")]
         workflows_enabled,
+        workflow_hooks_enabled,
+        #[cfg(feature = "enterprise")]
+        feature_revision: runtime_definition().feature_revision,
+        features: featuremap,
+        feature_names,
     })
 }
 
@@ -752,6 +834,7 @@ async fn search_inspector_permitted(org_id: &str, user_id: &str) -> bool {
             use_all_org: true,
             use_self_context: false,
             use_self_parent: false,
+            feature: None,
         },
         user.role,
         user.is_external,
@@ -1110,6 +1193,8 @@ pub async fn config_reload(Headers(user_email): Headers<UserEmail>) -> impl Into
             trace_id: None,
         },
         delegated: None,
+        fleet_id: None,
+        target: None,
     })
     .await;
     (
@@ -1231,6 +1316,8 @@ pub async fn redirect(
             trace_id: None,
         },
         delegated: None,
+        fleet_id: None,
+        target: None,
     };
 
     let state_cookie = cookies.get(LOGIN_STATE_COOKIE).map(|c| c.value());
@@ -1482,6 +1569,8 @@ pub async fn refresh_token_with_dex(
             trace_id: None,
         },
         delegated: None,
+        fleet_id: None,
+        target: None,
     };
 
     let token = if let Some(cookie) = cookies.get("auth_tokens") {
@@ -1773,6 +1862,8 @@ pub async fn logout(
                 trace_id: None,
             },
             delegated: None,
+            fleet_id: None,
+            target: None,
         })
         .await;
     }
@@ -2639,10 +2730,36 @@ mod tests {
         let json = zo_config_json().await;
         assert_eq!(
             json["incidents_rca_enabled"],
-            o2cfg.incidents.enabled && o2cfg.incidents.rca_enabled && o2cfg.ai.has_agent_target()
+            openobserve_core::alerts::incidents::incidents_enabled()
+                && o2cfg.incidents.rca_enabled
+                && openobserve_core::alerts::incidents::rca_agent_available()
         );
     }
 
+    #[cfg(feature = "enterprise")]
+    #[tokio::test]
+    async fn test_zo_config_online_evals_need_the_observability_license() {
+        let o2cfg = o2_enterprise::enterprise::common::config::get_config();
+        let json = zo_config_json().await;
+        assert_eq!(
+            json["online_evals_enabled"],
+            o2cfg.llm_eval_config.enabled && check_features(&[Feature::AiObservability])
+        );
+    }
+
+    #[cfg(feature = "enterprise")]
+    #[tokio::test]
+    async fn test_zo_config_feature_names_come_from_the_embedded_definition() {
+        let json = zo_config_json().await;
+        for (key, gate) in &runtime_definition().features {
+            assert_eq!(
+                json["feature_names"][key].as_str(),
+                gate.display_name.as_deref(),
+                "{key}"
+            );
+        }
+    }
+
     #[cfg(not(feature = "enterprise"))]
     #[tokio::test]
     async fn test_zo_config_has_no_license_fields_in_oss() {
diff --git a/src/api/management/src/request/status_pages/public.rs b/src/api/management/src/request/status_pages/public.rs
index 1e69e1226f..928248d010 100644
--- a/src/api/management/src/request/status_pages/public.rs
+++ b/src/api/management/src/request/status_pages/public.rs
@@ -397,6 +397,8 @@ pub async fn host_route_middleware(
     request: axum::extract::Request,
     next: axum::middleware::Next,
 ) -> Response {
+    use axum::response::IntoResponse;
+    use config::meta::feature::Feature;
     use o2_enterprise::enterprise::status_pages::host_routing::{
         HostRouteDecision, PageRoute, resolve_host_route,
     };
@@ -416,6 +418,18 @@ pub async fn host_route_middleware(
     match resolve_host_route(&host, &method, request.uri().path()).await {
         HostRouteDecision::Fallthrough => next.run(request).await,
         HostRouteDecision::NotConnected => domain_not_connected(),
+        HostRouteDecision::Page { .. }
+            if !o2_enterprise::enterprise::license::check_features(&[Feature::Synthetics]) =>
+        {
+            let err = infra::errors::ErrorCodes::LicenseFeatureNotEntitled(
+                <&str>::from(Feature::Synthetics).to_owned(),
+            );
+            (
+                StatusCode::FORBIDDEN,
+                Json(common::meta::http::HttpResponse::error_code(err)),
+            )
+                .into_response()
+        }
         HostRouteDecision::Page { slug, route } => {
             // The RealIp layer sits outside this one, so the resolved visitor IP is already on the
             // request.
diff --git a/src/api/management/src/request/users/mod.rs b/src/api/management/src/request/users/mod.rs
index 5c2b31b122..55f3e4a060 100644
--- a/src/api/management/src/request/users/mod.rs
+++ b/src/api/management/src/request/users/mod.rs
@@ -704,6 +704,8 @@ pub async fn authentication(
             trace_id: None,
         },
         delegated: None,
+        fleet_id: None,
+        target: None,
     };
 
     let mut resp = SignInResponse::default();
@@ -919,6 +921,8 @@ pub async fn get_presigned_url(
                 trace_id: None,
             },
             delegated: None,
+            fleet_id: None,
+            target: None,
         };
         audit(audit_message).await;
     }
@@ -961,6 +965,8 @@ pub async fn get_auth(
                 trace_id: None,
             },
             delegated: None,
+            fleet_id: None,
+            target: None,
         };
 
         let (name, password) = {
diff --git a/src/api/management/src/request/users/service_accounts.rs b/src/api/management/src/request/users/service_accounts.rs
index 4555eee982..728a486958 100644
--- a/src/api/management/src/request/users/service_accounts.rs
+++ b/src/api/management/src/request/users/service_accounts.rs
@@ -79,6 +79,8 @@ pub async fn exchange_token(
             trace_id: None,
         },
         delegated: None,
+        fleet_id: None,
+        target: None,
     };
     match result {
         Ok(response) => {
diff --git a/src/api/management/src/request/workflows/hook_limits.rs b/src/api/management/src/request/workflows/hook_limits.rs
new file mode 100644
index 0000000000..06d107da5f
--- /dev/null
+++ b/src/api/management/src/request/workflows/hook_limits.rs
@@ -0,0 +1,150 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Per-node limiters of the workflow hook routes; `Counters` lives in this crate, not in core.
+
+use std::{
+    net::{IpAddr, Ipv6Addr},
+    sync::LazyLock,
+    time::Duration,
+};
+
+use tokio::sync::{Semaphore, SemaphorePermit};
+
+use crate::request::public_rate_limit::{Counters, MAX_KEYS};
+
+pub const MINUTE: Duration = Duration::from_secs(60);
+pub const BUSY_RETRY_AFTER_SECS: u64 = 1;
+pub const STATUS_POLLS_PER_CALL: u32 = 4;
+
+pub static LIMITERS: LazyLock<HookLimiters> = LazyLock::new(HookLimiters::from_config);
+
+pub struct HookLimiters {
+    pub ip: Counters,
+    pub org: Counters,
+    pub trigger: Counters,
+    pub status: Counters,
+    pub org_bytes: Counters,
+    pub preauth: Semaphore,
+    pub unresolved_ip: Semaphore,
+}
+
+impl HookLimiters {
+    pub fn from_config() -> Self {
+        let limit = &config::get_config().limit;
+        Self {
+            ip: Counters::fail_open(MAX_KEYS),
+            org: Counters::default(),
+            trigger: Counters::default(),
+            status: Counters::default(),
+            org_bytes: Counters::default(),
+            preauth: Semaphore::new(limit.workflow_hook_preauth_slots),
+            unresolved_ip: Semaphore::new(limit.workflow_hook_unresolved_ip_slots),
+        }
+    }
+}
+
+/// IPv6 callers own a whole /64, so one host cannot spread over 2^64 keys.
+pub fn ip_key(ip: IpAddr) -> String {
+    match ip {
+        IpAddr::V4(v4) => v4.to_string(),
+        IpAddr::V6(v6) => match v6.to_ipv4_mapped() {
+            Some(v4) => v4.to_string(),
+            None => {
+                let s = v6.segments();
+                format!("{}/64", Ipv6Addr::new(s[0], s[1], s[2], s[3], 0, 0, 0, 0))
+            }
+        },
+    }
+}
+
+/// The trigger's own budget never exceeds the org's.
+pub fn trigger_budget(rate_limit_per_minute: i32, org_rpm: u32) -> u32 {
+    u32::try_from(rate_limit_per_minute)
+        .unwrap_or_default()
+        .min(org_rpm)
+}
+
+pub fn status_budget(trigger_budget: u32) -> u32 {
+    trigger_budget.saturating_mul(STATUS_POLLS_PER_CALL)
+}
+
+/// A full gate refuses at once rather than queueing, so a flood cannot hold the verify phase.
+pub fn enter(gate: &Semaphore) -> Option<SemaphorePermit<'_>> {
+    gate.try_acquire().ok()
+}
+
+#[cfg(test)]
+mod tests {
+    use std::net::Ipv4Addr;
+
+    use super::*;
+
+    #[test]
+    fn ipv6_addresses_share_a_slash_64_key() {
+        let a: IpAddr = "2001:db8:1:2:aaaa::1".parse().unwrap();
+        let b: IpAddr = "2001:db8:1:2:bbbb:cccc:dddd:eeee".parse().unwrap();
+        let other: IpAddr = "2001:db8:1:3::1".parse().unwrap();
+        assert_eq!(ip_key(a), ip_key(b));
+        assert_ne!(ip_key(a), ip_key(other));
+        assert_eq!(ip_key(a), "2001:db8:1:2::/64");
+    }
+
+    #[test]
+    fn ipv4_addresses_are_keyed_per_host() {
+        let a = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 7));
+        let b = IpAddr::V4(Ipv4Addr::new(203, 0, 113, 8));
+        assert_ne!(ip_key(a), ip_key(b));
+        assert_eq!(ip_key(a), "203.0.113.7");
+        let mapped = IpAddr::V6(Ipv4Addr::new(203, 0, 113, 7).to_ipv6_mapped());
+        assert_eq!(
+            ip_key(mapped),
+            "203.0.113.7",
+            "a v4-mapped address keys as v4"
+        );
+    }
+
+    #[test]
+    fn the_trigger_budget_is_capped_by_the_org() {
+        assert_eq!(trigger_budget(60, 1200), 60);
+        assert_eq!(trigger_budget(5000, 1200), 1200);
+        assert_eq!(trigger_budget(0, 1200), 0);
+        assert_eq!(trigger_budget(-3, 1200), 0);
+        assert_eq!(status_budget(60), 240);
+    }
+
+    #[test]
+    fn a_full_gate_refuses_at_once() {
+        let gate = Semaphore::new(1);
+        let held = enter(&gate).unwrap();
+        assert!(enter(&gate).is_none());
+        drop(held);
+        assert!(enter(&gate).is_some());
+    }
+
+    #[test]
+    fn limits_read_their_config() {
+        let limiters = HookLimiters::from_config();
+        let limit = &config::get_config().limit;
+        assert_eq!(
+            limiters.preauth.available_permits(),
+            limit.workflow_hook_preauth_slots
+        );
+        assert_eq!(
+            limiters.unresolved_ip.available_permits(),
+            limit.workflow_hook_unresolved_ip_slots
+        );
+    }
+}
diff --git a/src/api/management/src/request/workflows/hooks.rs b/src/api/management/src/request/workflows/hooks.rs
new file mode 100644
index 0000000000..bb60e70afd
--- /dev/null
+++ b/src/api/management/src/request/workflows/hooks.rs
@@ -0,0 +1,754 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Public workflow hook routes, authenticated here and never by `auth_middleware`.
+
+use std::sync::Arc;
+
+use axum::{
+    Extension, Json,
+    body::{Body, Bytes},
+    extract::{OriginalUri, Path, Request},
+    http::{HeaderMap, HeaderValue, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use config::{axum::middlewares::RealIp, utils::time::now_micros};
+use futures::StreamExt;
+use infra::{
+    db::get_orm_client_rw,
+    table::{
+        organizations, workflow_http_trigger_requests as ledger,
+        workflow_http_triggers::{AuthMode, CredentialKind},
+    },
+};
+use openobserve_core::workflows::http_trigger::{
+    HARD_BODY_CAP, HookReason,
+    cache::{self, CachedTrigger},
+    credentials,
+    enqueue::{self, EnqueueOutcome, EnqueueRequest},
+    payload::{self, HookInput},
+    read_within_deadline, rejections,
+    signature::{self, SigError, SignedContent, WebhookHeaders},
+    worker,
+};
+use tokio::sync::{Semaphore, SemaphorePermit};
+
+use crate::{
+    common::meta::http::HttpResponse as MetaHttpResponse,
+    request::{
+        public_rate_limit::client_ip,
+        workflows::hook_limits::{self, BUSY_RETRY_AFTER_SECS, LIMITERS, MINUTE},
+    },
+};
+
+const CHALLENGE: &str = "Bearer realm=\"workflow-hooks\"";
+const IDEMPOTENT_REPLAYED: &str = "idempotent-replayed";
+const RATE_RETRY_AFTER_SECS: u64 = 60;
+const QUEUE_RETRY_AFTER_SECS: u64 = 30;
+const MAX_CONTENT_TYPE_LEN: usize = 128;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum AuthShape {
+    Token,
+    Signature,
+    Unknown,
+}
+
+impl AuthShape {
+    fn of(headers: &HeaderMap) -> Self {
+        if payload::bearer_token(headers).is_some() {
+            Self::Token
+        } else if headers.contains_key("webhook-signature") {
+            Self::Signature
+        } else {
+            Self::Unknown
+        }
+    }
+}
+
+/// The facts of one call, fixed before any check runs.
+struct HookCall {
+    org_id: String,
+    trigger_id: String,
+    caller_ip: String,
+    path: String,
+    query: Option<String>,
+    now_us: i64,
+    poll: bool,
+}
+
+impl HookCall {
+    fn new(
+        org_id: String,
+        trigger_id: String,
+        ip: Option<RealIp>,
+        req: &Request<Body>,
+        poll: bool,
+    ) -> Self {
+        // A poll is signed over the path the caller sent, base URI included.
+        let uri = req
+            .extensions()
+            .get::<OriginalUri>()
+            .map_or(req.uri(), |original| &original.0);
+        Self {
+            org_id,
+            trigger_id,
+            caller_ip: client_ip(ip),
+            path: uri.path().to_string(),
+            query: uri.query().map(str::to_string),
+            now_us: now_micros(),
+            poll,
+        }
+    }
+}
+
+struct Authenticated {
+    trigger: Arc<CachedTrigger>,
+    credential_id: String,
+    credential_prefix: String,
+    body: Bytes,
+}
+
+pub async fn invoke(
+    Path((org_id, trigger_id)): Path<(String, String)>,
+    ip: Option<Extension<RealIp>>,
+    req: Request<Body>,
+) -> Response {
+    let ip = ip.map(|Extension(ip)| ip);
+    let call = HookCall::new(org_id, trigger_id, ip, &req, false);
+    let (auth, headers) = match admit(&call, ip, req).await {
+        Ok(admitted) => admitted,
+        Err(resp) => return resp,
+    };
+    match accept(&call, &headers, auth).await {
+        Ok(resp) => resp,
+        Err((reason, retry_after)) => reject_call(&call, reason, retry_after).await,
+    }
+}
+
+pub async fn run_status(
+    Path((org_id, trigger_id, run_id)): Path<(String, String, String)>,
+    ip: Option<Extension<RealIp>>,
+    req: Request<Body>,
+) -> Response {
+    let ip = ip.map(|Extension(ip)| ip);
+    let call = HookCall::new(org_id, trigger_id, ip, &req, true);
+    let auth = match admit(&call, ip, req).await {
+        Ok((auth, _)) => auth,
+        Err(resp) => return resp,
+    };
+    match stored_status(&call, &auth, &run_id).await {
+        Ok(resp) => resp,
+        Err((reason, retry_after)) => reject_call(&call, reason, retry_after).await,
+    }
+}
+
+/// Pre-auth gates, URL refusal, the hard-cap precheck and authentication, in that order.
+async fn admit(
+    call: &HookCall,
+    ip: Option<RealIp>,
+    req: Request<Body>,
+) -> Result<(Authenticated, HeaderMap), Response> {
+    let permits = preauth(ip)?;
+    if payload::credential_in_url(&call.path, call.query.as_deref()) {
+        note_preauth(call, HookReason::CredentialInUrl).await;
+        return Err(reject(HookReason::CredentialInUrl, None));
+    }
+    if declared_length(req.headers()).is_some_and(|len| len > HARD_BODY_CAP) {
+        note_preauth(call, HookReason::PayloadTooLarge).await;
+        return Err(reject(HookReason::PayloadTooLarge, None));
+    }
+    let (parts, body) = req.into_parts();
+    let shape = AuthShape::of(&parts.headers);
+    let auth = authenticate(call, &parts.headers, body, shape).await;
+    drop(permits);
+    match auth {
+        Ok(auth) => Ok((auth, parts.headers)),
+        Err(reason) => Err(reject(reason, None)),
+    }
+}
+
+/// Every identity failure leaves here as the same 401; specific reasons are only recorded.
+async fn authenticate(
+    call: &HookCall,
+    headers: &HeaderMap,
+    body: Body,
+    shape: AuthShape,
+) -> Result<Authenticated, HookReason> {
+    let trigger = cache::get(&call.trigger_id).await.map_err(|e| {
+        log::error!("[WORKFLOW_HOOK] trigger lookup failed: {e}");
+        HookReason::InternalError
+    })?;
+    let Some(trigger) = trigger.filter(|t| belongs_to(t, &call.org_id)) else {
+        dummy_work(shape, headers);
+        return Err(HookReason::Unauthorized);
+    };
+    // These routes sit outside blocked_orgs_middleware, so a deleting org must answer as missing.
+    if db::org_status::is_blocked(&call.org_id) {
+        dummy_work(shape, headers);
+        return Err(HookReason::Unauthorized);
+    }
+    match organizations::find(&call.org_id).await {
+        Ok(Some(_)) => {}
+        Ok(None) => {
+            dummy_work(shape, headers);
+            return Err(HookReason::Unauthorized);
+        }
+        Err(e) => {
+            log::error!("[WORKFLOW_HOOK] organization lookup failed: {e}");
+            return Err(HookReason::InternalError);
+        }
+    }
+    let verified = match AuthMode::parse(&trigger.trigger.auth_mode) {
+        Some(AuthMode::Token) => verify_token(call, &trigger, headers, body).await,
+        Some(AuthMode::Signature) => verify_signature(call, &trigger, headers, body).await,
+        None => Err(HookReason::InternalError),
+    };
+    if let Err(reason) = verified {
+        note_rejection(call, reason).await;
+    }
+    verified
+}
+
+async fn verify_token(
+    call: &HookCall,
+    trigger: &Arc<CachedTrigger>,
+    headers: &HeaderMap,
+    body: Body,
+) -> Result<Authenticated, HookReason> {
+    let presented = payload::bearer_token(headers).unwrap_or_default();
+    let Some(credential) = credentials::verify_token(presented, &trigger.credentials, call.now_us)
+    else {
+        return Err(HookReason::InvalidToken);
+    };
+    let body = if call.poll {
+        Bytes::new()
+    } else {
+        read_capped(body, body_cap(trigger)).await?
+    };
+    Ok(Authenticated {
+        trigger: trigger.clone(),
+        credential_id: credential.id.clone(),
+        credential_prefix: credential.display_prefix.clone(),
+        body,
+    })
+}
+
+/// Reads the body before the HMAC, since the signature covers its exact bytes.
+async fn verify_signature(
+    call: &HookCall,
+    trigger: &Arc<CachedTrigger>,
+    headers: &HeaderMap,
+    body: Body,
+) -> Result<Authenticated, HookReason> {
+    let header = |name: &str| {
+        headers
+            .get(name)
+            .and_then(|v| v.to_str().ok())
+            .unwrap_or("")
+    };
+    let webhook = WebhookHeaders {
+        id: header("webhook-id"),
+        timestamp: header("webhook-timestamp"),
+        signature: header("webhook-signature"),
+    };
+    if webhook.id.is_empty() || webhook.timestamp.is_empty() || webhook.signature.is_empty() {
+        return Err(HookReason::InvalidSignature);
+    }
+    let body = if call.poll {
+        Bytes::new()
+    } else {
+        read_capped(body, body_cap(trigger)).await?
+    };
+    let content = if call.poll {
+        SignedContent::Poll(&call.path)
+    } else {
+        SignedContent::Invoke(&body)
+    };
+    let now_secs = call.now_us / 1_000_000;
+    let mut matched = None;
+    let mut stale = false;
+    for credential in trigger
+        .credentials
+        .iter()
+        .filter(|c| c.kind == CredentialKind::SigningSecret && c.is_live_at(call.now_us))
+    {
+        let Some(key) = credential.signing_key.as_deref() else {
+            continue;
+        };
+        match signature::verify(&webhook, content, &[key], now_secs) {
+            Ok(()) if matched.is_none() => matched = Some(credential),
+            Err(SigError::StaleTimestamp) => stale = true,
+            _ => {}
+        }
+    }
+    match matched {
+        Some(credential) => Ok(Authenticated {
+            trigger: trigger.clone(),
+            credential_id: credential.id.clone(),
+            credential_prefix: credential.display_prefix.clone(),
+            body,
+        }),
+        None if stale => Err(HookReason::StaleTimestamp),
+        None => Err(HookReason::InvalidSignature),
+    }
+}
+
+/// Post-auth checks in the order the spec fixes: enabled, limits, dry run, replay, capacity.
+async fn accept(
+    call: &HookCall,
+    headers: &HeaderMap,
+    auth: Authenticated,
+) -> Result<Response, (HookReason, Option<u64>)> {
+    check_enabled(call, &auth.trigger).await.map_err(no_retry)?;
+    if over_limits(call, &auth) {
+        return Err((HookReason::RateLimited, Some(RATE_RETRY_AFTER_SECS)));
+    }
+    let run_id = config::ider::uuid();
+    let input = payload::build_input(
+        &call.trigger_id,
+        &run_id,
+        call.now_us,
+        headers,
+        call.query.as_deref(),
+        &auth.body,
+    );
+    rejections::record_use(&call.trigger_id, &auth.credential_id, call.now_us);
+    if payload::is_dry_run(call.query.as_deref()) {
+        return Ok(dry_run(call, &auth, input).await);
+    }
+    let mode = AuthMode::parse(&auth.trigger.trigger.auth_mode).unwrap_or(AuthMode::Token);
+    let idem_key = payload::idempotency_key(headers, mode).map_err(no_retry)?;
+    let body_sha256 = credentials::sha256_hex_bytes(&auth.body);
+    if let Some(key) = idem_key.as_deref()
+        && let Some(outcome) = enqueue::replay_or_conflict(&call.trigger_id, key, &body_sha256)
+            .await
+            .map_err(no_retry)?
+    {
+        return Ok(answer(call, &auth, outcome).await);
+    }
+    enqueue::check_queue_capacity(&call.org_id)
+        .await
+        .map_err(|reason| (reason, Some(QUEUE_RETRY_AFTER_SECS)))?;
+    if !worker::heartbeat_is_fresh().await {
+        return Err((HookReason::WorkerUnavailable, Some(QUEUE_RETRY_AFTER_SECS)));
+    }
+    let request = enqueue_request(call, headers, &auth, input, idem_key, body_sha256)?;
+    let outcome = enqueue::enqueue_run(request)
+        .await
+        .map_err(enqueue_refusal)?;
+    Ok(answer(call, &auth, outcome).await)
+}
+
+async fn check_enabled(call: &HookCall, trigger: &CachedTrigger) -> Result<(), HookReason> {
+    if !trigger.trigger.enabled {
+        return Err(HookReason::EndpointDisabled);
+    }
+    match db::workflows::get_workflow(&call.org_id, &trigger.trigger.workflow_id).await {
+        Ok(Some(workflow)) if workflow.enabled => Ok(()),
+        Ok(Some(_)) => Err(HookReason::WorkflowDisabled),
+        Ok(None) => Err(HookReason::WorkflowNotPublished),
+        Err(e) => {
+            log::error!("[WORKFLOW_HOOK] workflow lookup failed: {e}");
+            Err(HookReason::InternalError)
+        }
+    }
+}
+
+/// Dry runs count here too, against calls and bytes, so a probe loop cannot run unmetered.
+fn over_limits(call: &HookCall, auth: &Authenticated) -> bool {
+    let limit = &config::get_config().limit;
+    let trigger_rpm = hook_limits::trigger_budget(
+        auth.trigger.trigger.rate_limit_per_minute,
+        limit.workflow_hook_org_rpm,
+    );
+    let bytes = u32::try_from(auth.body.len()).unwrap_or(u32::MAX);
+    LIMITERS
+        .trigger
+        .over_budget(&call.trigger_id, MINUTE, trigger_rpm)
+        || LIMITERS
+            .org
+            .over_budget(&call.org_id, MINUTE, limit.workflow_hook_org_rpm)
+        || LIMITERS.org_bytes.over_budget_by(
+            &call.org_id,
+            MINUTE,
+            limit.workflow_hook_org_bytes_per_min,
+            bytes,
+        )
+}
+
+async fn dry_run(call: &HookCall, auth: &Authenticated, input: HookInput) -> Response {
+    enqueue::write_audit(|| {
+        enqueue::hook_audit_message(
+            &call.org_id,
+            &call.trigger_id,
+            &call.path,
+            StatusCode::OK.as_u16(),
+            enqueue::dry_run_audit_body(&auth.credential_prefix, &call.caller_ip),
+        )
+    })
+    .await;
+    let body = serde_json::json!({"dry_run": true, "accepted": true, "input": input});
+    (StatusCode::OK, Json(body)).into_response()
+}
+
+fn enqueue_request(
+    call: &HookCall,
+    headers: &HeaderMap,
+    auth: &Authenticated,
+    input: HookInput,
+    idem_key: Option<String>,
+    body_sha256: String,
+) -> Result<EnqueueRequest, (HookReason, Option<u64>)> {
+    let meta = serde_json::to_string(&input.meta).map_err(|e| {
+        log::error!("[WORKFLOW_HOOK] hook meta does not serialise: {e}");
+        (HookReason::InternalError, None)
+    })?;
+    let content_type = headers
+        .get(header::CONTENT_TYPE)
+        .and_then(|v| v.to_str().ok())
+        .map(|v| v.chars().take(MAX_CONTENT_TYPE_LEN).collect());
+    Ok(EnqueueRequest {
+        request: ledger::NewHookRequest {
+            trigger_id: call.trigger_id.clone(),
+            org_id: call.org_id.clone(),
+            workflow_id: auth.trigger.trigger.workflow_id.clone(),
+            run_id: input.meta.run_id.clone(),
+            idem_key,
+            body_sha256,
+            body_bytes: i64::try_from(auth.body.len()).unwrap_or(i64::MAX),
+            content_type,
+            meta,
+            credential_id: auth.credential_id.clone(),
+            credential_prefix: auth.credential_prefix.clone(),
+            caller_ip: call.caller_ip.clone(),
+            received_at: call.now_us,
+        },
+        input,
+    })
+}
+
+/// 202 for a new run, 200 with `Idempotent-Replayed` for a replay; both point at the run.
+async fn answer(call: &HookCall, auth: &Authenticated, outcome: EnqueueOutcome) -> Response {
+    let (status, run_id, run_status, replay) = match &outcome {
+        EnqueueOutcome::Accepted { run_id } => (StatusCode::ACCEPTED, run_id, "queued", false),
+        EnqueueOutcome::Replayed { run_id, status } => {
+            (StatusCode::OK, run_id, status.as_str(), true)
+        }
+    };
+    let status_url = enqueue::status_url(&call.org_id, &call.trigger_id, run_id);
+    enqueue::write_audit(|| {
+        enqueue::hook_audit_message(
+            &call.org_id,
+            &call.trigger_id,
+            &call.path,
+            status.as_u16(),
+            enqueue::accepted_audit_body(run_id, &auth.credential_prefix, &call.caller_ip, replay),
+        )
+    })
+    .await;
+    let body =
+        serde_json::json!({"run_id": run_id, "status": run_status, "status_url": status_url});
+    let mut resp = (status, Json(body)).into_response();
+    if let Ok(location) = HeaderValue::from_str(&status_url) {
+        resp.headers_mut().insert(header::LOCATION, location);
+    }
+    if replay {
+        resp.headers_mut()
+            .insert(IDEMPOTENT_REPLAYED, HeaderValue::from_static("true"));
+    }
+    resp
+}
+
+async fn stored_status(
+    call: &HookCall,
+    auth: &Authenticated,
+    run_id: &str,
+) -> Result<Response, (HookReason, Option<u64>)> {
+    let org_rpm = config::get_config().limit.workflow_hook_org_rpm;
+    let budget = hook_limits::status_budget(hook_limits::trigger_budget(
+        auth.trigger.trigger.rate_limit_per_minute,
+        org_rpm,
+    ));
+    if LIMITERS
+        .status
+        .over_budget(&call.trigger_id, MINUTE, budget)
+    {
+        return Err((HookReason::RateLimited, Some(RATE_RETRY_AFTER_SECS)));
+    }
+    let row = ledger::get_run(get_orm_client_rw().await, &call.trigger_id, run_id)
+        .await
+        .map_err(|e| {
+            log::error!("[WORKFLOW_HOOK] run lookup failed: {e}");
+            (HookReason::InternalError, None)
+        })?
+        // A revived trigger keeps its id; older runs belong to the endpoint it replaced.
+        .filter(|row| row.received_at >= auth.trigger.trigger.created_at)
+        .ok_or((HookReason::RunNotFound, None))?;
+    let body = serde_json::json!({
+        "run_id": row.run_id,
+        "status": row.status,
+        "received_at": row.received_at,
+        "finished_at": row.finished_at,
+        "error": row.error,
+        "idempotency_key": row.idem_key,
+    });
+    Ok((StatusCode::OK, Json(body)).into_response())
+}
+
+fn preauth(ip: Option<RealIp>) -> Result<Vec<SemaphorePermit<'static>>, Response> {
+    let mut permits = Vec::with_capacity(2);
+    match ip {
+        Some(RealIp(addr)) => {
+            let rpm = config::get_config().limit.workflow_hook_ip_rpm;
+            if LIMITERS
+                .ip
+                .over_budget(&hook_limits::ip_key(addr), MINUTE, rpm)
+            {
+                return Err(reject(HookReason::RateLimited, Some(RATE_RETRY_AFTER_SECS)));
+            }
+        }
+        None => permits.push(busy_gate(&LIMITERS.unresolved_ip)?),
+    }
+    permits.push(busy_gate(&LIMITERS.preauth)?);
+    Ok(permits)
+}
+
+fn declared_length(headers: &HeaderMap) -> Option<usize> {
+    headers
+        .get(header::CONTENT_LENGTH)?
+        .to_str()
+        .ok()?
+        .trim()
+        .parse()
+        .ok()
+}
+
+fn body_cap(trigger: &CachedTrigger) -> usize {
+    usize::try_from(trigger.trigger.max_body_bytes)
+        .unwrap_or_default()
+        .min(HARD_BODY_CAP)
+}
+
+fn belongs_to(trigger: &CachedTrigger, org_id: &str) -> bool {
+    trigger.trigger.org_id == org_id && trigger.trigger.deleted_at.is_none()
+}
+
+async fn read_capped(body: Body, cap: usize) -> Result<Bytes, HookReason> {
+    read_within_deadline(collect_capped(body, cap)).await
+}
+
+/// `DefaultBodyLimit` binds only body extractors, so the handler enforces the cap as it reads.
+async fn collect_capped(body: Body, cap: usize) -> Result<Bytes, HookReason> {
+    let mut stream = body.into_data_stream();
+    let mut buf = Vec::new();
+    while let Some(chunk) = stream.next().await {
+        let chunk = chunk.map_err(|e| {
+            log::warn!("[WORKFLOW_HOOK] request body read failed: {e}");
+            HookReason::InternalError
+        })?;
+        if buf.len() + chunk.len() > cap {
+            return Err(HookReason::PayloadTooLarge);
+        }
+        buf.extend_from_slice(&chunk);
+    }
+    Ok(Bytes::from(buf))
+}
+
+/// A miss costs what a hit costs: one hash, or one HMAC over at most 64 KiB, and no body read.
+fn dummy_work(shape: AuthShape, headers: &HeaderMap) {
+    match shape {
+        AuthShape::Signature => {
+            signature::dummy_verify(declared_length(headers).unwrap_or_default());
+        }
+        AuthShape::Token | AuthShape::Unknown => {
+            credentials::dummy_token_check(payload::bearer_token(headers).unwrap_or_default());
+        }
+    }
+}
+
+/// Refusals before authentication count only against a trigger of this org.
+async fn note_preauth(call: &HookCall, reason: HookReason) {
+    if !rejections::is_recordable_id(&call.trigger_id) {
+        return;
+    }
+    match cache::get(&call.trigger_id).await {
+        Ok(Some(trigger)) if belongs_to(&trigger, &call.org_id) => {
+            rejections::record(&call.trigger_id, reason, &call.caller_ip, call.now_us);
+        }
+        Ok(_) => {}
+        Err(e) => log::warn!("[WORKFLOW_HOOK] trigger lookup for a refused call failed: {e}"),
+    }
+}
+
+async fn reject_call(call: &HookCall, reason: HookReason, retry_after: Option<u64>) -> Response {
+    note_rejection(call, reason).await;
+    reject(reason, retry_after)
+}
+
+/// Rejections on a known trigger feed its rejections panel and, sampled, the audit log.
+async fn note_rejection(call: &HookCall, reason: HookReason) {
+    rejections::record(&call.trigger_id, reason, &call.caller_ip, call.now_us);
+    if call.poll || !reason.is_recorded() {
+        return;
+    }
+    if !rejections::should_audit(&call.trigger_id, reason, call.now_us) {
+        return;
+    }
+    enqueue::write_audit(|| {
+        enqueue::hook_audit_message(
+            &call.org_id,
+            &call.trigger_id,
+            &call.path,
+            reason.status(),
+            serde_json::json!({"rejected": reason.code(), "caller_ip": call.caller_ip}),
+        )
+    })
+    .await;
+}
+
+fn reject(reason: HookReason, retry_after: Option<u64>) -> Response {
+    let public = reason.public();
+    if public == HookReason::Unauthorized {
+        return unauthorized();
+    }
+    let status = StatusCode::from_u16(public.status()).unwrap_or(StatusCode::INTERNAL_SERVER_ERROR);
+    let mut body = MetaHttpResponse::error(status, public.message());
+    body.error_detail = Some(public.code().to_string());
+    body.hint = public.hint().map(str::to_string);
+    let mut resp = (status, Json(body)).into_response();
+    if let Some(secs) = retry_after {
+        resp.headers_mut()
+            .insert(header::RETRY_AFTER, HeaderValue::from(secs));
+    }
+    resp
+}
+
+fn unauthorized() -> Response {
+    let mut body =
+        MetaHttpResponse::error(StatusCode::UNAUTHORIZED, HookReason::Unauthorized.message());
+    body.error_detail = Some(HookReason::Unauthorized.code().to_string());
+    (
+        StatusCode::UNAUTHORIZED,
+        [(header::WWW_AUTHENTICATE, CHALLENGE)],
+        Json(body),
+    )
+        .into_response()
+}
+
+fn busy_gate(gate: &Semaphore) -> Result<SemaphorePermit<'_>, Response> {
+    hook_limits::enter(gate)
+        .ok_or_else(|| reject(HookReason::RateLimited, Some(BUSY_RETRY_AFTER_SECS)))
+}
+
+fn no_retry(reason: HookReason) -> (HookReason, Option<u64>) {
+    (reason, None)
+}
+
+/// The enqueue's own cap check races past the pre-check, so it answers with the same hint.
+fn enqueue_refusal(reason: HookReason) -> (HookReason, Option<u64>) {
+    match reason {
+        HookReason::QueueFull => (reason, Some(QUEUE_RETRY_AFTER_SECS)),
+        _ => no_retry(reason),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use axum::http::{StatusCode, header};
+
+    use super::*;
+
+    async fn body_of(resp: Response) -> String {
+        let bytes = axum::body::to_bytes(resp.into_body(), 4096).await.unwrap();
+        String::from_utf8(bytes.to_vec()).unwrap()
+    }
+
+    #[tokio::test]
+    async fn a_full_preauth_semaphore_answers_429_retry_after_1() {
+        let gate = Semaphore::new(1);
+        let _held = busy_gate(&gate).unwrap();
+        let refused = busy_gate(&gate).unwrap_err();
+        assert_eq!(refused.status(), StatusCode::TOO_MANY_REQUESTS);
+        assert_eq!(refused.headers()[header::RETRY_AFTER], "1");
+        assert!(
+            body_of(refused)
+                .await
+                .contains("\"error_detail\":\"rate_limited\"")
+        );
+    }
+
+    #[test]
+    fn a_queue_full_from_the_enqueue_itself_carries_retry_after() {
+        assert_eq!(
+            enqueue_refusal(HookReason::QueueFull),
+            (HookReason::QueueFull, Some(QUEUE_RETRY_AFTER_SECS))
+        );
+        assert_eq!(
+            enqueue_refusal(HookReason::InternalError),
+            (HookReason::InternalError, None)
+        );
+        let (reason, retry_after) = enqueue_refusal(HookReason::QueueFull);
+        let resp = reject(reason, retry_after);
+        assert_eq!(resp.status(), StatusCode::SERVICE_UNAVAILABLE);
+        assert_eq!(resp.headers()[header::RETRY_AFTER], "30");
+    }
+
+    #[tokio::test]
+    async fn the_401_is_the_same_bytes_for_every_identity_reason() {
+        let expected = r#"{"code":401,"message":"Unauthorized","error_detail":"unauthorized"}"#;
+        for reason in [
+            HookReason::Unauthorized,
+            HookReason::InvalidToken,
+            HookReason::InvalidSignature,
+            HookReason::StaleTimestamp,
+        ] {
+            let resp = reject(reason, None);
+            assert_eq!(resp.status(), StatusCode::UNAUTHORIZED);
+            assert!(resp.headers().contains_key(header::WWW_AUTHENTICATE));
+            assert_eq!(body_of(resp).await, expected, "{reason:?}");
+        }
+        assert_eq!(body_of(unauthorized()).await, expected);
+    }
+
+    #[tokio::test]
+    async fn every_non_2xx_uses_the_http_response_shape() {
+        for (reason, retry) in [
+            (HookReason::CredentialInUrl, None),
+            (HookReason::PayloadTooLarge, None),
+            (HookReason::RequestTimeout, None),
+            (HookReason::IdempotencyKeyReused, None),
+            (HookReason::RateLimited, Some(60)),
+            (HookReason::QueueFull, Some(30)),
+            (HookReason::WorkerUnavailable, Some(30)),
+            (HookReason::RunNotFound, None),
+            (HookReason::InternalError, None),
+        ] {
+            let resp = reject(reason, retry);
+            assert_eq!(resp.status().as_u16(), reason.status(), "{reason:?}");
+            assert_eq!(
+                resp.headers()
+                    .get(header::RETRY_AFTER)
+                    .map(|v| v.to_str().unwrap().to_string()),
+                retry.map(|s| s.to_string()),
+                "{reason:?}"
+            );
+            let json: serde_json::Value = serde_json::from_str(&body_of(resp).await).unwrap();
+            assert_eq!(json["code"], reason.status());
+            assert_eq!(json["error_detail"], reason.code());
+            assert!(json["message"].as_str().is_some_and(|m| !m.is_empty()));
+        }
+    }
+}
diff --git a/src/api/management/src/request/workflows/http_trigger.rs b/src/api/management/src/request/workflows/http_trigger.rs
new file mode 100644
index 0000000000..9fa7cad536
--- /dev/null
+++ b/src/api/management/src/request/workflows/http_trigger.rs
@@ -0,0 +1,625 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Management routes of a workflow's HTTP endpoint: config, credentials, reveal and test runs.
+
+use axum::{
+    Json,
+    extract::Path,
+    http::{HeaderValue, StatusCode, header},
+    response::{IntoResponse, Response},
+};
+use infra::table::workflow_http_triggers::AuthMode;
+use openobserve_api_common::extractors::Headers;
+use openobserve_core::{
+    auth::{UserEmail, check_permissions},
+    workflows::http_trigger::{
+        enqueue,
+        manage::{self, EndpointPermissions, ManageError, UpsertOutcome, UpsertRequest},
+    },
+};
+
+use super::WorkflowTestResult;
+use crate::{
+    common::meta::http::HttpResponse as MetaHttpResponse,
+    request::organization::require_credential_access,
+    service::workflows::{self, TestWorkflowOptions},
+};
+
+const NO_STORE: &str = "no-store, private";
+const REVEAL_ACTION: &str = "reveal a workflow endpoint credential";
+const ROTATE_ACTION: &str = "mint a workflow endpoint credential";
+
+#[derive(serde::Deserialize, utoipa::ToSchema)]
+pub struct PutHttpTriggerBody {
+    pub enabled: bool,
+    pub auth_mode: String,
+    pub max_body_bytes: Option<i64>,
+    pub rate_limit_per_minute: Option<i32>,
+}
+
+#[derive(serde::Deserialize, utoipa::ToSchema)]
+pub struct RotateBody {
+    pub overlap_seconds: i64,
+}
+
+#[derive(serde::Deserialize, utoipa::ToSchema)]
+pub struct HttpTriggerTestBody {
+    #[serde(default)]
+    pub data: Vec<serde_json::Value>,
+    #[serde(default)]
+    pub from_node: Option<String>,
+    #[serde(default)]
+    pub run_destinations: bool,
+}
+
+#[derive(serde::Serialize, utoipa::ToSchema)]
+pub struct SecretResponse<T: serde::Serialize> {
+    #[serde(flatten)]
+    pub body: T,
+    pub secret: Option<String>,
+}
+
+/// The 404 still tells the UI what the caller may do and what the org allows.
+#[derive(serde::Serialize)]
+struct NotConfiguredBody {
+    #[serde(flatten)]
+    base: MetaHttpResponse,
+    permissions: EndpointPermissions,
+    org_rate_limit_per_minute: u32,
+    secrets_encrypted_at_rest: bool,
+}
+
+/// GetWorkflowHttpTrigger
+#[utoipa::path(
+    get,
+    path = "/{org_id}/workflows/{id}/http_trigger",
+    context_path = "/api",
+    tag = "Workflows",
+    operation_id = "getWorkflowHttpTrigger",
+    summary = "Get the HTTP endpoint of a workflow",
+    description = "Configuration, live credentials (display prefix only) and what the caller may do",
+    security(
+        ("Authorization"= [])
+    ),
+    params(
+        ("org_id" = String, Path, description = "Organization id"),
+        ("id" = String, Path, description = "Workflow id"),
+    ),
+    responses(
+        (status = 200, description = "Success", content_type = "application/json", body = manage::TriggerView),
+        (status = 404, description = "No endpoint is configured (not_configured)", content_type = "application/json", body = Object),
+        (status = 500, description = "Internal Server Error", content_type = "application/json", body = ()),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Workflows", "operation": "get"})),
+        ("x-o2-mcp" = json!({"enabled": false})),
+    )
+)]
+pub async fn get_http_trigger(
+    Headers(user): Headers<UserEmail>,
+    Path((org_id, id)): Path<(String, String)>,
+) -> Response {
+    let permissions = endpoint_permissions(&org_id, &id, &user.user_id).await;
+    match manage::get(&org_id, &id, permissions).await {
+        Ok(view) => MetaHttpResponse::json(view),
+        Err(ManageError::NotConfigured) => {
+            let mut base = MetaHttpResponse::error(
+                StatusCode::NOT_FOUND,
+                "No HTTP endpoint is configured for this workflow",
+            );
+            base.error_detail = Some("not_configured".to_string());
+            let body = NotConfiguredBody {
+                base,
+                permissions,
+                org_rate_limit_per_minute: manage::org_budget(),
+                secrets_encrypted_at_rest: manage::secrets_encrypted_at_rest(),
+            };
+            (StatusCode::NOT_FOUND, Json(body)).into_response()
+        }
+        Err(e) => manage_error(e),
+    }
+}
+
+/// PutWorkflowHttpTrigger
+#[utoipa::path(
+    put,
+    path = "/{org_id}/workflows/{id}/http_trigger",
+    context_path = "/api",
+    tag = "Workflows",
+    operation_id = "putWorkflowHttpTrigger",
+    summary = "Turn on, update or switch the mode of a workflow's HTTP endpoint",
+    description = "Creating the endpoint or switching its mode mints a credential and returns it once in `secret`",
+    security(
+        ("Authorization"= [])
+    ),
+    params(
+        ("org_id" = String, Path, description = "Organization id"),
+        ("id" = String, Path, description = "Workflow id (published or draft)"),
+    ),
+    request_body(content = PutHttpTriggerBody, description = "Endpoint settings", content_type = "application/json"),
+    responses(
+        (status = 200, description = "Updated; a mode switch also carries the new `secret`", content_type = "application/json", body = Object),
+        (status = 201, description = "Created, with the new `secret`", content_type = "application/json", body = Object),
+        (status = 400, description = "invalid_limit or invalid_auth_mode", content_type = "application/json", body = ()),
+        (status = 403, description = "Minting a credential needs credential access", content_type = "application/json", body = ()),
+        (status = 404, description = "workflow_not_found", content_type = "application/json", body = ()),
+        (status = 500, description = "Internal Server Error, e.g. stored secrets are off", content_type = "application/json", body = ()),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Workflows", "operation": "update"})),
+        ("x-o2-mcp" = json!({"enabled": false})),
+    )
+)]
+pub async fn put_http_trigger(
+    Headers(user): Headers<UserEmail>,
+    Path((org_id, id)): Path<(String, String)>,
+    Json(body): Json<PutHttpTriggerBody>,
+) -> Response {
+    let Some(auth_mode) = AuthMode::parse(&body.auth_mode) else {
+        return coded(
+            StatusCode::BAD_REQUEST,
+            "invalid_auth_mode",
+            "auth_mode must be token or signature",
+        );
+    };
+    let req = UpsertRequest {
+        enabled: body.enabled,
+        auth_mode,
+        max_body_bytes: body.max_body_bytes,
+        rate_limit_per_minute: body.rate_limit_per_minute,
+    };
+    let permissions = endpoint_permissions(&org_id, &id, &user.user_id).await;
+    let access = credential_access(&org_id, &user.user_id).await;
+    match manage::upsert(&org_id, &id, req, &user.user_id, permissions, access).await {
+        Ok(UpsertOutcome::Created { config, secret }) => {
+            with_secret(StatusCode::CREATED, config, secret.plaintext)
+        }
+        Ok(UpsertOutcome::ModeSwitched { config, secret }) => {
+            with_secret(StatusCode::OK, config, secret.plaintext)
+        }
+        Ok(UpsertOutcome::Updated { config }) => MetaHttpResponse::json(SecretResponse {
+            body: config,
+            secret: None,
+        }),
+        Err(e) => manage_error(e),
+    }
+}
+
+/// DeleteWorkflowHttpTrigger
+#[utoipa::path(
+    delete,
+    path = "/{org_id}/workflows/{id}/http_trigger",
+    context_path = "/api",
+    tag = "Workflows",
+    operation_id = "deleteWorkflowHttpTrigger",
+    summary = "Delete a workflow's HTTP endpoint",
+    description = "Revokes every credential, deletes their stored secrets and the queued runs",
+    security(
+        ("Authorization"= [])
+    ),
+    params(
+        ("org_id" = String, Path, description = "Organization id"),
+        ("id" = String, Path, description = "Workflow id"),
+    ),
+    responses(
+        (status = 204, description = "Deleted"),
+        (status = 404, description = "not_configured", content_type = "application/json", body = ()),
+        (status = 500, description = "Internal Server Error", content_type = "application/json", body = ()),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Workflows", "operation": "delete"})),
+        ("x-o2-mcp" = json!({"enabled": false})),
+    )
+)]
+pub async fn delete_http_trigger(Path((org_id, id)): Path<(String, String)>) -> Response {
+    match manage::delete(&org_id, &id).await {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(e) => manage_error(e),
+    }
+}
+
+/// RotateWorkflowHttpCredential
+#[utoipa::path(
+    post,
+    path = "/{org_id}/workflows/{id}/http_trigger/credentials",
+    context_path = "/api",
+    tag = "Workflows",
+    operation_id = "rotateWorkflowHttpCredential",
+    summary = "Mint a new credential for a workflow's HTTP endpoint",
+    description = "The old credential stays valid for `overlap_seconds` (0, 3600, 86400 or 604800), or is revoked at once for 0",
+    security(
+        ("Authorization"= [])
+    ),
+    params(
+        ("org_id" = String, Path, description = "Organization id"),
+        ("id" = String, Path, description = "Workflow id"),
+    ),
+    request_body(content = RotateBody, description = "Overlap of the old credential", content_type = "application/json"),
+    responses(
+        (status = 201, description = "The new credential with its `secret`", content_type = "application/json", body = Object),
+        (status = 400, description = "invalid_overlap", content_type = "application/json", body = ()),
+        (status = 403, description = "Minting a credential needs credential access", content_type = "application/json", body = ()),
+        (status = 404, description = "not_configured", content_type = "application/json", body = ()),
+        (status = 409, description = "credential_retiring: revoke the retiring credential first", content_type = "application/json", body = ()),
+        (status = 500, description = "Internal Server Error", content_type = "application/json", body = ()),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Workflows", "operation": "update"})),
+        ("x-o2-mcp" = json!({"enabled": false})),
+    )
+)]
+pub async fn rotate_http_credential(
+    Headers(user): Headers<UserEmail>,
+    Path((org_id, id)): Path<(String, String)>,
+    Json(body): Json<RotateBody>,
+) -> Response {
+    if let Err(denied) = require_credential_access(&org_id, &user.user_id, ROTATE_ACTION).await {
+        return denied;
+    }
+    match manage::rotate(&org_id, &id, body.overlap_seconds, &user.user_id).await {
+        Ok((view, secret)) => with_secret(StatusCode::CREATED, view, secret.plaintext),
+        Err(e) => manage_error(e),
+    }
+}
+
+/// RevokeWorkflowHttpCredential
+#[utoipa::path(
+    delete,
+    path = "/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}",
+    context_path = "/api",
+    tag = "Workflows",
+    operation_id = "revokeWorkflowHttpCredential",
+    summary = "Revoke a credential of a workflow's HTTP endpoint",
+    description = "",
+    security(
+        ("Authorization"= [])
+    ),
+    params(
+        ("org_id" = String, Path, description = "Organization id"),
+        ("id" = String, Path, description = "Workflow id"),
+        ("cred_id" = String, Path, description = "Credential id"),
+    ),
+    responses(
+        (status = 204, description = "Revoked"),
+        (status = 404, description = "not_configured or credential_not_found", content_type = "application/json", body = ()),
+        (status = 500, description = "Internal Server Error", content_type = "application/json", body = ()),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Workflows", "operation": "delete"})),
+        ("x-o2-mcp" = json!({"enabled": false})),
+    )
+)]
+pub async fn revoke_http_credential(
+    Path((org_id, id, cred_id)): Path<(String, String, String)>,
+) -> Response {
+    match manage::revoke(&org_id, &id, &cred_id).await {
+        Ok(()) => StatusCode::NO_CONTENT.into_response(),
+        Err(e) => manage_error(e),
+    }
+}
+
+/// PUT row plus `require_credential_access`; never cached; audits every successful reveal.
+#[utoipa::path(
+    get,
+    path = "/{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}/secret",
+    context_path = "/api",
+    tag = "Workflows",
+    operation_id = "revealWorkflowHttpCredentialSecret",
+    summary = "Show the value of a live credential of a workflow's HTTP endpoint",
+    description = "Audited; never cached",
+    security(
+        ("Authorization"= [])
+    ),
+    params(
+        ("org_id" = String, Path, description = "Organization id"),
+        ("id" = String, Path, description = "Workflow id"),
+        ("cred_id" = String, Path, description = "Credential id"),
+    ),
+    responses(
+        (status = 200, description = "The credential and its `secret`", content_type = "application/json", body = Object),
+        (status = 403, description = "Needs credential access", content_type = "application/json", body = ()),
+        (status = 404, description = "not_configured or credential_not_found", content_type = "application/json", body = ()),
+        (status = 500, description = "The stored secret is missing or unreadable", content_type = "application/json", body = ()),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Workflows", "operation": "get"})),
+        ("x-o2-mcp" = json!({"enabled": false})),
+    )
+)]
+pub async fn reveal_http_credential_secret(
+    Headers(user): Headers<UserEmail>,
+    Path((org_id, id, cred_id)): Path<(String, String, String)>,
+) -> Response {
+    if let Err(denied) = require_credential_access(&org_id, &user.user_id, REVEAL_ACTION).await {
+        return denied;
+    }
+    let (view, trigger_id) = match manage::reveal_secret(&org_id, &id, &cred_id).await {
+        Ok(revealed) => revealed,
+        Err(e) => return manage_error(e),
+    };
+    let path = format!("{org_id}/workflows/{id}/http_trigger/credentials/{cred_id}/secret");
+    let body = enqueue::reveal_audit_body(
+        &id,
+        &trigger_id,
+        &view.id,
+        &view.display_prefix,
+        view.kind.as_str(),
+        view.state.as_str(),
+    );
+    enqueue::write_audit(|| enqueue::reveal_audit_message(&org_id, &user.user_id, &path, body))
+        .await;
+    no_store((StatusCode::OK, Json(view)).into_response())
+}
+
+/// TestWorkflowHttpTrigger
+#[utoipa::path(
+    post,
+    path = "/{org_id}/workflows/{id}/http_trigger/test",
+    context_path = "/api",
+    tag = "Workflows",
+    operation_id = "testWorkflowHttpTrigger",
+    summary = "Run a workflow on a sample HTTP call",
+    description = "Runs the saved version of the workflow, not unsaved editor changes. The steps get the input a real call gets; destinations are suppressed unless `run_destinations` is true",
+    security(
+        ("Authorization"= [])
+    ),
+    params(
+        ("org_id" = String, Path, description = "Organization id"),
+        ("id" = String, Path, description = "Workflow id (the draft is used when it is not published)"),
+    ),
+    request_body(content = HttpTriggerTestBody, description = "Sample data", content_type = "application/json"),
+    responses(
+        (status = 200, description = "Per-node inputs, outputs and errors", content_type = "application/json", body = Object),
+        (status = 400, description = "The workflow could not run", content_type = "application/json", body = ()),
+        (status = 404, description = "not_configured or workflow_not_found", content_type = "application/json", body = ()),
+        (status = 500, description = "Internal Server Error", content_type = "application/json", body = ()),
+    ),
+    extensions(
+        ("x-o2-ratelimit" = json!({"module": "Workflows", "operation": "create"})),
+        ("x-o2-mcp" = json!({"enabled": false})),
+    )
+)]
+pub async fn test_http_trigger(
+    Headers(user): Headers<UserEmail>,
+    Path((org_id, id)): Path<(String, String)>,
+    Json(body): Json<HttpTriggerTestBody>,
+) -> Response {
+    let trigger_id = match manage::trigger_id(&org_id, &id).await {
+        Ok(trigger_id) => trigger_id,
+        Err(e) => return manage_error(e),
+    };
+    let (mut workflow, is_draft) = match stored_workflow(&org_id, &id).await {
+        Ok(found) => found,
+        Err(e) => return manage_error(e),
+    };
+    workflow.id = format!("test-{}", config::ider::uuid());
+    let input = manage::hook_test_input(&trigger_id, body.data);
+    match workflows::test_workflow(
+        &org_id,
+        &id,
+        workflow,
+        vec![input],
+        body.from_node,
+        TestWorkflowOptions {
+            is_draft,
+            suppress_destinations: !body.run_destinations,
+        },
+        &user.user_id,
+    )
+    .await
+    {
+        Ok(v) => MetaHttpResponse::json(WorkflowTestResult {
+            errors: v.errors,
+            inputs: v.inputs,
+            outputs: v.outputs,
+        }),
+        Err(e) => MetaHttpResponse::bad_request(e),
+    }
+}
+
+/// With OpenFGA off every member may edit and test, but only Admin/Root may see a credential.
+async fn endpoint_permissions(
+    org_id: &str,
+    workflow_id: &str,
+    user_id: &str,
+) -> EndpointPermissions {
+    let allowed = |method: &'static str| {
+        check_permissions(
+            workflow_id,
+            org_id,
+            user_id,
+            "workflows",
+            method,
+            None,
+            false,
+            true,
+            false,
+        )
+    };
+    let edit = allowed("PUT").await;
+    let test = allowed("POST").await;
+    EndpointPermissions {
+        edit,
+        test,
+        reveal: edit && credential_access(org_id, user_id).await,
+    }
+}
+
+async fn credential_access(org_id: &str, user_id: &str) -> bool {
+    require_credential_access(org_id, user_id, REVEAL_ACTION)
+        .await
+        .is_ok()
+}
+
+/// The published row, else the draft, as the editor shows it.
+async fn stored_workflow(
+    org_id: &str,
+    workflow_id: &str,
+) -> Result<(infra::table::workflows::Workflow, bool), ManageError> {
+    let internal = |e: anyhow::Error| ManageError::Internal(e.to_string());
+    if let Some(workflow) = workflows::get_workflow_by_id(org_id, workflow_id)
+        .await
+        .map_err(internal)?
+    {
+        return Ok((workflow, false));
+    }
+    workflows::get_draft_by_id(org_id, workflow_id)
+        .await
+        .map_err(internal)?
+        .map(|draft| (draft, true))
+        .ok_or(ManageError::WorkflowNotFound)
+}
+
+fn with_secret<T: serde::Serialize>(status: StatusCode, body: T, secret: String) -> Response {
+    no_store(
+        (
+            status,
+            Json(SecretResponse {
+                body,
+                secret: Some(secret),
+            }),
+        )
+            .into_response(),
+    )
+}
+
+fn no_store(mut resp: Response) -> Response {
+    resp.headers_mut()
+        .insert(header::CACHE_CONTROL, HeaderValue::from_static(NO_STORE));
+    resp
+}
+
+fn coded(status: StatusCode, code: &str, message: &str) -> Response {
+    let mut body = MetaHttpResponse::error(status, message);
+    body.error_detail = Some(code.to_string());
+    (status, Json(body)).into_response()
+}
+
+fn manage_error(e: ManageError) -> Response {
+    let (status, code, message) = match &e {
+        ManageError::WorkflowNotFound => (
+            StatusCode::NOT_FOUND,
+            "workflow_not_found",
+            "No published or draft workflow has this id",
+        ),
+        ManageError::NotConfigured => (
+            StatusCode::NOT_FOUND,
+            "not_configured",
+            "No HTTP endpoint is configured for this workflow",
+        ),
+        ManageError::InvalidLimit => (
+            StatusCode::BAD_REQUEST,
+            "invalid_limit",
+            "max_body_bytes must be 1 KiB to 1 MiB and rate_limit_per_minute 1 to the org budget",
+        ),
+        ManageError::InvalidOverlap => (
+            StatusCode::BAD_REQUEST,
+            "invalid_overlap",
+            "overlap_seconds must be 0, 3600, 86400 or 604800",
+        ),
+        ManageError::CredentialRetiring => (
+            StatusCode::CONFLICT,
+            "credential_retiring",
+            "Revoke the retiring credential first",
+        ),
+        ManageError::CredentialNotFound => (
+            StatusCode::NOT_FOUND,
+            "credential_not_found",
+            "No live credential with this id",
+        ),
+        ManageError::CredentialAccessRequired => (
+            StatusCode::FORBIDDEN,
+            "credential_access_required",
+            "Admin or Root role required to mint a workflow endpoint credential",
+        ),
+        ManageError::Internal(detail) => {
+            log::error!("[WORKFLOW_HOOK] management request failed: {detail}");
+            (
+                StatusCode::INTERNAL_SERVER_ERROR,
+                "internal_error",
+                "Internal error; nothing was changed",
+            )
+        }
+    };
+    coded(status, code, message)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    async fn body_json(resp: Response) -> serde_json::Value {
+        let bytes = axum::body::to_bytes(resp.into_body(), usize::MAX)
+            .await
+            .unwrap();
+        serde_json::from_slice(&bytes).unwrap()
+    }
+
+    #[tokio::test]
+    async fn every_manage_error_has_a_status_and_code() {
+        let cases = [
+            (ManageError::WorkflowNotFound, 404, "workflow_not_found"),
+            (ManageError::NotConfigured, 404, "not_configured"),
+            (ManageError::InvalidLimit, 400, "invalid_limit"),
+            (ManageError::InvalidOverlap, 400, "invalid_overlap"),
+            (ManageError::CredentialRetiring, 409, "credential_retiring"),
+            (ManageError::CredentialNotFound, 404, "credential_not_found"),
+            (
+                ManageError::CredentialAccessRequired,
+                403,
+                "credential_access_required",
+            ),
+            (
+                ManageError::Internal("db detail o2wh_x".to_string()),
+                500,
+                "internal_error",
+            ),
+        ];
+        for (error, status, code) in cases {
+            let resp = manage_error(error);
+            assert_eq!(resp.status().as_u16(), status, "{code}");
+            let json = body_json(resp).await;
+            assert_eq!(json["error_detail"], code);
+            assert_eq!(json["code"], status);
+            assert!(!json.to_string().contains("o2wh_x"), "{json}");
+        }
+    }
+
+    #[tokio::test]
+    async fn secret_responses_are_no_store_and_flatten_the_secret() {
+        let resp = with_secret(
+            StatusCode::CREATED,
+            serde_json::json!({"id": "c1", "display_prefix": "o2wh_abcd…wxyz"}),
+            "o2wh_value".to_string(),
+        );
+        assert_eq!(resp.status(), StatusCode::CREATED);
+        assert_eq!(
+            resp.headers().get(header::CACHE_CONTROL).unwrap(),
+            "no-store, private"
+        );
+        let json = body_json(resp).await;
+        assert_eq!(json["id"], "c1");
+        assert_eq!(json["secret"], "o2wh_value");
+    }
+
+    #[test]
+    fn the_test_body_defaults_to_suppressed_destinations() {
+        let body: HttpTriggerTestBody = serde_json::from_str("{}").unwrap();
+        assert!(body.data.is_empty());
+        assert!(body.from_node.is_none());
+        assert!(!body.run_destinations);
+    }
+}
diff --git a/src/api/management/src/request/workflows/mod.rs b/src/api/management/src/request/workflows/mod.rs
index 04abc74eff..9ce6ecb86a 100644
--- a/src/api/management/src/request/workflows/mod.rs
+++ b/src/api/management/src/request/workflows/mod.rs
@@ -13,13 +13,17 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+pub mod hook_limits;
+pub mod hooks;
+pub mod http_trigger;
+
 use std::collections::HashMap;
 
 use axum::{
     Json,
     extract::{Path, Query},
     http::StatusCode,
-    response::Response,
+    response::{IntoResponse, Response},
 };
 use common::utils::sql::escape_like;
 use config::{
@@ -33,8 +37,10 @@ use config::{
     utils::time::now_micros,
 };
 use db::workflows::{AssociationDeleteEvent, WorkflowTriggerType};
-use infra::table::workflows::{
-    Workflow, WorkflowAssociation, WorkflowRunErrors, WorkflowTriggerEntity,
+use infra::table::{
+    entity::workflow_http_trigger_requests as ledger_rows,
+    workflow_http_trigger_requests as ledger, workflow_http_triggers,
+    workflows::{Workflow, WorkflowAssociation, WorkflowRunErrors, WorkflowTriggerEntity},
 };
 use openobserve_api_common::extractors::Headers;
 use openobserve_core::auth::UserEmail;
@@ -49,7 +55,7 @@ use crate::{
     common::{meta::http::HttpResponse as MetaHttpResponse, utils::http::get_or_create_trace_id},
     service::{
         auth::check_folder_write_permissions,
-        workflows::{self, InputMap},
+        workflows::{self, InputMap, TriggerWorkflowError},
     },
 };
 
@@ -85,6 +91,13 @@ pub struct WorkflowRetryDetails {
     from_node: Option<String>,
 }
 
+#[derive(Serialize, ToSchema)]
+pub struct WorkflowTriggerResponse {
+    #[serde(flatten)]
+    pub base: MetaHttpResponse,
+    pub run_id: String,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize)]
 pub struct WorkflowHistoryQuery {
     /// Start time in Unix timestamp microseconds
@@ -110,6 +123,21 @@ struct WorkflowHistoryRow {
     source_id: String,
     #[serde(default)]
     run_id: String,
+    #[serde(default)]
+    status: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    http_request: Option<HttpRequestFacts>,
+}
+
+#[derive(Clone, Debug, PartialEq, Serialize, Deserialize)]
+struct HttpRequestFacts {
+    credential_prefix: String,
+    caller_ip: String,
+    idempotency_key: Option<String>,
+    content_type: Option<String>,
+    body_bytes: i64,
+    status: String,
+    error: Option<String>,
 }
 
 #[derive(Serialize)]
@@ -132,6 +160,7 @@ pub struct WorkflowListItem {
     /// is meaningless to a client, so the name is resolved here.
     #[serde(skip_serializing_if = "Option::is_none")]
     folder_name: Option<String>,
+    http_endpoint_enabled: bool,
 }
 
 /// Resolves a folder primary key to its `(slug, display name)`, memoized so a
@@ -375,6 +404,7 @@ pub async fn list_workflows(
     let mut ret = Vec::with_capacity(workflows.len());
     // Resolved once per distinct folder rather than per row.
     let mut folders: HashMap<String, Option<(String, String)>> = HashMap::new();
+    let endpoints = http_endpoint_workflows(&org_id).await;
 
     for w in workflows {
         let associations = match workflows::get_workflow_associations(&org_id, &w.id).await {
@@ -390,12 +420,14 @@ pub async fn list_workflows(
 
         let folder = resolve_folder(&mut folders, &w.folder_id).await;
 
+        let http_endpoint_enabled = endpoints.contains(&w.id);
         ret.push(WorkflowListItem {
             workflow: w,
             associations,
             is_draft: false,
             folder_id: folder.as_ref().map(|(slug, _)| slug.clone()),
             folder_name: folder.map(|(_, display)| display),
+            http_endpoint_enabled,
         });
     }
 
@@ -419,12 +451,14 @@ pub async fn list_workflows(
             continue;
         }
         let folder = resolve_folder(&mut folders, &draft.folder_id).await;
+        let http_endpoint_enabled = endpoints.contains(&draft.id);
         ret.push(WorkflowListItem {
             workflow: draft,
             associations: vec![],
             is_draft: true,
             folder_id: folder.as_ref().map(|(slug, _)| slug.clone()),
             folder_name: folder.map(|(_, display)| display),
+            http_endpoint_enabled,
         });
     }
 
@@ -715,10 +749,7 @@ pub async fn update_workflows(
             .iter()
             .any(|v| v.trigger_type == WorkflowTriggerType::IncidentEvent.to_string());
 
-        // this means that originally this was a incident workflow and now we have made it an alert
-        // workflow
-        if incident_association_exists
-            && payload.trigger_type == WorkflowTriggerType::AlertFired
+        if drops_incident_association(incident_association_exists, &payload.trigger_type)
             && let Err(e) = db::workflows::delete_workflow_association(
                 AssociationDeleteEvent::TriggerWorkflow {
                     org_id: org_id.clone(),
@@ -875,8 +906,9 @@ pub async fn test_workflow(
     ),
     request_body(content = Vec<serde_json::Value>, description = "Workflow inputs, one JSON value per input event", content_type = "application/json"),
     responses(
-        (status = 200, description = "Success", content_type = "application/json", body = Object),
+        (status = 200, description = "Success", content_type = "application/json", body = WorkflowTriggerResponse),
         (status = 400, description = "Failure", content_type = "application/json", body = ()),
+        (status = 409, description = "The workflow is disabled", content_type = "application/json", body = ()),
     ),
     extensions(
         ("x-o2-ratelimit" = json!({"module": "Workflows", "operation": "create"})),
@@ -888,11 +920,27 @@ pub async fn trigger_workflow(
     Json(inputs): Json<Vec<serde_json::Value>>,
 ) -> Response {
     match workflows::trigger_workflow(&org_id, &workflow_id, inputs, &user_email.user_id).await {
-        Ok(trace_id) => MetaHttpResponse::json(
-            MetaHttpResponse::message(StatusCode::OK, "Workflow triggered successfully")
-                .with_trace_id(trace_id),
-        ),
-        Err(e) => MetaHttpResponse::bad_request(e),
+        Ok(run) => {
+            let mut base =
+                MetaHttpResponse::message(StatusCode::OK, "Workflow triggered successfully");
+            base.with_trace_id(run.trace_id);
+            MetaHttpResponse::json(WorkflowTriggerResponse {
+                base,
+                run_id: run.run_id,
+            })
+        }
+        Err(TriggerWorkflowError::Disabled) => {
+            let mut body = MetaHttpResponse::error(
+                StatusCode::CONFLICT,
+                "workflow is disabled, enable it before triggering a run",
+            );
+            body.error_detail = Some("workflow_disabled".to_string());
+            body.into_response()
+        }
+        Err(TriggerWorkflowError::NotFound) => {
+            MetaHttpResponse::bad_request(format!("workflow with id {workflow_id} not found"))
+        }
+        Err(TriggerWorkflowError::Other(e)) => MetaHttpResponse::bad_request(e),
     }
 }
 
@@ -1112,18 +1160,25 @@ pub async fn get_workflow_history(
     }
 
     let trace_id = get_or_create_trace_id(req.headers(), &tracing::Span::current());
+    let cap = usize::try_from(config::get_config().limit.query_default_limit).unwrap_or(1000);
+    let hook_runs = match ledger::list_for_workflow(
+        infra::db::get_orm_client_rw().await,
+        &org_id,
+        &workflow_id,
+        start_time,
+        end_time,
+        cap as u64,
+    )
+    .await
+    {
+        Ok(rows) => rows,
+        Err(e) => {
+            log::error!("error reading the HTTP run ledger of {org_id}/{workflow_id} : {e}");
+            return MetaHttpResponse::internal_error(e);
+        }
+    };
 
-    let data_sql = format!(
-        "SELECT _timestamp, org, key,  \
-         start_time, end_time, \
-         evaluation_took_in_secs, \
-         source_node, error \
-         FROM \"{TRIGGERS_STREAM}\" \
-         WHERE module = 'workflow' AND org = '{org_id}' \
-         AND key like '{}/%'\
-         AND _timestamp >= {start_time} AND _timestamp <= {end_time}",
-        escape_like(&workflow_id).replace("'", "''")
-    );
+    let data_sql = history_sql(&org_id, &workflow_id, start_time, end_time);
 
     let data_req = SearchRequest {
         query: SearchQuery {
@@ -1152,7 +1207,7 @@ pub async fn get_workflow_history(
         Err(e) => {
             let msg = e.to_string().to_lowercase();
             if msg.contains("not found") || msg.contains("stream not found") {
-                return MetaHttpResponse::json(Vec::<WorkflowHistoryRow>::new());
+                return MetaHttpResponse::json(merge_ledger_rows(vec![], hook_runs, cap));
             }
             log::error!("Failed to search alert history: {}", e);
             return MetaHttpResponse::internal_error(format!(
@@ -1179,22 +1234,22 @@ pub async fn get_workflow_history(
     let ret: Vec<_> = parsed_results
         .into_iter()
         .map(|mut v| {
-            let Some((event_type, source_id, run_id)) = parse_workflow_history_key(&v.key) else {
+            if let Some((event_type, source_id, run_id)) = parse_workflow_history_key(&v.key) {
+                v.run_id = run_id;
+                v.source_id = source_id;
+                v.event_type = event_type;
+            } else {
                 log::warn!(
                     "unexpected key for workflow history of {org_id}/{workflow_id} : {}",
                     v.key
                 );
-                return v;
-            };
-
-            v.run_id = run_id;
-            v.source_id = source_id;
-            v.event_type = event_type;
+            }
+            normalise_history_status(&mut v);
             v
         })
         .collect();
 
-    MetaHttpResponse::json(ret)
+    MetaHttpResponse::json(merge_ledger_rows(ret, hook_runs, cap))
 }
 
 /// PromoteDraftWorkflow
@@ -1310,6 +1365,126 @@ pub async fn promote_draft(
     MetaHttpResponse::created("converted to workflow successfully")
 }
 
+/// Empty when hooks are off, so a stored trigger never advertises an endpoint that 404s.
+async fn http_endpoint_workflows(org_id: &str) -> std::collections::HashSet<String> {
+    if !openobserve_core::workflows::http_trigger::hooks_enabled() {
+        return Default::default();
+    }
+    workflow_http_triggers::enabled_workflow_ids(infra::db::get_orm_client_rw().await, org_id)
+        .await
+        .unwrap_or_else(|e| {
+            log::error!("error listing the HTTP endpoints of {org_id} : {e}");
+            Default::default()
+        })
+}
+
+/// Any trigger type but `IncidentEvent` drops the association, or incidents keep running it.
+fn drops_incident_association(exists: bool, trigger_type: &WorkflowTriggerType) -> bool {
+    exists && *trigger_type != WorkflowTriggerType::IncidentEvent
+}
+
+/// Stream rows win for timing; the ledger adds runs not yet streamed and the request facts.
+fn merge_ledger_rows(
+    stream: Vec<WorkflowHistoryRow>,
+    ledger: Vec<ledger_rows::Model>,
+    cap: usize,
+) -> Vec<WorkflowHistoryRow> {
+    let mut by_run: HashMap<String, ledger_rows::Model> = ledger
+        .into_iter()
+        .map(|row| (row.run_id.clone(), row))
+        .collect();
+    let mut merged: Vec<WorkflowHistoryRow> = stream
+        .into_iter()
+        .map(|mut row| {
+            if let Some(request) = by_run.remove(&row.run_id) {
+                row.http_request = Some(http_request_facts(&request));
+            }
+            row
+        })
+        .collect();
+    merged.extend(by_run.into_values().map(ledger_history_row));
+    merged.sort_by(|a, b| {
+        b._timestamp
+            .cmp(&a._timestamp)
+            .then_with(|| b.run_id.cmp(&a.run_id))
+    });
+    merged.truncate(cap);
+    merged
+}
+
+fn http_request_facts(row: &ledger_rows::Model) -> HttpRequestFacts {
+    HttpRequestFacts {
+        credential_prefix: row.credential_prefix.clone(),
+        caller_ip: row.caller_ip.clone(),
+        idempotency_key: row.idem_key.clone(),
+        content_type: row.content_type.clone(),
+        body_bytes: row.body_bytes,
+        status: row.status.clone(),
+        error: row.error.clone(),
+    }
+}
+
+/// Keyed like the worker's stream row, so the client parses both the same way.
+fn ledger_history_row(row: ledger_rows::Model) -> WorkflowHistoryRow {
+    let start_time = row.claimed_at.unwrap_or(row.received_at);
+    let end_time = row.finished_at.unwrap_or(start_time);
+    let source_id = format!("hook:{}", row.trigger_id);
+    let mut history = WorkflowHistoryRow {
+        _timestamp: row.received_at,
+        org: row.org_id.clone(),
+        start_time,
+        end_time,
+        evaluation_took_in_secs: (end_time - start_time).max(0) as f64 / 1_000_000.0,
+        source_node: row.claimed_by.clone().unwrap_or_default(),
+        key: format!(
+            "{}/{}/{source_id}/{}",
+            row.workflow_id,
+            WorkflowTriggerType::Webhook,
+            row.run_id
+        ),
+        error: row.error.clone(),
+        event_type: WorkflowTriggerType::Webhook,
+        source_id,
+        run_id: row.run_id.clone(),
+        status: Some(row.status.clone()),
+        http_request: Some(http_request_facts(&row)),
+    };
+    normalise_history_status(&mut history);
+    history
+}
+
+fn history_sql(org_id: &str, workflow_id: &str, start_time: i64, end_time: i64) -> String {
+    format!(
+        "SELECT _timestamp, org, key,  \
+         start_time, end_time, \
+         evaluation_took_in_secs, \
+         source_node, error, status \
+         FROM \"{TRIGGERS_STREAM}\" \
+         WHERE module = 'workflow' AND org = '{org_id}' \
+         AND key like '{}/%'\
+         AND _timestamp >= {start_time} AND _timestamp <= {end_time}",
+        escape_like(workflow_id).replace("'", "''")
+    )
+}
+
+/// Rows written before the stored-status fix say `succeeded` even when the run errored.
+fn normalise_history_status(row: &mut WorkflowHistoryRow) {
+    let errored = row.error.is_some();
+    let status = match row.status.as_deref() {
+        Some("queued" | "running" | "expired" | "failed") => return,
+        Some("error") => "failed",
+        Some("succeeded" | "completed")
+            if errored && row.event_type != WorkflowTriggerType::Webhook =>
+        {
+            "failed"
+        }
+        Some("succeeded" | "completed") => "succeeded",
+        _ if errored => "failed",
+        _ => "succeeded",
+    };
+    row.status = Some(status.to_string());
+}
+
 /// Splits the 4-part run-history key. `rsplit_once` on the tail, not a
 /// left-to-right split: a source_id may itself contain '/' (a user email or an
 /// org/name pair), which would otherwise shift run_id into a source fragment.
@@ -1418,4 +1593,234 @@ mod tests {
             WorkflowDeleteOutcome::DeletePublished
         );
     }
+
+    fn history_row(
+        event_type: WorkflowTriggerType,
+        status: Option<&str>,
+        error: Option<&str>,
+    ) -> WorkflowHistoryRow {
+        WorkflowHistoryRow {
+            _timestamp: 0,
+            org: "org1".to_string(),
+            start_time: 0,
+            end_time: 0,
+            evaluation_took_in_secs: 0.0,
+            source_node: String::new(),
+            key: String::new(),
+            error: error.map(str::to_string),
+            event_type,
+            source_id: String::new(),
+            run_id: String::new(),
+            status: status.map(str::to_string),
+            http_request: None,
+        }
+    }
+
+    fn stream_row(run_id: &str, at: i64) -> WorkflowHistoryRow {
+        let mut row = history_row(WorkflowTriggerType::Webhook, Some("succeeded"), None);
+        row._timestamp = at;
+        row.start_time = at + 10;
+        row.end_time = at + 20;
+        row.run_id = run_id.to_string();
+        row.key = format!("wf1/Webhook/hook:t1/{run_id}");
+        row
+    }
+
+    fn ledger_row(run_id: &str, status: &str, at: i64) -> ledger_rows::Model {
+        ledger_rows::Model {
+            id: 0,
+            trigger_id: "t1".to_string(),
+            org_id: "org1".to_string(),
+            workflow_id: "wf1".to_string(),
+            run_id: run_id.to_string(),
+            idem_key: Some(format!("key-{run_id}")),
+            body_sha256: "ab".repeat(32),
+            body_bytes: 42,
+            content_type: Some("application/json".to_string()),
+            meta: "{}".to_string(),
+            status: status.to_string(),
+            claimed_by: None,
+            claimed_at: None,
+            error: None,
+            credential_id: "c1".to_string(),
+            credential_prefix: "o2wh_abcd…wxyz".to_string(),
+            caller_ip: "203.0.113.7".to_string(),
+            received_at: at,
+            finished_at: None,
+        }
+    }
+
+    #[test]
+    fn ledger_rows_merge_into_history_by_run_id() {
+        let merged = merge_ledger_rows(
+            vec![stream_row("done", 100)],
+            vec![
+                ledger_row("done", "succeeded", 90),
+                ledger_row("waiting", "queued", 300),
+                ledger_row("busy", "running", 200),
+            ],
+            1000,
+        );
+        let runs: Vec<(&str, Option<&str>)> = merged
+            .iter()
+            .map(|r| (r.run_id.as_str(), r.status.as_deref()))
+            .collect();
+        assert_eq!(
+            runs,
+            vec![
+                ("waiting", Some("queued")),
+                ("busy", Some("running")),
+                ("done", Some("succeeded")),
+            ]
+        );
+        let facts = merged[2].http_request.as_ref().unwrap();
+        assert_eq!(facts.credential_prefix, "o2wh_abcd…wxyz");
+        assert_eq!(facts.caller_ip, "203.0.113.7");
+        assert_eq!(facts.idempotency_key.as_deref(), Some("key-done"));
+        assert_eq!(facts.body_bytes, 42);
+        let queued = &merged[0];
+        assert_eq!(queued.event_type, WorkflowTriggerType::Webhook);
+        assert_eq!(
+            parse_workflow_history_key(&queued.key),
+            Some((
+                WorkflowTriggerType::Webhook,
+                "hook:t1".to_string(),
+                "waiting".to_string()
+            ))
+        );
+    }
+
+    #[test]
+    fn the_stream_row_wins_for_timing() {
+        let mut ledger = ledger_row("done", "succeeded", 90);
+        ledger.claimed_at = Some(1);
+        ledger.finished_at = Some(2);
+        let merged = merge_ledger_rows(vec![stream_row("done", 100)], vec![ledger], 1000);
+        assert_eq!(merged.len(), 1);
+        assert_eq!(
+            (
+                merged[0]._timestamp,
+                merged[0].start_time,
+                merged[0].end_time
+            ),
+            (100, 110, 120)
+        );
+        assert!(merged[0].http_request.is_some());
+    }
+
+    #[test]
+    fn merged_history_is_truncated_to_the_cap() {
+        let stream = (0..3).map(|i| stream_row(&format!("s{i}"), i)).collect();
+        let ledger = (0..3)
+            .map(|i| ledger_row(&format!("l{i}"), "queued", 10 + i))
+            .collect();
+        let merged = merge_ledger_rows(stream, ledger, 4);
+        let runs: Vec<&str> = merged.iter().map(|r| r.run_id.as_str()).collect();
+        assert_eq!(runs, vec!["l2", "l1", "l0", "s2"]);
+    }
+
+    #[test]
+    fn ledger_only_rows_keep_their_stored_status() {
+        let mut lost = ledger_row("lost", "failed", 5);
+        lost.error = Some("worker_lost".to_string());
+        let merged = merge_ledger_rows(vec![], vec![lost, ledger_row("late", "expired", 6)], 1000);
+        let runs: Vec<(&str, Option<&str>, Option<&str>)> = merged
+            .iter()
+            .map(|r| (r.run_id.as_str(), r.status.as_deref(), r.error.as_deref()))
+            .collect();
+        assert_eq!(
+            runs,
+            vec![
+                ("late", Some("expired"), None),
+                ("lost", Some("failed"), Some("worker_lost")),
+            ]
+        );
+    }
+
+    #[test]
+    fn switching_an_incident_workflow_to_another_trigger_type_drops_the_incident_association() {
+        for trigger_type in [
+            WorkflowTriggerType::AlertFired,
+            WorkflowTriggerType::AlertResolved,
+            WorkflowTriggerType::Manual,
+            WorkflowTriggerType::Webhook,
+        ] {
+            assert!(
+                drops_incident_association(true, &trigger_type),
+                "{trigger_type:?}"
+            );
+        }
+        assert!(!drops_incident_association(
+            true,
+            &WorkflowTriggerType::IncidentEvent
+        ));
+        assert!(!drops_incident_association(
+            false,
+            &WorkflowTriggerType::Webhook
+        ));
+    }
+
+    #[test]
+    fn an_errored_row_stored_as_succeeded_renders_failed() {
+        let mut row = history_row(
+            WorkflowTriggerType::AlertFired,
+            Some("succeeded"),
+            Some("some node errored during execution"),
+        );
+        normalise_history_status(&mut row);
+        assert_eq!(row.status.as_deref(), Some("failed"));
+    }
+
+    #[test]
+    fn stream_error_maps_to_failed() {
+        let mut row = history_row(WorkflowTriggerType::Manual, Some("error"), Some("boom"));
+        normalise_history_status(&mut row);
+        assert_eq!(row.status.as_deref(), Some("failed"));
+    }
+
+    #[test]
+    fn a_clean_row_stays_succeeded() {
+        let mut row = history_row(WorkflowTriggerType::AlertFired, Some("succeeded"), None);
+        normalise_history_status(&mut row);
+        assert_eq!(row.status.as_deref(), Some("succeeded"));
+    }
+
+    #[test]
+    fn every_normalised_status_is_in_the_history_vocabulary() {
+        let vocabulary = ["queued", "running", "succeeded", "failed", "expired"];
+        let stored = [
+            None,
+            Some("succeeded"),
+            Some("completed"),
+            Some("error"),
+            Some("failed"),
+            Some("skipped"),
+            Some("queued"),
+            Some("running"),
+            Some("expired"),
+        ];
+        for event_type in ["AlertFired", "Webhook"] {
+            for status in stored {
+                for error in [None, Some("boom")] {
+                    let mut row = history_row(WorkflowTriggerType::from(event_type), status, error);
+                    normalise_history_status(&mut row);
+                    let got = row.status.as_deref().unwrap_or("<none>");
+                    assert!(
+                        vocabulary.contains(&got),
+                        "{status:?} with error {error:?} on {event_type} normalised to {got}"
+                    );
+                }
+            }
+        }
+    }
+
+    #[test]
+    fn the_history_query_selects_the_stored_status() {
+        let sql = history_sql("org1", "wf1", 1, 2);
+        let select = sql.split(" FROM ").next().unwrap();
+        assert!(
+            select.split(',').any(|column| column.trim() == "status"),
+            "the history SELECT must return status, got {select}"
+        );
+    }
 }
diff --git a/src/api/search/src/promql/mod.rs b/src/api/search/src/promql/mod.rs
index 8b92d92c96..d80f1480f1 100644
--- a/src/api/search/src/promql/mod.rs
+++ b/src/api/search/src/promql/mod.rs
@@ -757,6 +757,7 @@ pub async fn metadata(
                     use_all_org: false,
                     use_self_context: false,
                     use_self_parent: true,
+                    feature: None,
                 },
                 user.role,
                 user.is_external,
@@ -1070,6 +1071,7 @@ async fn labels(
                     use_all_org: false,
                     use_self_context: false,
                     use_self_parent: true,
+                    feature: None,
                 },
                 user.role,
                 user.is_external,
@@ -1190,6 +1192,7 @@ pub async fn label_values(
                     use_all_org: false,
                     use_self_context: false,
                     use_self_parent: true,
+                    feature: None,
                 },
                 user.role,
                 user.is_external,
diff --git a/src/api/search/src/search/multi_streams.rs b/src/api/search/src/search/multi_streams.rs
index 06837dd517..de88ad2531 100644
--- a/src/api/search/src/search/multi_streams.rs
+++ b/src/api/search/src/search/multi_streams.rs
@@ -1564,6 +1564,8 @@ pub async fn report_to_audit(
                 trace_id: Some(trace_id.to_string()),
             },
             delegated: None,
+            fleet_id: None,
+            target: None,
         })
         .await;
     }
diff --git a/src/api/search/src/search/search_inspector.rs b/src/api/search/src/search/search_inspector.rs
index 7615dbe1a2..eb48d9bdbc 100644
--- a/src/api/search/src/search/search_inspector.rs
+++ b/src/api/search/src/search/search_inspector.rs
@@ -245,6 +245,7 @@ pub async fn get_search_profile(
                         use_all_org: false,
                         use_self_context: false,
                         use_self_parent: true,
+                        feature: None,
                     },
                     user.role,
                     user.is_external,
diff --git a/src/api/search/src/search/search_job.rs b/src/api/search/src/search/search_job.rs
index 3359dff374..ab470f502c 100644
--- a/src/api/search/src/search/search_job.rs
+++ b/src/api/search/src/search/search_job.rs
@@ -489,6 +489,9 @@ pub async fn get_job_result(
         if let Some(res) = check_permissions(&model, &org_id, &user_id).await {
             return res;
         }
+        if let Some(res) = check_license(&model) {
+            return res;
+        }
 
         if let Some(msg) = model.error_message {
             MetaHttpResponse::internal_error(format!("job_id: {job_id} error: {msg}",))
@@ -634,6 +637,9 @@ pub async fn retry_job(
         if let Some(res) = check_permissions(&model, &org_id, &user_id).await {
             return res;
         }
+        if let Some(res) = check_license(&model) {
+            return res;
+        }
 
         if model.status != 2 && model.status != 3 {
             return MetaHttpResponse::forbidden(format!(
@@ -725,6 +731,32 @@ fn apply_pagination(response: SearchResponse, from: i64, size: i64) -> Response
     Json(res).into_response()
 }
 
+// The route's `type` query param is caller-controlled, so gate on the type the job was submitted
+// with.
+#[cfg(feature = "enterprise")]
+fn check_license(job: &JobModel) -> Option<Response> {
+    use config::meta::feature::Feature;
+    let feature = match StreamType::from(job.stream_type.as_str()) {
+        StreamType::EnrichmentTables => return None,
+        StreamType::Metrics => Feature::Metrics,
+        StreamType::Traces => Feature::Traces,
+        StreamType::Profiles => Feature::ContinuousProfiling,
+        _ => Feature::Logs,
+    };
+    if o2_enterprise::enterprise::license::check_features(&[feature]) {
+        return None;
+    }
+    let name: &str = feature.into();
+    let err = infra::errors::ErrorCodes::LicenseFeatureNotEntitled(name.to_string());
+    Some(
+        (
+            StatusCode::FORBIDDEN,
+            Json(MetaHttpResponse::error_code(err)),
+        )
+            .into_response(),
+    )
+}
+
 // check permissions
 #[cfg(feature = "enterprise")]
 async fn check_permissions(job: &JobModel, org_id: &str, user_id: &str) -> Option<Response> {
diff --git a/src/api/search/src/traces/list/query.rs b/src/api/search/src/traces/list/query.rs
index fa1c60ee5b..e0d782d019 100644
--- a/src/api/search/src/traces/list/query.rs
+++ b/src/api/search/src/traces/list/query.rs
@@ -199,23 +199,32 @@ pub fn build_llm_trace_query(
     };
 
     if validated.has_gen_ai {
+        let usage = |column: &str| validated.usage_sum(column);
         let total_tokens_expr = if validated.has_total_tokens {
-            "sum(gen_ai_usage_total_tokens) as gen_ai_usage_details_total"
+            format!(
+                "{} as gen_ai_usage_details_total",
+                usage("gen_ai_usage_total_tokens")
+            )
         } else {
-            "0 as gen_ai_usage_details_total"
+            "0 as gen_ai_usage_details_total".to_string()
         };
+        let input_tokens_expr = usage("gen_ai_usage_input_tokens");
+        let output_tokens_expr = usage("gen_ai_usage_output_tokens");
+        let cost_expr = usage("gen_ai_usage_cost");
         format!(
             "SELECT trace_id, min({TIMESTAMP_COL_NAME}) as zo_sql_timestamp, \
             min(start_time) as trace_start_time, max(end_time) as trace_end_time, \
             (max(end_time) - min(start_time)) as zo_sql_duration, \
-            sum(gen_ai_usage_input_tokens) as gen_ai_usage_details_input, \
-            sum(gen_ai_usage_output_tokens) as gen_ai_usage_details_output, \
+            {input_tokens_expr} as gen_ai_usage_details_input, \
+            {output_tokens_expr} as gen_ai_usage_details_output, \
             {total_tokens_expr}, \
-            sum(gen_ai_usage_cost) as gen_ai_usage_cost_details, \
+            {cost_expr} as gen_ai_usage_cost_details, \
+            {}, \
             array_agg(DISTINCT gen_ai_response_model) FILTER (WHERE gen_ai_response_model IS NOT NULL AND gen_ai_response_model != '') as gen_ai_response_models, \
             {first_msg_clause} as gen_ai_input_messages, \
             {extra_selects} \
-            FROM {stream_ident}"
+            FROM {stream_ident}",
+            validated.unpriced_selects()
         )
     } else {
         let total_tokens_expr = if validated.has_total_tokens {
@@ -382,6 +391,37 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_build_llm_trace_query_sums_only_llm_call_spans() {
+        let mut validated = schema_compat::ValidatedLlmSchema::fallback(true);
+        validated.has_total_tokens = true;
+        validated.has_operation_name = true;
+        let sql = build_llm_trace_query("default", &validated, "count(*) AS span_count");
+        let llm_call = "(gen_ai_operation_name IS NULL OR gen_ai_operation_name IN \
+                        ('chat', 'text_completion', 'generate_content', 'embeddings'))";
+        for (column, alias) in [
+            ("gen_ai_usage_input_tokens", "gen_ai_usage_details_input"),
+            ("gen_ai_usage_output_tokens", "gen_ai_usage_details_output"),
+            ("gen_ai_usage_total_tokens", "gen_ai_usage_details_total"),
+            ("gen_ai_usage_cost", "gen_ai_usage_cost_details"),
+        ] {
+            let expected = format!("sum(CASE WHEN {llm_call} THEN {column} ELSE 0 END) as {alias}");
+            assert!(sql.contains(&expected), "{sql}");
+        }
+    }
+
+    #[test]
+    fn test_build_llm_trace_query_plain_sums_without_operation_name() {
+        let mut validated = schema_compat::ValidatedLlmSchema::fallback(true);
+        validated.has_total_tokens = true;
+        let sql = build_llm_trace_query("default", &validated, "count(*) AS span_count");
+        assert!(sql.contains("sum(gen_ai_usage_input_tokens) as gen_ai_usage_details_input"));
+        assert!(sql.contains("sum(gen_ai_usage_output_tokens) as gen_ai_usage_details_output"));
+        assert!(sql.contains("sum(gen_ai_usage_total_tokens) as gen_ai_usage_details_total"));
+        assert!(sql.contains("sum(gen_ai_usage_cost) as gen_ai_usage_cost_details"));
+        assert!(!sql.contains("gen_ai_operation_name"), "{sql}");
+    }
+
     #[test]
     fn test_trace_builders_quote_stream_name() {
         assert!(
diff --git a/src/api/search/src/traces/list/response.rs b/src/api/search/src/traces/list/response.rs
index 2e42f709fc..a558b5910e 100644
--- a/src/api/search/src/traces/list/response.rs
+++ b/src/api/search/src/traces/list/response.rs
@@ -34,6 +34,10 @@ pub struct TraceResponseItem {
     gen_ai_usage_cost: f64,
     gen_ai_input_messages: Option<serde_json::Value>,
     models: Vec<String>,
+    /// Tokens of this trace's spans that no price matched; their cost is missing.
+    gen_ai_unpriced_tokens: i64,
+    /// Models of those unpriced spans.
+    gen_ai_unpriced_models: Vec<String>,
 }
 
 #[derive(Debug, Default, Serialize)]
@@ -189,6 +193,8 @@ fn insert_summary(
         max_duration
     };
 
+    let (gen_ai_unpriced_tokens, gen_ai_unpriced_models) =
+        crate::traces::schema_compat::parse_unpriced(item);
     batch.traces.insert(
         trace_id.clone(),
         TraceResponseItem {
@@ -227,6 +233,8 @@ fn insert_summary(
                         .collect()
                 })
                 .unwrap_or_default(),
+            gen_ai_unpriced_tokens,
+            gen_ai_unpriced_models,
         },
     );
 }
@@ -290,7 +298,8 @@ mod tests {
             "first_service_name": "api", "first_operation_name": "request",
             "gen_ai_usage_details_input": 10, "gen_ai_usage_details_output": 20,
             "gen_ai_usage_details_total": 30, "gen_ai_usage_cost_details": 0.5,
-            "gen_ai_input_messages": "hello", "gen_ai_response_models": ["model", null]
+            "gen_ai_input_messages": "hello", "gen_ai_response_models": ["model", null],
+            "gen_ai_unpriced_tokens": 12, "gen_ai_unpriced_models": ["acme-internal-llm"]
         })
     }
 
@@ -307,7 +316,8 @@ mod tests {
                 "first_event": {"service_name": "gateway", "operation_name": "request"},
                 "gen_ai_usage_input_tokens": 10, "gen_ai_usage_output_tokens": 20,
                 "gen_ai_usage_total_tokens": 30, "gen_ai_usage_cost": 0.5,
-                "gen_ai_input_messages": "hello", "models": ["model"]
+                "gen_ai_input_messages": "hello", "models": ["model"],
+                "gen_ai_unpriced_tokens": 12, "gen_ai_unpriced_models": ["acme-internal-llm"]
             })
         );
     }
diff --git a/src/api/search/src/traces/schema_compat.rs b/src/api/search/src/traces/schema_compat.rs
index 8e886abbce..9477b79ea3 100644
--- a/src/api/search/src/traces/schema_compat.rs
+++ b/src/api/search/src/traces/schema_compat.rs
@@ -37,8 +37,8 @@ use arrow_schema::Schema;
 use config::meta::{
     stream::StreamType,
     traces::{
-        GEN_AI_SENTINEL_COLUMN, OPTIONAL_GEN_AI_FIELDS, OPTIONAL_LLM_FIELDS,
-        REQUIRED_GEN_AI_FIELDS, REQUIRED_LLM_FIELDS,
+        GEN_AI_OPERATION_NAME_COLUMN, GEN_AI_SENTINEL_COLUMN, GENERATION_GEN_AI_OPERATIONS,
+        OPTIONAL_GEN_AI_FIELDS, OPTIONAL_LLM_FIELDS, REQUIRED_GEN_AI_FIELDS, REQUIRED_LLM_FIELDS,
     },
 };
 
@@ -76,6 +76,13 @@ impl LlmColumns {
     }
 }
 
+/// Schema facts for callers that only need the generation and usage layout.
+#[derive(Debug, Clone, Copy, Default)]
+pub(super) struct StreamLlmLayout {
+    pub(super) has_gen_ai: bool,
+    pub(super) has_operation_name: bool,
+}
+
 /// Decide which schema generation an Arrow schema belongs to.
 ///
 /// Returns `true` when the new `gen_ai_*` columns are present (i.e. the stream
@@ -94,19 +101,47 @@ pub(super) fn columns_for(schema: &Schema) -> LlmColumns {
     }
 }
 
-/// Fetch the stream's Arrow schema from cache and decide whether it uses the
-/// new `gen_ai_*` columns. Streams missing from the cache default to `false`
-/// (legacy) so query SQL never references columns that aren't there for an
-/// unknown stream.
-pub(super) async fn stream_has_gen_ai_fields(
+/// Whether the stream stores `gen_ai_operation_name`, which totals need to sum only LLM calls.
+pub(super) fn has_operation_name(schema: &Schema) -> bool {
+    has_gen_ai_fields(schema) && schema.field_with_name(GEN_AI_OPERATION_NAME_COLUMN).is_ok()
+}
+
+/// The stream's LLM layout from the cached schema; an uncached stream counts as legacy.
+pub(super) async fn stream_llm_layout(
     org_id: &str,
     stream_name: &str,
     stream_type: StreamType,
-) -> bool {
+) -> StreamLlmLayout {
     infra::schema::get_stream_schema_from_cache(org_id, stream_name, stream_type)
         .await
-        .map(|s| has_gen_ai_fields(&s))
-        .unwrap_or(false)
+        .map(|s| StreamLlmLayout {
+            has_gen_ai: has_gen_ai_fields(&s),
+            has_operation_name: has_operation_name(&s),
+        })
+        .unwrap_or_default()
+}
+
+/// LLM-call spans (the ones ingest prices); a span without an operation name also counts.
+pub(super) fn generation_span_predicate() -> String {
+    let ops = GENERATION_GEN_AI_OPERATIONS
+        .iter()
+        .map(|op| format!("'{op}'"))
+        .collect::<Vec<_>>()
+        .join(", ");
+    format!("({GEN_AI_OPERATION_NAME_COLUMN} IS NULL OR {GEN_AI_OPERATION_NAME_COLUMN} IN ({ops}))")
+}
+
+/// Usage sum over LLM-call spans, so agent/workflow spans repeating their children's usage don't
+/// count.
+pub(super) fn usage_sum_expr(column: &str, has_operation_name: bool) -> String {
+    if has_operation_name {
+        format!(
+            "sum(CASE WHEN {} THEN {column} ELSE 0 END)",
+            generation_span_predicate()
+        )
+    } else {
+        format!("sum({column})")
+    }
 }
 
 /// Validated schema metadata for an LLM trace stream.
@@ -133,6 +168,47 @@ pub(super) struct ValidatedLlmSchema {
     pub(super) has_cost_estimated_without_cache: bool,
     pub(super) has_cost_cache_read_savings: bool,
     pub(super) has_cost_net_cache_impact: bool,
+    /// `gen_ai_usage_cost_status` exists (ingest marks unpriced / approximate spans).
+    pub(super) has_cost_status: bool,
+    /// New schema with `gen_ai_operation_name`, so usage totals sum only LLM-call spans.
+    pub(super) has_operation_name: bool,
+}
+
+impl ValidatedLlmSchema {
+    /// Per-row unpriced token sum and unpriced model list; zero / absent when the stream
+    /// predates the cost marker.
+    pub(super) fn unpriced_selects(&self) -> String {
+        if !self.has_gen_ai || !self.has_cost_status {
+            return "0 as gen_ai_unpriced_tokens".to_string();
+        }
+        let tokens = if self.has_total_tokens {
+            "gen_ai_usage_total_tokens"
+        } else {
+            "COALESCE(gen_ai_usage_input_tokens, 0) + COALESCE(gen_ai_usage_output_tokens, 0)"
+        };
+        format!(
+            "COALESCE(sum(CASE WHEN gen_ai_usage_cost_status = 'unpriced' THEN {tokens} ELSE 0 END), 0) as gen_ai_unpriced_tokens, \
+             array_agg(DISTINCT gen_ai_response_model) FILTER (WHERE gen_ai_usage_cost_status = 'unpriced' \
+             AND gen_ai_response_model IS NOT NULL AND gen_ai_response_model != '') as gen_ai_unpriced_models"
+        )
+    }
+}
+
+/// Reads the per-row unpriced fields [`ValidatedLlmSchema::unpriced_selects`] adds.
+pub(super) fn parse_unpriced(item: &config::utils::json::Value) -> (i64, Vec<String>) {
+    let tokens = item
+        .get("gen_ai_unpriced_tokens")
+        .map_or(0, config::utils::json::get_int_value);
+    let models = item
+        .get("gen_ai_unpriced_models")
+        .and_then(|v| v.as_array())
+        .map(|a| {
+            a.iter()
+                .filter_map(|m| m.as_str().map(str::to_string))
+                .collect()
+        })
+        .unwrap_or_default();
+    (tokens, models)
 }
 
 impl ValidatedLlmSchema {
@@ -158,8 +234,15 @@ impl ValidatedLlmSchema {
             has_cost_estimated_without_cache: false,
             has_cost_cache_read_savings: false,
             has_cost_net_cache_impact: false,
+            has_cost_status: false,
+            has_operation_name: false,
         }
     }
+
+    /// [`usage_sum_expr`] for this stream's layout.
+    pub(super) fn usage_sum(&self, column: &str) -> String {
+        usage_sum_expr(column, self.has_operation_name)
+    }
 }
 
 /// Error returned when a required LLM field is missing from the stream schema.
@@ -239,6 +322,11 @@ pub(super) fn validate_llm_schema(
         has_cost_estimated_without_cache,
         has_cost_cache_read_savings,
         has_cost_net_cache_impact,
+        has_cost_status: has_gen_ai
+            && schema
+                .field_with_name(config::meta::model_pricing::COST_STATUS_COLUMN)
+                .is_ok(),
+        has_operation_name: has_operation_name(schema),
     })
 }
 
@@ -314,6 +402,30 @@ mod tests {
         assert!(!has_gen_ai_fields(&schema));
     }
 
+    #[test]
+    fn operation_name_column_is_detected_only_on_new_schema_streams() {
+        let with_op = schema_with(&[
+            "gen_ai_usage_input_tokens",
+            "gen_ai_usage_output_tokens",
+            "gen_ai_usage_cost",
+            "gen_ai_response_model",
+            "gen_ai_conversation_id",
+            "gen_ai_input_messages",
+            "gen_ai_output_messages",
+            "gen_ai_operation_name",
+        ]);
+        assert!(has_operation_name(&with_op));
+        assert!(
+            validate_llm_schema(&with_op, "s")
+                .unwrap()
+                .has_operation_name
+        );
+        let without_op = schema_with(&["gen_ai_usage_input_tokens", "gen_ai_conversation_id"]);
+        assert!(!has_operation_name(&without_op));
+        let legacy_with_op = schema_with(&["llm_usage_tokens_input", "gen_ai_operation_name"]);
+        assert!(!has_operation_name(&legacy_with_op));
+    }
+
     #[test]
     fn valid_gen_ai_schema_passes_validation() {
         let schema = schema_with(&[
@@ -433,4 +545,36 @@ mod tests {
         assert!(!fallback.has_gen_ai);
         assert_eq!(fallback.columns, LlmColumns::legacy());
     }
+
+    #[test]
+    fn unpriced_selects_follow_the_cost_status_column() {
+        let base = [
+            "gen_ai_usage_input_tokens",
+            "gen_ai_usage_output_tokens",
+            "gen_ai_usage_cost",
+            "gen_ai_response_model",
+            "gen_ai_conversation_id",
+        ];
+        // A stream written before the marker: constant zero, no reference to the column.
+        let old = validate_llm_schema(&schema_with(&base), "s").unwrap();
+        assert!(!old.has_cost_status);
+        assert_eq!(old.unpriced_selects(), "0 as gen_ai_unpriced_tokens");
+
+        let mut fields = base.to_vec();
+        fields.push("gen_ai_usage_cost_status");
+        let new = validate_llm_schema(&schema_with(&fields), "s").unwrap();
+        assert!(new.has_cost_status);
+        let sql = new.unpriced_selects();
+        assert!(sql.contains("gen_ai_usage_cost_status = 'unpriced'"));
+        assert!(sql.contains("as gen_ai_unpriced_models"));
+
+        let (tokens, models) = parse_unpriced(&config::utils::json::json!({
+            "gen_ai_unpriced_tokens": 7, "gen_ai_unpriced_models": ["a", null]
+        }));
+        assert_eq!((tokens, models), (7, vec!["a".to_string()]));
+        assert_eq!(
+            parse_unpriced(&config::utils::json::json!({})),
+            (0, Vec::new())
+        );
+    }
 }
diff --git a/src/api/search/src/traces/session.rs b/src/api/search/src/traces/session.rs
index 0ea3399874..911db6557c 100644
--- a/src/api/search/src/traces/session.rs
+++ b/src/api/search/src/traces/session.rs
@@ -987,54 +987,55 @@ fn build_session_trace_details_sql(
         } else {
             "''".to_string()
         };
-        let total_tokens_expr = if validated.has_total_tokens {
-            "sum(gen_ai_usage_total_tokens) as gen_ai_usage_details_total"
-        } else {
-            "0 as gen_ai_usage_details_total"
-        };
-        let cache_read_tokens_expr = optional_sum_expr(
+        let usage = |column: &str| validated.usage_sum(column);
+        let optional_usage =
+            |has_field: bool, column: &str| optional_usage_expr(has_field, &usage(column), column);
+        let input_tokens_expr = usage("gen_ai_usage_input_tokens");
+        let output_tokens_expr = usage("gen_ai_usage_output_tokens");
+        let cost_expr = usage("gen_ai_usage_cost");
+        let total_tokens_expr = optional_usage_expr(
+            validated.has_total_tokens,
+            &usage("gen_ai_usage_total_tokens"),
+            "gen_ai_usage_details_total",
+        );
+        let cache_read_tokens_expr = optional_usage(
             validated.has_cache_read_input_tokens,
             "gen_ai_usage_cache_read_input_tokens",
-            "gen_ai_usage_cache_read_input_tokens",
         );
-        let cache_creation_tokens_expr = optional_sum_expr(
+        let cache_creation_tokens_expr = optional_usage(
             validated.has_cache_creation_input_tokens,
             "gen_ai_usage_cache_creation_input_tokens",
-            "gen_ai_usage_cache_creation_input_tokens",
         );
-        let cost_cache_read_expr = optional_sum_expr(
+        let cost_cache_read_expr = optional_usage(
             validated.has_cost_cache_read_input,
             "gen_ai_usage_cost_cache_read_input",
-            "gen_ai_usage_cost_cache_read_input",
         );
-        let cost_cache_creation_expr = optional_sum_expr(
+        let cost_cache_creation_expr = optional_usage(
             validated.has_cost_cache_creation_input,
             "gen_ai_usage_cost_cache_creation_input",
-            "gen_ai_usage_cost_cache_creation_input",
         );
-        let cost_estimated_without_cache_expr = optional_sum_expr(
+        let cost_estimated_without_cache_expr = optional_usage(
             validated.has_cost_estimated_without_cache,
             "gen_ai_usage_cost_estimated_without_cache",
-            "gen_ai_usage_cost_estimated_without_cache",
         );
-        let cost_cache_read_savings_expr = optional_sum_expr(
+        let cost_cache_read_savings_expr = optional_usage(
             validated.has_cost_cache_read_savings,
             "gen_ai_usage_cost_cache_read_savings",
-            "gen_ai_usage_cost_cache_read_savings",
         );
-        let cost_net_cache_impact_expr = optional_sum_expr(
+        let cost_net_cache_impact_expr = optional_usage(
             validated.has_cost_net_cache_impact,
             "gen_ai_usage_cost_net_cache_impact",
-            "gen_ai_usage_cost_net_cache_impact",
         );
+        let unpriced_selects = validated.unpriced_selects();
         format!(
             "SELECT trace_id, min({TIMESTAMP_COL_NAME}) as zo_sql_timestamp, \
             min(start_time) as trace_start_time, max(end_time) as trace_end_time, \
             (max(end_time) - min(start_time)) as zo_sql_duration, \
-            sum(gen_ai_usage_input_tokens) as gen_ai_usage_details_input, \
-            sum(gen_ai_usage_output_tokens) as gen_ai_usage_details_output, \
+            {input_tokens_expr} as gen_ai_usage_details_input, \
+            {output_tokens_expr} as gen_ai_usage_details_output, \
             {total_tokens_expr}, \
-            sum(gen_ai_usage_cost) as gen_ai_usage_cost_details, \
+            {cost_expr} as gen_ai_usage_cost_details, \
+            {unpriced_selects}, \
             {cache_read_tokens_expr}, \
             {cache_creation_tokens_expr}, \
             {cost_cache_read_expr}, \
@@ -1149,7 +1150,8 @@ fn build_session_trace_response_item(
     } else {
         max_duration
     };
-
+    let (gen_ai_unpriced_tokens, gen_ai_unpriced_models) =
+        super::schema_compat::parse_unpriced(item);
     let hit = SessionTraceResponseItem {
         trace_id: tid.clone(),
         user_ids,
@@ -1215,14 +1217,17 @@ fn build_session_trace_response_item(
                     .collect()
             })
             .unwrap_or_default(),
+        gen_ai_unpriced_tokens,
+        gen_ai_unpriced_models,
     };
 
     Some((tid, service_count, hit))
 }
 
-fn optional_sum_expr(has_field: bool, column: &str, alias: &str) -> String {
+/// `<sum_expr> as <alias>` when the column exists, else `0 as <alias>`.
+fn optional_usage_expr(has_field: bool, sum_expr: &str, alias: &str) -> String {
     if has_field {
-        format!("sum({column}) as {alias}")
+        format!("{sum_expr} as {alias}")
     } else {
         format!("0 as {alias}")
     }
@@ -1482,6 +1487,7 @@ fn build_latest_session_page_sql(
         )
     };
     let direction = sort.order.sql();
+    // Usage sorts use the same sum as the totals `build_latest_sessions_sql` reports.
     let (sort_projection, order_by) = match sort.field {
         LatestSessionSortField::EndTime => (
             String::new(),
@@ -1528,7 +1534,7 @@ fn latest_session_sort_expression(
             } else {
                 "llm_usage_tokens_total"
             };
-            format!("COALESCE(sum({column}), 0)")
+            format!("COALESCE({}, 0)", validated.usage_sum(column))
         }
         LatestSessionSortField::TotalTokens => "0".to_string(),
         LatestSessionSortField::Cost => {
@@ -1537,7 +1543,7 @@ fn latest_session_sort_expression(
             } else {
                 "llm_usage_cost_total"
             };
-            format!("COALESCE(sum({column}), 0)")
+            format!("COALESCE({}, 0)", validated.usage_sum(column))
         }
         LatestSessionSortField::Status => {
             "max(CASE WHEN span_status = 'ERROR' THEN 1 ELSE 0 END)".to_string()
@@ -1576,9 +1582,15 @@ fn build_latest_sessions_sql(
         )
     };
 
-    let total_tokens_expr = optional_sum_expr(
+    let usage = |column: &str| validated.usage_sum(column);
+    let optional_usage =
+        |has_field: bool, column: &str| optional_usage_expr(has_field, &usage(column), column);
+    let input_tokens_expr = usage(input_tokens_col);
+    let output_tokens_expr = usage(output_tokens_col);
+    let cost_expr = usage(cost_col);
+    let total_tokens_expr = optional_usage_expr(
         validated.has_total_tokens,
-        total_tokens_col,
+        &usage(total_tokens_col),
         "gen_ai_usage_total_tokens",
     );
     let first_message_expr = if validated.has_input_messages {
@@ -1591,41 +1603,35 @@ fn build_latest_sessions_sql(
         "'' as gen_ai_input_messages".to_string()
     };
 
-    let cache_read_tokens_expr = optional_sum_expr(
+    let cache_read_tokens_expr = optional_usage(
         validated.has_cache_read_input_tokens,
         "gen_ai_usage_cache_read_input_tokens",
-        "gen_ai_usage_cache_read_input_tokens",
     );
-    let cache_creation_tokens_expr = optional_sum_expr(
+    let cache_creation_tokens_expr = optional_usage(
         validated.has_cache_creation_input_tokens,
         "gen_ai_usage_cache_creation_input_tokens",
-        "gen_ai_usage_cache_creation_input_tokens",
     );
-    let cost_cache_read_expr = optional_sum_expr(
+    let cost_cache_read_expr = optional_usage(
         validated.has_cost_cache_read_input,
         "gen_ai_usage_cost_cache_read_input",
-        "gen_ai_usage_cost_cache_read_input",
     );
-    let cost_cache_creation_expr = optional_sum_expr(
+    let cost_cache_creation_expr = optional_usage(
         validated.has_cost_cache_creation_input,
         "gen_ai_usage_cost_cache_creation_input",
-        "gen_ai_usage_cost_cache_creation_input",
     );
-    let cost_estimated_without_cache_expr = optional_sum_expr(
+    let cost_estimated_without_cache_expr = optional_usage(
         validated.has_cost_estimated_without_cache,
         "gen_ai_usage_cost_estimated_without_cache",
-        "gen_ai_usage_cost_estimated_without_cache",
     );
-    let cost_cache_read_savings_expr = optional_sum_expr(
+    let cost_cache_read_savings_expr = optional_usage(
         validated.has_cost_cache_read_savings,
         "gen_ai_usage_cost_cache_read_savings",
-        "gen_ai_usage_cost_cache_read_savings",
     );
-    let cost_net_cache_impact_expr = optional_sum_expr(
+    let cost_net_cache_impact_expr = optional_usage(
         validated.has_cost_net_cache_impact,
         "gen_ai_usage_cost_net_cache_impact",
-        "gen_ai_usage_cost_net_cache_impact",
     );
+    let unpriced_selects = validated.unpriced_selects();
     let stream_ident = traces::session::quote_identifier(stream_name);
 
     format!(
@@ -1635,10 +1641,11 @@ fn build_latest_sessions_sql(
          CASE WHEN max(end_time) > min(start_time) \
               THEN max(end_time) - min(start_time) ELSE 0 END as duration, \
          count(DISTINCT trace_id) as trace_count, \
-         sum({input_tokens_col}) as gen_ai_usage_input_tokens, \
-         sum({output_tokens_col}) as gen_ai_usage_output_tokens, \
+         {input_tokens_expr} as gen_ai_usage_input_tokens, \
+         {output_tokens_expr} as gen_ai_usage_output_tokens, \
          {total_tokens_expr}, \
-         sum({cost_col}) as gen_ai_usage_cost, \
+        {cost_expr} as gen_ai_usage_cost, \
+        {unpriced_selects}, \
          {cache_read_tokens_expr}, \
          {cache_creation_tokens_expr}, \
          {cost_cache_read_expr}, \
@@ -1722,6 +1729,9 @@ struct SessionTraceResponseItem {
     gen_ai_usage_cost_net_cache_impact: f64,
     gen_ai_input_messages: Option<json::Value>,
     models: Vec<String>,
+    /// Tokens of this trace's spans that no price matched; their cost is missing.
+    gen_ai_unpriced_tokens: i64,
+    gen_ai_unpriced_models: Vec<String>,
 }
 
 #[derive(Debug, Default, Serialize)]
@@ -2160,6 +2170,103 @@ mod tests {
         );
     }
 
+    const LLM_CALL: &str = "(gen_ai_operation_name IS NULL OR gen_ai_operation_name IN \
+                            ('chat', 'text_completion', 'generate_content', 'embeddings'))";
+
+    fn with_operation_name() -> super::super::schema_compat::ValidatedLlmSchema {
+        let mut validated = super::super::schema_compat::ValidatedLlmSchema::fallback(true);
+        validated.has_total_tokens = true;
+        validated.has_cache_read_input_tokens = true;
+        validated.has_operation_name = true;
+        validated
+    }
+
+    #[test]
+    fn session_usage_sums_count_only_llm_call_spans() {
+        let validated = with_operation_name();
+        let llm_sum = |column: &str| format!("sum(CASE WHEN {LLM_CALL} THEN {column} ELSE 0 END)");
+        let details = build_session_trace_details_sql(
+            "default",
+            &validated,
+            false,
+            "service_name",
+            "trace_id IN ('t1')",
+        );
+        for (column, alias) in [
+            ("gen_ai_usage_input_tokens", "gen_ai_usage_details_input"),
+            ("gen_ai_usage_output_tokens", "gen_ai_usage_details_output"),
+            ("gen_ai_usage_total_tokens", "gen_ai_usage_details_total"),
+            ("gen_ai_usage_cost", "gen_ai_usage_cost_details"),
+            (
+                "gen_ai_usage_cache_read_input_tokens",
+                "gen_ai_usage_cache_read_input_tokens",
+            ),
+        ] {
+            let expected = format!("{} as {alias}", llm_sum(column));
+            assert!(details.contains(&expected), "{alias}: {details}");
+        }
+        assert!(details.contains("0 as gen_ai_usage_cache_creation_input_tokens"));
+
+        let sessions =
+            build_latest_sessions_sql("bench_traces", &["session-1".to_string()], &validated);
+        for column in [
+            "gen_ai_usage_input_tokens",
+            "gen_ai_usage_output_tokens",
+            "gen_ai_usage_total_tokens",
+            "gen_ai_usage_cost",
+        ] {
+            let expected = format!("{} as {column}", llm_sum(column));
+            assert!(sessions.contains(&expected), "{column}: {sessions}");
+        }
+
+        for (field, column) in [
+            (
+                LatestSessionSortField::TotalTokens,
+                "gen_ai_usage_total_tokens",
+            ),
+            (LatestSessionSortField::Cost, "gen_ai_usage_cost"),
+        ] {
+            let page = build_latest_session_page_sql(
+                "bench_traces",
+                "",
+                &LatestSessionSearch::default(),
+                &sort(field, LatestSessionSortOrder::Desc),
+                &validated,
+            );
+            let expected = format!("COALESCE({}, 0) as session_sort_value", llm_sum(column));
+            assert!(page.contains(&expected), "{page}");
+        }
+    }
+
+    #[test]
+    fn session_sql_without_operation_name_keeps_plain_sums() {
+        let mut validated = with_operation_name();
+        validated.has_operation_name = false;
+        let sessions =
+            build_latest_sessions_sql("bench_traces", &["session-1".to_string()], &validated);
+        let details = build_session_trace_details_sql(
+            "bench_traces",
+            &validated,
+            false,
+            "service_name",
+            "trace_id IN ('t1')",
+        );
+        let page = build_latest_session_page_sql(
+            "bench_traces",
+            "",
+            &LatestSessionSearch::default(),
+            &sort(LatestSessionSortField::Cost, LatestSessionSortOrder::Desc),
+            &validated,
+        );
+        for sql in [&sessions, &details, &page] {
+            assert!(!sql.contains("gen_ai_operation_name"), "{sql}");
+        }
+        assert!(sessions.contains("sum(gen_ai_usage_input_tokens) as gen_ai_usage_input_tokens"));
+        assert!(sessions.contains("FROM \"bench_traces\" WHERE gen_ai_conversation_id IN"));
+        assert!(details.contains("sum(gen_ai_usage_cost) as gen_ai_usage_cost_details"));
+        assert!(page.contains("COALESCE(sum(gen_ai_usage_cost), 0) as session_sort_value"));
+    }
+
     // ── List search (`keyword`) ─────────────────────────────────────────────
 
     fn search(keyword: Option<&str>) -> LatestSessionSearch {
diff --git a/src/api/search/src/traces/user.rs b/src/api/search/src/traces/user.rs
index 65cd303a8d..ac00e611f2 100644
--- a/src/api/search/src/traces/user.rs
+++ b/src/api/search/src/traces/user.rs
@@ -176,13 +176,10 @@ pub async fn get_latest_users(
     // Detect schema generation up front so both Phase 1 (user-id column) and
     // Phase 2 (token/cost columns) pick consistent names.
     let stream_type = StreamType::Traces;
-    let has_gen_ai_fields = super::schema_compat::stream_has_gen_ai_fields(
-        org_id.as_str(),
-        stream_name.as_str(),
-        stream_type,
-    )
-    .await;
-    let llm_cols = if has_gen_ai_fields {
+    let layout =
+        super::schema_compat::stream_llm_layout(org_id.as_str(), stream_name.as_str(), stream_type)
+            .await;
+    let llm_cols = if layout.has_gen_ai {
         super::schema_compat::LlmColumns::current()
     } else {
         super::schema_compat::LlmColumns::legacy()
@@ -285,7 +282,7 @@ pub async fn get_latest_users(
         .filter(|tid| !tid.is_empty())
         .collect();
     let trace_ids_sql = sanitized_ids.join("','");
-    req.query.sql = build_user_trace_usage_sql(&stream_name, &trace_ids_sql, has_gen_ai_fields);
+    req.query.sql = build_user_trace_usage_sql(&stream_name, &trace_ids_sql, layout);
     req.query.from = 0;
     req.query.size = all_trace_ids.len() as i64;
 
@@ -508,16 +505,20 @@ fn build_latest_users_page_sql(stream_name: &str, user_id_col: &str, filter: &st
 fn build_user_trace_usage_sql(
     stream_name: &str,
     trace_ids_sql: &str,
-    has_gen_ai_fields: bool,
+    layout: super::schema_compat::StreamLlmLayout,
 ) -> String {
     let stream_ident = quote_identifier(stream_name);
-    if has_gen_ai_fields {
+    if layout.has_gen_ai {
+        let usage =
+            |column: &str| super::schema_compat::usage_sum_expr(column, layout.has_operation_name);
+        let total_tokens_expr = usage("gen_ai_usage_total_tokens");
+        let cost_expr = usage("gen_ai_usage_cost");
         format!(
             "SELECT trace_id, \
             min(start_time) as trace_start_time, \
             max(end_time) as trace_end_time, \
-            sum(gen_ai_usage_total_tokens) as gen_ai_usage_details_total, \
-            sum(gen_ai_usage_cost) as gen_ai_usage_cost_details \
+            {total_tokens_expr} as gen_ai_usage_details_total, \
+            {cost_expr} as gen_ai_usage_cost_details \
             FROM {stream_ident} \
             WHERE trace_id IN ('{trace_ids_sql}') \
             GROUP BY trace_id"
@@ -785,15 +786,46 @@ mod tests {
 
     #[test]
     fn user_trace_usage_sql_quotes_the_stream_for_both_schemas() {
-        let current = build_user_trace_usage_sql("a\"b", "abc-1", true);
-        let legacy = build_user_trace_usage_sql("a\"b", "abc-1", false);
+        use super::super::schema_compat::StreamLlmLayout;
+        let current = build_user_trace_usage_sql(
+            "a\"b",
+            "abc-1",
+            StreamLlmLayout {
+                has_gen_ai: true,
+                has_operation_name: false,
+            },
+        );
+        let legacy = build_user_trace_usage_sql("a\"b", "abc-1", StreamLlmLayout::default());
         for sql in [&current, &legacy] {
             assert!(sql.contains("FROM \"a\"\"b\""));
             assert!(sql.contains("WHERE trace_id IN ('abc-1')"));
             assert!(!sql.contains("FROM \"a\"b\""));
         }
         assert!(current.contains("sum(gen_ai_usage_total_tokens) as gen_ai_usage_details_total"));
+        assert!(current.contains("sum(gen_ai_usage_cost) as gen_ai_usage_cost_details"));
+        assert!(!current.contains("gen_ai_operation_name"));
         assert!(legacy.contains("sum(llm_usage_tokens_total) as gen_ai_usage_details_total"));
         assert!(legacy.contains("sum(llm_usage_cost_total) as gen_ai_usage_cost_details"));
     }
+
+    #[test]
+    fn user_trace_usage_sql_sums_only_llm_call_spans() {
+        let sql = build_user_trace_usage_sql(
+            "default",
+            "abc-1",
+            super::super::schema_compat::StreamLlmLayout {
+                has_gen_ai: true,
+                has_operation_name: true,
+            },
+        );
+        let llm_call = "(gen_ai_operation_name IS NULL OR gen_ai_operation_name IN \
+                        ('chat', 'text_completion', 'generate_content', 'embeddings'))";
+        assert!(sql.contains(&format!(
+            "sum(CASE WHEN {llm_call} THEN gen_ai_usage_total_tokens ELSE 0 END) \
+             as gen_ai_usage_details_total"
+        )));
+        assert!(sql.contains(&format!(
+            "sum(CASE WHEN {llm_call} THEN gen_ai_usage_cost ELSE 0 END) as gen_ai_usage_cost_details"
+        )));
+    }
 }
diff --git a/src/audit/src/lib.rs b/src/audit/src/lib.rs
index 93efaf86d6..5f01cc383e 100644
--- a/src/audit/src/lib.rs
+++ b/src/audit/src/lib.rs
@@ -104,6 +104,8 @@ pub async fn report_with_protocol(
                 trace_id: Some(trace_id),
             },
             delegated: None,
+            fleet_id: None,
+            target: None,
         })
         .await;
     }
diff --git a/src/builtins/src/model_pricing.rs b/src/builtins/src/model_pricing.rs
index e6e44991fd..da0725e885 100644
--- a/src/builtins/src/model_pricing.rs
+++ b/src/builtins/src/model_pricing.rs
@@ -17,6 +17,8 @@
 //!
 //! Syncs model pricing definitions from the configured GitHub source into the database
 //! under the `_openobserve` org. Runs on startup and periodically (every 6h by default).
+//! Until a sync succeeds, or forever on an offline install, the seed list compiled into the
+//! binary ([`SEED_PRICING_JSON`]) supplies the built-in prices.
 
 use std::sync::{
     LazyLock,
@@ -37,12 +39,49 @@ pub static GITHUB_SERVICE: LazyLock<GitHubDataService> = LazyLock::new(GitHubDat
 /// Timestamp (Unix seconds) of the last successful sync from GitHub. 0 means never synced.
 static LAST_SYNC_TIMESTAMP: AtomicI64 = AtomicI64::new(0);
 
+/// The built-in price list as of [`SEED_DATE`], shipped in the binary so prices work offline.
+/// Same format as the GitHub source (`llm_pricing.json` in openobserve/sdr_patterns).
+pub const SEED_PRICING_JSON: &str = include_str!("model_pricing_seed.json");
+
+/// Date (UTC) of the upstream `llm_pricing.json` commit that [`SEED_PRICING_JSON`] copies.
+pub const SEED_DATE: &str = "2026-10-28";
+
 /// Returns the Unix timestamp (seconds) of the last successful built-in pricing sync.
 /// Returns 0 if no sync has completed yet.
 pub fn last_sync_timestamp() -> i64 {
     LAST_SYNC_TIMESTAMP.load(Ordering::Relaxed)
 }
 
+/// Parses the compiled-in seed list.
+pub fn seed_entries() -> Result<Vec<BuiltInModelPricingEntry>, anyhow::Error> {
+    let raw: Vec<serde_json::Value> = serde_json::from_str(SEED_PRICING_JSON)
+        .map_err(|e| anyhow::anyhow!("Failed to parse seed pricing JSON: {e}"))?;
+    Ok(parse_entries(raw))
+}
+
+/// Fill missing compiled-in prices, retrying incomplete seeds without overwriting synced rows.
+pub async fn load_seed() -> Result<usize, anyhow::Error> {
+    let names = table::model_pricing::list_built_in_names().await?;
+    let existing: std::collections::HashSet<&str> = names.iter().map(String::as_str).collect();
+    let mut missing = Vec::new();
+    for entry in seed_entries()? {
+        if existing.contains(entry.name.as_str()) {
+            continue;
+        }
+        let definition = entry.into_definition();
+        definition.validate_tiers(true).map_err(|error| {
+            anyhow::anyhow!("Invalid seed price '{}': {error}", definition.name)
+        })?;
+        missing.push(definition);
+    }
+    let created = usize::try_from(table::model_pricing::insert_missing_built_ins(missing).await?)?;
+    if created > 0 {
+        emit_sync_event().await;
+    }
+    log::info!("[model_pricing_sync] loaded {created} seed prices dated {SEED_DATE}");
+    Ok(created)
+}
+
 /// A model pricing entry from the community/built-in GitHub JSON source.
 #[derive(Debug, Deserialize)]
 pub struct BuiltInModelPricingEntry {
@@ -95,51 +134,7 @@ pub async fn sync_built_in_from_github(force_refresh: bool) -> Result<SyncResult
             .into_iter()
             .collect();
 
-    let mut created = 0usize;
-    let mut updated = 0usize;
-
-    // Upsert each entry
-    for entry in entries {
-        let is_new = !existing_names.contains(&entry.name);
-        let definition = ModelPricingDefinition {
-            id: None, // will be looked up by (org, name) on upsert
-            org_id: BUILT_IN_ORG.to_string(),
-            name: entry.name,
-            match_pattern: entry.match_pattern,
-            enabled: true,
-            tiers: entry.tiers,
-            valid_from: None,
-            sort_order: 0,
-            source: PricingSource::BuiltIn,
-            provider: entry.provider,
-            description: entry.description,
-            created_at: 0, // set by DB layer
-            updated_at: 0,
-            children: Vec::new(),
-            prepared_rule_keys: Default::default(),
-        };
-        // An invalid entry could overprice every span; keep the previously stored row.
-        if let Err(e) = definition.validate_tiers(true) {
-            log::warn!(
-                "[model_pricing_sync] skipping invalid entry '{}': {e}",
-                definition.name
-            );
-            continue;
-        }
-
-        match table::model_pricing::put(definition).await {
-            Ok(_) => {
-                if is_new {
-                    created += 1;
-                } else {
-                    updated += 1;
-                }
-            }
-            Err(e) => {
-                log::warn!("[model_pricing_sync] failed to upsert built-in model: {e}");
-            }
-        }
-    }
+    let (created, updated) = upsert_entries(entries, &existing_names).await;
 
     // Disable models that were removed from the upstream source
     let mut disabled = 0usize;
@@ -162,11 +157,7 @@ pub async fn sync_built_in_from_github(force_refresh: bool) -> Result<SyncResult
         }
     }
 
-    // Emit coordinator event so all nodes refresh the _openobserve cache
-    let event_key = format!("/model_pricing/{BUILT_IN_ORG}/_sync");
-    if let Err(e) = infra::coordinator::emit_put(&event_key).await {
-        log::error!("[model_pricing_sync] failed to emit sync event: {e}");
-    }
+    emit_sync_event().await;
 
     LAST_SYNC_TIMESTAMP.store(chrono::Utc::now().timestamp(), Ordering::Relaxed);
 
@@ -181,6 +172,72 @@ pub async fn sync_built_in_from_github(force_refresh: bool) -> Result<SyncResult
     })
 }
 
+/// Upserts catalogue entries as built-in definitions; returns (created, updated).
+/// An entry whose name is in `existing_names` counts as updated.
+async fn upsert_entries(
+    entries: Vec<BuiltInModelPricingEntry>,
+    existing_names: &std::collections::HashSet<String>,
+) -> (usize, usize) {
+    let mut created = 0usize;
+    let mut updated = 0usize;
+    for entry in entries {
+        let is_new = !existing_names.contains(&entry.name);
+        let definition = entry.into_definition();
+        // An invalid entry could overprice every span; keep the previously stored row.
+        if let Err(e) = definition.validate_tiers(true) {
+            log::warn!(
+                "[model_pricing_sync] skipping invalid entry '{}': {e}",
+                definition.name
+            );
+            continue;
+        }
+
+        match table::model_pricing::put(definition).await {
+            Ok(_) => {
+                if is_new {
+                    created += 1;
+                } else {
+                    updated += 1;
+                }
+            }
+            Err(e) => {
+                log::warn!("[model_pricing_sync] failed to upsert built-in model: {e}");
+            }
+        }
+    }
+    (created, updated)
+}
+
+/// Tells every node to refresh its `_openobserve` pricing cache.
+async fn emit_sync_event() {
+    let event_key = format!("/model_pricing/{BUILT_IN_ORG}/_sync");
+    if let Err(e) = infra::coordinator::emit_put(&event_key).await {
+        log::error!("[model_pricing_sync] failed to emit sync event: {e}");
+    }
+}
+
+impl BuiltInModelPricingEntry {
+    fn into_definition(self) -> ModelPricingDefinition {
+        ModelPricingDefinition {
+            id: None, // will be looked up by (org, name) on upsert
+            org_id: BUILT_IN_ORG.to_string(),
+            name: self.name,
+            match_pattern: self.match_pattern,
+            enabled: true,
+            tiers: self.tiers,
+            valid_from: None,
+            sort_order: 0,
+            source: PricingSource::BuiltIn,
+            provider: self.provider,
+            description: self.description,
+            created_at: 0, // set by DB layer
+            updated_at: 0,
+            children: Vec::new(),
+            prepared_rule_keys: Default::default(),
+        }
+    }
+}
+
 /// Parses each catalogue entry on its own so one malformed entry does not stop the whole sync.
 fn parse_entries(raw: Vec<serde_json::Value>) -> Vec<BuiltInModelPricingEntry> {
     raw.into_iter()
@@ -201,6 +258,27 @@ fn parse_entries(raw: Vec<serde_json::Value>) -> Vec<BuiltInModelPricingEntry> {
 mod tests {
     use super::*;
 
+    /// The seed list is all an offline install has, so every entry must parse and validate
+    /// without any network access.
+    #[test]
+    fn test_seed_list_loads_offline() {
+        let raw: Vec<serde_json::Value> = serde_json::from_str(SEED_PRICING_JSON).unwrap();
+        let entries = seed_entries().unwrap();
+        assert!(
+            entries.len() > 50,
+            "seed list has {} entries",
+            entries.len()
+        );
+        assert_eq!(entries.len(), raw.len(), "an entry failed to parse");
+        for entry in entries {
+            let definition = entry.into_definition();
+            definition
+                .validate_tiers(true)
+                .unwrap_or_else(|e| panic!("{}: {e}", definition.name));
+        }
+        assert!(chrono::NaiveDate::parse_from_str(SEED_DATE, "%Y-%m-%d").is_ok());
+    }
+
     #[test]
     fn test_last_sync_timestamp_initial_value() {
         // Initial value is 0 (never synced), unless tests run after sync
diff --git a/src/builtins/src/model_pricing_seed.json b/src/builtins/src/model_pricing_seed.json
new file mode 100644
index 0000000000..1967ffe62d
--- /dev/null
+++ b/src/builtins/src/model_pricing_seed.json
@@ -0,0 +1,5622 @@
+[
+  {
+    "name": "GPT-6.1 Sol",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-6.1 Sol - extended context pricing at 272k+ input tokens",
+    "match_pattern": "(?i)gpt-6\\.1-sol",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 4e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Ultrafast \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "ultrafast"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.4e-05,
+          "output": 9e-05,
+          "cache_read_input_tokens": 1.2e-06,
+          "cache_creation_input_tokens": 3e-05
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 8e-06,
+          "output": 3e-05,
+          "cache_read_input_tokens": 4e-07,
+          "cache_creation_input_tokens": 1e-05
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-06,
+          "output": 7.5e-06,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Ultrafast",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "ultrafast"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.2e-05,
+          "output": 6e-05,
+          "cache_read_input_tokens": 6e-07,
+          "cache_creation_input_tokens": 1.5e-05
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4e-06,
+          "output": 2e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-06,
+          "output": 5e-06,
+          "cache_read_input_tokens": 5e-08,
+          "cache_creation_input_tokens": 1.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-6.1 Terra",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-6.1 Terra - extended context pricing at 272k+ input tokens (place next to GPT-6.1 Sol; no overlap)",
+    "match_pattern": "(?i)gpt-6\\.1-terra",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-06,
+          "output": 5e-06,
+          "cache_read_input_tokens": 5e-08,
+          "cache_creation_input_tokens": 1.25e-06
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 2e-06,
+          "output": 7.5e-06,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-06,
+          "output": 3.75e-06,
+          "cache_read_input_tokens": 5e-08,
+          "cache_creation_input_tokens": 1.25e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 5e-07,
+          "output": 2.5e-06,
+          "cache_read_input_tokens": 2.5e-08,
+          "cache_creation_input_tokens": 6.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-6 Astra",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-6 Astra - extended context pricing at 272k+ input tokens",
+    "match_pattern": "(?i)gpt-6-astra",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-05,
+          "output": 5e-05,
+          "cache_read_input_tokens": 1e-06,
+          "cache_creation_input_tokens": 1.25e-05
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 2e-05,
+          "output": 7.5e-05,
+          "cache_read_input_tokens": 2e-06,
+          "cache_creation_input_tokens": 2.5e-05
+        }
+      },
+      {
+        "name": "Ultrafast \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "ultrafast"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 0.00012,
+          "output": 0.00045,
+          "cache_read_input_tokens": 1.2e-05,
+          "cache_creation_input_tokens": 0.00015
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4e-05,
+          "output": 0.00015,
+          "cache_read_input_tokens": 4e-06,
+          "cache_creation_input_tokens": 5e-05
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-05,
+          "output": 3.75e-05,
+          "cache_read_input_tokens": 1e-06,
+          "cache_creation_input_tokens": 1.25e-05
+        }
+      },
+      {
+        "name": "Ultrafast",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "ultrafast"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 6e-05,
+          "output": 0.0003,
+          "cache_read_input_tokens": 6e-06,
+          "cache_creation_input_tokens": 7.5e-05
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-05,
+          "output": 0.0001,
+          "cache_read_input_tokens": 2e-06,
+          "cache_creation_input_tokens": 2.5e-05
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 5e-06,
+          "output": 2.5e-05,
+          "cache_read_input_tokens": 5e-07,
+          "cache_creation_input_tokens": 6.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-6 Sol",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-6 Sol - extended context pricing at 272k+ input tokens",
+    "match_pattern": "(?i)gpt-6-sol",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 4e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 4e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 8e-06,
+          "output": 3e-05,
+          "cache_read_input_tokens": 8e-07,
+          "cache_creation_input_tokens": 1e-05
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-06,
+          "output": 7.5e-06,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4e-06,
+          "output": 2e-05,
+          "cache_read_input_tokens": 4e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-06,
+          "output": 5e-06,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 1.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-6 Luna",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-6 Luna - extended context pricing at 272k+ input tokens",
+    "match_pattern": "(?i)gpt-6-luna",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 5e-07,
+          "cache_read_input_tokens": 1e-08,
+          "cache_creation_input_tokens": 1.25e-07
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 2e-07,
+          "output": 7.5e-07,
+          "cache_read_input_tokens": 2e-08,
+          "cache_creation_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4e-07,
+          "output": 1.5e-06,
+          "cache_read_input_tokens": 4e-08,
+          "cache_creation_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-07,
+          "output": 3.75e-07,
+          "cache_read_input_tokens": 1e-08,
+          "cache_creation_input_tokens": 1.25e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-07,
+          "output": 1e-06,
+          "cache_read_input_tokens": 2e-08,
+          "cache_creation_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 5e-08,
+          "output": 2.5e-07,
+          "cache_read_input_tokens": 5e-09,
+          "cache_creation_input_tokens": 6.25e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.6 Cyber",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.6 Cyber (trusted-access); also covers the deprecated gpt-daybreak-red-latest alias, which the docs say points to gpt-5.6-cyber. Long-context tier from the model page rule (2x input, 1.5x output for >272K); cache rates doubled by the same rule OpenAI applies to GPT-5.6 Sol - the pricing page leaves cyber long-context columns blank. Place next to the GPT-5.6 entries; no overlap.",
+    "match_pattern": "(?i)(?:gpt-5\\.6-cyber|gpt-daybreak-red)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.25e-05,
+          "output": 7.5e-05,
+          "cache_read_input_tokens": 1.25e-06,
+          "cache_creation_input_tokens": 1.5625e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.6 Sol",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.6 Sol (also the plain gpt-5.6 alias and the deprecated gpt-daybreak-blue-latest alias) - extended context pricing at 272k+ input tokens; promotional pricing through at least 2026-11-21",
+    "match_pattern": "(?i)(?:gpt-5\\.6(?:-sol)?(?:$|-\\d)|gpt-daybreak-blue)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-06,
+          "output": 2e-05,
+          "cache_read_input_tokens": 4e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 8e-06,
+          "output": 3e-05,
+          "cache_read_input_tokens": 8e-07,
+          "cache_creation_input_tokens": 1e-05
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.6e-05,
+          "output": 6e-05,
+          "cache_read_input_tokens": 1.6e-06,
+          "cache_creation_input_tokens": 2e-05
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 4e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 8e-06,
+          "output": 4e-05,
+          "cache_read_input_tokens": 8e-07,
+          "cache_creation_input_tokens": 1e-05
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.6 Terra",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.6 Terra - extended context pricing at 272k+ input tokens",
+    "match_pattern": "(?i)gpt-5\\.6-terra",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1.2e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 4e-06,
+          "output": 1.8e-05,
+          "cache_read_input_tokens": 4e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 8e-06,
+          "output": 3.6e-05,
+          "cache_read_input_tokens": 8e-07,
+          "cache_creation_input_tokens": 1e-05
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-06,
+          "output": 9e-06,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4e-06,
+          "output": 2.4e-05,
+          "cache_read_input_tokens": 4e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-06,
+          "output": 6e-06,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 1.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.6 Luna",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.6 Luna - extended context pricing at 272k+ input tokens",
+    "match_pattern": "(?i)gpt-5\\.6-luna",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-07,
+          "output": 1.2e-06,
+          "cache_read_input_tokens": 2e-08,
+          "cache_creation_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 4e-07,
+          "output": 1.8e-06,
+          "cache_read_input_tokens": 4e-08,
+          "cache_creation_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 8e-07,
+          "output": 3.6e-06,
+          "cache_read_input_tokens": 8e-08,
+          "cache_creation_input_tokens": 1e-06
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-07,
+          "output": 9e-07,
+          "cache_read_input_tokens": 2e-08,
+          "cache_creation_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4e-07,
+          "output": 2.4e-06,
+          "cache_read_input_tokens": 4e-08,
+          "cache_creation_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-07,
+          "output": 6e-07,
+          "cache_read_input_tokens": 1e-08,
+          "cache_creation_input_tokens": 1.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.5 Cyber",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.5 Cyber (trusted-access; also matches gpt-5.5-cyber-preview). Must stay out of the GPT-5.5 pattern, which it currently is (that pattern only allows $, -digit, -codex, -chat-latest).",
+    "match_pattern": "(?i)gpt-5\\.5-cyber",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.25e-05,
+          "output": 7.5e-05,
+          "cache_read_input_tokens": 1.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.5 Pro",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.5 Pro",
+    "match_pattern": "(?i)gpt-5\\.5-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-05,
+          "output": 0.00018
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 6e-05,
+          "output": 0.00027
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 3e-05,
+          "output": 0.000135
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.5e-05,
+          "output": 9e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.5",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.5",
+    "match_pattern": "(?i)gpt-5\\.5(?:$|-\\d|-codex|-chat-latest)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 3e-05,
+          "cache_read_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 1e-05,
+          "output": 4.5e-05,
+          "cache_read_input_tokens": 1e-06
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 5e-06,
+          "output": 2.25e-05,
+          "cache_read_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.5e-05,
+          "output": 0.0001125,
+          "cache_read_input_tokens": 2.5e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.25e-05,
+          "output": 7.5e-05,
+          "cache_read_input_tokens": 1.25e-06
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.5e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 2.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.4 Pro",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.4 Pro",
+    "match_pattern": "(?i)gpt-5\\.4-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-05,
+          "output": 0.00018
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 6e-05,
+          "output": 0.00027
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 3e-05,
+          "output": 0.000135
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.5e-05,
+          "output": 9e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.4 Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.4 Mini",
+    "match_pattern": "(?i)gpt-5\\.4-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7.5e-07,
+          "output": 4.5e-06,
+          "cache_read_input_tokens": 7.5e-08
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.5e-06,
+          "output": 9e-06,
+          "cache_read_input_tokens": 1.5e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 3.75e-07,
+          "output": 2.25e-06,
+          "cache_read_input_tokens": 3.75e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.4 Nano",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.4 Nano",
+    "match_pattern": "(?i)gpt-5\\.4-nano",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-07,
+          "output": 1.25e-06,
+          "cache_read_input_tokens": 2e-08
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-07,
+          "output": 6.25e-07,
+          "cache_read_input_tokens": 1e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.4",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.4",
+    "match_pattern": "(?i)gpt-5\\.4(?:$|-\\d|-codex|-chat-latest)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "prices": {
+          "input": 5e-06,
+          "output": 2.25e-05,
+          "cache_read_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Flex \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.5e-06,
+          "output": 1.125e-05,
+          "cache_read_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Fast mode \u00b7 Extended Context (272k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 272000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-05,
+          "output": 4.5e-05,
+          "cache_read_input_tokens": 1e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 5e-06,
+          "output": 3e-05,
+          "cache_read_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.25e-06,
+          "output": 7.5e-06,
+          "cache_read_input_tokens": 1.3e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.3",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.3 (chat-latest, codex, codex-spark)",
+    "match_pattern": "(?i)gpt-5\\.3",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.75e-06,
+          "output": 1.4e-05,
+          "cache_read_input_tokens": 1.75e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 3.5e-06,
+          "output": 2.8e-05,
+          "cache_read_input_tokens": 3.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.2 Pro",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.2 Pro",
+    "match_pattern": "(?i)gpt-5\\.2-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.1e-05,
+          "output": 0.000168
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.2",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.2",
+    "match_pattern": "(?i)gpt-5\\.2(?:-codex|-chat-latest|-\\d{4}-\\d{2}-\\d{2})?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.75e-06,
+          "output": 1.4e-05,
+          "cache_read_input_tokens": 1.75e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 3.5e-06,
+          "output": 2.8e-05,
+          "cache_read_input_tokens": 3.5e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 8.75e-07,
+          "output": 7e-06,
+          "cache_read_input_tokens": 8.75e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.1 Codex Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.1 Codex Mini (shut down; kept for historical spans). MUST sit before GPT-5.1, whose unanchored (?i)gpt-5\\.1 pattern otherwise bills it at $1.25/$10.",
+    "match_pattern": "(?i)gpt-5\\.1-codex-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-07,
+          "output": 2e-06,
+          "cache_read_input_tokens": 2.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5.1",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5.1",
+    "match_pattern": "(?i)gpt-5\\.1",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.25e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1.25e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.5e-06,
+          "output": 2e-05,
+          "cache_read_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 6.25e-07,
+          "output": 5e-06,
+          "cache_read_input_tokens": 6.25e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5 Search API",
+    "provider": "OpenAI",
+    "description": "OpenAI gpt-5-search-api (per-call web search fees not included). GPT-5's pattern is $-anchored so it does not catch this; place anywhere, e.g. right before GPT-5.",
+    "match_pattern": "(?i)gpt-5-search-api",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.25e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5 Pro",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5 Pro",
+    "match_pattern": "(?i)gpt-5-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-05,
+          "output": 0.00012
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5 Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5 Mini",
+    "match_pattern": "(?i)gpt-5-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-07,
+          "output": 2e-06,
+          "cache_read_input_tokens": 2.5e-08
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4.5e-07,
+          "output": 3.6e-06,
+          "cache_read_input_tokens": 4.5e-08
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.25e-07,
+          "output": 1e-06,
+          "cache_read_input_tokens": 1.25e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5 Nano",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5 Nano",
+    "match_pattern": "(?i)gpt-5-nano",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-08,
+          "output": 4e-07,
+          "cache_read_input_tokens": 5e-09
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.5e-08,
+          "output": 2e-07,
+          "cache_read_input_tokens": 2.5e-09
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-5",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-5",
+    "match_pattern": "(?i)gpt-5(?:-codex|-chat-latest|-\\d{4}-\\d{2}-\\d{2})?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.25e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1.25e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.5e-06,
+          "output": 2e-05,
+          "cache_read_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 6.25e-07,
+          "output": 5e-06,
+          "cache_read_input_tokens": 6.25e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT Rosalind",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-Rosalind life-sciences models (research, discovery); no cache-write pricing per OpenAI. No overlap with other entries.",
+    "match_pattern": "(?i)gpt-rosalind-(?:research|discovery)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 2.5e-05,
+          "cache_read_input_tokens": 5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4.5 Preview",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4.5 Preview",
+    "match_pattern": "(?i)gpt-4\\.5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7.5e-05,
+          "output": 0.00015,
+          "cache_read_input_tokens": 3.75e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4.1 Nano",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4.1 Nano",
+    "match_pattern": "(?i)gpt-4\\.1-nano",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 4e-07,
+          "cache_read_input_tokens": 2.5e-08
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-07,
+          "output": 8e-07,
+          "cache_read_input_tokens": 5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4.1 Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4.1 Mini",
+    "match_pattern": "(?i)gpt-4\\.1-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-07,
+          "output": 1.6e-06,
+          "cache_read_input_tokens": 1e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 7e-07,
+          "output": 2.8e-06,
+          "cache_read_input_tokens": 1.75e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4.1",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4.1",
+    "match_pattern": "(?i)gpt-4\\.1(?:-\\d{4}-\\d{2}-\\d{2})?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 8e-06,
+          "cache_read_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 3.5e-06,
+          "output": 1.4e-05,
+          "cache_read_input_tokens": 8.75e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4o Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4o Mini",
+    "match_pattern": "(?i)gpt-4o-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-07,
+          "output": 6e-07,
+          "cache_read_input_tokens": 7.5e-08
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.5e-07,
+          "output": 1e-06,
+          "cache_read_input_tokens": 1.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "ChatGPT-4o Latest",
+    "provider": "OpenAI",
+    "description": "OpenAI chatgpt-4o-latest - ChatGPT-tuned GPT-4o, priced above the API gpt-4o",
+    "match_pattern": "(?i)chatgpt-4o-latest",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 1.5e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4o (2024-05-13)",
+    "provider": "OpenAI",
+    "description": "OpenAI gpt-4o-2024-05-13 snapshot (shut down), priced above GPT-4o; no cached-input price published. MUST sit before GPT-4o, whose pattern gpt-4o(?:-\\d{4}[-\\d]*)?$ also matches this snapshot.",
+    "match_pattern": "(?i)gpt-4o-2024-05-13",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 1.5e-05
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 8.75e-06,
+          "output": 2.625e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4o",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4o",
+    "match_pattern": "(?i)gpt-4o(?:-\\d{4}[-\\d]*)?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1.25e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4.25e-06,
+          "output": 1.7e-05,
+          "cache_read_input_tokens": 2.125e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "o1 Pro",
+    "provider": "OpenAI",
+    "description": "OpenAI o1 Pro",
+    "match_pattern": "(?i)o1-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 0.00015,
+          "output": 0.0006,
+          "cache_read_input_tokens": 7.5e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "o1 Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI o1 Mini",
+    "match_pattern": "(?i)o1-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.1e-06,
+          "output": 4.4e-06,
+          "cache_read_input_tokens": 5.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "o1",
+    "provider": "OpenAI",
+    "description": "OpenAI o1",
+    "match_pattern": "(?i)(?:^|[-/])o1(?:$|[-/]\\d|-preview)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-05,
+          "output": 6e-05,
+          "cache_read_input_tokens": 7.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "o3 Pro",
+    "provider": "OpenAI",
+    "description": "OpenAI o3 Pro",
+    "match_pattern": "(?i)o3-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-05,
+          "output": 8e-05,
+          "cache_read_input_tokens": 1e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "o3 Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI o3 Mini",
+    "match_pattern": "(?i)o3-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.1e-06,
+          "output": 4.4e-06,
+          "cache_read_input_tokens": 5.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "o3 Deep Research",
+    "provider": "OpenAI",
+    "description": "OpenAI o3 Deep Research",
+    "match_pattern": "(?i)o3-deep-research",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-05,
+          "output": 4e-05,
+          "cache_read_input_tokens": 2.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "o3",
+    "provider": "OpenAI",
+    "description": "OpenAI o3",
+    "match_pattern": "(?i)(?:^|[-/])o3(?:$|[-/]\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 8e-06,
+          "cache_read_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 3.5e-06,
+          "output": 1.4e-05,
+          "cache_read_input_tokens": 8.75e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-06,
+          "output": 4e-06,
+          "cache_read_input_tokens": 2.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "o4 Mini Deep Research",
+    "provider": "OpenAI",
+    "description": "OpenAI o4-mini-deep-research (shut down; kept for historical spans). MUST sit before o4 Mini, whose unanchored (?i)o4-mini pattern otherwise bills it at $1.10/$4.40.",
+    "match_pattern": "(?i)o4-mini-deep-research",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 8e-06,
+          "cache_read_input_tokens": 5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "o4 Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI o4 Mini",
+    "match_pattern": "(?i)o4-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.1e-06,
+          "output": 4.4e-06,
+          "cache_read_input_tokens": 2.75e-07
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "fast",
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2e-06,
+          "output": 8e-06,
+          "cache_read_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Flex",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "flex"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 5.5e-07,
+          "output": 2.2e-06,
+          "cache_read_input_tokens": 1.38e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4 Turbo",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4 Turbo",
+    "match_pattern": "(?i)gpt-4-(?:turbo|\\d{4}-preview|preview|vision-preview)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-05,
+          "output": 3e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4 32k",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4 32k",
+    "match_pattern": "(?i)gpt-4-32k",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 6e-05,
+          "output": 0.00012
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-4",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-4",
+    "match_pattern": "(?i)gpt-4(?:-0314|-0613|-0314)?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-05,
+          "output": 6e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT-3.5 Turbo",
+    "provider": "OpenAI",
+    "description": "OpenAI GPT-3.5 Turbo",
+    "match_pattern": "(?i)gpt-3\\.5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-07,
+          "output": 1.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT Image 1.5",
+    "provider": "OpenAI",
+    "description": "OpenAI gpt-image-1.5 (deprecated). input/cache_read use TEXT-token rates ($5 / $1.25); output uses IMAGE output ($32). Image input ($8, cached $2) and text output ($10) are not represented. Order-independent: the GPT Image 1 pattern excludes 1.5.",
+    "match_pattern": "(?i)gpt-image-1\\.5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 3.2e-05,
+          "cache_read_input_tokens": 1.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT Image 1 Mini",
+    "provider": "OpenAI",
+    "description": "OpenAI gpt-image-1-mini (deprecated). input/cache_read use TEXT-token rates ($2 / $0.20); output uses IMAGE output ($8). Image input ($2.50, cached $0.25) is not represented; no text output price exists.",
+    "match_pattern": "(?i)gpt-image-1-mini",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 8e-06,
+          "cache_read_input_tokens": 2e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GPT Image 1",
+    "provider": "OpenAI",
+    "description": "OpenAI gpt-image-1 (shut down 2026-10-23; kept for historical spans). input/cache_read use TEXT-token rates ($5 / $1.25); output uses IMAGE output ($40). Image input ($10, cached $2.50) is not represented. Pattern is anchored so it does not catch gpt-image-1.5 / gpt-image-1-mini.",
+    "match_pattern": "(?i)gpt-image-1(?:$|-\\d{4})",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 4e-05,
+          "cache_read_input_tokens": 1.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "text-embedding-3-large",
+    "provider": "OpenAI",
+    "description": "OpenAI text embedding large",
+    "match_pattern": "(?i)text-embedding-3-large",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.3e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "text-embedding-3-small",
+    "provider": "OpenAI",
+    "description": "OpenAI text embedding small",
+    "match_pattern": "(?i)text-embedding-3-small",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "text-embedding-ada-002",
+    "provider": "OpenAI",
+    "description": "OpenAI Ada embedding",
+    "match_pattern": "(?i)text-embedding-ada-002",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Opus 5.5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Opus 5.5 \u2014 1M context window, no long-context premium",
+    "match_pattern": "(?i)claude-opus-5-5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-06,
+          "output": 2e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 5e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "anthropic.response.speed",
+              "gen_ai.response.speed",
+              "anthropic.request.speed",
+              "gen_ai.request.speed",
+              "param.speed"
+            ],
+            "op": "in",
+            "values": [
+              "fast"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 8e-06,
+          "output": 4e-05,
+          "cache_read_input_tokens": 4e-07,
+          "cache_creation_input_tokens": 1e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Opus 5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Opus 5 \u2014 1M context window, no long-context premium",
+    "match_pattern": "(?i)claude-opus-5(?:$|[@:\\[]|-v\\d|-\\d{8}|-latest)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 2.5e-05,
+          "cache_read_input_tokens": 5e-07,
+          "cache_creation_input_tokens": 6.25e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "anthropic.response.speed",
+              "gen_ai.response.speed",
+              "anthropic.request.speed",
+              "gen_ai.request.speed",
+              "param.speed"
+            ],
+            "op": "in",
+            "values": [
+              "fast"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-05,
+          "output": 5e-05,
+          "cache_read_input_tokens": 1e-06,
+          "cache_creation_input_tokens": 1.25e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Sonnet 5.5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Sonnet 5.5 \u2014 1M context window, no long-context premium",
+    "match_pattern": "(?i)claude-sonnet-5-5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Sonnet 5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Sonnet 5 - 1M context window, no long-context premium. The $2/$10 launch price is now the standard price (the planned 2026-09-01 rise to $3/$15 was cancelled)",
+    "match_pattern": "(?i)claude-sonnet-5(?:$|[@:\\[]|-v\\d|-\\d{8}|-latest)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Fable 5.1",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Fable 5.1 \u2014 1M context window",
+    "match_pattern": "(?i)claude-fable-5-1",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-05,
+          "output": 5e-05,
+          "cache_read_input_tokens": 2.5e-07,
+          "cache_creation_input_tokens": 1.25e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Fable 5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Fable 5 \u2014 most capable widely released model, 1M context window",
+    "match_pattern": "(?i)claude-fable-5(?:$|[@:\\[]|-v\\d|-\\d{8}|-latest)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-05,
+          "output": 5e-05,
+          "cache_read_input_tokens": 1e-06,
+          "cache_creation_input_tokens": 1.25e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Mythos 5.1",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Mythos 5.1 \u2014 same pricing as Fable 5.1, 1M context window",
+    "match_pattern": "(?i)claude-mythos-5-1",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-05,
+          "output": 5e-05,
+          "cache_read_input_tokens": 2.5e-07,
+          "cache_creation_input_tokens": 1.25e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Mythos 5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Mythos 5 \u2014 Project Glasswing, same pricing as Fable 5, 1M context window",
+    "match_pattern": "(?i)claude-mythos-5(?:$|[@:\\[]|-v\\d|-\\d{8}|-latest)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-05,
+          "output": 5e-05,
+          "cache_read_input_tokens": 1e-06,
+          "cache_creation_input_tokens": 1.25e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Opus 4.8",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Opus 4.8 \u2014 1M context window, no long-context premium",
+    "match_pattern": "(?i)claude-opus-4-8",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 2.5e-05,
+          "cache_read_input_tokens": 5e-07,
+          "cache_creation_input_tokens": 6.25e-06
+        }
+      },
+      {
+        "name": "Fast mode",
+        "rules": [
+          {
+            "keys": [
+              "anthropic.response.speed",
+              "gen_ai.response.speed",
+              "anthropic.request.speed",
+              "gen_ai.request.speed",
+              "param.speed"
+            ],
+            "op": "in",
+            "values": [
+              "fast"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1e-05,
+          "output": 5e-05,
+          "cache_read_input_tokens": 1e-06,
+          "cache_creation_input_tokens": 1.25e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Opus 4.7",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Opus 4.7 \u2014 1M context window, no long-context premium",
+    "match_pattern": "(?i)claude-opus-4-7",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 2.5e-05,
+          "cache_read_input_tokens": 5e-07,
+          "cache_creation_input_tokens": 6.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Opus 4.6",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Opus 4.6 \u2014 1M context window, no long-context premium",
+    "match_pattern": "(?i)claude-opus-4-6",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 2.5e-05,
+          "cache_read_input_tokens": 5e-07,
+          "cache_creation_input_tokens": 6.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Opus 4.5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Opus 4.5",
+    "match_pattern": "(?i)claude-opus-4-5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-06,
+          "output": 2.5e-05,
+          "cache_read_input_tokens": 5e-07,
+          "cache_creation_input_tokens": 6.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Opus 4.1",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Opus 4.1",
+    "match_pattern": "(?i)claude-opus-4-1",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-05,
+          "output": 7.5e-05,
+          "cache_read_input_tokens": 1.5e-06,
+          "cache_creation_input_tokens": 1.875e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Opus 4",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Opus 4",
+    "match_pattern": "(?i)claude-opus-4(?:-0|-20\\d{6})?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-05,
+          "output": 7.5e-05,
+          "cache_read_input_tokens": 1.5e-06,
+          "cache_creation_input_tokens": 1.875e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Sonnet 4.6",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Sonnet 4.6 - 1M context window, no long-context premium",
+    "match_pattern": "(?i)claude-sonnet-4-6",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 3e-07,
+          "cache_creation_input_tokens": 3.75e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Sonnet 4.5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Sonnet 4.5 \u2014 extended context pricing at 200k+ input tokens",
+    "match_pattern": "(?i)claude-sonnet-4-5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 3e-07,
+          "cache_creation_input_tokens": 3.75e-06
+        }
+      },
+      {
+        "name": "Extended Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 6e-06,
+          "output": 2.25e-05,
+          "cache_read_input_tokens": 6e-07,
+          "cache_creation_input_tokens": 7.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Sonnet 4",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Sonnet 4",
+    "match_pattern": "(?i)claude-sonnet-4(?:-0|-20\\d{6}|-latest)?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 3e-07,
+          "cache_creation_input_tokens": 3.75e-06
+        }
+      },
+      {
+        "name": "Extended Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 6e-06,
+          "output": 2.25e-05,
+          "cache_read_input_tokens": 6e-07,
+          "cache_creation_input_tokens": 7.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude 3 Opus",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude 3 Opus",
+    "match_pattern": "(?i)claude-3-opus",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-05,
+          "output": 7.5e-05,
+          "cache_read_input_tokens": 1.5e-06,
+          "cache_creation_input_tokens": 1.875e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude 3.7 Sonnet",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude 3.7 Sonnet",
+    "match_pattern": "(?i)claude-3[-.]7-sonnet",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 3e-07,
+          "cache_creation_input_tokens": 3.75e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude 3.5 Sonnet",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude 3.5 Sonnet",
+    "match_pattern": "(?i)claude-3[-.]5-sonnet",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 3e-07,
+          "cache_creation_input_tokens": 3.75e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude 3 Sonnet",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude 3 Sonnet",
+    "match_pattern": "(?i)claude-3-sonnet(?:-20\\d{6})?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 3e-07,
+          "cache_creation_input_tokens": 3.75e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Haiku 4.5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Haiku 4.5",
+    "match_pattern": "(?i)claude-haiku-4-5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-06,
+          "output": 5e-06,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 1.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude 3.5 Haiku",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude 3.5 Haiku",
+    "match_pattern": "(?i)claude-(?:haiku-3-5|3[-.]5-haiku)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 8e-07,
+          "output": 4e-06,
+          "cache_read_input_tokens": 8e-08,
+          "cache_creation_input_tokens": 1e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude 3 Haiku",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude 3 Haiku",
+    "match_pattern": "(?i)claude-3-haiku",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-07,
+          "output": 1.25e-06,
+          "cache_read_input_tokens": 2.5e-08,
+          "cache_creation_input_tokens": 3.125e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Haiku 5.5",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Haiku 5.5 - prompts over 100,000 tokens (counting cache reads and writes) pay the higher rate for the whole request",
+    "match_pattern": "(?i)claude-haiku-5-5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 5e-07,
+          "cache_read_input_tokens": 1e-08,
+          "cache_creation_input_tokens": 1.25e-07
+        }
+      },
+      {
+        "name": "Long Prompt (100k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 100001
+        },
+        "prices": {
+          "input": 5e-07,
+          "output": 2.5e-06,
+          "cache_read_input_tokens": 5e-08,
+          "cache_creation_input_tokens": 6.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Claude Mythos Preview",
+    "provider": "Anthropic",
+    "description": "Anthropic Claude Mythos Preview (Project Glasswing, limited access) - price applies after research-preview credits; no cache price published",
+    "match_pattern": "(?i)claude-mythos-preview",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-05,
+          "output": 0.000125
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3.8 Flash",
+    "provider": "Google",
+    "description": "Google Gemini 3.8 Flash",
+    "match_pattern": "(?i)gemini-3\\.8-flash",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7.5e-07,
+          "output": 3.75e-06,
+          "cache_read_input_tokens": 7.5e-08
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.35e-06,
+          "output": 6.75e-06,
+          "cache_read_input_tokens": 1.35e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3.7 Flash",
+    "provider": "Google",
+    "description": "Google Gemini 3.7 Flash",
+    "match_pattern": "(?i)gemini-3\\.7-flash",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7.5e-07,
+          "output": 3.75e-06,
+          "cache_read_input_tokens": 7.5e-08
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.35e-06,
+          "output": 6.75e-06,
+          "cache_read_input_tokens": 1.35e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3.6 Flash",
+    "provider": "Google",
+    "description": "Google Gemini 3.6 Flash",
+    "match_pattern": "(?i)gemini-3\\.6-flash",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7.5e-07,
+          "output": 3.75e-06,
+          "cache_read_input_tokens": 7.5e-08
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.35e-06,
+          "output": 6.75e-06,
+          "cache_read_input_tokens": 1.35e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3.5 Flash Lite",
+    "provider": "Google",
+    "description": "Google Gemini 3.5 Flash Lite",
+    "match_pattern": "(?i)gemini-3\\.5-flash-lite",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-07,
+          "output": 2.5e-06,
+          "cache_read_input_tokens": 3e-08
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 5.4e-07,
+          "output": 4.5e-06,
+          "cache_read_input_tokens": 5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3.5 Flash",
+    "provider": "Google",
+    "description": "Google Gemini 3.5 Flash",
+    "match_pattern": "(?i)gemini-3\\.5-flash(?:$|-preview|-latest|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-06,
+          "output": 9e-06,
+          "cache_read_input_tokens": 1.5e-07
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.7e-06,
+          "output": 1.62e-05,
+          "cache_read_input_tokens": 2.7e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3.1 Pro",
+    "provider": "Google",
+    "description": "Google Gemini 3.1 Pro \u2014 extended context pricing at 200k+ input tokens",
+    "match_pattern": "(?i)gemini-3\\.1-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1.2e-05,
+          "cache_read_input_tokens": 2e-07
+        }
+      },
+      {
+        "name": "Extended Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 4e-06,
+          "output": 1.8e-05,
+          "cache_read_input_tokens": 4e-07
+        }
+      },
+      {
+        "name": "Priority \u00b7 Extended Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 7.2e-06,
+          "output": 3.24e-05,
+          "cache_read_input_tokens": 7.2e-07
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 3.6e-06,
+          "output": 2.16e-05,
+          "cache_read_input_tokens": 3.6e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3.1 Flash Lite",
+    "provider": "Google",
+    "description": "Google Gemini 3.1 Flash Lite",
+    "match_pattern": "(?i)gemini-3\\.1-flash-lite",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-07,
+          "output": 1.5e-06,
+          "cache_read_input_tokens": 2.5e-08
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4.5e-07,
+          "output": 2.7e-06,
+          "cache_read_input_tokens": 4.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3 Pro",
+    "provider": "Google",
+    "description": "Google Gemini 3 Pro \u2014 extended context pricing at 200k+ input tokens",
+    "match_pattern": "(?i)gemini-3-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1.2e-05,
+          "cache_read_input_tokens": 2e-07
+        }
+      },
+      {
+        "name": "Extended Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 4e-06,
+          "output": 1.8e-05,
+          "cache_read_input_tokens": 4e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 3 Flash",
+    "provider": "Google",
+    "description": "Google Gemini 3 Flash",
+    "match_pattern": "(?i)gemini-3-flash",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-07,
+          "output": 3e-06,
+          "cache_read_input_tokens": 5e-08
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 9e-07,
+          "output": 5.4e-06,
+          "cache_read_input_tokens": 9e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 2.5 Pro",
+    "provider": "Google",
+    "description": "Google Gemini 2.5 Pro \u2014 extended context pricing at 200k+ input tokens",
+    "match_pattern": "(?i)gemini-2\\.5-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.25e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1.25e-07
+        }
+      },
+      {
+        "name": "Extended Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 2.5e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Priority \u00b7 Extended Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 4.5e-06,
+          "output": 2.7e-05,
+          "cache_read_input_tokens": 4.5e-07
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 2.25e-06,
+          "output": 1.8e-05,
+          "cache_read_input_tokens": 2.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini Flash Lite Latest",
+    "provider": "Google",
+    "description": "Google Gemini Flash Lite (rolling alias \u2014 currently 2.5 Flash Lite pricing)",
+    "match_pattern": "(?i)gemini-flash-lite-latest",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 4e-07,
+          "cache_read_input_tokens": 2.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini Flash Latest",
+    "provider": "Google",
+    "description": "Google Gemini Flash rolling alias - resolves to 3.6 Flash pricing ($0.75/$3.75, cache $0.075) through 2026-12-31; 3.6 Flash doubles from 2027-01-01",
+    "match_pattern": "(?i)gemini-flash-latest",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7.5e-07,
+          "output": 3.75e-06,
+          "cache_read_input_tokens": 7.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 2.5 Flash Lite",
+    "provider": "Google",
+    "description": "Google Gemini 2.5 Flash Lite",
+    "match_pattern": "(?i)gemini-2\\.5-flash-lite",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 4e-07,
+          "cache_read_input_tokens": 1e-08
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 1.8e-07,
+          "output": 7.2e-07,
+          "cache_read_input_tokens": 1.8e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 2.5 Flash",
+    "provider": "Google",
+    "description": "Google Gemini 2.5 Flash",
+    "match_pattern": "(?i)gemini-2\\.5-flash$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-07,
+          "output": 2.5e-06,
+          "cache_read_input_tokens": 3e-08
+        }
+      },
+      {
+        "name": "Priority",
+        "rules": [
+          {
+            "keys": [
+              "openai.response.service_tier",
+              "gen_ai.openai.response.service_tier",
+              "gen_ai.response.service_tier",
+              "openai.request.service_tier",
+              "gen_ai.openai.request.service_tier",
+              "gen_ai.request.service_tier",
+              "param.service_tier"
+            ],
+            "op": "in",
+            "values": [
+              "priority"
+            ]
+          }
+        ],
+        "prices": {
+          "input": 5.4e-07,
+          "output": 4.5e-06,
+          "cache_read_input_tokens": 5.4e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 2.0 Flash Lite",
+    "provider": "Google",
+    "description": "Google Gemini 2.0 Flash Lite",
+    "match_pattern": "(?i)gemini-2\\.0-flash-lite",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7.5e-08,
+          "output": 3e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 2.0 Flash",
+    "provider": "Google",
+    "description": "Google Gemini 2.0 Flash",
+    "match_pattern": "(?i)gemini-2\\.0-flash(?:-\\d{3})?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 4e-07,
+          "cache_read_input_tokens": 2.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 1.5 Flash 8B",
+    "provider": "Google",
+    "description": "Google Gemini 1.5 Flash 8B \u2014 extended context pricing at 128k+ input tokens",
+    "match_pattern": "(?i)gemini-(?:flash-1\\.5-8b|1\\.5-flash-8b)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3.75e-08,
+          "output": 1.5e-07,
+          "cache_read_input_tokens": 1e-08
+        }
+      },
+      {
+        "name": "Extended Context (128k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 128000
+        },
+        "prices": {
+          "input": 7.5e-08,
+          "output": 3e-07,
+          "cache_read_input_tokens": 2e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 1.5 Pro",
+    "provider": "Google",
+    "description": "Google Gemini 1.5 Pro",
+    "match_pattern": "(?i)gemini-1\\.5-pro",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.25e-06,
+          "output": 5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 1.5 Flash",
+    "provider": "Google",
+    "description": "Google Gemini 1.5 Flash",
+    "match_pattern": "(?i)gemini-1\\.5-flash(?:$|-\\d{3}|-latest|-preview)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7.5e-08,
+          "output": 3e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini Pro",
+    "provider": "Google",
+    "description": "Google Gemini Pro",
+    "match_pattern": "(?i)gemini-pro$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-07,
+          "output": 1.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini Embedding",
+    "provider": "Google",
+    "description": "Google Gemini Embedding (gemini-embedding-001)",
+    "match_pattern": "(?i)gemini-embedding(?:$|-0|-exp)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini 4 Argon",
+    "provider": "Google",
+    "description": "Google Gemini 4 Argon - 1M context, implicit caching only. Introductory price through 2026-11-30; doubles to $4/$20 (cache $0.20) from 2026-12-01",
+    "match_pattern": "(?i)gemini-4-argon",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 1e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini Embedding 2",
+    "provider": "Google",
+    "description": "Google Gemini Embedding 2 multimodal embedding - text input price (image/audio/video input priced higher)",
+    "match_pattern": "(?i)gemini-embedding-2",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Gemini Robotics ER 2",
+    "provider": "Google",
+    "description": "Google Gemini Robotics ER 2 Preview and Streaming Preview - price through 2026-12-31; doubles to $2/$10 (cache $0.20) from 2027-01-01",
+    "match_pattern": "(?i)gemini-robotics-er-2",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-06,
+          "output": 5e-06,
+          "cache_read_input_tokens": 1e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "DeepSeek V4 Flash",
+    "provider": "DeepSeek",
+    "description": "DeepSeek Flash (deepseek-flash, served by DeepSeek-V4.1-Flash-1017; legacy deepseek-v4-flash / deepseek-v4-flash-vision-exp are routed to it and billed at the Flash price) - 1M context. Peak hours are 01:00-04:00 and 06:00-10:00 UTC Monday-Friday excluding Chinese public holidays; all other hours, including weekends, are off-peak at half the peak rate. utc_windows cannot express the weekday rule, so weekend traffic in those windows is overpriced at peak.",
+    "match_pattern": "(?i)deepseek-(?:v4(?:\\.1)?-)?flash",
+    "tiers": [
+      {
+        "name": "Off-Peak",
+        "prices": {
+          "input": 1.5e-07,
+          "output": 6e-07,
+          "cache_read_input_tokens": 3e-09
+        }
+      },
+      {
+        "name": "Peak (01:00-04:00, 06:00-10:00 UTC)",
+        "utc_windows": [
+          {
+            "start_minute": 60,
+            "end_minute": 240
+          },
+          {
+            "start_minute": 360,
+            "end_minute": 600
+          }
+        ],
+        "prices": {
+          "input": 3e-07,
+          "output": 1.2e-06,
+          "cache_read_input_tokens": 6e-09
+        }
+      }
+    ]
+  },
+  {
+    "name": "DeepSeek V4 Pro",
+    "provider": "DeepSeek",
+    "description": "DeepSeek V4 Pro (DeepSeek-V4-Pro-0813) - 1M context. Peak hours are 01:00-04:00 and 06:00-10:00 UTC Monday-Friday excluding Chinese public holidays; all other hours, including weekends, are off-peak at half the peak rate. utc_windows cannot express the weekday rule, so weekend traffic in those windows is overpriced at peak.",
+    "match_pattern": "(?i)deepseek-v4-pro",
+    "tiers": [
+      {
+        "name": "Off-Peak",
+        "prices": {
+          "input": 6.6e-07,
+          "output": 1.98e-06,
+          "cache_read_input_tokens": 2.2e-08
+        }
+      },
+      {
+        "name": "Peak (01:00-04:00, 06:00-10:00 UTC)",
+        "utc_windows": [
+          {
+            "start_minute": 60,
+            "end_minute": 240
+          },
+          {
+            "start_minute": 360,
+            "end_minute": 600
+          }
+        ],
+        "prices": {
+          "input": 1.32e-06,
+          "output": 3.96e-06,
+          "cache_read_input_tokens": 4.4e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "DeepSeek V3",
+    "provider": "DeepSeek",
+    "description": "DeepSeek V3 (deepseek-chat)",
+    "match_pattern": "(?i)deepseek-(?:v3|chat)(?:$|-)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.7e-07,
+          "output": 1.1e-06,
+          "cache_read_input_tokens": 7e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "DeepSeek R1",
+    "provider": "DeepSeek",
+    "description": "DeepSeek R1 reasoning model (deepseek-reasoner)",
+    "match_pattern": "(?i)deepseek-(?:r1|reasoner)(?:-\\d[\\d-]*)?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5.5e-07,
+          "output": 2.19e-06,
+          "cache_read_input_tokens": 1.4e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "DeepSeek R1 Distill Llama 8B",
+    "provider": "DeepSeek",
+    "description": "DeepSeek R1 distilled on Llama 8B",
+    "match_pattern": "(?i)deepseek-r1-distill-llama-8b",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-08,
+          "output": 4e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "DeepSeek R1 Distill Qwen 32B",
+    "provider": "DeepSeek",
+    "description": "DeepSeek R1 distilled on Qwen 32B",
+    "match_pattern": "(?i)deepseek-r1-distill-qwen-32b",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.9e-07,
+          "output": 2.9e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K2.7",
+    "provider": "Moonshot",
+    "description": "Kimi K2.7 Code (K2 series, retiring end of Dec 2026)",
+    "match_pattern": "(?i)kimi-k2\\.7(?:-code)?(?:$|-preview|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 9.5e-07,
+          "output": 4e-06,
+          "cache_read_input_tokens": 1.9e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K2.6",
+    "provider": "Moonshot",
+    "description": "Kimi K2.6 multimodal model",
+    "match_pattern": "(?i)kimi-k2\\.6",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 9.5e-07,
+          "output": 4e-06,
+          "cache_read_input_tokens": 1.6e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K2.5",
+    "provider": "Moonshot",
+    "description": "Kimi K2.5 multimodal model",
+    "match_pattern": "(?i)kimi-k2\\.5",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 6e-07,
+          "output": 3e-06,
+          "cache_read_input_tokens": 1e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K2 Turbo",
+    "provider": "Moonshot",
+    "description": "Kimi K2 Turbo / Thinking Turbo variants",
+    "match_pattern": "(?i)kimi-k2-(?:turbo|thinking-turbo)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.15e-06,
+          "output": 8e-06,
+          "cache_read_input_tokens": 1.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K2",
+    "provider": "Moonshot",
+    "description": "Kimi K2 generation model (0711, 0905, thinking variants)",
+    "match_pattern": "(?i)kimi-k2(?:-(?:0711|0905|thinking))?(?:-preview)?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 6e-07,
+          "output": 2.5e-06,
+          "cache_read_input_tokens": 1.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Moonshot V1 128k",
+    "provider": "Moonshot",
+    "description": "Moonshot V1 classic model \u2014 128k context",
+    "match_pattern": "(?i)moonshot-v1-128k",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Moonshot V1 32k",
+    "provider": "Moonshot",
+    "description": "Moonshot V1 classic model \u2014 32k context",
+    "match_pattern": "(?i)moonshot-v1-32k",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-06,
+          "output": 3e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Moonshot V1 8k",
+    "provider": "Moonshot",
+    "description": "Moonshot V1 classic model \u2014 8k context",
+    "match_pattern": "(?i)moonshot-v1-8k",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-07,
+          "output": 2e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K3.1 Pro Highspeed",
+    "provider": "Moonshot",
+    "description": "Kimi K3.1 Pro high-speed variant - 1M context; cache write price is the 5m TTL rate (1h writes $8/MTok)",
+    "match_pattern": "(?i)kimi-k3\\.1-pro-highspeed",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-06,
+          "output": 2e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 4e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K3.1 Pro",
+    "provider": "Moonshot",
+    "description": "Kimi K3.1 Pro - 1M context; cache write price is the 5m TTL rate (1h writes $4/MTok)",
+    "match_pattern": "(?i)kimi-k3\\.1-pro(?:$|-preview|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 1e-05,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 2e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K3",
+    "provider": "Moonshot",
+    "description": "Kimi K3 - 1M context; cache write price is the 5m TTL rate (1h writes $6/MTok)",
+    "match_pattern": "(?i)kimi-k3(?:$|-preview|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-06,
+          "output": 1.5e-05,
+          "cache_read_input_tokens": 3e-07,
+          "cache_creation_input_tokens": 3e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Kimi K2.7 Code Highspeed",
+    "provider": "Moonshot",
+    "description": "Kimi K2.7 Code high-speed variant (K2 series, retiring end of Dec 2026)",
+    "match_pattern": "(?i)kimi-k2\\.7-code-highspeed",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.9e-06,
+          "output": 8e-06,
+          "cache_read_input_tokens": 3.8e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Grok 4.6 / 4.7",
+    "provider": "xAI",
+    "description": "xAI Grok 4.7 and Grok 4.6 (same price) - prompts of 200k+ tokens bill every token at the long-context rate",
+    "match_pattern": "(?i)grok-4\\.[67](?:$|-)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 6e-06,
+          "cache_read_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Long Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 4e-06,
+          "output": 1.2e-05,
+          "cache_read_input_tokens": 1e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Grok 4.5",
+    "provider": "xAI",
+    "description": "xAI Grok 4.5 (aliases grok-4.5-latest, grok-build-latest) - prompts of 200k+ tokens bill every token at the long-context rate",
+    "match_pattern": "(?i)grok-(?:4\\.5|build-latest)(?:$|-)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 6e-06,
+          "cache_read_input_tokens": 3e-07
+        }
+      },
+      {
+        "name": "Long Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 4e-06,
+          "output": 1.2e-05,
+          "cache_read_input_tokens": 6e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Grok 4.3 / 4.20",
+    "provider": "xAI",
+    "description": "xAI Grok 4.3 and Grok 4.20 reasoning, non-reasoning and multi-agent (all aliases, same price) - prompts of 200k+ tokens bill every token at the long-context rate",
+    "match_pattern": "(?i)grok-4\\.(?:3|20)(?:$|-)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.25e-06,
+          "output": 2.5e-06,
+          "cache_read_input_tokens": 2e-07
+        }
+      },
+      {
+        "name": "Long Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 2.5e-06,
+          "output": 5e-06,
+          "cache_read_input_tokens": 4e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Grok Build 0.1",
+    "provider": "xAI",
+    "description": "xAI grok-build-0.1 (aliases grok-code-fast, grok-code-fast-1, grok-code-fast-1-0825) - prompts of 200k+ tokens bill every token at the long-context rate",
+    "match_pattern": "(?i)grok-(?:build-0\\.1|code-fast)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-06,
+          "output": 2e-06,
+          "cache_read_input_tokens": 2e-07
+        }
+      },
+      {
+        "name": "Long Context (200k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 200000
+        },
+        "prices": {
+          "input": 2e-06,
+          "output": 4e-06,
+          "cache_read_input_tokens": 4e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Mistral Large 4",
+    "provider": "Mistral",
+    "description": "Mistral Large 4 (v26.10, public preview; ids mistral-large-4, mistral-large-4-0)",
+    "match_pattern": "(?i)mistral-large-4(?:$|-)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.36e-06,
+          "output": 4.18e-06,
+          "cache_read_input_tokens": 1.4e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Mistral Large 3",
+    "provider": "Mistral",
+    "description": "Mistral Large 3 (v25.12; ids mistral-large-2512, mistral-large-latest)",
+    "match_pattern": "(?i)mistral-large-(?:2512|3|latest)(?:$|-)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-07,
+          "output": 1.5e-06,
+          "cache_read_input_tokens": 5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Mistral Medium 3.5",
+    "provider": "Mistral",
+    "description": "Mistral Medium 3.5 (v26.04; ids mistral-medium-3-5, mistral-medium-3, mistral-medium-latest)",
+    "match_pattern": "(?i)mistral-medium(?:-3[.-]5|-3|-2604|-latest)?(?:$|[:@])",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-06,
+          "output": 7.5e-06,
+          "cache_read_input_tokens": 1.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Mistral Small 4",
+    "provider": "Mistral",
+    "description": "Mistral Small 4 (v26.03; ids mistral-small-2603, mistral-small-latest)",
+    "match_pattern": "(?i)mistral-small-(?:2603|4|latest)(?:$|-)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-07,
+          "output": 6e-07,
+          "cache_read_input_tokens": 1.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Ministral 3 14B",
+    "provider": "Mistral",
+    "description": "Mistral Ministral 3 14B (v25.12; ids ministral-14b-2512, ministral-14b-latest)",
+    "match_pattern": "(?i)ministral-(?:3-)?14b",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-07,
+          "output": 2e-07,
+          "cache_read_input_tokens": 2e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Ministral 3 8B",
+    "provider": "Mistral",
+    "description": "Mistral Ministral 3 8B (v25.12; ids ministral-8b-2512, ministral-8b-latest)",
+    "match_pattern": "(?i)ministral-(?:3-)?8b-(?:2512|latest)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-07,
+          "output": 1.5e-07,
+          "cache_read_input_tokens": 1.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Ministral 3 3B",
+    "provider": "Mistral",
+    "description": "Mistral Ministral 3 3B (v25.12; ids ministral-3b-2512, ministral-3b-latest)",
+    "match_pattern": "(?i)ministral-(?:3-)?3b-(?:2512|latest)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 1e-07,
+          "cache_read_input_tokens": 1e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Codestral",
+    "provider": "Mistral",
+    "description": "Mistral Codestral (v25.08; ids codestral-2508, codestral-latest)",
+    "match_pattern": "(?i)codestral-(?:2508|latest)(?:$|-)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-07,
+          "output": 9e-07,
+          "cache_read_input_tokens": 3e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Codestral Embed",
+    "provider": "Mistral",
+    "description": "Mistral Codestral Embed (ids codestral-embed-2505, codestral-embed)",
+    "match_pattern": "(?i)codestral-embed",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-07,
+          "cache_read_input_tokens": 1.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Mistral Embed",
+    "provider": "Mistral",
+    "description": "Mistral Embed (ids mistral-embed-2312, mistral-embed)",
+    "match_pattern": "(?i)mistral-embed",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "cache_read_input_tokens": 1e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-5.1 / 5.2 / 5.3",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-5.1, GLM-5.2 and GLM-5.3 (same list price)",
+    "match_pattern": "(?i)glm-5\\.[123](?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.4e-06,
+          "output": 4.4e-06,
+          "cache_read_input_tokens": 2.6e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-5.3 FlashX",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-5.3-FlashX and GLM-5.3-FlashX-Legal",
+    "match_pattern": "(?i)glm-5\\.3-flashx",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3.7e-07,
+          "output": 1.25e-06,
+          "cache_read_input_tokens": 7.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-5.3 Flash",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-5.3-Flash",
+    "match_pattern": "(?i)glm-5\\.3-flash(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-07,
+          "output": 5e-07,
+          "cache_read_input_tokens": 3e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-5",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-5",
+    "match_pattern": "(?i)glm-5(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-06,
+          "output": 3.2e-06,
+          "cache_read_input_tokens": 2e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4.5 / 4.6 / 4.7",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4.5, GLM-4.6 and GLM-4.7 (same list price)",
+    "match_pattern": "(?i)glm-4\\.[567](?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 6e-07,
+          "output": 2.2e-06,
+          "cache_read_input_tokens": 1.1e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4.7 FlashX",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4.7-FlashX (GLM-4.7-Flash is free and not priced)",
+    "match_pattern": "(?i)glm-4\\.7-flashx",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 7e-08,
+          "output": 4e-07,
+          "cache_read_input_tokens": 1e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4.5 X",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4.5-X",
+    "match_pattern": "(?i)glm-4\\.5-x(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.2e-06,
+          "output": 8.9e-06,
+          "cache_read_input_tokens": 4.5e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4.5 AirX",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4.5-AirX",
+    "match_pattern": "(?i)glm-4\\.5-airx",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.1e-06,
+          "output": 4.5e-06,
+          "cache_read_input_tokens": 2.2e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4.5 Air",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4.5-Air",
+    "match_pattern": "(?i)glm-4\\.5-air(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-07,
+          "output": 1.1e-06,
+          "cache_read_input_tokens": 3e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4 32B",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4-32B-0414-128K",
+    "match_pattern": "(?i)glm-4-32b-0414",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 1e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4.6V FlashX",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4.6V-FlashX vision model",
+    "match_pattern": "(?i)glm-4\\.6v-flashx",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-08,
+          "output": 4e-07,
+          "cache_read_input_tokens": 4e-09
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4.6V",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4.6V vision model",
+    "match_pattern": "(?i)glm-4\\.6v(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-07,
+          "output": 9e-07,
+          "cache_read_input_tokens": 5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "GLM-4.5V",
+    "provider": "Z.ai",
+    "description": "Z.ai GLM-4.5V vision model",
+    "match_pattern": "(?i)glm-4\\.5v(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 6e-07,
+          "output": 1.8e-06,
+          "cache_read_input_tokens": 1.1e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "MiniMax M3",
+    "provider": "MiniMax",
+    "description": "MiniMax-M3 Standard tier; higher rate above 512k input tokens. Priority service tier (1.5x) is not modelled.",
+    "match_pattern": "(?i)minimax-m3(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-07,
+          "output": 1.2e-06,
+          "cache_read_input_tokens": 6e-08
+        }
+      },
+      {
+        "name": "Long Context (512k+)",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 512000
+        },
+        "prices": {
+          "input": 6e-07,
+          "output": 2.4e-06,
+          "cache_read_input_tokens": 1.2e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "MiniMax M3.1 Flash",
+    "provider": "MiniMax",
+    "description": "MiniMax-M3.1-Flash",
+    "match_pattern": "(?i)minimax-m3\\.1-flash",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-07,
+          "output": 6e-07,
+          "cache_read_input_tokens": 1.5e-08
+        }
+      }
+    ]
+  },
+  {
+    "name": "Command R+ 08-2024",
+    "provider": "Cohere",
+    "description": "Cohere Command R+ 08-2024",
+    "match_pattern": "(?i)command-r-plus-08-2024",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-06,
+          "output": 1e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Command R+ 04-2024",
+    "provider": "Cohere",
+    "description": "Cohere Command R+ 04-2024 (legacy, existing customers)",
+    "match_pattern": "(?i)command-r-plus-04-2024",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-06,
+          "output": 1.5e-05
+        }
+      }
+    ]
+  },
+  {
+    "name": "Command R 03-2024",
+    "provider": "Cohere",
+    "description": "Cohere Command R 03-2024 (legacy, existing customers)",
+    "match_pattern": "(?i)command-r-03-2024",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-07,
+          "output": 1.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Command Light",
+    "provider": "Cohere",
+    "description": "Cohere Command-light (legacy, existing customers)",
+    "match_pattern": "(?i)(?:^|[/.])command-light$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-07,
+          "output": 6e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Command",
+    "provider": "Cohere",
+    "description": "Cohere Command (legacy, existing customers)",
+    "match_pattern": "(?i)(?:^|[/.])command$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-06,
+          "output": 2e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Aya Expanse",
+    "provider": "Cohere",
+    "description": "Cohere Aya Expanse 8B and 32B on the Cohere API",
+    "match_pattern": "(?i)aya-expanse-(?:8b|32b)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-07,
+          "output": 1.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.8 Max",
+    "provider": "Alibaba",
+    "description": "Qwen3.8-Max (International). Cache creation is 125% of input; the cache-hit price is not published.",
+    "match_pattern": "(?i)qwen3\\.8-max(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2e-06,
+          "output": 6e-06,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.8 Flash",
+    "provider": "Alibaba",
+    "description": "Qwen3.8-Flash (International). Cache prices are not published.",
+    "match_pattern": "(?i)qwen3\\.8-flash(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.5e-07,
+          "output": 4.7e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.7 Max",
+    "provider": "Alibaba",
+    "description": "Qwen3.7-Max incl. snapshots and preview (International). Cache read is the implicit-cache rate (20%).",
+    "match_pattern": "(?i)qwen3\\.7-max(?:$|-\\d|-preview)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-06,
+          "output": 7.5e-06,
+          "cache_read_input_tokens": 5e-07,
+          "cache_creation_input_tokens": 3.125e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen Max",
+    "provider": "Alibaba",
+    "description": "Qwen-Max (International, non-thinking only). Cache read is the implicit-cache rate (20%).",
+    "match_pattern": "(?i)qwen-max(?:$|-latest|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1.6e-06,
+          "output": 6.4e-06,
+          "cache_read_input_tokens": 3.2e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.7 Plus",
+    "provider": "Alibaba",
+    "description": "Qwen3.7-Plus (International); higher rate above 256K input. Cache read is the implicit-cache rate (20%).",
+    "match_pattern": "(?i)qwen3\\.7-plus(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-07,
+          "output": 1.6e-06,
+          "cache_read_input_tokens": 8e-08,
+          "cache_creation_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Input 256K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 256000
+        },
+        "prices": {
+          "input": 1.2e-06,
+          "output": 4.8e-06,
+          "cache_read_input_tokens": 2.4e-07,
+          "cache_creation_input_tokens": 1.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.6 Plus",
+    "provider": "Alibaba",
+    "description": "Qwen3.6-Plus (International); higher rate above 256K input. Explicit cache only (hit 10%).",
+    "match_pattern": "(?i)qwen3\\.6-plus(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-07,
+          "output": 3e-06,
+          "cache_read_input_tokens": 5e-08,
+          "cache_creation_input_tokens": 6.25e-07
+        }
+      },
+      {
+        "name": "Input 256K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 256000
+        },
+        "prices": {
+          "input": 2e-06,
+          "output": 6e-06,
+          "cache_read_input_tokens": 2e-07,
+          "cache_creation_input_tokens": 2.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.5 Plus",
+    "provider": "Alibaba",
+    "description": "Qwen3.5-Plus (International); higher rate above 256K input. Explicit cache only (hit 10%).",
+    "match_pattern": "(?i)qwen3\\.5-plus(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-07,
+          "output": 2.4e-06,
+          "cache_read_input_tokens": 4e-08,
+          "cache_creation_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Input 256K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 256000
+        },
+        "prices": {
+          "input": 5e-07,
+          "output": 3e-06,
+          "cache_read_input_tokens": 5e-08,
+          "cache_creation_input_tokens": 6.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen Plus",
+    "provider": "Alibaba",
+    "description": "Qwen-Plus / -latest / 2025-12-01 (International); non-thinking output price (thinking output is $4/$12 per 1M). Cache read is the implicit-cache rate (20%).",
+    "match_pattern": "(?i)qwen-plus(?:-latest|-2025-12-01)?$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-07,
+          "output": 1.2e-06,
+          "cache_read_input_tokens": 8e-08,
+          "cache_creation_input_tokens": 5e-07
+        }
+      },
+      {
+        "name": "Input 256K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 256000
+        },
+        "prices": {
+          "input": 1.2e-06,
+          "output": 3.6e-06,
+          "cache_read_input_tokens": 2.4e-07,
+          "cache_creation_input_tokens": 1.5e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen Plus (2025-01/04/07 snapshots)",
+    "provider": "Alibaba",
+    "description": "Older Qwen-Plus snapshots, no tiered pricing; non-thinking output price (thinking output is $4 per 1M).",
+    "match_pattern": "(?i)qwen-plus-2025-0[147]-\\d\\d$",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 4e-07,
+          "output": 1.2e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.7 Flash",
+    "provider": "Alibaba",
+    "description": "Qwen3.7-Flash (International), three input-length tiers. Cache read is the implicit-cache rate (20%).",
+    "match_pattern": "(?i)qwen3\\.7-flash(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-08,
+          "output": 1.3e-07,
+          "cache_read_input_tokens": 6e-09,
+          "cache_creation_input_tokens": 3.75e-08
+        }
+      },
+      {
+        "name": "Input 256K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 256000
+        },
+        "prices": {
+          "input": 2e-07,
+          "output": 8e-07,
+          "cache_read_input_tokens": 4e-08,
+          "cache_creation_input_tokens": 2.5e-07
+        }
+      },
+      {
+        "name": "Input 32K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 32000
+        },
+        "prices": {
+          "input": 1e-07,
+          "output": 4e-07,
+          "cache_read_input_tokens": 2e-08,
+          "cache_creation_input_tokens": 1.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.6 Flash",
+    "provider": "Alibaba",
+    "description": "Qwen3.6-Flash (International); higher rate above 256K input. Explicit cache only (hit 10%).",
+    "match_pattern": "(?i)qwen3\\.6-flash(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 2.5e-07,
+          "output": 1.5e-06,
+          "cache_read_input_tokens": 2.5e-08,
+          "cache_creation_input_tokens": 3.125e-07
+        }
+      },
+      {
+        "name": "Input 256K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 256000
+        },
+        "prices": {
+          "input": 1e-06,
+          "output": 4e-06,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 1.25e-06
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3.5 Flash",
+    "provider": "Alibaba",
+    "description": "Qwen3.5-Flash (International). Explicit cache only (hit 10%).",
+    "match_pattern": "(?i)qwen3\\.5-flash(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 1e-07,
+          "output": 4e-07,
+          "cache_read_input_tokens": 1e-08,
+          "cache_creation_input_tokens": 1.25e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen Flash",
+    "provider": "Alibaba",
+    "description": "Qwen-Flash (International); higher rate above 256K input. Cache read is the implicit-cache rate (20%).",
+    "match_pattern": "(?i)qwen-flash(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 5e-08,
+          "output": 4e-07,
+          "cache_read_input_tokens": 1e-08,
+          "cache_creation_input_tokens": 6.25e-08
+        }
+      },
+      {
+        "name": "Input 256K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 256000
+        },
+        "prices": {
+          "input": 2.5e-07,
+          "output": 2e-06,
+          "cache_read_input_tokens": 5e-08,
+          "cache_creation_input_tokens": 3.125e-07
+        }
+      }
+    ]
+  },
+  {
+    "name": "Qwen3 Coder Flash",
+    "provider": "Alibaba",
+    "description": "Qwen3-Coder-Flash (International), four input-length tiers. Cache read is the implicit-cache rate (20%).",
+    "match_pattern": "(?i)qwen3-coder-flash(?:$|-\\d)",
+    "tiers": [
+      {
+        "name": "Default",
+        "prices": {
+          "input": 3e-07,
+          "output": 1.5e-06,
+          "cache_read_input_tokens": 6e-08,
+          "cache_creation_input_tokens": 3.75e-07
+        }
+      },
+      {
+        "name": "Input 256K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 256000
+        },
+        "prices": {
+          "input": 1.6e-06,
+          "output": 9.6e-06,
+          "cache_read_input_tokens": 3.2e-07,
+          "cache_creation_input_tokens": 2e-06
+        }
+      },
+      {
+        "name": "Input 128K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 128000
+        },
+        "prices": {
+          "input": 8e-07,
+          "output": 4e-06,
+          "cache_read_input_tokens": 1.6e-07,
+          "cache_creation_input_tokens": 1e-06
+        }
+      },
+      {
+        "name": "Input 32K+",
+        "condition": {
+          "usage_key": "input",
+          "operator": "gte",
+          "value": 32000
+        },
+        "prices": {
+          "input": 5e-07,
+          "output": 2.5e-06,
+          "cache_read_input_tokens": 1e-07,
+          "cache_creation_input_tokens": 6.25e-07
+        }
+      }
+    ]
+  }
+]
diff --git a/src/config/src/axum/middlewares/access_log.rs b/src/config/src/axum/middlewares/access_log.rs
index 9f11ae0804..ad0230b662 100644
--- a/src/config/src/axum/middlewares/access_log.rs
+++ b/src/config/src/axum/middlewares/access_log.rs
@@ -30,13 +30,16 @@ use tower::{Layer, Service};
 const SHARE_TOKEN_PREFIX: usize = 6;
 
 /// Request headers whose value is a credential and is never written to the log.
-const REDACTED_REQUEST_HEADERS: [&str; 5] = [
+const REDACTED_REQUEST_HEADERS: [&str; 6] = [
     "authorization",
     "proxy-authorization",
     "cookie",
     "x-api-key",
     "x-o2-mcp",
+    "webhook-signature",
 ];
+/// Workflow hook credentials; a URL value starting with one, in any case or encoding, is cut.
+const HOOK_CREDENTIAL_PREFIXES: [&str; 2] = ["o2wh_", "whsec_"];
 
 /// The access log format: `common`, `json`, or a custom one (%a %t %r %s %b %U %T %D %{Header}i/o).
 pub fn get_http_access_log_format() -> String {
@@ -306,8 +309,12 @@ pub fn mask_log_url(url: &str) -> String {
     mask_slack_callback_query(&mask_share_tokens(url))
 }
 
-/// `path` (or a URL) with every chat share token or dashboard slug, a bearer credential, cut short.
+/// `path` (or a URL) with every share token, dashboard slug or hook credential cut short.
 pub fn mask_share_tokens(path: &str) -> String {
+    mask_hook_credentials(&mask_chat_share_tokens(path))
+}
+
+fn mask_chat_share_tokens(path: &str) -> String {
     let segments: Vec<&str> = path.split('/').collect();
     let mut masked = Vec::with_capacity(segments.len());
     for (i, segment) in segments.iter().enumerate() {
@@ -332,6 +339,61 @@ pub fn mask_share_tokens(path: &str) -> String {
     masked.join("/")
 }
 
+/// Cuts a hook credential that starts a path segment or a query value, up to its delimiter.
+fn mask_hook_credentials(url: &str) -> String {
+    let mut masked = String::with_capacity(url.len());
+    let mut rest = url;
+    let mut at_boundary = true;
+    while let Some(c) = rest.chars().next() {
+        if let Some(len) = at_boundary.then(|| credential_prefix_len(rest)).flatten() {
+            masked.push_str(&rest[..len]);
+            masked.push('…');
+            let end = rest.find(['/', '?', '&', '#']).unwrap_or(rest.len());
+            rest = &rest[end..];
+            at_boundary = false;
+            continue;
+        }
+        masked.push(c);
+        at_boundary = matches!(c, '/' | '?' | '&' | '=');
+        rest = &rest[c.len_utf8()..];
+    }
+    masked
+}
+
+/// Raw length of the start of `value` that decodes to a hook credential prefix, if it does.
+fn credential_prefix_len(value: &str) -> Option<usize> {
+    let raw = value.as_bytes();
+    let mut decoded = Vec::new();
+    let mut used = 0;
+    while used < raw.len() {
+        let escaped = (raw[used] == b'%')
+            .then(|| Some((hex_digit(*raw.get(used + 1)?)? << 4) | hex_digit(*raw.get(used + 2)?)?))
+            .flatten();
+        let (byte, width) = escaped.map_or((raw[used], 1), |byte| (byte, 3));
+        decoded.push(byte.to_ascii_lowercase());
+        used += width;
+        if HOOK_CREDENTIAL_PREFIXES
+            .iter()
+            .any(|p| p.as_bytes() == decoded)
+        {
+            return Some(used);
+        }
+        if !HOOK_CREDENTIAL_PREFIXES
+            .iter()
+            .any(|p| p.as_bytes().starts_with(&decoded))
+        {
+            return None;
+        }
+    }
+    None
+}
+
+fn hex_digit(byte: u8) -> Option<u8> {
+    char::from(byte)
+        .to_digit(16)
+        .and_then(|digit| u8::try_from(digit).ok())
+}
+
 /// A Slack callback's `code` and `state` are one-time OAuth secrets the SPA sends as Referer.
 fn mask_slack_callback_query(url: &str) -> String {
     let Some((path, rest)) = url.split_once('?') else {
@@ -427,6 +489,75 @@ mod tests {
         assert_eq!(mask_log_url(admin), admin);
     }
 
+    #[test]
+    fn hook_tokens_in_path_and_query_are_masked() {
+        let token = "o2wh_AbCdEfGhIjKlMnOpQrStUvWxYz0123456789abcde";
+        let secret = "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw";
+        for (url, masked) in [
+            (
+                format!("/api/v2/acme/workflows/hooks/{token}"),
+                "/api/v2/acme/workflows/hooks/o2wh_…".to_string(),
+            ),
+            (
+                format!("/api/v2/acme/workflows/hooks/t1?token={token}&k=v"),
+                "/api/v2/acme/workflows/hooks/t1?token=o2wh_…&k=v".to_string(),
+            ),
+            (
+                format!("/api/v2/acme/workflows/hooks/t1/runs/r1?s={secret}#x"),
+                "/api/v2/acme/workflows/hooks/t1/runs/r1?s=whsec_…#x".to_string(),
+            ),
+            (format!("/x/{secret}/y"), "/x/whsec_…/y".to_string()),
+        ] {
+            assert_eq!(mask_log_url(&url), masked);
+            assert_eq!(mask_share_tokens(&url), masked);
+            assert!(!mask_share_tokens(&url).contains(&token[5..]));
+            assert!(!mask_share_tokens(&url).contains(&secret[6..]));
+        }
+        for untouched in [
+            "/api/v2/acme/workflows/hooks/t1?key=o2wh",
+            "/api/v2/acme/workflows/hooks/xo2wh_abc",
+            "/api/v2/acme/workflows/hooks/t1?v=awhsec_x",
+        ] {
+            assert_eq!(mask_share_tokens(untouched), untouched);
+        }
+    }
+
+    #[test]
+    fn encoded_or_uppercase_hook_credentials_are_masked() {
+        let tail = "AbCdEfGhIjKlMnOpQrStUvWxYz0123456789abcde";
+        for (url, masked) in [
+            (
+                format!("/api/v2/acme/workflows/hooks/t1?token=o2wh%5F{tail}&k=v"),
+                "/api/v2/acme/workflows/hooks/t1?token=o2wh%5F…&k=v",
+            ),
+            (
+                format!("/api/v2/acme/workflows/hooks/t1?s=WHSEC%5f{tail}"),
+                "/api/v2/acme/workflows/hooks/t1?s=WHSEC%5f…",
+            ),
+            (
+                format!("/api/v2/acme/workflows/hooks/O2WH_{tail}"),
+                "/api/v2/acme/workflows/hooks/O2WH_…",
+            ),
+            (
+                format!("/api/v2/acme/workflows/hooks/t1?v=%6F2wh_{tail}"),
+                "/api/v2/acme/workflows/hooks/t1?v=%6F2wh_…",
+            ),
+        ] {
+            assert_eq!(mask_log_url(&url), masked);
+            assert!(!mask_share_tokens(&url).contains(tail), "{url}");
+        }
+        assert_eq!(
+            mask_share_tokens("/api/v2/acme/workflows/hooks/t1?v=o2wh%5"),
+            "/api/v2/acme/workflows/hooks/t1?v=o2wh%5"
+        );
+    }
+
+    #[test]
+    fn webhook_signature_header_is_redacted() {
+        assert!(REDACTED_REQUEST_HEADERS.contains(&"webhook-signature"));
+        assert!(REDACTED_REQUEST_HEADERS.contains(&"authorization"));
+    }
+
     #[test]
     fn slack_callback_secrets_never_reach_the_access_log() {
         for (url, masked) in [
diff --git a/src/config/src/config.rs b/src/config/src/config.rs
index 2bf46229e3..41dd45242b 100644
--- a/src/config/src/config.rs
+++ b/src/config/src/config.rs
@@ -131,7 +131,9 @@ pub type RwBTreeMap<K, V> = tokio::sync::RwLock<BTreeMap<K, V>>;
 // 131: org domain mapping migrations
 // 132: create oncall_chat_messages; add oncall_teams slack columns.
 // 133: add status page run streaks to synthetics.
-pub const DB_SCHEMA_VERSION: u64 = 133;
+// 134: add write_version to llm_dataset_items, so one write request is one Dataset version.
+// 135: create the three workflow HTTP trigger tables; index workflow_run_data.run_id.
+pub const DB_SCHEMA_VERSION: u64 = 135;
 pub const DB_SCHEMA_KEY: &str = "/db_schema_version/";
 
 // global version variables
@@ -3284,6 +3286,72 @@ pub struct Limit {
         help = "Default is 30 days, how many days in past to retain the errored workflow input files"
     )]
     pub workflow_error_retention_secs: i64,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_IP_RPM",
+        default = 6000,
+        help = "Requests per minute one client IP may send to workflow HTTP endpoints"
+    )]
+    pub workflow_hook_ip_rpm: u32,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_PREAUTH_SLOTS",
+        default = 256,
+        help = "Workflow HTTP endpoint requests read at once before authentication"
+    )]
+    pub workflow_hook_preauth_slots: usize,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_UNRESOLVED_IP_SLOTS",
+        default = 16,
+        help = "Pre-authentication slots shared by requests whose client IP is unknown"
+    )]
+    pub workflow_hook_unresolved_ip_slots: usize,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_ORG_RPM",
+        default = 1200,
+        help = "Workflow HTTP endpoint requests per minute per organization"
+    )]
+    pub workflow_hook_org_rpm: u32,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_ORG_BYTES_PER_MIN",
+        default = 16777216,
+        help = "Workflow HTTP endpoint body bytes per minute per organization; run history keeps about 3x this per minute for ZO_WORKFLOW_ERROR_RETAIN_DURATION"
+    )]
+    pub workflow_hook_org_bytes_per_min: u32,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_ORG_QUEUE_MAX",
+        default = 1000,
+        help = "Queued workflow HTTP runs allowed per organization"
+    )]
+    pub workflow_hook_org_queue_max: u64,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_ORG_CONCURRENCY",
+        default = 2,
+        help = "Workflow HTTP runs executing at once per organization, at most ZO_WORKFLOW_HOOK_CONCURRENCY"
+    )]
+    pub workflow_hook_org_concurrency: u64,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_CONCURRENCY",
+        default = 8,
+        help = "Workflow HTTP runs executing at once per region"
+    )]
+    pub workflow_hook_concurrency: u64,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_RUN_TIMEOUT",
+        default = 900,
+        help = "Seconds a workflow HTTP run may take before it is cancelled"
+    )]
+    pub workflow_hook_run_timeout_secs: u64,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_QUEUE_TTL",
+        default = 3600,
+        help = "Seconds a workflow HTTP run may wait in the queue before it expires"
+    )]
+    pub workflow_hook_queue_ttl_secs: u64,
+    #[env_config(
+        name = "ZO_WORKFLOW_HOOK_WORKER_DISABLED",
+        default = false,
+        help = "Never run the workflow HTTP worker on this node"
+    )]
+    pub workflow_hook_worker_disabled: bool,
 }
 
 #[derive(Serialize, EnvConfig, Default)]
@@ -4232,9 +4300,47 @@ fn check_limit_config(cfg: &mut Config) -> Result<(), anyhow::Error> {
 
     cfg.limit.editor_suggest_mode = normalize_editor_suggest_mode(&cfg.limit.editor_suggest_mode)?;
 
+    check_workflow_hook_limits(&mut cfg.limit);
+
     Ok(())
 }
 
+fn check_workflow_hook_limits(limit: &mut Limit) {
+    if limit.workflow_hook_ip_rpm == 0 {
+        limit.workflow_hook_ip_rpm = 6000;
+    }
+    if limit.workflow_hook_preauth_slots == 0 {
+        limit.workflow_hook_preauth_slots = 256;
+    }
+    if limit.workflow_hook_unresolved_ip_slots == 0 {
+        limit.workflow_hook_unresolved_ip_slots = 16;
+    }
+    if limit.workflow_hook_org_rpm == 0 {
+        limit.workflow_hook_org_rpm = 1200;
+    }
+    if limit.workflow_hook_org_bytes_per_min == 0 {
+        limit.workflow_hook_org_bytes_per_min = 16777216;
+    }
+    if limit.workflow_hook_org_queue_max == 0 {
+        limit.workflow_hook_org_queue_max = 1000;
+    }
+    if limit.workflow_hook_org_concurrency == 0 {
+        limit.workflow_hook_org_concurrency = 2;
+    }
+    if limit.workflow_hook_concurrency == 0 {
+        limit.workflow_hook_concurrency = 8;
+    }
+    if limit.workflow_hook_run_timeout_secs == 0 {
+        limit.workflow_hook_run_timeout_secs = 900;
+    }
+    if limit.workflow_hook_queue_ttl_secs == 0 {
+        limit.workflow_hook_queue_ttl_secs = 3600;
+    }
+    limit.workflow_hook_org_concurrency = limit
+        .workflow_hook_org_concurrency
+        .min(limit.workflow_hook_concurrency);
+}
+
 fn normalize_editor_suggest_mode(raw: &str) -> Result<String, anyhow::Error> {
     let mode = raw.trim().to_lowercase();
     match mode.as_str() {
@@ -6558,6 +6664,37 @@ mod tests {
         );
     }
 
+    #[test]
+    fn workflow_hook_limits_replace_zeros_and_cap_org_concurrency() {
+        let mut cfg = Config::init().unwrap();
+        cfg.limit.workflow_hook_ip_rpm = 0;
+        cfg.limit.workflow_hook_org_bytes_per_min = 0;
+        cfg.limit.workflow_hook_queue_ttl_secs = 0;
+        cfg.limit.workflow_hook_concurrency = 3;
+        cfg.limit.workflow_hook_org_concurrency = 5;
+        check_limit_config(&mut cfg).unwrap();
+        assert_eq!(cfg.limit.workflow_hook_ip_rpm, 6000);
+        assert_eq!(cfg.limit.workflow_hook_org_bytes_per_min, 16_777_216);
+        assert_eq!(cfg.limit.workflow_hook_queue_ttl_secs, 3600);
+        assert_eq!(cfg.limit.workflow_hook_org_concurrency, 3);
+
+        let defaults = Config::init().unwrap().limit;
+        assert_eq!(
+            (
+                defaults.workflow_hook_org_rpm,
+                defaults.workflow_hook_org_bytes_per_min,
+                defaults.workflow_hook_org_queue_max,
+                defaults.workflow_hook_concurrency,
+                defaults.workflow_hook_org_concurrency,
+                defaults.workflow_hook_run_timeout_secs,
+                defaults.workflow_hook_preauth_slots,
+                defaults.workflow_hook_unresolved_ip_slots,
+            ),
+            (1200, 16_777_216, 1000, 8, 2, 900, 256, 16)
+        );
+        assert!(!defaults.workflow_hook_worker_disabled);
+    }
+
     #[test]
     fn test_check_limit_config_batch_size_clamping() {
         let mut cfg = Config::init().unwrap();
diff --git a/src/config/src/meta/alerts/incidents.rs b/src/config/src/meta/alerts/incidents.rs
index 65c7ab5dea..e53610b333 100644
--- a/src/config/src/meta/alerts/incidents.rs
+++ b/src/config/src/meta/alerts/incidents.rs
@@ -638,6 +638,11 @@ pub enum IncidentEventType {
         reason: String,
     },
 
+    /// A person resolved one of the incident's pages, which ended its acknowledgement.
+    AckEndedByPageResolve {
+        user_id: String,
+    },
+
     DimensionsUpgraded {
         from_key: String,
         to_key: String,
@@ -748,6 +753,7 @@ impl IncidentEventType {
         "Acknowledged",
         "Resolved",
         "Reopened",
+        "AckEndedByPageResolve",
         "DimensionsUpgraded",
         "TitleChanged",
         "AssignmentChanged",
@@ -832,6 +838,12 @@ impl IncidentEvent {
         Self::now(IncidentEventType::Resolved { user_id })
     }
 
+    pub fn ack_ended_by_page_resolve(user_id: impl Into<String>) -> Self {
+        Self::now(IncidentEventType::AckEndedByPageResolve {
+            user_id: user_id.into(),
+        })
+    }
+
     pub fn reopened(user_id: impl Into<String>, reason: impl Into<String>) -> Self {
         Self::now(IncidentEventType::Reopened {
             user_id: user_id.into(),
@@ -1091,6 +1103,9 @@ mod tests {
                 user_id: "u".into(),
                 reason: "r".into(),
             },
+            IncidentEventType::AckEndedByPageResolve {
+                user_id: "u".into(),
+            },
             IncidentEventType::DimensionsUpgraded {
                 from_key: "a".into(),
                 to_key: "b".into(),
diff --git a/src/config/src/meta/dashboards/v8/mod.rs b/src/config/src/meta/dashboards/v8/mod.rs
index d4a3d94755..f5efd371ad 100644
--- a/src/config/src/meta/dashboards/v8/mod.rs
+++ b/src/config/src/meta/dashboards/v8/mod.rs
@@ -1261,6 +1261,10 @@ pub struct VariableList {
     pub tabs: Option<Vec<String>>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub panels: Option<Vec<String>>,
+    /// A date variable's output when its placeholder names no format: `iso`, `dmy`, `mdy`,
+    /// `epoch`, `epochms` or `epochus`; `iso` when unset.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub date_format: Option<String>,
 }
 
 #[derive(Default, Debug, Clone, PartialEq, Hash, Serialize, Deserialize, ToSchema)]
@@ -1892,6 +1896,17 @@ mod tests {
         assert!(json.contains("customMultiSelectValue"));
     }
 
+    #[test]
+    fn test_variable_list_keeps_a_date_variable_s_format() {
+        let vl: VariableList =
+            serde_json::from_str(r#"{"type":"date","name":"day","dateFormat":"epochus"}"#).unwrap();
+        assert_eq!(vl.date_format.as_deref(), Some("epochus"));
+        let json = serde_json::to_string(&vl).unwrap();
+        assert!(json.contains(r#""dateFormat":"epochus""#));
+        let json = serde_json::to_string(&VariableList::default()).unwrap();
+        assert!(!json.contains("dateFormat"));
+    }
+
     #[test]
     fn test_datetime_options_none_fields_absent() {
         let opts = DateTimeOptions {
diff --git a/src/config/src/meta/eval_job_health.rs b/src/config/src/meta/eval_job_health.rs
index f73b0af9bf..b86b5b5606 100644
--- a/src/config/src/meta/eval_job_health.rs
+++ b/src/config/src/meta/eval_job_health.rs
@@ -22,11 +22,12 @@ use serde::{Deserialize, Serialize};
 #[serde(rename_all = "snake_case")]
 pub enum EvalJobHealth {
     Healthy,
-    /// More than 20% of at least 5 recent scorer runs failed.
+    /// More than 20% of at least 5 recent scorer runs failed, or nothing ran recently and the
+    /// lookback's newest outcome is an error.
     Degraded,
     /// The newest scorer outcome is a `provider_auth` error.
     WaitingForCredentials,
-    /// No scorer ran in the recent window.
+    /// No scorer ran in the 24-hour lookback.
     NoRecentRuns,
 }
 
diff --git a/src/config/src/meta/feature.rs b/src/config/src/meta/feature.rs
new file mode 100644
index 0000000000..fd1d449ed6
--- /dev/null
+++ b/src/config/src/meta/feature.rs
@@ -0,0 +1,110 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+use serde::Serialize;
+use strum::{EnumIter, EnumString, IntoEnumIterator, IntoStaticStr};
+
+/// Product features as tags; the snake_case name is the gate-definition and license key.
+#[derive(
+    Clone, Copy, Debug, PartialEq, Eq, Hash, EnumString, IntoStaticStr, Serialize, EnumIter,
+)]
+#[strum(serialize_all = "snake_case")]
+#[serde(rename_all = "snake_case")]
+#[repr(u64)]
+pub enum Feature {
+    AiObservability,
+    AiAssistant,
+    Workflows,
+    Oncall,
+    Incidents,
+    Logs,
+    Metrics,
+    Traces,
+    Rum,
+    ProductAnalytics,
+    Synthetics,
+    DbMonitoring,
+    Correlation,
+    Dashboards,
+    Reports,
+    Alerts,
+    Pipelines,
+    AiToolsets,
+    Mcp,
+    Ratelimit,
+    AnomalyDetection,
+    ContinuousProfiling,
+    KubernetesMonitoring,
+    HostMonitoring,
+    Sso,
+    Rbac,
+    AuditTrail,
+    QueryManagement,
+    SuperCluster,
+    Byob,
+}
+
+impl Feature {
+    /// Key of this feature in the entitlement set.
+    #[inline]
+    pub const fn index(self) -> u64 {
+        self as u64
+    }
+
+    pub fn all() -> impl Iterator<Item = Feature> {
+        <Self as IntoEnumIterator>::iter()
+    }
+}
+
+#[derive(Clone, Copy, Serialize)]
+#[serde(rename_all = "lowercase")]
+pub enum FeatureState {
+    Enabled,
+    Locked,
+    Hidden,
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{collections::HashSet, str::FromStr};
+
+    use super::*;
+
+    #[test]
+    fn keys_round_trip() {
+        for (key, f) in [
+            ("ai_assistant", Feature::AiAssistant),
+            ("oncall", Feature::Oncall),
+            ("product_analytics", Feature::ProductAnalytics),
+            ("correlation", Feature::Correlation),
+            ("rbac", Feature::Rbac),
+            ("byob", Feature::Byob),
+        ] {
+            assert_eq!(Feature::from_str(key).unwrap(), f);
+            assert_eq!(<&str>::from(f), key);
+        }
+        assert!(Feature::from_str("ai").is_err());
+        assert!(Feature::from_str("all").is_err());
+        assert!(Feature::from_str("rum_source_maps").is_err());
+        assert!(Feature::from_str("downtimes").is_err());
+    }
+
+    #[test]
+    fn indices_are_unique() {
+        let indices: HashSet<u64> = Feature::all().map(Feature::index).collect();
+        assert_eq!(indices.len(), Feature::all().count());
+        assert_eq!(Feature::all().count(), 30);
+    }
+}
diff --git a/src/config/src/meta/fleet.rs b/src/config/src/meta/fleet.rs
index ac4d8b1980..cc481bb8d3 100644
--- a/src/config/src/meta/fleet.rs
+++ b/src/config/src/meta/fleet.rs
@@ -438,11 +438,37 @@ pub struct AuditList {
     pub audit_disabled: bool,
 }
 
-#[derive(Clone, Debug, PartialEq, Serialize, Deserialize, ToSchema, IntoParams)]
+#[derive(Clone, Debug, Default, PartialEq, Serialize, Deserialize, ToSchema, IntoParams)]
 #[into_params(parameter_in = Query)]
 pub struct AuditQuery {
+    /// Epoch milliseconds; defaults to 30 days before `to`.
     pub from: Option<i64>,
+    /// Epoch milliseconds, exclusive; defaults to now.
     pub to: Option<i64>,
+    #[serde(default)]
+    pub offset: Option<usize>,
+    #[serde(default)]
+    pub limit: Option<usize>,
+    /// Only this fleet's events, which leaves out org-wide ones.
+    #[serde(default)]
+    pub fleet: Option<String>,
+    #[serde(default)]
+    pub module: Option<AuditModule>,
+    /// Matches the actor or the target, ignoring case.
+    #[serde(default)]
+    pub q: Option<String>,
+}
+
+/// The part of the fleet API an event was made through; `settings` is the org's fleet settings.
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "lowercase")]
+pub enum AuditModule {
+    Collectors,
+    Tokens,
+    Fleets,
+    Rollouts,
+    Configs,
+    Settings,
 }
 
 /// Per-fleet overrides; `None` inherits the organization default.
diff --git a/src/config/src/meta/mod.rs b/src/config/src/meta/mod.rs
index 3ad45523dd..8766aa90b6 100644
--- a/src/config/src/meta/mod.rs
+++ b/src/config/src/meta/mod.rs
@@ -25,6 +25,7 @@ pub mod destinations;
 pub mod downtimes;
 pub mod enrichment_table;
 pub mod eval_job_health;
+pub mod feature;
 pub mod fleet;
 pub mod folder;
 pub mod function;
diff --git a/src/config/src/meta/model_pricing.rs b/src/config/src/meta/model_pricing.rs
index ce04b30d52..8dc5622641 100644
--- a/src/config/src/meta/model_pricing.rs
+++ b/src/config/src/meta/model_pricing.rs
@@ -117,6 +117,35 @@ impl MatchKind {
     }
 }
 
+/// Stream column that marks how ingest priced an LLM span. Exact non-zero prices and
+/// client-reported costs leave it unset, so streams written before it existed have no such
+/// column.
+pub const COST_STATUS_COLUMN: &str = "gen_ai_usage_cost_status";
+
+/// How ingest priced an LLM span whose cost is not an exact non-zero price; stored in
+/// [`COST_STATUS_COLUMN`].
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize, ToSchema)]
+#[serde(rename_all = "snake_case")]
+pub enum CostStatus {
+    /// No pricing definition matched the model: the span keeps its tokens and has no cost.
+    Unpriced,
+    /// A pattern matched only part of the model name; the cost uses that pattern's prices.
+    Approximate,
+    /// The model matched a price exactly and the span costs nothing (a free or muted model).
+    /// The zero cost is a real price, unlike the zero legacy spans stored for no price.
+    Free,
+}
+
+impl CostStatus {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            CostStatus::Unpriced => "unpriced",
+            CostStatus::Approximate => "approximate",
+            CostStatus::Free => "free",
+        }
+    }
+}
+
 /// A model pricing definition that maps model names (via regex) to pricing tiers.
 #[derive(Clone, Debug, Serialize, Deserialize, Default, ToSchema)]
 #[serde(default)]
diff --git a/src/config/src/meta/oncall/preset.rs b/src/config/src/meta/oncall/preset.rs
index 0c3f259451..e2170d0529 100644
--- a/src/config/src/meta/oncall/preset.rs
+++ b/src/config/src/meta/oncall/preset.rs
@@ -60,6 +60,9 @@ const MINUTES_PER_DAY: u32 = 1440;
 
 const DEFAULT_BUSINESS_START_MINUTE: u32 = 9 * 60;
 const DEFAULT_BUSINESS_END_MINUTE: u32 = 17 * 60;
+/// Thursday 00:00: the boundary the split-the-week summary describes before anything is chosen.
+const DEFAULT_SPLIT_BOUNDARY_DAY: u8 = 3;
+const DEFAULT_SPLIT_BOUNDARY_MINUTE: u32 = 0;
 
 fn default_business_days() -> Vec<u8> {
     vec![0, 1, 2, 3, 4]
@@ -73,6 +76,14 @@ fn default_business_end() -> u32 {
     DEFAULT_BUSINESS_END_MINUTE
 }
 
+fn default_split_boundary_day() -> u8 {
+    DEFAULT_SPLIT_BOUNDARY_DAY
+}
+
+fn default_split_boundary_minute() -> u32 {
+    DEFAULT_SPLIT_BOUNDARY_MINUTE
+}
+
 /// Which preset. Serialises to the id the catalogue publishes.
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Hash, Serialize, Deserialize, ToSchema)]
 #[serde(rename_all = "snake_case")]
@@ -156,9 +167,11 @@ pub enum PresetSpec {
         first: Group,
         /// Covers from the boundary to the end of the week.
         second: Group,
-        /// 0 = Monday … 6 = Sunday.
+        /// 0 = Monday … 6 = Sunday. Defaults to Thursday.
+        #[serde(default = "default_split_boundary_day")]
         boundary_day: u8,
-        /// Minutes from midnight in the team's timezone.
+        /// Minutes from midnight in the team's timezone. Defaults to 00:00.
+        #[serde(default = "default_split_boundary_minute")]
         boundary_minute: u32,
     },
     /// A working-hours layer over an out-of-hours catch-all.
@@ -1018,8 +1031,10 @@ pub fn catalogue() -> Vec<PresetDescriptor> {
                     "Hand over on",
                     "0 = Monday … 6 = Sunday. Monday 00:00 is refused: it would give the first group none of the week.",
                 )
-                .bounded(0, 6),
-                minute_input("boundary_minute", "Hand over at"),
+                .bounded(0, 6)
+                .defaulting(serde_json::json!(DEFAULT_SPLIT_BOUNDARY_DAY)),
+                minute_input("boundary_minute", "Hand over at")
+                    .defaulting(serde_json::json!(DEFAULT_SPLIT_BOUNDARY_MINUTE)),
             ]),
         },
         PresetDescriptor {
@@ -1795,6 +1810,38 @@ mod tests {
         );
     }
 
+    /// The split-the-week form opens on the boundary its summary shows, so Save works untouched.
+    #[test]
+    fn test_split_the_week_defaults_to_thursday_midnight() {
+        let entries = catalogue();
+        let split = entries
+            .iter()
+            .find(|e| e.id == PresetId::SplitTheWeek)
+            .unwrap();
+        let default_of = |field: &str| {
+            let input = split.inputs.iter().find(|i| i.field == field).unwrap();
+            assert!(!input.required, "{field} is still required");
+            input.default.clone()
+        };
+        assert_eq!(default_of("boundary_day"), Some(serde_json::json!(3)));
+        assert_eq!(default_of("boundary_minute"), Some(serde_json::json!(0)));
+        let spec: PresetSpec = serde_json::from_str(
+            r#"{"preset":"split_the_week",
+                "first":{"members":["ana@o2.ai"]},
+                "second":{"members":["bo@o2.ai"]}}"#,
+        )
+        .unwrap();
+        let rotations = build(&spec, chrono_tz::UTC, MONDAY, DEFAULT_HANDOVER_MICROS).unwrap();
+        assert_eq!(
+            rotations[0].restrictions,
+            vec![TimeWindow {
+                days: vec![0, 1, 2],
+                start_minute: 0,
+                end_minute: MINUTES_PER_DAY,
+            }]
+        );
+    }
+
     /// A region whose hours straddle local midnight is a normal thing to
     /// describe, and it must not be mistaken for an empty window.
     #[test]
diff --git a/src/config/src/meta/oncall/response.rs b/src/config/src/meta/oncall/response.rs
index d53a32eaae..afcf89cb0c 100644
--- a/src/config/src/meta/oncall/response.rs
+++ b/src/config/src/meta/oncall/response.rs
@@ -78,6 +78,17 @@ pub fn snoozed_ladder_anchor(
     existing_anchor.unwrap_or(opened_at) + (until - quiet_reaches).max(0)
 }
 
+/// Where the ladder's clock sits when a snooze ends early at `now`: as if it had been that short.
+pub fn unsnoozed_ladder_anchor(
+    existing_anchor: Option<i64>,
+    opened_at: i64,
+    snoozed_until: Option<i64>,
+    now: i64,
+) -> i64 {
+    let unused = snoozed_until.map_or(0, |until| (until - now).max(0));
+    existing_anchor.unwrap_or(opened_at) - unused
+}
+
 /// Lifecycle of a response record: `triggered → triaged → acknowledged →
 /// resolved`. `triaged` comes from the L0 agent and is skipped entirely when
 /// the agent is absent or disabled.
@@ -1711,6 +1722,27 @@ mod tests {
                 17 * MIN
             );
         }
+
+        /// Ending a snooze early gives back the unused quiet, so the rungs keep their gaps from
+        /// where the ladder paused instead of waiting out the rest of the snooze.
+        #[test]
+        fn test_unsnoozing_leaves_the_clock_where_a_snooze_that_short_would() {
+            let snoozed = snoozed_ladder_anchor(None, 0, None, MIN, 61 * MIN);
+            assert_eq!(
+                unsnoozed_ladder_anchor(Some(snoozed), 0, Some(61 * MIN), 3 * MIN),
+                snoozed_ladder_anchor(None, 0, None, MIN, 3 * MIN),
+            );
+        }
+
+        /// A snooze that has already lapsed has no quiet left to give back.
+        #[test]
+        fn test_unsnoozing_a_lapsed_snooze_leaves_the_clock() {
+            let snoozed = snoozed_ladder_anchor(None, 0, None, MIN, 61 * MIN);
+            assert_eq!(
+                unsnoozed_ladder_anchor(Some(snoozed), 0, Some(61 * MIN), 90 * MIN),
+                snoozed
+            );
+        }
     }
 
     #[test]
diff --git a/src/config/src/meta/public_dashboards.rs b/src/config/src/meta/public_dashboards.rs
index e5f9b3ebb5..b45716732a 100644
--- a/src/config/src/meta/public_dashboards.rs
+++ b/src/config/src/meta/public_dashboards.rs
@@ -430,6 +430,12 @@ pub struct PublicVariable {
     /// Set for a panel-scoped variable: the panel this value belongs to.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub panel_id: Option<String>,
+    /// `date` for a date variable, so the page formats titles and text as the dashboard does.
+    #[serde(rename = "type", default, skip_serializing_if = "Option::is_none")]
+    pub var_type: Option<String>,
+    /// A date variable's default output format.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub date_format: Option<String>,
 }
 
 impl PublicVariable {
@@ -474,6 +480,7 @@ impl PublicVariable {
                             .collect(),
                         _ => vec![(v.name.clone(), None, None)],
                     };
+                let is_date = v.type_field == "date";
                 instances
                     .into_iter()
                     .map(|(key, tab_id, panel_id)| {
@@ -483,6 +490,8 @@ impl PublicVariable {
                             value: values.get(&key).cloned().unwrap_or(serde_json::Value::Null),
                             tab_id,
                             panel_id,
+                            var_type: is_date.then(|| "date".to_string()),
+                            date_format: v.date_format.clone().filter(|_| is_date),
                         };
                         (key, entry)
                     })
@@ -785,6 +794,35 @@ mod tests {
         assert_eq!(stored.name, "");
     }
 
+    #[test]
+    fn public_variables_carry_a_date_variables_format() {
+        let dash = Dashboard {
+            v8: Some(
+                serde_json::from_value(serde_json::json!({
+                    "variables": { "list": [
+                        { "type": "date", "name": "day", "label": "Day",
+                          "dateFormat": "dmy" },
+                        { "type": "textbox", "name": "q", "label": "Q",
+                          "dateFormat": "dmy" }
+                    ] }
+                }))
+                .unwrap(),
+            ),
+            ..Default::default()
+        };
+        let values = BTreeMap::from([("day".to_string(), serde_json::json!("2026-10-30"))]);
+        let list = PublicVariable::list(&dash, &values);
+        let day = serde_json::to_value(&list[0]).unwrap();
+        assert_eq!(day["type"], "date");
+        assert_eq!(day["date_format"], "dmy");
+        let q = serde_json::to_value(&list[1]).unwrap();
+        assert!(q.get("type").is_none() && q.get("date_format").is_none());
+        let stored: PublicVariable =
+            serde_json::from_value(serde_json::json!({ "label": "Day", "value": "2026-10-30" }))
+                .unwrap();
+        assert_eq!(stored.var_type, None);
+    }
+
     #[test]
     fn identity_names_the_org() {
         assert_eq!(
diff --git a/src/config/src/meta/self_reporting/llm_experiments.rs b/src/config/src/meta/self_reporting/llm_experiments.rs
index 1eb0668f6a..f58d6aef80 100644
--- a/src/config/src/meta/self_reporting/llm_experiments.rs
+++ b/src/config/src/meta/self_reporting/llm_experiments.rs
@@ -103,6 +103,11 @@ pub struct ExperimentExecutionRecord {
     pub output: Option<serde_json::Value>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub error_message: Option<String>,
+    /// Failure class from the shared evaluation taxonomy (`provider_auth`,
+    /// `timeout`, `execution_error`, …). Absent on records written before it
+    /// existed, which group by message alone.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub error_kind: Option<String>,
     /// Permanent reason an intentionally ineligible slot was not executed.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub skip_reason: Option<ExperimentSkipReason>,
@@ -148,6 +153,7 @@ impl ExperimentExecutionRecord {
         Self {
             output: Some(serde_json::Value::String(String::new())),
             error_message: Some(String::new()),
+            error_kind: Some(String::new()),
             skip_reason: Some(ExperimentSkipReason::NoReference),
             error_attempt_count: Some(0),
             latency_ms: Some(0),
@@ -334,6 +340,7 @@ mod tests {
             status: ExperimentExecutionStatus::Ok,
             output: Some(json!("It ships tomorrow")),
             error_message: None,
+            error_kind: None,
             skip_reason: None,
             error_attempt_count: None,
             latency_ms: Some(42),
@@ -367,6 +374,7 @@ mod tests {
             "status",
             "output",
             "error_message",
+            "error_kind",
             "skip_reason",
             "error_attempt_count",
             "latency_ms",
diff --git a/src/config/src/meta/slack.rs b/src/config/src/meta/slack.rs
index 211ab8e24f..1dd87b2171 100644
--- a/src/config/src/meta/slack.rs
+++ b/src/config/src/meta/slack.rs
@@ -109,6 +109,7 @@ pub enum SetFrom {
 #[serde(rename_all = "snake_case")]
 pub enum DisabledReason {
     Edition,
+    License,
     Flag,
     MasterKey,
     SuperCluster,
diff --git a/src/config/src/meta/synthetics.rs b/src/config/src/meta/synthetics.rs
index d0df50ff5a..cbd578f0ae 100644
--- a/src/config/src/meta/synthetics.rs
+++ b/src/config/src/meta/synthetics.rs
@@ -1297,9 +1297,10 @@ fn validate_net_retry_budget(
         } else {
             String::new()
         };
+        let or = if retries_fix.is_empty() { "" } else { "or " };
         return Err(format!(
             "config: this check needs up to {} per run, which is over the {} check budget. To fix \
-             it, {retries_fix}or lower config.timeout_ms (currently {}). Detail: {} attempt(s) x \
+             it, {retries_fix}{or}lower config.timeout_ms (currently {}). Detail: {} attempt(s) x \
              {} each, plus {}s between retries. A check that outlives the budget is killed mid-run \
              by the probe's function timeout and reports a failure the target never had.",
             human_ms(worst_case_ms),
@@ -2291,9 +2292,14 @@ fn validate_browser_config(
         } else {
             String::new()
         };
+        let or = if combos_fix.is_empty() && retries_fix.is_empty() {
+            ""
+        } else {
+            "or "
+        };
         return Err(format!(
             "config: this check needs up to {} per run, which is over the {} check budget. To fix \
-             it, {combos_fix}{retries_fix}or shorten the run with config.journey_budget_ms \
+             it, {combos_fix}{retries_fix}{or}shorten the run with config.journey_budget_ms \
              (currently {}). Detail: {devices} browser/device combo(s) x {attempts} attempt(s) x \
              {} each, plus {}s between retries. A run that outlives the budget is killed \
              mid-journey by the probe's function timeout.",
@@ -4304,6 +4310,30 @@ mod tests {
         assert!(retries_at < budget_at, "reachable lever first: {err}");
     }
 
+    #[test]
+    fn over_budget_message_with_only_the_budget_lever_has_no_dangling_or() {
+        let (locs, brs, devs) = allowed();
+        let mut s = valid_browser_synthetic();
+        s.retries = 0;
+        s.config["journey_budget_ms"] = serde_json::json!(MAX_JOURNEY_BUDGET_MS);
+        let err = s.validate(&locs, &brs, &devs, true).unwrap_err();
+        assert!(
+            err.contains(
+                "To fix it, shorten the run with config.journey_budget_ms (currently 15m)"
+            ),
+            "{err}"
+        );
+        assert!(!err.contains("To fix it, or"), "{err}");
+
+        s.retries = 1;
+        s.config["journey_budget_ms"] = serde_json::json!(450_000);
+        let err = s.validate(&locs, &brs, &devs, true).unwrap_err();
+        assert!(
+            err.contains("To fix it, lower retries below 1, or shorten the run"),
+            "{err}"
+        );
+    }
+
     /// Two browser/device combos with the web form's own default `retries: 1`
     /// and the server default budget land at 2 x (2 x 300s + 5s) = 1210s, past
     /// the 840s check budget — so "Chromium desktop + Chromium mobile" cannot be
diff --git a/src/config/src/meta/traces.rs b/src/config/src/meta/traces.rs
index 21de380359..d4d131f939 100644
--- a/src/config/src/meta/traces.rs
+++ b/src/config/src/meta/traces.rs
@@ -16,6 +16,13 @@
 /// Sentinel column whose presence indicates the new `gen_ai_*` schema.
 pub const GEN_AI_SENTINEL_COLUMN: &str = "gen_ai_usage_input_tokens";
 
+/// Stored column holding a span's Gen-AI operation (`chat`, `invoke_agent`, ...).
+pub const GEN_AI_OPERATION_NAME_COLUMN: &str = "gen_ai_operation_name";
+
+/// Operations that are LLM calls: the spans ingest prices and trace/session totals sum.
+pub const GENERATION_GEN_AI_OPERATIONS: &[&str] =
+    &["chat", "text_completion", "generate_content", "embeddings"];
+
 /// Required fields for the new (gen_ai_*) schema. If any are missing, the
 /// query is rejected with a clear error.
 pub const REQUIRED_GEN_AI_FIELDS: &[&str] = &[
diff --git a/src/config/src/metrics/base.rs b/src/config/src/metrics/base.rs
index cabee38b17..742f67078e 100644
--- a/src/config/src/metrics/base.rs
+++ b/src/config/src/metrics/base.rs
@@ -3096,6 +3096,22 @@ pub static PUBLIC_DASHBOARD_LINKS: Lazy<IntGaugeVec> = Lazy::new(|| {
     .expect("Metric created")
 });
 
+/// HTTP trigger snapshots this region failed to apply; each failure is left for redelivery.
+pub static WORKFLOW_HOOK_SNAPSHOT_APPLY_FAILURES: Lazy<IntCounterVec> = Lazy::new(|| {
+    IntCounterVec::new(
+        Opts::new(
+            "workflow_hook_snapshot_apply_failures_total",
+            "Workflow HTTP trigger snapshots that failed to apply and will be redelivered"
+                .to_owned()
+                + HELP_SUFFIX,
+        )
+        .namespace(NAMESPACE)
+        .const_labels(create_const_labels()),
+        &["origin_cluster"],
+    )
+    .expect("Metric created")
+});
+
 pub(crate) fn register(registry: &Registry) {
     // http latency
     registry
@@ -3123,6 +3139,9 @@ pub(crate) fn register(registry: &Registry) {
     registry
         .register(Box::new(INGEST_RECORDS_DROPPED.clone()))
         .expect("Metric registered");
+    registry
+        .register(Box::new(WORKFLOW_HOOK_SNAPSHOT_APPLY_FAILURES.clone()))
+        .expect("Metric registered");
 
     // ingester stats
     registry
@@ -3773,6 +3792,26 @@ mod tests {
         let _ = GRPC_RESPONSE_TIME.clone();
     }
 
+    #[test]
+    fn workflow_hook_snapshot_apply_failures_is_registered_under_its_name() {
+        let registry = Registry::new();
+        register(&registry);
+        WORKFLOW_HOOK_SNAPSHOT_APPLY_FAILURES
+            .with_label_values(&["r1"])
+            .inc();
+        let names: Vec<String> = registry
+            .gather()
+            .iter()
+            .map(|family| family.name().to_string())
+            .collect();
+        assert!(
+            names.contains(&format!(
+                "{NAMESPACE}_workflow_hook_snapshot_apply_failures_total"
+            )),
+            "{names:?}"
+        );
+    }
+
     #[test]
     fn test_statics_hec() {
         let _ = HEC_AUTH_TOTAL.clone();
diff --git a/src/config/src/router.rs b/src/config/src/router.rs
index 884ce404d8..d2c9ad5e9c 100644
--- a/src/config/src/router.rs
+++ b/src/config/src/router.rs
@@ -14,7 +14,7 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 /// usize indicates the number of parts to skip based on their actual paths.
-const QUERIER_ROUTES: [(&str, usize); 43] = [
+const QUERIER_ROUTES: [(&str, usize); 47] = [
     ("config", 0),               // /config (unauthenticated bootstrap)
     ("config", 2),               // /api/{org_id}/config (authenticated full)
     ("summary", 2),              // /api/{org_id}/summary
@@ -56,11 +56,16 @@ const QUERIER_ROUTES: [(&str, usize); 43] = [
     ("chat_stream", 3),                       /* /api/{org_id}/ai/chat_stream
                                                * {label_name}/
                                                * values */
-    ("discovery", 2),         // /api/{org_id}/discovery
-    ("annotation_queues", 2), // /api/{org_id}/annotation_queues/...
-    ("playground", 2),        // /api/{org_id}/playground/...
-    ("service_streams", 2),   // /api/{org_id}/service_streams/...
-    ("node/list", 2),         // /api/_meta/node/list
+    ("discovery", 2),           // /api/{org_id}/discovery
+    ("annotation_queues", 2),   // /api/{org_id}/annotation_queues/...
+    ("playground", 2),          // /api/{org_id}/playground/...
+    ("service_streams", 2),     // /api/{org_id}/service_streams/...
+    ("node/list", 2),           // /api/_meta/node/list
+    ("gen_ai/data_health", 2),  // /api/{org_id}/gen_ai/data_health
+    ("llm/models/unpriced", 2), // /api/{org_id}/llm/models/unpriced
+    // Queriers own the built-in GitHub sync, so its node-local sync time lives there.
+    ("llm/models/built-in", 2), // /api/{org_id}/llm/models/built-in
+    ("llm/models/refresh-built-in", 2), // /api/{org_id}/llm/models/refresh-built-in
 ];
 const QUERIER_ROUTES_BY_BODY: [&str; 9] = [
     "/_search",
@@ -240,6 +245,12 @@ mod tests {
         assert!(is_querier_route(
             "/api/org1/traces/time_range?trace_id=a,b,c"
         ));
+        // Built-in catalogue status and refresh read the querier's sync state.
+        assert!(is_querier_route(
+            "/api/org1/llm/models/built-in?metadata_only=true"
+        ));
+        assert!(is_querier_route("/api/org1/llm/models/refresh-built-in"));
+        assert!(!is_querier_route("/api/org1/llm/models"));
         // the org-level entry must not swallow the OTLP ingest route
         assert!(!is_querier_route("/api/org1/traces"));
         for leaf in ["meta", "tag_values", "series", "merge", "diff"] {
diff --git a/src/config/src/utils/time.rs b/src/config/src/utils/time.rs
index 9538a42915..66876bf1ec 100644
--- a/src/config/src/utils/time.rs
+++ b/src/config/src/utils/time.rs
@@ -311,6 +311,27 @@ pub fn parse_timezone_to_offset_at(timezone: &str, reference_micros: i64) -> Opt
     Some(offset.fix().local_minus_utc() as i64)
 }
 
+/// Microseconds since the epoch of 00:00 UTC on `date` (`YYYY-MM-DD`); `None` unless it is a real
+/// calendar date.
+pub fn start_of_date_micros(date: &str) -> Option<i64> {
+    let bytes = date.as_bytes();
+    let shaped = bytes.len() == 10
+        && bytes.iter().enumerate().all(|(i, b)| {
+            if i == 4 || i == 7 {
+                *b == b'-'
+            } else {
+                b.is_ascii_digit()
+            }
+        });
+    if !shaped {
+        return None;
+    }
+    let midnight = chrono::NaiveDate::parse_from_str(date, "%Y-%m-%d")
+        .ok()?
+        .and_hms_opt(0, 0, 0)?;
+    Some(midnight.and_utc().timestamp_micros())
+}
+
 #[inline(always)]
 pub fn parse_str_to_timestamp_micros_as_option(v: &str) -> Option<i64> {
     v.parse()
@@ -786,4 +807,15 @@ mod tests {
         assert_eq!(validate_time_range(11, 10), ordered);
         assert_eq!(validate_time_range(1, 2), Ok(()));
     }
+
+    #[test]
+    fn test_start_of_date_micros() {
+        let s = |date: &str| start_of_date_micros(date).map(|us| us / 1_000_000);
+        assert_eq!(s("2026-01-31"), Some(1_769_817_600));
+        assert_eq!(s("2026-07-01"), Some(1_782_864_000));
+        assert_eq!(s("1969-12-31"), Some(-86_400));
+        for bad in ["2026-02-30", "2026-1-05", "2026/01/05", "", "+2026-01-05"] {
+            assert_eq!(s(bad), None, "{bad}");
+        }
+    }
 }
diff --git a/src/core/Cargo.toml b/src/core/Cargo.toml
index 816cd6f0bd..1819a4212d 100644
--- a/src/core/Cargo.toml
+++ b/src/core/Cargo.toml
@@ -130,6 +130,7 @@ thiserror.workspace = true
 time.workspace = true
 tiktoken-rs.workspace = true
 tokio.workspace = true
+tokio-util.workspace = true
 tonic.workspace = true
 tracing.workspace = true
 tracing-opentelemetry.workspace = true
@@ -149,6 +150,7 @@ zstd.workspace = true
 
 [dev-dependencies]
 infra = { workspace = true, features = ["test-utils"] }
+tokio = { workspace = true, features = ["test-util"] }
 criterion = { version = "0.5", default-features = false, features = ["rayon"] }
 multer.workspace = true
 
diff --git a/src/core/src/alerts/ack.rs b/src/core/src/alerts/ack.rs
index 57102b796a..ead1c0773a 100644
--- a/src/core/src/alerts/ack.rs
+++ b/src/core/src/alerts/ack.rs
@@ -111,6 +111,8 @@ pub enum Verb {
     Unack,
     /// An unack for a hand-off: the hand-off, not the unack, restarts the page it moves.
     HandOff,
+    /// A person fixed the problem: its ack ends and no page restarts.
+    Resolve,
 }
 
 /// Which firing groups of an alert an ack names.
@@ -181,6 +183,15 @@ pub struct PlanFacts {
     /// Who holds the firing groups of the alert the caller did not name.
     pub other_holders: Vec<String>,
     pub pages: Vec<OpenPage>,
+    /// What a page's Resolve may end; `None` ends the whole problem.
+    pub cover: Option<PageCover>,
+}
+
+/// A page covers the firings of its alert that started by the time it closed.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct PageCover {
+    pub alert_id: String,
+    pub closed_at: i64,
 }
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -384,7 +395,7 @@ pub async fn resolve_target(org_id: &str, alert_id: &str) -> Result<AckTarget, A
 pub fn plan(f: &PlanFacts) -> AckPlan {
     match f.verb {
         Verb::Acknowledge | Verb::TakeOver => plan_hold(f),
-        Verb::Unack | Verb::HandOff => plan_release(f),
+        Verb::Unack | Verb::HandOff | Verb::Resolve => plan_release(f),
     }
 }
 
@@ -535,7 +546,7 @@ pub async fn take_over(
 /// [weak: the ack is cleared first; a page that fails to restart stays acknowledged until the next
 /// unack; one restarted with no ladder armed is logged and left to `reconcile_abandoned`]
 pub async fn unack(p: &Problem, actor: &str, source: AckSource) -> Result<UnackResponse, AckError> {
-    release(p, Verb::Unack, actor, source).await
+    release(p, Verb::Unack, actor, source, None).await
 }
 
 /// Clears the problem's ack for a hand-off, which restarts the page it moves.
@@ -546,7 +557,28 @@ pub async fn release_for_hand_off(
     actor: &str,
     source: AckSource,
 ) -> Result<UnackResponse, AckError> {
-    release(p, Verb::HandOff, actor, source).await
+    release(p, Verb::HandOff, actor, source, None).await
+}
+
+/// Ends the covered ack after a person's Resolve. [weak: a retried Resolve clears the rest]
+pub async fn resolve(
+    p: &Problem,
+    actor: &str,
+    source: AckSource,
+    cover: Option<PageCover>,
+) -> Result<UnackResponse, AckError> {
+    release(p, Verb::Resolve, actor, source, cover).await
+}
+
+/// An alert page covers its alert's firings up to its first close; an incident page all. [pure]
+pub fn page_cover(subject: &config::meta::oncall::SubjectRef, closed_at: i64) -> Option<PageCover> {
+    match subject.subject_type {
+        config::meta::oncall::SubjectType::Alert => Some(PageCover {
+            alert_id: source_of_page(&subject.source_id).to_string(),
+            closed_at,
+        }),
+        config::meta::oncall::SubjectType::Incident => None,
+    }
 }
 
 /// A firing that joins an acknowledged incident takes the incident's ack, so nobody is re-paged.
@@ -1044,6 +1076,26 @@ async fn org_editors(org_id: &str) -> Vec<(String, UserRole, Option<String>)> {
     out
 }
 
+/// The records a release ends; a page's Resolve leaves its alert's firings newer than its close.
+fn covered(f: &PlanFacts) -> Vec<&HeldRecord> {
+    let Some(c) = f.cover.as_ref().filter(|_| f.verb == Verb::Resolve) else {
+        return f.records.iter().collect();
+    };
+    let newer = |r: &HeldRecord| {
+        matches!(&r.record, AckRecord::Firing { alert_id, firing_started_at, .. }
+            if *alert_id == c.alert_id && *firing_started_at > c.closed_at)
+    };
+    let incident = f
+        .records
+        .iter()
+        .any(|r| matches!(r.record, AckRecord::Incident { .. }));
+    // An incident is one problem: a page whose alert fired again after it closed covers none of it.
+    if incident && f.records.iter().any(newer) {
+        return vec![];
+    }
+    f.records.iter().filter(|r| !newer(r)).collect()
+}
+
 fn same(a: &str, b: &str) -> bool {
     a.trim().eq_ignore_ascii_case(b.trim())
 }
@@ -1137,13 +1189,13 @@ fn hold_step(p: &OpenPage, f: &PlanFacts, by: &str, take_over: bool) -> PageStep
     }
 }
 
-/// An unack restarts the current pages an ack stopped (D34); a hand-off leaves them be.
+/// An unack restarts the current pages an ack stopped (D34); a hand-off and a resolve do not.
 fn plan_release(f: &PlanFacts) -> AckPlan {
+    let ends = covered(f);
     // Any held record, carried ones too: a retry after a partial clear must finish the job.
-    let held = f.records.iter().any(|r| r.holder.is_some());
+    let held = ends.iter().any(|r| r.holder.is_some());
     let writes = if held {
-        f.records
-            .iter()
+        ends.iter()
             .filter_map(|r| {
                 r.holder
                     .as_ref()
@@ -1203,8 +1255,10 @@ async fn release(
     verb: Verb,
     actor: &str,
     source: AckSource,
+    cover: Option<PageCover>,
 ) -> Result<UnackResponse, AckError> {
-    let g = gather(p, verb, actor).await?;
+    let mut g = gather(p, verb, actor).await?;
+    g.facts.cover = cover;
     let plan = plan(&g.facts);
     let out = carry_out(p, &g, &plan, actor, source).await?;
     Ok(UnackResponse {
@@ -1235,6 +1289,7 @@ async fn gather(p: &Problem, verb: Verb, actor: &str) -> Result<Gathered, AckErr
             other_groups_unacked: 0,
             other_holders: vec![],
             pages,
+            cover: None,
         },
         targets: HashMap::new(),
         held: HashMap::new(),
@@ -1293,7 +1348,7 @@ async fn one_row(
     firing_started_at: Option<i64>,
     verb: Verb,
 ) -> Result<Vec<(String, i64)>, AckError> {
-    if matches!(verb, Verb::Unack | Verb::HandOff) {
+    if matches!(verb, Verb::Unack | Verb::HandOff | Verb::Resolve) {
         let firing = match firing_started_at {
             Some(f) => Some(f),
             None => current_firing(target, group_key).await?,
@@ -1354,19 +1409,22 @@ async fn gather_incident(
     };
     let status: IncidentStatus = model.status.parse().unwrap_or_default();
     g.incident_status = Some(status);
-    // A resolved incident has nothing to acknowledge or clear; reopening it is its own verb.
-    if status == IncidentStatus::Resolved {
+    let resolved = status == IncidentStatus::Resolved;
+    // A resolved incident has nothing to acknowledge; only a resolve still clears its alerts' rows.
+    if resolved && g.facts.verb != Verb::Resolve {
         return Ok(());
     }
-    g.facts.records.push(HeldRecord {
-        record: AckRecord::Incident {
-            incident_id: incident_id.to_string(),
-        },
-        holder: (status == IncidentStatus::Acknowledged)
-            .then_some(model.acknowledged_by)
-            .flatten(),
-        named: true,
-    });
+    if !resolved {
+        g.facts.records.push(HeldRecord {
+            record: AckRecord::Incident {
+                incident_id: incident_id.to_string(),
+            },
+            holder: (status == IncidentStatus::Acknowledged)
+                .then_some(model.acknowledged_by)
+                .flatten(),
+            named: true,
+        });
+    }
     for alert_id in incident_alert_ids(incident_id).await? {
         let target = match resolve_target(org_id, &alert_id).await {
             Ok(t) => t,
@@ -1425,7 +1483,8 @@ async fn carry_out(
             .any(|r| &r.record == record && r.named);
         let won = match record {
             AckRecord::Incident { incident_id } => {
-                let won = write_incident(p.org_id(), incident_id, write, actor).await?;
+                let won =
+                    write_incident(p.org_id(), incident_id, write, actor, g.facts.verb).await?;
                 if won {
                     incident_status = Some(status_after(write));
                 } else if *write == RecordWrite::Claim {
@@ -1586,6 +1645,7 @@ async fn write_incident(
     incident_id: &str,
     write: &RecordWrite,
     actor: &str,
+    verb: Verb,
 ) -> Result<bool, AckError> {
     use config::meta::alerts::incidents::IncidentEvent;
     use infra::table::alert_incidents;
@@ -1605,7 +1665,12 @@ async fn write_incident(
         ),
         RecordWrite::Clear { holder } => (
             alert_incidents::unacknowledge(org_id, incident_id, holder).await?,
-            IncidentEvent::reopened(actor, "Unacknowledged"),
+            match verb {
+                Verb::Resolve => IncidentEvent::ack_ended_by_page_resolve(actor),
+                Verb::Acknowledge | Verb::TakeOver | Verb::Unack | Verb::HandOff => {
+                    IncidentEvent::reopened(actor, "Unacknowledged")
+                }
+            },
         ),
     };
     if won {
@@ -1621,6 +1686,7 @@ async fn write_incident(
     _incident_id: &str,
     _write: &RecordWrite,
     _actor: &str,
+    _verb: Verb,
 ) -> Result<bool, AckError> {
     Err(AckError::NotFound)
 }
@@ -2059,6 +2125,14 @@ mod tests {
             other_groups_unacked: 0,
             other_holders: vec![],
             pages,
+            cover: None,
+        }
+    }
+
+    fn cover(closed_at: i64) -> PageCover {
+        PageCover {
+            alert_id: "a1".into(),
+            closed_at,
         }
     }
 
@@ -2225,6 +2299,82 @@ mod tests {
                 vec![],
                 Answer::Changed,
             ),
+            (
+                "a resolve clears every record and restarts no page",
+                facts_for(
+                    Verb::Resolve,
+                    vec![incident(ana), firing("", ana, false)],
+                    vec![page("owner", ana), page("paging", None)],
+                ),
+                vec![cleared(&incident(ana)), cleared(&firing("", ana, false))],
+                vec![("owner", Leave), ("paging", Leave)],
+                vec![],
+                Answer::Changed,
+            ),
+            (
+                "a resolve with nothing held changes nothing",
+                facts_for(
+                    Verb::Resolve,
+                    vec![firing("", None, true)],
+                    vec![page("p1", ana)],
+                ),
+                vec![],
+                vec![("p1", Leave)],
+                vec![],
+                Answer::NotHeld,
+            ),
+            (
+                "a page's resolve leaves a firing that started after the page closed",
+                PlanFacts {
+                    cover: Some(cover(50)),
+                    ..facts_for(
+                        Verb::Resolve,
+                        vec![firing("", ana, true)],
+                        vec![page("p1", ana)],
+                    )
+                },
+                vec![],
+                vec![("p1", Leave)],
+                vec![],
+                Answer::NotHeld,
+            ),
+            (
+                "a page's resolve ends a firing that started while it was open",
+                PlanFacts {
+                    cover: Some(cover(100)),
+                    ..facts_for(Verb::Resolve, vec![firing("", ana, true)], vec![])
+                },
+                vec![cleared(&firing("", ana, true))],
+                vec![],
+                vec![],
+                Answer::Changed,
+            ),
+            (
+                "a page's resolve covers none of an incident its alert re-fired into after the close",
+                PlanFacts {
+                    cover: Some(cover(50)),
+                    ..facts_for(
+                        Verb::Resolve,
+                        vec![incident(ana), firing("", ana, false)],
+                        vec![],
+                    )
+                },
+                vec![],
+                vec![],
+                vec![],
+                Answer::NotHeld,
+            ),
+            (
+                "a hand-off ignores a cover",
+                PlanFacts {
+                    cover: Some(cover(50)),
+                    ..facts_for(Verb::HandOff, vec![firing("", ana, true)], vec![])
+                },
+                vec![cleared(&firing("", ana, true))],
+                vec![],
+                vec![],
+                Answer::Changed,
+            ),
             (
                 "an unack with nothing held still restarts the page an ack stopped",
                 facts_for(
@@ -2333,6 +2483,17 @@ mod tests {
         }
     }
 
+    #[test]
+    fn an_alert_page_covers_its_alerts_firings_up_to_its_close_and_an_incident_page_all() {
+        use config::meta::oncall::{SubjectRef, SubjectType};
+        let subject = |kind, source: &str| SubjectRef::new(kind, source.to_string(), 1);
+        assert_eq!(
+            page_cover(&subject(SubjectType::Alert, "a1:group:g1"), 70),
+            Some(cover(70))
+        );
+        assert_eq!(page_cover(&subject(SubjectType::Incident, "i1"), 70), None);
+    }
+
     #[test]
     fn a_page_names_its_source_without_the_group_or_impacted_suffix() {
         for (page_source, source) in [
diff --git a/src/core/src/alerts/alert.rs b/src/core/src/alerts/alert.rs
index 5e74990e1e..04b9f9f923 100644
--- a/src/core/src/alerts/alert.rs
+++ b/src/core/src/alerts/alert.rs
@@ -379,6 +379,17 @@ impl ManualTrigger {
             }
         }
     }
+
+    /// What the send could not deliver, such as a failed destination or a page the license
+    /// withheld.
+    pub fn warning(&self) -> Option<&str> {
+        match self {
+            Self::Sent { error_message, .. } if !error_message.trim().is_empty() => {
+                Some(error_message)
+            }
+            _ => None,
+        }
+    }
 }
 
 pub async fn save(
@@ -2358,6 +2369,18 @@ pub(crate) fn with_incident_notify_error(
     }
 }
 
+/// A failure, not a skip, so alert history says why on-call stayed silent.
+#[cfg(feature = "enterprise")]
+pub(crate) fn with_unlicensed_page_reason(
+    notify_error: Option<String>,
+    unlicensed: Option<&str>,
+) -> Option<String> {
+    match unlicensed {
+        None => notify_error,
+        Some(reason) => Some(with_incident_notify_error(reason.to_string(), notify_error)),
+    }
+}
+
 /// Whether a send tried any destination or workflow; an `Err` is a failed delivery, so it counts.
 pub(crate) fn send_attempted(result: &Result<NotificationOutcome, AlertError>) -> bool {
     result.as_ref().map_or(true, |outcome| outcome.attempted)
@@ -2408,9 +2431,7 @@ pub async fn trigger_by_id<C: ConnectionTrait>(
     // the notification. For all other cases send the direct notification.
     #[cfg(feature = "enterprise")]
     let (incident_notified, incident_notify_error) = if alert.creates_incident
-        && o2_enterprise::enterprise::common::config::get_config()
-            .incidents
-            .enabled
+        && crate::alerts::incidents::incidents_enabled()
     {
         let synthetic_row = manual_trigger_row(&alert);
         let notify = std::slice::from_ref(&synthetic_row);
@@ -2478,6 +2499,11 @@ pub async fn trigger_by_id<C: ConnectionTrait>(
     if o2_enterprise::enterprise::oncall::is_enabled() && !incident_notified {
         crate::alerts::scheduler::handlers::page_for_alert_firing(&trace_id, &alert, &rows).await;
     }
+    #[cfg(feature = "enterprise")]
+    let incident_notify_error = with_unlicensed_page_reason(
+        incident_notify_error,
+        o2_enterprise::enterprise::oncall::escalation::unlicensed_page_reason(&alert.org_id).await,
+    );
     let outcome = alert
         .send_notification(
             &trace_id,
@@ -2976,7 +3002,7 @@ impl AlertExt for Alert {
         }
 
         outcome.success_message = success_message;
-        outcome.error_message = err_message;
+        outcome.error_message = format!("{err_message}{workflow_err_msg}");
 
         // Attempted = destinations not skipped by the ledger. An attempt in
         // which every attempted destination failed is still a hard error, so
@@ -3842,6 +3868,33 @@ async fn send_discord_with_attachment(
     send_outcome(resp_status, &resp_body, hide_body)
 }
 
+/// A destination's non-2xx reply; `body` is `None` when the peer may not show it.
+#[derive(Debug)]
+pub(crate) struct DestinationStatusError {
+    pub(crate) status: reqwest::StatusCode,
+    body: Option<String>,
+}
+
+impl std::fmt::Display for DestinationStatusError {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match &self.body {
+            Some(body) => write!(f, "sent error status: {}, err: {body}", self.status),
+            None => write!(f, "sent error status: {}", self.status),
+        }
+    }
+}
+
+impl std::error::Error for DestinationStatusError {}
+
+#[cfg(all(test, feature = "enterprise"))]
+pub(crate) fn send_outcome_for_test(
+    status: reqwest::StatusCode,
+    body: &str,
+    hide_body: bool,
+) -> Result<String, anyhow::Error> {
+    send_outcome(status, body, hide_body)
+}
+
 /// What the caller of a send sees; a peer only the operator allowlist admits shows its status only.
 fn send_outcome(
     status: reqwest::StatusCode,
@@ -3851,8 +3904,10 @@ fn send_outcome(
     match (status.is_success(), hide_body) {
         (true, false) => Ok(format!("sent status: {status}, body: {body}")),
         (true, true) => Ok(format!("sent status: {status}")),
-        (false, false) => Err(anyhow::anyhow!("sent error status: {status}, err: {body}")),
-        (false, true) => Err(anyhow::anyhow!("sent error status: {status}")),
+        (false, hide_body) => Err(anyhow::Error::new(DestinationStatusError {
+            status,
+            body: (!hide_body).then(|| body.to_string()),
+        })),
     }
 }
 
@@ -4366,16 +4421,7 @@ async fn build_notification_context(
             None => String::new(),
         }
     } else if alert.stream_type == StreamType::Traces {
-        // The traces page takes a filter expression in `query`, not SQL, so the query is left out.
-        format!(
-            "{}{}/web/traces?stream={}&from={}&to={}&org_identifier={}&tab=spans",
-            cfg.common.web_url,
-            cfg.common.base_uri,
-            alert.stream_name,
-            alert_start_time,
-            alert_end_time,
-            alert.org_id
-        )
+        traces_alert_url(&cfg, alert, alert_start_time, alert_end_time)
     } else {
         match alert.query_condition.query_type {
             QueryType::SQL => {
@@ -4512,6 +4558,29 @@ async fn build_notification_context(
         chart_png: None,
     }
 }
+
+fn traces_alert_url(cfg: &config::Config, alert: &Alert, start_time: i64, end_time: i64) -> String {
+    let mut url = format!(
+        "{}{}/web/traces?stream={}&from={}&to={}&org_identifier={}&tab=spans",
+        cfg.common.web_url,
+        cfg.common.base_uri,
+        alert.stream_name,
+        start_time,
+        end_time,
+        alert.org_id
+    );
+    // The traces page takes a filter expression in `query`, not SQL, so only the WHERE is carried.
+    if alert.query_condition.query_type == QueryType::SQL
+        && let Some(sql) = &alert.query_condition.sql
+    {
+        let where_clause = config::meta::sql::extract_where(sql).where_clause;
+        if !where_clause.is_empty() {
+            url.push_str("&query=");
+            url.push_str(&base64::encode_url(&where_clause));
+        }
+    }
+    url
+}
 pub fn get_row_column_map(rows: &[Map<String, Value>]) -> HashMap<String, HashSet<String>> {
     let mut vars = HashMap::with_capacity(rows.len());
     for row in rows.iter() {
@@ -4692,6 +4761,7 @@ pub async fn permitted_alerts(
                 use_self_context: false,
                 use_self_parent: true,
                 auth: "".to_string(), // We don't need to pass the auth token here.
+                feature: None,
             },
             user_role,
             false,
@@ -5491,6 +5561,24 @@ mod tests {
 
     use super::*;
 
+    #[test]
+    fn a_failed_send_keeps_its_text_and_hides_the_body_when_asked() {
+        let status = reqwest::StatusCode::INTERNAL_SERVER_ERROR;
+        let shown = send_outcome(status, "boom", false).unwrap_err();
+        assert_eq!(
+            shown.to_string(),
+            "sent error status: 500 Internal Server Error, err: boom"
+        );
+        let hidden = send_outcome(status, "boom", true).unwrap_err();
+        assert_eq!(
+            hidden.to_string(),
+            "sent error status: 500 Internal Server Error"
+        );
+        let typed = hidden.downcast_ref::<DestinationStatusError>().unwrap();
+        assert_eq!(typed.status, status);
+        assert!(typed.body.is_none());
+    }
+
     #[tokio::test]
     async fn a_multi_alert_with_recovery_saves() {
         let mut alert = Alert::default();
@@ -8703,6 +8791,16 @@ mod tests {
             error_message: String::new(),
         };
         assert_eq!(sent.response_message(), "Alert triggered");
+        assert_eq!(sent.warning(), None);
+        assert_eq!(suppressed.warning(), None);
+        let partial = ManualTrigger::Sent {
+            success_message: String::new(),
+            error_message: "not paged: On-Call is not included in your license".to_string(),
+        };
+        assert_eq!(
+            partial.warning(),
+            Some("not paged: On-Call is not included in your license")
+        );
     }
 
     #[test]
@@ -9555,14 +9653,13 @@ mod rule_notification_tests {
         assert!(matches!(error, AlertError::PromqlMissingQuery));
     }
 
-    #[tokio::test]
-    async fn traces_alert_url_opens_the_traces_page() {
+    async fn notification_url_for_traces_alert(query_type: QueryType, sql: Option<&str>) -> String {
         let mut alert = Alert::default();
         alert.org_id = "org".into();
         alert.stream_type = StreamType::Traces;
         alert.stream_name = "default".into();
-        alert.query_condition.query_type = QueryType::SQL;
-        alert.query_condition.sql = Some("SELECT span_id FROM \"default\"".into());
+        alert.query_condition.query_type = query_type;
+        alert.query_condition.sql = sql.map(Into::into);
         let options = ProcessTemplateOptions {
             rows_end_time: 0,
             start_time: None,
@@ -9574,12 +9671,15 @@ mod rule_notification_tests {
             resolved: false,
         };
         let context = build_notification_context("org", &alert, &[], &[], options, None).await;
-        let url = if let Some((_, suffix)) = context.alert_url.split_once("/web/short/") {
+        if let Some((_, suffix)) = context.alert_url.split_once("/web/short/") {
             let id = suffix.split('?').next().unwrap();
             short_url::retrieve(&alert.org_id, id).await.unwrap()
         } else {
             context.alert_url
-        };
+        }
+    }
+
+    fn assert_plain_traces_url(url: &str) {
         assert!(url.contains("/web/traces?stream=default&"));
         assert!(url.contains("&from=") && url.contains("&to="));
         assert!(url.contains("&org_identifier=org&"));
@@ -9588,4 +9688,53 @@ mod rule_notification_tests {
         assert!(!url.contains("sql_mode"));
         assert!(!url.contains("query="));
     }
+
+    #[tokio::test]
+    async fn traces_alert_url_without_where_opens_the_traces_page() {
+        let url = notification_url_for_traces_alert(
+            QueryType::SQL,
+            Some("SELECT span_id FROM \"default\""),
+        )
+        .await;
+        assert_plain_traces_url(&url);
+    }
+
+    #[tokio::test]
+    async fn traces_alert_url_keeps_the_where_filter() {
+        let url = notification_url_for_traces_alert(
+            QueryType::SQL,
+            Some("SELECT count(*) AS cnt FROM \"default\" WHERE service_name = 'api' AND duration > 100"),
+        )
+        .await;
+        assert!(url.contains("/web/traces?stream=default&"));
+        assert!(url.contains("&org_identifier=org&"));
+        assert!(url.contains("&tab=spans"));
+        assert!(!url.contains("sql_mode"));
+        let query = url
+            .split_once("&query=")
+            .unwrap()
+            .1
+            .split('&')
+            .next()
+            .unwrap();
+        assert_eq!(
+            base64::decode_url(query).unwrap(),
+            "service_name = 'api' AND duration > 100"
+        );
+    }
+
+    #[tokio::test]
+    async fn traces_alert_url_skips_unparsable_or_non_sql_queries() {
+        assert_plain_traces_url(
+            &notification_url_for_traces_alert(QueryType::SQL, Some("not sql WHERE")).await,
+        );
+        assert_plain_traces_url(&notification_url_for_traces_alert(QueryType::SQL, None).await);
+        assert_plain_traces_url(
+            &notification_url_for_traces_alert(
+                QueryType::Custom,
+                Some("SELECT * FROM \"default\" WHERE service_name = 'api'"),
+            )
+            .await,
+        );
+    }
 }
diff --git a/src/core/src/alerts/incidents.rs b/src/core/src/alerts/incidents.rs
index 2a7225274f..9a499c4e36 100644
--- a/src/core/src/alerts/incidents.rs
+++ b/src/core/src/alerts/incidents.rs
@@ -628,6 +628,28 @@ async fn send_incident_severity_notification(org_id: &str, incident_id: &str) {
     .await;
 }
 
+/// Whether the operator switched incident correlation on and the license grants it.
+#[cfg(feature = "enterprise")]
+pub fn incidents_enabled() -> bool {
+    o2_enterprise::enterprise::common::config::get_config()
+        .incidents
+        .enabled
+        && o2_enterprise::enterprise::license::check_features(&[
+            config::meta::feature::Feature::Incidents,
+        ])
+}
+
+/// Whether O2's agent may answer an analysis: operator switch, agent target and assistant license.
+#[cfg(feature = "enterprise")]
+pub fn rca_agent_available() -> bool {
+    let cfg = o2_enterprise::enterprise::common::config::get_config();
+    cfg.ai.enabled
+        && cfg.ai.has_agent_target()
+        && o2_enterprise::enterprise::license::check_features(&[
+            config::meta::feature::Feature::AiAssistant,
+        ])
+}
+
 /// Correlate an alert to an incident, and send a notification if appropriate.
 ///
 /// This is the main entry point for incident correlation in the alert execution flow.
@@ -2424,7 +2446,7 @@ pub async fn rca_will_run(org_id: &str, incident_id: &str) -> bool {
     use o2_enterprise::enterprise::{alerts::rca_service, common::config::get_config};
 
     let cfg = get_config();
-    let will_run = cfg.incidents.enabled && cfg.incidents.rca_enabled && cfg.ai.has_agent_target();
+    let will_run = incidents_enabled() && cfg.incidents.rca_enabled && rca_agent_available();
     if !will_run {
         rca_service::skip_analysis_for_incident(org_id, incident_id).await;
     }
@@ -2792,7 +2814,7 @@ pub async fn trigger_rca_for_incident(
 
     let config = get_o2_config();
 
-    if !config.incidents.enabled || !config.incidents.rca_enabled {
+    if !incidents_enabled() || !config.incidents.rca_enabled {
         log::debug!("[INCIDENTS::RCA] RCA not enabled, ending run {run_id}");
         end_failed(ERROR_RCA_DISABLED, RCA_DISABLED_REASON, None).await;
         return Ok(());
@@ -3183,15 +3205,21 @@ pub async fn update_status_as(
         return through_the_one_ack(org_id, incident_id, status, user_id).await;
     }
     // Read before the resolve clears it, so resolving a muted incident still notifies nobody.
+    let before = infra::table::alert_incidents::get(org_id, incident_id).await?;
     let muted_before = reads_mute_before(
         status,
         o2_enterprise::enterprise::common::config::get_config()
             .downtimes
             .enabled,
-    ) && infra::table::alert_incidents::get(org_id, incident_id)
-        .await?
+    ) && before
+        .as_ref()
         .is_some_and(|m| m.muted_by_downtime_id.is_some());
-    let updated = infra::table::alert_incidents::update_status(org_id, incident_id, status).await?;
+    // A re-sent Resolve re-runs the idempotent repairs but keeps the first row and event.
+    let again = status == "resolved" && before.as_ref().is_some_and(|m| m.status == "resolved");
+    let updated = match before {
+        Some(m) if again => m,
+        _ => infra::table::alert_incidents::update_status(org_id, incident_id, status).await?,
+    };
 
     let muted = status_change_is_muted(
         quiet || muted_before,
@@ -3216,7 +3244,7 @@ pub async fn update_status_as(
         "open" => Some(IncidentEvent::reopened(user_id, "Manually reopened")),
         _ => None,
     };
-    if let Some(evt) = event
+    if let Some(evt) = event.filter(|_| !again)
         && let Err(e) = append_event_unless_muted(org_id, incident_id, evt, muted).await
     {
         log::error!("[Incidents] Failed to record status event: org_id: {org_id}, error: {e}");
diff --git a/src/core/src/alerts/mute.rs b/src/core/src/alerts/mute.rs
index d99b6acaae..d1e8f34cdd 100644
--- a/src/core/src/alerts/mute.rs
+++ b/src/core/src/alerts/mute.rs
@@ -84,7 +84,8 @@ pub async fn mute(
     let now = now_micros();
     let ends_at = requested_end(req.until_clear, req.minutes, req.ends_at, now)?;
     let groups = requested_groups(target, req).await?;
-    let rows = db::downtimes::list_cached(&target.org_id);
+    // The primary, so a mute made moments ago is seen; two at the same instant can still race.
+    let rows = downtimes::primary_rows(&target.org_id).await?;
     if let Some(live) = covering_mute(&rows, &target.alert_id, groups.as_deref(), now) {
         return Err(MuteError::Conflict(AlertMuteConflict::AlreadyMuted {
             downtime_id: live.id.clone(),
diff --git a/src/core/src/alerts/rca_turn.rs b/src/core/src/alerts/rca_turn.rs
index cb2ed3c47c..4b05d007a8 100644
--- a/src/core/src/alerts/rca_turn.rs
+++ b/src/core/src/alerts/rca_turn.rs
@@ -3362,12 +3362,12 @@ mod tests {
         }
     }
 
-    /// Paused time that moves 100x faster than the wall clock.
+    /// 10x time: auto-advance fires the DB acquire timeout; faster makes CI stalls false backoffs.
     fn fast_clock() -> tokio::task::JoinHandle<()> {
         tokio::spawn(async {
             loop {
                 std::thread::sleep(Duration::from_millis(1));
-                tokio::time::advance(Duration::from_millis(100)).await;
+                tokio::time::advance(Duration::from_millis(10)).await;
             }
         })
     }
@@ -3491,9 +3491,9 @@ mod tests {
         clock.abort();
     }
 
-    #[tokio::test(start_paused = true)]
+    // Real clock: even the 10x fast_clock turns a 500 ms CI stall into a false 5 s backoff.
+    #[tokio::test]
     async fn other_start_errors_fail_the_continuation_at_once() {
-        let clock = fast_clock();
         let _db = db().await;
         for (error, can_retry, code) in [
             (RcaTurnError::Busy, true, "busy"),
@@ -3543,7 +3543,6 @@ mod tests {
                 "{stored_error:?}"
             );
         }
-        clock.abort();
     }
 
     #[tokio::test]
diff --git a/src/core/src/alerts/scheduler/handlers.rs b/src/core/src/alerts/scheduler/handlers.rs
index 82d0bda5a2..f01e04c869 100644
--- a/src/core/src/alerts/scheduler/handlers.rs
+++ b/src/core/src/alerts/scheduler/handlers.rs
@@ -1111,6 +1111,13 @@ async fn handle_oncall_escalation_triggers(
 
     let response_id = trigger.module_key.clone();
     if !oncall::is_enabled() {
+        if oncall::is_unlicensed()
+            && let Err(e) =
+                oncall::escalation::note_unlicensed_pause(&trigger.org, &response_id, now_micros())
+                    .await
+        {
+            log::error!("[ONCALL] could not note the license pause on {response_id}: {e}");
+        }
         // Turned off mid-ladder: drop the job rather than hold a timer nobody will service.
         db::scheduler::delete(
             &trigger.org,
@@ -1527,10 +1534,7 @@ async fn handle_composite_alert_trigger(
         #[cfg(feature = "enterprise")]
         let opens_incident = composite_opens_incident(
             has_targets,
-            definition.definition.creates_incident
-                && o2_enterprise::enterprise::common::config::get_config()
-                    .incidents
-                    .enabled,
+            definition.definition.creates_incident && crate::alerts::incidents::incidents_enabled(),
         );
         if delivery.should_deliver() && has_targets {
             let notification_alert =
@@ -1661,18 +1665,22 @@ async fn handle_composite_alert_trigger(
 
         // Outside the deliverable branch: a silenced composite never reaches correlation.
         #[cfg(feature = "enterprise")]
-        if o2_enterprise::enterprise::oncall::is_enabled()
-            && !composite_incident_handled
-            && downtime.is_none()
-        {
-            let notification_alert =
-                crate::alerts::composite::notification_alert(&definition.definition);
-            let rows = [composite_notification_row(
-                &definition.definition.expression,
-                evaluated.result,
-                &evaluated.children,
-            )];
-            page_for_alert_firing(trace_id, &notification_alert, &rows).await;
+        if !composite_incident_handled && downtime.is_none() {
+            if o2_enterprise::enterprise::oncall::is_enabled() {
+                let notification_alert =
+                    crate::alerts::composite::notification_alert(&definition.definition);
+                let rows = [composite_notification_row(
+                    &definition.definition.expression,
+                    evaluated.result,
+                    &evaluated.children,
+                )];
+                page_for_alert_firing(trace_id, &notification_alert, &rows).await;
+            }
+            delivery_error = crate::alerts::alert::with_unlicensed_page_reason(
+                delivery_error,
+                o2_enterprise::enterprise::oncall::escalation::unlicensed_page_reason(&trigger.org)
+                    .await,
+            );
         }
     }
 
@@ -2514,7 +2522,7 @@ async fn trigger_rca_for_alert_firing(
 
     let cfg = get_o2_config();
     // Must agree with the condition `analysis_at_start` used to mark these records `Pending`.
-    if !cfg.incidents.rca_enabled || !cfg.ai.enabled || !cfg.ai.has_agent_target() {
+    if !cfg.incidents.rca_enabled || !crate::alerts::incidents::rca_agent_available() {
         release_alert_firing_hold(&alert.org_id, &opened).await;
         return;
     }
@@ -2867,7 +2875,7 @@ fn rows_by_downtime_key(
 
 /// The group key of one multi-alert row, the same key [rows_by_downtime_key] files it under.
 #[cfg(feature = "enterprise")]
-fn downtime_row_key(
+pub(crate) fn downtime_row_key(
     alert: &config::meta::alerts::alert::Alert,
     group_by: &[String],
     row: &config::utils::json::Map<String, config::utils::json::Value>,
@@ -2881,7 +2889,7 @@ fn downtime_row_key(
 }
 
 #[cfg(feature = "enterprise")]
-fn alert_group_by(alert: &config::meta::alerts::alert::Alert) -> Vec<String> {
+pub(crate) fn alert_group_by(alert: &config::meta::alerts::alert::Alert) -> Vec<String> {
     alert
         .query_condition
         .aggregation
@@ -3034,9 +3042,7 @@ pub(crate) async fn correlate_muted_incident(
     let Some(first_row) = rows.first() else {
         return;
     };
-    let incidents_enabled = o2_enterprise::enterprise::common::config::get_config()
-        .incidents
-        .enabled;
+    let incidents_enabled = crate::alerts::incidents::incidents_enabled();
     if !correlates_muted_firing(alert.creates_incident, incidents_enabled, downtime) {
         return;
     }
@@ -3072,9 +3078,7 @@ async fn correlate_repeated_incident(
     let Some(first_row) = rows.first() else {
         return;
     };
-    let incidents_enabled = o2_enterprise::enterprise::common::config::get_config()
-        .incidents
-        .enabled;
+    let incidents_enabled = crate::alerts::incidents::incidents_enabled();
     if !correlates_repeated_firing(alert.creates_incident, incidents_enabled) {
         return;
     }
@@ -4156,9 +4160,7 @@ async fn handle_alert_triggers(
         let correlation_rows = unmuted_rows.as_deref().unwrap_or(data.as_slice());
         #[cfg(feature = "enterprise")]
         let (incident_handled_notification, incident_notify_error) = if alert.creates_incident
-            && o2_enterprise::enterprise::common::config::get_config()
-                .incidents
-                .enabled
+            && crate::alerts::incidents::incidents_enabled()
             && let Some(first_row) = correlation_rows.first()
         {
             match crate::alerts::incidents::correlate_alert_to_incident(
@@ -4219,6 +4221,12 @@ async fn handle_alert_triggers(
                 page_for_alert_identity(&scheduler_trace_id, &alert, &identity).await;
             }
         }
+        #[cfg(feature = "enterprise")]
+        let incident_notify_error = crate::alerts::alert::with_unlicensed_page_reason(
+            incident_notify_error,
+            o2_enterprise::enterprise::oncall::escalation::unlicensed_page_reason(&alert.org_id)
+                .await,
+        );
 
         let vars = get_row_column_map(&data);
         // Multi-time range alerts can have multiple time ranges, hence only
@@ -9665,6 +9673,34 @@ mod tests {
         assert_eq!(kept, RunOutcome::NotifyFailed);
     }
 
+    #[cfg(feature = "enterprise")]
+    #[test]
+    fn an_unlicensed_page_is_recorded_in_alert_history() {
+        use o2_enterprise::enterprise::oncall::escalation::UNLICENSED_PAGE_REASON;
+
+        use crate::alerts::alert::with_unlicensed_page_reason;
+
+        assert_eq!(with_unlicensed_page_reason(None, None), None);
+        let mut fired = TriggerData {
+            status: RunOutcome::Firing,
+            ..Default::default()
+        };
+        let error = with_unlicensed_page_reason(None, Some(UNLICENSED_PAGE_REASON)).unwrap();
+        let kept = record_incident_notify_failure(&mut fired, error);
+        assert_eq!(kept, RunOutcome::Firing);
+        assert_eq!(fired.status, RunOutcome::NotifyFailed);
+        assert_eq!(fired.error.as_deref(), Some(UNLICENSED_PAGE_REASON));
+
+        let both = with_unlicensed_page_reason(
+            Some("slack: http 500".to_string()),
+            Some(UNLICENSED_PAGE_REASON),
+        );
+        assert_eq!(
+            both.as_deref(),
+            Some(format!("slack: http 500; {UNLICENSED_PAGE_REASON}").as_str())
+        );
+    }
+
     const PARK_NOW: i64 = 10_000_000_000;
     const PARK_DELETED_AT: i64 = PARK_NOW - 90 * 60 * 1_000_000;
 
diff --git a/src/core/src/alerts/slack_investigate.rs b/src/core/src/alerts/slack_investigate.rs
index 09422186f7..9960d0ed76 100644
--- a/src/core/src/alerts/slack_investigate.rs
+++ b/src/core/src/alerts/slack_investigate.rs
@@ -343,7 +343,7 @@ mod enterprise {
     /// Admits the run (config, AI usage, credentials, the org's active-run cap) and records it.
     pub async fn start_alert_rca(req: AlertRcaRequest) -> Result<AlertRcaStart, AlertRcaRefusal> {
         let cfg = get_o2_config();
-        if !cfg.incidents.rca_enabled || !cfg.ai.enabled || !cfg.ai.has_agent_target() {
+        if !cfg.incidents.rca_enabled || !crate::alerts::incidents::rca_agent_available() {
             return Err(AlertRcaRefusal::NotConfigured(
                 "RCA or the AI agent is not enabled".into(),
             ));
diff --git a/src/core/src/alerts/slack_publish.rs b/src/core/src/alerts/slack_publish.rs
index 7f19b2f8e7..19adce0912 100644
--- a/src/core/src/alerts/slack_publish.rs
+++ b/src/core/src/alerts/slack_publish.rs
@@ -115,6 +115,7 @@ pub fn unavailable_reason(org_id: &str) -> Option<String> {
                 "Slack is not available on super-cluster deployments".to_string()
             }
             DisabledReason::Edition => "Slack app needs Enterprise".to_string(),
+            DisabledReason::License => "Slack app is not included in your license".to_string(),
             DisabledReason::Flag | DisabledReason::MasterKey => {
                 "Slack is turned off on this deployment".to_string()
             }
diff --git a/src/core/src/anomaly_detection/partitioned_search.rs b/src/core/src/anomaly_detection/partitioned_search.rs
index e801b43c3c..0de85a3b89 100644
--- a/src/core/src/anomaly_detection/partitioned_search.rs
+++ b/src/core/src/anomaly_detection/partitioned_search.rs
@@ -1307,7 +1307,7 @@ mod tests {
                 .expect("planner response was not configured"))
         }
 
-        async fn search(&self, _trace_id: &str, req: &Request) -> Result<Response> {
+        async fn search(&self, _trace_id: &str, _req: &Request) -> Result<Response> {
             self.searched.fetch_add(1, Ordering::SeqCst);
             let batch = self
                 .batches
diff --git a/src/core/src/auth.rs b/src/core/src/auth.rs
index 3193b1646f..a743e55fc7 100644
--- a/src/core/src/auth.rs
+++ b/src/core/src/auth.rs
@@ -26,7 +26,7 @@ use base64::Engine;
 use common::meta::user::AuthTokensExt;
 use common::meta::user::{AuthTokens, UserOrgRole};
 use config::{
-    meta::user::UserRole,
+    meta::{feature::Feature, user::UserRole},
     utils::{hash::try_get_passcode_hash, json},
 };
 use lru::LruCache;
@@ -266,6 +266,8 @@ pub struct AuthExtractor {
     pub use_all_org: bool,
     pub use_self_context: bool,
     pub use_self_parent: bool,
+    /// License features the route requires; checked even when `bypass_check` is set.
+    pub feature: Option<&'static [Feature]>,
 }
 
 impl AuthExtractor {
@@ -282,6 +284,7 @@ impl AuthExtractor {
             use_all_org: false,
             use_self_context: false,
             use_self_parent: false,
+            feature: None,
         }
     }
 }
@@ -366,6 +369,9 @@ where
             if let Some(auth_header) = parts.headers.get("Authorization")
                 && let Ok(auth_str) = auth_header.to_str()
             {
+                let feature =
+                    rp::resolve_permission(&path_columns, &method, &org_id, &folder, None)
+                        .and_then(|r| r.feature);
                 return Ok(AuthExtractor {
                     auth: reject_forged_session_marker(auth_str.to_owned()),
                     method,
@@ -376,6 +382,7 @@ where
                     use_all_org: false,
                     use_self_context: false,
                     use_self_parent: false,
+                    feature,
                 });
             }
             return Err(AuthExtractorRejection::unauthorized("Unauthorized Access"));
@@ -394,6 +401,10 @@ where
             if let Some(auth_header) = parts.headers.get("Authorization")
                 && let Ok(auth_str) = auth_header.to_str()
             {
+                // the stream-level bypass skips RBAC, not the license gate
+                let feature =
+                    rp::resolve_permission(&path_columns, &method, &org_id, &folder, None)
+                        .and_then(|r| r.feature);
                 return Ok(AuthExtractor {
                     auth: reject_forged_session_marker(auth_str.to_owned()),
                     method,
@@ -404,6 +415,7 @@ where
                     use_all_org: false,
                     use_self_context: false,
                     use_self_parent: false,
+                    feature,
                 });
             }
             return Err(AuthExtractorRejection::unauthorized("Unauthorized Access"));
@@ -447,6 +459,7 @@ where
                     use_all_org: false,
                     use_self_context: false,
                     use_self_parent: false,
+                    feature: None,
                 });
             }
         };
@@ -467,6 +480,7 @@ where
                 use_all_org: false,
                 use_self_context: false,
                 use_self_parent: false,
+                feature: resolved.feature,
             });
         }
 
@@ -485,6 +499,7 @@ where
             use_all_org: resolved.use_all_org,
             use_self_context: resolved.use_self_context,
             use_self_parent: resolved.use_self_parent,
+            feature: resolved.feature,
         })
     }
 
@@ -523,6 +538,7 @@ where
                 use_all_org: false,
                 use_self_context: false,
                 use_self_parent: false,
+                feature: None,
             });
         }
 
@@ -580,6 +596,7 @@ fn opamp_extractor(
         use_all_org: false,
         use_self_context: false,
         use_self_parent: false,
+        feature: None,
     })
 }
 
@@ -793,6 +810,7 @@ pub async fn check_permissions(
                 use_all_org,
                 use_self_context,
                 use_self_parent,
+                feature: None,
             },
             user.role,
             user.is_external,
@@ -1001,6 +1019,24 @@ mod tests {
         assert_eq!(generated_url, expected_url);
     }
 
+    #[cfg(feature = "enterprise")]
+    #[tokio::test]
+    async fn ingestion_write_carries_its_route_feature() {
+        use axum::extract::FromRequestParts;
+        use config::meta::feature::Feature;
+
+        let (mut parts, _) = axum::http::Request::post("/myorg/v1/logs")
+            .header("Authorization", "Basic cm9vdEBleGFtcGxlLmNvbTpwYXNz")
+            .body(())
+            .unwrap()
+            .into_parts();
+        let Ok(auth) = AuthExtractor::from_request_parts(&mut parts, &()).await else {
+            panic!("an ingestion write with credentials must extract");
+        };
+        assert!(auth.bypass_check);
+        assert_eq!(auth.feature, Some(&[Feature::Logs][..]));
+    }
+
     #[tokio::test]
     async fn test_is_root_user() {
         assert!(!is_root_user("dummy"));
diff --git a/src/core/src/authz.rs b/src/core/src/authz.rs
index dcae6d04e3..59201cebc8 100644
--- a/src/core/src/authz.rs
+++ b/src/core/src/authz.rs
@@ -342,6 +342,7 @@ impl StreamAccessChecker for OpenFgaStreamChecker {
                 use_all_org: false,
                 use_self_context: false,
                 use_self_parent: true,
+                feature: None,
             },
             user.role,
             user.is_external,
@@ -439,6 +440,7 @@ pub async fn check_stream_permissions(
             use_all_org: false,
             use_self_context: false,
             use_self_parent: true,
+            feature: None,
         },
         user.role,
         user.is_external,
@@ -873,6 +875,7 @@ async fn cipher_key_allowed(
             use_all_org: false,
             use_self_context: false,
             use_self_parent: true,
+            feature: None,
         },
         user.role.clone(),
         user.is_external,
diff --git a/src/core/src/dashboards/mod.rs b/src/core/src/dashboards/mod.rs
index bb1b5ea851..4a1e2ce10a 100644
--- a/src/core/src/dashboards/mod.rs
+++ b/src/core/src/dashboards/mod.rs
@@ -1407,6 +1407,7 @@ async fn filter_permitted_dashboards(
                 use_self_context: false,
                 use_self_parent: true,
                 auth: "".to_string(), // We don't need to pass the auth token here.
+                feature: None,
             },
             user_role,
             false,
diff --git a/src/core/src/downtimes.rs b/src/core/src/downtimes.rs
index 6f9d52c7f4..1917ecb58f 100644
--- a/src/core/src/downtimes.rs
+++ b/src/core/src/downtimes.rs
@@ -193,9 +193,8 @@ pub async fn list(
 
 pub async fn get(org: &str, user_id: &str, id: &str) -> Result<DowntimeDetail, DowntimeError> {
     ensure_enabled()?;
-    let row = infra::table::downtimes::get(org, id)
-        .await?
-        .ok_or(DowntimeError::NotFound)?;
+    // The primary, so a detail opened right after its create is never a replica-lag 404.
+    let row = load(org, id).await?;
     access::authorize_row(org, user_id, &row, "GET").await?;
     let inventory = inventory::cached(org).await?;
     let matches = matches_of(&row, &inventory);
@@ -378,8 +377,9 @@ pub async fn extend(
             created_id: None,
         });
     }
-    let cached = db::downtimes::list_cached(org);
-    if let Some(follow_up) = live_follow_up(&cached, &before.id, window.end, now) {
+    // The primary: a follow-up created moments ago may not be in this node's cache yet.
+    let rows = primary_rows(org).await?;
+    if let Some(follow_up) = live_follow_up(&rows, &before.id, window.end, now) {
         let follow_up = load(org, &follow_up.id).await?;
         access::authorize_row(org, user_id, &follow_up, "PUT").await?;
         let current_end = follow_up.schedule.ends_at.unwrap_or(window.end);
@@ -736,8 +736,18 @@ async fn extend_follow_up(
 
 /// A follow-up outlives its parent's cancel unless it is cancelled too; a failure is logged.
 async fn cancel_follow_ups(org: &str, user_id: &str, parent_id: &str, now: i64) {
-    let cached = db::downtimes::list_cached(org);
-    for id in follow_ups_to_cancel(&cached, parent_id, now) {
+    // The primary: an extend moments ago may have created a follow-up this cache lacks.
+    let rows = match primary_rows(org).await {
+        Ok(rows) => Arc::new(rows),
+        Err(e) => {
+            // The parent cancel already committed, so the cache beats leaving every follow-up live.
+            log::warn!(
+                "[downtimes] primary list of {org} failed, cancelling follow-ups of {parent_id} from the cache: {e}"
+            );
+            db::downtimes::list_cached(org)
+        }
+    };
+    for id in follow_ups_to_cancel(&rows, parent_id, now) {
         if let Err(e) = cancel_follow_up(org, user_id, id, now).await {
             log::warn!(
                 "[downtimes] could not cancel {org}/{id}, the follow-up of {parent_id}: {e}"
@@ -851,6 +861,12 @@ async fn load(org: &str, id: &str) -> Result<Downtime, DowntimeError> {
         .ok_or(DowntimeError::NotFound)
 }
 
+/// Every row of the org as the primary holds it, for a decision a replica lag must not skew.
+pub(crate) async fn primary_rows(org: &str) -> Result<Vec<Downtime>, DowntimeError> {
+    let conn = infra::db::get_orm_client_rw().await;
+    Ok(infra::table::downtimes::list_with(conn, org, None).await?)
+}
+
 /// An unknown folder is a 400; the default folder is created on first use.
 async fn resolve_folder(org: &str, folder_id: &str) -> Result<String, DowntimeError> {
     let folder_id = if folder_id.trim().is_empty() {
@@ -3199,7 +3215,7 @@ mod tests {
     }
 
     #[test]
-    fn writes_load_the_row_from_the_primary_and_the_detail_from_the_replica() {
+    fn writes_and_the_detail_load_the_row_from_the_primary() {
         assert!(body_of("async fn load(").contains("downtimes::get_rw(org, id)"));
         for write in [
             "pub async fn update(",
@@ -3211,8 +3227,7 @@ mod tests {
         ] {
             assert!(body_of(write).contains("load(org, "), "{write}");
         }
-        let detail = body_of("pub async fn get(");
-        assert!(detail.contains("downtimes::get(org, id)"));
-        assert!(!detail.contains("load(org, "));
+        // A detail opened right after its create must not 404 on replica lag.
+        assert!(body_of("pub async fn get(").contains("load(org, id)"));
     }
 }
diff --git a/src/core/src/downtimes/notify.rs b/src/core/src/downtimes/notify.rs
index d1e4382407..60dd4cb706 100644
--- a/src/core/src/downtimes/notify.rs
+++ b/src/core/src/downtimes/notify.rs
@@ -33,6 +33,8 @@ pub const LOG_LIMIT: u64 = 50;
 /// How often the notifier ticks; a start one tick back is already behind every healthy checkpoint.
 pub const TICK_INTERVAL_SECS: u64 = 30;
 pub const RESULT_OK: &str = "ok";
+/// A failed send's stored outcome when it carries no HTTP status.
+pub const RESULT_FAILED: &str = "delivery failed";
 const DOWNTIME_VARIABLE_PREFIX: &str = "{downtime_";
 
 #[derive(Clone, Debug, PartialEq, Eq)]
@@ -174,12 +176,13 @@ fn destinations_of(row: &Downtime) -> Vec<String> {
 }
 
 fn log_entry(row: DowntimeNotification) -> DowntimeNotificationLogEntry {
+    let destinations: Vec<String> = serde_json::from_value(row.destinations).unwrap_or_default();
     DowntimeNotificationLogEntry {
         window_start: row.window_start,
         event: row.event,
         sent_at: row.sent_at,
-        destinations: serde_json::from_value(row.destinations).unwrap_or_default(),
-        result: row.result,
+        result: row.result.map(|r| safe_result(r, &destinations)),
+        destinations,
     }
 }
 
@@ -195,7 +198,14 @@ async fn send(row: &Downtime, due: &DueEvent, destinations: &[String]) -> Result
     let mut errors = Vec::new();
     for name in destinations {
         if let Err(e) = send_one(&row.org, name, &vars).await {
-            errors.push(format!("{name}: {e}"));
+            // The full error stays in the server log; folder readers see only its summary.
+            log::warn!(
+                "[DOWNTIMES] {} notification of {}/{} to {name} failed: {e}",
+                due.event.as_str(),
+                row.org,
+                row.id
+            );
+            errors.push(outcome_summary(name, &e));
         }
     }
     if errors.is_empty() {
@@ -205,16 +215,16 @@ async fn send(row: &Downtime, due: &DueEvent, destinations: &[String]) -> Result
     }
 }
 
-async fn send_one(org: &str, name: &str, vars: &[(&str, String)]) -> Result<(), String> {
+async fn send_one(org: &str, name: &str, vars: &[(&str, String)]) -> Result<(), anyhow::Error> {
     let dest = crate::alerts::destinations::get(org, name)
         .await
-        .map_err(|e| e.to_string())?;
+        .map_err(|e| anyhow::anyhow!("{e}"))?;
     let Module::Alert {
         template,
         destination_type,
     } = dest.module
     else {
-        return Err("not an alert destination".to_string());
+        return Err(anyhow::anyhow!("not an alert destination"));
     };
     let own = match template {
         Some(template) => db::alerts::templates::get(org, &template).await.ok(),
@@ -234,7 +244,33 @@ async fn send_one(org: &str, name: &str, vars: &[(&str, String)]) -> Result<(),
     crate::alerts::alert::dispatch_notification(org, &destination_type, &subject, body)
         .await
         .map(|_| ())
-        .map_err(|e| e.to_string())
+}
+
+/// One destination's stored outcome: its HTTP status, never the reply body.
+fn outcome_summary(name: &str, e: &anyhow::Error) -> String {
+    match e.downcast_ref::<crate::alerts::alert::DestinationStatusError>() {
+        Some(status) => format!("{name}: HTTP {}", status.status.as_u16()),
+        None => format!("{name}: {RESULT_FAILED}"),
+    }
+}
+
+/// A stored outcome in the status-only format, else [RESULT_FAILED] so an older row never shows a
+/// reply body.
+fn safe_result(result: String, destinations: &[String]) -> String {
+    let safe_part = |part: &str| {
+        part.rsplit_once(": ").is_some_and(|(name, outcome)| {
+            destinations.iter().any(|d| d == name)
+                && (outcome == RESULT_FAILED
+                    || outcome.strip_prefix("HTTP ").is_some_and(|code| {
+                        code.len() == 3 && code.bytes().all(|b| b.is_ascii_digit())
+                    }))
+        })
+    };
+    if result == RESULT_OK || result.split("; ").all(safe_part) {
+        result
+    } else {
+        RESULT_FAILED.to_string()
+    }
 }
 
 fn template_for(own: Option<Template>, destination_type: &DestinationType) -> Template {
@@ -577,4 +613,61 @@ mod tests {
     fn counts_are_empty_when_unknown() {
         assert_eq!(counts_phrase(&row(None), None), "");
     }
+
+    fn status_error(code: u16, body: &str, hide_body: bool) -> anyhow::Error {
+        crate::alerts::alert::send_outcome_for_test(
+            reqwest::StatusCode::from_u16(code).unwrap(),
+            body,
+            hide_body,
+        )
+        .unwrap_err()
+    }
+
+    #[test]
+    fn a_failed_send_stores_its_status_never_the_reply_body() {
+        let e = status_error(500, "token=abc", false);
+        assert!(
+            e.to_string().contains("token=abc"),
+            "the server log keeps the body"
+        );
+        assert_eq!(outcome_summary("hook", &e), "hook: HTTP 500");
+        assert_eq!(
+            outcome_summary("hook", &anyhow::anyhow!("no destination hook")),
+            "hook: delivery failed"
+        );
+    }
+
+    #[test]
+    fn an_older_row_with_a_reply_body_is_redacted_on_read() {
+        let dests = vec!["hook".to_string(), "mail".to_string()];
+        let legacy = "hook: sent error status: 500 Internal Server Error, err: token=abc";
+        assert_eq!(safe_result(legacy.to_string(), &dests), RESULT_FAILED);
+        assert_eq!(safe_result("ok".to_string(), &dests), "ok");
+        let current = "hook: HTTP 500; mail: delivery failed";
+        assert_eq!(safe_result(current.to_string(), &dests), current);
+        // A name the row never sent to, or a status that is not three digits, is not ours.
+        assert_eq!(
+            safe_result("other: HTTP 500".to_string(), &dests),
+            RESULT_FAILED
+        );
+        assert_eq!(
+            safe_result("hook: HTTP 5000".to_string(), &dests),
+            RESULT_FAILED
+        );
+    }
+
+    #[test]
+    fn the_log_entry_never_returns_an_older_reply_body() {
+        let entry = log_entry(DowntimeNotification {
+            id: "n1".to_string(),
+            org: "acme".to_string(),
+            downtime_id: "d1".to_string(),
+            window_start: 1,
+            event: "started".to_string(),
+            sent_at: 1,
+            destinations: serde_json::json!(["hook"]),
+            result: Some("hook: sent error status: 401, err: secret".to_string()),
+        });
+        assert_eq!(entry.result.as_deref(), Some(RESULT_FAILED));
+    }
 }
diff --git a/src/core/src/fleet.rs b/src/core/src/fleet.rs
index cdbde47339..cc5035b502 100644
--- a/src/core/src/fleet.rs
+++ b/src/core/src/fleet.rs
@@ -63,14 +63,14 @@ pub async fn list_audit(
     query: AuditQuery,
     fleets: Option<&HashSet<String>>,
 ) -> Result<AuditList, anyhow::Error> {
-    o2_enterprise::enterprise::fleet::audit::list_audit(
-        org_id,
-        query,
-        fleets,
-        now_micros(),
-        search_audit,
-    )
-    .await
+    use o2_enterprise::enterprise::fleet::audit::{self, AuditColumns};
+
+    let schema = infra::schema::get(META_ORG_ID, AUDIT_STREAM, StreamType::Logs).await?;
+    let columns = AuditColumns {
+        fleet_id: schema.field_with_name("fleet_id").is_ok(),
+        target: schema.field_with_name("target").is_ok(),
+    };
+    audit::list_audit(org_id, query, fleets, columns, now_micros(), search_audit).await
 }
 
 /// The check `/prometheus/api/v1/query` makes per metric stream; a refused query is `None`.
@@ -132,6 +132,7 @@ async fn search_audit(
     sql: String,
     start_time: i64,
     end_time: i64,
+    from: i64,
     size: i64,
 ) -> Result<Vec<serde_json::Value>, anyhow::Error> {
     // Until the first audit row is written the stream does not exist, and a search of it errors.
@@ -142,7 +143,7 @@ async fn search_audit(
     let req = search::Request {
         query: search::Query {
             sql,
-            from: 0,
+            from,
             size,
             start_time,
             end_time,
diff --git a/src/core/src/incidents.rs b/src/core/src/incidents.rs
index 5783b363d3..703c5f8293 100644
--- a/src/core/src/incidents.rs
+++ b/src/core/src/incidents.rs
@@ -109,6 +109,11 @@ async fn get_event_metadata(
             metadata.push(("reason", reason.into()));
         }
 
+        IncidentEventType::AckEndedByPageResolve { user_id } => {
+            metadata.push(("event_type", "ack_ended_by_page_resolve".into()));
+            metadata.push(("user_id", user_id.into()));
+        }
+
         IncidentEventType::DimensionsUpgraded { from_key, to_key } => {
             metadata.push(("event_type", "dimensions_upgraded".into()));
             metadata.push(("from_key", from_key.into()));
diff --git a/src/core/src/ingestion/mod.rs b/src/core/src/ingestion/mod.rs
index 40e5a59b5f..8ab0e5e1e3 100644
--- a/src/core/src/ingestion/mod.rs
+++ b/src/core/src/ingestion/mod.rs
@@ -71,20 +71,33 @@ use crate::{
 pub mod columnar;
 pub mod grpc;
 pub mod ingestion_service;
+pub mod realtime_mute;
 pub mod rejections;
 
-pub type TriggerAlertData = Vec<(Alert, Vec<Map<String, Value>>)>;
-
 /// Global atomic counter for round-robin distribution of requests across memory table buckets.
 /// This ensures even distribution of ingestion load across multiple buckets in axum.
 static REQUEST_COUNTER: AtomicUsize = AtomicUsize::new(0);
 
-/// `org/alert -> until`, taken before the downtime check so concurrent requests run it once.
+/// `org/alert` and `org/alert/downtime` -> until, so one node evaluates each once per floor.
 static REALTIME_FLOOR_CLAIMS: LazyLock<DashMap<String, (i64, u64)>> = LazyLock::new(DashMap::new);
 
 /// Tells claims of one key apart, so a request releases only its own.
 static REALTIME_FLOOR_TOKENS: AtomicU64 = AtomicU64::new(0);
 
+/// Each real-time alert with its matching rows and what is known of their downtime.
+pub type TriggerAlertData = Vec<(Alert, Vec<Map<String, Value>>, RealtimeMute)>;
+
+/// The downtime decision a real-time trigger carries from ingestion.
+#[derive(Clone, Debug, PartialEq)]
+pub enum RealtimeMute {
+    /// Not classified at ingestion (the org has no alert downtime then); decided at send time.
+    Unchecked,
+    /// Every carried row is outside any downtime.
+    Unmuted,
+    /// Every matching row was muted; the merged downtime.
+    Muted(config::meta::downtimes::ActiveDowntime),
+}
+
 /// Memoizes the write partition per time bucket while no partition key is enabled.
 pub struct PartitionMemo<'a> {
     partition_keys: &'a Vec<StreamPartition>,
@@ -206,7 +219,7 @@ pub async fn evaluate_trigger(triggers: TriggerAlertData) {
         return;
     }
     let mut trigger_usage_reports = vec![];
-    for (alert, val) in triggers.iter() {
+    for (alert, val, mute) in triggers.iter() {
         let module_key = scheduler_key(alert.id);
         let now = Utc::now().timestamp_micros();
         let mut trigger_data_stream = TriggerData {
@@ -259,7 +272,26 @@ pub async fn evaluate_trigger(triggers: TriggerAlertData) {
         } else {
             None
         };
-        let delivered = if let Some(downtime) = realtime_downtime(alert, val, now).await {
+        let downtime = match mute {
+            RealtimeMute::Unchecked => realtime_downtime(alert, val, now).await,
+            RealtimeMute::Unmuted => None,
+            RealtimeMute::Muted(downtime) => Some(downtime.clone()),
+        };
+        let delivered = if let Some(downtime) = downtime {
+            // Downtime keys are never released, so expired claims are dropped before a new one.
+            REALTIME_FLOOR_CLAIMS.retain(|_, (until, _)| *until > now);
+            if claim_realtime_floor(
+                &format!("{floor_key}/{}", downtime.id),
+                now,
+                TriggerCondition::min_silence_micros(),
+            )
+            .is_none()
+            {
+                if let Some(token) = floor_claim {
+                    release_realtime_floor(&floor_key, token);
+                }
+                continue;
+            }
             log::info!(
                 "Realtime alert {}/{} suppressed by downtime {}",
                 alert.org_id,
@@ -1004,10 +1036,10 @@ fn realtime_alert_is_live(trigger: Option<&db::scheduler::Trigger>) -> bool {
     trigger.is_none_or(|t| !t.is_silenced)
 }
 
-/// A suppressed run keeps the rate-limit floor only, so the first firing after the window pages.
+/// A suppressed run silences nothing, so an unmuted service of the same alert still pages.
 fn realtime_silence_micros(alert: &Alert, run: &TriggerData, delivered: bool) -> Option<i64> {
     match run.status {
-        RunOutcome::Suppressed => Some(TriggerCondition::min_silence_micros()),
+        RunOutcome::Suppressed => None,
         _ if delivered => Some(alert.trigger_condition.effective_silence_micros()),
         _ => None,
     }
@@ -1245,7 +1277,7 @@ mod tests {
     }
 
     #[test]
-    fn test_only_a_send_or_a_suppression_silences_a_realtime_alert() {
+    fn test_only_a_send_silences_a_realtime_alert() {
         let mut alert = Alert::default();
         alert.trigger_condition.silence = 60;
         let failed = TriggerData {
@@ -1258,6 +1290,12 @@ mod tests {
             Some(3_600_000_000)
         );
         assert!(realtime_alert_is_live(None));
+        // A muted firing silences nothing, so another service's rows still evaluate.
+        let suppressed = TriggerData {
+            status: RunOutcome::Suppressed,
+            ..Default::default()
+        };
+        assert_eq!(realtime_silence_micros(&alert, &suppressed, false), None);
     }
 
     #[test]
diff --git a/src/core/src/ingestion/realtime_mute.rs b/src/core/src/ingestion/realtime_mute.rs
new file mode 100644
index 0000000000..63ccfbb3e5
--- /dev/null
+++ b/src/core/src/ingestion/realtime_mute.rs
@@ -0,0 +1,701 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Per-row downtime decisions for real-time alerts, so a muted service never hides an unmuted one.
+
+use std::collections::{HashMap, HashSet};
+#[cfg(feature = "enterprise")]
+use std::sync::{
+    Arc, LazyLock,
+    atomic::{AtomicI64, Ordering},
+};
+
+use config::{
+    meta::{alerts::alert::Alert, downtimes::ActiveDowntime},
+    utils::json::{Map, Value},
+};
+#[cfg(feature = "enterprise")]
+use dashmap::DashMap;
+
+use super::{RealtimeMute, TriggerAlertData};
+
+/// Matches the downtime cache's full reload, so settings are as fresh as the downtimes.
+#[cfg(feature = "enterprise")]
+const SEMANTIC_GROUPS_TTL_MICROS: i64 = 60 * 1_000_000;
+
+/// The settings read caches only a row it finds, so an org without an override reads per call.
+#[cfg(feature = "enterprise")]
+static SEMANTIC_GROUPS: LazyLock<DashMap<String, (i64, SemanticGroups)>> =
+    LazyLock::new(DashMap::new);
+
+/// Discovery matches only semantic-group fields, so the answer is cached per alert and those
+/// fields.
+#[cfg(feature = "enterprise")]
+static FALLBACK_SERVICES: LazyLock<DashMap<String, (i64, Option<String>)>> =
+    LazyLock::new(DashMap::new);
+
+/// When [FALLBACK_SERVICES] was last pruned, so a miss scans it at most once per floor.
+#[cfg(feature = "enterprise")]
+static FALLBACK_PRUNED_AT: AtomicI64 = AtomicI64::new(0);
+
+#[cfg(feature = "enterprise")]
+type SemanticGroups = Arc<Vec<config::meta::correlation::FieldAlias>>;
+type Row = Map<String, Value>;
+type Dims = HashMap<String, String>;
+
+/// Per request: every matching row of every real-time alert, classified as it arrives.
+pub struct RealtimeMuteSplit {
+    org: String,
+    now: i64,
+    row_cap: usize,
+    alerts: HashMap<String, AlertEntry>,
+    order: Vec<String>,
+    full: usize,
+}
+
+impl RealtimeMuteSplit {
+    /// `None` unless the org has an alert downtime; `row_cap` is the most rows one alert delivers.
+    pub fn for_org(org: &str, row_cap: usize) -> Option<Self> {
+        crate::alerts::downtimes::any_for(org, config::meta::downtimes::TargetModule::Alerts).then(
+            || Self {
+                org: org.to_string(),
+                now: config::utils::time::now_micros(),
+                row_cap,
+                alerts: HashMap::new(),
+                order: Vec::new(),
+                full: 0,
+            },
+        )
+    }
+
+    pub fn seen(&self, key: &str, signature: u64) -> bool {
+        self.alerts
+            .get(key)
+            .is_some_and(|entry| entry.rows.seen(signature))
+    }
+
+    /// Lets the caller skip evaluating an alert whose verdict is already Deliver.
+    pub fn is_full(&self, key: &str) -> bool {
+        self.alerts
+            .get(key)
+            .is_some_and(|entry| entry.rows.is_full())
+    }
+
+    /// A muted alert never fills, so the caller stops evaluating rows only when this reaches its
+    /// alert count.
+    pub fn full_alerts(&self) -> usize {
+        self.full
+    }
+
+    /// Files the matching rows of `alert`, keyed as the caller keys its alerts.
+    pub async fn push(&mut self, key: &str, alert: &Alert, rows: Vec<Row>, signature: Option<u64>) {
+        if !self.alerts.contains_key(key) {
+            let entry = AlertEntry {
+                alert: alert.clone(),
+                #[cfg(feature = "enterprise")]
+                scope: scope(&self.org, self.now, alert).await,
+                rows: RowSplit::with_cap(self.row_cap),
+            };
+            self.alerts.insert(key.to_string(), entry);
+            self.order.push(key.to_string());
+        }
+        let entry = self.alerts.get_mut(key).expect("inserted above");
+        let was_full = entry.rows.is_full();
+        for row in rows {
+            push_row(&self.org, self.now, entry, row, signature);
+        }
+        if !was_full && entry.rows.is_full() {
+            self.full += 1;
+        }
+    }
+
+    /// Spawned by the ingest path after the write, since the verdicts may read service discovery.
+    pub async fn evaluate(self) {
+        let triggers = self.finish().await;
+        if !triggers.is_empty() {
+            super::evaluate_trigger(triggers).await;
+        }
+    }
+
+    /// The alerts with a verdict, ready for `evaluate_trigger`.
+    pub async fn finish(mut self) -> TriggerAlertData {
+        let mut out = Vec::with_capacity(self.order.len());
+        for key in self.order {
+            let Some(entry) = self.alerts.remove(&key) else {
+                continue;
+            };
+            out.extend(finish_entry(&self.org, self.now, &key, entry).await);
+        }
+        out
+    }
+}
+
+struct AlertEntry {
+    alert: Alert,
+    /// `None` leaves the rows unmuted, as `realtime_downtime` does without an id or folder.
+    #[cfg(feature = "enterprise")]
+    scope: Option<Scope>,
+    rows: RowSplit,
+}
+
+/// What a row needs to be classified: the alert's id, folder and identity rules.
+#[cfg(feature = "enterprise")]
+struct Scope {
+    alert_id: String,
+    folder_id: String,
+    semantic_groups: SemanticGroups,
+    group_by: Option<Vec<String>>,
+}
+
+/// The rows of one alert in one request, split by their downtime decision.
+pub(crate) struct RowSplit {
+    cap: usize,
+    unmuted: Vec<Row>,
+    /// Rows with no identity by group key, decided at [Self::finish] as each group is scheduled.
+    empty: HashMap<Option<String>, Vec<Row>>,
+    muted: Option<ActiveDowntime>,
+    muted_ids: HashSet<String>,
+    any_identity: bool,
+    groups: HashMap<String, Group>,
+    /// Plain rows with the same identity get the same answer, so the cache scan runs once each.
+    decided: HashMap<Vec<(String, String)>, Option<ActiveDowntime>>,
+    seen: HashSet<u64>,
+}
+
+impl RowSplit {
+    fn with_cap(cap: usize) -> Self {
+        Self {
+            cap,
+            unmuted: Vec::new(),
+            empty: HashMap::new(),
+            muted: None,
+            muted_ids: HashSet::new(),
+            any_identity: false,
+            groups: HashMap::new(),
+            decided: HashMap::new(),
+            seen: HashSet::new(),
+        }
+    }
+
+    pub(crate) fn seen(&self, signature: u64) -> bool {
+        self.seen.contains(&signature)
+    }
+
+    /// A full unmuted bucket fixes the verdict at Deliver, so later rows change nothing.
+    pub(crate) fn is_full(&self) -> bool {
+        self.unmuted.len() >= self.cap
+    }
+
+    /// Files one matching row; `group` is its multi-alert group key, `None` for a plain alert.
+    pub(crate) fn push(
+        &mut self,
+        row: Row,
+        group: Option<String>,
+        signature: Option<u64>,
+        dims_of: impl FnOnce(&Row) -> Dims,
+        active_for: impl FnOnce(&Dims) -> Option<ActiveDowntime>,
+    ) {
+        if self.is_full() {
+            return;
+        }
+        if let Some(signature) = signature
+            && !self.seen.insert(signature)
+        {
+            return;
+        }
+        let decision = match &group {
+            Some(key) => match self.groups.get(key) {
+                Some(group) => group.clone(),
+                None => {
+                    let decided = self.classify(&row, false, dims_of, active_for);
+                    self.groups.insert(key.clone(), decided.clone());
+                    decided
+                }
+            },
+            None => self.classify(&row, true, dims_of, active_for),
+        };
+        match decision {
+            Group::Empty => {
+                let rows = self.empty.entry(group).or_default();
+                if rows.len() < self.cap {
+                    rows.push(row);
+                }
+            }
+            Group::Decided(None) => self.unmuted.push(row),
+            Group::Decided(Some(downtime)) => self.mute(downtime),
+        }
+    }
+
+    /// A group's decision may be group-scoped, so only plain rows share the identity cache.
+    fn classify(
+        &mut self,
+        row: &Row,
+        cacheable: bool,
+        dims_of: impl FnOnce(&Row) -> Dims,
+        active_for: impl FnOnce(&Dims) -> Option<ActiveDowntime>,
+    ) -> Group {
+        let dims = dims_of(row);
+        if dims.is_empty() {
+            return Group::Empty;
+        }
+        self.any_identity = true;
+        if !cacheable {
+            return Group::Decided(active_for(&dims));
+        }
+        let mut identity: Vec<(String, String)> =
+            dims.iter().map(|(k, v)| (k.clone(), v.clone())).collect();
+        identity.sort_unstable();
+        let decision = self
+            .decided
+            .entry(identity)
+            .or_insert_with(|| active_for(&dims))
+            .clone();
+        Group::Decided(decision)
+    }
+
+    fn mute(&mut self, downtime: ActiveDowntime) {
+        if !self.muted_ids.insert(downtime.id.clone()) {
+            return;
+        }
+        self.muted = Some(match self.muted.take() {
+            Some(merged) => merge(merged, downtime),
+            None => downtime,
+        });
+    }
+
+    /// Only when no row had an identity, as `downtime_identities_by_key` decides it.
+    #[cfg_attr(not(feature = "enterprise"), allow(dead_code))]
+    pub(crate) fn fallback_row(&self) -> Option<&Row> {
+        if self.any_identity {
+            return None;
+        }
+        self.empty.values().find_map(|rows| rows.first())
+    }
+
+    /// Decides each empty group with `empty_identity` and its group key, then the whole alert.
+    pub(crate) fn finish(
+        mut self,
+        empty_identity: Dims,
+        mut active_for: impl FnMut(&Dims, Option<&str>) -> Option<ActiveDowntime>,
+    ) -> Verdict {
+        let mut empty: Vec<_> = std::mem::take(&mut self.empty).into_iter().collect();
+        empty.sort_unstable_by(|a, b| a.0.cmp(&b.0));
+        for (group, rows) in empty {
+            match active_for(&empty_identity, group.as_deref()) {
+                Some(downtime) => self.mute(downtime),
+                None => {
+                    let room = self.cap.saturating_sub(self.unmuted.len());
+                    self.unmuted.extend(rows.into_iter().take(room));
+                }
+            }
+        }
+        if !self.unmuted.is_empty() {
+            return Verdict::Deliver(self.unmuted);
+        }
+        match self.muted {
+            Some(downtime) => Verdict::Suppress(downtime),
+            None => Verdict::Nothing,
+        }
+    }
+}
+
+/// A group's first row decides every row of the group, as in a scheduled run.
+#[derive(Clone)]
+enum Group {
+    Empty,
+    Decided(Option<ActiveDowntime>),
+}
+
+/// What a request's rows of one alert come to.
+#[derive(Debug, PartialEq)]
+pub(crate) enum Verdict {
+    Deliver(Vec<Row>),
+    Suppress(ActiveDowntime),
+    Nothing,
+}
+
+#[cfg(feature = "enterprise")]
+fn merge(a: ActiveDowntime, b: ActiveDowntime) -> ActiveDowntime {
+    crate::alerts::downtimes::enterprise::merged(a, b)
+}
+
+#[cfg(not(feature = "enterprise"))]
+fn merge(a: ActiveDowntime, _b: ActiveDowntime) -> ActiveDowntime {
+    a
+}
+
+#[cfg(feature = "enterprise")]
+async fn semantic_groups(org: &str, now: i64) -> SemanticGroups {
+    if let Some(cached) = SEMANTIC_GROUPS.get(org)
+        && now.saturating_sub(cached.0) < SEMANTIC_GROUPS_TTL_MICROS
+    {
+        return cached.1.clone();
+    }
+    let groups = Arc::new(crate::db::system_settings::get_semantic_field_groups(org).await);
+    SEMANTIC_GROUPS.insert(org.to_string(), (now, groups.clone()));
+    groups
+}
+
+#[cfg(feature = "enterprise")]
+async fn fallback_service(
+    org: &str,
+    key: &str,
+    now: i64,
+    groups: &[config::meta::correlation::FieldAlias],
+    row: &Row,
+) -> Option<String> {
+    let floor = config::meta::alerts::TriggerCondition::min_silence_micros();
+    let cache_key = format!("{key}/{:x}", fields_hash(row, groups));
+    if let Some(cached) = FALLBACK_SERVICES.get(&cache_key)
+        && now.saturating_sub(cached.0) < floor
+    {
+        return cached.1.clone();
+    }
+    let pruned_at = FALLBACK_PRUNED_AT.load(Ordering::Relaxed);
+    if now.saturating_sub(pruned_at) >= floor
+        && FALLBACK_PRUNED_AT
+            .compare_exchange(pruned_at, now, Ordering::Relaxed, Ordering::Relaxed)
+            .is_ok()
+    {
+        FALLBACK_SERVICES.retain(|_, (at, _)| now.saturating_sub(*at) < floor);
+    }
+    let service = crate::alerts::incidents::correlated_service_for_routing(org, row).await;
+    FALLBACK_SERVICES.insert(cache_key, (now, service.clone()));
+    service
+}
+
+/// The scalar fields `correlate` can match (a group id or one of its fields), so `_timestamp` is
+/// out.
+#[cfg(feature = "enterprise")]
+fn fields_hash(row: &Row, groups: &[config::meta::correlation::FieldAlias]) -> u64 {
+    use std::hash::{Hash, Hasher};
+    let matched = |k: &String| groups.iter().any(|g| g.id == *k || g.fields.contains(k));
+    let mut fields: Vec<(&String, String)> = row
+        .iter()
+        .filter(|(k, _)| matched(k))
+        .filter_map(|(k, v)| match v {
+            Value::String(s) => Some((k, s.clone())),
+            Value::Number(n) => Some((k, n.to_string())),
+            Value::Bool(b) => Some((k, b.to_string())),
+            _ => None,
+        })
+        .collect();
+    fields.sort_unstable();
+    let mut hasher = std::collections::hash_map::DefaultHasher::new();
+    fields.hash(&mut hasher);
+    hasher.finish()
+}
+
+#[cfg(feature = "enterprise")]
+async fn scope(org: &str, now: i64, alert: &Alert) -> Option<Scope> {
+    let alert_id = alert.id.as_ref()?.to_string();
+    let (folder, _) = crate::db::alerts::alert::get_alert_from_cache(org, &alert_id).await?;
+    let group_by = alert
+        .query_condition
+        .multi_alert_enabled()
+        .then(|| crate::alerts::scheduler::handlers::alert_group_by(alert));
+    Some(Scope {
+        alert_id,
+        folder_id: folder.folder_id,
+        semantic_groups: semantic_groups(org, now).await,
+        group_by,
+    })
+}
+
+#[cfg(feature = "enterprise")]
+fn push_row(org: &str, now: i64, entry: &mut AlertEntry, row: Row, signature: Option<u64>) {
+    let alert = &entry.alert;
+    let Some(scope) = &entry.scope else {
+        entry
+            .rows
+            .push(row, None, signature, |_| Dims::new(), |_| None);
+        return;
+    };
+    let group = scope.group_by.as_ref().map(|group_by| {
+        crate::alerts::scheduler::handlers::downtime_row_key(alert, group_by, &row)
+    });
+    let group_key = group.clone();
+    entry.rows.push(
+        row,
+        group,
+        signature,
+        |row| {
+            o2_enterprise::enterprise::oncall::routing::dimensions_for_alert(
+                &scope.semantic_groups,
+                &alert.query_condition,
+                row,
+            )
+        },
+        |dims| {
+            crate::alerts::downtimes::active_for_alert_key(
+                org,
+                &scope.alert_id,
+                &scope.folder_id,
+                dims,
+                group_key.as_deref(),
+                now,
+            )
+        },
+    );
+}
+
+#[cfg(not(feature = "enterprise"))]
+fn push_row(_org: &str, _now: i64, entry: &mut AlertEntry, row: Row, signature: Option<u64>) {
+    entry
+        .rows
+        .push(row, None, signature, |_| Dims::new(), |_| None);
+}
+
+#[cfg(feature = "enterprise")]
+async fn finish_entry(org: &str, now: i64, key: &str, entry: AlertEntry) -> TriggerAlertData {
+    let AlertEntry { alert, scope, rows } = entry;
+    let Some(scope) = scope else {
+        return into_trigger(alert, rows.finish(Dims::new(), |_, _| None));
+    };
+    let mut empty_identity = Dims::new();
+    if let Some(row) = rows.fallback_row()
+        && let Some(service) = fallback_service(org, key, now, &scope.semantic_groups, row).await
+    {
+        empty_identity.insert(config::meta::oncall::SERVICE_DIMENSION.to_string(), service);
+    }
+    let verdict = rows.finish(empty_identity, |dims, group_key| {
+        crate::alerts::downtimes::active_for_alert_key(
+            org,
+            &scope.alert_id,
+            &scope.folder_id,
+            dims,
+            group_key,
+            now,
+        )
+    });
+    into_trigger(alert, verdict)
+}
+
+#[cfg(not(feature = "enterprise"))]
+async fn finish_entry(_org: &str, _now: i64, _key: &str, entry: AlertEntry) -> TriggerAlertData {
+    into_trigger(entry.alert, entry.rows.finish(Dims::new(), |_, _| None))
+}
+
+fn into_trigger(alert: Alert, verdict: Verdict) -> TriggerAlertData {
+    match verdict {
+        Verdict::Deliver(rows) => vec![(alert, rows, RealtimeMute::Unmuted)],
+        // A suppressed run reads only the downtime, never the rows.
+        Verdict::Suppress(downtime) => vec![(alert, vec![], RealtimeMute::Muted(downtime))],
+        Verdict::Nothing => vec![],
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use config::meta::alerts::level::PAYLOAD_SAMPLE_ROWS;
+
+    use super::*;
+
+    const ROW_CAP: usize = PAYLOAD_SAMPLE_ROWS as usize;
+
+    fn row(service: &str) -> Row {
+        let mut row = Row::new();
+        if !service.is_empty() {
+            row.insert("service".to_string(), Value::String(service.to_string()));
+        }
+        row
+    }
+
+    fn dims_of(row: &Row) -> Dims {
+        row.get("service")
+            .and_then(|v| v.as_str())
+            .map(|s| Dims::from([("service".to_string(), s.to_string())]))
+            .unwrap_or_default()
+    }
+
+    fn downtime(id: &str) -> ActiveDowntime {
+        ActiveDowntime {
+            id: id.to_string(),
+            ..Default::default()
+        }
+    }
+
+    /// A downtime on `service=a`, the way `active_for_alert` answers.
+    fn mutes_a(dims: &Dims) -> Option<ActiveDowntime> {
+        (dims.get("service").map(String::as_str) == Some("a")).then(|| downtime("dt-a"))
+    }
+
+    fn mutes_all(_: &Dims) -> Option<ActiveDowntime> {
+        Some(downtime("dt-all"))
+    }
+
+    /// The answer for a plain alert, which ignores the group key.
+    fn plain(
+        active: fn(&Dims) -> Option<ActiveDowntime>,
+    ) -> impl FnMut(&Dims, Option<&str>) -> Option<ActiveDowntime> {
+        move |dims, _| active(dims)
+    }
+
+    fn split(
+        rows: &[&str],
+        groups: Option<&[&str]>,
+        active: fn(&Dims) -> Option<ActiveDowntime>,
+    ) -> RowSplit {
+        let mut split = RowSplit::with_cap(ROW_CAP);
+        for (i, service) in rows.iter().enumerate() {
+            let group = groups.map(|g| g[i].to_string());
+            split.push(row(service), group, None, dims_of, active);
+        }
+        split
+    }
+
+    fn delivered(verdict: &Verdict) -> Vec<String> {
+        match verdict {
+            Verdict::Deliver(rows) => rows
+                .iter()
+                .map(|r| dims_of(r).get("service").cloned().unwrap_or_default())
+                .collect(),
+            other => panic!("expected a delivery, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn a_muted_row_never_hides_an_unmuted_one_in_either_order() {
+        for rows in [["a", "b"], ["b", "a"]] {
+            let verdict = split(&rows, None, mutes_a).finish(Dims::new(), plain(mutes_a));
+            assert_eq!(delivered(&verdict), ["b"]);
+        }
+    }
+
+    #[test]
+    fn only_muted_rows_suppress_with_the_downtime() {
+        let verdict = split(&["a", "a"], None, mutes_a).finish(Dims::new(), plain(mutes_a));
+        match verdict {
+            Verdict::Suppress(downtime) => assert_eq!(downtime.id, "dt-a"),
+            other => panic!("expected a suppression, got {other:?}"),
+        }
+    }
+
+    #[test]
+    fn muted_rows_past_the_cap_never_push_out_an_unmuted_row() {
+        let mut rows = vec!["a"; 150];
+        rows.push("b");
+        let verdict = split(&rows, None, mutes_a).finish(Dims::new(), plain(mutes_a));
+        assert_eq!(delivered(&verdict), ["b"]);
+    }
+
+    #[test]
+    fn a_metric_series_seen_once_is_not_taken_again() {
+        let mut split = RowSplit::with_cap(ROW_CAP);
+        for signature in [1, 1, 2] {
+            split.push(row("b"), None, Some(signature), dims_of, mutes_a);
+        }
+        assert!(split.seen(1) && split.seen(2) && !split.seen(3));
+        assert_eq!(
+            delivered(&split.finish(Dims::new(), plain(mutes_a))).len(),
+            2
+        );
+    }
+
+    #[test]
+    fn a_multi_alert_group_takes_the_decision_of_its_first_row() {
+        // Group keys: rows 1 and 3 are group "ga" (service a), row 2 is group "gb".
+        let verdict = split(&["a", "b", "a"], Some(&["ga", "gb", "ga"]), mutes_a)
+            .finish(Dims::new(), plain(mutes_a));
+        assert_eq!(delivered(&verdict), ["b"]);
+        let reversed = split(&["b", "a", "a"], Some(&["gb", "ga", "ga"]), mutes_a)
+            .finish(Dims::new(), plain(mutes_a));
+        assert_eq!(delivered(&reversed), ["b"]);
+        // A later row of a group follows its first row even with other dims.
+        let verdict =
+            split(&["b", "a"], Some(&["g", "g"]), mutes_a).finish(Dims::new(), plain(mutes_a));
+        assert_eq!(delivered(&verdict), ["b", "a"]);
+    }
+
+    #[test]
+    fn the_fallback_runs_only_when_no_group_first_row_has_an_identity() {
+        // The group's first row is empty, its second row has service a: the fallback still runs.
+        let split_rows = split(&["", "a"], Some(&["g", "g"]), mutes_a);
+        assert!(split_rows.fallback_row().is_some());
+        let fallback = Dims::from([("service".to_string(), "a".to_string())]);
+        assert!(matches!(
+            split_rows.finish(fallback, plain(mutes_a)),
+            Verdict::Suppress(_)
+        ));
+    }
+
+    #[test]
+    fn empty_rows_beside_an_identity_are_decided_with_empty_dims() {
+        let mut rows = vec![""; 150];
+        rows.push("b");
+        let split_rows = split(&rows, None, mutes_a);
+        assert!(split_rows.fallback_row().is_none(), "row b has an identity");
+        let verdict = split_rows.finish(Dims::new(), plain(mutes_a));
+        assert_eq!(
+            delivered(&verdict).len(),
+            ROW_CAP,
+            "b plus empty rows, capped"
+        );
+    }
+
+    #[test]
+    fn empty_rows_past_the_cap_suppress_when_the_downtime_covers_them() {
+        let mut rows = vec![""; 150];
+        rows.push("b");
+        let verdict = split(&rows, None, mutes_all).finish(Dims::new(), plain(mutes_all));
+        assert!(matches!(verdict, Verdict::Suppress(_)));
+    }
+
+    #[test]
+    fn rows_with_no_identity_use_the_fallback_service() {
+        let split_rows = split(&["", ""], None, mutes_a);
+        assert!(split_rows.fallback_row().is_some());
+        let fallback = Dims::from([("service".to_string(), "a".to_string())]);
+        assert!(matches!(
+            split_rows.finish(fallback, plain(mutes_a)),
+            Verdict::Suppress(_)
+        ));
+    }
+
+    #[test]
+    fn empty_rows_of_a_multi_alert_are_decided_per_group_key() {
+        let split_rows = split(&["", ""], Some(&["g1", "g2"]), mutes_a);
+        let verdict = split_rows.finish(Dims::new(), |_, group| {
+            (group == Some("g1")).then(|| downtime("dt-g1"))
+        });
+        assert_eq!(delivered(&verdict), [""]);
+        let all_muted = split(&["", ""], Some(&["g1", "g2"]), mutes_a)
+            .finish(Dims::new(), |_, group| group.map(downtime));
+        assert!(matches!(all_muted, Verdict::Suppress(_)));
+    }
+
+    #[cfg(feature = "enterprise")]
+    #[test]
+    fn the_discovery_key_ignores_fields_outside_the_semantic_groups() {
+        use config::meta::correlation::FieldAlias;
+        let groups = [FieldAlias::new("service", "Service", &["service", "svc"])];
+        let with = |svc: &str, ts: i64| {
+            let mut row = row("");
+            row.insert("svc".to_string(), Value::String(svc.to_string()));
+            row.insert("_timestamp".to_string(), Value::from(ts));
+            fields_hash(&row, &groups)
+        };
+        assert_eq!(
+            with("a", 1),
+            with("a", 2),
+            "_timestamp must not split the cache"
+        );
+        assert_ne!(
+            with("a", 1),
+            with("b", 1),
+            "a different service must not share it"
+        );
+    }
+}
diff --git a/src/core/src/logs/mod.rs b/src/core/src/logs/mod.rs
index 7d00161405..5a203b18d0 100644
--- a/src/core/src/logs/mod.rs
+++ b/src/core/src/logs/mod.rs
@@ -480,6 +480,9 @@ async fn write_logs(
     let mut triggers: TriggerAlertData =
         Vec::with_capacity(cur_stream_alerts.map_or(0, |v| v.len()));
     let mut evaluated_alerts = HashSet::new();
+    // An org with an alert downtime classifies every matching row, so a muted row hides none.
+    let mut mute_split = cur_stream_alerts
+        .and_then(|_| crate::ingestion::realtime_mute::RealtimeMuteSplit::for_org(org_id, 1));
     // End get stream alert
 
     // start check for schema
@@ -598,7 +601,10 @@ async fn write_logs(
 
         // start check for alert trigger
         if let Some(alerts) = cur_stream_alerts
-            && triggers.len() < alerts.len()
+            && match &mute_split {
+                Some(split) => split.full_alerts() < alerts.len(),
+                None => triggers.len() < alerts.len(),
+            }
         {
             let end_time = now_micros();
             for alert in alerts {
@@ -611,7 +617,11 @@ async fn write_logs(
                 );
                 // For one alert, only one trigger per request
                 // Trigger for this alert is already added.
-                if evaluated_alerts.contains(&key) {
+                let done = match &mute_split {
+                    Some(split) => split.is_full(&key),
+                    None => evaluated_alerts.contains(&key),
+                };
+                if done {
                     continue;
                 }
                 match alert
@@ -619,8 +629,18 @@ async fn write_logs(
                     .await
                 {
                     Ok(trigger_results) if trigger_results.data.is_some() => {
-                        triggers.push((alert.clone(), trigger_results.data.unwrap()));
-                        evaluated_alerts.insert(key);
+                        let rows = trigger_results.data.unwrap();
+                        match mute_split.as_mut() {
+                            Some(split) => split.push(&key, alert, rows, None).await,
+                            None => {
+                                triggers.push((
+                                    alert.clone(),
+                                    rows,
+                                    crate::ingestion::RealtimeMute::Unchecked,
+                                ));
+                                evaluated_alerts.insert(key);
+                            }
+                        }
                     }
                     Ok(_) => {
                         // the data doesn't satisfy the alert condition
@@ -685,6 +705,9 @@ async fn write_logs(
         .await?
     };
 
+    if let Some(split) = mute_split {
+        tokio::spawn(split.evaluate());
+    }
     // only one trigger per request
     if !triggers.is_empty() {
         tokio::spawn(evaluate_trigger(triggers));
diff --git a/src/core/src/metrics/ingest.rs b/src/core/src/metrics/ingest.rs
index 14740e1bee..b27217ce16 100644
--- a/src/core/src/metrics/ingest.rs
+++ b/src/core/src/metrics/ingest.rs
@@ -122,6 +122,12 @@ impl StreamKeyChecks {
     }
 }
 
+/// One stream's realtime alert work, sent only after its records are written.
+pub(super) struct StreamTriggers {
+    triggers: TriggerAlertData,
+    mute_split: Option<crate::ingestion::realtime_mute::RealtimeMuteSplit>,
+}
+
 /// Runs each stream's pipelines over its buffered records, grouping the output by destination.
 pub(super) async fn run_pipelines<T: Clone>(
     org_id: &str,
@@ -317,7 +323,7 @@ pub(super) async fn buffer_stream_records(
     partition_keys: Option<&Vec<StreamPartition>>,
     alerts: Option<&Vec<alert::Alert>>,
     partitions: &mut HashMap<String, SchemaRecords>,
-) -> Option<TriggerAlertData> {
+) -> Option<StreamTriggers> {
     let partition_keys = partition_keys.unwrap_or(&NO_PARTITION_KEYS);
     let partition_time_level = infra::schema::get_partition_time_level(StreamType::Metrics);
     let mut partition_memo = PartitionMemo::new(partition_keys, partition_time_level);
@@ -338,6 +344,13 @@ pub(super) async fn buffer_stream_records(
         .unwrap_or_default();
     let mut triggers: TriggerAlertData = Vec::with_capacity(alert_keys.len());
     let mut trigger_slots: HashMap<String, super::TriggerSlot> = HashMap::new();
+    // An org with an alert downtime classifies each series before the label cap.
+    let mut mute_split = alerts.and_then(|_| {
+        crate::ingestion::realtime_mute::RealtimeMuteSplit::for_org(
+            org_id,
+            super::TRIGGER_LABEL_LIMIT,
+        )
+    });
 
     for (record, timestamp) in records {
         if let Some(alerts) = alerts {
@@ -347,6 +360,7 @@ pub(super) async fn buffer_stream_records(
                 &alert_keys,
                 &mut triggers,
                 &mut trigger_slots,
+                mute_split.as_mut(),
             )
             .await;
         }
@@ -364,7 +378,10 @@ pub(super) async fn buffer_stream_records(
         partition.records.push(Arc::new(record));
     }
 
-    (!triggers.is_empty()).then_some(triggers)
+    (!triggers.is_empty() || mute_split.is_some()).then_some(StreamTriggers {
+        triggers,
+        mute_split,
+    })
 }
 
 /// Each stream's WAL entries, from its JSON partitions and from what went straight to arrow.
@@ -487,10 +504,15 @@ pub(super) fn observe_request(
 }
 
 /// Sends each stream's alert notification off the request path.
-pub(super) fn spawn_triggers(stream_trigger_map: HashMap<String, Option<TriggerAlertData>>) {
+pub(super) fn spawn_triggers(stream_trigger_map: HashMap<String, Option<StreamTriggers>>) {
     // only one trigger per request; notification/db work must not block ingestion
     for entry in stream_trigger_map.into_values().flatten() {
-        tokio::spawn(evaluate_trigger(entry));
+        if !entry.triggers.is_empty() {
+            tokio::spawn(evaluate_trigger(entry.triggers));
+        }
+        if let Some(split) = entry.mute_split {
+            tokio::spawn(split.evaluate());
+        }
     }
 }
 
@@ -622,25 +644,35 @@ async fn evaluate_record_alerts(
     alert_keys: &[String],
     triggers: &mut TriggerAlertData,
     trigger_slots: &mut HashMap<String, super::TriggerSlot>,
+    mut mute_split: Option<&mut crate::ingestion::realtime_mute::RealtimeMuteSplit>,
 ) {
     let end_time = now_micros();
     let dedup = super::series_signature(record);
     for (alert, key) in alerts.iter().zip(alert_keys) {
         // one row per label set: a series repeats its labels on every sample
-        if !super::trigger_wants_labels(trigger_slots, key, dedup) {
+        let wanted = match mute_split.as_deref() {
+            Some(split) => !split.is_full(key) && !split.seen(key, dedup),
+            None => super::trigger_wants_labels(trigger_slots, key, dedup),
+        };
+        if !wanted {
             continue;
         }
         match alert.evaluate(Some(record), (None, end_time), None).await {
-            Ok(results) if results.data.is_some() => {
-                super::merge_trigger_rows(
+            Ok(results) if results.data.is_some() => match mute_split.as_deref_mut() {
+                Some(split) => {
+                    split
+                        .push(key, alert, results.data.unwrap(), Some(dedup))
+                        .await
+                }
+                None => super::merge_trigger_rows(
                     triggers,
                     trigger_slots,
                     key,
                     dedup,
                     alert,
                     results.data.unwrap(),
-                );
-            }
+                ),
+            },
             Ok(_) => {}
             Err(e) => {
                 log::error!("[METRICS] Error while evaluating realtime alert: {e}");
diff --git a/src/core/src/metrics/json.rs b/src/core/src/metrics/json.rs
index 381e41ff3f..7008e436e3 100644
--- a/src/core/src/metrics/json.rs
+++ b/src/core/src/metrics/json.rs
@@ -47,7 +47,7 @@ use ingestion_common::{IngestionResponse, StreamStatus};
 use super::ingest::{self, PipelineFailure, PipelineInputs, RecordsByStream};
 use crate::{
     common::meta::{authz::Authz, stream::SchemaRecords},
-    ingestion::{TriggerAlertData, check_ingestion_allowed},
+    ingestion::check_ingestion_allowed,
     pipeline::batch_execution::ExecutablePipeline,
 };
 
@@ -314,7 +314,7 @@ async fn buffer_stream_rows(
     (mut rows, first_type): (Vec<Row>, Option<&'static str>),
     lookups: &mut StreamLookups,
     partitions: &mut HashMap<String, SchemaRecords>,
-) -> Result<Option<TriggerAlertData>> {
+) -> Result<Option<ingest::StreamTriggers>> {
     if !lookups.partitions.contains_key(stream_name) {
         let keys =
             crate::ingestion::get_stream_partition_keys(org_id, &StreamType::Metrics, stream_name)
@@ -511,7 +511,7 @@ pub async fn ingest(
     }
 
     let mut stream_data_buf: HashMap<String, HashMap<String, SchemaRecords>> = HashMap::new();
-    let mut stream_trigger_map: HashMap<String, Option<TriggerAlertData>> = HashMap::new();
+    let mut stream_trigger_map: HashMap<String, Option<ingest::StreamTriggers>> = HashMap::new();
     for (stream_name, records) in records_by_stream {
         // redacted before finish_rows, so the series hash covers the stored values
         #[cfg(feature = "vectorscan")]
diff --git a/src/core/src/metrics/mod.rs b/src/core/src/metrics/mod.rs
index 0569514662..89edf678d3 100644
--- a/src/core/src/metrics/mod.rs
+++ b/src/core/src/metrics/mod.rs
@@ -277,7 +277,11 @@ fn merge_trigger_rows(
                     labels: HashSet::from([labels]),
                 },
             );
-            triggers.push((alert.clone(), rows));
+            triggers.push((
+                alert.clone(),
+                rows,
+                crate::ingestion::RealtimeMute::Unchecked,
+            ));
         }
     }
 }
diff --git a/src/core/src/metrics/otlp.rs b/src/core/src/metrics/otlp.rs
index 79ce589f82..78c38a64b2 100644
--- a/src/core/src/metrics/otlp.rs
+++ b/src/core/src/metrics/otlp.rs
@@ -61,7 +61,7 @@ use crate::{
         stream::SchemaRecords,
     },
     ingestion::{
-        TriggerAlertData, check_ingestion_allowed,
+        check_ingestion_allowed,
         grpc::{get_exemplar_val, get_metric_val, get_val},
     },
     pipeline::batch_execution::ExecutablePipeline,
@@ -247,7 +247,7 @@ pub async fn handle_otlp_request(
 
     // realtime alerts
     let mut stream_alerts_map: HashMap<String, Vec<alert::Alert>> = HashMap::new();
-    let mut stream_trigger_map: HashMap<String, Option<TriggerAlertData>> = HashMap::new();
+    let mut stream_trigger_map: HashMap<String, Option<ingest::StreamTriggers>> = HashMap::new();
 
     let mut partial_success = ExportMetricsPartialSuccess::default();
 
diff --git a/src/core/src/metrics/prom.rs b/src/core/src/metrics/prom.rs
index 02f51cb3e4..7b713d3068 100644
--- a/src/core/src/metrics/prom.rs
+++ b/src/core/src/metrics/prom.rs
@@ -65,7 +65,7 @@ use crate::{
         infra::config::{METRIC_CLUSTER_LEADER, METRIC_CLUSTER_MAP},
         meta::stream::SchemaRecords,
     },
-    ingestion::{TriggerAlertData, check_ingestion_allowed},
+    ingestion::check_ingestion_allowed,
     pipeline::batch_execution::ExecutablePipeline,
 };
 
@@ -186,7 +186,7 @@ pub async fn remote_write(
 
     // realtime alerts
     let mut stream_alerts_map: HashMap<String, Vec<alert::Alert>> = HashMap::new();
-    let mut stream_trigger_map: HashMap<String, Option<TriggerAlertData>> = HashMap::new();
+    let mut stream_trigger_map: HashMap<String, Option<ingest::StreamTriggers>> = HashMap::new();
 
     let decoded = config::utils::snappy::decode_raw_snappy(&body, cfg.limit.req_payload_limit)
         .map_err(|e| anyhow::anyhow!("Invalid snappy compressed data: {e}"))?;
diff --git a/src/core/src/metrics/usage.rs b/src/core/src/metrics/usage.rs
index 0bde6e6754..0e0e64a655 100644
--- a/src/core/src/metrics/usage.rs
+++ b/src/core/src/metrics/usage.rs
@@ -481,6 +481,7 @@ async fn route_allows(
             use_all_org: route.use_all_org,
             use_self_context: route.use_self_context,
             use_self_parent: route.use_self_parent,
+            feature: None,
         },
         role.clone(),
         false,
@@ -509,6 +510,7 @@ async fn folder_get(
             use_all_org: false,
             use_self_context: false,
             use_self_parent: true,
+            feature: None,
         },
         role.clone(),
         false,
diff --git a/src/core/src/org_cleanup/coverage.rs b/src/core/src/org_cleanup/coverage.rs
index 55e813bb31..fb6547f49c 100644
--- a/src/core/src/org_cleanup/coverage.rs
+++ b/src/core/src/org_cleanup/coverage.rs
@@ -229,6 +229,9 @@ pub const COVERAGE: &[Coverage] = &[
     table("workflow_associations", DB),
     table("workflow_drafts", DB),
     table("workflow_errors", DB),
+    table("workflow_http_trigger_credentials", DB),
+    table("workflow_http_trigger_requests", DB),
+    table("workflow_http_triggers", DB),
     table("workflow_run_data", DB),
     table("workflows", DB),
     table("org_domain_ownership", DB),
diff --git a/src/core/src/org_cleanup/mod.rs b/src/core/src/org_cleanup/mod.rs
index 345a799722..07a1c34a6c 100644
--- a/src/core/src/org_cleanup/mod.rs
+++ b/src/core/src/org_cleanup/mod.rs
@@ -30,7 +30,7 @@ use infra::{
     org_lifecycle::OrgLifecycleGuard,
     table::{org_cleanup_tasks, organizations},
 };
-use sea_orm::TransactionTrait;
+use sea_orm::{ConnectionTrait, TransactionTrait};
 
 #[cfg(feature = "cloud")]
 use crate::{org_domain_ownership, org_domain_requests};
@@ -932,6 +932,136 @@ async fn delete_org_sourcemaps(org_id: &str) -> Result<(), anyhow::Error> {
     Ok(())
 }
 
+/// Tombstones go out first: once the rows are gone nothing is left to build them from.
+async fn delete_org_workflow_http_triggers(org_id: &str) -> Result<(), anyhow::Error> {
+    #[cfg(feature = "enterprise")]
+    emit_org_trigger_tombstones(org_id).await?;
+    let gone = delete_org_workflow_rows(get_orm_client_rw().await, org_id).await?;
+    #[cfg(feature = "enterprise")]
+    forget_org_triggers(org_id, &gone).await;
+    #[cfg(not(feature = "enterprise"))]
+    drop(gone);
+    Ok(())
+}
+
+/// After the delete: a cache reload before it would find the rows and keep them for the TTL.
+#[cfg(feature = "enterprise")]
+async fn forget_org_triggers(org_id: &str, trigger_ids: &[String]) {
+    for trigger_id in trigger_ids {
+        if let Err(e) = crate::db::workflow_http_triggers::forget_local(trigger_id).await {
+            log::warn!(
+                "[OrgCleanup] org '{org_id}': cache of trigger {trigger_id} not evicted: {e}"
+            );
+        }
+    }
+}
+
+#[cfg(feature = "enterprise")]
+async fn emit_org_trigger_tombstones(org_id: &str) -> Result<(), anyhow::Error> {
+    let snapshots = org_trigger_tombstones(
+        get_orm_client_rw().await,
+        org_id,
+        config::utils::time::now_micros(),
+        &config::get_cluster_name(),
+    )
+    .await?;
+    for snapshot in &snapshots {
+        // Not retried: a region whose org row is gone refuses the org's hooks anyway.
+        if let Err(e) = crate::db::workflow_http_triggers::emit_prepared(snapshot).await {
+            log::warn!(
+                "[OrgCleanup] org '{org_id}': tombstone of trigger {} not sent: {e}",
+                snapshot.trigger.id
+            );
+        }
+    }
+    Ok(())
+}
+
+/// Version + 1, now and the local cluster outrank the stored row, so every receiver applies it.
+#[cfg(feature = "enterprise")]
+async fn org_trigger_tombstones<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+    now_us: i64,
+    local_cluster: &str,
+) -> Result<Vec<infra::table::workflow_http_triggers::TriggerSnapshot>, anyhow::Error> {
+    use infra::table::workflow_http_triggers::{
+        self as http_triggers, AuthMode, CredentialKind, CredentialState, ReplicatedCredential,
+        ReplicatedTrigger, TriggerSnapshot,
+    };
+
+    let mut snapshots = Vec::new();
+    for trigger in http_triggers::list_by_org(db, org_id).await? {
+        let Some(auth_mode) = AuthMode::parse(&trigger.auth_mode) else {
+            log::warn!(
+                "[OrgCleanup] trigger {} has an unknown auth mode, no tombstone",
+                trigger.id
+            );
+            continue;
+        };
+        let credentials = http_triggers::list_credentials(db, &trigger.id)
+            .await?
+            .into_iter()
+            .filter_map(|credential| {
+                Some(ReplicatedCredential {
+                    kind: CredentialKind::parse(&credential.kind)?,
+                    state: CredentialState::Revoked,
+                    revoked_at: credential.revoked_at.or(Some(now_us)),
+                    updated_at: now_us,
+                    secret: None,
+                    id: credential.id,
+                    display_prefix: credential.display_prefix,
+                    token_sha256: credential.token_sha256,
+                    expires_at: credential.expires_at,
+                    created_by: credential.created_by,
+                    created_at: credential.created_at,
+                })
+            })
+            .collect();
+        snapshots.push(TriggerSnapshot {
+            version: trigger.version + 1,
+            origin_cluster: local_cluster.to_string(),
+            deleted: true,
+            trigger: ReplicatedTrigger {
+                id: trigger.id,
+                org_id: trigger.org_id,
+                workflow_id: trigger.workflow_id,
+                enabled: trigger.enabled,
+                auth_mode,
+                max_body_bytes: trigger.max_body_bytes,
+                rate_limit_per_minute: trigger.rate_limit_per_minute,
+                created_by: trigger.created_by,
+                created_at: trigger.created_at,
+                updated_at: now_us,
+                deleted_at: trigger.deleted_at.or(Some(now_us)),
+            },
+            credentials,
+        });
+    }
+    Ok(snapshots)
+}
+
+async fn delete_org_workflow_rows<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+) -> Result<Vec<String>, anyhow::Error> {
+    use infra::{
+        secrets::SecretOwnerKind,
+        table::{llm_secrets, workflow_http_trigger_requests, workflow_http_triggers},
+    };
+
+    let trigger_ids = workflow_http_triggers::list_by_org(db, org_id)
+        .await?
+        .into_iter()
+        .map(|trigger| trigger.id)
+        .collect();
+    workflow_http_trigger_requests::delete_by_org(db, org_id).await?;
+    workflow_http_triggers::delete_by_org(db, org_id).await?;
+    llm_secrets::delete_by_org_owner_kind(db, org_id, SecretOwnerKind::WorkflowTrigger.as_str())
+        .await?;
+    Ok(trigger_ids)
+}
+
 /// Per report through the db layer, its ownership tuple first, so a retry still finds the row.
 async fn delete_org_reports(org_id: &str) -> Result<(), anyhow::Error> {
     let conn = get_orm_client_rw().await;
@@ -1283,6 +1413,9 @@ async fn step_delete_db_resources(org_id: &str) -> Result<(), anyhow::Error> {
     infra::storage::del_org_prefix_strict(org_id, &format!("synthetics/{org_id}/"))
         .await
         .map_err(|e| anyhow::anyhow!("step_delete_db_resources/synthetics_artifacts: {e}"))?;
+    delete_org_workflow_http_triggers(org_id)
+        .await
+        .map_err(|e| anyhow::anyhow!("step_delete_db_resources/workflow_http_triggers: {e}"))?;
     workflows::delete_children_by_org(org_id)
         .await
         .map_err(|e| anyhow::anyhow!("step_delete_db_resources/workflow_children: {e}"))?;
@@ -1579,6 +1712,8 @@ async fn emit_status_audit(org_id: &str, actor: &str, from: &str, to: &str) {
             _timestamp: config::utils::time::now_micros(),
             protocol: auditor::Protocol::Http,
             delegated: None,
+            fleet_id: None,
+            target: None,
             response_meta: auditor::ResponseMeta {
                 http_method: "SYSTEM".to_string(),
                 http_path: format!("/system/org_cleanup/{from}_to_{to}"),
@@ -5394,4 +5529,217 @@ mod tests {
             "drop_member_tuples(org_id, &member.email, &member.role, member.user_removed)"
         ));
     }
+
+    mod workflow_teardown {
+        use infra::{
+            secrets::{self, SecretOwnerKind},
+            table::{
+                entity::{
+                    llm_secrets, workflow_http_trigger_credentials as credentials,
+                    workflow_http_trigger_requests as requests, workflow_http_triggers as triggers,
+                },
+                workflow_http_trigger_requests::{self as ledger, NewHookRequest},
+                workflow_http_triggers as http_triggers,
+            },
+        };
+        use sea_orm::{
+            ColumnTrait, ConnectOptions, Database, DatabaseConnection, EntityTrait, PaginatorTrait,
+            QueryFilter,
+        };
+
+        use super::{super::*, SOURCE, position_of};
+
+        const NOW: i64 = 1_760_000_000_000_000;
+
+        /// One connection: separate connections to `sqlite::memory:` are separate databases.
+        async fn db() -> DatabaseConnection {
+            let mut opts = ConnectOptions::new("sqlite::memory:".to_string());
+            opts.max_connections(1);
+            let db = Database::connect(opts).await.unwrap();
+            http_triggers::create_tables_for_tests(&db).await.unwrap();
+            infra::table::workflows::create_tables_for_tests(&db)
+                .await
+                .unwrap();
+            db
+        }
+
+        async fn seed_trigger(db: &DatabaseConnection, org: &str) {
+            let trigger_id = format!("t-{org}");
+            http_triggers::insert_trigger(
+                db,
+                triggers::Model {
+                    id: trigger_id.clone(),
+                    org_id: org.to_string(),
+                    workflow_id: format!("wf-{org}"),
+                    enabled: true,
+                    auth_mode: "signature".to_string(),
+                    max_body_bytes: 1_048_576,
+                    rate_limit_per_minute: 60,
+                    created_by: "a@x.io".to_string(),
+                    created_at: NOW - 10,
+                    updated_at: NOW - 10,
+                    version: 3,
+                    origin_cluster: "r2".to_string(),
+                    deleted_at: None,
+                    last_invoked_at: None,
+                    rejections: None,
+                },
+            )
+            .await
+            .unwrap();
+            let credential_id = format!("c-{org}");
+            let prepared =
+                secrets::prepared_for_tests(org, SecretOwnerKind::WorkflowTrigger, &credential_id);
+            let secret_ref = secrets::insert_prepared(db, prepared)
+                .await
+                .unwrap()
+                .metadata
+                .secret_ref;
+            http_triggers::insert_credential(
+                db,
+                credentials::Model {
+                    id: credential_id,
+                    trigger_id: trigger_id.clone(),
+                    org_id: org.to_string(),
+                    kind: "signing_secret".to_string(),
+                    display_prefix: "whsec_abcd…wxyz".to_string(),
+                    token_sha256: None,
+                    secret_ref: Some(secret_ref),
+                    state: "active".to_string(),
+                    expires_at: None,
+                    revoked_at: None,
+                    created_by: "a@x.io".to_string(),
+                    created_at: NOW - 10,
+                    updated_at: NOW - 10,
+                    last_used_at: None,
+                },
+            )
+            .await
+            .unwrap();
+            let request = NewHookRequest {
+                trigger_id,
+                org_id: org.to_string(),
+                workflow_id: format!("wf-{org}"),
+                run_id: format!("run-{org}"),
+                idem_key: None,
+                body_sha256: "cd".repeat(32),
+                body_bytes: 2,
+                content_type: None,
+                meta: "{}".to_string(),
+                credential_id: format!("c-{org}"),
+                credential_prefix: "whsec_abcd…wxyz".to_string(),
+                caller_ip: "203.0.113.7".to_string(),
+                received_at: NOW,
+            };
+            ledger::enqueue(db, request, "{}".to_string())
+                .await
+                .unwrap();
+        }
+
+        async fn hook_rows(db: &DatabaseConnection, org: &str) -> [u64; 4] {
+            [
+                triggers::Entity::find()
+                    .filter(triggers::Column::OrgId.eq(org))
+                    .count(db)
+                    .await
+                    .unwrap(),
+                credentials::Entity::find()
+                    .filter(credentials::Column::OrgId.eq(org))
+                    .count(db)
+                    .await
+                    .unwrap(),
+                requests::Entity::find()
+                    .filter(requests::Column::OrgId.eq(org))
+                    .count(db)
+                    .await
+                    .unwrap(),
+                llm_secrets::Entity::find()
+                    .filter(llm_secrets::Column::OrgId.eq(org))
+                    .filter(llm_secrets::Column::OwnerKind.eq("workflow_trigger"))
+                    .count(db)
+                    .await
+                    .unwrap(),
+            ]
+        }
+
+        #[tokio::test]
+        async fn org_delete_removes_workflow_http_trigger_rows_and_secrets() {
+            let db = db().await;
+            seed_trigger(&db, "gone").await;
+            seed_trigger(&db, "kept").await;
+            assert_eq!(hook_rows(&db, "gone").await, [1, 1, 1, 1]);
+
+            let gone = delete_org_workflow_rows(&db, "gone").await.unwrap();
+            assert_eq!(
+                gone,
+                ["t-gone"],
+                "the deleted triggers are named for eviction"
+            );
+            assert_eq!(hook_rows(&db, "gone").await, [0, 0, 0, 0]);
+            assert_eq!(hook_rows(&db, "kept").await, [1, 1, 1, 1]);
+        }
+
+        #[test]
+        fn the_db_resources_step_deletes_the_orgs_workflow_http_triggers() {
+            assert!(
+                position_of("delete_org_workflow_http_triggers(org_id)")
+                    < position_of("workflows::delete_children_by_org(org_id)"),
+                "the trigger rows go before the workflows they start"
+            );
+            let helper = SOURCE
+                .find("async fn delete_org_workflow_http_triggers")
+                .expect("the helper is defined in this file");
+            let body = &SOURCE[helper..];
+            let body = &body[..body.find("\n}\n").unwrap()];
+            assert!(
+                body.find("emit_org_trigger_tombstones(org_id)").unwrap()
+                    < body.find("delete_org_workflow_rows(").unwrap(),
+                "tombstones are emitted while the rows still exist"
+            );
+            assert!(
+                body.contains("#[cfg(feature = \"enterprise\")]\n    emit_org_trigger_tombstones"),
+                "the super-cluster emit exists only in enterprise builds"
+            );
+            assert!(
+                body.find("delete_org_workflow_rows(").unwrap()
+                    < body.find("forget_org_triggers(org_id, &gone)").unwrap(),
+                "caches are evicted after the delete, so no reload finds the rows again"
+            );
+        }
+
+        #[cfg(feature = "enterprise")]
+        #[tokio::test]
+        async fn org_delete_emits_a_deleted_snapshot_per_trigger_before_deleting() {
+            let db = db().await;
+            seed_trigger(&db, "gone").await;
+            seed_trigger(&db, "kept").await;
+            let snapshots = org_trigger_tombstones(&db, "gone", NOW, "r1")
+                .await
+                .unwrap();
+            assert_eq!(snapshots.len(), 1);
+            let snapshot = &snapshots[0];
+            assert_eq!(snapshot.trigger.id, "t-gone");
+            assert!(snapshot.deleted);
+            assert_eq!(snapshot.version, 4, "local version + 1");
+            assert_eq!(snapshot.trigger.updated_at, NOW);
+            assert_eq!(snapshot.trigger.deleted_at, Some(NOW));
+            assert_eq!(snapshot.origin_cluster, "r1");
+            let local = http_triggers::get(&db, "t-gone").await.unwrap().unwrap();
+            assert!(
+                snapshot.supersedes(Some(&local)),
+                "a receiver holding the local row applies it"
+            );
+            assert_eq!(snapshot.credentials.len(), 1);
+            assert_eq!(
+                snapshot.credentials[0].state,
+                http_triggers::CredentialState::Revoked
+            );
+            assert_eq!(snapshot.credentials[0].secret, None);
+            assert_eq!(
+                hook_rows(&db, "gone").await,
+                [1, 1, 1, 1],
+                "nothing deleted yet"
+            );
+        }
+    }
 }
diff --git a/src/core/src/pipeline/batch_execution.rs b/src/core/src/pipeline/batch_execution.rs
index 6c4f3cc087..bdaa5e130a 100644
--- a/src/core/src/pipeline/batch_execution.rs
+++ b/src/core/src/pipeline/batch_execution.rs
@@ -49,6 +49,7 @@ use proto::cluster_rpc;
 #[cfg(feature = "enterprise")]
 use tokio::sync::Mutex;
 use tokio::sync::mpsc::{Receiver, Sender, channel};
+use tokio_util::sync::CancellationToken;
 use transform::{
     QUERY_FUNCTIONS, apply_vrl_fn, compile_vrl_function,
     js::{JSRuntimeConfig, apply_js_fn, compile_js_function},
@@ -70,13 +71,25 @@ struct BatchBuffer {
     last_write: Instant,
 }
 
-/// Per-run switches; only the Test path sets these, so triggers and retries are unchanged.
-#[derive(Default, Clone, Copy)]
+/// Only the Test path sets `suppress_destinations` and only the hook worker sets `cancel`.
+#[derive(Default, Clone)]
 pub struct WorkflowRunOptions {
     /// Destination nodes report the routing they resolved instead of dispatching.
     pub suppress_destinations: bool,
+    pub cancel: Option<CancellationToken>,
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct RunCancelled;
+
+impl std::fmt::Display for RunCancelled {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        write!(f, "workflow run cancelled")
+    }
+}
+
+impl std::error::Error for RunCancelled {}
+
 #[derive(Default)]
 pub struct WorkflowResult {
     pub stream_details: HashMap<StreamParams, Vec<(usize, Value)>>,
@@ -85,6 +98,14 @@ pub struct WorkflowResult {
     pub outputs: HashMap<String, Vec<Value>>,
 }
 
+enum NodeTaskOutput {
+    Node(Result<()>),
+    Results(HashMap<StreamParams, Vec<(usize, Value)>>),
+    Errors(Option<PipelineError>),
+    Inputs(HashMap<String, Vec<Value>>),
+    Outputs(HashMap<String, Vec<Value>>),
+}
+
 #[cfg(feature = "enterprise")]
 fn eval_sampling_key(record: &json::Value, idx: usize) -> String {
     record
@@ -603,7 +624,8 @@ impl ExecutablePipeline {
                 leaf_dest_stream: _leaf_dest_stream,
                 return_value_for_error: false, // pipelines do not support this
                 suppress_destinations: false,  // pipelines have no destination nodes
-                flatten_records: true,         // ingest depends on flattened records
+                cancel: None,
+                flatten_records: true, // ingest depends on flattened records
             };
             let channels = ProcessChannels {
                 receiver: node_receiver,
@@ -844,7 +866,7 @@ impl ExecutablePipeline {
         }
 
         // Spawn tasks for each node
-        let mut node_tasks = Vec::with_capacity(self.sorted_nodes.len());
+        let mut tasks = tokio::task::JoinSet::new();
         for (idx, node_id) in self.sorted_nodes.iter().enumerate() {
             let pl_id_cp = self.id.to_string();
             let org_id_cp = org_id.to_string();
@@ -892,6 +914,7 @@ impl ExecutablePipeline {
                 leaf_dest_stream: _leaf_dest_stream,
                 return_value_for_error: true,
                 suppress_destinations: options.suppress_destinations,
+                cancel: options.cancel.clone(),
                 flatten_records: false,
                 source_stream_name: "system_workflow_trigger".to_string(),
             };
@@ -919,20 +942,17 @@ impl ExecutablePipeline {
                         .collect()
                 })
                 .unwrap_or_default();
-            let task = tokio::spawn(process_node(
-                metadata,
-                node,
-                function_runtime,
-                channels,
-                handle_routes,
-            ));
-            node_tasks.push(task);
+            tasks.spawn(async move {
+                NodeTaskOutput::Node(
+                    process_node(metadata, node, function_runtime, channels, handle_routes).await,
+                )
+            });
         }
 
         // task to collect results
         let pl_name_for_results = pipeline_name.clone();
         let inv_id_for_results = inv_id.clone();
-        let result_task = tokio::spawn(async move {
+        tasks.spawn(async move {
             log::debug!(
                 "[Workflow] {pl_name_for_results} [inv={inv_id_for_results}]: starts result collecting job"
             );
@@ -949,13 +969,13 @@ impl ExecutablePipeline {
                     .or_insert(Vec::new())
                     .push((idx, record));
             }
-            results
+            NodeTaskOutput::Results(results)
         });
 
         // task to collect errors
         let mut pipeline_error = PipelineError::new(&self.id, &self.name);
         let inv_id_for_errors = inv_id.clone();
-        let error_task = tokio::spawn(async move {
+        tasks.spawn(async move {
             log::debug!("[Workflow] [inv={inv_id_for_errors}]: starts error collecting job");
             let mut count = 0;
             while let Some((node_id, node_type, error, fn_name, val)) = error_receiver.recv().await
@@ -964,27 +984,23 @@ impl ExecutablePipeline {
                 count += 1;
             }
             log::debug!("[Workflow] [inv={inv_id_for_errors}]: collected {count} errors");
-            if count > 0 {
-                Some(pipeline_error)
-            } else {
-                None
-            }
+            NodeTaskOutput::Errors((count > 0).then_some(pipeline_error))
         });
 
-        let inputs_task = tokio::spawn(async move {
+        tasks.spawn(async move {
             let mut input_map = HashMap::new();
             while let Some((node_id, val)) = inputs_receiver.recv().await {
                 input_map.entry(node_id).or_insert(vec![]).push(val);
             }
-            input_map
+            NodeTaskOutput::Inputs(input_map)
         });
 
-        let outputs_task = tokio::spawn(async move {
+        tasks.spawn(async move {
             let mut outputs_map = HashMap::new();
             while let Some((node_id, val)) = outputs_receiver.recv().await {
                 outputs_map.entry(node_id).or_insert(vec![]).push(val);
             }
-            outputs_map
+            NodeTaskOutput::Outputs(outputs_map)
         });
 
         // Send records to the source node to begin processing
@@ -1028,34 +1044,32 @@ impl ExecutablePipeline {
         log::debug!(
             "[Workflow] {pipeline_name} [inv={inv_id}]: waiting for all node tasks to complete"
         );
-        if let Err(e) = try_join_all(node_tasks).await {
-            log::error!(
-                "[Workflow] {pipeline_name} [inv={inv_id}]: node processing jobs failed: {e}"
-            );
-        }
+        let task_outputs = join_node_tasks(tasks, options.cancel.as_ref())
+            .await
+            .inspect_err(|_| {
+                log::info!(
+                    "[Workflow] {pipeline_name} [inv={inv_id}]: run cancelled after every task drained"
+                );
+            })?;
         log::debug!("[Workflow] {pipeline_name} [inv={inv_id}]: all node tasks completed");
 
-        // Publish errors if received any
-        log::debug!("[Workflow] {pipeline_name} [inv={inv_id}]: awaiting error task");
-        let errors = error_task.await.map_err(|e| {
-            log::error!(
-                "[Workflow] {pipeline_name} [inv={inv_id}]: error collecting job failed: {e}"
-            );
-            anyhow!("[Workflow] error collecting job failed: {}", e)
-        })?;
+        let (mut results, mut errors, mut inputs, mut outputs) = (None, None, None, None);
+        for output in task_outputs {
+            match output {
+                NodeTaskOutput::Node(Err(e)) => {
+                    log::debug!("[Workflow] {pipeline_name} [inv={inv_id}]: node returned {e}");
+                }
+                NodeTaskOutput::Node(Ok(())) => {}
+                NodeTaskOutput::Results(v) => results = Some(v),
+                NodeTaskOutput::Errors(v) => errors = Some(v),
+                NodeTaskOutput::Inputs(v) => inputs = Some(v),
+                NodeTaskOutput::Outputs(v) => outputs = Some(v),
+            }
+        }
 
-        let inputs = inputs_task.await.map_err(|e| {
-            log::error!(
-                "[Workflow] {pipeline_name} [inv={inv_id}]: input collecting job failed: {e}"
-            );
-            anyhow!("[Workflow] input collecting job failed: {}", e)
-        })?;
-        let outputs = outputs_task.await.map_err(|e| {
-            log::error!(
-                "[Workflow] {pipeline_name} [inv={inv_id}]: output collecting job failed: {e}"
-            );
-            anyhow!("[Workflow] output collecting job failed: {}", e)
-        })?;
+        let errors = errors.ok_or_else(|| anyhow!("[Workflow] error collecting job failed"))?;
+        let inputs = inputs.ok_or_else(|| anyhow!("[Workflow] input collecting job failed"))?;
+        let outputs = outputs.ok_or_else(|| anyhow!("[Workflow] output collecting job failed"))?;
 
         let node_errors = errors
             .as_ref()
@@ -1082,13 +1096,7 @@ impl ExecutablePipeline {
             publish_error(error_data).await;
         }
 
-        log::debug!("[Workflow] {pipeline_name} [inv={inv_id}]: awaiting result collector");
-        let results = result_task.await.map_err(|e| {
-            log::error!(
-                "[Workflow] {pipeline_name} [inv={inv_id}]: result collecting job failed: {e}"
-            );
-            anyhow!("[Workflow] result collecting job failed: {}", e)
-        })?;
+        let results = results.ok_or_else(|| anyhow!("[Workflow] result collecting job failed"))?;
         log::debug!(
             "[Workflow] {pipeline_name} [inv={inv_id}]: result collector returned {} stream groups",
             results.len()
@@ -1238,6 +1246,7 @@ struct ProcessMetadata {
     leaf_dest_stream: Option<StreamParams>,
     return_value_for_error: bool,
     suppress_destinations: bool,
+    cancel: Option<CancellationToken>,
     /// Ingest flattens so conditions can index a flat row; a workflow's event shape is a
     /// user-facing contract, so it is preserved and columns are resolved against it.
     flatten_records: bool,
@@ -1281,6 +1290,33 @@ impl ProcessChannels {
     }
 }
 
+async fn join_node_tasks(
+    mut tasks: tokio::task::JoinSet<NodeTaskOutput>,
+    cancel: Option<&CancellationToken>,
+) -> Result<Vec<NodeTaskOutput>, RunCancelled> {
+    let mut outputs = Vec::with_capacity(tasks.len());
+    loop {
+        let next = match cancel {
+            Some(cancel) => tokio::select! {
+                biased;
+                _ = cancel.cancelled() => None,
+                next = tasks.join_next() => Some(next),
+            },
+            None => Some(tasks.join_next().await),
+        };
+        match next {
+            None => {
+                tasks.abort_all();
+                while tasks.join_next().await.is_some() {}
+                return Err(RunCancelled);
+            }
+            Some(None) => return Ok(outputs),
+            Some(Some(Ok(output))) => outputs.push(output),
+            Some(Some(Err(e))) => log::error!("[Workflow] node processing job failed: {e}"),
+        }
+    }
+}
+
 async fn process_node(
     metadata: ProcessMetadata,
     node: ExecutableNode,
@@ -2950,7 +2986,15 @@ async fn process_destination_node(
                     for (name, val) in headers {
                         req = req.header(name, val);
                     }
-                    req.body(send_data).send().await.map_err(|e| e.to_string())
+                    let send = req.body(send_data).send();
+                    match metadata.cancel.as_ref() {
+                        Some(cancel) => tokio::select! {
+                            biased;
+                            _ = cancel.cancelled() => return Err(RunCancelled.into()),
+                            res = send => res.map_err(|e| e.to_string()),
+                        },
+                        None => send.await.map_err(|e| e.to_string()),
+                    }
                 }
                 Err(e) => Err(e),
             };
@@ -3266,7 +3310,7 @@ mod tests {
         collections::HashMap,
         sync::{
             Arc,
-            atomic::{AtomicU64, Ordering},
+            atomic::{AtomicU64, AtomicUsize, Ordering},
         },
     };
 
@@ -3367,6 +3411,7 @@ mod tests {
             leaf_dest_stream: None,
             return_value_for_error: false,
             suppress_destinations: false,
+            cancel: None,
             flatten_records: true,
         };
         let (input_tx, input_rx) = tokio::sync::mpsc::channel(1);
@@ -3934,6 +3979,7 @@ mod tests {
             leaf_dest_stream: None,
             return_value_for_error: false,
             suppress_destinations: false,
+            cancel: None,
             flatten_records: true,
         }
     }
@@ -4246,6 +4292,7 @@ mod tests {
             leaf_dest_stream: None,
             return_value_for_error: false,
             suppress_destinations: false,
+            cancel: None,
             flatten_records: false,
         }
     }
@@ -4864,6 +4911,7 @@ mod tests {
                 None,
                 WorkflowRunOptions {
                     suppress_destinations: true,
+                    ..Default::default()
                 },
             )
             .await
@@ -4954,6 +5002,7 @@ mod tests {
                 None,
                 WorkflowRunOptions {
                     suppress_destinations: true,
+                    ..Default::default()
                 },
             )
             .await
@@ -4989,6 +5038,7 @@ mod tests {
                 None,
                 WorkflowRunOptions {
                     suppress_destinations: true,
+                    ..Default::default()
                 },
             )
             .await
@@ -5025,6 +5075,7 @@ mod tests {
                 None,
                 WorkflowRunOptions {
                     suppress_destinations: false,
+                    ..Default::default()
                 },
             )
             .await
@@ -5057,6 +5108,7 @@ mod tests {
                 None,
                 WorkflowRunOptions {
                     suppress_destinations: false,
+                    ..Default::default()
                 },
             )
             .await
@@ -5101,6 +5153,7 @@ mod tests {
                         None,
                         WorkflowRunOptions {
                             suppress_destinations: false,
+                            ..Default::default()
                         },
                     )
                     .await
@@ -5584,4 +5637,175 @@ mod tests {
             "the sleeping task only woke after {woke_after}ms, so the JavaScript eval held the worker"
         );
     }
+
+    #[tokio::test]
+    async fn a_cancelled_run_returns_only_after_every_node_task_has_drained() {
+        struct CountsDrop(Arc<AtomicUsize>);
+        impl Drop for CountsDrop {
+            fn drop(&mut self) {
+                self.0.fetch_add(1, Ordering::SeqCst);
+            }
+        }
+        let dropped = Arc::new(AtomicUsize::new(0));
+        let mut tasks = tokio::task::JoinSet::new();
+        for _ in 0..3 {
+            let guard = CountsDrop(dropped.clone());
+            tasks.spawn(async move {
+                let _guard = guard;
+                std::future::pending::<()>().await;
+                NodeTaskOutput::Node(Ok(()))
+            });
+        }
+        let cancel = CancellationToken::new();
+        let trigger = cancel.clone();
+        tokio::spawn(async move {
+            tokio::time::sleep(Duration::from_millis(20)).await;
+            trigger.cancel();
+        });
+
+        let res = join_node_tasks(tasks, Some(&cancel)).await;
+
+        assert!(
+            matches!(res, Err(RunCancelled)),
+            "a cancelled join must report the cancel"
+        );
+        assert_eq!(
+            dropped.load(Ordering::SeqCst),
+            3,
+            "every node task must be dropped before the join returns"
+        );
+    }
+
+    #[tokio::test]
+    async fn a_run_without_a_cancel_token_is_unchanged() {
+        let workflow = test_workflow(
+            vec![
+                Node::new(
+                    "t1".to_string(),
+                    NodeData::WorkflowTrigger,
+                    0.0,
+                    0.0,
+                    "input".to_string(),
+                ),
+                Node::new(
+                    "c1".to_string(),
+                    NodeData::Condition(pass_all_condition()),
+                    0.0,
+                    0.0,
+                    "default".to_string(),
+                ),
+            ],
+            vec![Edge::new("t1".to_string(), "c1".to_string())],
+        );
+        let executable = ExecutablePipeline::new_from_workflow(&workflow)
+            .await
+            .expect("condition workflow must build");
+        let record = json::json!({"severity": "high"});
+
+        let without = executable
+            .process_workflow("org-1", vec![record.clone()], None, Default::default())
+            .await
+            .expect("a run without a token must not fail");
+        let with_idle_token = executable
+            .process_workflow(
+                "org-1",
+                vec![record.clone()],
+                None,
+                WorkflowRunOptions {
+                    cancel: Some(CancellationToken::new()),
+                    ..Default::default()
+                },
+            )
+            .await
+            .expect("a run whose token never fires must not fail");
+
+        assert!(without.errors.is_empty());
+        assert_eq!(
+            without.outputs.get("c1").and_then(|o| o.first()),
+            Some(&record),
+            "the condition must still forward the record"
+        );
+        assert_eq!(without.inputs, with_idle_token.inputs);
+        assert_eq!(without.outputs, with_idle_token.outputs);
+    }
+
+    /// Holds every connection open without answering, counting each one as it arrives.
+    #[cfg(feature = "enterprise")]
+    async fn hanging_server(seen: Arc<AtomicUsize>, arrived: Arc<tokio::sync::Notify>) -> String {
+        let listener = tokio::net::TcpListener::bind("127.0.0.1:0").await.unwrap();
+        let port = listener.local_addr().unwrap().port();
+        tokio::spawn(async move {
+            let mut held = Vec::new();
+            while let Ok((sock, _)) = listener.accept().await {
+                seen.fetch_add(1, Ordering::SeqCst);
+                arrived.notify_one();
+                held.push(sock);
+            }
+        });
+        format!("http://127.0.0.1:{port}")
+    }
+
+    #[cfg(feature = "enterprise")]
+    #[test]
+    fn a_cancelled_run_sends_nothing_to_the_destination_after_abort() {
+        crate::ssrf_test_support::isolated(
+            concat!(
+                module_path!(),
+                "::a_cancelled_run_sends_nothing_to_the_destination_after_abort"
+            ),
+            &[("ZO_SSRF_ALLOWED_CIDRS", "127.0.0.1/32")],
+            || async {
+                let seen = Arc::new(AtomicUsize::new(0));
+                let arrived = Arc::new(tokio::sync::Notify::new());
+                let base = hanging_server(seen.clone(), arrived.clone()).await;
+                seed_pipeline_destination_with_url("org-1", "hanging", &format!("{base}/hold"));
+                let executable =
+                    ExecutablePipeline::new_from_workflow(&destination_workflow("hanging"))
+                        .await
+                        .expect("workflow must build");
+                let cancel = CancellationToken::new();
+                let options = WorkflowRunOptions {
+                    cancel: Some(cancel.clone()),
+                    ..Default::default()
+                };
+
+                let run = executable.process_workflow(
+                    "org-1",
+                    vec![json::json!({"n": 1})],
+                    None,
+                    options.clone(),
+                );
+                let cancel_on_arrival = async {
+                    arrived.notified().await;
+                    cancel.cancel();
+                };
+                let (res, ()) = tokio::time::timeout(Duration::from_secs(10), async {
+                    tokio::join!(run, cancel_on_arrival)
+                })
+                .await
+                .expect("a cancelled run must return without waiting for the destination");
+                let err = res.err().expect("a cancelled run must not report success");
+                assert!(
+                    err.downcast_ref::<RunCancelled>().is_some(),
+                    "the run must end as cancelled, got {err}"
+                );
+
+                let again = executable
+                    .process_workflow("org-1", vec![json::json!({"n": 2})], None, options)
+                    .await;
+                assert!(
+                    again
+                        .err()
+                        .is_some_and(|e| e.downcast_ref::<RunCancelled>().is_some()),
+                    "a run whose token is already cancelled must end as cancelled"
+                );
+                tokio::time::sleep(Duration::from_millis(200)).await;
+                assert_eq!(
+                    seen.load(Ordering::SeqCst),
+                    1,
+                    "no destination request may start after the cancel"
+                );
+            },
+        );
+    }
 }
diff --git a/src/core/src/public_dashboards/defaults.rs b/src/core/src/public_dashboards/defaults.rs
index a52dd85e17..e249f7fcfc 100644
--- a/src/core/src/public_dashboards/defaults.rs
+++ b/src/core/src/public_dashboards/defaults.rs
@@ -33,7 +33,9 @@ use config::{
 use regex::{Captures, Regex};
 use serde_json::Value;
 
-use super::variables::{SELECT_ALL_VALUE, escape, js_string, normalize_syntax, placeholder_regex};
+use super::variables::{
+    DateSpec, SELECT_ALL_VALUE, escape, js_string, normalize_syntax, placeholder_regex,
+};
 
 /// The picker's page size when the variable sets none.
 const DEFAULT_VALUES_SIZE: i64 = 10;
@@ -183,6 +185,14 @@ impl<'a> Defaults<'a> {
 
     /// Visible variable name → key, global then tab then panel, as the instance's picker sees them.
     fn visible(&self, idx: usize) -> BTreeMap<String, String> {
+        self.visible_instances(idx)
+            .into_iter()
+            .map(|(name, o)| (name, o.key.clone()))
+            .collect()
+    }
+
+    /// The instance behind each visible name.
+    fn visible_instances(&self, idx: usize) -> BTreeMap<String, &Instance<'a>> {
         let me = &self.instances[idx];
         self.instances
             .iter()
@@ -192,7 +202,7 @@ impl<'a> Defaults<'a> {
                 (Some(tab), None) => me.tab.as_ref() == Some(tab),
                 (_, Some(panel)) => me.panel.as_ref() == Some(panel),
             })
-            .map(|o| (o.var.name.clone(), o.key.clone()))
+            .map(|o| (o.var.name.clone(), o))
             .collect()
     }
 
@@ -200,10 +210,14 @@ impl<'a> Defaults<'a> {
     fn values_query(&self, idx: usize) -> ValuesQuery {
         let var = self.instances[idx].var;
         let qd = var.query_data.clone().unwrap_or_default();
-        let scope: BTreeMap<String, Value> = self
-            .visible(idx)
-            .into_iter()
-            .filter_map(|(name, key)| self.values.get(&key).map(|v| (name, v.clone())))
+        let visible = self.visible_instances(idx);
+        let scope: BTreeMap<String, Value> = visible
+            .iter()
+            .filter_map(|(name, o)| self.values.get(&o.key).map(|v| (name.clone(), v.clone())))
+            .collect();
+        let dates: BTreeMap<String, DateSpec> = visible
+            .iter()
+            .filter_map(|(name, o)| Some((name.clone(), DateSpec::of(o.var)?)))
             .collect();
         let stream = resolve_name(&qd.stream, &scope);
         let field = resolve_name(&qd.field, &scope);
@@ -221,7 +235,7 @@ impl<'a> Defaults<'a> {
         let filter = if conditions.is_empty() {
             String::new()
         } else {
-            format!(" WHERE {}", substitute_context(&conditions, &scope))
+            format!(" WHERE {}", substitute_context(&conditions, &scope, &dates))
         };
         let sql = format!(
             "SELECT {} AS zo_sql_key FROM {}{filter} GROUP BY zo_sql_key ORDER BY zo_sql_key ASC LIMIT {size}",
@@ -435,8 +449,13 @@ fn split_quoted(input: &str) -> Vec<String> {
         .collect()
 }
 
-/// `buildQueryContext`'s replacement: lists quoted per item unless the placeholder is quoted.
-fn substitute_context(text: &str, scope: &BTreeMap<String, Value>) -> String {
+/// `buildQueryContext`'s replacement: lists quoted per item unless the placeholder is quoted, and a
+/// date in its format.
+fn substitute_context(
+    text: &str,
+    scope: &BTreeMap<String, Value>,
+    dates: &BTreeMap<String, DateSpec>,
+) -> String {
     let text = normalize_syntax(text);
     let mut names: Vec<&str> = scope.keys().map(String::as_str).collect();
     names.sort_by_key(|n| std::cmp::Reverse(n.len()));
@@ -451,6 +470,14 @@ fn substitute_context(text: &str, scope: &BTreeMap<String, Value>) -> String {
             .or_else(|| c.get(5))
             .map_or("", |m| m.as_str());
         let quoted = text[..whole.start()].ends_with('\'') && text[whole.end()..].starts_with('\'');
+        let format = c.get(2).or_else(|| c.get(4)).map(|m| m.as_str());
+        let date = scope
+            .get(name)
+            .zip(dates.get(name))
+            .and_then(|(v, spec)| spec.format(v, format));
+        if let Some(date) = date {
+            return escape(&date);
+        }
         match scope.get(name) {
             Some(Value::Array(items)) => {
                 let items: Vec<String> = items.iter().map(|v| escape(&js_string(v))).collect();
@@ -749,24 +776,72 @@ mod tests {
 
     #[test]
     fn context_substitution_matches_the_live_picker() {
+        let none = BTreeMap::new();
         let scope = BTreeMap::from([
             ("x".to_string(), json!("O'B")),
             ("y".to_string(), json!(["p", "q'r"])),
             ("z".to_string(), Value::Null),
         ]);
         assert_eq!(
-            substitute_context(r#""a" = '$x' AND "b" IN ('$y') AND "c" != 'z'"#, &scope),
+            substitute_context(
+                r#""a" = '$x' AND "b" IN ('$y') AND "c" != 'z'"#,
+                &scope,
+                &none
+            ),
             r#""a" = 'O''B' AND "b" IN ('p', 'q''r') AND "c" != 'z'"#
         );
         assert_eq!(
             substitute_context(
                 "a = '$y' AND b IN ($y) AND c = '${x}' AND d = '{{z}}' AND e = $x",
-                &scope
+                &scope,
+                &none
             ),
             "a = 'p', 'q''r' AND b IN ('p', 'q''r') AND c = 'O''B' AND d = '{{z}}' AND e = O''B"
         );
     }
 
+    #[test]
+    fn a_date_variable_reaches_a_values_query_in_its_format() {
+        let dash = dashboard(json!([
+            { "type": "date", "name": "day", "dateFormat": "epochus" },
+            { "type": "query_values", "name": "pod",
+              "query_data": { "stream": "logs", "field": "pod", "filter": [
+                { "name": "_timestamp", "operator": ">=", "value": "$day" },
+                { "name": "d", "operator": "=", "value": "${day:dmy}" } ] } }
+        ]));
+        let frozen = BTreeMap::from([("day".to_string(), json!("2026-07-01"))]);
+        let mut d = Defaults::new(&dash, frozen);
+        let pod = d.next_query().expect("pod");
+        assert_eq!(
+            pod.query.sql,
+            r#"SELECT "pod" AS zo_sql_key FROM "logs" WHERE "_timestamp" >= '1782864000000000' AND "d" = '01/07/2026' GROUP BY zo_sql_key ORDER BY zo_sql_key ASC LIMIT 10"#
+        );
+    }
+
+    #[test]
+    fn context_substitution_prints_a_date_in_its_format() {
+        let spec = |format: &str| {
+            DateSpec::of(&VariableList {
+                type_field: "date".to_string(),
+                date_format: Some(format.to_string()),
+                ..Default::default()
+            })
+            .unwrap()
+        };
+        let scope = BTreeMap::from([
+            ("d".to_string(), json!("2026-07-01")),
+            ("e".to_string(), json!("")),
+        ]);
+        let dates = BTreeMap::from([
+            ("d".to_string(), spec("epochus")),
+            ("e".to_string(), spec("dmy")),
+        ]);
+        assert_eq!(
+            substitute_context("a >= $d AND b = '${d:iso}' AND c = '$e'", &scope, &dates),
+            "a >= 1782864000000000 AND b = '2026-07-01' AND c = ''"
+        );
+    }
+
     #[test]
     fn stream_and_field_names_take_a_list_s_first_item() {
         let scope = BTreeMap::from([
diff --git a/src/core/src/public_dashboards/mask.rs b/src/core/src/public_dashboards/mask.rs
index 8f02ecfe7f..c3c6737fd1 100644
--- a/src/core/src/public_dashboards/mask.rs
+++ b/src/core/src/public_dashboards/mask.rs
@@ -241,6 +241,8 @@ mod tests {
             value,
             tab_id: None,
             panel_id: None,
+            var_type: None,
+            date_format: None,
         };
         let body = ResultBody {
             variables: vec![var("svc", json!("checkout")), var("env", json!("prod"))],
diff --git a/src/core/src/public_dashboards/materialize.rs b/src/core/src/public_dashboards/materialize.rs
index 620a98445f..954b24a873 100644
--- a/src/core/src/public_dashboards/materialize.rs
+++ b/src/core/src/public_dashboards/materialize.rs
@@ -1462,6 +1462,8 @@ pub(super) mod tests {
                     value: json!("checkout"),
                     tab_id: None,
                     panel_id: None,
+                    var_type: None,
+                    date_format: None,
                 }],
                 variable_keys: vec!["svc".into()],
                 values_dependencies: vec![ValuesDependency {
diff --git a/src/core/src/public_dashboards/variables.rs b/src/core/src/public_dashboards/variables.rs
index 4261e0a914..127cb3313a 100644
--- a/src/core/src/public_dashboards/variables.rs
+++ b/src/core/src/public_dashboards/variables.rs
@@ -20,7 +20,9 @@ use std::collections::BTreeMap;
 use config::meta::dashboards::Dashboard;
 use regex::{Captures, Regex};
 
-const VARIABLE_FORMATS: &str = "csv|pipe|doublequote|singlequote";
+/// The list formats, then a date variable's (longer epoch names first).
+const VARIABLE_FORMATS: &str = "csv|pipe|doublequote|singlequote|iso|dmy|mdy|epochms|epochus|epoch";
+const DATE_FORMATS: [&str; 6] = ["iso", "dmy", "mdy", "epochms", "epochus", "epoch"];
 /// What an unset or empty value becomes; the server reads a filter on it as "all".
 pub(super) const SELECT_ALL_VALUE: &str = "_o2_all_";
 const MIN_PERCENTILE_SAMPLES: f64 = 20.0;
@@ -90,17 +92,25 @@ impl QueryVars {
 
     /// The values one panel sees: each variable's global, tab or panel value, as its scope says.
     pub fn for_panel(&self, tab_id: &str, panel_id: &str) -> PanelVars {
-        let values = self
-            .vars
-            .iter()
-            .filter_map(|var| {
-                let key = var.key_for(tab_id, panel_id)?;
-                let value = self.frozen.get(&key)?;
-                Some((var.name.clone(), value.clone()))
-            })
-            .collect();
+        let mut values = BTreeMap::new();
+        let mut dates = BTreeMap::new();
+        for var in &self.vars {
+            let Some(value) = var
+                .key_for(tab_id, panel_id)
+                .and_then(|key| self.frozen.get(&key))
+            else {
+                continue;
+            };
+            values.insert(var.name.clone(), value.clone());
+            // The variable that gives the value decides how it prints.
+            match &var.date {
+                Some(spec) => dates.insert(var.name.clone(), spec.clone()),
+                None => dates.remove(&var.name),
+            };
+        }
         PanelVars {
             values,
+            dates,
             scrape_secs: self.scrape_secs,
         }
     }
@@ -110,6 +120,50 @@ impl QueryVars {
 struct ScopedVar {
     name: String,
     scope: Scope,
+    date: Option<DateSpec>,
+}
+
+/// How a date variable prints when its placeholder names no date format.
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct DateSpec {
+    format: String,
+}
+
+impl DateSpec {
+    /// Only a `date` variable has one; an unknown default format prints `iso`.
+    pub(super) fn of(v: &config::meta::dashboards::v8::VariableList) -> Option<Self> {
+        (v.type_field == "date").then(|| Self {
+            format: v
+                .date_format
+                .clone()
+                .filter(|f| DATE_FORMATS.contains(&f.as_str()))
+                .unwrap_or_else(|| "iso".to_string()),
+        })
+    }
+
+    /// The value in the placeholder's date format, else the default; None unless it is a date.
+    pub(super) fn format(
+        &self,
+        value: &serde_json::Value,
+        placeholder: Option<&str>,
+    ) -> Option<String> {
+        let serde_json::Value::String(date) = value else {
+            return None;
+        };
+        let start = config::utils::time::start_of_date_micros(date)?;
+        let format = placeholder
+            .filter(|f| DATE_FORMATS.contains(f))
+            .unwrap_or(self.format.as_str());
+        let (y, m, d) = (&date[0..4], &date[5..7], &date[8..10]);
+        Some(match format {
+            "dmy" => format!("{d}/{m}/{y}"),
+            "mdy" => format!("{m}/{d}/{y}"),
+            "epoch" => start.div_euclid(1_000_000).to_string(),
+            "epochms" => start.div_euclid(1_000).to_string(),
+            "epochus" => start.to_string(),
+            _ => date.clone(),
+        })
+    }
 }
 
 impl ScopedVar {
@@ -138,6 +192,7 @@ impl From<&config::meta::dashboards::v8::VariableList> for ScopedVar {
         Self {
             name: v.name.clone(),
             scope,
+            date: DateSpec::of(v),
         }
     }
 }
@@ -151,6 +206,7 @@ enum Scope {
 /// One panel's variable values plus the inputs of `$__interval` and kin.
 pub struct PanelVars {
     values: BTreeMap<String, serde_json::Value>,
+    dates: BTreeMap<String, DateSpec>,
     scrape_secs: f64,
 }
 
@@ -186,10 +242,13 @@ impl PanelVars {
                     value.clone()
                 };
             }
-            self.values.get(name).map_or_else(
-                || caps[0].to_string(),
-                |v| format_value(v, format, query_type),
-            )
+            let Some(v) = self.values.get(name) else {
+                return caps[0].to_string();
+            };
+            match self.dates.get(name).and_then(|spec| spec.format(v, format)) {
+                Some(date) => escape(&date),
+                None => format_value(v, format, query_type),
+            }
         })
         .into_owned()
     }
@@ -418,6 +477,7 @@ mod tests {
                 .iter()
                 .map(|(k, v)| (k.to_string(), v.clone()))
                 .collect(),
+            dates: BTreeMap::new(),
             scrape_secs: 15.0,
         }
     }
@@ -472,6 +532,58 @@ mod tests {
         assert_eq!(vars.for_panel("t1", "p1").scrape_secs, 15.0);
     }
 
+    #[test]
+    fn a_date_variable_prints_in_its_format() {
+        let dash = Dashboard {
+            v8: Some(
+                serde_json::from_value(json!({
+                    "variables": {
+                        "list": [
+                            { "type": "date", "name": "day" },
+                            { "type": "date", "name": "micros", "dateFormat": "epochus" },
+                            { "type": "date", "name": "odd", "dateFormat": "nope" },
+                            { "type": "textbox", "name": "tb" },
+                            { "type": "date", "name": "empty" }
+                        ]
+                    }
+                }))
+                .unwrap(),
+            ),
+            ..Default::default()
+        };
+        let frozen = BTreeMap::from([
+            ("day".to_string(), json!("2026-07-01")),
+            ("micros".to_string(), json!("2026-07-01")),
+            ("odd".to_string(), json!("2026-07-01")),
+            ("tb".to_string(), json!("2026-07-01")),
+            ("empty".to_string(), json!("")),
+        ]);
+        let v = QueryVars::new(&dash, frozen, None).for_panel("t1", "p1");
+        assert_eq!(
+            sub(
+                &v,
+                "'$day' ${day:dmy} {{day:mdy}} ${day:epoch} ${ day : epochms }",
+                "sql"
+            ),
+            "'2026-07-01' 01/07/2026 07/01/2026 1782864000 1782864000000"
+        );
+        // The placeholder's date format wins; a list format keeps the variable's default.
+        assert_eq!(
+            sub(
+                &v,
+                "$micros ${micros:iso} ${micros:epoch} ${micros:csv}",
+                "sql"
+            ),
+            "1782864000000000 2026-07-01 1782864000 1782864000000000"
+        );
+        // An unknown default prints iso, a date format means nothing to a textbox, and empty stays
+        // empty.
+        assert_eq!(
+            sub(&v, "$odd ${tb:epoch} '$empty'", "sql"),
+            "2026-07-01 2026-07-01 ''"
+        );
+    }
+
     #[test]
     fn replaces_every_syntax_including_spaced_ones() {
         let v = qv(&[("svc", json!("api"))]);
diff --git a/src/core/src/traces/mod.rs b/src/core/src/traces/mod.rs
index df1154700d..8f1ce5b779 100644
--- a/src/core/src/traces/mod.rs
+++ b/src/core/src/traces/mod.rs
@@ -80,7 +80,7 @@ use crate::{
         evaluate_trigger, get_thread_id, grpc::get_val, write_file,
     },
     logs::IngestJsonData,
-    traces::otel::{OtelIngestionProcessor, is_llm_trace},
+    traces::otel::{OtelIngestionProcessor, SpanContext, is_llm_trace},
 };
 
 const SERVICE_NAME: &str = "service.name";
@@ -88,7 +88,7 @@ const SERVICE: &str = "service";
 const PARENT_SPAN_ID: &str = "reference.parent_span_id";
 const PARENT_TRACE_ID: &str = "reference.parent_trace_id";
 const REF_TYPE: &str = "reference.ref_type";
-const RESERVED_SPAN_FIELDS: [&str; 33] = [
+const RESERVED_SPAN_FIELDS: [&str; 34] = [
     "trace_id",
     "span_id",
     "flags",
@@ -122,6 +122,10 @@ const RESERVED_SPAN_FIELDS: [&str; 33] = [
     crate::db_monitoring::O2_DB_ENV,
     crate::db_monitoring::O2_DB_STMT_CLASS,
     crate::db_monitoring::O2_DB_BATCH_MULTIPLIER,
+    // The ingest pricing marker: any spelling a client sends (`gen_ai.usage.cost_status`,
+    // `gen_ai_usage_cost_status`, …) on any span gets the attr_ prefix, so only the
+    // processor's own value reaches the column.
+    config::meta::model_pricing::COST_STATUS_COLUMN,
     "events",
     "links",
     TIMESTAMP_COL_NAME,
@@ -359,15 +363,18 @@ async fn queue_gen_ai_agent_observations(org_id: &str, mut observations: AgentOb
     .await;
 }
 
-/// Strip client-supplied derived-identity keys (`o2_db_*`, `infer_service_*`)
-/// from a JSON-path record BEFORE re-derivation (design D1 condition 1):
+/// Strip client-supplied derived keys (`o2_db_*`, `infer_service_*`, the ingest pricing
+/// marker) from a JSON-path record BEFORE re-derivation (design D1 condition 1):
 /// `RESERVED_SPAN_FIELDS` protects the OTLP path only — the JSON ingest path
 /// flattens the caller's record keys directly, so a spoofed `o2_db_fingerprint`
 /// (or `infer_service_name`, fixed in the same PR per the design) would land as
 /// a trusted aggregation key. Legitimate values written by a first-pass OTLP
 /// enrichment re-derive identically from the raw `db_*` / peer attributes that
-/// are still on the record (the derivations are deterministic).
+/// are still on the record (the derivations are deterministic). This path does not
+/// price spans, so it never sets `gen_ai_usage_cost_status`; a value on the record is
+/// not ingest's.
 fn strip_client_supplied_derived_fields(record_val: &mut Map<String, json::Value>) {
+    record_val.remove(config::meta::model_pricing::COST_STATUS_COLUMN);
     // one key scan instead of 20 map removals: a record almost never carries a derived key
     if !record_val
         .keys()
@@ -873,15 +880,12 @@ pub async fn handle_otlp_request(
     let otel_processor = OtelIngestionProcessor::new();
 
     // Pre-load user-defined model pricing entries for this org (in-memory cache, no I/O).
-    // When ZO_MODEL_PRICING_ENABLED=false, no pricing applies and spans keep only reported costs.
-    static EMPTY_PRICING: std::sync::OnceLock<
-        std::sync::Arc<Vec<crate::db::model_pricing::CachedModelPricing>>,
-    > = std::sync::OnceLock::new();
-    let org_pricing_entries = if config::get_config().common.model_pricing_enabled {
-        crate::db::model_pricing::get_org_pricing_entries(org_id)
-    } else {
-        std::sync::Arc::clone(EMPTY_PRICING.get_or_init(|| std::sync::Arc::new(vec![])))
-    };
+    // When ZO_MODEL_PRICING_ENABLED=false, nothing is priced or marked and spans keep only
+    // reported costs.
+    let org_pricing_entries = config::get_config()
+        .common
+        .model_pricing_enabled
+        .then(|| crate::db::model_pricing::get_org_pricing_entries(org_id));
 
     let gen_ai_agent_mapping_config =
         crate::db::system_settings::get_gen_ai_agent_mapping_config(org_id).await;
@@ -967,8 +971,15 @@ pub async fn handle_otlp_request(
                         &service_att_map,
                         scope_name,
                         &events,
-                        &org_pricing_entries,
-                        start_time,
+                        org_pricing_entries.as_deref().map(Vec::as_slice),
+                        SpanContext {
+                            name: &span.name,
+                            start_nanos: start_time,
+                            is_error: span
+                                .status
+                                .as_ref()
+                                .is_some_and(|s| s.code == StatusCode::Error as i32),
+                        },
                         &gen_ai_agent_mapping_config,
                     );
 
@@ -1911,6 +1922,9 @@ async fn write_traces(
     let mut triggers: TriggerAlertData =
         Vec::with_capacity(cur_stream_alerts.map_or(0, |v| v.len()));
     let mut evaluated_alerts = HashSet::new();
+    // An org with an alert downtime classifies every matching row, so a muted row hides none.
+    let mut mute_split = cur_stream_alerts
+        .and_then(|_| crate::ingestion::realtime_mute::RealtimeMuteSplit::for_org(org_id, 1));
     // End get stream alert
 
     // Start check for schema
@@ -1969,7 +1983,10 @@ async fn write_traces(
     for (timestamp, record_val) in json_data {
         // Start check for alert trigger
         if let Some(alerts) = cur_stream_alerts
-            && triggers.len() < alerts.len()
+            && match &mute_split {
+                Some(split) => split.full_alerts() < alerts.len(),
+                None => triggers.len() < alerts.len(),
+            }
         {
             let alert_end_time = now_micros();
             for alert in alerts {
@@ -1981,7 +1998,11 @@ async fn write_traces(
                     alert.get_unique_key()
                 );
                 // check if alert already evaluated
-                if evaluated_alerts.contains(&key) {
+                let done = match &mute_split {
+                    Some(split) => split.is_full(&key),
+                    None => evaluated_alerts.contains(&key),
+                };
+                if done {
                     continue;
                 }
 
@@ -1990,8 +2011,17 @@ async fn write_traces(
                     .await
                     .map(|res| res.data)
                 {
-                    triggers.push((alert.clone(), data));
-                    evaluated_alerts.insert(key);
+                    match mute_split.as_mut() {
+                        Some(split) => split.push(&key, alert, data, None).await,
+                        None => {
+                            triggers.push((
+                                alert.clone(),
+                                data,
+                                crate::ingestion::RealtimeMute::Unchecked,
+                            ));
+                            evaluated_alerts.insert(key);
+                        }
+                    }
                 }
             }
         }
@@ -2034,6 +2064,9 @@ async fn write_traces(
         std::io::Error::other(e)
     })?;
 
+    if let Some(split) = mute_split {
+        tokio::spawn(split.evaluate());
+    }
     // only one trigger per request; notification/db work must not block ingestion
     if !triggers.is_empty() {
         tokio::spawn(evaluate_trigger(triggers));
@@ -2554,7 +2587,7 @@ mod tests {
     #[test]
     fn test_reserved_span_fields() {
         let reserved_span_fields = &super::RESERVED_SPAN_FIELDS;
-        assert_eq!(reserved_span_fields.len(), 33);
+        assert_eq!(reserved_span_fields.len(), 34);
         // All eleven DBM identity columns are reserved (design D1 condition 1).
         for field in crate::db_monitoring::ALL_DB_FIELDS {
             assert!(
@@ -2980,6 +3013,37 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_span_attribute_key_blocks_cost_status_spoofing() {
+        // Only the processor's own marker may reach gen_ai_usage_cost_status; a client's
+        // value in any spelling, on any span, keeps its data under an attr_ key.
+        let service_att_map = std::collections::HashMap::new();
+        for raw in [
+            "gen_ai.usage.cost_status",
+            "gen_ai_usage_cost_status",
+            "Gen_AI.Usage.Cost-Status",
+        ] {
+            assert_eq!(attr_key(raw, &service_att_map), format!("attr_{raw}"));
+        }
+    }
+
+    #[test]
+    fn test_strip_client_cost_status_on_json_path() {
+        use config::utils::json;
+
+        let mut record_val: json::Map<String, json::Value> = json::Map::new();
+        record_val.insert(
+            config::meta::model_pricing::COST_STATUS_COLUMN.to_string(),
+            json::json!("unpriced"),
+        );
+        record_val.insert("gen_ai_usage_cost".to_string(), json::json!(0.25));
+
+        super::strip_client_supplied_derived_fields(&mut record_val);
+
+        assert!(!record_val.contains_key(config::meta::model_pricing::COST_STATUS_COLUMN));
+        assert!(record_val.contains_key("gen_ai_usage_cost"));
+    }
+
     #[test]
     fn test_strip_client_supplied_derived_fields_on_json_path() {
         // The JSON ingest path flattens client keys directly — RESERVED_SPAN_FIELDS
@@ -3952,6 +4016,146 @@ mod tests {
         assert_eq!(names, ["svc-a", "llm-svc", "unknown_service"]);
     }
 
+    #[cfg(not(feature = "cloud"))]
+    #[tokio::test]
+    async fn test_handle_otlp_request_llm_processing_sees_span_name_and_error_status() {
+        use arrow::{
+            array::{Array, StringArray},
+            compute::cast,
+            datatypes::DataType,
+        };
+        use opentelemetry_proto::tonic::{
+            collector::trace::v1::ExportTraceServiceRequest,
+            common::v1::InstrumentationScope,
+            resource::v1::Resource,
+            trace::v1::{ResourceSpans, ScopeSpans, Span, Status, status::StatusCode},
+        };
+
+        let org_id = "test_llm_span_context_org";
+        let stream = "test_llm_span_context";
+        let now = chrono::Utc::now().timestamp_nanos_opt().unwrap() as u64;
+        let call_attrs = || {
+            vec![
+                string_kv("ai.model.id", "gpt-4o"),
+                string_kv(
+                    "ai.prompt.messages",
+                    r#"[{"role":"user","content":"Say hello to everyone"}]"#,
+                ),
+            ]
+        };
+        let span = |id: u8, name: &str, attributes, status| Span {
+            trace_id: vec![7; 16],
+            span_id: vec![id; 8],
+            name: name.to_string(),
+            start_time_unix_nano: now,
+            end_time_unix_nano: now + 1000,
+            attributes,
+            status,
+            ..Default::default()
+        };
+        let wrapper = span(
+            1,
+            "ai.generateText",
+            vec![
+                string_kv("ai.model.id", "gpt-4o"),
+                string_kv("ai.prompt", r#"{"prompt":"Say hello to everyone"}"#),
+                string_kv("ai.response.text", "Hello everyone!"),
+            ],
+            None,
+        );
+        let failed = span(
+            2,
+            "ai.generateText.doGenerate",
+            call_attrs(),
+            Some(Status {
+                code: StatusCode::Error as i32,
+                message: "upstream 500".to_string(),
+            }),
+        );
+        let succeeded = span(3, "ai.generateText.doGenerate", call_attrs(), None);
+        let request = ExportTraceServiceRequest {
+            resource_spans: vec![ResourceSpans {
+                resource: Some(Resource {
+                    attributes: vec![string_kv(super::SERVICE_NAME, "svc")],
+                    ..Default::default()
+                }),
+                scope_spans: vec![ScopeSpans {
+                    scope: Some(InstrumentationScope {
+                        name: "ai".to_string(),
+                        ..Default::default()
+                    }),
+                    spans: vec![wrapper, failed, succeeded],
+                    ..Default::default()
+                }],
+                ..Default::default()
+            }],
+        };
+        let resp = super::handle_otlp_request(
+            org_id,
+            request,
+            config::meta::otlp::OtlpRequestType::HttpProtobuf,
+            Some(stream),
+            ingestion_common::IngestUser::from_user_email("a@a.com"),
+        )
+        .await
+        .unwrap();
+        assert_eq!(resp.status(), axum::http::StatusCode::OK);
+
+        let (_, batches) = ingester::read_from_memtable(
+            org_id,
+            config::meta::stream::StreamType::Traces.as_str(),
+            stream,
+            None,
+            &[],
+        )
+        .await
+        .unwrap();
+        // span_id -> (operation, input tokens, response model)
+        let mut rows = std::collections::BTreeMap::new();
+        for entry in batches.into_iter().flat_map(|(_, entries)| entries) {
+            let column = |name: &str| {
+                entry
+                    .data
+                    .column_by_name(name)
+                    .map(|c| cast(c, &DataType::Utf8).unwrap())
+            };
+            let value = |col: &Option<arrow::array::ArrayRef>, row: usize| {
+                col.as_ref().and_then(|c| {
+                    let c = c.as_any().downcast_ref::<StringArray>().unwrap();
+                    (!c.is_null(row)).then(|| c.value(row).to_string())
+                })
+            };
+            let (span_ids, ops, input_tokens, response_models) = (
+                column("span_id"),
+                column("gen_ai_operation_name"),
+                column("gen_ai_usage_input_tokens"),
+                column("gen_ai_response_model"),
+            );
+            for row in 0..entry.data.num_rows() {
+                rows.insert(
+                    value(&span_ids, row).unwrap(),
+                    (
+                        value(&ops, row),
+                        value(&input_tokens, row)
+                            .map(|v| v.parse::<i64>().unwrap())
+                            .unwrap_or(0),
+                        value(&response_models, row),
+                    ),
+                );
+            }
+        }
+        let rows: Vec<_> = rows.into_values().collect();
+        // The wrapper is recognised by its span name alone and is not estimated.
+        assert_eq!(rows[0].0.as_deref(), Some("invoke_workflow"));
+        assert_eq!(rows[0].1, 0);
+        // The ERROR call without usage gets no estimate and no request-derived response model.
+        assert_eq!(rows[1], (Some("chat".to_string()), 0, None));
+        // The same call without an error status is estimated.
+        assert_eq!(rows[2].0.as_deref(), Some("chat"));
+        assert!(rows[2].1 > 0);
+        assert_eq!(rows[2].2.as_deref(), Some("gpt-4o"));
+    }
+
     // cloud builds reject the unknown test org at the trial check before the columns check
     #[cfg(not(feature = "cloud"))]
     #[tokio::test]
diff --git a/src/core/src/traces/otel/attributes.rs b/src/core/src/traces/otel/attributes.rs
index 491db8baaf..87bf7ea4cf 100644
--- a/src/core/src/traces/otel/attributes.rs
+++ b/src/core/src/traces/otel/attributes.rs
@@ -151,6 +151,9 @@ impl GenAiExtensions {
     pub const USAGE_COST_CACHE_READ_SAVINGS: &'static str = "gen_ai.usage.cost.cache_read_savings";
     /// Net cost impact after cache reads and writes (Float64). OO extension.
     pub const USAGE_COST_NET_CACHE_IMPACT: &'static str = "gen_ai.usage.cost.net_cache_impact";
+    /// How ingest priced the span (`unpriced` / `approximate`); unset for exact prices and
+    /// client-reported costs. Flattens to `config::meta::model_pricing::COST_STATUS_COLUMN`.
+    pub const USAGE_COST_STATUS: &'static str = "gen_ai.usage.cost_status";
 }
 
 pub struct LLMAttributes;
@@ -202,7 +205,27 @@ impl VercelAiSdkAttributes {
     pub const SETTINGS_MODE: &'static str = "ai.settings.mode";
 
     // AI Usage
+    /// Embedding token count (`ai.embed` / `ai.embedMany`)
     pub const USAGE_TOKENS: &'static str = "ai.usage.tokens";
+    /// ai@4 names
+    pub const USAGE_PROMPT_TOKENS: &'static str = "ai.usage.promptTokens";
+    pub const USAGE_COMPLETION_TOKENS: &'static str = "ai.usage.completionTokens";
+    /// ai@5+ names; `inputTokens` is the provider's input count (ai@6+: total incl. cache)
+    pub const USAGE_INPUT_TOKENS: &'static str = "ai.usage.inputTokens";
+    pub const USAGE_OUTPUT_TOKENS: &'static str = "ai.usage.outputTokens";
+    pub const USAGE_TOTAL_TOKENS: &'static str = "ai.usage.totalTokens";
+    /// ai@5 cache-read count (subset of, or added to, `inputTokens` depending on provider)
+    pub const USAGE_CACHED_INPUT_TOKENS: &'static str = "ai.usage.cachedInputTokens";
+    /// ai@6+ breakdown of `inputTokens` (which includes both)
+    pub const USAGE_INPUT_CACHE_READ_TOKENS: &'static str =
+        "ai.usage.inputTokenDetails.cacheReadTokens";
+    pub const USAGE_INPUT_CACHE_WRITE_TOKENS: &'static str =
+        "ai.usage.inputTokenDetails.cacheWriteTokens";
+
+    // AI Operation (`ai.generateText`, `ai.generateText.doGenerate`, …)
+    pub const OPERATION_ID: &'static str = "ai.operationId";
+    // AI Response model (provider call spans)
+    pub const RESPONSE_MODEL: &'static str = "ai.response.model";
 
     // AI Telemetry Metadata
     pub const TELEMETRY_METADATA_USER_ID: &'static str = "ai.telemetry.metadata.userId";
@@ -218,6 +241,11 @@ impl OpenInferenceAttributes {
     pub const LLM_RESPONSE_MODEL: &'static str = "llm.response.model";
     pub const LLM_TOKEN_COUNT_PROMPT: &'static str = "llm.token_count.prompt";
     pub const LLM_TOKEN_COUNT_COMPLETION: &'static str = "llm.token_count.completion";
+    /// Cache-read / cache-write prompt tokens; included in `llm.token_count.prompt`
+    pub const LLM_TOKEN_COUNT_PROMPT_CACHE_READ: &'static str =
+        "llm.token_count.prompt_details.cache_read";
+    pub const LLM_TOKEN_COUNT_PROMPT_CACHE_WRITE: &'static str =
+        "llm.token_count.prompt_details.cache_write";
     pub const LLM_INVOCATION_PARAMETERS: &'static str = "llm.invocation_parameters";
     // Tool name on a TOOL-kind span (Arize/Phoenix, OpenAI Agents, Google ADK).
     pub const TOOL_NAME: &'static str = "tool.name";
@@ -318,6 +346,11 @@ impl FrameworkAttributes {
     pub const TRACELOOP_ENTITY_INPUT: &'static str = "traceloop.entity.input";
     pub const TRACELOOP_ENTITY_OUTPUT: &'static str = "traceloop.entity.output";
     pub const TRACELOOP_SPAN_KIND: &'static str = "traceloop.span.kind";
+    /// OpenLLMetry association properties, where LangChain puts `RunnableConfig.metadata` ids.
+    pub const TRACELOOP_ASSOCIATION_SESSION_ID: &'static str =
+        "traceloop.association.properties.session_id";
+    pub const TRACELOOP_ASSOCIATION_USER_ID: &'static str =
+        "traceloop.association.properties.user_id";
 
     // SmolAgents
     pub const INPUT_VALUE: &'static str = "input.value";
diff --git a/src/core/src/traces/otel/extractors/gen_ai_operation.rs b/src/core/src/traces/otel/extractors/gen_ai_operation.rs
index f2e89faeb2..ea8b87094a 100644
--- a/src/core/src/traces/otel/extractors/gen_ai_operation.rs
+++ b/src/core/src/traces/otel/extractors/gen_ai_operation.rs
@@ -29,9 +29,12 @@ use crate::traces::otel::attributes::{
     OpenInferenceAttributes, VercelAiSdkAttributes,
 };
 
-/// Scope information for mapping
-pub struct ScopeInfo {
-    pub name: Option<String>,
+/// Scope and span identity used for mapping
+pub struct ScopeInfo<'a> {
+    /// Instrumentation scope name
+    pub name: Option<&'a str>,
+    /// Span name; the Vercel AI SDK names its spans by operation id
+    pub span_name: Option<&'a str>,
 }
 
 const KNOWN_GEN_AI_OPERATION_NAME_VALUES: &[&str] = &[
@@ -57,8 +60,13 @@ const KNOWN_GEN_AI_OPERATION_NAME_VALUES: &[&str] = &[
 pub fn map_to_gen_ai_operation_name(
     attributes: &HashMap<String, json::Value>,
     _resource_attributes: &HashMap<String, json::Value>,
-    scope: Option<&ScopeInfo>,
+    scope: Option<&ScopeInfo<'_>>,
 ) -> &'static str {
+    // Priority 0: Vercel AI SDK operation id, so a wrapper span is never classified as a call.
+    if let Some(op) = vercel_operation_id(attributes, scope).and_then(map_vercel_operation_id) {
+        return op;
+    }
+
     // Priority 1: gen_ai.operation.name — pass through spec values directly
     if let Some(operation) = attributes
         .get(GenAiAttributes::OPERATION_NAME)
@@ -139,7 +147,7 @@ pub fn map_to_gen_ai_operation_name(
 
     // Priority 6: Vercel AI SDK
     if let Some(scope_info) = scope
-        && scope_info.name.as_deref() == Some("ai")
+        && scope_info.name == Some("ai")
         && (attributes.contains_key(VercelAiSdkAttributes::MODEL_ID)
             || attributes.contains_key(GenAiAttributes::REQUEST_MODEL)
             || attributes.contains_key(GenAiAttributes::RESPONSE_MODEL))
@@ -149,7 +157,7 @@ pub fn map_to_gen_ai_operation_name(
 
     // "ai" scope with no model → span
     if let Some(scope_info) = scope
-        && scope_info.name.as_deref() == Some("ai")
+        && scope_info.name == Some("ai")
     {
         return "span";
     }
@@ -264,10 +272,36 @@ pub fn is_llm_trace(attributes: &HashMap<String, json::Value>, scope_name: Optio
 /// Check if a gen_ai.operation.name value represents a generation (chat/completion)
 /// or embedding operation — used to decide whether to auto-count input/output tokens.
 pub fn is_generation_or_embedding(op_name: &str) -> bool {
-    matches!(
-        op_name,
-        "chat" | "text_completion" | "generate_content" | "embeddings"
-    )
+    config::meta::traces::GENERATION_GEN_AI_OPERATIONS.contains(&op_name)
+}
+
+/// Vercel AI SDK operation id, from `ai.operationId` or else the span name.
+fn vercel_operation_id<'a>(
+    attributes: &'a HashMap<String, json::Value>,
+    scope: Option<&ScopeInfo<'a>>,
+) -> Option<&'a str> {
+    if let Some(id) = attributes
+        .get(VercelAiSdkAttributes::OPERATION_ID)
+        .and_then(|v| v.as_str())
+    {
+        return Some(id);
+    }
+    let scope = scope?;
+    if scope.name != Some("ai") {
+        return None;
+    }
+    scope.span_name.filter(|name| name.starts_with("ai."))
+}
+
+/// Wrapper operations (`ai.generateText`, …) sum their children's usage, so stay unpriced.
+fn map_vercel_operation_id(operation_id: &str) -> Option<&'static str> {
+    match operation_id {
+        "ai.generateText" | "ai.streamText" | "ai.generateObject" | "ai.streamObject"
+        | "ai.embed" | "ai.embedMany" => Some("invoke_workflow"),
+        "ai.embed.doEmbed" | "ai.embedMany.doEmbed" => Some("embeddings"),
+        id if id.ends_with(".doGenerate") || id.ends_with(".doStream") => Some("chat"),
+        _ => None,
+    }
 }
 
 #[cfg(test)]
@@ -541,7 +575,8 @@ mod tests {
         let attrs = make_attributes(vec![("ai.model.id", "gpt-4")]);
         let resource_attrs = HashMap::new();
         let scope = Some(ScopeInfo {
-            name: Some("ai".to_string()),
+            name: Some("ai"),
+            span_name: None,
         });
         assert_eq!(
             map_to_gen_ai_operation_name(&attrs, &resource_attrs, scope.as_ref()),
@@ -553,12 +588,77 @@ mod tests {
     fn test_vercel_scope_no_model_returns_span() {
         let attrs = HashMap::new();
         let scope = Some(ScopeInfo {
-            name: Some("ai".to_string()),
+            name: Some("ai"),
+            span_name: None,
         });
         let result = map_to_gen_ai_operation_name(&attrs, &HashMap::new(), scope.as_ref());
         assert_eq!(result, "span");
     }
 
+    fn vercel_op(attrs: &HashMap<String, json::Value>, span_name: &str) -> &'static str {
+        let scope = ScopeInfo {
+            name: Some("ai"),
+            span_name: Some(span_name),
+        };
+        map_to_gen_ai_operation_name(attrs, &HashMap::new(), Some(&scope))
+    }
+
+    #[test]
+    fn test_vercel_wrapper_spans_are_workflows() {
+        let attrs = make_attributes(vec![
+            ("ai.model.id", "gpt-4o"),
+            ("gen_ai.request.model", "gpt-4o"),
+        ]);
+        for name in [
+            "ai.generateText",
+            "ai.streamText",
+            "ai.generateObject",
+            "ai.streamObject",
+            "ai.embed",
+            "ai.embedMany",
+        ] {
+            assert_eq!(vercel_op(&attrs, name), "invoke_workflow", "{name}");
+        }
+    }
+
+    #[test]
+    fn test_vercel_provider_call_spans() {
+        let attrs = make_attributes(vec![("ai.model.id", "gpt-4o")]);
+        assert_eq!(vercel_op(&attrs, "ai.generateText.doGenerate"), "chat");
+        assert_eq!(vercel_op(&attrs, "ai.streamText.doStream"), "chat");
+        assert_eq!(vercel_op(&attrs, "ai.streamObject.doStream"), "chat");
+        assert_eq!(vercel_op(&attrs, "ai.embed.doEmbed"), "embeddings");
+        assert_eq!(vercel_op(&attrs, "ai.embedMany.doEmbed"), "embeddings");
+    }
+
+    #[test]
+    fn test_vercel_operation_id_attribute_wins_over_span_name() {
+        let attrs = make_attributes(vec![
+            ("ai.model.id", "gpt-4o"),
+            ("ai.operationId", "ai.generateText"),
+            ("gen_ai.operation.name", "chat"),
+        ]);
+        // Custom span name, wrapper operation id, and an explicit gen_ai op name.
+        assert_eq!(vercel_op(&attrs, "my-call"), "invoke_workflow");
+        assert_eq!(
+            map_to_gen_ai_operation_name(&attrs, &HashMap::new(), None),
+            "invoke_workflow"
+        );
+    }
+
+    #[test]
+    fn test_span_name_ignored_outside_ai_scope() {
+        let attrs = make_attributes(vec![("gen_ai.request.model", "gpt-4o")]);
+        let scope = ScopeInfo {
+            name: Some("openai"),
+            span_name: Some("ai.generateText"),
+        };
+        assert_eq!(
+            map_to_gen_ai_operation_name(&attrs, &HashMap::new(), Some(&scope)),
+            "chat"
+        );
+    }
+
     // ---- default ----
 
     #[test]
diff --git a/src/core/src/traces/otel/extractors/input_output.rs b/src/core/src/traces/otel/extractors/input_output.rs
index ec468a6401..cef3ddc7ee 100644
--- a/src/core/src/traces/otel/extractors/input_output.rs
+++ b/src/core/src/traces/otel/extractors/input_output.rs
@@ -29,6 +29,8 @@ use crate::{
 };
 
 const MAX_INDEX: usize = 100;
+const TRACELOOP_PROMPT_PREFIX: &str = "gen_ai.prompt";
+const TRACELOOP_COMPLETION_PREFIX: &str = "gen_ai.completion";
 
 pub struct InputOutputExtractor;
 
@@ -134,6 +136,15 @@ impl InputOutputExtractor {
             return (Some(input.clone()), output.cloned());
         }
 
+        // Structured OpenInference messages first: they keep roles and tool calls over `*.value`.
+        let (input, output) = self.extract_openinference_nested(attributes);
+        if input.is_some() || output.is_some() {
+            return (
+                input.or_else(|| attributes.get(FrameworkAttributes::INPUT_VALUE).cloned()),
+                output.or_else(|| attributes.get(FrameworkAttributes::OUTPUT_VALUE).cloned()),
+            );
+        }
+
         // SmolAgents
         if let Some(input) = attributes.get(FrameworkAttributes::INPUT_VALUE) {
             let output = attributes.get(FrameworkAttributes::OUTPUT_VALUE);
@@ -152,12 +163,6 @@ impl InputOutputExtractor {
             return (Some(input.clone()), output.cloned());
         }
 
-        // OpenInference nested attributes (llm.input_messages.* and llm.output_messages.*)
-        let (input, output) = self.extract_openinference_nested(attributes);
-        if input.is_some() || output.is_some() {
-            return (input, output);
-        }
-
         (None, None)
     }
 
@@ -218,11 +223,28 @@ impl InputOutputExtractor {
             return true;
         }
 
-        // Check prefixes for nested attributes
-        key.starts_with("gen_ai.prompt")
-            || key.starts_with("gen_ai.completion")
-            || key.starts_with("llm.input_messages")
-            || key.starts_with("llm.output_messages")
+        // OpenInference nested messages
+        if key.starts_with("llm.input_messages") || key.starts_with("llm.output_messages") {
+            return true;
+        }
+
+        // TraceLoop nested prompt/completion (`gen_ai.prompt.0.content`, …) and
+        // other `gen_ai.prompt.*` / `gen_ai.completion.*` keys such as prompt
+        // template variables are not stored as columns. The prompt reference
+        // (name/version/label) is not a message; the processor overwrites it
+        // with the normalised value, or removes it when the value is invalid.
+        if matches!(
+            key,
+            GenAiAttributes::PROMPT_NAME
+                | GenAiAttributes::PROMPT_VERSION
+                | GenAiAttributes::PROMPT_LABEL
+        ) {
+            return false;
+        }
+        key == TRACELOOP_PROMPT_PREFIX
+            || key == TRACELOOP_COMPLETION_PREFIX
+            || key.starts_with("gen_ai.prompt.")
+            || key.starts_with("gen_ai.completion.")
     }
 
     fn extract_vercel_ai_sdk(
@@ -241,11 +263,20 @@ impl InputOutputExtractor {
 
         let output = if let Some(text) = attributes.get(VercelAiSdkAttributes::RESPONSE_TEXT) {
             if let Some(tool_calls) = attributes.get(VercelAiSdkAttributes::RESPONSE_TOOL_CALLS) {
-                Some(json::json!({
-                    "role": "assistant",
-                    "content": text,
-                    "tool_calls": tool_calls
-                }))
+                // `ai.response.toolCalls` arrives as a JSON string; embed it structurally.
+                let tool_calls = tool_calls
+                    .as_str()
+                    .and_then(|s| json::from_str::<json::Value>(s).ok())
+                    .unwrap_or_else(|| tool_calls.clone());
+                // A string, since an object would be flattened into `_role`/`_content` columns.
+                Some(json::Value::String(
+                    json::json!({
+                        "role": "assistant",
+                        "content": text,
+                        "tool_calls": tool_calls
+                    })
+                    .to_string(),
+                ))
             } else {
                 Some(text.clone())
             }
@@ -404,13 +435,13 @@ impl InputOutputExtractor {
     ) -> (Option<json::Value>, Option<json::Value>) {
         let input_attrs: HashMap<String, json::Value> = attributes
             .iter()
-            .filter(|(k, _)| k.starts_with("gen_ai.prompt"))
+            .filter(|(k, _)| is_traceloop_nested_key(k, TRACELOOP_PROMPT_PREFIX))
             .map(|(k, v)| (k.clone(), v.clone()))
             .collect();
 
         let output_attrs: HashMap<String, json::Value> = attributes
             .iter()
-            .filter(|(k, _)| k.starts_with("gen_ai.completion"))
+            .filter(|(k, _)| is_traceloop_nested_key(k, TRACELOOP_COMPLETION_PREFIX))
             .map(|(k, v)| (k.clone(), v.clone()))
             .collect();
 
@@ -421,7 +452,7 @@ impl InputOutputExtractor {
         let input = if !input_attrs.is_empty() {
             Some(convert_key_path_to_nested_object(
                 &input_attrs,
-                "gen_ai.prompt",
+                TRACELOOP_PROMPT_PREFIX,
             ))
         } else {
             None
@@ -430,7 +461,7 @@ impl InputOutputExtractor {
         let output = if !output_attrs.is_empty() {
             Some(convert_key_path_to_nested_object(
                 &output_attrs,
-                "gen_ai.completion",
+                TRACELOOP_COMPLETION_PREFIX,
             ))
         } else {
             None
@@ -482,6 +513,24 @@ impl InputOutputExtractor {
     }
 }
 
+/// True for TraceLoop's legacy indexed message keys: `<prefix>` itself or
+/// `<prefix>.<N>[.…]` (e.g. `gen_ai.prompt.0.content`). Named keys under the
+/// same prefix, such as the prompt reference `gen_ai.prompt.name`, are not
+/// TraceLoop messages.
+fn is_traceloop_nested_key(key: &str, prefix: &str) -> bool {
+    let Some(rest) = key.strip_prefix(prefix) else {
+        return false;
+    };
+    if rest.is_empty() {
+        return true;
+    }
+    let Some(rest) = rest.strip_prefix('.') else {
+        return false;
+    };
+    let index = rest.split('.').next().unwrap_or_default();
+    !index.is_empty() && index.bytes().all(|b| b.is_ascii_digit())
+}
+
 /// Converts nested key paths (e.g., "gen_ai.prompt.0.role") to nested objects/arrays
 /// This is critical for handling TraceLoop and OpenInference attributes
 fn convert_key_path_to_nested_object(
@@ -650,6 +699,92 @@ mod tests {
         assert!(!extractor.is_input_output_attribute("gen_ai.request.model"));
     }
 
+    /// Issue #3138: two chat spans, identical except span B carries the prompt
+    /// reference (`gen_ai.prompt.name|version|label`). Both must keep their
+    /// messages, and B must keep the reference attributes.
+    #[test]
+    fn test_prompt_reference_does_not_swallow_messages() {
+        let extractor = InputOutputExtractor;
+        let input_messages =
+            json::json!(r#"[{"role":"user","parts":[{"type":"text","content":"What is 2+2?"}]}]"#);
+        let output_messages =
+            json::json!(r#"[{"role":"assistant","parts":[{"type":"text","content":"4"}]}]"#);
+        let span_a: HashMap<String, json::Value> = HashMap::from([
+            ("gen_ai.operation.name".to_string(), json::json!("chat")),
+            (
+                GenAiAttributes::INPUT_MESSAGES.to_string(),
+                input_messages.clone(),
+            ),
+            (
+                GenAiAttributes::OUTPUT_MESSAGES.to_string(),
+                output_messages.clone(),
+            ),
+        ]);
+        let mut span_b = span_a.clone();
+        span_b.insert(
+            GenAiAttributes::PROMPT_NAME.to_string(),
+            json::json!("support-answer"),
+        );
+        span_b.insert(
+            GenAiAttributes::PROMPT_VERSION.to_string(),
+            json::json!("3"),
+        );
+        span_b.insert(
+            GenAiAttributes::PROMPT_LABEL.to_string(),
+            json::json!("production"),
+        );
+
+        for attrs in [&span_a, &span_b] {
+            let (input, output) = extractor.extract(&[], attrs, "");
+            assert_eq!(input.as_ref(), Some(&input_messages));
+            assert_eq!(output.as_ref(), Some(&output_messages));
+        }
+
+        let kept: Vec<&str> = span_b
+            .keys()
+            .map(String::as_str)
+            .filter(|k| !extractor.is_input_output_attribute(k))
+            .collect();
+        for key in [
+            GenAiAttributes::PROMPT_NAME,
+            GenAiAttributes::PROMPT_VERSION,
+            GenAiAttributes::PROMPT_LABEL,
+        ] {
+            assert!(kept.contains(&key), "{key} must be kept");
+        }
+        assert!(!kept.contains(&GenAiAttributes::INPUT_MESSAGES));
+    }
+
+    #[test]
+    fn test_traceloop_nested_ignores_prompt_reference() {
+        let extractor = InputOutputExtractor;
+        let attrs = HashMap::from([
+            ("gen_ai.prompt.0.role".to_string(), json::json!("user")),
+            ("gen_ai.prompt.0.content".to_string(), json::json!("Hello")),
+            ("gen_ai.completion.0.content".to_string(), json::json!("Hi")),
+            (
+                GenAiAttributes::PROMPT_NAME.to_string(),
+                json::json!("support-answer"),
+            ),
+            (
+                "gen_ai.prompt.variable.customer".to_string(),
+                json::json!("acme"),
+            ),
+        ]);
+
+        let (input, output) = extractor.extract(&[], &attrs, "");
+        assert_eq!(
+            input,
+            Some(json::json!([{"role": "user", "content": "Hello"}]))
+        );
+        assert_eq!(output, Some(json::json!([{"content": "Hi"}])));
+
+        assert!(extractor.is_input_output_attribute("gen_ai.prompt.0.content"));
+        assert!(extractor.is_input_output_attribute("gen_ai.completion.0.content"));
+        assert!(extractor.is_input_output_attribute("gen_ai.prompt.variable.customer"));
+        assert!(!extractor.is_input_output_attribute(GenAiAttributes::PROMPT_NAME));
+    }
+
     #[test]
     fn test_extract_traceloop_nested() {
         let extractor = InputOutputExtractor;
@@ -690,6 +825,105 @@ mod tests {
         assert_eq!(input_arr[0]["content"], "Test");
     }
 
+    #[test]
+    fn test_openinference_structured_messages_win_over_input_value() {
+        let extractor = InputOutputExtractor;
+        let mut attrs = HashMap::new();
+        attrs.insert(
+            "input.value".to_string(),
+            json::json!(r#"{"messages":[{"role":"user","content":"Weather?"}]}"#),
+        );
+        attrs.insert("output.value".to_string(), json::json!(r#"{"id":"x"}"#));
+        attrs.insert(
+            "llm.input_messages.0.message.role".to_string(),
+            json::json!("user"),
+        );
+        attrs.insert(
+            "llm.input_messages.0.message.content".to_string(),
+            json::json!("Weather?"),
+        );
+        attrs.insert(
+            "llm.input_messages.1.message.role".to_string(),
+            json::json!("tool"),
+        );
+        attrs.insert(
+            "llm.input_messages.1.message.content".to_string(),
+            json::json!("sunny"),
+        );
+        attrs.insert(
+            "llm.output_messages.0.message.role".to_string(),
+            json::json!("assistant"),
+        );
+        attrs.insert(
+            "llm.output_messages.0.message.tool_calls.0.tool_call.function.name".to_string(),
+            json::json!("get_weather"),
+        );
+
+        let (input, output) = extractor.extract(&[], &attrs, "openinference");
+        let input = input.unwrap();
+        assert_eq!(input[0]["message"]["role"], "user");
+        assert_eq!(input[0]["message"]["content"], "Weather?");
+        assert_eq!(input[1]["message"]["role"], "tool");
+        let output = output.unwrap();
+        assert_eq!(output[0]["message"]["role"], "assistant");
+        assert_eq!(
+            output[0]["message"]["tool_calls"][0]["tool_call"]["function"]["name"],
+            "get_weather"
+        );
+    }
+
+    #[test]
+    fn test_openinference_side_without_structured_messages_keeps_its_value() {
+        let extractor = InputOutputExtractor;
+        let mut attrs = HashMap::new();
+        attrs.insert("input.value".to_string(), json::json!("raw request"));
+        attrs.insert("output.value".to_string(), json::json!("streamed answer"));
+        attrs.insert(
+            "llm.input_messages.0.message.role".to_string(),
+            json::json!("user"),
+        );
+        attrs.insert(
+            "llm.input_messages.0.message.content".to_string(),
+            json::json!("Weather?"),
+        );
+
+        let (input, output) = extractor.extract(&[], &attrs, "openinference");
+        assert_eq!(input.unwrap()[0]["message"]["content"], "Weather?");
+        assert_eq!(output, Some(json::json!("streamed answer")));
+    }
+
+    #[test]
+    fn test_smolagents_input_value_without_structured_messages() {
+        let extractor = InputOutputExtractor;
+        let mut attrs = HashMap::new();
+        attrs.insert("input.value".to_string(), json::json!("task"));
+        attrs.insert("output.value".to_string(), json::json!("answer"));
+
+        let (input, output) = extractor.extract(&[], &attrs, "smolagents");
+        assert_eq!(input, Some(json::json!("task")));
+        assert_eq!(output, Some(json::json!("answer")));
+    }
+
+    #[test]
+    fn test_vercel_tool_call_step_output_is_single_string() {
+        let extractor = InputOutputExtractor;
+        let mut attrs = HashMap::new();
+        attrs.insert("ai.response.text".to_string(), json::json!(""));
+        attrs.insert(
+            "ai.response.toolCalls".to_string(),
+            json::json!(r#"[{"toolCallId":"c1","toolName":"weather","input":"{}"}]"#),
+        );
+
+        let (_, output) = extractor.extract(&[], &attrs, "ai");
+        let output = output.unwrap();
+        let s = output
+            .as_str()
+            .expect("output must be a single JSON string");
+        let parsed: json::Value = json::from_str(s).unwrap();
+        assert_eq!(parsed["role"], "assistant");
+        assert_eq!(parsed["tool_calls"][0]["toolName"], "weather");
+    }
+
     #[test]
     fn test_convert_key_path_simple_object() {
         let mut input = HashMap::new();
diff --git a/src/core/src/traces/otel/extractors/metadata.rs b/src/core/src/traces/otel/extractors/metadata.rs
index b69022cb90..c34f7d701b 100644
--- a/src/core/src/traces/otel/extractors/metadata.rs
+++ b/src/core/src/traces/otel/extractors/metadata.rs
@@ -20,7 +20,7 @@ use std::collections::HashMap;
 use config::utils::json;
 
 use crate::traces::otel::attributes::{
-    GenAiAttributes, LangfuseAttributes, OtelAttributes, VercelAiSdkAttributes,
+    FrameworkAttributes, GenAiAttributes, LangfuseAttributes, OtelAttributes, VercelAiSdkAttributes,
 };
 
 pub struct MetadataExtractor;
@@ -35,6 +35,7 @@ impl MetadataExtractor {
         let user_id_keys = [
             OtelAttributes::USER_ID,
             VercelAiSdkAttributes::TELEMETRY_METADATA_USER_ID,
+            FrameworkAttributes::TRACELOOP_ASSOCIATION_USER_ID,
             "service_user.id",
         ];
 
@@ -69,6 +70,7 @@ impl MetadataExtractor {
             VercelAiSdkAttributes::TELEMETRY_METADATA_SESSION_ID,
             LangfuseAttributes::METADATA_LANGFUSE_SESSION_ID,
             LangfuseAttributes::METADATA_SESSION_ID,
+            FrameworkAttributes::TRACELOOP_ASSOCIATION_SESSION_ID,
             "service_session.id",
         ];
 
@@ -130,6 +132,28 @@ mod tests {
         assert!(result.is_none());
     }
 
+    #[test]
+    fn test_extract_user_id_from_traceloop_association_properties() {
+        let mut attrs = HashMap::new();
+        attrs.insert(
+            "traceloop.association.properties.user_id".to_string(),
+            json::json!("tl_user"),
+        );
+        let result = MetadataExtractor.extract_user_id(&attrs, &HashMap::new());
+        assert_eq!(result, Some("tl_user".to_string()));
+    }
+
+    #[test]
+    fn test_extract_session_id_from_traceloop_association_properties() {
+        let mut attrs = HashMap::new();
+        attrs.insert(
+            "traceloop.association.properties.session_id".to_string(),
+            json::json!("tl_session"),
+        );
+        let result = MetadataExtractor.extract_session_id(&attrs, &HashMap::new());
+        assert_eq!(result, Some("tl_session".to_string()));
+    }
+
     #[test]
     fn test_extract_session_id_from_span_attributes() {
         let mut attrs = HashMap::new();
diff --git a/src/core/src/traces/otel/extractors/model.rs b/src/core/src/traces/otel/extractors/model.rs
index 3703b44e4d..a7ac589ba9 100644
--- a/src/core/src/traces/otel/extractors/model.rs
+++ b/src/core/src/traces/otel/extractors/model.rs
@@ -26,10 +26,11 @@ use crate::traces::otel::attributes::{
 pub struct ModelExtractor;
 
 impl ModelExtractor {
-    /// Extract model name from attributes
+    /// Extract the model name (response model, else request model) for pricing and tokenization.
     pub fn extract(&self, attributes: &HashMap<String, json::Value>) -> Option<String> {
         let model_name_keys = [
             GenAiAttributes::RESPONSE_MODEL,
+            VercelAiSdkAttributes::RESPONSE_MODEL,
             VercelAiSdkAttributes::MODEL_ID,
             GenAiAttributes::REQUEST_MODEL,
             LangfuseAttributes::MODEL,
@@ -45,6 +46,22 @@ impl ModelExtractor {
         }
         None
     }
+
+    /// Extract only the response model, i.e. the model that actually answered.
+    pub fn extract_response_model(
+        &self,
+        attributes: &HashMap<String, json::Value>,
+    ) -> Option<String> {
+        [
+            GenAiAttributes::RESPONSE_MODEL,
+            VercelAiSdkAttributes::RESPONSE_MODEL,
+            OpenInferenceAttributes::LLM_RESPONSE_MODEL,
+        ]
+        .iter()
+        .find_map(|key| attributes.get(*key))
+        .and_then(|v| v.as_str())
+        .map(str::to_string)
+    }
 }
 
 #[cfg(test)]
@@ -151,4 +168,33 @@ mod tests {
         let attrs = make_attributes(vec![("gen_ai.response.model", json::json!(""))]);
         assert_eq!(extractor.extract(&attrs), Some("".to_string()));
     }
+
+    #[test]
+    fn test_extract_response_model_ignores_request_keys() {
+        let extractor = ModelExtractor;
+        let attrs = make_attributes(vec![
+            ("gen_ai.request.model", json::json!("gpt-4o")),
+            ("ai.model.id", json::json!("gpt-4o")),
+            ("llm.model_name", json::json!("gpt-4o")),
+            ("langfuse.observation.model.name", json::json!("gpt-4o")),
+        ]);
+        assert!(extractor.extract_response_model(&attrs).is_none());
+    }
+
+    #[test]
+    fn test_extract_response_model_keys() {
+        let extractor = ModelExtractor;
+        for key in [
+            "gen_ai.response.model",
+            "ai.response.model",
+            "llm.response.model",
+        ] {
+            let attrs = make_attributes(vec![(key, json::json!("gpt-4o-2024-08-06"))]);
+            assert_eq!(
+                extractor.extract_response_model(&attrs),
+                Some("gpt-4o-2024-08-06".to_string()),
+                "{key}"
+            );
+        }
+    }
 }
diff --git a/src/core/src/traces/otel/extractors/usage.rs b/src/core/src/traces/otel/extractors/usage.rs
index 057ae73438..81704e4781 100644
--- a/src/core/src/traces/otel/extractors/usage.rs
+++ b/src/core/src/traces/otel/extractors/usage.rs
@@ -226,6 +226,29 @@ impl UsageExtractor {
         ) {
             set_val_if_not_zero(&mut usage, "output".to_string(), num);
         }
+        // OpenInference cache details are part of `llm.token_count.prompt`.
+        let oi_cache_keys = [
+            (
+                &[
+                    OpenInferenceAttributes::LLM_TOKEN_COUNT_PROMPT_CACHE_READ,
+                    "llm_token_count_prompt_details_cache_read",
+                ][..],
+                "cache_read_input_tokens",
+            ),
+            (
+                &[
+                    OpenInferenceAttributes::LLM_TOKEN_COUNT_PROMPT_CACHE_WRITE,
+                    "llm_token_count_prompt_details_cache_write",
+                ][..],
+                "cache_creation_input_tokens",
+            ),
+        ];
+        for (keys, usage_key) in &oi_cache_keys {
+            if let Some(num) = extract_i64_any(attributes, keys) {
+                set_val_if_not_zero(&mut usage, usage_key.to_string(), num);
+                input_includes_cache = true;
+            }
+        }
 
         // Vercel AI SDK
         if instrumentation_scope_name == "ai" {
@@ -252,9 +275,68 @@ impl UsageExtractor {
             ) {
                 set_val_if_not_zero(&mut usage, "output".to_string(), num);
             }
-            if let Some(num) = extract_i64_any(attributes, &[VercelAiSdkAttributes::USAGE_TOKENS]) {
+            // ai@4 (`promptTokens`) and ai@5+ (`inputTokens`) names.
+            if let Some(num) = extract_i64_any(
+                attributes,
+                &[
+                    VercelAiSdkAttributes::USAGE_INPUT_TOKENS,
+                    VercelAiSdkAttributes::USAGE_PROMPT_TOKENS,
+                ],
+            ) {
+                set_val_if_not_zero(&mut usage, "input".to_string(), num);
+                input_includes_cache = true;
+            }
+            if let Some(num) = extract_i64_any(
+                attributes,
+                &[
+                    VercelAiSdkAttributes::USAGE_OUTPUT_TOKENS,
+                    VercelAiSdkAttributes::USAGE_COMPLETION_TOKENS,
+                ],
+            ) {
+                set_val_if_not_zero(&mut usage, "output".to_string(), num);
+            }
+            if let Some(num) = extract_i64_any(
+                attributes,
+                &[
+                    VercelAiSdkAttributes::USAGE_TOTAL_TOKENS,
+                    VercelAiSdkAttributes::USAGE_TOKENS,
+                ],
+            ) {
                 set_val_if_not_zero(&mut usage, "total".to_string(), num);
             }
+            // `ai.usage.tokens` is the embedding call's input token count.
+            if !usage.contains_key("input")
+                && let Some(num) =
+                    extract_i64_any(attributes, &[VercelAiSdkAttributes::USAGE_TOKENS])
+            {
+                set_val_if_not_zero(&mut usage, "input".to_string(), num);
+            }
+
+            // ai@6+ splits `inputTokens` (which includes the cache) into details.
+            let cache_read = extract_i64_any(
+                attributes,
+                &[VercelAiSdkAttributes::USAGE_INPUT_CACHE_READ_TOKENS],
+            );
+            let cache_write = extract_i64_any(
+                attributes,
+                &[VercelAiSdkAttributes::USAGE_INPUT_CACHE_WRITE_TOKENS],
+            );
+            if cache_read.is_some() || cache_write.is_some() {
+                if let Some(num) = cache_read {
+                    set_val_if_not_zero(&mut usage, "cache_read_input_tokens".to_string(), num);
+                }
+                if let Some(num) = cache_write {
+                    set_val_if_not_zero(&mut usage, "cache_creation_input_tokens".to_string(), num);
+                }
+                input_includes_cache = true;
+            } else if let Some(num) = extract_i64_any(
+                attributes,
+                &[VercelAiSdkAttributes::USAGE_CACHED_INPUT_TOKENS],
+            ) {
+                // ai@5 passes through the provider's input count, which may include cache reads.
+                set_val_if_not_zero(&mut usage, "cache_read_input_tokens".to_string(), num);
+                input_includes_cache = !vercel_provider_reports_cache_separately(attributes);
+            }
         }
 
         // Langfuse usage_details (support both dot and underscore formats)
@@ -276,7 +358,17 @@ impl UsageExtractor {
                 } else if let Some(s) = v.as_object() {
                     for (sk, sv) in s {
                         if let Some(v) = sv.as_i64() {
-                            set_val_if_not_zero(&mut usage, format!("{}_{}", k, sk), v);
+                            // OpenAI usage nests cache reads; `prompt_tokens` includes them.
+                            if k == "prompt_tokens_details" && sk == "cached_tokens" {
+                                set_val_if_not_zero(
+                                    &mut usage,
+                                    "cache_read_input_tokens".to_string(),
+                                    v,
+                                );
+                                input_includes_cache = true;
+                            } else {
+                                set_val_if_not_zero(&mut usage, format!("{}_{}", k, sk), v);
+                            }
                         }
                     }
                 }
@@ -341,6 +433,16 @@ fn has_provider_native_cache_tokens(attributes: &HashMap<String, json::Value>) -
     .any(|key| attributes.contains_key(*key))
 }
 
+/// Vercel AI SDK providers whose ai@5 `inputTokens` excludes cache reads (e.g. Anthropic, Bedrock).
+fn vercel_provider_reports_cache_separately(attributes: &HashMap<String, json::Value>) -> bool {
+    attributes
+        .get(VercelAiSdkAttributes::MODEL_PROVIDER)
+        .and_then(|v| v.as_str())
+        .is_some_and(|provider| {
+            provider.contains("anthropic") || provider.starts_with("amazon-bedrock")
+        })
+}
+
 #[cfg(test)]
 mod tests {
     use std::collections::HashMap;
@@ -598,4 +700,129 @@ mod tests {
         assert_eq!(cost.get("tokens_input"), Some(&0.01f64));
         assert_eq!(cost.get("tokens_output"), Some(&0.005f64));
     }
+
+    fn attrs_of(pairs: &[(&str, json::Value)]) -> HashMap<String, json::Value> {
+        pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.clone()))
+            .collect()
+    }
+
+    #[test]
+    fn test_extract_usage_vercel_v5_usage_keys() {
+        let attrs = attrs_of(&[
+            ("ai.usage.inputTokens", json::json!(30)),
+            ("ai.usage.outputTokens", json::json!(12)),
+            ("ai.usage.totalTokens", json::json!(42)),
+        ]);
+        let usage = UsageExtractor.extract_usage(&attrs, "ai");
+        assert_eq!(usage.get("input"), Some(&30));
+        assert_eq!(usage.get("output"), Some(&12));
+        assert_eq!(usage.get("total"), Some(&42));
+    }
+
+    #[test]
+    fn test_extract_usage_vercel_v4_usage_keys() {
+        let attrs = attrs_of(&[
+            ("ai.usage.promptTokens", json::json!(30)),
+            ("ai.usage.completionTokens", json::json!(12)),
+        ]);
+        let usage = UsageExtractor.extract_usage(&attrs, "ai");
+        assert_eq!(usage.get("input"), Some(&30));
+        assert_eq!(usage.get("output"), Some(&12));
+    }
+
+    #[test]
+    fn test_extract_usage_vercel_embedding_tokens_are_input() {
+        let attrs = attrs_of(&[("ai.usage.tokens", json::json!(5))]);
+        let usage = UsageExtractor.extract_usage(&attrs, "ai");
+        assert_eq!(usage.get("input"), Some(&5));
+        assert_eq!(usage.get("total"), Some(&5));
+        assert!(!usage.contains_key("output"));
+    }
+
+    #[test]
+    fn test_extract_usage_vercel_input_token_details_cache() {
+        let attrs = attrs_of(&[
+            ("ai.model.provider", json::json!("anthropic.messages")),
+            ("ai.usage.inputTokens", json::json!(1000)),
+            (
+                "ai.usage.inputTokenDetails.cacheReadTokens",
+                json::json!(700),
+            ),
+            (
+                "ai.usage.inputTokenDetails.cacheWriteTokens",
+                json::json!(100),
+            ),
+            ("ai.usage.cachedInputTokens", json::json!(700)),
+        ]);
+        let details = UsageExtractor.extract_usage_details(&attrs, "ai");
+        assert_eq!(details.usage.get("input"), Some(&1000));
+        assert_eq!(details.usage.get("cache_read_input_tokens"), Some(&700));
+        assert_eq!(details.usage.get("cache_creation_input_tokens"), Some(&100));
+        assert!(details.input_includes_cache);
+    }
+
+    #[test]
+    fn test_extract_usage_vercel_v5_cached_input_tokens_by_provider() {
+        for (provider, includes) in [
+            ("openai.chat", true),
+            ("google.generative-ai", true),
+            ("anthropic.messages", false),
+            ("amazon-bedrock", false),
+        ] {
+            let attrs = attrs_of(&[
+                ("ai.model.provider", json::json!(provider)),
+                ("ai.usage.inputTokens", json::json!(300)),
+                ("ai.usage.cachedInputTokens", json::json!(200)),
+            ]);
+            let details = UsageExtractor.extract_usage_details(&attrs, "ai");
+            assert_eq!(details.usage.get("cache_read_input_tokens"), Some(&200));
+            assert_eq!(details.input_includes_cache, includes, "{provider}");
+        }
+    }
+
+    #[test]
+    fn test_extract_usage_openinference_cache_details() {
+        let attrs = attrs_of(&[
+            ("llm.token_count.prompt", json::json!(1000)),
+            ("llm.token_count.completion", json::json!(100)),
+            (
+                "llm.token_count.prompt_details.cache_read",
+                json::json!(700),
+            ),
+            (
+                "llm.token_count.prompt_details.cache_write",
+                json::json!(100),
+            ),
+        ]);
+        let details = UsageExtractor.extract_usage_details(&attrs, "");
+        assert_eq!(details.usage.get("input"), Some(&1000));
+        assert_eq!(details.usage.get("cache_read_input_tokens"), Some(&700));
+        assert_eq!(details.usage.get("cache_creation_input_tokens"), Some(&100));
+        assert!(details.input_includes_cache);
+    }
+
+    #[test]
+    fn test_extract_usage_langfuse_nested_cached_tokens() {
+        let details = json::json!({
+            "prompt_tokens": 1000,
+            "completion_tokens": 100,
+            "total_tokens": 1100,
+            "prompt_tokens_details": {"cached_tokens": 700, "audio_tokens": 0}
+        });
+        let attrs = attrs_of(&[(
+            "langfuse.observation.usage_details",
+            json::Value::String(details.to_string()),
+        )]);
+        let details = UsageExtractor.extract_usage_details(&attrs, "");
+        assert_eq!(details.usage.get("input"), Some(&1000));
+        assert_eq!(details.usage.get("cache_read_input_tokens"), Some(&700));
+        assert!(
+            !details
+                .usage
+                .contains_key("prompt_tokens_details_cached_tokens")
+        );
+        assert!(details.input_includes_cache);
+    }
 }
diff --git a/src/core/src/traces/otel/mod.rs b/src/core/src/traces/otel/mod.rs
index 176c89a67d..a642c5dfe2 100644
--- a/src/core/src/traces/otel/mod.rs
+++ b/src/core/src/traces/otel/mod.rs
@@ -55,8 +55,8 @@
 //!     &resource_attributes,
 //!     Some("openai"),
 //!     &events,
-//!     &[], // pass org pricing entries here in production
-//!     span_start_nanos, // span.start_time_unix_nano from OTLP payload
+//!     Some(&[]), // org pricing entries in production; None when pricing is disabled
+//!     SpanContext { name: &span.name, start_nanos: span.start_time_unix_nano, is_error },
 //!     &GenAiAgentMappingConfig::default(),
 //! );
 //! ```
@@ -84,8 +84,8 @@
 //!     &resource_attrs,
 //!     Some("openai"),
 //!     &events,
-//!     &[],
-//!     0,
+//!     Some(&[]),
+//!     SpanContext::default(),
 //!     &GenAiAgentMappingConfig::default(),
 //! );
 //!
@@ -114,7 +114,7 @@ pub mod processor;
 pub use extractors::{
     ScopeInfo, is_generation_or_embedding, is_llm_trace, map_to_gen_ai_operation_name,
 };
-pub use processor::OtelIngestionProcessor;
+pub use processor::{OtelIngestionProcessor, SpanContext};
 
 #[cfg(test)]
 mod tests {
diff --git a/src/core/src/traces/otel/processor.rs b/src/core/src/traces/otel/processor.rs
index 04cf004224..74f1ee804a 100644
--- a/src/core/src/traces/otel/processor.rs
+++ b/src/core/src/traces/otel/processor.rs
@@ -18,12 +18,14 @@
 //! Processes OpenTelemetry resource spans and enriches them with OpenObserve-specific
 //! attributes following gen-ai semantic conventions.
 
-use std::collections::HashMap;
+use std::{borrow::Cow, collections::HashMap, fmt::Write as _};
 
 use config::{
     meta::{
         gen_ai::GenAiAgentMappingConfig,
-        model_pricing::{ModelPricingDefinition, PricingContext},
+        model_pricing::{
+            COST_STATUS_COLUMN, CostStatus, MatchKind, ModelPricingDefinition, PricingContext,
+        },
     },
     utils::{json, time::parse_timestamp_micro_from_value},
 };
@@ -43,11 +45,25 @@ use super::{
 };
 use crate::common::meta::traces::Event;
 
+/// OTLP span fields the processor needs besides the attributes.
+#[derive(Clone, Copy, Debug, Default)]
+pub struct SpanContext<'a> {
+    /// Span name; the Vercel AI SDK names spans by operation id.
+    pub name: &'a str,
+    /// `start_time_unix_nano`; zero means unknown.
+    pub start_nanos: u64,
+    /// The span status is ERROR.
+    pub is_error: bool,
+}
+
 /// Results of extracting span enrichment data from raw attributes.
 /// Captures all information needed before I/O attribute cleanup.
 struct SpanExtractions {
     op_name: &'static str,
+    /// Response model, else request model: pricing, tokenization, stored response model.
     model_name: Option<String>,
+    /// Model named by response attributes only.
+    response_model: Option<String>,
     provider_name: Option<String>,
     input: Option<json::Value>,
     output: Option<json::Value>,
@@ -67,6 +83,8 @@ struct SpanExtractions {
     tool_call_result: Option<json::Value>,
     agent: AgentIdentity,
     evaluation: Evaluation,
+    /// Failed call with no usage or cost, so it gets no estimated tokens, cost or request model.
+    failed_without_usage: bool,
 }
 
 pub struct OtelIngestionProcessor {
@@ -136,12 +154,17 @@ impl OtelIngestionProcessor {
             resource_attributes,
             scope_name,
             events,
-            org_pricing_entries,
-            span_start_nanos,
+            Some(org_pricing_entries),
+            SpanContext {
+                start_nanos: span_start_nanos,
+                ..Default::default()
+            },
             &GenAiAgentMappingConfig::default(),
         );
     }
 
+    /// Enriches an LLM span. `org_pricing_entries` is `None` when model pricing is disabled
+    /// (`ZO_MODEL_PRICING_ENABLED=false`): no cost is computed and no cost status is written.
     #[allow(clippy::too_many_arguments)]
     pub fn process_span_with_pricing_and_agent_mapping(
         &self,
@@ -149,8 +172,8 @@ impl OtelIngestionProcessor {
         resource_attributes: &HashMap<String, json::Value>,
         scope_name: Option<&str>,
         events: &[Event],
-        org_pricing_entries: &[CachedModelPricing],
-        span_start_nanos: u64,
+        org_pricing_entries: Option<&[CachedModelPricing]>,
+        span: SpanContext<'_>,
         agent_mapping_config: &GenAiAgentMappingConfig,
     ) {
         // Phase 1: Extract all raw data from span attributes.
@@ -159,6 +182,7 @@ impl OtelIngestionProcessor {
             resource_attributes,
             scope_name,
             events,
+            span,
             agent_mapping_config,
         );
 
@@ -167,16 +191,16 @@ impl OtelIngestionProcessor {
             .retain(|key, _| !self.input_output_extractor.is_input_output_attribute(key));
 
         // Phase 2: Compute derived values — token counts, cost estimates, defaults.
-        let (usage, cost) = self.compute_usage_and_cost(
+        let (usage, cost, cost_status) = self.compute_usage_and_cost(
             &extracted,
             span_attributes,
             resource_attributes,
             org_pricing_entries,
-            span_start_nanos,
+            span.start_nanos,
         );
 
         // Phase 3: Write enriched attributes back to the span.
-        self.emit_enriched_attributes(span_attributes, &extracted, &usage, &cost);
+        self.emit_enriched_attributes(span_attributes, &extracted, &usage, &cost, cost_status);
     }
 
     // ── Phase 1: Extract raw data ──────────────────────────────────────────
@@ -187,15 +211,17 @@ impl OtelIngestionProcessor {
         resource_attributes: &HashMap<String, json::Value>,
         scope_name: Option<&str>,
         events: &[Event],
+        span: SpanContext<'_>,
         agent_mapping_config: &GenAiAgentMappingConfig,
     ) -> SpanExtractions {
-        let scope_info = scope_name.map(|name| ScopeInfo {
-            name: Some(name.to_string()),
-        });
+        let scope_info = ScopeInfo {
+            name: scope_name,
+            span_name: (!span.name.is_empty()).then_some(span.name),
+        };
         let scope_name_default = scope_name.unwrap_or("");
 
         let op_name =
-            map_to_gen_ai_operation_name(span_attributes, resource_attributes, scope_info.as_ref());
+            map_to_gen_ai_operation_name(span_attributes, resource_attributes, Some(&scope_info));
         let model_name = self.model_extractor.extract(span_attributes);
         let provider_name = self.provider_extractor.extract(span_attributes);
         let (input, output) =
@@ -232,10 +258,16 @@ impl OtelIngestionProcessor {
             agent_mapping_config,
         );
         let evaluation = self.evaluation_extractor.extract(span_attributes);
+        let failed_without_usage =
+            span.is_error && usage_details.usage.is_empty() && cost.is_empty();
+        let response_model = failed_without_usage
+            .then(|| self.model_extractor.extract_response_model(span_attributes))
+            .flatten();
 
         SpanExtractions {
             op_name,
             model_name,
+            response_model,
             provider_name,
             input,
             output,
@@ -255,24 +287,36 @@ impl OtelIngestionProcessor {
             tool_call_result,
             agent,
             evaluation,
+            failed_without_usage,
         }
     }
 
     // ── Phase 2: Compute usage, cost, and defaults ─────────────────────────
 
+    /// Returns token usage, cost components and, for a model not priced exactly at a non-zero
+    /// cost, its [`CostStatus`]. An unpriced span gets no cost entries, not a zero total.
+    /// `org_pricing_entries` is `None` when model pricing is disabled: nothing is priced and
+    /// no span is marked.
     fn compute_usage_and_cost(
         &self,
         extracted: &SpanExtractions,
         span_attributes: &HashMap<String, json::Value>,
         resource_attributes: &HashMap<String, json::Value>,
-        org_pricing_entries: &[CachedModelPricing],
+        org_pricing_entries: Option<&[CachedModelPricing]>,
         span_start_nanos: u64,
-    ) -> (HashMap<String, i64>, HashMap<String, f64>) {
+    ) -> (
+        HashMap<String, i64>,
+        HashMap<String, f64>,
+        Option<CostStatus>,
+    ) {
         let mut usage = extracted.usage.clone();
         let mut cost = extracted.cost.clone();
         let mut input_includes_cache = extracted.input_includes_cache;
+        let mut cost_status = None;
+        let mut zero_priced = false;
 
-        if is_generation_or_embedding(extracted.op_name) {
+        // Estimating tokens for a failed call with no usage would invent a cost.
+        if is_generation_or_embedding(extracted.op_name) && !extracted.failed_without_usage {
             // Zero means the payload carried no start time; treat it as unknown rather
             // than as 1970-01-01, which would land every such span in a time-of-day tier.
             let span_ts_micros = (span_start_nanos != 0)
@@ -282,15 +326,17 @@ impl OtelIngestionProcessor {
             if let Some(v) = &extracted.input
                 && !usage.contains_key("input")
             {
-                let prompt = v.to_string();
+                let prompt = message_text(v);
                 let prompt_tokens = pricing::calculate_token_count(tokenizer_key, &prompt);
                 usage.insert("input".to_string(), prompt_tokens);
                 input_includes_cache = true;
             }
-            if let Some(v) = &extracted.output
+            // An embedding's output is a vector, not generated tokens.
+            if extracted.op_name != "embeddings"
+                && let Some(v) = &extracted.output
                 && !usage.contains_key("output")
             {
-                let output_text = v.to_string();
+                let output_text = message_text(v);
                 let output_tokens = pricing::calculate_token_count(tokenizer_key, &output_text);
                 usage.insert("output".to_string(), output_tokens);
             }
@@ -305,42 +351,69 @@ impl OtelIngestionProcessor {
             let (billable_usage, tier_usage) = build_pricing_usage(&usage, input_includes_cache);
 
             // Resolve only for spans without a client-reported cost; the lookup runs regexes.
+            // A span with tokens but no model name has nothing to price: it is unpriced, not
+            // free. One without tokens stays unmarked. With pricing disabled nothing is priced
+            // or marked: the span keeps only a reported cost.
             if cost.is_empty()
-                && let Some(resolved) = extracted.model_name.as_ref().and_then(|mn| {
-                    crate::db::model_pricing::find_pricing_sync_at(
-                        org_pricing_entries,
-                        mn,
-                        span_ts_micros,
-                    )
-                })
+                && org_pricing_entries.is_some()
+                && extracted.model_name.is_none()
+                && usage.values().any(|&v| v > 0)
             {
-                let pricing_def = &resolved.definition;
-                let ctx = pricing_context(
-                    pricing_def,
-                    span_attributes,
-                    resource_attributes,
-                    &extracted.model_params,
+                cost_status = Some(CostStatus::Unpriced);
+            } else if cost.is_empty()
+                && let Some(org_pricing_entries) = org_pricing_entries
+                && let Some(model_name) = extracted.model_name.as_deref()
+            {
+                let resolved = crate::db::model_pricing::find_pricing_sync_at(
+                    org_pricing_entries,
+                    model_name,
+                    span_ts_micros,
                 );
-                let result =
-                    crate::db::model_pricing::calculate_cost_from_definition_with_tier_usage(
+                let mut priced = false;
+                if let Some(resolved) = resolved {
+                    let pricing_def = &resolved.definition;
+                    let ctx = pricing_context(
                         pricing_def,
-                        &billable_usage,
-                        &tier_usage,
-                        span_ts_micros,
-                        &ctx,
+                        span_attributes,
+                        resource_attributes,
+                        &extracted.model_params,
                     );
-                if !result.cost.is_empty() {
-                    log::debug!(
-                        "[model_pricing] model='{}' pattern='{}' match={:?} tier='{}' total_cost={:.8}",
-                        extracted.model_name.as_deref().unwrap_or(""),
-                        pricing_def.match_pattern,
-                        resolved.match_kind,
-                        result.tier_name,
-                        result.cost.get("total").copied().unwrap_or(0.0),
-                    );
-                    cost = result.cost;
-                    add_cache_derived_costs(&mut cost, &tier_usage, &result.prices);
-                    cost.values_mut().for_each(|v| *v = round_cost(*v));
+                    let result =
+                        crate::db::model_pricing::calculate_cost_from_definition_with_tier_usage(
+                            pricing_def,
+                            &billable_usage,
+                            &tier_usage,
+                            span_ts_micros,
+                            &ctx,
+                        );
+                    // A selected tier prices the span even when its cost is zero (no tokens,
+                    // or a free model); only "no definition / no tier" is unpriced.
+                    priced = result.tier_index.is_some();
+                    if priced && resolved.match_kind == MatchKind::Approximate {
+                        cost_status = Some(CostStatus::Approximate);
+                    }
+                    // Free means the exact match's selected tier prices every unit at $0, not
+                    // that this span happened to cost $0 (a priced model's zero-token span).
+                    zero_priced = priced
+                        && resolved.match_kind == MatchKind::Exact
+                        && !result.prices.is_empty()
+                        && result.prices.values().all(|&price| price == 0.0);
+                    if !result.cost.is_empty() {
+                        log::debug!(
+                            "[model_pricing] model='{}' pattern='{}' match={:?} tier='{}' total_cost={:.8}",
+                            model_name,
+                            pricing_def.match_pattern,
+                            resolved.match_kind,
+                            result.tier_name,
+                            result.cost.get("total").copied().unwrap_or(0.0),
+                        );
+                        cost = result.cost;
+                        add_cache_derived_costs(&mut cost, &tier_usage, &result.prices);
+                        cost.values_mut().for_each(|v| *v = round_cost(*v));
+                    }
+                }
+                if !priced && usage.values().any(|&tokens| tokens > 0) {
+                    cost_status = Some(CostStatus::Unpriced);
                 }
             }
         }
@@ -363,13 +436,20 @@ impl OtelIngestionProcessor {
             usage.insert("total".to_string(), input + cache_input + output);
         }
 
-        // Ensure cost total (sum all components, not just input+output).
-        if !cost.contains_key("total") {
+        // Ensure cost total (sum all components, not just input+output). An unpriced span keeps
+        // no cost at all so readers can tell "no price" from "free".
+        if cost_status != Some(CostStatus::Unpriced) && !cost.contains_key("total") {
             let total = actual_cost_total(&cost);
             cost.insert("total".to_string(), total);
         }
+        // An exact all-zero price (a free or muted model) is still a price; mark it so readers
+        // do not take the zero for a legacy unpriced span. A priced model's zero-token span
+        // stays unmarked.
+        if zero_priced && cost.get("total").copied() == Some(0.0) {
+            cost_status = Some(CostStatus::Free);
+        }
 
-        (usage, cost)
+        (usage, cost, cost_status)
     }
 
     // ── Phase 3: Emit enriched attributes ──────────────────────────────────
@@ -380,13 +460,20 @@ impl OtelIngestionProcessor {
         extracted: &SpanExtractions,
         usage: &HashMap<String, i64>,
         cost: &HashMap<String, f64>,
+        cost_status: Option<CostStatus>,
     ) {
         span_attributes.insert(
             GenAiAttributes::OPERATION_NAME.to_string(),
             json::json!(extracted.op_name),
         );
 
-        if let Some(ref model) = extracted.model_name {
+        // A failed call keeps only a response-named model; the request model proves nothing.
+        let response_model = if extracted.failed_without_usage {
+            extracted.response_model.as_ref()
+        } else {
+            extracted.model_name.as_ref()
+        };
+        if let Some(model) = response_model {
             span_attributes.insert(
                 GenAiAttributes::RESPONSE_MODEL.to_string(),
                 json::json!(model),
@@ -512,6 +599,20 @@ impl OtelIngestionProcessor {
         if let Some(&v) = cost.get("total") {
             insert_if_absent(span_attributes, GenAiAttributes::USAGE_COST, json::json!(v));
         }
+        // Only ingest sets the marker; a client-sent value in either spelling (both flatten to
+        // the same column) would fake one or collide with the ingest value.
+        span_attributes.remove(GenAiExtensions::USAGE_COST_STATUS);
+        span_attributes.remove(COST_STATUS_COLUMN);
+        if let Some(status) = cost_status {
+            if status == CostStatus::Unpriced {
+                // A client-sent zero is not a price; leave the cost null.
+                span_attributes.remove(GenAiAttributes::USAGE_COST);
+            }
+            span_attributes.insert(
+                GenAiExtensions::USAGE_COST_STATUS.to_string(),
+                json::json!(status.as_str()),
+            );
+        }
 
         if let Some(uid) = &extracted.user_id {
             span_attributes.insert(OtelAttributes::USER_ID.to_string(), json::json!(uid));
@@ -524,20 +625,27 @@ impl OtelIngestionProcessor {
             );
         }
 
-        if let Some(pname) = &extracted.prompt_name {
-            span_attributes.insert(GenAiAttributes::PROMPT_NAME.to_string(), json::json!(pname));
-        }
-        if let Some(version) = extracted.prompt_version {
-            span_attributes.insert(
-                GenAiAttributes::PROMPT_VERSION.to_string(),
-                json::json!(version),
-            );
-        }
-        if let Some(label) = &extracted.prompt_label {
-            span_attributes.insert(
-                GenAiAttributes::PROMPT_LABEL.to_string(),
-                json::json!(label),
-            );
+        // The raw prompt reference survives extraction; replace it with the normalised value,
+        // or drop it when the extractor rejected it (a non-string name, a version that is not a
+        // positive integer), so `gen_ai_prompt_version` stays an Int64 column.
+        for (key, value) in [
+            (
+                GenAiAttributes::PROMPT_NAME,
+                extracted.prompt_name.as_deref().map(|v| json::json!(v)),
+            ),
+            (
+                GenAiAttributes::PROMPT_VERSION,
+                extracted.prompt_version.map(|v| json::json!(v)),
+            ),
+            (
+                GenAiAttributes::PROMPT_LABEL,
+                extracted.prompt_label.as_deref().map(|v| json::json!(v)),
+            ),
+        ] {
+            match value {
+                Some(value) => span_attributes.insert(key.to_string(), value),
+                None => span_attributes.remove(key),
+            };
         }
 
         // TTFT: convert microseconds → Float64 seconds.
@@ -786,6 +894,94 @@ fn cache_input_tokens(usage: &HashMap<String, i64>) -> i64 {
     cache_read.saturating_add(cache_creation)
 }
 
+/// Text a tokenizer should count: message `content`/`text` parts and tool-call arguments only.
+fn message_text(value: &json::Value) -> Cow<'_, str> {
+    let parsed;
+    let structured = match value {
+        json::Value::String(s) => match json::from_str::<json::Value>(s) {
+            Ok(v @ (json::Value::Array(_) | json::Value::Object(_))) => {
+                parsed = v;
+                &parsed
+            }
+            _ => return Cow::Borrowed(s),
+        },
+        other => other,
+    };
+    let mut out = String::new();
+    collect_message_text(structured, &mut out);
+    if out.is_empty() {
+        collect_string_leaves(structured, &mut out);
+    }
+    Cow::Owned(out)
+}
+
+fn collect_message_text(value: &json::Value, out: &mut String) {
+    match value {
+        json::Value::String(s) => push_text(out, s),
+        json::Value::Array(items) => items
+            .iter()
+            .for_each(|item| collect_message_text(item, out)),
+        json::Value::Object(map) => {
+            for key in [
+                "content",
+                "text",
+                "parts",
+                "messages",
+                "tool_calls",
+                "toolCalls",
+                // OpenInference `message.content`, `contents.N.message_content.text`, tool calls.
+                "message",
+                "contents",
+                "message_content",
+                "tool_call",
+            ] {
+                if let Some(v) = map.get(key) {
+                    collect_message_text(v, out);
+                }
+            }
+            // Tool call: OpenAI `{function: {arguments}}`, `{arguments}`, or Vercel `{args}`.
+            if let Some(function) = map.get("function") {
+                collect_message_text(function, out);
+            }
+            for key in ["arguments", "args", "input"] {
+                match map.get(key) {
+                    Some(json::Value::String(s)) => push_text(out, s),
+                    Some(v @ (json::Value::Object(_) | json::Value::Array(_))) => {
+                        if !out.is_empty() {
+                            out.push('\n');
+                        }
+                        // Writing into a String cannot fail.
+                        let _ = write!(out, "{v}");
+                    }
+                    _ => {}
+                }
+            }
+        }
+        _ => {}
+    }
+}
+
+fn collect_string_leaves(value: &json::Value, out: &mut String) {
+    match value {
+        json::Value::String(s) => push_text(out, s),
+        json::Value::Array(items) => items
+            .iter()
+            .for_each(|item| collect_string_leaves(item, out)),
+        json::Value::Object(map) => map.values().for_each(|v| collect_string_leaves(v, out)),
+        _ => {}
+    }
+}
+
+fn push_text(out: &mut String, text: &str) {
+    if text.is_empty() {
+        return;
+    }
+    if !out.is_empty() {
+        out.push('\n');
+    }
+    out.push_str(text);
+}
+
 fn insert_if_absent(
     span_attributes: &mut HashMap<String, json::Value>,
     key: &str,
@@ -1011,8 +1207,8 @@ mod tests {
             &HashMap::new(),
             None,
             &[],
-            &[],
-            0,
+            Some(&[]),
+            SpanContext::default(),
             &config,
         );
 
@@ -1233,6 +1429,51 @@ mod tests {
         assert!(!span_attrs.contains_key("gen_ai_prompt_variable_customer"));
     }
 
+    #[test]
+    fn process_span_replaces_or_drops_raw_prompt_reference() {
+        let processor = OtelIngestionProcessor::new();
+        // Rejected by the extractor: a non-numeric version and a non-string name.
+        let mut rejected = HashMap::from([
+            (GenAiAttributes::PROMPT_NAME.to_string(), json::json!(42)),
+            (
+                GenAiAttributes::PROMPT_VERSION.to_string(),
+                json::json!("latest"),
+            ),
+            (
+                GenAiAttributes::PROMPT_LABEL.to_string(),
+                json::json!("production"),
+            ),
+        ]);
+        processor.process_span(&mut rejected, &HashMap::new(), None, &[]);
+        assert!(!rejected.contains_key(GenAiAttributes::PROMPT_VERSION));
+        assert!(!rejected.contains_key(GenAiAttributes::PROMPT_NAME));
+        assert_eq!(
+            rejected.get(GenAiAttributes::PROMPT_LABEL),
+            Some(&json::json!("production"))
+        );
+
+        // A numeric string version is stored as the integer it names.
+        let mut accepted = HashMap::from([
+            (
+                GenAiAttributes::PROMPT_NAME.to_string(),
+                json::json!("support-answer"),
+            ),
+            (
+                GenAiAttributes::PROMPT_VERSION.to_string(),
+                json::json!("3"),
+            ),
+        ]);
+        processor.process_span(&mut accepted, &HashMap::new(), None, &[]);
+        assert_eq!(
+            accepted.get(GenAiAttributes::PROMPT_VERSION),
+            Some(&json::json!(3))
+        );
+        assert_eq!(
+            accepted.get(GenAiAttributes::PROMPT_NAME),
+            Some(&json::json!("support-answer"))
+        );
+    }
+
     #[test]
     fn test_process_span_calculates_cost_from_tokens() {
         let processor = OtelIngestionProcessor::new();
@@ -1508,39 +1749,93 @@ mod tests {
         );
     }
 
-    #[test]
-    fn test_process_span_no_cost_calculation_for_unknown_model() {
-        let processor = OtelIngestionProcessor::new();
-
+    fn chat_span(model: &str) -> HashMap<String, json::Value> {
         let mut span_attrs = HashMap::new();
         span_attrs.insert("gen_ai.operation.name".to_string(), json::json!("chat"));
-        span_attrs.insert(
-            "gen_ai.request.model".to_string(),
-            json::json!("unknown-model-xyz-2024"),
-        );
-        span_attrs.insert(
-            "gen_ai.input.messages".to_string(),
-            json::json!("[{\"role\":\"user\"}]"),
-        );
-        span_attrs.insert(
-            "gen_ai.output.messages".to_string(),
-            json::json!("[{\"role\":\"assistant\"}]"),
-        );
+        span_attrs.insert("gen_ai.request.model".to_string(), json::json!(model));
         span_attrs.insert("gen_ai.usage.input_tokens".to_string(), json::json!(1000));
         span_attrs.insert("gen_ai.usage.output_tokens".to_string(), json::json!(500));
+        span_attrs
+    }
 
-        let resource_attrs = HashMap::new();
-        let events = vec![];
+    fn cost_status(span_attrs: &HashMap<String, json::Value>) -> Option<&str> {
+        span_attrs
+            .get(GenAiExtensions::USAGE_COST_STATUS)
+            .and_then(|v| v.as_str())
+    }
 
-        processor.process_span(&mut span_attrs, &resource_attrs, None, &events);
+    #[test]
+    fn test_unpriced_model_keeps_tokens_and_has_no_cost() {
+        let processor = OtelIngestionProcessor::new();
+        let mut span_attrs = chat_span("unknown-model-xyz-2024");
+        // A client-sent zero is not a price either.
+        span_attrs.insert("gen_ai.usage.cost".to_string(), json::json!(0));
 
-        // No pricing definition matched for unknown model — total cost should be zero.
+        processor.process_span(&mut span_attrs, &HashMap::new(), None, &[]);
+
+        assert_eq!(cost_status(&span_attrs), Some("unpriced"));
+        assert!(!span_attrs.contains_key(GenAiAttributes::USAGE_COST));
+        assert!(!span_attrs.contains_key(GenAiExtensions::USAGE_COST_INPUT));
+        assert!(!span_attrs.contains_key(GenAiExtensions::USAGE_COST_OUTPUT));
         assert_eq!(
-            span_attrs
+            span_attrs.get(GenAiAttributes::USAGE_TOTAL_TOKENS),
+            Some(&json::json!(1500))
+        );
+    }
+
+    #[test]
+    fn test_approximate_match_keeps_cost_and_is_marked() {
+        let processor = OtelIngestionProcessor::new();
+        // `(?i)claude-sonnet-4-6` covers only the start of the dated name.
+        let mut span_attrs = chat_span("claude-sonnet-4-6-20260101");
+
+        processor.process_span(&mut span_attrs, &HashMap::new(), None, &[]);
+
+        assert_eq!(cost_status(&span_attrs), Some("approximate"));
+        let total = span_attrs
+            .get(GenAiAttributes::USAGE_COST)
+            .and_then(|v| v.as_f64())
+            .unwrap();
+        assert!((total - (1000.0 * 3e-06 + 500.0 * 1.5e-05)).abs() < 1e-12);
+    }
+
+    #[test]
+    fn test_exact_match_and_client_cost_write_no_marker() {
+        let processor = OtelIngestionProcessor::new();
+        let mut exact = chat_span("gpt-4o");
+        exact.insert(
+            "gen_ai.usage.cost_status".to_string(),
+            json::json!("unpriced"),
+        );
+        processor.process_span(&mut exact, &HashMap::new(), None, &[]);
+        assert_eq!(cost_status(&exact), None);
+        assert!(exact.contains_key(GenAiAttributes::USAGE_COST));
+
+        let mut client_cost = chat_span("unknown-model-xyz-2024");
+        client_cost.insert("gen_ai.usage.cost".to_string(), json::json!(0.25));
+        processor.process_span(&mut client_cost, &HashMap::new(), None, &[]);
+        assert_eq!(cost_status(&client_cost), None);
+        assert_eq!(
+            client_cost
                 .get(GenAiAttributes::USAGE_COST)
                 .and_then(|v| v.as_f64()),
-            Some(0.0)
+            Some(0.25)
         );
+
+        // The flattened spelling lands in the same column and must not survive either.
+        let mut flattened = chat_span("gpt-4o");
+        flattened.insert(COST_STATUS_COLUMN.to_string(), json::json!("unpriced"));
+        processor.process_span(&mut flattened, &HashMap::new(), None, &[]);
+        assert_eq!(cost_status(&flattened), None);
+        assert!(!flattened.contains_key(COST_STATUS_COLUMN));
+        assert!(flattened.contains_key(GenAiAttributes::USAGE_COST));
+
+        // An ingest-set marker replaces a client-sent flattened one instead of colliding.
+        let mut unpriced = chat_span("unknown-model-xyz-2024");
+        unpriced.insert(COST_STATUS_COLUMN.to_string(), json::json!("approximate"));
+        processor.process_span(&mut unpriced, &HashMap::new(), None, &[]);
+        assert_eq!(cost_status(&unpriced), Some("unpriced"));
+        assert!(!unpriced.contains_key(COST_STATUS_COLUMN));
     }
 
     #[test]
@@ -1594,6 +1889,152 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_no_model_with_tokens_is_unpriced_without_tokens_unmarked() {
+        let processor = OtelIngestionProcessor::new();
+        let mut with_tokens = chat_span("x");
+        with_tokens.remove("gen_ai.request.model");
+        processor.process_span(&mut with_tokens, &HashMap::new(), None, &[]);
+        assert_eq!(cost_status(&with_tokens), Some("unpriced"));
+        assert!(!with_tokens.contains_key(GenAiAttributes::USAGE_COST));
+        assert_eq!(
+            with_tokens.get(GenAiAttributes::USAGE_TOTAL_TOKENS),
+            Some(&json::json!(1500))
+        );
+
+        let mut no_tokens = HashMap::new();
+        no_tokens.insert("gen_ai.operation.name".to_string(), json::json!("chat"));
+        processor.process_span(&mut no_tokens, &HashMap::new(), None, &[]);
+        assert_eq!(cost_status(&no_tokens), None);
+        no_tokens.insert(
+            "gen_ai.request.model".to_string(),
+            json::json!("unknown-zero-usage"),
+        );
+        processor.process_span(&mut no_tokens, &HashMap::new(), None, &[]);
+        assert_eq!(cost_status(&no_tokens), None);
+
+        // A client-reported cost still wins over the missing model.
+        let mut client_cost = chat_span("x");
+        client_cost.remove("gen_ai.request.model");
+        client_cost.insert("gen_ai.usage.cost".to_string(), json::json!(0.25));
+        processor.process_span(&mut client_cost, &HashMap::new(), None, &[]);
+        assert_eq!(cost_status(&client_cost), None);
+    }
+
+    fn zero_price_entry(model: &str) -> CachedModelPricing {
+        use config::meta::model_pricing::PricingTierDefinition;
+
+        let pattern = format!("^{model}$");
+        CachedModelPricing {
+            definition: ModelPricingDefinition {
+                name: format!("{model} (muted)"),
+                match_pattern: pattern.clone(),
+                enabled: true,
+                tiers: vec![PricingTierDefinition {
+                    name: "Default".to_string(),
+                    condition: None,
+                    prices: HashMap::from([
+                        ("input".to_string(), 0.0),
+                        ("output".to_string(), 0.0),
+                    ]),
+                    utc_windows: Vec::new(),
+                    rules: Vec::new(),
+                    priority: 0,
+                }],
+                ..Default::default()
+            },
+            compiled_regex: regex::Regex::new(&pattern).unwrap(),
+        }
+    }
+
+    #[test]
+    fn test_exact_zero_price_with_tokens_is_marked_free() {
+        let processor = OtelIngestionProcessor::new();
+        let entries = vec![zero_price_entry("acme-internal-llm")];
+
+        let mut muted = chat_span("acme-internal-llm");
+        processor.process_span_with_pricing(&mut muted, &HashMap::new(), None, &[], &entries, 0);
+        assert_eq!(cost_status(&muted), Some("free"));
+        assert_eq!(
+            muted
+                .get(GenAiAttributes::USAGE_COST)
+                .and_then(|v| v.as_f64()),
+            Some(0.0)
+        );
+
+        // An exactly matched zero price is free even when no tokens were used.
+        let mut no_tokens = HashMap::new();
+        no_tokens.insert("gen_ai.operation.name".to_string(), json::json!("chat"));
+        no_tokens.insert(
+            "gen_ai.request.model".to_string(),
+            json::json!("acme-internal-llm"),
+        );
+        processor.process_span_with_pricing(
+            &mut no_tokens,
+            &HashMap::new(),
+            None,
+            &[],
+            &entries,
+            0,
+        );
+        assert_eq!(cost_status(&no_tokens), Some("free"));
+    }
+
+    #[test]
+    fn test_zero_token_span_of_priced_model_is_not_free() {
+        let processor = OtelIngestionProcessor::new();
+        let mut entry = zero_price_entry("acme-paid-llm");
+        entry.definition.tiers[0].prices = HashMap::from([
+            ("input".to_string(), 0.000001),
+            ("output".to_string(), 0.000002),
+        ]);
+        let entries = vec![entry];
+
+        let mut no_tokens = HashMap::new();
+        no_tokens.insert("gen_ai.operation.name".to_string(), json::json!("chat"));
+        no_tokens.insert(
+            "gen_ai.request.model".to_string(),
+            json::json!("acme-paid-llm"),
+        );
+        processor.process_span_with_pricing(
+            &mut no_tokens,
+            &HashMap::new(),
+            None,
+            &[],
+            &entries,
+            0,
+        );
+        assert_eq!(cost_status(&no_tokens), None);
+    }
+
+    #[test]
+    fn test_pricing_disabled_writes_no_marker() {
+        let processor = OtelIngestionProcessor::new();
+        for model in [Some("unknown-model-xyz-2024"), Some("gpt-4o"), None] {
+            let mut span_attrs = chat_span(model.unwrap_or("x"));
+            if model.is_none() {
+                span_attrs.remove("gen_ai.request.model");
+            }
+            processor.process_span_with_pricing_and_agent_mapping(
+                &mut span_attrs,
+                &HashMap::new(),
+                None,
+                &[],
+                None,
+                SpanContext::default(),
+                &GenAiAgentMappingConfig::default(),
+            );
+            assert_eq!(cost_status(&span_attrs), None, "{model:?}");
+            assert!(!span_attrs.contains_key(COST_STATUS_COLUMN), "{model:?}");
+            // Tokens are still counted; nothing is priced.
+            assert_eq!(
+                span_attrs.get(GenAiAttributes::USAGE_TOTAL_TOKENS),
+                Some(&json::json!(1500))
+            );
+            assert!(!span_attrs.contains_key(GenAiExtensions::USAGE_COST_INPUT));
+        }
+    }
+
     #[test]
     fn test_process_span_extracts_evaluation_scores() {
         let processor = OtelIngestionProcessor::new();
@@ -2285,4 +2726,514 @@ mod tests {
             0.003
         ));
     }
+
+    fn attrs(pairs: &[(&str, json::Value)]) -> HashMap<String, json::Value> {
+        pairs
+            .iter()
+            .map(|(k, v)| (k.to_string(), v.clone()))
+            .collect()
+    }
+
+    fn process_ctx(
+        span_attrs: &mut HashMap<String, json::Value>,
+        scope_name: Option<&str>,
+        span: SpanContext<'_>,
+        pricing: &[CachedModelPricing],
+    ) {
+        OtelIngestionProcessor::new().process_span_with_pricing_and_agent_mapping(
+            span_attrs,
+            &HashMap::new(),
+            scope_name,
+            &[],
+            Some(pricing),
+            span,
+            &GenAiAgentMappingConfig::default(),
+        );
+    }
+
+    fn get_i64(span_attrs: &HashMap<String, json::Value>, key: &str) -> Option<i64> {
+        span_attrs.get(key).and_then(|v| v.as_i64())
+    }
+
+    fn get_f64(span_attrs: &HashMap<String, json::Value>, key: &str) -> Option<f64> {
+        span_attrs.get(key).and_then(|v| v.as_f64())
+    }
+
+    fn get_str<'a>(span_attrs: &'a HashMap<String, json::Value>, key: &str) -> Option<&'a str> {
+        span_attrs.get(key).and_then(|v| v.as_str())
+    }
+
+    #[test]
+    fn test_vercel_ai5_generate_text_trace_prices_only_provider_call() {
+        // ai@5 `generateText`: the wrapper span carries its single `doGenerate` child's usage.
+        let mut wrapper = attrs(&[
+            ("ai.operationId", json::json!("ai.generateText")),
+            ("operation.name", json::json!("ai.generateText")),
+            ("ai.model.id", json::json!("gpt-4o")),
+            ("ai.model.provider", json::json!("openai.chat")),
+            ("ai.prompt", json::json!(r#"{"prompt":"Say hello"}"#)),
+            ("ai.response.text", json::json!("Hello!")),
+            ("ai.usage.inputTokens", json::json!(30)),
+            ("ai.usage.outputTokens", json::json!(12)),
+            ("ai.usage.totalTokens", json::json!(42)),
+        ]);
+        let mut call = attrs(&[
+            ("ai.operationId", json::json!("ai.generateText.doGenerate")),
+            ("ai.model.id", json::json!("gpt-4o")),
+            ("ai.model.provider", json::json!("openai.chat")),
+            (
+                "ai.prompt.messages",
+                json::json!(r#"[{"role":"user","content":[{"type":"text","text":"Say hello"}]}]"#),
+            ),
+            ("ai.response.text", json::json!("Hello!")),
+            ("ai.response.model", json::json!("gpt-4o-2024-08-06")),
+            ("gen_ai.system", json::json!("openai.chat")),
+            ("gen_ai.request.model", json::json!("gpt-4o")),
+            ("gen_ai.response.model", json::json!("gpt-4o-2024-08-06")),
+            ("gen_ai.usage.input_tokens", json::json!(30)),
+            ("gen_ai.usage.output_tokens", json::json!(12)),
+            ("ai.usage.inputTokens", json::json!(30)),
+            ("ai.usage.outputTokens", json::json!(12)),
+            ("ai.usage.totalTokens", json::json!(42)),
+        ]);
+        let pricing = built_in_pricing();
+        process_ctx(
+            &mut wrapper,
+            Some("ai"),
+            SpanContext {
+                name: "ai.generateText",
+                ..Default::default()
+            },
+            pricing,
+        );
+        process_ctx(
+            &mut call,
+            Some("ai"),
+            SpanContext {
+                name: "ai.generateText.doGenerate",
+                ..Default::default()
+            },
+            pricing,
+        );
+
+        // Wrapper: an aggregate, keeps the real usage, is not priced.
+        assert_eq!(
+            get_str(&wrapper, GenAiAttributes::OPERATION_NAME),
+            Some("invoke_workflow")
+        );
+        assert_eq!(
+            get_i64(&wrapper, GenAiAttributes::USAGE_INPUT_TOKENS),
+            Some(30)
+        );
+        assert_eq!(
+            get_i64(&wrapper, GenAiAttributes::USAGE_OUTPUT_TOKENS),
+            Some(12)
+        );
+        assert_eq!(get_f64(&wrapper, GenAiAttributes::USAGE_COST), Some(0.0));
+        assert!(!wrapper.contains_key(GenAiExtensions::USAGE_COST_INPUT));
+
+        // Provider call: priced from the provider usage (gpt-4o $2.50/$10.00 per 1M).
+        assert_eq!(
+            get_str(&call, GenAiAttributes::OPERATION_NAME),
+            Some("chat")
+        );
+        assert_eq!(
+            get_i64(&call, GenAiAttributes::USAGE_INPUT_TOKENS),
+            Some(30)
+        );
+        assert_eq!(
+            get_i64(&call, GenAiAttributes::USAGE_OUTPUT_TOKENS),
+            Some(12)
+        );
+        let cost = get_f64(&call, GenAiAttributes::USAGE_COST).unwrap();
+        assert!(
+            (cost - (30.0 * 2.5e-6 + 12.0 * 1e-5)).abs() < 1e-12,
+            "{cost}"
+        );
+    }
+
+    #[test]
+    fn test_vercel_wrapper_identified_by_span_name_alone() {
+        let mut wrapper = attrs(&[
+            ("ai.model.id", json::json!("gpt-4o")),
+            ("ai.prompt", json::json!(r#"{"prompt":"Say hello"}"#)),
+            ("ai.response.text", json::json!("Hello!")),
+        ]);
+        process_ctx(
+            &mut wrapper,
+            Some("ai"),
+            SpanContext {
+                name: "ai.streamText",
+                ..Default::default()
+            },
+            built_in_pricing(),
+        );
+        assert_eq!(
+            get_str(&wrapper, GenAiAttributes::OPERATION_NAME),
+            Some("invoke_workflow")
+        );
+        // No estimation on an aggregate span.
+        assert_eq!(
+            get_i64(&wrapper, GenAiAttributes::USAGE_INPUT_TOKENS),
+            Some(0)
+        );
+        assert_eq!(
+            get_i64(&wrapper, GenAiAttributes::USAGE_OUTPUT_TOKENS),
+            Some(0)
+        );
+        assert_eq!(get_f64(&wrapper, GenAiAttributes::USAGE_COST), Some(0.0));
+    }
+
+    /// Anthropic-like per-1M prices: input $3, output $15, cache read $0.30, cache write $3.75.
+    fn cache_pricing() -> Vec<CachedModelPricing> {
+        use config::meta::model_pricing::PricingTierDefinition;
+        vec![CachedModelPricing {
+            definition: ModelPricingDefinition {
+                name: "Claude Cache".to_string(),
+                match_pattern: "(?i)^claude-cache".to_string(),
+                enabled: true,
+                tiers: vec![PricingTierDefinition {
+                    name: "Default".to_string(),
+                    condition: None,
+                    prices: HashMap::from([
+                        ("input".to_string(), 3e-6),
+                        ("output".to_string(), 1.5e-5),
+                        ("cache_read_input_tokens".to_string(), 3e-7),
+                        ("cache_creation_input_tokens".to_string(), 3.75e-6),
+                    ]),
+                    utc_windows: Vec::new(),
+                    rules: Vec::new(),
+                    priority: 0,
+                }],
+                ..Default::default()
+            },
+            compiled_regex: regex::Regex::new("(?i)^claude-cache").unwrap(),
+        }]
+    }
+
+    fn cached_cost(mut span_attrs: HashMap<String, json::Value>, scope: Option<&str>) -> f64 {
+        let span_name = span_attrs
+            .get("ai.operationId")
+            .and_then(|v| v.as_str())
+            .unwrap_or("")
+            .to_string();
+        process_ctx(
+            &mut span_attrs,
+            scope,
+            SpanContext {
+                name: &span_name,
+                ..Default::default()
+            },
+            &cache_pricing(),
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_CACHE_READ_INPUT_TOKENS),
+            Some(700)
+        );
+        let cache_read_cost =
+            get_f64(&span_attrs, GenAiExtensions::USAGE_COST_CACHE_READ_INPUT).unwrap();
+        assert!((cache_read_cost - 700.0 * 3e-7).abs() < 1e-12);
+        get_f64(&span_attrs, GenAiAttributes::USAGE_COST).unwrap()
+    }
+
+    // 200 uncached input + 100 output + 700 cache read (+ 100 cache write).
+    const READ_ONLY_COST: f64 = 200.0 * 3e-6 + 100.0 * 1.5e-5 + 700.0 * 3e-7;
+    const READ_WRITE_COST: f64 = READ_ONLY_COST + 100.0 * 3.75e-6;
+
+    #[test]
+    fn test_openinference_cache_tokens_priced_at_cache_rates() {
+        // OpenInference's prompt count includes the cache details.
+        let cost = cached_cost(
+            attrs(&[
+                ("openinference.span.kind", json::json!("LLM")),
+                ("llm.model_name", json::json!("claude-cache")),
+                ("llm.token_count.prompt", json::json!(1000)),
+                ("llm.token_count.completion", json::json!(100)),
+                (
+                    "llm.token_count.prompt_details.cache_read",
+                    json::json!(700),
+                ),
+                (
+                    "llm.token_count.prompt_details.cache_write",
+                    json::json!(100),
+                ),
+            ]),
+            None,
+        );
+        assert!((cost - READ_WRITE_COST).abs() < 1e-12, "{cost}");
+    }
+
+    #[test]
+    fn test_vercel_input_token_details_priced_at_cache_rates() {
+        // ai@6+: inputTokens is the total including cache read and write.
+        let cost = cached_cost(
+            attrs(&[
+                ("ai.operationId", json::json!("ai.generateText.doGenerate")),
+                ("ai.model.id", json::json!("claude-cache")),
+                ("ai.model.provider", json::json!("anthropic.messages")),
+                ("ai.usage.inputTokens", json::json!(1000)),
+                ("ai.usage.outputTokens", json::json!(100)),
+                (
+                    "ai.usage.inputTokenDetails.cacheReadTokens",
+                    json::json!(700),
+                ),
+                (
+                    "ai.usage.inputTokenDetails.cacheWriteTokens",
+                    json::json!(100),
+                ),
+            ]),
+            Some("ai"),
+        );
+        assert!((cost - READ_WRITE_COST).abs() < 1e-12, "{cost}");
+    }
+
+    #[test]
+    fn test_vercel_cached_input_tokens_priced_per_provider_semantics() {
+        // ai@5: Anthropic's inputTokens excludes cache reads, OpenAI's includes them.
+        for (provider, input_tokens) in [("anthropic.messages", 200), ("openai.chat", 900)] {
+            let cost = cached_cost(
+                attrs(&[
+                    ("ai.operationId", json::json!("ai.streamText.doStream")),
+                    ("ai.model.id", json::json!("claude-cache")),
+                    ("ai.model.provider", json::json!(provider)),
+                    ("ai.usage.inputTokens", json::json!(input_tokens)),
+                    ("ai.usage.outputTokens", json::json!(100)),
+                    ("ai.usage.cachedInputTokens", json::json!(700)),
+                ]),
+                Some("ai"),
+            );
+            assert!((cost - READ_ONLY_COST).abs() < 1e-12, "{provider}: {cost}");
+        }
+    }
+
+    #[test]
+    fn test_langfuse_nested_cached_tokens_priced_at_cache_rates() {
+        // langfuse.openai: OpenAI usage, prompt_tokens includes the nested cached_tokens.
+        let usage = json::json!({
+            "prompt_tokens": 900,
+            "completion_tokens": 100,
+            "total_tokens": 1000,
+            "prompt_tokens_details": {"cached_tokens": 700}
+        });
+        let cost = cached_cost(
+            attrs(&[
+                ("langfuse.observation.type", json::json!("generation")),
+                (
+                    "langfuse.observation.model.name",
+                    json::json!("claude-cache"),
+                ),
+                (
+                    LangfuseAttributes::USAGE_DETAILS,
+                    json::Value::String(usage.to_string()),
+                ),
+            ]),
+            None,
+        );
+        assert!((cost - READ_ONLY_COST).abs() < 1e-12, "{cost}");
+    }
+
+    #[test]
+    fn test_failed_call_without_usage_gets_no_tokens_cost_or_response_model() {
+        let mut span_attrs = attrs(&[
+            ("gen_ai.operation.name", json::json!("chat")),
+            ("gen_ai.request.model", json::json!("gpt-4o")),
+            (
+                "gen_ai.input.messages",
+                json::json!(r#"[{"role":"user","content":"What is the capital of France?"}]"#),
+            ),
+        ]);
+        process_ctx(
+            &mut span_attrs,
+            None,
+            SpanContext {
+                is_error: true,
+                ..Default::default()
+            },
+            built_in_pricing(),
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_INPUT_TOKENS),
+            Some(0)
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_OUTPUT_TOKENS),
+            Some(0)
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_TOTAL_TOKENS),
+            Some(0)
+        );
+        assert_eq!(get_f64(&span_attrs, GenAiAttributes::USAGE_COST), Some(0.0));
+        assert!(!span_attrs.contains_key(GenAiExtensions::USAGE_COST_INPUT));
+        assert!(!span_attrs.contains_key(GenAiAttributes::RESPONSE_MODEL));
+        assert_eq!(
+            get_str(&span_attrs, GenAiAttributes::REQUEST_MODEL),
+            Some("gpt-4o")
+        );
+    }
+
+    #[test]
+    fn test_failed_call_with_usage_is_still_priced() {
+        let mut span_attrs = attrs(&[
+            ("gen_ai.operation.name", json::json!("chat")),
+            ("gen_ai.request.model", json::json!("gpt-4o")),
+            ("gen_ai.usage.input_tokens", json::json!(1000)),
+            ("gen_ai.usage.output_tokens", json::json!(500)),
+        ]);
+        process_ctx(
+            &mut span_attrs,
+            None,
+            SpanContext {
+                is_error: true,
+                ..Default::default()
+            },
+            built_in_pricing(),
+        );
+        assert_eq!(
+            get_f64(&span_attrs, GenAiAttributes::USAGE_COST),
+            Some(0.0075)
+        );
+        assert_eq!(
+            get_str(&span_attrs, GenAiAttributes::RESPONSE_MODEL),
+            Some("gpt-4o")
+        );
+    }
+
+    #[test]
+    fn test_successful_call_without_response_model_priced_from_request_model() {
+        let mut span_attrs = attrs(&[
+            ("gen_ai.operation.name", json::json!("chat")),
+            ("gen_ai.request.model", json::json!("gpt-4o")),
+            ("gen_ai.usage.input_tokens", json::json!(1000)),
+            ("gen_ai.usage.output_tokens", json::json!(500)),
+        ]);
+        process_ctx(
+            &mut span_attrs,
+            None,
+            SpanContext::default(),
+            built_in_pricing(),
+        );
+        assert_eq!(
+            get_f64(&span_attrs, GenAiAttributes::USAGE_COST),
+            Some(0.0075)
+        );
+        assert_eq!(
+            get_str(&span_attrs, GenAiAttributes::RESPONSE_MODEL),
+            Some("gpt-4o")
+        );
+    }
+
+    #[test]
+    fn test_embedding_without_usage_estimates_no_output_tokens() {
+        let mut span_attrs = attrs(&[
+            ("gen_ai.operation.name", json::json!("embeddings")),
+            (
+                "gen_ai.request.model",
+                json::json!("text-embedding-3-small"),
+            ),
+            ("gen_ai.input.messages", json::json!("hello world")),
+            (
+                "gen_ai.output.messages",
+                json::json!("[0.0123,-0.0456,0.0789,0.0101,-0.0112,0.0131]"),
+            ),
+        ]);
+        process_ctx(
+            &mut span_attrs,
+            None,
+            SpanContext::default(),
+            built_in_pricing(),
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_INPUT_TOKENS),
+            Some(pricing::calculate_token_count(
+                "text-embedding-3-small",
+                "hello world"
+            ))
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_OUTPUT_TOKENS),
+            Some(0)
+        );
+    }
+
+    #[test]
+    fn test_chat_estimate_counts_message_text_only() {
+        let question = "What is the capital of France?";
+        let answer = "The capital of France is Paris.";
+        let mut span_attrs = attrs(&[
+            ("gen_ai.operation.name", json::json!("chat")),
+            ("gen_ai.request.model", json::json!("gpt-4o")),
+            (
+                "gen_ai.input.messages",
+                json::json!(format!(
+                    r#"[{{"role":"user","content":[{{"type":"text","text":"{question}"}}]}}]"#
+                )),
+            ),
+            (
+                "gen_ai.output.messages",
+                json::json!(format!(
+                    r#"[{{"role":"assistant","content":"{answer}","id":"msg_0123456789"}}]"#
+                )),
+            ),
+        ]);
+        process_ctx(
+            &mut span_attrs,
+            None,
+            SpanContext::default(),
+            built_in_pricing(),
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_INPUT_TOKENS),
+            Some(pricing::calculate_token_count("gpt-4o", question))
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_OUTPUT_TOKENS),
+            Some(pricing::calculate_token_count("gpt-4o", answer))
+        );
+    }
+
+    #[test]
+    fn test_openinference_estimate_counts_message_text_only() {
+        let question = "What is the capital of France?";
+        let arguments = r#"{"city":"Paris"}"#;
+        let mut span_attrs = attrs(&[
+            ("openinference.span.kind", json::json!("LLM")),
+            ("llm.model_name", json::json!("gpt-4o")),
+            ("llm.input_messages.0.message.role", json::json!("user")),
+            (
+                "llm.input_messages.0.message.content",
+                json::json!(question),
+            ),
+            (
+                "llm.output_messages.0.message.role",
+                json::json!("assistant"),
+            ),
+            (
+                "llm.output_messages.0.message.tool_calls.0.tool_call.id",
+                json::json!("call_0123456789"),
+            ),
+            (
+                "llm.output_messages.0.message.tool_calls.0.tool_call.function.name",
+                json::json!("get_weather"),
+            ),
+            (
+                "llm.output_messages.0.message.tool_calls.0.tool_call.function.arguments",
+                json::json!(arguments),
+            ),
+        ]);
+        process_ctx(
+            &mut span_attrs,
+            None,
+            SpanContext::default(),
+            built_in_pricing(),
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_INPUT_TOKENS),
+            Some(pricing::calculate_token_count("gpt-4o", question))
+        );
+        assert_eq!(
+            get_i64(&span_attrs, GenAiAttributes::USAGE_OUTPUT_TOKENS),
+            Some(pricing::calculate_token_count("gpt-4o", arguments))
+        );
+    }
 }
diff --git a/src/core/src/workflows/http_trigger/cache.rs b/src/core/src/workflows/http_trigger/cache.rs
new file mode 100644
index 0000000000..10c3d78551
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/cache.rs
@@ -0,0 +1,338 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Per-node lookup cache of trigger config, live credentials and decrypted signing keys.
+
+use std::{
+    sync::{
+        Arc, LazyLock,
+        atomic::{AtomicU64, Ordering},
+    },
+    time::{Duration, Instant},
+};
+
+use config::utils::time::now_micros;
+use db::workflow_http_triggers::TRIGGER_KEY_PREFIX;
+use hashbrown::HashMap;
+use infra::{
+    coordinator::get_coordinator,
+    db::{Event, get_orm_client_rw},
+    secrets::{self, SecretMaterial, SecretOwnerKind},
+    table::{
+        entity::{
+            workflow_http_trigger_credentials::Model as CredentialRow,
+            workflow_http_triggers::Model as TriggerRow,
+        },
+        workflow_http_triggers::{self as triggers, CredentialKind, CredentialState},
+    },
+};
+use tokio::sync::RwLock;
+
+use super::{credentials::LiveCredential, signature::decode_secret};
+
+const TTL: Duration = Duration::from_secs(30);
+
+static CACHE: LazyLock<RwLock<HashMap<String, Arc<CachedTrigger>>>> =
+    LazyLock::new(Default::default);
+// Bumped by every invalidation, so a load that overlapped one answers its caller uncached.
+static EPOCH: AtomicU64 = AtomicU64::new(0);
+
+#[derive(Clone)]
+pub struct CachedTrigger {
+    pub trigger: TriggerRow,
+    pub credentials: Vec<LiveCredential>,
+    pub fetched_at: Instant,
+}
+
+impl std::fmt::Debug for CachedTrigger {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("CachedTrigger")
+            .field("trigger_id", &self.trigger.id)
+            .field("org_id", &self.trigger.org_id)
+            .field("auth_mode", &self.trigger.auth_mode)
+            .field("enabled", &self.trigger.enabled)
+            .field("credentials", &self.credentials)
+            .field("fetched_at", &self.fetched_at)
+            .finish()
+    }
+}
+
+pub async fn get(trigger_id: &str) -> Result<Option<Arc<CachedTrigger>>, anyhow::Error> {
+    get_or_load(trigger_id, || load(trigger_id)).await
+}
+
+pub async fn invalidate(trigger_id: &str) {
+    let mut cache = CACHE.write().await;
+    EPOCH.fetch_add(1, Ordering::AcqRel);
+    cache.remove(trigger_id);
+}
+
+pub async fn watch() -> Result<(), anyhow::Error> {
+    let mut events = get_coordinator().await.watch(TRIGGER_KEY_PREFIX).await?;
+    let events = Arc::get_mut(&mut events)
+        .ok_or_else(|| anyhow::anyhow!("trigger cache watch receiver is shared"))?;
+    log::info!("[WORKFLOW_HOOK] start watching trigger cache keys");
+    while let Some(event) = events.recv().await {
+        let key = match &event {
+            Event::Put(e) => e.key.as_str(),
+            Event::Delete(e) => e.key.as_str(),
+            Event::Empty => continue,
+        };
+        if let Some(trigger_id) = evicted_trigger(key) {
+            invalidate(trigger_id).await;
+        }
+    }
+    log::warn!("[WORKFLOW_HOOK] trigger cache watch channel closed");
+    Ok(())
+}
+
+/// The epoch is compared under the write lock that `invalidate` also takes.
+async fn get_or_load<F, Fut>(
+    trigger_id: &str,
+    load: F,
+) -> Result<Option<Arc<CachedTrigger>>, anyhow::Error>
+where
+    F: FnOnce() -> Fut,
+    Fut: Future<Output = Result<Option<CachedTrigger>, anyhow::Error>>,
+{
+    if let Some(hit) = fresh(&*CACHE.read().await, trigger_id, Instant::now()) {
+        return Ok(Some(hit));
+    }
+    let epoch = EPOCH.load(Ordering::Acquire);
+    let loaded = load().await?;
+    let mut cache = CACHE.write().await;
+    let Some(loaded) = loaded else {
+        cache.remove(trigger_id);
+        return Ok(None);
+    };
+    let loaded = Arc::new(loaded);
+    if EPOCH.load(Ordering::Acquire) == epoch {
+        cache.insert(trigger_id.to_string(), loaded.clone());
+    }
+    Ok(Some(loaded))
+}
+
+async fn load(trigger_id: &str) -> Result<Option<CachedTrigger>, anyhow::Error> {
+    let db = get_orm_client_rw().await;
+    let Some(trigger) = triggers::get(db, trigger_id).await? else {
+        return Ok(None);
+    };
+    let now = now_micros();
+    let mut credentials = Vec::new();
+    for row in triggers::list_credentials(db, trigger_id).await? {
+        if let Some(credential) = live_credential(&trigger, row, now).await {
+            credentials.push(credential);
+        }
+    }
+    Ok(Some(CachedTrigger {
+        trigger,
+        credentials,
+        fetched_at: Instant::now(),
+    }))
+}
+
+/// A signing key that cannot be decrypted drops only its own credential, logged by id.
+async fn live_credential(
+    trigger: &TriggerRow,
+    row: CredentialRow,
+    now_us: i64,
+) -> Option<LiveCredential> {
+    let kind = CredentialKind::parse(&row.kind)?;
+    let state = CredentialState::parse(&row.state)?;
+    if !triggers::is_live(state, row.expires_at, now_us) {
+        return None;
+    }
+    let signing_key = match kind {
+        CredentialKind::Token => None,
+        CredentialKind::SigningSecret => Some(signing_key(trigger, &row).await?),
+    };
+    Some(LiveCredential {
+        id: row.id,
+        kind,
+        display_prefix: row.display_prefix,
+        token_sha256: row.token_sha256,
+        signing_key,
+        state,
+        expires_at: row.expires_at,
+    })
+}
+
+async fn signing_key(trigger: &TriggerRow, row: &CredentialRow) -> Option<Vec<u8>> {
+    let secret_ref = row.secret_ref.as_deref()?;
+    let resolved = secrets::resolve_record(
+        &trigger.org_id,
+        secret_ref,
+        SecretOwnerKind::WorkflowTrigger,
+        &row.id,
+        secrets::CURRENT,
+    )
+    .await;
+    match resolved {
+        Ok((_, SecretMaterial::Token { value })) => decode_secret(&value),
+        Ok(_) => {
+            log::warn!("[WORKFLOW_HOOK] credential {} holds no signing key", row.id);
+            None
+        }
+        Err(e) => {
+            log::error!(
+                "[WORKFLOW_HOOK] signing key of credential {} unreadable: {e}",
+                row.id
+            );
+            None
+        }
+    }
+}
+
+fn fresh(
+    cache: &HashMap<String, Arc<CachedTrigger>>,
+    trigger_id: &str,
+    now: Instant,
+) -> Option<Arc<CachedTrigger>> {
+    cache
+        .get(trigger_id)
+        .filter(|entry| now.duration_since(entry.fetched_at) < TTL)
+        .cloned()
+}
+
+fn evicted_trigger(key: &str) -> Option<&str> {
+    key.strip_prefix(TRIGGER_KEY_PREFIX)
+        .filter(|id| !id.is_empty() && !id.contains('/'))
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn trigger_row(id: &str) -> TriggerRow {
+        TriggerRow {
+            id: id.to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: "wf".to_string(),
+            enabled: true,
+            auth_mode: "token".to_string(),
+            max_body_bytes: 1024,
+            rate_limit_per_minute: 60,
+            created_by: "a@acme.io".to_string(),
+            created_at: 1,
+            updated_at: 1,
+            version: 1,
+            origin_cluster: "local".to_string(),
+            deleted_at: None,
+            last_invoked_at: None,
+            rejections: None,
+        }
+    }
+
+    fn cached(id: &str, fetched_at: Instant) -> Arc<CachedTrigger> {
+        Arc::new(CachedTrigger {
+            trigger: trigger_row(id),
+            credentials: vec![LiveCredential {
+                id: "c1".to_string(),
+                kind: CredentialKind::SigningSecret,
+                display_prefix: "whsec_abcd…wxyz".to_string(),
+                token_sha256: None,
+                signing_key: Some(b"key-material".to_vec()),
+                state: CredentialState::Active,
+                expires_at: None,
+            }],
+            fetched_at,
+        })
+    }
+
+    #[test]
+    fn an_entry_older_than_thirty_seconds_is_refetched() {
+        let t0 = Instant::now();
+        let mut map = HashMap::new();
+        map.insert("t1".to_string(), cached("t1", t0));
+        assert!(fresh(&map, "t1", t0 + Duration::from_secs(29)).is_some());
+        assert!(fresh(&map, "t1", t0 + TTL).is_none());
+        assert!(fresh(&map, "t2", t0).is_none());
+    }
+
+    #[tokio::test]
+    async fn an_invalidation_evicts_the_entry() {
+        CACHE
+            .write()
+            .await
+            .insert("t-evict".to_string(), cached("t-evict", Instant::now()));
+        let key = format!("{TRIGGER_KEY_PREFIX}t-evict");
+        let trigger_id = evicted_trigger(&key).unwrap();
+        invalidate(trigger_id).await;
+        assert!(!CACHE.read().await.contains_key("t-evict"));
+        assert_eq!(evicted_trigger("/workflow_http_trigger/a/b"), None);
+        assert_eq!(evicted_trigger("/other/t1"), None);
+    }
+
+    #[tokio::test]
+    async fn a_revoke_during_a_load_is_honoured_on_the_next_request() {
+        let id = "t-revoke-race";
+        let stale = get_or_load(id, || async {
+            invalidate(id).await;
+            Ok(Some(CachedTrigger::clone(&cached(id, Instant::now()))))
+        })
+        .await
+        .unwrap();
+        assert!(
+            stale.is_some(),
+            "the caller in flight still gets its answer"
+        );
+        assert!(
+            !CACHE.read().await.contains_key(id),
+            "a load that overlapped an invalidation is not cached"
+        );
+        let reloads = std::sync::atomic::AtomicUsize::new(0);
+        let fresh = get_or_load(id, || async {
+            reloads.fetch_add(1, std::sync::atomic::Ordering::SeqCst);
+            Ok(None)
+        })
+        .await
+        .unwrap();
+        assert_eq!(reloads.into_inner(), 1, "the next request reloads");
+        assert!(fresh.is_none(), "and sees the revoke");
+    }
+
+    #[tokio::test]
+    async fn token_rows_never_decrypt() {
+        let row = CredentialRow {
+            id: "c-tok".to_string(),
+            trigger_id: "t1".to_string(),
+            org_id: "acme".to_string(),
+            kind: CredentialKind::Token.as_str().to_string(),
+            display_prefix: "o2wh_abcd…wxyz".to_string(),
+            token_sha256: Some("ab".repeat(32)),
+            secret_ref: Some("unresolvable-ref".to_string()),
+            state: CredentialState::Active.as_str().to_string(),
+            expires_at: None,
+            revoked_at: None,
+            created_by: "a@acme.io".to_string(),
+            created_at: 1,
+            updated_at: 1,
+            last_used_at: None,
+        };
+        let live = live_credential(&trigger_row("t1"), row, 10)
+            .await
+            .expect("a live token stays usable without its secret");
+        assert_eq!(live.signing_key, None);
+        assert_eq!(live.token_sha256, Some("ab".repeat(32)));
+    }
+
+    #[test]
+    fn cached_trigger_debug_omits_signing_keys() {
+        let printed = format!("{:?}", cached("t1", Instant::now()));
+        assert!(!printed.contains("key-material"));
+        assert!(!printed.contains("107, 101, 121"));
+        assert!(printed.contains("t1"));
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/credentials.rs b/src/core/src/workflows/http_trigger/credentials.rs
new file mode 100644
index 0000000000..04d866f658
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/credentials.rs
@@ -0,0 +1,361 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Minting and verifying the bearer tokens and signing secrets of HTTP triggers.
+
+use base64::{Engine, prelude::BASE64_STANDARD};
+use config::utils::str::constant_time_eq;
+use infra::{
+    secrets::{self, PreparedSecret, SecretError, SecretMaterial, SecretOwnerKind, SecretPurpose},
+    table::workflow_http_triggers::{CredentialKind, CredentialState, is_live},
+};
+use sha2::{Digest, Sha256};
+
+pub const TOKEN_PREFIX: &str = "o2wh_";
+pub const SECRET_PREFIX: &str = "whsec_";
+const TOKEN_CHARS: usize = 43;
+const TRIGGER_ID_CHARS: usize = 22;
+const SECRET_BYTES: usize = 32;
+const DISPLAY_CHARS: usize = 4;
+const BASE62: &[u8; 62] = b"0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz";
+// Compared against when the trigger is unknown, so a miss costs the same hash and compare.
+const DUMMY_SHA256: &str = "0000000000000000000000000000000000000000000000000000000000000000";
+
+#[derive(Clone)]
+pub struct MintedSecret {
+    pub plaintext: String,
+    pub display_prefix: String,
+    pub token_sha256: Option<String>,
+}
+
+impl std::fmt::Debug for MintedSecret {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("MintedSecret")
+            .field("plaintext", &"[REDACTED]")
+            .field("display_prefix", &self.display_prefix)
+            .field(
+                "token_sha256",
+                &self.token_sha256.as_ref().map(|_| "[REDACTED]"),
+            )
+            .finish()
+    }
+}
+
+#[derive(Clone)]
+pub struct LiveCredential {
+    pub id: String,
+    pub kind: CredentialKind,
+    pub display_prefix: String,
+    pub token_sha256: Option<String>,
+    pub signing_key: Option<Vec<u8>>,
+    pub state: CredentialState,
+    pub expires_at: Option<i64>,
+}
+
+impl LiveCredential {
+    pub fn is_live_at(&self, now_us: i64) -> bool {
+        is_live(self.state, self.expires_at, now_us)
+    }
+}
+
+impl std::fmt::Debug for LiveCredential {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("LiveCredential")
+            .field("id", &self.id)
+            .field("kind", &self.kind)
+            .field("display_prefix", &self.display_prefix)
+            .field(
+                "token_sha256",
+                &self.token_sha256.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field(
+                "signing_key",
+                &self.signing_key.as_ref().map(|_| "[REDACTED]"),
+            )
+            .field("state", &self.state)
+            .field("expires_at", &self.expires_at)
+            .finish()
+    }
+}
+
+pub fn new_trigger_id() -> String {
+    base62_random(TRIGGER_ID_CHARS)
+}
+
+pub fn mint_token() -> MintedSecret {
+    let plaintext = format!("{TOKEN_PREFIX}{}", base62_random(TOKEN_CHARS));
+    MintedSecret {
+        display_prefix: display_prefix(&plaintext),
+        token_sha256: Some(sha256_hex(&plaintext)),
+        plaintext,
+    }
+}
+
+pub fn mint_signing_secret() -> MintedSecret {
+    let key = config::utils::rand::random_bytes(SECRET_BYTES);
+    let plaintext = format!("{SECRET_PREFIX}{}", BASE64_STANDARD.encode(key));
+    MintedSecret {
+        display_prefix: display_prefix(&plaintext),
+        token_sha256: None,
+        plaintext,
+    }
+}
+
+pub fn secret_purpose(kind: CredentialKind) -> SecretPurpose {
+    match kind {
+        CredentialKind::Token => SecretPurpose::Auth,
+        CredentialKind::SigningSecret => SecretPurpose::Signing,
+    }
+}
+
+/// Encrypts a minted credential under the org DEK; call before `begin`, as `get_dek` may write.
+pub async fn prepare_secret(
+    org_id: &str,
+    credential_id: &str,
+    kind: CredentialKind,
+    minted: &MintedSecret,
+) -> Result<PreparedSecret, SecretError> {
+    secrets::prepare_create(
+        org_id,
+        SecretOwnerKind::WorkflowTrigger,
+        credential_id,
+        secret_purpose(kind),
+        None,
+        secret_material(minted),
+    )
+    .await
+}
+
+pub fn display_prefix(plaintext: &str) -> String {
+    let (prefix, random) = [TOKEN_PREFIX, SECRET_PREFIX]
+        .into_iter()
+        .find_map(|p| plaintext.strip_prefix(p).map(|rest| (p, rest)))
+        .unwrap_or(("", plaintext));
+    let chars: Vec<char> = random.chars().collect();
+    let head: String = chars.iter().take(DISPLAY_CHARS).collect();
+    let tail: String = chars[chars.len().saturating_sub(DISPLAY_CHARS)..]
+        .iter()
+        .collect();
+    format!("{prefix}{head}…{tail}")
+}
+
+pub fn sha256_hex(value: &str) -> String {
+    sha256_hex_bytes(value.as_bytes())
+}
+
+pub fn sha256_hex_bytes(value: &[u8]) -> String {
+    format!("{:x}", Sha256::digest(value))
+}
+
+pub fn verify_token<'a>(
+    presented: &str,
+    credentials: &'a [LiveCredential],
+    now_us: i64,
+) -> Option<&'a LiveCredential> {
+    verify_token_with(presented, credentials, now_us, constant_time_eq)
+}
+
+pub fn dummy_token_check(presented: &str) {
+    let hash = sha256_hex(presented);
+    std::hint::black_box(constant_time_eq(hash.as_bytes(), DUMMY_SHA256.as_bytes()));
+}
+
+/// Compares against every live token without an early exit, so the match position does not leak.
+fn verify_token_with<'a>(
+    presented: &str,
+    credentials: &'a [LiveCredential],
+    now_us: i64,
+    mut eq: impl FnMut(&[u8], &[u8]) -> bool,
+) -> Option<&'a LiveCredential> {
+    let hash = sha256_hex(presented);
+    let mut found = None;
+    for credential in credentials
+        .iter()
+        .filter(|c| c.kind == CredentialKind::Token && c.is_live_at(now_us))
+    {
+        let Some(stored) = credential.token_sha256.as_deref() else {
+            continue;
+        };
+        if eq(hash.as_bytes(), stored.as_bytes()) && found.is_none() {
+            found = Some(credential);
+        }
+    }
+    found
+}
+
+fn secret_material(minted: &MintedSecret) -> SecretMaterial {
+    SecretMaterial::Token {
+        value: minted.plaintext.clone(),
+    }
+}
+
+/// Rejection sampling keeps every character equally likely: 248 is the largest multiple of 62.
+fn base62_random(len: usize) -> String {
+    let mut out = String::with_capacity(len);
+    while out.len() < len {
+        for byte in config::utils::rand::random_bytes(len * 2) {
+            if byte < 248 && out.len() < len {
+                out.push(BASE62[usize::from(byte % 62)] as char);
+            }
+        }
+    }
+    out
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    fn token_credential(id: &str, token: &str, state: CredentialState) -> LiveCredential {
+        LiveCredential {
+            id: id.to_string(),
+            kind: CredentialKind::Token,
+            display_prefix: display_prefix(token),
+            token_sha256: Some(sha256_hex(token)),
+            signing_key: None,
+            state,
+            expires_at: None,
+        }
+    }
+
+    #[test]
+    fn a_minted_token_has_the_prefix_and_256_bits() {
+        let minted = mint_token();
+        let random = minted.plaintext.strip_prefix(TOKEN_PREFIX).unwrap();
+        assert_eq!(random.len(), TOKEN_CHARS);
+        assert!(random.bytes().all(|b| BASE62.contains(&b)));
+        assert!(
+            TOKEN_CHARS as f64 * 62f64.log2() >= 256.0,
+            "43 base62 characters carry at least 256 bits"
+        );
+        assert_ne!(mint_token().plaintext, minted.plaintext);
+    }
+
+    #[test]
+    fn a_minted_token_carries_its_hash_and_its_plaintext_for_encryption() {
+        let minted = mint_token();
+        let hash = minted.token_sha256.clone().unwrap();
+        assert_eq!(hash, sha256_hex(&minted.plaintext));
+        assert_eq!(hash.len(), 64);
+        assert!(!hash.contains(&minted.plaintext[TOKEN_PREFIX.len()..]));
+        assert_eq!(
+            sha256_hex("abc"),
+            "ba7816bf8f01cfea414140de5dae2223b00361a396177a9cb410ff61f20015ad"
+        );
+        assert!(matches!(
+            secret_material(&minted),
+            SecretMaterial::Token { value } if value == minted.plaintext
+        ));
+    }
+
+    #[test]
+    fn secret_purpose_is_auth_for_tokens_and_signing_for_secrets() {
+        assert_eq!(secret_purpose(CredentialKind::Token), SecretPurpose::Auth);
+        assert_eq!(
+            secret_purpose(CredentialKind::SigningSecret),
+            SecretPurpose::Signing
+        );
+    }
+
+    #[test]
+    fn the_display_prefix_shows_four_and_four() {
+        assert_eq!(
+            display_prefix("o2wh_ABCDefghijklmnopWXYZ"),
+            "o2wh_ABCD…WXYZ"
+        );
+        assert_eq!(
+            display_prefix("whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw"),
+            "whsec_MfKQ…LaSw"
+        );
+        let minted = mint_token();
+        assert_eq!(minted.display_prefix, display_prefix(&minted.plaintext));
+    }
+
+    #[test]
+    fn a_signing_secret_is_standard_base64_of_32_bytes() {
+        let minted = mint_signing_secret();
+        let encoded = minted.plaintext.strip_prefix(SECRET_PREFIX).unwrap();
+        assert_eq!(BASE64_STANDARD.decode(encoded).unwrap().len(), 32);
+        assert!(minted.token_sha256.is_none());
+        assert_eq!(minted.display_prefix, display_prefix(&minted.plaintext));
+    }
+
+    #[test]
+    fn a_trigger_id_is_22_base62_characters() {
+        let id = new_trigger_id();
+        assert_eq!(id.len(), TRIGGER_ID_CHARS);
+        assert!(id.bytes().all(|b| BASE62.contains(&b)));
+    }
+
+    #[test]
+    fn verify_checks_every_live_credential() {
+        let creds = vec![
+            token_credential("a", "o2wh_first", CredentialState::Active),
+            token_credential("b", "o2wh_second", CredentialState::Retiring),
+            token_credential("c", "o2wh_third", CredentialState::Revoked),
+        ];
+        let mut compared = 0;
+        let found = verify_token_with("o2wh_first", &creds, 10, |a, b| {
+            compared += 1;
+            constant_time_eq(a, b)
+        });
+        assert_eq!(found.map(|c| c.id.as_str()), Some("a"));
+        assert_eq!(
+            compared, 2,
+            "every live credential is compared, the match too"
+        );
+        assert_eq!(
+            verify_token("o2wh_second", &creds, 10).map(|c| c.id.as_str()),
+            Some("b")
+        );
+        assert!(verify_token("o2wh_third", &creds, 10).is_none());
+        assert!(verify_token("o2wh_other", &creds, 10).is_none());
+    }
+
+    #[test]
+    fn an_expired_retiring_token_does_not_verify() {
+        let mut retiring = token_credential("b", "o2wh_second", CredentialState::Retiring);
+        retiring.expires_at = Some(5);
+        let creds = [retiring];
+        assert!(verify_token("o2wh_second", &creds, 4).is_some());
+        assert!(verify_token("o2wh_second", &creds, 5).is_none());
+    }
+
+    #[test]
+    fn a_missing_trigger_still_hashes_the_token() {
+        dummy_token_check("o2wh_anything");
+        dummy_token_check("");
+    }
+
+    #[test]
+    fn minted_secret_debug_is_redacted() {
+        let minted = mint_token();
+        let printed = format!("{minted:?}");
+        assert!(!printed.contains(&minted.plaintext));
+        assert!(!printed.contains(minted.token_sha256.as_deref().unwrap()));
+        assert!(printed.contains(&minted.display_prefix));
+    }
+
+    #[test]
+    fn live_credential_debug_omits_key_material() {
+        let mut cred = token_credential("a", "o2wh_first", CredentialState::Active);
+        cred.signing_key = Some(b"super-secret-key".to_vec());
+        let printed = format!("{cred:?}");
+        assert!(!printed.contains(cred.token_sha256.as_deref().unwrap()));
+        assert!(!printed.contains("115, 117, 112"));
+        assert!(!printed.contains("super-secret-key"));
+        assert!(printed.contains("\"a\""));
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/enqueue.rs b/src/core/src/workflows/http_trigger/enqueue.rs
new file mode 100644
index 0000000000..7581d6c61b
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/enqueue.rs
@@ -0,0 +1,581 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Accepting a hook run: idempotency, queue capacity, the ledger write and its audit event.
+
+use std::time::Duration;
+
+use config::utils::time::now_micros;
+use infra::{
+    db::get_orm_client_rw,
+    table::{
+        entity::workflow_http_trigger_requests::Model as LedgerRow,
+        workflow_http_trigger_requests::{
+            self as ledger, HookRunStatus, LedgerInsert, NewHookRequest,
+        },
+    },
+};
+use o2_enterprise::enterprise::common::auditor::{AuditMessage, Protocol, ResponseMeta};
+use sea_orm::TransactionTrait;
+
+use super::{HookReason, payload::HookInput, wake};
+
+// Finished runs averaged for the predicted queue wait.
+const MEAN_RUN_SAMPLE: u64 = 20;
+const MAX_REISSUES: usize = 2;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum EnqueueOutcome {
+    Accepted {
+        run_id: String,
+    },
+    Replayed {
+        run_id: String,
+        status: HookRunStatus,
+    },
+}
+
+#[derive(Clone, Debug)]
+pub struct EnqueueRequest {
+    pub request: NewHookRequest,
+    pub input: HookInput,
+}
+
+enum Replay {
+    Reissue,
+    Same(EnqueueOutcome),
+}
+
+pub fn status_url(org_id: &str, trigger_id: &str, run_id: &str) -> String {
+    let cfg = config::get_config();
+    status_url_for(
+        &cfg.common.web_url,
+        &cfg.common.base_uri,
+        org_id,
+        trigger_id,
+        run_id,
+    )
+}
+
+pub fn predicted_wait_exceeds_ttl(
+    org_queued: u64,
+    org_concurrency: u64,
+    mean_run_secs: f64,
+    ttl: Duration,
+) -> bool {
+    let wait_secs = org_queued as f64 / org_concurrency.max(1) as f64 * mean_run_secs;
+    wait_secs > ttl.as_secs_f64()
+}
+
+pub fn hook_audit_message(
+    org_id: &str,
+    trigger_id: &str,
+    path: &str,
+    code: u16,
+    body: serde_json::Value,
+) -> AuditMessage {
+    let path = path.split_once('?').map_or(path, |(path, _)| path);
+    AuditMessage {
+        user_email: format!("hook:{trigger_id}"),
+        org_id: org_id.to_string(),
+        _timestamp: now_micros(),
+        protocol: Protocol::Http,
+        response_meta: ResponseMeta {
+            http_method: "POST".to_string(),
+            http_path: path.to_string(),
+            http_query_params: String::new(),
+            http_body: body.to_string(),
+            http_response_code: code,
+            error_msg: None,
+            trace_id: None,
+        },
+        delegated: None,
+        fleet_id: None,
+        target: None,
+    }
+}
+
+/// The explicit reveal event; `path` is stored in the `audited_path` form `{org}/workflows/…`.
+pub fn reveal_audit_message(
+    org_id: &str,
+    user_email: &str,
+    path: &str,
+    body: serde_json::Value,
+) -> AuditMessage {
+    let path = path.split_once('?').map_or(path, |(path, _)| path);
+    AuditMessage {
+        user_email: user_email.to_string(),
+        org_id: org_id.to_string(),
+        _timestamp: now_micros(),
+        protocol: Protocol::Http,
+        response_meta: ResponseMeta {
+            http_method: "GET".to_string(),
+            http_path: path.strip_prefix('/').unwrap_or(path).to_string(),
+            http_query_params: String::new(),
+            http_body: body.to_string(),
+            http_response_code: 200,
+            error_msg: None,
+            trace_id: None,
+        },
+        delegated: None,
+        fleet_id: None,
+        target: None,
+    }
+}
+
+pub fn accepted_audit_body(
+    run_id: &str,
+    credential_prefix: &str,
+    caller_ip: &str,
+    idempotent_replay: bool,
+) -> serde_json::Value {
+    serde_json::json!({
+        "run_id": run_id,
+        "credential_prefix": credential_prefix,
+        "caller_ip": caller_ip,
+        "idempotent_replay": idempotent_replay,
+    })
+}
+
+pub fn dry_run_audit_body(credential_prefix: &str, caller_ip: &str) -> serde_json::Value {
+    serde_json::json!({
+        "dry_run": true,
+        "credential_prefix": credential_prefix,
+        "caller_ip": caller_ip,
+    })
+}
+
+pub fn reveal_audit_body(
+    workflow_id: &str,
+    trigger_id: &str,
+    credential_id: &str,
+    credential_prefix: &str,
+    kind: &str,
+    state: &str,
+) -> serde_json::Value {
+    serde_json::json!({
+        "event": "credential_revealed",
+        "workflow_id": workflow_id,
+        "trigger_id": trigger_id,
+        "credential_id": credential_id,
+        "credential_prefix": credential_prefix,
+        "kind": kind,
+        "state": state,
+    })
+}
+
+/// The hook bypasses `audit_middleware`, so it applies the same `audit_enabled` gate itself.
+pub fn audit_gate(enabled: bool, message: impl FnOnce() -> AuditMessage) -> Option<AuditMessage> {
+    enabled.then(message)
+}
+
+pub async fn write_audit(message: impl FnOnce() -> AuditMessage) {
+    let enabled = o2_enterprise::enterprise::common::config::get_config()
+        .common
+        .audit_enabled;
+    if let Some(message) = audit_gate(enabled, message) {
+        audit::audit(message).await;
+    }
+}
+
+pub async fn check_queue_capacity(org_id: &str) -> Result<(), HookReason> {
+    let limit = &config::get_config().limit;
+    let db = get_orm_client_rw().await;
+    let queued = ledger::count_queued_for_org(db, org_id)
+        .await
+        .map_err(internal("queue count"))?;
+    if queued >= limit.workflow_hook_org_queue_max {
+        return Err(HookReason::QueueFull);
+    }
+    let mean = ledger::recent_mean_run_secs(db, org_id, MEAN_RUN_SAMPLE)
+        .await
+        .map_err(internal("mean run time"))?
+        .unwrap_or_default();
+    let ttl = Duration::from_secs(limit.workflow_hook_queue_ttl_secs);
+    if predicted_wait_exceeds_ttl(queued, limit.workflow_hook_org_concurrency, mean, ttl) {
+        return Err(HookReason::QueueFull);
+    }
+    Ok(())
+}
+
+pub async fn enqueue_run(req: EnqueueRequest) -> Result<EnqueueOutcome, HookReason> {
+    let queue_max = config::get_config().limit.workflow_hook_org_queue_max;
+    let outcome = enqueue_in(get_orm_client_rw().await, req, queue_max).await?;
+    if matches!(outcome, EnqueueOutcome::Accepted { .. }) {
+        wake::request_wake();
+    }
+    Ok(outcome)
+}
+
+pub async fn replay_or_conflict(
+    trigger_id: &str,
+    idem_key: &str,
+    body_sha256: &str,
+) -> Result<Option<EnqueueOutcome>, HookReason> {
+    let existing = ledger::find_by_idem_key(get_orm_client_rw().await, trigger_id, idem_key)
+        .await
+        .map_err(internal("idempotency lookup"))?;
+    match existing {
+        None => Ok(None),
+        Some(row) => match replay_decision(&row, body_sha256)? {
+            Replay::Reissue => Ok(None),
+            Replay::Same(outcome) => Ok(Some(outcome)),
+        },
+    }
+}
+
+/// One capped transaction per attempt; a lost key race re-reads the winner as a replay.
+async fn enqueue_in<C: TransactionTrait>(
+    db: &C,
+    req: EnqueueRequest,
+    queue_max: u64,
+) -> Result<EnqueueOutcome, HookReason> {
+    let payload = serde_json::to_string(&req.input).map_err(|e| {
+        log::error!("[WORKFLOW_HOOK] run input does not serialise: {e}");
+        HookReason::InternalError
+    })?;
+    let run_id = req.request.run_id.clone();
+    let body_sha256 = req.request.body_sha256.clone();
+    let mut expired_id = None;
+    for _ in 0..=MAX_REISSUES {
+        let written = ledger::enqueue_capped(
+            db,
+            expired_id,
+            req.request.clone(),
+            payload.clone(),
+            queue_max,
+        )
+        .await;
+        let winner = match written.map_err(internal("enqueue"))? {
+            LedgerInsert::Inserted => return Ok(EnqueueOutcome::Accepted { run_id }),
+            LedgerInsert::KeyTaken(winner) => winner,
+            LedgerInsert::QueueFull => return Err(HookReason::QueueFull),
+        };
+        match replay_decision(&winner, &body_sha256)? {
+            Replay::Same(outcome) => return Ok(outcome),
+            Replay::Reissue => expired_id = Some(winner.id),
+        }
+    }
+    log::error!("[WORKFLOW_HOOK] idempotency key of run {run_id} kept changing hands");
+    Err(HookReason::InternalError)
+}
+
+/// Only an original that never ran is replaced; any other state answers with its own run.
+fn replay_decision(row: &LedgerRow, body_sha256: &str) -> Result<Replay, HookReason> {
+    if row.body_sha256 != body_sha256 {
+        return Err(HookReason::IdempotencyKeyReused);
+    }
+    let Some(status) = HookRunStatus::parse(&row.status) else {
+        log::error!(
+            "[WORKFLOW_HOOK] ledger row {} has status {:?}",
+            row.id,
+            row.status
+        );
+        return Err(HookReason::InternalError);
+    };
+    if status == HookRunStatus::Expired {
+        return Ok(Replay::Reissue);
+    }
+    Ok(Replay::Same(EnqueueOutcome::Replayed {
+        run_id: row.run_id.clone(),
+        status,
+    }))
+}
+
+fn status_url_for(
+    web_url: &str,
+    base_uri: &str,
+    org_id: &str,
+    trigger_id: &str,
+    run_id: &str,
+) -> String {
+    format!(
+        "{}{}/api/v2/{org_id}/workflows/hooks/{trigger_id}/runs/{run_id}",
+        web_url.trim_end_matches('/'),
+        base_uri.trim_end_matches('/'),
+    )
+}
+
+fn internal(what: &'static str) -> impl Fn(sea_orm::DbErr) -> HookReason {
+    move |e| {
+        log::error!("[WORKFLOW_HOOK] {what} failed: {e}");
+        HookReason::InternalError
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use sea_orm::Database;
+
+    use super::{super::payload::build_input, *};
+
+    const NO_CAP: u64 = u64::MAX;
+
+    async fn ledger_db() -> sea_orm::DatabaseConnection {
+        let db = Database::connect("sqlite::memory:").await.unwrap();
+        ledger::create_tables_for_tests(&db).await.unwrap();
+        db
+    }
+
+    fn request(run_id: &str, idem_key: Option<&str>, body_sha256: &str) -> EnqueueRequest {
+        let input = build_input("t1", run_id, 10, &http::HeaderMap::new(), None, b"[1]");
+        EnqueueRequest {
+            request: NewHookRequest {
+                trigger_id: "t1".to_string(),
+                org_id: "acme".to_string(),
+                workflow_id: "wf".to_string(),
+                run_id: run_id.to_string(),
+                idem_key: idem_key.map(str::to_string),
+                body_sha256: body_sha256.to_string(),
+                body_bytes: 3,
+                content_type: None,
+                meta: serde_json::to_string(&input.meta).unwrap(),
+                credential_id: "c1".to_string(),
+                credential_prefix: "o2wh_abcd…wxyz".to_string(),
+                caller_ip: "203.0.113.7".to_string(),
+                received_at: 10,
+            },
+            input,
+        }
+    }
+
+    #[test]
+    fn status_url_is_absolute_with_base_uri() {
+        assert_eq!(
+            status_url_for("https://o2.example.com/", "/o2", "acme", "t1", "r1"),
+            "https://o2.example.com/o2/api/v2/acme/workflows/hooks/t1/runs/r1"
+        );
+        assert_eq!(
+            status_url_for("http://localhost:5080", "", "acme", "t1", "r1"),
+            "http://localhost:5080/api/v2/acme/workflows/hooks/t1/runs/r1"
+        );
+        assert_eq!(
+            status_url_for("http://h", "/", "acme", "t1", "r1"),
+            "http://h/api/v2/acme/workflows/hooks/t1/runs/r1"
+        );
+    }
+
+    #[test]
+    fn predicted_wait_over_ttl_is_queue_full() {
+        let ttl = Duration::from_secs(3600);
+        assert!(!predicted_wait_exceeds_ttl(10, 2, 60.0, ttl));
+        assert!(predicted_wait_exceeds_ttl(200, 2, 60.0, ttl));
+        assert!(
+            !predicted_wait_exceeds_ttl(120, 2, 60.0, ttl),
+            "exactly the TTL still fits"
+        );
+        assert!(
+            !predicted_wait_exceeds_ttl(500, 2, 0.0, ttl),
+            "no finished runs yet"
+        );
+        assert!(
+            predicted_wait_exceeds_ttl(61, 0, 60.0, ttl),
+            "zero concurrency counts as one"
+        );
+    }
+
+    #[test]
+    fn accepted_audit_has_no_query_and_names_the_hook() {
+        let body = accepted_audit_body("r1", "o2wh_abcd…wxyz", "203.0.113.7", false);
+        let message = hook_audit_message(
+            "acme",
+            "t1",
+            "/api/v2/acme/workflows/hooks/t1?token=o2wh_leak",
+            202,
+            body.clone(),
+        );
+        assert_eq!(message.user_email, "hook:t1");
+        assert_eq!(message.org_id, "acme");
+        assert_eq!(
+            message.response_meta.http_path,
+            "/api/v2/acme/workflows/hooks/t1"
+        );
+        assert_eq!(message.response_meta.http_query_params, "");
+        assert_eq!(message.response_meta.http_response_code, 202);
+        assert_eq!(message.response_meta.http_method, "POST");
+        let stored: serde_json::Value =
+            serde_json::from_str(&message.response_meta.http_body).unwrap();
+        assert_eq!(stored, body);
+        assert_eq!(
+            stored["idempotent_replay"], false,
+            "the body names the run, the credential prefix and the caller"
+        );
+    }
+
+    #[test]
+    fn dry_run_audit_is_marked() {
+        let body = dry_run_audit_body("o2wh_abcd…wxyz", "203.0.113.7");
+        assert_eq!(body["dry_run"], true);
+        let message = hook_audit_message("acme", "t1", "/p", 200, body);
+        assert_eq!(message.response_meta.http_response_code, 200);
+    }
+
+    #[test]
+    fn reveal_audit_message_never_carries_the_value() {
+        let secret = "o2wh_c2VjcmV0LXRva2VuLXZhbHVlLW5ldmVyLWF1ZGl0ZWQ";
+        let body = reveal_audit_body("wf-1", "t1", "c1", "o2wh_c2Vj…ZWQ", "token", "retiring");
+        let message = reveal_audit_message(
+            "acme",
+            "u@acme.io",
+            "/acme/workflows/wf-1/http_trigger/credentials/c1/secret?show=1",
+            body,
+        );
+        assert_eq!(
+            (message.user_email.as_str(), message.org_id.as_str()),
+            ("u@acme.io", "acme")
+        );
+        let meta = &message.response_meta;
+        assert_eq!(
+            (meta.http_method.as_str(), meta.http_response_code),
+            ("GET", 200)
+        );
+        assert_eq!(
+            meta.http_path,
+            "acme/workflows/wf-1/http_trigger/credentials/c1/secret"
+        );
+        assert_eq!(meta.http_query_params, "");
+        let audited: serde_json::Value = serde_json::from_str(&meta.http_body).unwrap();
+        assert_eq!(
+            audited,
+            serde_json::json!({
+                "event": "credential_revealed",
+                "workflow_id": "wf-1",
+                "trigger_id": "t1",
+                "credential_id": "c1",
+                "credential_prefix": "o2wh_c2Vj…ZWQ",
+                "kind": "token",
+                "state": "retiring",
+            })
+        );
+        let printed = format!("{message:?}");
+        assert!(!printed.contains(secret), "{printed}");
+        assert!(!printed.contains(&secret[9..]), "{printed}");
+    }
+
+    #[test]
+    fn no_audit_when_disabled() {
+        let build = || hook_audit_message("acme", "t1", "/p", 202, serde_json::json!({}));
+        assert!(audit_gate(false, build).is_none());
+        assert!(audit_gate(true, build).is_some());
+    }
+
+    #[tokio::test]
+    async fn a_db_error_before_commit_maps_to_internal_error() {
+        let db = Database::connect("sqlite::memory:").await.unwrap();
+        assert_eq!(
+            enqueue_in(&db, request("r1", None, "h1"), NO_CAP).await,
+            Err(HookReason::InternalError)
+        );
+    }
+
+    #[tokio::test]
+    async fn an_accepted_run_stores_the_whole_step_input() {
+        let db = ledger_db().await;
+        let req = request("r1", None, "h1");
+        let expected = serde_json::to_value(&req.input).unwrap();
+        assert_eq!(
+            enqueue_in(&db, req, NO_CAP).await,
+            Ok(EnqueueOutcome::Accepted {
+                run_id: "r1".to_string()
+            })
+        );
+        let payload = ledger::read_payload(&db, "acme", "wf", "r1")
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            serde_json::from_str::<serde_json::Value>(&payload).unwrap(),
+            expected
+        );
+        let row = ledger::get_run(&db, "t1", "r1").await.unwrap().unwrap();
+        assert_eq!(row.status, "queued");
+    }
+
+    #[tokio::test]
+    async fn a_lost_key_race_answers_like_a_replay() {
+        let db = ledger_db().await;
+        enqueue_in(&db, request("r1", Some("k"), "h1"), NO_CAP)
+            .await
+            .unwrap();
+        assert_eq!(
+            enqueue_in(&db, request("r2", Some("k"), "h1"), NO_CAP).await,
+            Ok(EnqueueOutcome::Replayed {
+                run_id: "r1".to_string(),
+                status: HookRunStatus::Queued
+            })
+        );
+        assert_eq!(
+            enqueue_in(&db, request("r3", Some("k"), "h2"), NO_CAP).await,
+            Err(HookReason::IdempotencyKeyReused)
+        );
+    }
+
+    #[tokio::test]
+    async fn an_expired_original_is_reissued_as_a_new_run() {
+        let db = ledger_db().await;
+        enqueue_in(&db, request("r1", Some("k"), "h1"), NO_CAP)
+            .await
+            .unwrap();
+        let original = ledger::get_run(&db, "t1", "r1").await.unwrap().unwrap();
+        assert!(
+            ledger::finish_unclaimed(&db, original.id, HookRunStatus::Expired, None, 20)
+                .await
+                .unwrap()
+        );
+        assert_eq!(
+            replay_decision(
+                &ledger::get_run(&db, "t1", "r1").await.unwrap().unwrap(),
+                "h1"
+            )
+            .map(|d| matches!(d, Replay::Reissue)),
+            Ok(true)
+        );
+        assert_eq!(
+            enqueue_in(&db, request("r2", Some("k"), "h1"), NO_CAP).await,
+            Ok(EnqueueOutcome::Accepted {
+                run_id: "r2".to_string()
+            })
+        );
+        let old = ledger::get_run(&db, "t1", "r1").await.unwrap().unwrap();
+        assert_eq!(old.idem_key, None);
+    }
+
+    #[tokio::test]
+    async fn the_org_queue_cap_is_checked_by_the_enqueue_itself() {
+        let db = ledger_db().await;
+        assert!(matches!(
+            enqueue_in(&db, request("r1", None, "h1"), 1).await,
+            Ok(EnqueueOutcome::Accepted { .. })
+        ));
+        assert_eq!(
+            enqueue_in(&db, request("r2", None, "h2"), 1).await,
+            Err(HookReason::QueueFull)
+        );
+        assert!(ledger::get_run(&db, "t1", "r2").await.unwrap().is_none());
+    }
+
+    #[test]
+    fn enqueue_never_publishes_a_workflow_trigger() {
+        let src = include_str!("enqueue.rs");
+        let production = src.split("#[cfg(test)]").next().unwrap();
+        for forbidden in [
+            "send_workflow_trigger",
+            "/workflow_trigger/",
+            "get_coordinator",
+        ] {
+            assert!(!production.contains(forbidden), "{forbidden}");
+        }
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/manage.rs b/src/core/src/workflows/http_trigger/manage.rs
new file mode 100644
index 0000000000..cb5af3070c
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/manage.rs
@@ -0,0 +1,2064 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Manages a workflow HTTP endpoint and mints, rotates, revokes and reveals its credentials.
+
+use config::utils::time::now_micros;
+use infra::{
+    db::get_orm_client_rw,
+    secrets::{self, PreparedSecret, SecretError, SecretMaterial, SecretOwnerKind},
+    table::{
+        cipher,
+        entity::{
+            workflow_http_trigger_credentials as credentials,
+            workflow_http_trigger_requests as requests, workflow_http_triggers as triggers,
+        },
+        workflow_http_triggers::{
+            self as http_triggers, AuthMode, CredentialKind, CredentialState, is_live,
+        },
+    },
+};
+use o2_enterprise::enterprise::common::config::get_config as get_o2_config;
+use sea_orm::{
+    ColumnTrait, ConnectionTrait, DbErr, EntityTrait, IntoActiveModel, QueryFilter, QueryOrder,
+    Set, SqlErr, TransactionTrait, sea_query::Expr,
+};
+
+use super::{
+    DEFAULT_MAX_BODY_BYTES, DEFAULT_TRIGGER_RPM,
+    credentials::{self as minting, MintedSecret},
+    payload::{EVENT_TYPE, HookInput, HookMeta, TRIGGER_SOURCE},
+};
+
+pub const OVERLAPS: [i64; 4] = [0, 3600, 86400, 604800];
+pub const MIN_BODY_BYTES: i64 = 1024;
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct UpsertRequest {
+    pub enabled: bool,
+    pub auth_mode: AuthMode,
+    pub max_body_bytes: Option<i64>,
+    pub rate_limit_per_minute: Option<i32>,
+}
+
+#[derive(Debug)]
+pub enum UpsertOutcome {
+    Created {
+        config: TriggerView,
+        secret: MintedSecret,
+    },
+    Updated {
+        config: TriggerView,
+    },
+    ModeSwitched {
+        config: TriggerView,
+        secret: MintedSecret,
+    },
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, utoipa::ToSchema)]
+pub struct TriggerView {
+    pub id: String,
+    pub url: String,
+    pub region_host: Option<String>,
+    pub enabled: bool,
+    #[schema(value_type = String)]
+    pub auth_mode: AuthMode,
+    pub max_body_bytes: i64,
+    pub rate_limit_per_minute: i32,
+    pub org_rate_limit_per_minute: u32,
+    pub created_by: String,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub last_invoked_at: Option<i64>,
+    pub last_call: Option<LastCall>,
+    pub secrets_encrypted_at_rest: bool,
+    #[schema(value_type = Object)]
+    pub rejections: serde_json::Value,
+    pub credentials: Vec<CredentialView>,
+    pub permissions: EndpointPermissions,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, utoipa::ToSchema)]
+pub struct CredentialView {
+    pub id: String,
+    #[schema(value_type = String)]
+    pub kind: CredentialKind,
+    pub display_prefix: String,
+    #[schema(value_type = String)]
+    pub state: CredentialState,
+    pub expires_at: Option<i64>,
+    pub created_by: String,
+    pub creator_in_org: bool,
+    pub created_at: i64,
+    pub last_used_at: Option<i64>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, serde::Serialize, utoipa::ToSchema)]
+pub struct LastCall {
+    pub run_id: String,
+    pub status: String,
+    pub received_at: i64,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, utoipa::ToSchema)]
+pub struct EndpointPermissions {
+    pub edit: bool,
+    pub test: bool,
+    /// `edit && require_credential_access` would pass.
+    pub reveal: bool,
+}
+
+#[derive(Clone, PartialEq, Eq, serde::Serialize, utoipa::ToSchema)]
+pub struct RevealView {
+    pub id: String,
+    #[schema(value_type = String)]
+    pub kind: CredentialKind,
+    pub display_prefix: String,
+    #[schema(value_type = String)]
+    pub state: CredentialState,
+    pub expires_at: Option<i64>,
+    pub secret: String,
+}
+
+impl std::fmt::Debug for RevealView {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("RevealView")
+            .field("id", &self.id)
+            .field("kind", &self.kind)
+            .field("display_prefix", &self.display_prefix)
+            .field("state", &self.state)
+            .field("expires_at", &self.expires_at)
+            .field("secret", &"[REDACTED]")
+            .finish()
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub enum ManageError {
+    WorkflowNotFound,
+    NotConfigured,
+    InvalidLimit,
+    InvalidOverlap,
+    CredentialRetiring,
+    CredentialNotFound,
+    CredentialAccessRequired,
+    Internal(String),
+}
+
+impl From<DbErr> for ManageError {
+    fn from(e: DbErr) -> Self {
+        Self::Internal(e.to_string())
+    }
+}
+
+impl From<SecretError> for ManageError {
+    fn from(e: SecretError) -> Self {
+        Self::Internal(e.to_string())
+    }
+}
+
+/// The caller and clock of one locked write; the region named here takes over as origin.
+struct Writer<'a> {
+    org_id: &'a str,
+    workflow_id: &'a str,
+    user_id: &'a str,
+    local_cluster: &'a str,
+    now: i64,
+}
+
+/// A credential minted and encrypted before the transaction, inserted inside it.
+struct Mint {
+    credential_id: String,
+    kind: CredentialKind,
+    secret: MintedSecret,
+    prepared: PreparedSecret,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum WriteKind {
+    Created,
+    Updated,
+    Switched,
+}
+
+#[derive(Debug)]
+struct Written {
+    trigger_id: String,
+    kind: WriteKind,
+    secret: Option<MintedSecret>,
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum UpsertFail {
+    Manage(ManageError),
+    Raced,
+}
+
+impl From<ManageError> for UpsertFail {
+    fn from(e: ManageError) -> Self {
+        Self::Manage(e)
+    }
+}
+
+impl From<DbErr> for UpsertFail {
+    fn from(e: DbErr) -> Self {
+        Self::Manage(e.into())
+    }
+}
+
+impl From<SecretError> for UpsertFail {
+    fn from(e: SecretError) -> Self {
+        Self::Manage(e.into())
+    }
+}
+
+/// Omitted values default; a body over the 1 MiB cap or a rate over the org budget is refused.
+pub fn validate_limits(req: &UpsertRequest, org_budget: u32) -> Result<(i64, i32), ManageError> {
+    let max_body = req.max_body_bytes.unwrap_or(DEFAULT_MAX_BODY_BYTES);
+    if !(MIN_BODY_BYTES..=DEFAULT_MAX_BODY_BYTES).contains(&max_body) {
+        return Err(ManageError::InvalidLimit);
+    }
+    let budget = i32::try_from(org_budget).unwrap_or(i32::MAX);
+    let rpm = req
+        .rate_limit_per_minute
+        .unwrap_or(DEFAULT_TRIGGER_RPM.min(budget));
+    if !(1..=budget).contains(&rpm) {
+        return Err(ManageError::InvalidLimit);
+    }
+    Ok((max_body, rpm))
+}
+
+pub fn trigger_view(
+    trigger: &triggers::Model,
+    credentials: Vec<CredentialView>,
+    last_call: Option<LastCall>,
+    encrypting: bool,
+    permissions: EndpointPermissions,
+    org_budget: u32,
+) -> TriggerView {
+    TriggerView {
+        id: trigger.id.clone(),
+        url: invoke_url(&trigger.org_id, &trigger.id),
+        region_host: region_host(),
+        enabled: trigger.enabled,
+        auth_mode: AuthMode::parse(&trigger.auth_mode).unwrap_or(AuthMode::Token),
+        max_body_bytes: trigger.max_body_bytes,
+        rate_limit_per_minute: trigger.rate_limit_per_minute,
+        org_rate_limit_per_minute: org_budget,
+        created_by: trigger.created_by.clone(),
+        created_at: trigger.created_at,
+        updated_at: trigger.updated_at,
+        last_invoked_at: trigger.last_invoked_at,
+        last_call,
+        secrets_encrypted_at_rest: encrypting,
+        rejections: trigger
+            .rejections
+            .as_deref()
+            .and_then(|raw| serde_json::from_str(raw).ok())
+            .unwrap_or_else(|| serde_json::json!({})),
+        credentials,
+        permissions,
+    }
+}
+
+pub fn org_budget() -> u32 {
+    config::get_config().limit.workflow_hook_org_rpm
+}
+
+pub fn secrets_encrypted_at_rest() -> bool {
+    cipher::is_encrypting()
+}
+
+pub async fn get(
+    org_id: &str,
+    workflow_id: &str,
+    permissions: EndpointPermissions,
+) -> Result<TriggerView, ManageError> {
+    let db = get_orm_client_rw().await;
+    let trigger = live_trigger(db, org_id, workflow_id).await?;
+    let now = now_micros();
+    let mut views = Vec::new();
+    for row in http_triggers::list_credentials(db, &trigger.id).await? {
+        let in_org = crate::users::get_user(Some(org_id), &row.created_by)
+            .await
+            .is_some();
+        if let Some(view) = credential_view(&row, in_org, now) {
+            views.push(view);
+        }
+    }
+    let last_call = last_call_in(db, &trigger).await?;
+    Ok(trigger_view(
+        &trigger,
+        views,
+        last_call,
+        secrets_encrypted_at_rest(),
+        permissions,
+        org_budget(),
+    ))
+}
+
+pub async fn trigger_id(org_id: &str, workflow_id: &str) -> Result<String, ManageError> {
+    Ok(live_trigger(get_orm_client_rw().await, org_id, workflow_id)
+        .await?
+        .id)
+}
+
+pub async fn upsert(
+    org_id: &str,
+    workflow_id: &str,
+    req: UpsertRequest,
+    user_id: &str,
+    permissions: EndpointPermissions,
+    credential_access: bool,
+) -> Result<UpsertOutcome, ManageError> {
+    if !workflow_exists(org_id, workflow_id).await? {
+        return Err(ManageError::WorkflowNotFound);
+    }
+    let db = get_orm_client_rw().await;
+    let cluster = config::get_cluster_name();
+    let mut raced = false;
+    let written = loop {
+        let writer = writer(org_id, workflow_id, user_id, &cluster);
+        match upsert_in(db, &writer, &req, org_budget(), credential_access, prepare).await {
+            Ok(written) => break written,
+            Err(UpsertFail::Raced) if !raced => raced = true,
+            Err(UpsertFail::Raced) => {
+                return Err(ManageError::Internal(
+                    "the endpoint changed during the write, retry".to_string(),
+                ));
+            }
+            Err(UpsertFail::Manage(e)) => return Err(e),
+        }
+    };
+    emit_after_commit(&written.trigger_id).await;
+    let config = get(org_id, workflow_id, permissions).await?;
+    Ok(match (written.kind, written.secret) {
+        (WriteKind::Created, Some(secret)) => UpsertOutcome::Created { config, secret },
+        (WriteKind::Switched, Some(secret)) => UpsertOutcome::ModeSwitched { config, secret },
+        _ => UpsertOutcome::Updated { config },
+    })
+}
+
+pub async fn delete(org_id: &str, workflow_id: &str) -> Result<(), ManageError> {
+    let db = get_orm_client_rw().await;
+    let cluster = config::get_cluster_name();
+    let trigger_id = delete_in(db, &writer(org_id, workflow_id, "", &cluster)).await?;
+    emit_after_commit(&trigger_id).await;
+    Ok(())
+}
+
+pub async fn rotate(
+    org_id: &str,
+    workflow_id: &str,
+    overlap_seconds: i64,
+    user_id: &str,
+) -> Result<(CredentialView, MintedSecret), ManageError> {
+    let db = get_orm_client_rw().await;
+    let cluster = config::get_cluster_name();
+    let writer = writer(org_id, workflow_id, user_id, &cluster);
+    let (trigger_id, view, secret) = rotate_in(db, &writer, overlap_seconds, prepare).await?;
+    emit_after_commit(&trigger_id).await;
+    let in_org = crate::users::get_user(Some(org_id), user_id)
+        .await
+        .is_some();
+    Ok((
+        CredentialView {
+            creator_in_org: in_org,
+            ..view
+        },
+        secret,
+    ))
+}
+
+pub async fn revoke(
+    org_id: &str,
+    workflow_id: &str,
+    credential_id: &str,
+) -> Result<(), ManageError> {
+    let db = get_orm_client_rw().await;
+    let cluster = config::get_cluster_name();
+    let writer = writer(org_id, workflow_id, "", &cluster);
+    let trigger_id = revoke_in(db, &writer, credential_id).await?;
+    emit_after_commit(&trigger_id).await;
+    Ok(())
+}
+
+/// Decrypts a live credential, returned with the trigger id for the audit event.
+pub async fn reveal_secret(
+    org_id: &str,
+    workflow_id: &str,
+    credential_id: &str,
+) -> Result<(RevealView, String), ManageError> {
+    let db = get_orm_client_rw().await;
+    reveal_in(
+        db,
+        org_id,
+        workflow_id,
+        credential_id,
+        now_micros(),
+        resolve_secret,
+    )
+    .await
+}
+
+/// The test run gets the shape a real call gets, with an empty query and header map.
+pub fn hook_test_input(trigger_id: &str, data: Vec<serde_json::Value>) -> serde_json::Value {
+    let input = HookInput {
+        meta: HookMeta {
+            event_type: EVENT_TYPE,
+            trigger_source: TRIGGER_SOURCE,
+            trigger_id: trigger_id.to_string(),
+            run_id: config::ider::uuid(),
+            received_at: now_micros(),
+            query: serde_json::Map::new(),
+            headers: serde_json::Map::new(),
+        },
+        data,
+    };
+    serde_json::to_value(input).unwrap_or_default()
+}
+
+fn writer<'a>(
+    org_id: &'a str,
+    workflow_id: &'a str,
+    user_id: &'a str,
+    local_cluster: &'a str,
+) -> Writer<'a> {
+    Writer {
+        org_id,
+        workflow_id,
+        user_id,
+        local_cluster,
+        now: now_micros(),
+    }
+}
+
+fn invoke_url(org_id: &str, trigger_id: &str) -> String {
+    let cfg = config::get_config();
+    format!(
+        "{}{}/api/v2/{org_id}/workflows/hooks/{trigger_id}",
+        cfg.common.web_url.trim_end_matches('/'),
+        cfg.common.base_uri.trim_end_matches('/'),
+    )
+}
+
+/// Hooks run only in the accepting region, so a super-cluster caller must pin this host.
+fn region_host() -> Option<String> {
+    if !get_o2_config().super_cluster.enabled {
+        return None;
+    }
+    let web_url = &config::get_config().common.web_url;
+    url::Url::parse(web_url)
+        .ok()
+        .and_then(|url| url.host_str().map(str::to_string))
+}
+
+fn credential_view(
+    row: &credentials::Model,
+    creator_in_org: bool,
+    now: i64,
+) -> Option<CredentialView> {
+    let kind = CredentialKind::parse(&row.kind)?;
+    let state = CredentialState::parse(&row.state)?;
+    is_live(state, row.expires_at, now).then(|| CredentialView {
+        id: row.id.clone(),
+        kind,
+        display_prefix: row.display_prefix.clone(),
+        state,
+        expires_at: row.expires_at,
+        created_by: row.created_by.clone(),
+        creator_in_org,
+        created_at: row.created_at,
+        last_used_at: row.last_used_at,
+    })
+}
+
+async fn workflow_exists(org_id: &str, workflow_id: &str) -> Result<bool, ManageError> {
+    let internal = |e: anyhow::Error| ManageError::Internal(e.to_string());
+    if crate::workflows::get_workflow_by_id(org_id, workflow_id)
+        .await
+        .map_err(internal)?
+        .is_some()
+    {
+        return Ok(true);
+    }
+    Ok(crate::workflows::get_draft_by_id(org_id, workflow_id)
+        .await
+        .map_err(internal)?
+        .is_some())
+}
+
+async fn live_trigger<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+    workflow_id: &str,
+) -> Result<triggers::Model, ManageError> {
+    http_triggers::get_by_workflow(db, org_id, workflow_id)
+        .await?
+        .filter(|trigger| trigger.deleted_at.is_none())
+        .ok_or(ManageError::NotConfigured)
+}
+
+/// A revived trigger keeps its id, so runs from before its tombstone are not its last call.
+async fn last_call_in<C: ConnectionTrait>(
+    db: &C,
+    trigger: &triggers::Model,
+) -> Result<Option<LastCall>, ManageError> {
+    let newest = requests::Entity::find()
+        .filter(requests::Column::TriggerId.eq(&trigger.id))
+        .filter(requests::Column::ReceivedAt.gte(trigger.created_at))
+        .order_by_desc(requests::Column::ReceivedAt)
+        .order_by_desc(requests::Column::Id)
+        .one(db)
+        .await?;
+    Ok(newest.map(|row| LastCall {
+        run_id: row.run_id,
+        status: row.status,
+        received_at: row.received_at,
+    }))
+}
+
+async fn prepare(
+    org_id: String,
+    credential_id: String,
+    kind: CredentialKind,
+    minted: MintedSecret,
+) -> Result<PreparedSecret, SecretError> {
+    minting::prepare_secret(&org_id, &credential_id, kind, &minted).await
+}
+
+async fn resolve_secret(
+    org_id: String,
+    secret_ref: String,
+    credential_id: String,
+) -> Result<String, SecretError> {
+    let (_, material) = secrets::resolve_record(
+        &org_id,
+        &secret_ref,
+        SecretOwnerKind::WorkflowTrigger,
+        &credential_id,
+        secrets::CURRENT,
+    )
+    .await?;
+    match material {
+        SecretMaterial::Token { value } => Ok(value),
+        SecretMaterial::Basic { .. } => Err(SecretError::Malformed(
+            "workflow trigger secret is not token material".to_string(),
+        )),
+    }
+}
+
+/// Encrypts before `begin`: `prepare_create` may write the org DEK, and SQLite has one writer.
+async fn mint_for<P, F>(org_id: &str, mode: AuthMode, prepare: &P) -> Result<Mint, ManageError>
+where
+    P: Fn(String, String, CredentialKind, MintedSecret) -> F,
+    F: Future<Output = Result<PreparedSecret, SecretError>>,
+{
+    let kind = CredentialKind::for_mode(mode);
+    let secret = match kind {
+        CredentialKind::Token => minting::mint_token(),
+        CredentialKind::SigningSecret => minting::mint_signing_secret(),
+    };
+    let credential_id = config::ider::generate();
+    let prepared = prepare(
+        org_id.to_string(),
+        credential_id.clone(),
+        kind,
+        secret.clone(),
+    )
+    .await
+    .map_err(|e| {
+        log::error!("[WORKFLOW_HOOK] credential {credential_id} could not be stored: {e}");
+        ManageError::Internal("stored secrets are unavailable".to_string())
+    })?;
+    Ok(Mint {
+        credential_id,
+        kind,
+        secret,
+        prepared,
+    })
+}
+
+async fn upsert_in<C, P, F>(
+    db: &C,
+    writer: &Writer<'_>,
+    req: &UpsertRequest,
+    org_budget: u32,
+    credential_access: bool,
+    prepare: P,
+) -> Result<Written, UpsertFail>
+where
+    C: ConnectionTrait + TransactionTrait,
+    P: Fn(String, String, CredentialKind, MintedSecret) -> F,
+    F: Future<Output = Result<PreparedSecret, SecretError>>,
+{
+    let existing = http_triggers::get_by_workflow(db, writer.org_id, writer.workflow_id).await?;
+    let live = existing.as_ref().filter(|t| t.deleted_at.is_none());
+    let limits = validate_limits(&with_current_limits(req, live, org_budget), org_budget)?;
+    let switching = live.is_some_and(|t| t.auth_mode != req.auth_mode.as_str());
+    let mint = if live.is_none() || switching {
+        if !credential_access {
+            return Err(ManageError::CredentialAccessRequired.into());
+        }
+        Some(mint_for(writer.org_id, req.auth_mode, &prepare).await?)
+    } else {
+        None
+    };
+    let txn = db.begin().await?;
+    let written = match existing {
+        None => create_locked(&txn, writer, req, limits, mint).await,
+        Some(trigger) => change_locked(&txn, writer, req, limits, mint, &trigger).await,
+    };
+    match written {
+        Ok(written) => {
+            txn.commit().await?;
+            Ok(written)
+        }
+        Err(e) => {
+            txn.rollback().await?;
+            Err(e)
+        }
+    }
+}
+
+/// An omitted limit keeps the stored one, clamped to a budget that may have shrunk since.
+fn with_current_limits(
+    req: &UpsertRequest,
+    live: Option<&triggers::Model>,
+    org_budget: u32,
+) -> UpsertRequest {
+    let Some(trigger) = live else {
+        return req.clone();
+    };
+    let budget = i32::try_from(org_budget).unwrap_or(i32::MAX);
+    UpsertRequest {
+        max_body_bytes: req.max_body_bytes.or(Some(trigger.max_body_bytes)),
+        rate_limit_per_minute: req
+            .rate_limit_per_minute
+            .or(Some(trigger.rate_limit_per_minute.min(budget))),
+        ..req.clone()
+    }
+}
+
+async fn create_locked<C: ConnectionTrait>(
+    txn: &C,
+    writer: &Writer<'_>,
+    req: &UpsertRequest,
+    (max_body_bytes, rate_limit_per_minute): (i64, i32),
+    mint: Option<Mint>,
+) -> Result<Written, UpsertFail> {
+    let mint = mint.ok_or(UpsertFail::Raced)?;
+    let trigger_id = minting::new_trigger_id();
+    let row = triggers::Model {
+        id: trigger_id.clone(),
+        org_id: writer.org_id.to_string(),
+        workflow_id: writer.workflow_id.to_string(),
+        enabled: req.enabled,
+        auth_mode: req.auth_mode.as_str().to_string(),
+        max_body_bytes,
+        rate_limit_per_minute,
+        created_by: writer.user_id.to_string(),
+        created_at: writer.now,
+        updated_at: writer.now,
+        version: 1,
+        origin_cluster: writer.local_cluster.to_string(),
+        deleted_at: None,
+        last_invoked_at: None,
+        rejections: None,
+    };
+    if let Err(e) = http_triggers::insert_trigger(txn, row).await {
+        return Err(match e.sql_err() {
+            Some(SqlErr::UniqueConstraintViolation(_)) => UpsertFail::Raced,
+            _ => e.into(),
+        });
+    }
+    let secret = insert_minted(txn, writer, &trigger_id, mint).await?;
+    Ok(Written {
+        trigger_id,
+        kind: WriteKind::Created,
+        secret: Some(secret),
+    })
+}
+
+/// Re-checked under the row lock: the decision to mint was taken before `begin`.
+async fn change_locked<C: ConnectionTrait>(
+    txn: &C,
+    writer: &Writer<'_>,
+    req: &UpsertRequest,
+    (max_body_bytes, rate_limit_per_minute): (i64, i32),
+    mint: Option<Mint>,
+    seen: &triggers::Model,
+) -> Result<Written, UpsertFail> {
+    let locked = http_triggers::get_for_update(txn, &seen.id)
+        .await?
+        .ok_or(UpsertFail::Raced)?;
+    let revived = locked.deleted_at.is_some();
+    let switching = !revived && locked.auth_mode != req.auth_mode.as_str();
+    if locked.deleted_at != seen.deleted_at
+        || locked.auth_mode != seen.auth_mode
+        || (revived || switching) != mint.is_some()
+    {
+        return Err(UpsertFail::Raced);
+    }
+    if switching || revived {
+        revoke_all_in(txn, &locked, writer.now).await?;
+    }
+    let mut row = locked.clone().into_active_model();
+    row.enabled = Set(req.enabled);
+    row.auth_mode = Set(req.auth_mode.as_str().to_string());
+    row.max_body_bytes = Set(max_body_bytes);
+    row.rate_limit_per_minute = Set(rate_limit_per_minute);
+    row.updated_at = Set(writer.now);
+    row.version = Set(locked.version + 1);
+    row.origin_cluster = Set(writer.local_cluster.to_string());
+    if revived {
+        row.created_by = Set(writer.user_id.to_string());
+        row.created_at = Set(writer.now);
+        row.deleted_at = Set(None);
+        row.last_invoked_at = Set(None);
+        row.rejections = Set(None);
+    }
+    http_triggers::update_trigger(txn, row).await?;
+    let secret = match mint {
+        Some(mint) => Some(insert_minted(txn, writer, &locked.id, mint).await?),
+        None => None,
+    };
+    let kind = match (revived, switching) {
+        (true, _) => WriteKind::Created,
+        (false, true) => WriteKind::Switched,
+        (false, false) => WriteKind::Updated,
+    };
+    Ok(Written {
+        trigger_id: locked.id,
+        kind,
+        secret,
+    })
+}
+
+async fn insert_minted<C: ConnectionTrait>(
+    txn: &C,
+    writer: &Writer<'_>,
+    trigger_id: &str,
+    mint: Mint,
+) -> Result<MintedSecret, UpsertFail> {
+    let secret_ref = secrets::insert_prepared(txn, mint.prepared)
+        .await?
+        .metadata
+        .secret_ref;
+    http_triggers::insert_credential(
+        txn,
+        credentials::Model {
+            id: mint.credential_id,
+            trigger_id: trigger_id.to_string(),
+            org_id: writer.org_id.to_string(),
+            kind: mint.kind.as_str().to_string(),
+            display_prefix: mint.secret.display_prefix.clone(),
+            token_sha256: mint.secret.token_sha256.clone(),
+            secret_ref: Some(secret_ref),
+            state: CredentialState::Active.as_str().to_string(),
+            expires_at: None,
+            revoked_at: None,
+            created_by: writer.user_id.to_string(),
+            created_at: writer.now,
+            updated_at: writer.now,
+            last_used_at: None,
+        },
+    )
+    .await?;
+    Ok(mint.secret)
+}
+
+async fn revoke_all_in<C: ConnectionTrait>(
+    txn: &C,
+    trigger: &triggers::Model,
+    now: i64,
+) -> Result<(), DbErr> {
+    for credential in http_triggers::list_credentials(txn, &trigger.id).await? {
+        if credential.state != CredentialState::Revoked.as_str() {
+            revoke_credential_in(txn, &credential, now).await?;
+        }
+    }
+    Ok(())
+}
+
+/// The secret goes in the same transaction, through the transaction, so SQLite never deadlocks.
+async fn revoke_credential_in<C: ConnectionTrait>(
+    txn: &C,
+    credential: &credentials::Model,
+    now: i64,
+) -> Result<(), DbErr> {
+    secrets::delete_for_owner_in(
+        txn,
+        &credential.org_id,
+        SecretOwnerKind::WorkflowTrigger,
+        &credential.id,
+    )
+    .await
+    .map_err(|e| match e {
+        SecretError::Database(e) => e,
+        other => DbErr::Custom(other.to_string()),
+    })?;
+    credentials::Entity::update_many()
+        .col_expr(
+            credentials::Column::State,
+            Expr::value(CredentialState::Revoked.as_str()),
+        )
+        .col_expr(credentials::Column::RevokedAt, Expr::value(now))
+        .col_expr(credentials::Column::UpdatedAt, Expr::value(now))
+        .col_expr(
+            credentials::Column::SecretRef,
+            Expr::value(Option::<String>::None),
+        )
+        .filter(credentials::Column::Id.eq(&credential.id))
+        .exec(txn)
+        .await?;
+    Ok(())
+}
+
+/// Every locked write bumps `version` and names this region as origin, a no-op PUT included.
+async fn bump_in<C: ConnectionTrait>(
+    txn: &C,
+    trigger: &triggers::Model,
+    writer: &Writer<'_>,
+) -> Result<(), DbErr> {
+    triggers::Entity::update_many()
+        .col_expr(triggers::Column::Version, Expr::value(trigger.version + 1))
+        .col_expr(triggers::Column::UpdatedAt, Expr::value(writer.now))
+        .col_expr(
+            triggers::Column::OriginCluster,
+            Expr::value(writer.local_cluster),
+        )
+        .filter(triggers::Column::Id.eq(&trigger.id))
+        .exec(txn)
+        .await?;
+    Ok(())
+}
+
+/// Locks the workflow's live trigger, or answers `NotConfigured` after rolling back.
+async fn lock_live<C: ConnectionTrait>(
+    txn: &C,
+    writer: &Writer<'_>,
+) -> Result<triggers::Model, ManageError> {
+    let seen = live_trigger(txn, writer.org_id, writer.workflow_id).await?;
+    http_triggers::get_for_update(txn, &seen.id)
+        .await?
+        .filter(|trigger| trigger.deleted_at.is_none())
+        .ok_or(ManageError::NotConfigured)
+}
+
+async fn delete_in<C: ConnectionTrait + TransactionTrait>(
+    db: &C,
+    writer: &Writer<'_>,
+) -> Result<String, ManageError> {
+    let txn = db.begin().await?;
+    let trigger = match lock_live(&txn, writer).await {
+        Ok(trigger) => trigger,
+        Err(e) => {
+            txn.rollback().await?;
+            return Err(e);
+        }
+    };
+    http_triggers::tombstone_for_workflow(&txn, &trigger.workflow_id, writer.now)
+        .await
+        .map_err(|e| ManageError::Internal(e.to_string()))?;
+    triggers::Entity::update_many()
+        .col_expr(
+            triggers::Column::OriginCluster,
+            Expr::value(writer.local_cluster),
+        )
+        .filter(triggers::Column::Id.eq(&trigger.id))
+        .exec(&txn)
+        .await?;
+    txn.commit().await?;
+    Ok(trigger.id)
+}
+
+async fn rotate_in<C, P, F>(
+    db: &C,
+    writer: &Writer<'_>,
+    overlap_seconds: i64,
+    prepare: P,
+) -> Result<(String, CredentialView, MintedSecret), ManageError>
+where
+    C: ConnectionTrait + TransactionTrait,
+    P: Fn(String, String, CredentialKind, MintedSecret) -> F,
+    F: Future<Output = Result<PreparedSecret, SecretError>>,
+{
+    if !OVERLAPS.contains(&overlap_seconds) {
+        return Err(ManageError::InvalidOverlap);
+    }
+    let seen = live_trigger(db, writer.org_id, writer.workflow_id).await?;
+    let mode = AuthMode::parse(&seen.auth_mode)
+        .ok_or_else(|| ManageError::Internal(format!("unknown auth mode {}", seen.auth_mode)))?;
+    let mint = mint_for(writer.org_id, mode, &prepare).await?;
+    let txn = db.begin().await?;
+    match rotate_locked(&txn, writer, overlap_seconds, &seen, mint).await {
+        Ok(rotated) => {
+            txn.commit().await?;
+            Ok(rotated)
+        }
+        Err(e) => {
+            txn.rollback().await?;
+            Err(e)
+        }
+    }
+}
+
+/// Holds one active and at most one live retiring credential, so a second rotate is refused.
+async fn rotate_locked<C: ConnectionTrait>(
+    txn: &C,
+    writer: &Writer<'_>,
+    overlap_seconds: i64,
+    seen: &triggers::Model,
+    mint: Mint,
+) -> Result<(String, CredentialView, MintedSecret), ManageError> {
+    let trigger = lock_live(txn, writer).await?;
+    if trigger.id != seen.id || trigger.auth_mode != seen.auth_mode {
+        return Err(ManageError::Internal(
+            "the endpoint changed during the rotate, retry".to_string(),
+        ));
+    }
+    let now = writer.now;
+    let live: Vec<credentials::Model> = http_triggers::list_credentials(txn, &trigger.id)
+        .await?
+        .into_iter()
+        .filter(|c| row_is_live(c, now))
+        .collect();
+    let retiring = |c: &credentials::Model| c.state == CredentialState::Retiring.as_str();
+    // A revoked active credential leaves only the retiring one, and its replacement must be
+    // mintable.
+    if live.iter().any(retiring) && live.iter().any(|c| !retiring(c)) {
+        return Err(ManageError::CredentialRetiring);
+    }
+    let newest = live
+        .iter()
+        .filter(|c| !retiring(c))
+        .map(|c| c.created_at)
+        .max();
+    for credential in &live {
+        // It already carries its own expiry, which the caller chose on the earlier rotate.
+        if retiring(credential) {
+            continue;
+        }
+        let keep = overlap_seconds > 0 && Some(credential.created_at) == newest;
+        if keep {
+            retire_in(txn, credential, now + overlap_seconds * 1_000_000, now).await?;
+        } else {
+            revoke_credential_in(txn, credential, now).await?;
+        }
+    }
+    bump_in(txn, &trigger, writer).await?;
+    let credential_id = mint.credential_id.clone();
+    let kind = mint.kind;
+    let secret = insert_minted(txn, writer, &trigger.id, mint)
+        .await
+        .map_err(|e| match e {
+            UpsertFail::Manage(e) => e,
+            UpsertFail::Raced => ManageError::Internal("raced".to_string()),
+        })?;
+    let view = CredentialView {
+        id: credential_id,
+        kind,
+        display_prefix: secret.display_prefix.clone(),
+        state: CredentialState::Active,
+        expires_at: None,
+        created_by: writer.user_id.to_string(),
+        creator_in_org: true,
+        created_at: now,
+        last_used_at: None,
+    };
+    Ok((trigger.id, view, secret))
+}
+
+async fn retire_in<C: ConnectionTrait>(
+    txn: &C,
+    credential: &credentials::Model,
+    expires_at: i64,
+    now: i64,
+) -> Result<(), DbErr> {
+    credentials::Entity::update_many()
+        .col_expr(
+            credentials::Column::State,
+            Expr::value(CredentialState::Retiring.as_str()),
+        )
+        .col_expr(credentials::Column::ExpiresAt, Expr::value(expires_at))
+        .col_expr(credentials::Column::UpdatedAt, Expr::value(now))
+        .filter(credentials::Column::Id.eq(&credential.id))
+        .exec(txn)
+        .await?;
+    Ok(())
+}
+
+async fn revoke_in<C: ConnectionTrait + TransactionTrait>(
+    db: &C,
+    writer: &Writer<'_>,
+    credential_id: &str,
+) -> Result<String, ManageError> {
+    let txn = db.begin().await?;
+    match revoke_locked(&txn, writer, credential_id).await {
+        Ok(trigger_id) => {
+            txn.commit().await?;
+            Ok(trigger_id)
+        }
+        Err(e) => {
+            txn.rollback().await?;
+            Err(e)
+        }
+    }
+}
+
+async fn revoke_locked<C: ConnectionTrait>(
+    txn: &C,
+    writer: &Writer<'_>,
+    credential_id: &str,
+) -> Result<String, ManageError> {
+    let trigger = lock_live(txn, writer).await?;
+    let credential = http_triggers::list_credentials(txn, &trigger.id)
+        .await?
+        .into_iter()
+        .find(|c| c.id == credential_id && c.state != CredentialState::Revoked.as_str())
+        .ok_or(ManageError::CredentialNotFound)?;
+    revoke_credential_in(txn, &credential, writer.now).await?;
+    bump_in(txn, &trigger, writer).await?;
+    Ok(trigger.id)
+}
+
+/// An expired retiring credential is refused before the worker flips it to revoked.
+async fn reveal_in<C, R, F>(
+    db: &C,
+    org_id: &str,
+    workflow_id: &str,
+    credential_id: &str,
+    now: i64,
+    resolve: R,
+) -> Result<(RevealView, String), ManageError>
+where
+    C: ConnectionTrait,
+    R: Fn(String, String, String) -> F,
+    F: Future<Output = Result<String, SecretError>>,
+{
+    let trigger = live_trigger(db, org_id, workflow_id).await?;
+    let credential = http_triggers::list_credentials(db, &trigger.id)
+        .await?
+        .into_iter()
+        .find(|c| c.id == credential_id && row_is_live(c, now))
+        .ok_or(ManageError::CredentialNotFound)?;
+    let (Some(kind), Some(state)) = (
+        CredentialKind::parse(&credential.kind),
+        CredentialState::parse(&credential.state),
+    ) else {
+        return Err(ManageError::Internal(format!(
+            "credential {credential_id} is malformed"
+        )));
+    };
+    let Some(secret_ref) = credential.secret_ref.clone() else {
+        log::error!("[WORKFLOW_HOOK] credential {credential_id} has no stored secret");
+        return Err(ManageError::Internal(
+            "the secret is unavailable".to_string(),
+        ));
+    };
+    let secret = resolve(org_id.to_string(), secret_ref, credential.id.clone())
+        .await
+        .map_err(|e| {
+            log::error!("[WORKFLOW_HOOK] credential {credential_id} secret unreadable: {e}");
+            ManageError::Internal("the secret is unavailable".to_string())
+        })?;
+    Ok((
+        RevealView {
+            id: credential.id,
+            kind,
+            display_prefix: credential.display_prefix,
+            state,
+            expires_at: credential.expires_at,
+            secret,
+        },
+        trigger.id,
+    ))
+}
+
+fn row_is_live(credential: &credentials::Model, now: i64) -> bool {
+    CredentialState::parse(&credential.state)
+        .is_some_and(|state| is_live(state, credential.expires_at, now))
+}
+
+/// The local change is committed, so a failed emit is logged and healed by anti-entropy.
+async fn emit_after_commit(trigger_id: &str) {
+    // The coordinator watch evicts later; this node must see its own write at once.
+    super::cache::invalidate(trigger_id).await;
+    if let Err(e) = db::workflow_http_triggers::emit_snapshot(trigger_id).await {
+        log::error!("[WORKFLOW_HOOK] snapshot emit for trigger {trigger_id} failed: {e}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::HashMap,
+        sync::{Arc, Mutex},
+    };
+
+    use infra::table::{
+        entity::llm_secrets,
+        workflow_http_trigger_requests::{self as ledger, NewHookRequest},
+    };
+    use sea_orm::{ConnectOptions, Database, DatabaseConnection, PaginatorTrait};
+
+    use super::*;
+
+    const NOW: i64 = 1_760_000_000_000_000;
+    const ORG: &str = "acme";
+    const WF: &str = "wf1";
+    const LOCAL: &str = "r1";
+    const BUDGET: u32 = 1200;
+
+    type Stored = Arc<Mutex<HashMap<String, String>>>;
+
+    /// One connection: separate connections to `sqlite::memory:` are separate databases.
+    async fn db() -> DatabaseConnection {
+        let mut opts = ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = Database::connect(opts).await.unwrap();
+        http_triggers::create_tables_for_tests(&db).await.unwrap();
+        db
+    }
+
+    fn at(now: i64) -> Writer<'static> {
+        Writer {
+            org_id: ORG,
+            workflow_id: WF,
+            user_id: "a@acme.io",
+            local_cluster: LOCAL,
+            now,
+        }
+    }
+
+    fn request(mode: AuthMode) -> UpsertRequest {
+        UpsertRequest {
+            enabled: true,
+            auth_mode: mode,
+            max_body_bytes: None,
+            rate_limit_per_minute: None,
+        }
+    }
+
+    fn all_permissions() -> EndpointPermissions {
+        EndpointPermissions {
+            edit: true,
+            test: true,
+            reveal: true,
+        }
+    }
+
+    /// Records each minted plaintext by credential id, so a fake resolver can return it.
+    fn preparer(
+        stored: Stored,
+    ) -> impl Fn(
+        String,
+        String,
+        CredentialKind,
+        MintedSecret,
+    ) -> std::future::Ready<Result<PreparedSecret, SecretError>> {
+        move |org, credential_id, _kind, minted| {
+            stored
+                .lock()
+                .unwrap()
+                .insert(credential_id.clone(), minted.plaintext);
+            std::future::ready(Ok(secrets::prepared_for_tests(
+                &org,
+                SecretOwnerKind::WorkflowTrigger,
+                &credential_id,
+            )))
+        }
+    }
+
+    fn secrets_off(
+        _org: String,
+        _credential_id: String,
+        _kind: CredentialKind,
+        _minted: MintedSecret,
+    ) -> std::future::Ready<Result<PreparedSecret, SecretError>> {
+        std::future::ready(Err(SecretError::Encryption("no master key".to_string())))
+    }
+
+    fn resolver(
+        stored: Stored,
+    ) -> impl Fn(String, String, String) -> std::future::Ready<Result<String, SecretError>> {
+        move |_org, _secret_ref, credential_id| {
+            std::future::ready(
+                stored
+                    .lock()
+                    .unwrap()
+                    .get(&credential_id)
+                    .cloned()
+                    .ok_or(SecretError::NotFound),
+            )
+        }
+    }
+
+    async fn create(db: &DatabaseConnection, mode: AuthMode, stored: &Stored) -> Written {
+        upsert_in(
+            db,
+            &at(NOW),
+            &request(mode),
+            BUDGET,
+            true,
+            preparer(stored.clone()),
+        )
+        .await
+        .unwrap()
+    }
+
+    async fn trigger_of(db: &DatabaseConnection) -> triggers::Model {
+        http_triggers::get_by_workflow(db, ORG, WF)
+            .await
+            .unwrap()
+            .unwrap()
+    }
+
+    async fn credentials_of(db: &DatabaseConnection, trigger_id: &str) -> Vec<credentials::Model> {
+        http_triggers::list_credentials(db, trigger_id)
+            .await
+            .unwrap()
+    }
+
+    async fn secrets_of(db: &DatabaseConnection, owner_id: &str) -> u64 {
+        llm_secrets::Entity::find()
+            .filter(llm_secrets::Column::OwnerKind.eq("workflow_trigger"))
+            .filter(llm_secrets::Column::OwnerId.eq(owner_id))
+            .count(db)
+            .await
+            .unwrap()
+    }
+
+    async fn all_secrets(db: &DatabaseConnection) -> u64 {
+        llm_secrets::Entity::find().count(db).await.unwrap()
+    }
+
+    async fn ledger_row(db: &DatabaseConnection, trigger_id: &str, run_id: &str, at: i64) {
+        ledger::enqueue(
+            db,
+            NewHookRequest {
+                trigger_id: trigger_id.to_string(),
+                org_id: ORG.to_string(),
+                workflow_id: WF.to_string(),
+                run_id: run_id.to_string(),
+                idem_key: None,
+                body_sha256: "ab".repeat(32),
+                body_bytes: 2,
+                content_type: None,
+                meta: "{}".to_string(),
+                credential_id: "c1".to_string(),
+                credential_prefix: "o2wh_abcd…wxyz".to_string(),
+                caller_ip: "203.0.113.7".to_string(),
+                received_at: at,
+            },
+            "{}".to_string(),
+        )
+        .await
+        .unwrap();
+    }
+
+    fn live_state(rows: &[credentials::Model], now: i64) -> Vec<(String, String)> {
+        rows.iter()
+            .filter(|c| row_is_live(c, now))
+            .map(|c| (c.kind.clone(), c.state.clone()))
+            .collect()
+    }
+
+    #[test]
+    fn limits_default_and_refuse_values_outside_the_range() {
+        let mut req = request(AuthMode::Token);
+        assert_eq!(validate_limits(&req, BUDGET), Ok((1024 * 1024, 60)));
+        assert_eq!(validate_limits(&req, 30), Ok((1024 * 1024, 30)));
+        for (body, rpm) in [
+            (Some(MIN_BODY_BYTES - 1), None),
+            (Some(DEFAULT_MAX_BODY_BYTES + 1), None),
+            (None, Some(0)),
+            (None, Some(1201)),
+        ] {
+            req.max_body_bytes = body;
+            req.rate_limit_per_minute = rpm;
+            assert_eq!(
+                validate_limits(&req, BUDGET),
+                Err(ManageError::InvalidLimit),
+                "{body:?} {rpm:?}"
+            );
+        }
+        req.max_body_bytes = Some(MIN_BODY_BYTES);
+        req.rate_limit_per_minute = Some(1200);
+        assert_eq!(validate_limits(&req, BUDGET), Ok((MIN_BODY_BYTES, 1200)));
+    }
+
+    #[test]
+    fn reveal_view_debug_omits_the_secret() {
+        let view = RevealView {
+            id: "c1".to_string(),
+            kind: CredentialKind::Token,
+            display_prefix: "o2wh_abcd…wxyz".to_string(),
+            state: CredentialState::Active,
+            expires_at: None,
+            secret: "o2wh_supersecretvalue".to_string(),
+        };
+        let printed = format!("{view:?}");
+        assert!(!printed.contains("supersecretvalue"), "{printed}");
+        assert!(printed.contains("o2wh_abcd…wxyz"), "{printed}");
+    }
+
+    #[test]
+    fn hook_test_input_has_the_hook_shape() {
+        let input = hook_test_input("t1", vec![serde_json::json!({"a": 1})]);
+        assert_eq!(input["meta"]["event_type"], "webhook");
+        assert_eq!(input["meta"]["trigger_source"], "http");
+        assert_eq!(input["meta"]["trigger_id"], "t1");
+        assert!(
+            input["meta"]["run_id"]
+                .as_str()
+                .is_some_and(|r| !r.is_empty())
+        );
+        assert!(input["meta"]["received_at"].as_i64().is_some());
+        assert_eq!(input["meta"]["query"], serde_json::json!({}));
+        assert_eq!(input["meta"]["headers"], serde_json::json!({}));
+        assert_eq!(input["data"], serde_json::json!([{"a": 1}]));
+    }
+
+    #[tokio::test]
+    async fn the_view_reports_secrets_not_encrypted_without_a_master_key() {
+        let db = db().await;
+        create(&db, AuthMode::Token, &Stored::default()).await;
+        let trigger = trigger_of(&db).await;
+        let view = trigger_view(&trigger, vec![], None, false, all_permissions(), BUDGET);
+        assert!(!view.secrets_encrypted_at_rest);
+        let json = serde_json::to_value(&view).unwrap();
+        assert_eq!(json["secrets_encrypted_at_rest"], false);
+        assert_eq!(json["auth_mode"], "token");
+        assert_eq!(json["org_rate_limit_per_minute"], BUDGET);
+        assert_eq!(json["rejections"], serde_json::json!({}));
+        assert!(
+            json["url"]
+                .as_str()
+                .unwrap()
+                .ends_with(&format!("/api/v2/{ORG}/workflows/hooks/{}", trigger.id))
+        );
+    }
+
+    #[tokio::test]
+    async fn the_view_reports_secrets_encrypted_with_a_master_key() {
+        let db = db().await;
+        create(&db, AuthMode::Token, &Stored::default()).await;
+        let trigger = trigger_of(&db).await;
+        let view = trigger_view(&trigger, vec![], None, true, all_permissions(), BUDGET);
+        assert!(view.secrets_encrypted_at_rest);
+        assert_eq!(view.permissions, all_permissions());
+    }
+
+    #[tokio::test]
+    async fn trigger_view_carries_last_call_from_the_newest_ledger_row() {
+        let db = db().await;
+        let written = create(&db, AuthMode::Token, &Stored::default()).await;
+        let trigger = trigger_of(&db).await;
+        assert_eq!(last_call_in(&db, &trigger).await.unwrap(), None);
+        ledger_row(&db, &written.trigger_id, "run-old", NOW + 1).await;
+        ledger_row(&db, &written.trigger_id, "run-new", NOW + 2).await;
+        ledger_row(&db, "another-trigger", "run-other", NOW + 3).await;
+        let last = last_call_in(&db, &trigger).await.unwrap();
+        let view = trigger_view(&trigger, vec![], last, false, all_permissions(), BUDGET);
+        assert_eq!(
+            view.last_call,
+            Some(LastCall {
+                run_id: "run-new".to_string(),
+                status: "queued".to_string(),
+                received_at: NOW + 2,
+            })
+        );
+    }
+
+    #[tokio::test]
+    async fn minting_a_token_stores_it_encrypted_and_hashed() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        assert_eq!(written.kind, WriteKind::Created);
+        let secret = written.secret.unwrap();
+        let rows = credentials_of(&db, &written.trigger_id).await;
+        assert_eq!(rows.len(), 1);
+        let row = &rows[0];
+        assert_eq!(row.kind, "token");
+        assert_eq!(row.state, "active");
+        assert_eq!(
+            row.token_sha256.as_deref(),
+            Some(minting::sha256_hex(&secret.plaintext).as_str())
+        );
+        assert_eq!(row.display_prefix, secret.display_prefix);
+        assert!(row.secret_ref.is_some());
+        assert_eq!(secrets_of(&db, &row.id).await, 1);
+        assert_eq!(
+            stored.lock().unwrap().get(&row.id),
+            Some(&secret.plaintext),
+            "the plaintext handed to the encryptor is the minted token"
+        );
+        let trigger = trigger_of(&db).await;
+        assert_eq!(
+            (trigger.version, trigger.origin_cluster.as_str()),
+            (1, LOCAL)
+        );
+    }
+
+    #[tokio::test]
+    async fn a_mint_with_stored_secrets_off_fails_and_writes_nothing() {
+        let db = db().await;
+        let failed = upsert_in(
+            &db,
+            &at(NOW),
+            &request(AuthMode::Token),
+            BUDGET,
+            true,
+            secrets_off,
+        )
+        .await;
+        assert!(
+            matches!(failed, Err(UpsertFail::Manage(ManageError::Internal(_)))),
+            "{failed:?}"
+        );
+        assert!(
+            http_triggers::get_by_workflow(&db, ORG, WF)
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert_eq!(all_secrets(&db).await, 0);
+    }
+
+    #[tokio::test]
+    async fn create_and_mode_switch_need_credential_access_and_an_update_does_not() {
+        let db = db().await;
+        let stored = Stored::default();
+        let refused = upsert_in(
+            &db,
+            &at(NOW),
+            &request(AuthMode::Token),
+            BUDGET,
+            false,
+            preparer(stored.clone()),
+        )
+        .await;
+        assert_eq!(
+            refused.unwrap_err(),
+            UpsertFail::Manage(ManageError::CredentialAccessRequired)
+        );
+        assert!(stored.lock().unwrap().is_empty(), "nothing was minted");
+        create(&db, AuthMode::Token, &stored).await;
+        let mut update = request(AuthMode::Token);
+        update.enabled = false;
+        let updated = upsert_in(
+            &db,
+            &at(NOW + 1),
+            &update,
+            BUDGET,
+            false,
+            preparer(stored.clone()),
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            (updated.kind, updated.secret.is_none()),
+            (WriteKind::Updated, true)
+        );
+        let switch = upsert_in(
+            &db,
+            &at(NOW + 2),
+            &request(AuthMode::Signature),
+            BUDGET,
+            false,
+            preparer(stored.clone()),
+        )
+        .await;
+        assert_eq!(
+            switch.unwrap_err(),
+            UpsertFail::Manage(ManageError::CredentialAccessRequired)
+        );
+        assert_eq!(trigger_of(&db).await.auth_mode, "token");
+    }
+
+    #[tokio::test]
+    async fn an_update_keeps_the_stored_limits_when_omitted() {
+        let db = db().await;
+        let stored = Stored::default();
+        let mut first = request(AuthMode::Token);
+        first.max_body_bytes = Some(4096);
+        first.rate_limit_per_minute = Some(10);
+        upsert_in(
+            &db,
+            &at(NOW),
+            &first,
+            BUDGET,
+            true,
+            preparer(stored.clone()),
+        )
+        .await
+        .unwrap();
+        upsert_in(
+            &db,
+            &at(NOW + 1),
+            &request(AuthMode::Token),
+            BUDGET,
+            true,
+            preparer(stored),
+        )
+        .await
+        .unwrap();
+        let trigger = trigger_of(&db).await;
+        assert_eq!(
+            (trigger.max_body_bytes, trigger.rate_limit_per_minute),
+            (4096, 10)
+        );
+    }
+
+    #[tokio::test]
+    async fn mode_switch_deletes_the_token_secret() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let token_id = credentials_of(&db, &written.trigger_id).await[0].id.clone();
+        assert_eq!(secrets_of(&db, &token_id).await, 1);
+        let switched = upsert_in(
+            &db,
+            &at(NOW + 1),
+            &request(AuthMode::Signature),
+            BUDGET,
+            true,
+            preparer(stored),
+        )
+        .await
+        .unwrap();
+        assert_eq!(switched.kind, WriteKind::Switched);
+        assert!(switched.secret.unwrap().plaintext.starts_with("whsec_"));
+        let rows = credentials_of(&db, &written.trigger_id).await;
+        assert_eq!(
+            live_state(&rows, NOW + 1),
+            vec![("signing_secret".to_string(), "active".to_string())]
+        );
+        let old = rows.iter().find(|c| c.id == token_id).unwrap();
+        assert_eq!(
+            (old.state.as_str(), old.secret_ref.as_ref()),
+            ("revoked", None)
+        );
+        assert_eq!(secrets_of(&db, &token_id).await, 0);
+        assert_eq!(trigger_of(&db).await.auth_mode, "signature");
+    }
+
+    #[tokio::test]
+    async fn revoking_a_token_deletes_its_secret() {
+        let db = db().await;
+        let written = create(&db, AuthMode::Token, &Stored::default()).await;
+        let token_id = credentials_of(&db, &written.trigger_id).await[0].id.clone();
+        let trigger_id = revoke_in(&db, &at(NOW + 1), &token_id).await.unwrap();
+        assert_eq!(trigger_id, written.trigger_id);
+        let row = &credentials_of(&db, &trigger_id).await[0];
+        assert_eq!(
+            (row.state.as_str(), row.revoked_at, row.secret_ref.as_ref()),
+            ("revoked", Some(NOW + 1), None)
+        );
+        assert_eq!(secrets_of(&db, &token_id).await, 0);
+        assert_eq!(
+            revoke_in(&db, &at(NOW + 2), &token_id).await,
+            Err(ManageError::CredentialNotFound)
+        );
+    }
+
+    #[tokio::test]
+    async fn revoking_another_triggers_credential_is_not_found() {
+        let db = db().await;
+        create(&db, AuthMode::Token, &Stored::default()).await;
+        let other = Writer {
+            workflow_id: "wf2",
+            ..at(NOW)
+        };
+        upsert_in(
+            &db,
+            &other,
+            &request(AuthMode::Token),
+            BUDGET,
+            true,
+            preparer(Stored::default()),
+        )
+        .await
+        .unwrap();
+        let foreign = credentials_of(&db, &trigger_of(&db).await.id).await[0]
+            .id
+            .clone();
+        assert_eq!(
+            revoke_in(
+                &db,
+                &Writer {
+                    now: NOW + 1,
+                    ..other
+                },
+                &foreign
+            )
+            .await,
+            Err(ManageError::CredentialNotFound)
+        );
+    }
+
+    #[tokio::test]
+    async fn deleting_the_endpoint_deletes_every_secret() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        rotate_in(&db, &at(NOW + 1), 3600, preparer(stored))
+            .await
+            .unwrap();
+        ledger_row(&db, &written.trigger_id, "queued-run", NOW + 2).await;
+        assert_eq!(all_secrets(&db).await, 2);
+        let deleted = delete_in(&db, &at(NOW + 3)).await.unwrap();
+        assert_eq!(deleted, written.trigger_id);
+        assert_eq!(all_secrets(&db).await, 0);
+        let trigger = trigger_of(&db).await;
+        assert_eq!(trigger.deleted_at, Some(NOW + 3));
+        assert_eq!(
+            (trigger.version, trigger.origin_cluster.as_str()),
+            (3, LOCAL)
+        );
+        assert!(
+            credentials_of(&db, &deleted)
+                .await
+                .iter()
+                .all(|c| c.state == "revoked" && c.secret_ref.is_none())
+        );
+        assert!(
+            ledger::get_run(&db, &deleted, "queued-run")
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert_eq!(
+            delete_in(&db, &at(NOW + 4)).await,
+            Err(ManageError::NotConfigured)
+        );
+    }
+
+    #[tokio::test]
+    async fn a_tombstoned_endpoint_is_revived_on_create() {
+        let db = db().await;
+        let stored = Stored::default();
+        let first = create(&db, AuthMode::Token, &stored).await;
+        delete_in(&db, &at(NOW + 1)).await.unwrap();
+        let again = upsert_in(
+            &db,
+            &at(NOW + 2),
+            &request(AuthMode::Signature),
+            BUDGET,
+            true,
+            preparer(stored),
+        )
+        .await
+        .unwrap();
+        assert_eq!(again.kind, WriteKind::Created);
+        assert_eq!(again.trigger_id, first.trigger_id);
+        let trigger = trigger_of(&db).await;
+        assert_eq!(
+            (trigger.deleted_at, trigger.created_at, trigger.version),
+            (None, NOW + 2, 3)
+        );
+        let rows = credentials_of(&db, &trigger.id).await;
+        assert_eq!(
+            live_state(&rows, NOW + 2),
+            vec![("signing_secret".to_string(), "active".to_string())]
+        );
+    }
+
+    #[tokio::test]
+    async fn rotate_while_a_live_retiring_credential_exists_is_refused() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        rotate_in(&db, &at(NOW + 1), 3600, preparer(stored.clone()))
+            .await
+            .unwrap();
+        let refused = rotate_in(&db, &at(NOW + 2), 0, preparer(stored.clone())).await;
+        assert_eq!(refused.unwrap_err(), ManageError::CredentialRetiring);
+        assert_eq!(credentials_of(&db, &written.trigger_id).await.len(), 2);
+        let after_expiry = NOW + 1 + 3600 * 1_000_000 + 1;
+        rotate_in(&db, &at(after_expiry), 0, preparer(stored))
+            .await
+            .unwrap();
+        assert_eq!(
+            rotate_in(&db, &at(NOW), 60, preparer(Stored::default()))
+                .await
+                .unwrap_err(),
+            ManageError::InvalidOverlap
+        );
+    }
+
+    #[tokio::test]
+    async fn rotate_after_revoking_the_active_credential_keeps_the_retiring_one() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let (_, active, _) = rotate_in(&db, &at(NOW + 1), 3600, preparer(stored.clone()))
+            .await
+            .unwrap();
+        revoke_in(&db, &at(NOW + 2), &active.id).await.unwrap();
+        let retiring_before = credentials_of(&db, &written.trigger_id)
+            .await
+            .into_iter()
+            .find(|c| c.state == "retiring")
+            .unwrap();
+
+        let (_, minted, _) = rotate_in(&db, &at(NOW + 3), 86400, preparer(stored.clone()))
+            .await
+            .unwrap();
+        let rows = credentials_of(&db, &written.trigger_id).await;
+        let retiring = rows.iter().find(|c| c.id == retiring_before.id).unwrap();
+        assert_eq!(
+            (retiring.state.as_str(), retiring.expires_at),
+            ("retiring", retiring_before.expires_at)
+        );
+        assert_eq!(
+            rows.iter().find(|c| c.id == minted.id).unwrap().state,
+            "active"
+        );
+
+        let refused = rotate_in(&db, &at(NOW + 4), 3600, preparer(stored.clone())).await;
+        assert_eq!(refused.unwrap_err(), ManageError::CredentialRetiring);
+    }
+
+    #[tokio::test]
+    async fn an_immediate_rotate_with_only_a_retiring_credential_keeps_it() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let (_, active, _) = rotate_in(&db, &at(NOW + 1), 3600, preparer(stored.clone()))
+            .await
+            .unwrap();
+        revoke_in(&db, &at(NOW + 2), &active.id).await.unwrap();
+        rotate_in(&db, &at(NOW + 3), 0, preparer(stored))
+            .await
+            .unwrap();
+        let rows = credentials_of(&db, &written.trigger_id).await;
+        let mut live = live_state(&rows, NOW + 3);
+        live.sort();
+        assert_eq!(
+            live,
+            vec![
+                ("token".to_string(), "active".to_string()),
+                ("token".to_string(), "retiring".to_string())
+            ]
+        );
+    }
+
+    #[tokio::test]
+    async fn a_third_live_credential_is_never_created() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let mut now = NOW;
+        for overlap in [3600, 0, 86400, 0, 604800] {
+            now += 1;
+            let _ = rotate_in(&db, &at(now), overlap, preparer(stored.clone())).await;
+            let rows = credentials_of(&db, &written.trigger_id).await;
+            let live = live_state(&rows, now);
+            assert!(live.len() <= 2, "{live:?}");
+            assert_eq!(
+                live.iter().filter(|(_, s)| s == "active").count(),
+                1,
+                "{live:?}"
+            );
+            assert!(
+                live.iter().filter(|(_, s)| s == "retiring").count() <= 1,
+                "{live:?}"
+            );
+        }
+        let mut stray = credentials_of(&db, &written.trigger_id).await[0].clone();
+        stray.id = "stray-active".to_string();
+        stray.state = "active".to_string();
+        stray.expires_at = None;
+        stray.created_at = NOW - 10;
+        stray.secret_ref = None;
+        http_triggers::insert_credential(&db, stray).await.unwrap();
+        let later = NOW + 30 * 86_400 * 1_000_000;
+        rotate_in(&db, &at(later), 3600, preparer(stored))
+            .await
+            .unwrap();
+        let rows = credentials_of(&db, &written.trigger_id).await;
+        let live = live_state(&rows, later);
+        assert_eq!(live.len(), 2, "{live:?}");
+        let stray = rows.iter().find(|c| c.id == "stray-active").unwrap();
+        assert_eq!(stray.state, "revoked");
+    }
+
+    #[tokio::test]
+    async fn an_immediate_rotate_revokes_the_old_credential_and_its_secret() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let old = credentials_of(&db, &written.trigger_id).await[0].id.clone();
+        let (_, view, secret) = rotate_in(&db, &at(NOW + 1), 0, preparer(stored))
+            .await
+            .unwrap();
+        assert_eq!(view.state, CredentialState::Active);
+        assert_eq!(view.display_prefix, secret.display_prefix);
+        let rows = credentials_of(&db, &written.trigger_id).await;
+        let old_row = rows.iter().find(|c| c.id == old).unwrap();
+        assert_eq!(old_row.state, "revoked");
+        assert_eq!(secrets_of(&db, &old).await, 0);
+        let with_overlap = rotate_in(&db, &at(NOW + 2), 86400, preparer(Stored::default()))
+            .await
+            .unwrap();
+        let rows = credentials_of(&db, &written.trigger_id).await;
+        let retiring = rows.iter().find(|c| c.id == view.id).unwrap();
+        assert_eq!(
+            (retiring.state.as_str(), retiring.expires_at),
+            ("retiring", Some(NOW + 2 + 86400 * 1_000_000))
+        );
+        assert_ne!(with_overlap.1.id, view.id);
+    }
+
+    #[tokio::test]
+    async fn a_local_write_takes_over_as_origin() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        triggers::Entity::update_many()
+            .col_expr(triggers::Column::OriginCluster, Expr::value("r2"))
+            .col_expr(triggers::Column::Version, Expr::value(7))
+            .filter(triggers::Column::Id.eq(&written.trigger_id))
+            .exec(&db)
+            .await
+            .unwrap();
+        let writes: [(&str, i64); 4] =
+            [("update", 8), ("rotate", 9), ("revoke", 10), ("delete", 11)];
+        for (step, (name, version)) in writes.into_iter().enumerate() {
+            triggers::Entity::update_many()
+                .col_expr(triggers::Column::OriginCluster, Expr::value("r2"))
+                .filter(triggers::Column::Id.eq(&written.trigger_id))
+                .exec(&db)
+                .await
+                .unwrap();
+            let now = NOW + 1 + step as i64;
+            match name {
+                "update" => {
+                    upsert_in(
+                        &db,
+                        &at(now),
+                        &request(AuthMode::Token),
+                        BUDGET,
+                        true,
+                        preparer(stored.clone()),
+                    )
+                    .await
+                    .unwrap();
+                }
+                "rotate" => {
+                    rotate_in(&db, &at(now), 3600, preparer(stored.clone()))
+                        .await
+                        .unwrap();
+                }
+                "revoke" => {
+                    let retiring = credentials_of(&db, &written.trigger_id)
+                        .await
+                        .into_iter()
+                        .find(|c| c.state == "retiring")
+                        .unwrap();
+                    revoke_in(&db, &at(now), &retiring.id).await.unwrap();
+                }
+                _ => {
+                    delete_in(&db, &at(now)).await.unwrap();
+                }
+            }
+            let trigger = trigger_of(&db).await;
+            assert_eq!(
+                (
+                    trigger.origin_cluster.as_str(),
+                    trigger.version,
+                    trigger.updated_at
+                ),
+                (LOCAL, version, now),
+                "{name}"
+            );
+        }
+    }
+
+    #[tokio::test]
+    async fn a_noop_put_still_bumps_version_and_emits() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let before = trigger_of(&db).await;
+        let again = upsert_in(
+            &db,
+            &at(NOW + 5),
+            &request(AuthMode::Token),
+            BUDGET,
+            true,
+            preparer(stored),
+        )
+        .await
+        .unwrap();
+        assert_eq!(
+            (
+                again.kind,
+                again.trigger_id.as_str(),
+                again.secret.is_none()
+            ),
+            (WriteKind::Updated, written.trigger_id.as_str(), true),
+            "the write names its trigger, which the caller emits after commit"
+        );
+        let after = trigger_of(&db).await;
+        assert_eq!(after.version, before.version + 1);
+        assert_eq!(after.updated_at, NOW + 5);
+        assert_eq!(credentials_of(&db, &after.id).await.len(), 1);
+    }
+
+    #[tokio::test]
+    async fn version_increments_on_each_locked_write() {
+        let db = db().await;
+        let stored = Stored::default();
+        create(&db, AuthMode::Token, &stored).await;
+        let mut expected = 1;
+        for step in 1..=3 {
+            rotate_in(&db, &at(NOW + step), 0, preparer(stored.clone()))
+                .await
+                .unwrap();
+            expected += 1;
+            assert_eq!(trigger_of(&db).await.version, expected);
+        }
+    }
+
+    #[tokio::test]
+    async fn reveal_returns_the_plaintext_of_a_live_credential() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let minted = written.secret.unwrap();
+        let id = credentials_of(&db, &written.trigger_id).await[0].id.clone();
+        let (view, trigger_id) = reveal_in(&db, ORG, WF, &id, NOW + 1, resolver(stored))
+            .await
+            .unwrap();
+        assert_eq!(trigger_id, written.trigger_id);
+        assert_eq!(view.secret, minted.plaintext);
+        assert_eq!(
+            (view.kind, view.state, view.display_prefix.as_str()),
+            (
+                CredentialKind::Token,
+                CredentialState::Active,
+                minted.display_prefix.as_str()
+            )
+        );
+    }
+
+    #[tokio::test]
+    async fn a_retiring_credential_reveals_until_expiry() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Signature, &stored).await;
+        let old = credentials_of(&db, &written.trigger_id).await[0].id.clone();
+        rotate_in(&db, &at(NOW + 1), 3600, preparer(stored.clone()))
+            .await
+            .unwrap();
+        let expires = NOW + 1 + 3600 * 1_000_000;
+        let (view, _) = reveal_in(&db, ORG, WF, &old, expires - 1, resolver(stored.clone()))
+            .await
+            .unwrap();
+        assert_eq!(
+            (view.state, view.expires_at),
+            (CredentialState::Retiring, Some(expires))
+        );
+        assert!(view.secret.starts_with("whsec_"));
+        assert_eq!(
+            reveal_in(&db, ORG, WF, &old, expires, resolver(stored))
+                .await
+                .unwrap_err(),
+            ManageError::CredentialNotFound
+        );
+    }
+
+    #[tokio::test]
+    async fn revoked_or_expired_credentials_do_not_reveal() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let first = credentials_of(&db, &written.trigger_id).await[0].id.clone();
+        rotate_in(&db, &at(NOW + 1), 0, preparer(stored.clone()))
+            .await
+            .unwrap();
+        assert_eq!(
+            reveal_in(&db, ORG, WF, &first, NOW + 2, resolver(stored.clone()))
+                .await
+                .unwrap_err(),
+            ManageError::CredentialNotFound
+        );
+        assert_eq!(
+            reveal_in(&db, ORG, WF, "unknown", NOW + 2, resolver(stored.clone()))
+                .await
+                .unwrap_err(),
+            ManageError::CredentialNotFound
+        );
+        let other_wf = reveal_in(&db, ORG, "wf-none", &first, NOW + 2, resolver(stored)).await;
+        assert_eq!(other_wf.unwrap_err(), ManageError::NotConfigured);
+    }
+
+    #[tokio::test]
+    async fn another_triggers_credential_does_not_reveal() {
+        let db = db().await;
+        let stored = Stored::default();
+        create(&db, AuthMode::Token, &stored).await;
+        let other = Writer {
+            workflow_id: "wf2",
+            ..at(NOW)
+        };
+        let second = upsert_in(
+            &db,
+            &other,
+            &request(AuthMode::Token),
+            BUDGET,
+            true,
+            preparer(stored.clone()),
+        )
+        .await
+        .unwrap();
+        let foreign = credentials_of(&db, &second.trigger_id).await[0].id.clone();
+        assert_eq!(
+            reveal_in(&db, ORG, WF, &foreign, NOW + 1, resolver(stored))
+                .await
+                .unwrap_err(),
+            ManageError::CredentialNotFound
+        );
+    }
+
+    #[tokio::test]
+    async fn a_credential_without_a_secret_ref_reveals_500() {
+        let db = db().await;
+        let stored = Stored::default();
+        let written = create(&db, AuthMode::Token, &stored).await;
+        let id = credentials_of(&db, &written.trigger_id).await[0].id.clone();
+        let unreadable = reveal_in(&db, ORG, WF, &id, NOW + 1, resolver(Stored::default())).await;
+        assert!(matches!(unreadable, Err(ManageError::Internal(_))));
+        credentials::Entity::update_many()
+            .col_expr(
+                credentials::Column::SecretRef,
+                Expr::value(Option::<String>::None),
+            )
+            .filter(credentials::Column::Id.eq(&id))
+            .exec(&db)
+            .await
+            .unwrap();
+        assert!(matches!(
+            reveal_in(&db, ORG, WF, &id, NOW + 1, resolver(stored)).await,
+            Err(ManageError::Internal(_))
+        ));
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/mod.rs b/src/core/src/workflows/http_trigger/mod.rs
new file mode 100644
index 0000000000..5d2e892c78
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/mod.rs
@@ -0,0 +1,386 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Runs workflows started by HTTP requests on a per-region worker, apart from the trigger queue.
+
+pub mod cache;
+pub mod credentials;
+pub mod enqueue;
+pub mod manage;
+pub mod payload;
+pub mod rejections;
+pub mod signature;
+pub mod sweeper;
+pub mod wake;
+pub mod worker;
+
+use std::time::Duration;
+
+use config::cluster::LOCAL_NODE;
+use o2_enterprise::enterprise::common::config::get_config as get_o2_config;
+
+pub const HEARTBEAT_KEY: &str = "/workflow_hook_worker/heartbeat";
+pub const WORKER_LOCK_KEY: &str = "/workflow-hook-worker";
+pub const WAKE_PREFIX: &str = "/workflow_hook_wake/";
+// Spike S2: the JS runtime's 10 MiB heap does not hold a larger input.
+pub const HARD_BODY_CAP: usize = 1024 * 1024;
+pub const DEFAULT_MAX_BODY_BYTES: i64 = 1024 * 1024;
+pub const DEFAULT_TRIGGER_RPM: i32 = 60;
+// The server sets no body timeout, and a stalled body would hold its pre-auth permit.
+pub const BODY_READ_TIMEOUT: Duration = Duration::from_secs(10);
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Hash, PartialOrd, Ord)]
+pub enum HookReason {
+    Unauthorized,
+    InvalidToken,
+    InvalidSignature,
+    StaleTimestamp,
+    CredentialInUrl,
+    EndpointDisabled,
+    WorkflowDisabled,
+    WorkflowNotPublished,
+    PayloadTooLarge,
+    InvalidIdempotencyKey,
+    IdempotencyKeyReused,
+    RateLimited,
+    QueueFull,
+    WorkerUnavailable,
+    RunNotFound,
+    InternalError,
+    RequestTimeout,
+}
+
+impl HookReason {
+    pub fn code(self) -> &'static str {
+        match self {
+            Self::Unauthorized => "unauthorized",
+            Self::InvalidToken => "invalid_token",
+            Self::InvalidSignature => "invalid_signature",
+            Self::StaleTimestamp => "stale_timestamp",
+            Self::CredentialInUrl => "credential_in_url",
+            Self::EndpointDisabled => "endpoint_disabled",
+            Self::WorkflowDisabled => "workflow_disabled",
+            Self::WorkflowNotPublished => "workflow_not_published",
+            Self::PayloadTooLarge => "payload_too_large",
+            Self::InvalidIdempotencyKey => "invalid_idempotency_key",
+            Self::IdempotencyKeyReused => "idempotency_key_reused",
+            Self::RateLimited => "rate_limited",
+            Self::QueueFull => "queue_full",
+            Self::WorkerUnavailable => "worker_unavailable",
+            Self::RunNotFound => "run_not_found",
+            Self::InternalError => "internal_error",
+            Self::RequestTimeout => "request_timeout",
+        }
+    }
+
+    pub fn status(self) -> u16 {
+        match self {
+            Self::Unauthorized
+            | Self::InvalidToken
+            | Self::InvalidSignature
+            | Self::StaleTimestamp => 401,
+            Self::CredentialInUrl | Self::InvalidIdempotencyKey => 400,
+            Self::EndpointDisabled | Self::WorkflowDisabled | Self::WorkflowNotPublished => 403,
+            Self::RunNotFound => 404,
+            Self::RequestTimeout => 408,
+            Self::PayloadTooLarge => 413,
+            Self::IdempotencyKeyReused => 422,
+            Self::RateLimited => 429,
+            Self::InternalError => 500,
+            Self::QueueFull | Self::WorkerUnavailable => 503,
+        }
+    }
+
+    /// Stored-only identity reasons collapse to `Unauthorized` on the wire so callers cannot probe.
+    pub fn public(self) -> Self {
+        match self {
+            Self::InvalidToken | Self::InvalidSignature | Self::StaleTimestamp => {
+                Self::Unauthorized
+            }
+            other => other,
+        }
+    }
+
+    pub fn message(self) -> &'static str {
+        match self {
+            Self::Unauthorized
+            | Self::InvalidToken
+            | Self::InvalidSignature
+            | Self::StaleTimestamp => "Unauthorized",
+            Self::CredentialInUrl => "A credential was found in the request URL",
+            Self::EndpointDisabled => "This HTTP endpoint is turned off",
+            Self::WorkflowDisabled => "The workflow is disabled",
+            Self::WorkflowNotPublished => "The workflow is not published",
+            Self::PayloadTooLarge => "The request body is too large",
+            Self::InvalidIdempotencyKey => "The idempotency key is invalid",
+            Self::IdempotencyKeyReused => "The idempotency key was used with a different body",
+            Self::RateLimited => "Too many requests",
+            Self::QueueFull => "Too many runs are waiting for this organization",
+            Self::WorkerUnavailable => "No worker is available to run the workflow",
+            Self::RunNotFound => "Run not found",
+            Self::InternalError => "Internal error; nothing was queued",
+            Self::RequestTimeout => "The request body did not arrive in time",
+        }
+    }
+
+    pub fn hint(self) -> Option<&'static str> {
+        match self {
+            Self::CredentialInUrl => Some(
+                "Send the token as an Authorization: Bearer header, then rotate it: URLs are logged",
+            ),
+            Self::EndpointDisabled => {
+                Some("Turn the endpoint on in the workflow's HTTP endpoint settings")
+            }
+            Self::WorkflowDisabled => Some("Enable the workflow"),
+            Self::WorkflowNotPublished => Some("Publish the workflow"),
+            Self::PayloadTooLarge => Some("Send a smaller body or raise the endpoint's body limit"),
+            Self::RequestTimeout => Some("Send the whole body without pausing"),
+            Self::InvalidIdempotencyKey => Some("Use 1 to 255 printable ASCII characters"),
+            Self::IdempotencyKeyReused => Some("Use a new idempotency key for a different body"),
+            Self::RateLimited | Self::QueueFull | Self::WorkerUnavailable => {
+                Some("Retry after the number of seconds in Retry-After")
+            }
+            Self::Unauthorized
+            | Self::InvalidToken
+            | Self::InvalidSignature
+            | Self::StaleTimestamp
+            | Self::RunNotFound
+            | Self::InternalError => None,
+        }
+    }
+
+    pub fn is_recorded(self) -> bool {
+        !matches!(
+            self,
+            Self::Unauthorized | Self::RunNotFound | Self::InternalError | Self::RequestTimeout
+        )
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default, PartialEq, Eq)]
+pub struct NodeTasks {
+    pub cache_watch: bool,
+    pub rejection_merge: bool,
+    pub wake_coalescer: bool,
+    pub workflow_cache_watch: bool,
+    pub worker: bool,
+}
+
+/// Phase 1 keeps Cloud off until spike S1 sizes its caps.
+pub fn hooks_enabled() -> bool {
+    let common = &get_o2_config().common;
+    hooks_enabled_for(
+        cfg!(feature = "cloud"),
+        common.workflows_enabled,
+        common.workflow_hooks_enabled,
+    )
+}
+
+/// Router-only nodes return early from `jobs::init`, so they need their own selection.
+pub fn node_tasks(
+    is_router_only: bool,
+    is_scheduler: bool,
+    hooks_enabled: bool,
+    worker_disabled: bool,
+) -> NodeTasks {
+    if !hooks_enabled {
+        return NodeTasks::default();
+    }
+    NodeTasks {
+        cache_watch: true,
+        rejection_merge: true,
+        wake_coalescer: true,
+        workflow_cache_watch: is_router_only,
+        worker: is_scheduler && !worker_disabled,
+    }
+}
+
+pub fn spawn_node_tasks() {
+    let tasks = node_tasks(
+        LOCAL_NODE.is_router() && LOCAL_NODE.is_single_role(),
+        LOCAL_NODE.is_scheduler(),
+        hooks_enabled(),
+        config::get_config().limit.workflow_hook_worker_disabled,
+    );
+    if tasks.cache_watch {
+        tokio::task::spawn(cache::watch());
+    }
+    if tasks.rejection_merge {
+        tokio::task::spawn(rejections::run_merge_loop());
+    }
+    if tasks.wake_coalescer {
+        tokio::task::spawn(wake::run_coalescer());
+    }
+    // Other nodes already run this watch from `jobs::init`, past the router early return.
+    if tasks.workflow_cache_watch {
+        tokio::task::spawn(db::workflows::watch());
+    }
+    if tasks.worker {
+        tokio::task::spawn(worker::run_supervisor());
+    }
+}
+
+/// `RequestTimeout` once the read has taken `BODY_READ_TIMEOUT`.
+pub async fn read_within_deadline<T>(
+    read: impl Future<Output = Result<T, HookReason>>,
+) -> Result<T, HookReason> {
+    tokio::time::timeout(BODY_READ_TIMEOUT, read)
+        .await
+        .unwrap_or(Err(HookReason::RequestTimeout))
+}
+
+fn hooks_enabled_for(is_cloud: bool, workflows_enabled: bool, hooks_flag: bool) -> bool {
+    !is_cloud && workflows_enabled && hooks_flag
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn hooks_are_off_when_workflows_are_off() {
+        assert!(!hooks_enabled_for(false, false, true));
+        assert!(!hooks_enabled_for(false, true, false));
+        assert!(hooks_enabled_for(false, true, true));
+    }
+
+    #[test]
+    fn hooks_stay_off_in_cloud_builds() {
+        assert!(!hooks_enabled_for(true, true, true));
+    }
+
+    #[test]
+    fn router_only_nodes_get_the_hook_node_tasks() {
+        let tasks = node_tasks(true, false, true, false);
+        assert_eq!(
+            tasks,
+            NodeTasks {
+                cache_watch: true,
+                rejection_merge: true,
+                wake_coalescer: true,
+                workflow_cache_watch: true,
+                worker: false,
+            }
+        );
+    }
+
+    #[test]
+    fn every_hook_node_evicts_its_cache_and_merges_rejections() {
+        for (router_only, scheduler) in [(true, false), (false, true), (false, false)] {
+            let tasks = node_tasks(router_only, scheduler, true, false);
+            assert!(tasks.cache_watch && tasks.rejection_merge);
+        }
+    }
+
+    #[test]
+    fn every_reason_has_a_status_and_code() {
+        use HookReason::*;
+        let table = [
+            (Unauthorized, 401, "unauthorized"),
+            (InvalidToken, 401, "invalid_token"),
+            (InvalidSignature, 401, "invalid_signature"),
+            (StaleTimestamp, 401, "stale_timestamp"),
+            (CredentialInUrl, 400, "credential_in_url"),
+            (EndpointDisabled, 403, "endpoint_disabled"),
+            (WorkflowDisabled, 403, "workflow_disabled"),
+            (WorkflowNotPublished, 403, "workflow_not_published"),
+            (PayloadTooLarge, 413, "payload_too_large"),
+            (InvalidIdempotencyKey, 400, "invalid_idempotency_key"),
+            (IdempotencyKeyReused, 422, "idempotency_key_reused"),
+            (RateLimited, 429, "rate_limited"),
+            (QueueFull, 503, "queue_full"),
+            (WorkerUnavailable, 503, "worker_unavailable"),
+            (RunNotFound, 404, "run_not_found"),
+            (InternalError, 500, "internal_error"),
+            (RequestTimeout, 408, "request_timeout"),
+        ];
+        for (reason, status, code) in table {
+            assert_eq!(reason.status(), status, "{reason:?}");
+            assert_eq!(reason.code(), code, "{reason:?}");
+            assert!(!reason.message().is_empty(), "{reason:?}");
+            let text = format!("{} {}", reason.message(), reason.hint().unwrap_or_default());
+            assert!(!text.contains("trigger step"), "{reason:?}: {text}");
+        }
+        assert_eq!(
+            EndpointDisabled.hint(),
+            Some("Turn the endpoint on in the workflow's HTTP endpoint settings")
+        );
+        for identity in [InvalidToken, InvalidSignature, StaleTimestamp] {
+            assert_eq!(identity.public(), Unauthorized);
+            assert!(identity.is_recorded());
+        }
+        for (reason, ..) in table {
+            if !matches!(reason, InvalidToken | InvalidSignature | StaleTimestamp) {
+                assert_eq!(reason.public(), reason);
+            }
+        }
+        assert!(!Unauthorized.is_recorded());
+        assert!(!RunNotFound.is_recorded());
+        assert!(!InternalError.is_recorded());
+        assert!(!RequestTimeout.is_recorded());
+        assert_eq!(
+            table
+                .iter()
+                .filter(|(reason, ..)| reason.is_recorded())
+                .count(),
+            13,
+            "the stored reasons are the 13 the rejections panel names"
+        );
+        assert!(Unauthorized.hint().is_none());
+        assert!(CredentialInUrl.hint().is_some());
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_body_read_past_the_deadline_is_a_request_timeout() {
+        let started = tokio::time::Instant::now();
+        let stalled = read_within_deadline(std::future::pending::<Result<(), HookReason>>()).await;
+        assert_eq!(stalled, Err(HookReason::RequestTimeout));
+        assert_eq!(started.elapsed(), BODY_READ_TIMEOUT);
+        assert_eq!(read_within_deadline(async { Ok(7) }).await, Ok(7));
+        assert_eq!(
+            read_within_deadline(async { Err::<(), _>(HookReason::PayloadTooLarge) }).await,
+            Err(HookReason::PayloadTooLarge)
+        );
+    }
+
+    #[test]
+    fn schedulers_get_the_worker() {
+        let tasks = node_tasks(false, true, true, false);
+        assert!(tasks.worker);
+        assert!(tasks.wake_coalescer);
+        assert!(
+            !tasks.workflow_cache_watch,
+            "a scheduler already runs the workflow watch from jobs::init"
+        );
+        assert!(!node_tasks(false, false, true, false).worker);
+    }
+
+    #[test]
+    fn a_disabled_worker_is_not_spawned() {
+        let tasks = node_tasks(false, true, true, true);
+        assert!(!tasks.worker);
+        assert!(tasks.wake_coalescer);
+    }
+
+    #[test]
+    fn nothing_spawns_when_hooks_are_off() {
+        for (router_only, scheduler) in [(true, false), (false, true), (false, false)] {
+            assert_eq!(
+                node_tasks(router_only, scheduler, false, false),
+                NodeTasks::default()
+            );
+        }
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/payload.rs b/src/core/src/workflows/http_trigger/payload.rs
new file mode 100644
index 0000000000..97e53c83e0
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/payload.rs
@@ -0,0 +1,504 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! What a hook request becomes for the workflow's steps, and the request facts read before that.
+
+use base64::{Engine, prelude::BASE64_STANDARD};
+use http::HeaderMap;
+use infra::table::workflow_http_triggers::AuthMode;
+use serde_json::{Map, Value};
+
+use super::{
+    HookReason,
+    credentials::{SECRET_PREFIX, TOKEN_PREFIX},
+    signature::{MAX_WEBHOOK_ID_LEN, is_printable_ascii},
+};
+
+pub const HEADER_ALLOWLIST: [&str; 13] = [
+    "content-type",
+    "content-length",
+    "user-agent",
+    "x-request-id",
+    "x-correlation-id",
+    "traceparent",
+    "tracestate",
+    "webhook-id",
+    "webhook-timestamp",
+    "idempotency-key",
+    "x-github-event",
+    "x-github-delivery",
+    "x-event-type",
+];
+pub const REFUSED_QUERY_NAMES: [&str; 5] = ["token", "access_token", "api_key", "apikey", "secret"];
+pub const MAX_META_HEADERS_BYTES: usize = 8 * 1024;
+pub const MAX_META_QUERY_BYTES: usize = 2 * 1024;
+pub const EVENT_TYPE: &str = "webhook";
+/// Set only on HTTP runs, so a step can tell them apart from the workflow's own trigger kind.
+pub const TRIGGER_SOURCE: &str = "http";
+pub const DRY_RUN_PARAM: &str = "dry_run";
+const ENCODED_TOKEN_PREFIX: &str = "o2wh%5f";
+const ENCODED_SECRET_PREFIX: &str = "whsec%5f";
+const HOOK_SEGMENTS: &str = "/workflows/hooks/";
+
+#[derive(Clone, Debug, PartialEq, serde::Serialize)]
+pub struct HookInput {
+    pub meta: HookMeta,
+    pub data: Vec<Value>,
+}
+
+#[derive(Clone, Debug, PartialEq, serde::Serialize)]
+pub struct HookMeta {
+    pub event_type: &'static str,
+    pub trigger_source: &'static str,
+    pub trigger_id: String,
+    pub run_id: String,
+    pub received_at: i64,
+    pub query: Map<String, Value>,
+    pub headers: Map<String, Value>,
+}
+
+/// Only the trigger and run segments and the query carry what a caller pastes; the org cannot.
+pub fn credential_in_url(path: &str, query: Option<&str>) -> bool {
+    let hook_segments = path
+        .split_once(HOOK_SEGMENTS)
+        .map_or(path, |(_, tail)| tail);
+    hook_segments.split('/').any(is_credential_value)
+        || query.is_some_and(|q| {
+            url::form_urlencoded::parse(q.as_bytes()).any(|(name, value)| {
+                REFUSED_QUERY_NAMES
+                    .iter()
+                    .any(|refused| name.eq_ignore_ascii_case(refused))
+                    || is_credential_value(&name)
+                    || is_credential_value(&value)
+            })
+        })
+}
+
+pub fn map_body(body: &[u8]) -> Vec<Value> {
+    match serde_json::from_slice::<Value>(body) {
+        Ok(Value::Array(items)) => items,
+        Ok(object @ Value::Object(_)) => vec![object],
+        _ => match std::str::from_utf8(body) {
+            Ok(text) => vec![serde_json::json!({ "body": text })],
+            Err(_) => vec![serde_json::json!({ "body_base64": BASE64_STANDARD.encode(body) })],
+        },
+    }
+}
+
+/// Walks the allowlist in its fixed order, so the cap drops the same headers on every call.
+pub fn kept_headers(headers: &HeaderMap) -> Map<String, Value> {
+    let mut kept = Map::new();
+    let mut used = 0;
+    for name in HEADER_ALLOWLIST {
+        let values: Vec<&str> = headers
+            .get_all(name)
+            .iter()
+            .filter_map(|v| v.to_str().ok())
+            .collect();
+        if values.is_empty() {
+            continue;
+        }
+        let value = values.join(", ");
+        let size = name.len() + value.len();
+        if used + size > MAX_META_HEADERS_BYTES {
+            continue;
+        }
+        used += size;
+        kept.insert(name.to_string(), Value::String(value));
+    }
+    kept
+}
+
+pub fn kept_query(query: Option<&str>) -> Map<String, Value> {
+    let mut kept = Map::new();
+    let mut used = 0;
+    for (name, value) in url::form_urlencoded::parse(query.unwrap_or_default().as_bytes()) {
+        if name == DRY_RUN_PARAM {
+            continue;
+        }
+        let size = name.len() + value.len();
+        if used + size > MAX_META_QUERY_BYTES {
+            continue;
+        }
+        used += size;
+        let value = Value::String(value.into_owned());
+        match kept.get_mut(name.as_ref()) {
+            Some(Value::Array(values)) => values.push(value),
+            Some(existing) => *existing = Value::Array(vec![existing.take(), value]),
+            None => {
+                kept.insert(name.into_owned(), value);
+            }
+        }
+    }
+    kept
+}
+
+pub fn build_input(
+    trigger_id: &str,
+    run_id: &str,
+    received_at_us: i64,
+    headers: &HeaderMap,
+    query: Option<&str>,
+    body: &[u8],
+) -> HookInput {
+    HookInput {
+        meta: HookMeta {
+            event_type: EVENT_TYPE,
+            trigger_source: TRIGGER_SOURCE,
+            trigger_id: trigger_id.to_string(),
+            run_id: run_id.to_string(),
+            received_at: received_at_us,
+            query: kept_query(query),
+            headers: kept_headers(headers),
+        },
+        data: map_body(body),
+    }
+}
+
+pub fn bearer_token(headers: &HeaderMap) -> Option<&str> {
+    let value = headers.get(http::header::AUTHORIZATION)?.to_str().ok()?;
+    let (scheme, token) = value.split_once(' ')?;
+    scheme.eq_ignore_ascii_case("bearer").then(|| token.trim())
+}
+
+pub fn idempotency_key(headers: &HeaderMap, mode: AuthMode) -> Result<Option<String>, HookReason> {
+    let name = match mode {
+        AuthMode::Token => "idempotency-key",
+        AuthMode::Signature => "webhook-id",
+    };
+    let Some(value) = headers.get(name) else {
+        return Ok(None);
+    };
+    let bytes = value.as_bytes();
+    if bytes.is_empty()
+        || bytes.len() > MAX_WEBHOOK_ID_LEN
+        || !bytes.iter().copied().all(is_printable_ascii)
+    {
+        return Err(HookReason::InvalidIdempotencyKey);
+    }
+    Ok(Some(String::from_utf8_lossy(bytes).into_owned()))
+}
+
+/// A query flag, not a header, so a browser test needs no extra CORS header.
+pub fn is_dry_run(query: Option<&str>) -> bool {
+    url::form_urlencoded::parse(query.unwrap_or_default().as_bytes())
+        .any(|(name, value)| name == DRY_RUN_PARAM && value.trim().eq_ignore_ascii_case("true"))
+}
+
+/// Raw path segments are not percent-decoded, so the encoded underscore is matched too.
+pub fn is_credential_value(value: &str) -> bool {
+    let lower = value.to_ascii_lowercase();
+    [
+        TOKEN_PREFIX,
+        SECRET_PREFIX,
+        ENCODED_TOKEN_PREFIX,
+        ENCODED_SECRET_PREFIX,
+    ]
+    .iter()
+    .any(|prefix| lower.starts_with(prefix))
+}
+
+#[cfg(test)]
+mod tests {
+    use http::HeaderValue;
+    use serde_json::json;
+
+    use super::*;
+
+    fn header_map(pairs: &[(&str, &str)]) -> HeaderMap {
+        let mut map = HeaderMap::new();
+        for (name, value) in pairs {
+            map.append(
+                http::HeaderName::from_bytes(name.as_bytes()).unwrap(),
+                HeaderValue::from_str(value).unwrap(),
+            );
+        }
+        map
+    }
+
+    #[test]
+    fn credential_names_in_the_query_are_refused() {
+        for query in [
+            "token=x",
+            "a=1&ACCESS_TOKEN=x",
+            "api_key=x",
+            "ApiKey=x",
+            "secret",
+            "secret=",
+        ] {
+            assert!(
+                credential_in_url("/api/v2/o/workflows/hooks/t", Some(query)),
+                "{query}"
+            );
+        }
+        assert!(credential_in_url("/x", Some("v=o2wh_abc")));
+        assert!(credential_in_url("/x", Some("v=whsec_abc")));
+        assert!(
+            credential_in_url("/x", Some("v=o2wh%5Fabc")),
+            "a percent-encoded prefix is refused"
+        );
+    }
+
+    #[test]
+    fn a_param_named_key_is_allowed() {
+        assert!(!credential_in_url(
+            "/api/v2/o/workflows/hooks/t",
+            Some("key=deploy")
+        ));
+        assert!(!credential_in_url(
+            "/api/v2/o/workflows/hooks/t",
+            Some("tokens=1&secretary=2")
+        ));
+        assert!(!credential_in_url("/api/v2/o/workflows/hooks/t", None));
+    }
+
+    #[test]
+    fn a_prefixed_value_in_the_path_is_refused() {
+        assert!(credential_in_url(
+            "/api/v2/o/workflows/hooks/o2wh_abc",
+            None
+        ));
+        assert!(credential_in_url(
+            "/api/v2/o/workflows/hooks/t/runs/whsec_abc",
+            None
+        ));
+        assert!(credential_in_url(
+            "/api/v2/o/workflows/hooks/O2WH%5Fabc",
+            None
+        ));
+        assert!(!credential_in_url(
+            "/api/v2/o/workflows/hooks/xo2wh_abc",
+            None
+        ));
+    }
+
+    #[test]
+    fn only_segments_after_hooks_are_checked() {
+        assert!(!credential_in_url(
+            "/api/v2/whsec_lab/workflows/hooks/t1",
+            None
+        ));
+        assert!(!credential_in_url(
+            "/o2wh_base/api/v2/whsec_lab/workflows/hooks/t1/runs/r1",
+            None
+        ));
+        assert!(credential_in_url(
+            "/api/v2/whsec_lab/workflows/hooks/o2wh_abc",
+            None
+        ));
+        assert!(credential_in_url(
+            "/api/v2/whsec_lab/workflows/hooks/t1",
+            Some("v=whsec_abc")
+        ));
+    }
+
+    #[test]
+    fn an_array_body_maps_to_itself() {
+        assert_eq!(map_body(br#"[{"a":1},2]"#), vec![json!({"a":1}), json!(2)]);
+        assert_eq!(map_body(b"[]"), Vec::<Value>::new());
+    }
+
+    #[test]
+    fn an_object_body_is_wrapped() {
+        assert_eq!(
+            map_body(br#"{"event":"deploy"}"#),
+            vec![json!({"event":"deploy"})]
+        );
+    }
+
+    #[test]
+    fn text_body_maps_to_body_field() {
+        assert_eq!(map_body(b"hello"), vec![json!({"body":"hello"})]);
+        assert_eq!(map_body(b"42"), vec![json!({"body":"42"})]);
+        assert_eq!(map_body(b""), vec![json!({"body":""})]);
+    }
+
+    #[test]
+    fn binary_body_maps_to_body_base64() {
+        let bytes = [0xff_u8, 0x00, 0xfe];
+        assert_eq!(
+            map_body(&bytes),
+            vec![json!({"body_base64": BASE64_STANDARD.encode(bytes)})]
+        );
+    }
+
+    #[test]
+    fn only_allowlisted_headers_reach_meta() {
+        let headers = header_map(&[
+            ("Content-Type", "application/json"),
+            ("authorization", "Bearer o2wh_secret"),
+            ("cookie", "s=1"),
+            ("webhook-signature", "v1,abc"),
+            ("x-api-key", "k"),
+            ("x-github-event", "push"),
+            ("x-custom", "1"),
+        ]);
+        let kept = kept_headers(&headers);
+        assert_eq!(kept.get("content-type"), Some(&json!("application/json")));
+        assert_eq!(kept.get("x-github-event"), Some(&json!("push")));
+        assert_eq!(kept.len(), 2, "{kept:?}");
+    }
+
+    #[test]
+    fn idempotency_key_header_is_kept() {
+        let kept = kept_headers(&header_map(&[("Idempotency-Key", "deploy-42")]));
+        assert_eq!(kept.get("idempotency-key"), Some(&json!("deploy-42")));
+    }
+
+    #[test]
+    fn headers_are_capped_at_8_kib() {
+        let big = "a".repeat(5000);
+        let headers = header_map(&[
+            ("user-agent", &big),
+            ("x-request-id", &big),
+            ("content-type", "text/plain"),
+        ]);
+        let kept = kept_headers(&headers);
+        let size: usize = kept
+            .iter()
+            .map(|(k, v)| k.len() + v.as_str().map_or(0, str::len))
+            .sum();
+        assert!(size <= MAX_META_HEADERS_BYTES, "{size}");
+        assert!(kept.contains_key("user-agent"));
+        assert!(!kept.contains_key("x-request-id"));
+        assert!(kept.contains_key("content-type"));
+    }
+
+    #[test]
+    fn query_is_capped_at_2_kib() {
+        let query = format!("a=1&b={}&c=3&a=2", "x".repeat(3000));
+        let kept = kept_query(Some(&query));
+        assert_eq!(kept.get("a"), Some(&json!(["1", "2"])));
+        assert_eq!(kept.get("c"), Some(&json!("3")));
+        assert!(!kept.contains_key("b"));
+        assert_eq!(kept_query(Some("k=v%20w")).get("k"), Some(&json!("v w")));
+        assert!(kept_query(None).is_empty());
+    }
+
+    #[test]
+    fn hook_input_has_meta_and_data() {
+        let headers = header_map(&[("content-type", "application/json")]);
+        let input = build_input(
+            "t1",
+            "r1",
+            1_792_579_200_000_000,
+            &headers,
+            Some("k=v"),
+            br#"{"a":1}"#,
+        );
+        assert_eq!(
+            serde_json::to_value(&input).unwrap(),
+            json!({
+                "meta": {
+                    "event_type": "webhook",
+                    "trigger_source": "http",
+                    "trigger_id": "t1",
+                    "run_id": "r1",
+                    "received_at": 1_792_579_200_000_000_i64,
+                    "query": {"k": "v"},
+                    "headers": {"content-type": "application/json"},
+                },
+                "data": [{"a": 1}],
+            })
+        );
+    }
+
+    #[test]
+    fn received_at_is_microseconds() {
+        let now = config::utils::time::now_micros();
+        let input = build_input("t", "r", now, &HeaderMap::new(), None, b"[]");
+        assert_eq!(input.meta.received_at, now);
+        assert!(
+            input.meta.received_at > 1_000_000_000_000_000,
+            "µs since the epoch"
+        );
+    }
+
+    #[test]
+    fn only_a_bearer_authorization_carries_the_token() {
+        let token = "o2wh_abc";
+        assert_eq!(
+            bearer_token(&header_map(&[("authorization", "Bearer o2wh_abc")])),
+            Some(token)
+        );
+        assert_eq!(
+            bearer_token(&header_map(&[("authorization", "bearer o2wh_abc")])),
+            Some(token)
+        );
+        assert_eq!(
+            bearer_token(&header_map(&[("authorization", "Basic o2wh_abc")])),
+            None
+        );
+        assert_eq!(
+            bearer_token(&header_map(&[("x-api-key", "o2wh_abc")])),
+            None
+        );
+        assert_eq!(bearer_token(&HeaderMap::new()), None);
+    }
+
+    #[test]
+    fn idempotency_keys_are_printable_ascii_up_to_255() {
+        let token = AuthMode::Token;
+        assert_eq!(idempotency_key(&HeaderMap::new(), token), Ok(None));
+        assert_eq!(
+            idempotency_key(&header_map(&[("idempotency-key", "deploy-42")]), token),
+            Ok(Some("deploy-42".to_string()))
+        );
+        assert_eq!(
+            idempotency_key(&header_map(&[("webhook-id", "msg_1")]), AuthMode::Signature),
+            Ok(Some("msg_1".to_string()))
+        );
+        assert_eq!(
+            idempotency_key(&header_map(&[("webhook-id", "msg_1")]), token),
+            Ok(None),
+            "token mode keys on Idempotency-Key only"
+        );
+        for bad in ["", &"k".repeat(256)] {
+            assert_eq!(
+                idempotency_key(&header_map(&[("idempotency-key", bad)]), token),
+                Err(HookReason::InvalidIdempotencyKey),
+                "{bad:?}"
+            );
+        }
+        let mut tabbed = HeaderMap::new();
+        tabbed.insert("idempotency-key", HeaderValue::from_static("a\tb"));
+        assert_eq!(
+            idempotency_key(&tabbed, token),
+            Err(HookReason::InvalidIdempotencyKey)
+        );
+    }
+
+    #[test]
+    fn the_dry_run_param_must_say_true() {
+        assert!(is_dry_run(Some("dry_run=true")));
+        assert!(is_dry_run(Some("a=1&dry_run=TRUE")));
+        assert!(!is_dry_run(Some("dry_run=1")));
+        assert!(!is_dry_run(Some("dry_run=false")));
+        assert!(!is_dry_run(None));
+    }
+
+    #[test]
+    fn the_dry_run_param_is_not_part_of_the_run_input() {
+        let kept = kept_query(Some("env=prod&dry_run=true"));
+        assert_eq!(kept.get("env"), Some(&json!("prod")));
+        assert!(!kept.contains_key("dry_run"));
+    }
+
+    #[test]
+    fn the_old_dry_run_header_is_not_kept() {
+        let kept = kept_headers(&header_map(&[("x-o2-dry-run", "true")]));
+        assert!(kept.is_empty());
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/rejections.rs b/src/core/src/workflows/http_trigger/rejections.rs
new file mode 100644
index 0000000000..6ab16fbccd
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/rejections.rs
@@ -0,0 +1,383 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Per-node rejection and credential-use counters, merged into the trigger rows once a minute.
+
+use std::{collections::BTreeMap, sync::LazyLock, time::Duration};
+
+use config::utils::time::now_micros;
+use infra::{
+    db::get_orm_client_rw,
+    table::workflow_http_triggers::{self as triggers, RejectionDelta},
+};
+use parking_lot::Mutex;
+use sea_orm::TransactionTrait;
+
+use super::{HookReason, payload::is_credential_value};
+
+const MERGE_EVERY: Duration = Duration::from_secs(60);
+const AUDIT_EVERY_US: i64 = 60 * 1_000_000;
+// Bounds the per-node maps however many triggers a flood names.
+const MAX_PENDING_TRIGGERS: usize = 10_000;
+// Minted ids are 22 characters; a longer path segment cannot name a trigger.
+const MAX_TRIGGER_ID_LEN: usize = 64;
+
+static PENDING: LazyLock<Mutex<PendingRejections>> = LazyLock::new(Default::default);
+
+#[derive(Default)]
+struct PendingRejections {
+    deltas: BTreeMap<String, BTreeMap<String, RejectionDelta>>,
+    used: BTreeMap<String, (i64, Vec<String>)>,
+    audited: BTreeMap<(String, HookReason), i64>,
+}
+
+impl PendingRejections {
+    fn record(&mut self, trigger_id: &str, reason: HookReason, caller_ip: &str, now_us: i64) {
+        if !reason.is_recorded() || !is_recordable_id(trigger_id) {
+            return;
+        }
+        if !self.deltas.contains_key(trigger_id) && self.deltas.len() >= MAX_PENDING_TRIGGERS {
+            return;
+        }
+        let delta = self
+            .deltas
+            .entry(trigger_id.to_string())
+            .or_default()
+            .entry(reason.code().to_string())
+            .or_insert_with(|| RejectionDelta {
+                count: 0,
+                last_at: now_us,
+                last_ip: caller_ip.to_string(),
+            });
+        delta.count = delta.count.saturating_add(1);
+        if now_us >= delta.last_at {
+            delta.last_at = now_us;
+            delta.last_ip = caller_ip.to_string();
+        }
+    }
+
+    fn record_use(&mut self, trigger_id: &str, credential_id: &str, now_us: i64) {
+        if !self.used.contains_key(trigger_id) && self.used.len() >= MAX_PENDING_TRIGGERS {
+            return;
+        }
+        let (last, credentials) = self
+            .used
+            .entry(trigger_id.to_string())
+            .or_insert_with(|| (now_us, Vec::new()));
+        *last = (*last).max(now_us);
+        if !credentials.iter().any(|c| c == credential_id) {
+            credentials.push(credential_id.to_string());
+        }
+    }
+
+    fn should_audit(&mut self, trigger_id: &str, reason: HookReason, now_us: i64) -> bool {
+        if self.audited.len() >= MAX_PENDING_TRIGGERS {
+            self.audited.retain(|_, at| now_us - *at < AUDIT_EVERY_US);
+        }
+        let key = (trigger_id.to_string(), reason);
+        if self
+            .audited
+            .get(&key)
+            .is_some_and(|at| now_us - at < AUDIT_EVERY_US)
+        {
+            return false;
+        }
+        if self.audited.len() >= MAX_PENDING_TRIGGERS {
+            return false;
+        }
+        self.audited.insert(key, now_us);
+        true
+    }
+
+    /// Drains the counters for a merge pass; the audit marks stay, so sampling spans passes.
+    fn take(&mut self) -> Self {
+        Self {
+            deltas: std::mem::take(&mut self.deltas),
+            used: std::mem::take(&mut self.used),
+            audited: BTreeMap::new(),
+        }
+    }
+}
+
+/// A pasted credential is never a map key, a lookup key or a log field.
+pub fn is_recordable_id(trigger_id: &str) -> bool {
+    trigger_id.len() <= MAX_TRIGGER_ID_LEN && !is_credential_value(trigger_id)
+}
+
+pub fn record(trigger_id: &str, reason: HookReason, caller_ip: &str, now_us: i64) {
+    PENDING.lock().record(trigger_id, reason, caller_ip, now_us);
+}
+
+pub fn record_use(trigger_id: &str, credential_id: &str, now_us: i64) {
+    PENDING.lock().record_use(trigger_id, credential_id, now_us);
+}
+
+pub fn should_audit(trigger_id: &str, reason: HookReason, now_us: i64) -> bool {
+    PENDING.lock().should_audit(trigger_id, reason, now_us)
+}
+
+pub async fn run_merge_loop() {
+    let mut interval = tokio::time::interval(MERGE_EVERY);
+    interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Delay);
+    interval.tick().await;
+    loop {
+        interval.tick().await;
+        if let Err(e) = flush(now_micros()).await {
+            log::error!("[WORKFLOW_HOOK] rejection merge failed: {e}");
+        }
+    }
+}
+
+async fn flush(now_us: i64) -> Result<(), anyhow::Error> {
+    let pending = PENDING.lock().take();
+    flush_into(get_orm_client_rw().await, pending, now_us).await
+}
+
+/// Writes every trigger it can; a missing row (unknown or swept id) is skipped by the merge itself.
+async fn flush_into<C: TransactionTrait>(
+    db: &C,
+    pending: PendingRejections,
+    now_us: i64,
+) -> Result<(), anyhow::Error> {
+    let mut failed = 0;
+    for (trigger_id, deltas) in &pending.deltas {
+        if let Err(e) = triggers::merge_rejections(db, trigger_id, deltas, now_us).await {
+            log::warn!("[WORKFLOW_HOOK] rejections of trigger {trigger_id} not merged: {e}");
+            failed += 1;
+        }
+    }
+    for (trigger_id, (invoked_at, credential_ids)) in &pending.used {
+        let txn = db.begin().await?;
+        let touched =
+            triggers::touch_last_used(&txn, trigger_id, *invoked_at, credential_ids).await;
+        match touched {
+            Ok(()) => txn.commit().await?,
+            Err(e) => {
+                txn.rollback().await?;
+                log::warn!("[WORKFLOW_HOOK] last use of trigger {trigger_id} not written: {e}");
+                failed += 1;
+            }
+        }
+    }
+    if failed > 0 {
+        anyhow::bail!("{failed} trigger rows not merged");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use infra::table::{
+        entity::workflow_http_triggers::Model as TriggerRow,
+        workflow_http_triggers::{RejectionEntry, create_tables_for_tests},
+    };
+    use sea_orm::Database;
+
+    use super::*;
+
+    const MINUTE_US: i64 = 60 * 1_000_000;
+    const DAY_US: i64 = 24 * 3600 * 1_000_000;
+
+    fn trigger_row(id: &str) -> TriggerRow {
+        TriggerRow {
+            id: id.to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: format!("wf-{id}"),
+            enabled: true,
+            auth_mode: "token".to_string(),
+            max_body_bytes: 1024,
+            rate_limit_per_minute: 60,
+            created_by: "a@acme.io".to_string(),
+            created_at: 1,
+            updated_at: 7,
+            version: 3,
+            origin_cluster: "local".to_string(),
+            deleted_at: None,
+            last_invoked_at: None,
+            rejections: None,
+        }
+    }
+
+    async fn db_with(ids: &[&str]) -> sea_orm::DatabaseConnection {
+        let db = Database::connect("sqlite::memory:").await.unwrap();
+        create_tables_for_tests(&db).await.unwrap();
+        for id in ids {
+            triggers::insert_trigger(&db, trigger_row(id))
+                .await
+                .unwrap();
+        }
+        db
+    }
+
+    async fn stored(
+        db: &sea_orm::DatabaseConnection,
+        id: &str,
+    ) -> BTreeMap<String, RejectionEntry> {
+        let row = triggers::get(db, id).await.unwrap().unwrap();
+        row.rejections
+            .as_deref()
+            .map(|raw| serde_json::from_str(raw).unwrap())
+            .unwrap_or_default()
+    }
+
+    #[tokio::test]
+    async fn merge_adds_deltas_within_the_window() {
+        let db = db_with(&["t1"]).await;
+        let mut pending = PendingRejections::default();
+        pending.record("t1", HookReason::InvalidToken, "203.0.113.1", 100);
+        pending.record("t1", HookReason::InvalidToken, "203.0.113.2", 200);
+        flush_into(&db, pending, 1_000).await.unwrap();
+        let mut pending = PendingRejections::default();
+        pending.record("t1", HookReason::InvalidToken, "203.0.113.3", MINUTE_US);
+        flush_into(&db, pending, MINUTE_US + 1).await.unwrap();
+        let entry = &stored(&db, "t1").await["invalid_token"];
+        assert_eq!(entry.count_24h, 3);
+        assert_eq!(entry.last_at, MINUTE_US);
+        assert_eq!(entry.last_ip, "203.0.113.3");
+    }
+
+    #[tokio::test]
+    async fn merge_resets_after_twenty_four_hours() {
+        let db = db_with(&["t1"]).await;
+        let mut pending = PendingRejections::default();
+        pending.record("t1", HookReason::RateLimited, "203.0.113.1", 100);
+        pending.record("t1", HookReason::RateLimited, "203.0.113.1", 101);
+        flush_into(&db, pending, 1_000).await.unwrap();
+        let mut pending = PendingRejections::default();
+        pending.record("t1", HookReason::RateLimited, "203.0.113.9", DAY_US + 2_000);
+        flush_into(&db, pending, DAY_US + 2_000).await.unwrap();
+        assert_eq!(stored(&db, "t1").await["rate_limited"].count_24h, 1);
+    }
+
+    #[tokio::test]
+    async fn merge_keeps_the_newer_ip() {
+        let mut pending = PendingRejections::default();
+        pending.record("t1", HookReason::StaleTimestamp, "203.0.113.2", 500);
+        pending.record("t1", HookReason::StaleTimestamp, "203.0.113.1", 400);
+        let delta = &pending.deltas["t1"]["stale_timestamp"];
+        assert_eq!(delta.count, 2);
+        assert_eq!(delta.last_at, 500);
+        assert_eq!(delta.last_ip, "203.0.113.2");
+    }
+
+    #[tokio::test]
+    async fn stored_reason_is_specific_not_unauthorized() {
+        let mut pending = PendingRejections::default();
+        pending.record("t1", HookReason::Unauthorized, "203.0.113.1", 1);
+        pending.record("t1", HookReason::InternalError, "203.0.113.1", 1);
+        pending.record("t1", HookReason::RunNotFound, "203.0.113.1", 1);
+        assert!(pending.deltas.is_empty());
+        pending.record("t1", HookReason::InvalidSignature, "203.0.113.1", 1);
+        assert_eq!(
+            pending.deltas["t1"].keys().collect::<Vec<_>>(),
+            vec!["invalid_signature"]
+        );
+    }
+
+    #[tokio::test]
+    async fn merge_leaves_version_and_updated_at() {
+        let db = db_with(&["t1"]).await;
+        let mut pending = PendingRejections::default();
+        pending.record("t1", HookReason::CredentialInUrl, "203.0.113.1", 5);
+        pending.record_use("t1", "c1", 5);
+        flush_into(&db, pending, 10).await.unwrap();
+        let row = triggers::get(&db, "t1").await.unwrap().unwrap();
+        assert_eq!((row.version, row.updated_at), (3, 7));
+        assert_eq!(row.last_invoked_at, Some(5));
+    }
+
+    #[tokio::test]
+    async fn an_unknown_trigger_id_is_skipped() {
+        let db = db_with(&["t1"]).await;
+        let mut pending = PendingRejections::default();
+        pending.record("nope", HookReason::CredentialInUrl, "203.0.113.1", 5);
+        pending.record("t1", HookReason::CredentialInUrl, "203.0.113.1", 5);
+        flush_into(&db, pending, 10).await.unwrap();
+        assert_eq!(stored(&db, "t1").await["credential_in_url"].count_24h, 1);
+    }
+
+    #[test]
+    fn pending_triggers_are_bounded() {
+        let mut pending = PendingRejections::default();
+        for i in 0..MAX_PENDING_TRIGGERS + 5 {
+            pending.record(&format!("t{i}"), HookReason::CredentialInUrl, "ip", 1);
+        }
+        assert_eq!(pending.deltas.len(), MAX_PENDING_TRIGGERS);
+        let mut fresh = PendingRejections::default();
+        fresh.record(
+            &"t".repeat(MAX_TRIGGER_ID_LEN + 1),
+            HookReason::CredentialInUrl,
+            "ip",
+            1,
+        );
+        assert!(
+            fresh.deltas.is_empty(),
+            "an overlong path segment is never kept"
+        );
+        pending.record("t0", HookReason::CredentialInUrl, "ip", 2);
+        assert_eq!(pending.deltas["t0"]["credential_in_url"].count, 2);
+    }
+
+    #[test]
+    fn a_credential_shaped_id_is_never_a_key() {
+        let mut pending = PendingRejections::default();
+        for id in [
+            "o2wh_AbCdEfGhIjKlMnOpQrStUvWxYz0123",
+            "WHSEC%5Fabc",
+            "whsec_abc",
+        ] {
+            pending.record(id, HookReason::PayloadTooLarge, "ip", 1);
+        }
+        assert!(pending.deltas.is_empty(), "{:?}", pending.deltas.keys());
+    }
+
+    #[test]
+    fn rejection_audit_is_sampled_once_per_minute_per_reason() {
+        let mut pending = PendingRejections::default();
+        assert!(pending.should_audit("t1", HookReason::InvalidToken, 0));
+        assert!(!pending.should_audit("t1", HookReason::InvalidToken, MINUTE_US - 1));
+        assert!(pending.should_audit("t1", HookReason::RateLimited, 1));
+        assert!(pending.should_audit("t2", HookReason::InvalidToken, 1));
+        assert!(pending.should_audit("t1", HookReason::InvalidToken, MINUTE_US));
+        let _ = pending.take();
+        assert!(
+            !pending.should_audit("t1", HookReason::InvalidToken, MINUTE_US + 1),
+            "a merge pass keeps the audit marks"
+        );
+    }
+
+    #[tokio::test]
+    async fn last_used_is_written_at_most_once_a_minute() {
+        let db = db_with(&["t1"]).await;
+        let mut pending = PendingRejections::default();
+        pending.record_use("t1", "c1", 30);
+        pending.record_use("t1", "c1", 10);
+        pending.record_use("t1", "c2", 20);
+        assert_eq!(
+            pending.used["t1"],
+            (30, vec!["c1".to_string(), "c2".to_string()])
+        );
+        flush_into(&db, pending, 40).await.unwrap();
+        assert_eq!(
+            triggers::get(&db, "t1")
+                .await
+                .unwrap()
+                .unwrap()
+                .last_invoked_at,
+            Some(30)
+        );
+        assert_eq!(MERGE_EVERY, Duration::from_secs(60));
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/signature.rs b/src/core/src/workflows/http_trigger/signature.rs
new file mode 100644
index 0000000000..7e7eee0aed
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/signature.rs
@@ -0,0 +1,385 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Standard Webhooks `v1` signatures, over the body for an invoke and over `GET {path}` for a poll.
+
+use base64::{Engine, prelude::BASE64_STANDARD};
+use config::utils::str::constant_time_eq;
+use hmac::{Hmac, Mac};
+use sha2::Sha256;
+
+use super::credentials::SECRET_PREFIX;
+
+pub const TOLERANCE_SECS: i64 = 300;
+pub const DUMMY_HMAC_MAX_BYTES: usize = 64 * 1024;
+pub const MAX_WEBHOOK_ID_LEN: usize = 255;
+const POLL_PREFIX: &[u8] = b"GET /";
+const DUMMY_KEY: &[u8] = b"workflow-hook-dummy-key";
+
+static DUMMY_BODY: [u8; DUMMY_HMAC_MAX_BYTES] = [0; DUMMY_HMAC_MAX_BYTES];
+
+#[derive(Clone, Copy, Debug)]
+pub struct WebhookHeaders<'a> {
+    pub id: &'a str,
+    pub timestamp: &'a str,
+    pub signature: &'a str,
+}
+
+#[derive(Clone, Copy, Debug)]
+pub enum SignedContent<'a> {
+    Invoke(&'a [u8]),
+    Poll(&'a str),
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum SigError {
+    Missing,
+    Malformed,
+    StaleTimestamp,
+    Mismatch,
+}
+
+pub fn decode_secret(secret: &str) -> Option<Vec<u8>> {
+    let encoded = secret.strip_prefix(SECRET_PREFIX).unwrap_or(secret);
+    BASE64_STANDARD
+        .decode(encoded)
+        .ok()
+        .filter(|key| !key.is_empty())
+}
+
+pub fn sign(key: &[u8], id: &str, timestamp: i64, content: SignedContent<'_>) -> String {
+    let mac = hmac(key, &signed_bytes(id, &timestamp.to_string(), content));
+    format!("v1,{}", BASE64_STANDARD.encode(mac))
+}
+
+pub fn verify(
+    headers: &WebhookHeaders<'_>,
+    content: SignedContent<'_>,
+    keys: &[&[u8]],
+    now_secs: i64,
+) -> Result<(), SigError> {
+    if headers.id.is_empty() || headers.timestamp.is_empty() || headers.signature.is_empty() {
+        return Err(SigError::Missing);
+    }
+    if headers.id.len() > MAX_WEBHOOK_ID_LEN || !headers.id.bytes().all(is_printable_ascii) {
+        return Err(SigError::Malformed);
+    }
+    let timestamp: i64 = headers.timestamp.parse().map_err(|_| SigError::Malformed)?;
+    if now_secs.abs_diff(timestamp) > TOLERANCE_SECS.unsigned_abs() {
+        return Err(SigError::StaleTimestamp);
+    }
+    // Poll content is `GET {path}`; an invoke body spelling it would reuse a poll signature.
+    if let SignedContent::Invoke(body) = content
+        && body.starts_with(POLL_PREFIX)
+    {
+        return Err(SigError::Mismatch);
+    }
+    let presented = parse_v1_signatures(headers.signature);
+    let message = signed_bytes(headers.id, headers.timestamp, content);
+    let mut matched = false;
+    for key in keys {
+        let expected = hmac(key, &message);
+        for candidate in &presented {
+            matched |= constant_time_eq(&expected, candidate);
+        }
+    }
+    if matched {
+        Ok(())
+    } else {
+        Err(SigError::Mismatch)
+    }
+}
+
+/// HMACs zeros as long as the declared body, so a miss never waits on a body that may not come.
+pub fn dummy_verify(declared_len: usize) {
+    let len = declared_len.min(DUMMY_HMAC_MAX_BYTES);
+    std::hint::black_box(hmac(DUMMY_KEY, &DUMMY_BODY[..len]));
+}
+
+pub fn is_printable_ascii(byte: u8) -> bool {
+    byte == b' ' || byte.is_ascii_graphic()
+}
+
+fn signed_bytes(id: &str, timestamp: &str, content: SignedContent<'_>) -> Vec<u8> {
+    let mut bytes = format!("{id}.{timestamp}.").into_bytes();
+    match content {
+        SignedContent::Invoke(body) => bytes.extend_from_slice(body),
+        SignedContent::Poll(path) => {
+            bytes.extend_from_slice(b"GET ");
+            bytes.extend_from_slice(path.as_bytes());
+        }
+    }
+    bytes
+}
+
+fn parse_v1_signatures(header: &str) -> Vec<Vec<u8>> {
+    header
+        .split(' ')
+        .filter_map(|entry| entry.strip_prefix("v1,"))
+        .filter_map(|encoded| BASE64_STANDARD.decode(encoded).ok())
+        .collect()
+}
+
+fn hmac(key: &[u8], message: &[u8]) -> Vec<u8> {
+    let mut mac = <Hmac<Sha256>>::new_from_slice(key).expect("HMAC accepts any key length");
+    mac.update(message);
+    mac.finalize().into_bytes().to_vec()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    const VECTOR_SECRET: &str = "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw";
+    const VECTOR_ID: &str = "msg_p5jXN8AQM9LWM0D4loKWxJek";
+    const VECTOR_TS: i64 = 1614265330;
+    const VECTOR_BODY: &[u8] = br#"{"test": 2432232314}"#;
+    const VECTOR_SIGNATURE: &str = "v1,g0hM9SsE+OTPJTGt/tmIKtSyZlE3uFJELVlNIOLJ1OE=";
+    const POLL_PATH: &str = "/api/v2/acme/workflows/hooks/t1/runs/r1";
+
+    fn headers<'a>(id: &'a str, ts: &'a str, signature: &'a str) -> WebhookHeaders<'a> {
+        WebhookHeaders {
+            id,
+            timestamp: ts,
+            signature,
+        }
+    }
+
+    #[test]
+    fn the_standard_webhooks_test_vector_verifies() {
+        let key = decode_secret(VECTOR_SECRET).unwrap();
+        assert_eq!(
+            sign(
+                &key,
+                VECTOR_ID,
+                VECTOR_TS,
+                SignedContent::Invoke(VECTOR_BODY)
+            ),
+            VECTOR_SIGNATURE
+        );
+        let ts = VECTOR_TS.to_string();
+        assert_eq!(
+            verify(
+                &headers(VECTOR_ID, &ts, VECTOR_SIGNATURE),
+                SignedContent::Invoke(VECTOR_BODY),
+                &[&key],
+                VECTOR_TS + 10,
+            ),
+            Ok(())
+        );
+        assert_eq!(
+            verify(
+                &headers(VECTOR_ID, &ts, VECTOR_SIGNATURE),
+                SignedContent::Invoke(b"{\"test\": 1}"),
+                &[&key],
+                VECTOR_TS,
+            ),
+            Err(SigError::Mismatch)
+        );
+    }
+
+    #[test]
+    fn a_timestamp_301_seconds_old_is_stale() {
+        let key = decode_secret(VECTOR_SECRET).unwrap();
+        let ts = VECTOR_TS.to_string();
+        let h = headers(VECTOR_ID, &ts, VECTOR_SIGNATURE);
+        let body = SignedContent::Invoke(VECTOR_BODY);
+        assert_eq!(verify(&h, body, &[&key], VECTOR_TS + 300), Ok(()));
+        assert_eq!(
+            verify(&h, body, &[&key], VECTOR_TS + 301),
+            Err(SigError::StaleTimestamp)
+        );
+        assert_eq!(
+            verify(&h, body, &[&key], VECTOR_TS - 301),
+            Err(SigError::StaleTimestamp)
+        );
+        assert_eq!(
+            verify(
+                &headers(VECTOR_ID, "soon", VECTOR_SIGNATURE),
+                body,
+                &[&key],
+                VECTOR_TS
+            ),
+            Err(SigError::Malformed)
+        );
+    }
+
+    #[test]
+    fn any_matching_v1_entry_is_enough() {
+        let key = decode_secret(VECTOR_SECRET).unwrap();
+        let other = decode_secret("whsec_b3RoZXItc2VjcmV0LW9mLXRoaXJ0eS10d28tYnl0").unwrap();
+        let ts = VECTOR_TS.to_string();
+        let several = format!("v1,AAAA {VECTOR_SIGNATURE} v1,BBBB");
+        let body = SignedContent::Invoke(VECTOR_BODY);
+        assert_eq!(
+            verify(&headers(VECTOR_ID, &ts, &several), body, &[&key], VECTOR_TS),
+            Ok(())
+        );
+        assert_eq!(
+            verify(
+                &headers(VECTOR_ID, &ts, VECTOR_SIGNATURE),
+                body,
+                &[&other, &key],
+                VECTOR_TS
+            ),
+            Ok(()),
+            "any live secret may match"
+        );
+        assert_eq!(
+            verify(
+                &headers(VECTOR_ID, &ts, VECTOR_SIGNATURE),
+                body,
+                &[&other],
+                VECTOR_TS
+            ),
+            Err(SigError::Mismatch)
+        );
+    }
+
+    #[test]
+    fn a_v1a_entry_is_ignored() {
+        let key = decode_secret(VECTOR_SECRET).unwrap();
+        let ts = VECTOR_TS.to_string();
+        let v1a = VECTOR_SIGNATURE.replacen("v1,", "v1a,", 1);
+        assert_eq!(
+            verify(
+                &headers(VECTOR_ID, &ts, &v1a),
+                SignedContent::Invoke(VECTOR_BODY),
+                &[&key],
+                VECTOR_TS
+            ),
+            Err(SigError::Mismatch)
+        );
+    }
+
+    #[test]
+    fn missing_or_oversized_headers_are_refused() {
+        let key = decode_secret(VECTOR_SECRET).unwrap();
+        let ts = VECTOR_TS.to_string();
+        let body = SignedContent::Invoke(VECTOR_BODY);
+        assert_eq!(
+            verify(
+                &headers("", &ts, VECTOR_SIGNATURE),
+                body,
+                &[&key],
+                VECTOR_TS
+            ),
+            Err(SigError::Missing)
+        );
+        assert_eq!(
+            verify(&headers(VECTOR_ID, &ts, ""), body, &[&key], VECTOR_TS),
+            Err(SigError::Missing)
+        );
+        let long_id = "m".repeat(MAX_WEBHOOK_ID_LEN + 1);
+        assert_eq!(
+            verify(
+                &headers(&long_id, &ts, VECTOR_SIGNATURE),
+                body,
+                &[&key],
+                VECTOR_TS
+            ),
+            Err(SigError::Malformed)
+        );
+        assert_eq!(decode_secret("whsec_***"), None);
+    }
+
+    #[test]
+    fn a_poll_signature_never_verifies_an_invoke() {
+        let key = decode_secret(VECTOR_SECRET).unwrap();
+        let ts = VECTOR_TS.to_string();
+        let poll = sign(&key, VECTOR_ID, VECTOR_TS, SignedContent::Poll(POLL_PATH));
+        let h = headers(VECTOR_ID, &ts, &poll);
+        assert_eq!(
+            verify(&h, SignedContent::Poll(POLL_PATH), &[&key], VECTOR_TS),
+            Ok(())
+        );
+        let same_bytes = format!("GET {POLL_PATH}");
+        assert_eq!(
+            verify(
+                &h,
+                SignedContent::Invoke(same_bytes.as_bytes()),
+                &[&key],
+                VECTOR_TS
+            ),
+            Err(SigError::Mismatch),
+            "a body spelling the poll content must not borrow a poll signature"
+        );
+        assert_eq!(
+            verify(&h, SignedContent::Invoke(VECTOR_BODY), &[&key], VECTOR_TS),
+            Err(SigError::Mismatch)
+        );
+        let invoke = sign(
+            &key,
+            VECTOR_ID,
+            VECTOR_TS,
+            SignedContent::Invoke(VECTOR_BODY),
+        );
+        assert_eq!(
+            verify(
+                &headers(VECTOR_ID, &ts, &invoke),
+                SignedContent::Poll(POLL_PATH),
+                &[&key],
+                VECTOR_TS
+            ),
+            Err(SigError::Mismatch)
+        );
+    }
+
+    #[test]
+    fn an_extreme_timestamp_is_stale_not_an_overflow() {
+        let key = decode_secret(VECTOR_SECRET).unwrap();
+        let body = SignedContent::Invoke(VECTOR_BODY);
+        for ts in [i64::MIN.to_string(), i64::MAX.to_string()] {
+            assert_eq!(
+                verify(
+                    &headers(VECTOR_ID, &ts, VECTOR_SIGNATURE),
+                    body,
+                    &[&key],
+                    VECTOR_TS
+                ),
+                Err(SigError::StaleTimestamp),
+                "{ts}"
+            );
+        }
+        let ts = VECTOR_TS.to_string();
+        let h = headers(VECTOR_ID, &ts, VECTOR_SIGNATURE);
+        for now in [i64::MIN, i64::MAX] {
+            assert_eq!(
+                verify(&h, body, &[&key], now),
+                Err(SigError::StaleTimestamp),
+                "{now}"
+            );
+        }
+    }
+
+    #[test]
+    fn dummy_hmac_reads_at_most_64_kib() {
+        dummy_verify(DUMMY_HMAC_MAX_BYTES * 2);
+        dummy_verify(0);
+    }
+
+    #[test]
+    fn signed_bytes_follow_the_spec_layout() {
+        assert_eq!(
+            signed_bytes("id", "5", SignedContent::Invoke(b"{}")),
+            b"id.5.{}".to_vec()
+        );
+        assert_eq!(
+            signed_bytes("id", "5", SignedContent::Poll("/p")),
+            b"id.5.GET /p".to_vec()
+        );
+        assert_eq!(parse_v1_signatures("v1,AAAA v2,BBBB v1,!!").len(), 1);
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/sweeper.rs b/src/core/src/workflows/http_trigger/sweeper.rs
new file mode 100644
index 0000000000..58261bca61
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/sweeper.rs
@@ -0,0 +1,571 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Trigger upkeep the worker runs under its lock, and the tombstone of a deleted workflow.
+
+use std::{collections::BTreeMap, time::Duration};
+
+use config::utils::time::now_micros;
+use infra::{
+    db::get_orm_client_rw,
+    secrets::{self, SecretOwnerKind},
+    table::{
+        entity::{
+            workflow_http_trigger_credentials as credentials, workflow_http_triggers as triggers,
+        },
+        workflow_http_triggers::{self as http_triggers, CredentialState, TOMBSTONE_TTL_US},
+    },
+};
+use o2_enterprise::enterprise::common::config::get_config as get_o2_config;
+use sea_orm::{
+    ColumnTrait, ConnectionTrait, EntityTrait, QueryFilter, QuerySelect, TransactionTrait,
+    sea_query::Expr,
+};
+
+pub const ANTI_ENTROPY_EVERY: Duration = Duration::from_secs(24 * 3600);
+
+#[derive(Debug, Default, PartialEq, Eq)]
+struct Expired {
+    credentials: u64,
+    triggers: Vec<String>,
+}
+
+/// Only the region that last wrote a trigger revokes its credentials, so regions never race.
+pub async fn expire_retiring(now_us: i64) -> Result<u64, anyhow::Error> {
+    let db = get_orm_client_rw().await;
+    let expired = expire_retiring_in(db, &config::get_cluster_name(), now_us).await?;
+    for trigger_id in &expired.triggers {
+        emit_after_commit(trigger_id).await;
+    }
+    Ok(expired.credentials)
+}
+
+pub async fn sweep_tombstones(now_us: i64) -> Result<u64, anyhow::Error> {
+    let swept = sweep_tombstones_in(get_orm_client_rw().await, now_us).await?;
+    for trigger_id in &swept {
+        if let Err(e) = db::workflow_http_triggers::forget_local(trigger_id).await {
+            log::warn!("[WORKFLOW_HOOK] cache key of swept trigger {trigger_id} not dropped: {e}");
+        }
+    }
+    Ok(u64::try_from(swept.len()).unwrap_or(u64::MAX))
+}
+
+pub async fn anti_entropy_emit(now_us: i64) -> Result<u64, anyhow::Error> {
+    if !get_o2_config().super_cluster.enabled {
+        return Ok(0);
+    }
+    let db = get_orm_client_rw().await;
+    let targets = anti_entropy_targets_in(db, &config::get_cluster_name(), now_us).await?;
+    let mut emitted = 0;
+    for trigger_id in targets {
+        let snapshot = match http_triggers::load_snapshot(&trigger_id).await {
+            Ok(Some(snapshot)) => snapshot,
+            Ok(None) => continue,
+            Err(e) => {
+                log::error!("[WORKFLOW_HOOK] anti-entropy skips trigger {trigger_id}: {e}");
+                continue;
+            }
+        };
+        if db::workflow_http_triggers::emit_prepared(&snapshot)
+            .await
+            .is_ok()
+        {
+            emitted += 1;
+        }
+    }
+    Ok(emitted)
+}
+
+/// The deleting region takes over as writer, so its tombstone wins in every region.
+pub async fn tombstone_workflow_trigger(
+    org_id: &str,
+    workflow_id: &str,
+) -> Result<(), anyhow::Error> {
+    let db = get_orm_client_rw().await;
+    let tombstoned = tombstone_workflow_trigger_in(
+        db,
+        org_id,
+        workflow_id,
+        &config::get_cluster_name(),
+        now_micros(),
+    )
+    .await?;
+    if let Some(trigger_id) = tombstoned {
+        emit_after_commit(&trigger_id).await;
+    }
+    Ok(())
+}
+
+async fn expire_retiring_in<C: ConnectionTrait + TransactionTrait>(
+    db: &C,
+    local_cluster: &str,
+    now_us: i64,
+) -> Result<Expired, anyhow::Error> {
+    let mut by_trigger: BTreeMap<String, Vec<String>> = BTreeMap::new();
+    for credential in http_triggers::list_expired_retiring(db, local_cluster, now_us).await? {
+        by_trigger
+            .entry(credential.trigger_id)
+            .or_default()
+            .push(credential.id);
+    }
+    let mut expired = Expired::default();
+    for (trigger_id, credential_ids) in by_trigger {
+        let revoked =
+            revoke_expired_in(db, &trigger_id, &credential_ids, local_cluster, now_us).await?;
+        if revoked > 0 {
+            expired.credentials += revoked;
+            expired.triggers.push(trigger_id);
+        }
+    }
+    Ok(expired)
+}
+
+/// Re-checked under the trigger lock: a rotate or a takeover may have run since the list.
+async fn revoke_expired_in<C: TransactionTrait>(
+    db: &C,
+    trigger_id: &str,
+    credential_ids: &[String],
+    local_cluster: &str,
+    now_us: i64,
+) -> Result<u64, anyhow::Error> {
+    let txn = db.begin().await?;
+    let trigger = http_triggers::get_for_update(&txn, trigger_id)
+        .await?
+        .filter(|trigger| trigger.deleted_at.is_none() && trigger.origin_cluster == local_cluster);
+    let Some(trigger) = trigger else {
+        txn.rollback().await?;
+        return Ok(0);
+    };
+    let mut revoked = 0;
+    for credential_id in credential_ids {
+        let updated = credentials::Entity::update_many()
+            .col_expr(
+                credentials::Column::State,
+                Expr::value(CredentialState::Revoked.as_str()),
+            )
+            .col_expr(credentials::Column::RevokedAt, Expr::value(now_us))
+            .col_expr(credentials::Column::UpdatedAt, Expr::value(now_us))
+            .col_expr(
+                credentials::Column::SecretRef,
+                Expr::value(Option::<String>::None),
+            )
+            .filter(credentials::Column::Id.eq(credential_id))
+            .filter(credentials::Column::TriggerId.eq(trigger_id))
+            .filter(credentials::Column::State.eq(CredentialState::Retiring.as_str()))
+            .filter(credentials::Column::ExpiresAt.lt(now_us))
+            .exec(&txn)
+            .await?
+            .rows_affected;
+        if updated == 0 {
+            continue;
+        }
+        secrets::delete_for_owner_in(
+            &txn,
+            &trigger.org_id,
+            SecretOwnerKind::WorkflowTrigger,
+            credential_id,
+        )
+        .await?;
+        revoked += updated;
+    }
+    if revoked == 0 {
+        txn.rollback().await?;
+        return Ok(0);
+    }
+    triggers::Entity::update_many()
+        .col_expr(triggers::Column::Version, Expr::value(trigger.version + 1))
+        .col_expr(triggers::Column::UpdatedAt, Expr::value(now_us))
+        .filter(triggers::Column::Id.eq(trigger_id))
+        .exec(&txn)
+        .await?;
+    txn.commit().await?;
+    Ok(revoked)
+}
+
+async fn sweep_tombstones_in<C: ConnectionTrait>(
+    db: &C,
+    now_us: i64,
+) -> Result<Vec<String>, anyhow::Error> {
+    let before_us = now_us - TOMBSTONE_TTL_US;
+    let swept = triggers::Entity::find()
+        .select_only()
+        .column(triggers::Column::Id)
+        .filter(triggers::Column::DeletedAt.lt(before_us))
+        .into_tuple()
+        .all(db)
+        .await?;
+    http_triggers::delete_tombstones_before(db, before_us).await?;
+    Ok(swept)
+}
+
+async fn anti_entropy_targets_in<C: ConnectionTrait>(
+    db: &C,
+    local_cluster: &str,
+    now_us: i64,
+) -> Result<Vec<String>, anyhow::Error> {
+    let originated =
+        http_triggers::list_originated(db, local_cluster, now_us - TOMBSTONE_TTL_US).await?;
+    Ok(originated.into_iter().map(|trigger| trigger.id).collect())
+}
+
+async fn tombstone_workflow_trigger_in<C: ConnectionTrait + TransactionTrait>(
+    db: &C,
+    org_id: &str,
+    workflow_id: &str,
+    local_cluster: &str,
+    now_us: i64,
+) -> Result<Option<String>, anyhow::Error> {
+    let txn = db.begin().await?;
+    let live = http_triggers::get_by_workflow(&txn, org_id, workflow_id)
+        .await?
+        .is_some_and(|trigger| trigger.deleted_at.is_none());
+    let tombstoned = if live {
+        http_triggers::tombstone_for_workflow(&txn, workflow_id, now_us).await?
+    } else {
+        None
+    };
+    let Some(trigger_id) = tombstoned else {
+        txn.rollback().await?;
+        return Ok(None);
+    };
+    triggers::Entity::update_many()
+        .col_expr(triggers::Column::OriginCluster, Expr::value(local_cluster))
+        .filter(triggers::Column::Id.eq(&trigger_id))
+        .exec(&txn)
+        .await?;
+    txn.commit().await?;
+    Ok(Some(trigger_id))
+}
+
+/// The local change is committed, so a failed emit is logged and healed by anti-entropy.
+async fn emit_after_commit(trigger_id: &str) {
+    if let Err(e) = db::workflow_http_triggers::emit_snapshot(trigger_id).await {
+        log::error!("[WORKFLOW_HOOK] snapshot emit for trigger {trigger_id} failed: {e}");
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use infra::table::{
+        entity::{llm_secrets, workflow_http_trigger_requests as requests},
+        workflow_http_trigger_requests::{self as ledger, NewHookRequest},
+        workflow_http_triggers::{AuthMode, CredentialKind},
+    };
+    use sea_orm::{ConnectOptions, Database, DatabaseConnection, PaginatorTrait};
+
+    use super::*;
+
+    const NOW: i64 = 1_760_000_000_000_000;
+    const DAY: i64 = 24 * 3600 * 1_000_000;
+    const LOCAL: &str = "r1";
+
+    /// One connection: separate connections to `sqlite::memory:` are separate databases.
+    async fn db() -> DatabaseConnection {
+        let mut opts = ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = Database::connect(opts).await.unwrap();
+        http_triggers::create_tables_for_tests(&db).await.unwrap();
+        db
+    }
+
+    fn trigger(id: &str, origin: &str, deleted_at: Option<i64>) -> triggers::Model {
+        triggers::Model {
+            id: id.to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: format!("wf-{id}"),
+            enabled: true,
+            auth_mode: AuthMode::Signature.as_str().to_string(),
+            max_body_bytes: 1_048_576,
+            rate_limit_per_minute: 60,
+            created_by: "a@x.io".to_string(),
+            created_at: NOW - 30 * DAY,
+            updated_at: NOW - 30 * DAY,
+            version: 1,
+            origin_cluster: origin.to_string(),
+            deleted_at,
+            last_invoked_at: None,
+            rejections: None,
+        }
+    }
+
+    fn credential(
+        id: &str,
+        trigger_id: &str,
+        state: CredentialState,
+        expires_at: Option<i64>,
+    ) -> credentials::Model {
+        credentials::Model {
+            id: id.to_string(),
+            trigger_id: trigger_id.to_string(),
+            org_id: "acme".to_string(),
+            kind: CredentialKind::SigningSecret.as_str().to_string(),
+            display_prefix: "whsec_abcd…wxyz".to_string(),
+            token_sha256: None,
+            secret_ref: None,
+            state: state.as_str().to_string(),
+            expires_at,
+            revoked_at: (state == CredentialState::Revoked).then_some(NOW - 30 * DAY),
+            created_by: "a@x.io".to_string(),
+            created_at: NOW - 30 * DAY,
+            updated_at: NOW - 30 * DAY,
+            last_used_at: None,
+        }
+    }
+
+    async fn seed(
+        db: &DatabaseConnection,
+        trigger: triggers::Model,
+        credentials: &[credentials::Model],
+    ) {
+        http_triggers::insert_trigger(db, trigger).await.unwrap();
+        for credential in credentials {
+            let mut credential = credential.clone();
+            let prepared = secrets::prepared_for_tests(
+                "acme",
+                SecretOwnerKind::WorkflowTrigger,
+                &credential.id,
+            );
+            credential.secret_ref = Some(
+                secrets::insert_prepared(db, prepared)
+                    .await
+                    .unwrap()
+                    .metadata
+                    .secret_ref,
+            );
+            http_triggers::insert_credential(db, credential)
+                .await
+                .unwrap();
+        }
+    }
+
+    async fn queue_run(db: &DatabaseConnection, trigger_id: &str, run_id: &str) {
+        let request = NewHookRequest {
+            trigger_id: trigger_id.to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: format!("wf-{trigger_id}"),
+            run_id: run_id.to_string(),
+            idem_key: None,
+            body_sha256: "cd".repeat(32),
+            body_bytes: 2,
+            content_type: None,
+            meta: "{}".to_string(),
+            credential_id: "c1".to_string(),
+            credential_prefix: "whsec_abcd…wxyz".to_string(),
+            caller_ip: "203.0.113.7".to_string(),
+            received_at: NOW,
+        };
+        ledger::enqueue(db, request, "{}".to_string())
+            .await
+            .unwrap();
+    }
+
+    async fn stored(db: &DatabaseConnection, trigger_id: &str) -> Option<triggers::Model> {
+        http_triggers::get(db, trigger_id).await.unwrap()
+    }
+
+    async fn credential_of(db: &DatabaseConnection, id: &str) -> Option<credentials::Model> {
+        credentials::Entity::find_by_id(id).one(db).await.unwrap()
+    }
+
+    async fn secrets_of(db: &DatabaseConnection, owner_id: &str) -> u64 {
+        llm_secrets::Entity::find()
+            .filter(llm_secrets::Column::OwnerKind.eq("workflow_trigger"))
+            .filter(llm_secrets::Column::OwnerId.eq(owner_id))
+            .count(db)
+            .await
+            .unwrap()
+    }
+
+    #[tokio::test]
+    async fn tombstoning_a_workflow_trigger_revokes_and_drops_queued_rows() {
+        let db = db().await;
+        seed(
+            &db,
+            trigger("t1", "r2", None),
+            &[credential("c1", "t1", CredentialState::Active, None)],
+        )
+        .await;
+        queue_run(&db, "t1", "run-1").await;
+
+        let tombstoned = tombstone_workflow_trigger_in(&db, "acme", "wf-t1", LOCAL, NOW)
+            .await
+            .unwrap();
+        assert_eq!(tombstoned.as_deref(), Some("t1"));
+        let trigger = stored(&db, "t1").await.unwrap();
+        assert_eq!(trigger.deleted_at, Some(NOW));
+        assert_eq!(trigger.version, 2);
+        assert_eq!(
+            trigger.origin_cluster, LOCAL,
+            "the deleting region takes over"
+        );
+        let revoked = credential_of(&db, "c1").await.unwrap();
+        assert_eq!(revoked.state, "revoked");
+        assert_eq!(revoked.revoked_at, Some(NOW));
+        assert_eq!(secrets_of(&db, "c1").await, 0);
+        assert_eq!(requests::Entity::find().count(&db).await.unwrap(), 0);
+
+        let again = tombstone_workflow_trigger_in(&db, "acme", "wf-t1", LOCAL, NOW + 1)
+            .await
+            .unwrap();
+        assert_eq!(again, None, "a tombstone is not tombstoned twice");
+        assert_eq!(stored(&db, "t1").await.unwrap().version, 2);
+    }
+
+    #[tokio::test]
+    async fn a_workflow_of_another_org_is_not_tombstoned() {
+        let db = db().await;
+        seed(&db, trigger("t1", LOCAL, None), &[]).await;
+        let tombstoned = tombstone_workflow_trigger_in(&db, "other", "wf-t1", LOCAL, NOW)
+            .await
+            .unwrap();
+        assert_eq!(tombstoned, None);
+        assert_eq!(stored(&db, "t1").await.unwrap().deleted_at, None);
+    }
+
+    #[tokio::test]
+    async fn expired_retiring_credentials_are_revoked_only_for_local_triggers() {
+        let db = db().await;
+        seed(
+            &db,
+            trigger("t-local", LOCAL, None),
+            &[
+                credential("c-old", "t-local", CredentialState::Retiring, Some(NOW - 1)),
+                credential(
+                    "c-live",
+                    "t-local",
+                    CredentialState::Retiring,
+                    Some(NOW + DAY),
+                ),
+                credential("c-active", "t-local", CredentialState::Active, None),
+            ],
+        )
+        .await;
+        seed(
+            &db,
+            trigger("t-remote", "r2", None),
+            &[credential(
+                "c-remote",
+                "t-remote",
+                CredentialState::Retiring,
+                Some(NOW - 1),
+            )],
+        )
+        .await;
+
+        let expired = expire_retiring_in(&db, LOCAL, NOW).await.unwrap();
+        assert_eq!(
+            expired,
+            Expired {
+                credentials: 1,
+                triggers: vec!["t-local".to_string()],
+            }
+        );
+        let old = credential_of(&db, "c-old").await.unwrap();
+        assert_eq!(
+            (
+                old.state.as_str(),
+                old.revoked_at,
+                old.updated_at,
+                old.secret_ref
+            ),
+            ("revoked", Some(NOW), NOW, None)
+        );
+        assert_eq!(secrets_of(&db, "c-old").await, 0);
+        assert_eq!(
+            credential_of(&db, "c-live").await.unwrap().state,
+            "retiring"
+        );
+        assert_eq!(
+            credential_of(&db, "c-active").await.unwrap().state,
+            "active"
+        );
+        assert_eq!(secrets_of(&db, "c-live").await, 1);
+        let local = stored(&db, "t-local").await.unwrap();
+        assert_eq!((local.version, local.updated_at), (2, NOW));
+        assert_eq!(
+            credential_of(&db, "c-remote").await.unwrap().state,
+            "retiring",
+            "the origin region expires its own credentials"
+        );
+        assert_eq!(stored(&db, "t-remote").await.unwrap().version, 1);
+
+        let again = expire_retiring_in(&db, LOCAL, NOW).await.unwrap();
+        assert_eq!(again, Expired::default());
+    }
+
+    #[tokio::test]
+    async fn expiring_a_retiring_token_deletes_its_secret() {
+        let db = db().await;
+        let mut trig = trigger("t-tok", LOCAL, None);
+        trig.auth_mode = AuthMode::Token.as_str().to_string();
+        let mut old = credential("c-tok", "t-tok", CredentialState::Retiring, Some(NOW - 1));
+        old.kind = CredentialKind::Token.as_str().to_string();
+        old.display_prefix = "o2wh_abcd…wxyz".to_string();
+        old.token_sha256 = Some("ab".repeat(32));
+        seed(&db, trig, &[old]).await;
+        assert_eq!(secrets_of(&db, "c-tok").await, 1);
+
+        let expired = expire_retiring_in(&db, LOCAL, NOW).await.unwrap();
+        assert_eq!(expired.credentials, 1);
+        let stored = credential_of(&db, "c-tok").await.unwrap();
+        assert_eq!(
+            (stored.state.as_str(), stored.secret_ref),
+            ("revoked", None)
+        );
+        assert_eq!(secrets_of(&db, "c-tok").await, 0);
+        assert_eq!(stored.token_sha256, Some("ab".repeat(32)));
+    }
+
+    #[tokio::test]
+    async fn tombstones_older_than_seven_days_are_deleted() {
+        let db = db().await;
+        seed(
+            &db,
+            trigger("t-old", LOCAL, Some(NOW - 8 * DAY)),
+            &[credential("c-old", "t-old", CredentialState::Revoked, None)],
+        )
+        .await;
+        seed(&db, trigger("t-recent", "r2", Some(NOW - DAY)), &[]).await;
+        let mut swept = credential("c-swept", "t-live", CredentialState::Revoked, None);
+        swept.revoked_at = Some(NOW - 8 * DAY);
+        let mut kept = credential("c-kept", "t-live", CredentialState::Revoked, None);
+        kept.revoked_at = Some(NOW - DAY);
+        seed(&db, trigger("t-live", LOCAL, None), &[swept, kept]).await;
+
+        let swept = sweep_tombstones_in(&db, NOW).await.unwrap();
+        assert_eq!(
+            swept,
+            ["t-old"],
+            "swept triggers are named so their keys go too"
+        );
+        assert!(stored(&db, "t-old").await.is_none());
+        assert!(credential_of(&db, "c-old").await.is_none());
+        assert!(stored(&db, "t-recent").await.is_some());
+        assert!(stored(&db, "t-live").await.is_some());
+        assert!(credential_of(&db, "c-swept").await.is_none());
+        assert!(credential_of(&db, "c-kept").await.is_some());
+    }
+
+    #[tokio::test]
+    async fn anti_entropy_emits_every_local_trigger_including_recent_tombstones() {
+        let db = db().await;
+        seed(&db, trigger("t-live", LOCAL, None), &[]).await;
+        seed(&db, trigger("t-recent", LOCAL, Some(NOW - DAY)), &[]).await;
+        seed(&db, trigger("t-old", LOCAL, Some(NOW - 8 * DAY)), &[]).await;
+        seed(&db, trigger("t-remote", "r2", None), &[]).await;
+        let targets = anti_entropy_targets_in(&db, LOCAL, NOW).await.unwrap();
+        assert_eq!(targets, ["t-live", "t-recent"]);
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/wake.rs b/src/core/src/workflows/http_trigger/wake.rs
new file mode 100644
index 0000000000..59eaf51e8e
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/wake.rs
@@ -0,0 +1,130 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Worker wake-ups: any hook rate becomes at most four coordinator puts a second per node.
+
+use std::{
+    sync::{
+        Arc,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use bytes::Bytes;
+use config::cluster::LOCAL_NODE;
+use infra::{coordinator::get_coordinator, db::NEED_WATCH};
+use tokio::{sync::Notify, time::MissedTickBehavior};
+
+use super::WAKE_PREFIX;
+
+const COALESCE_EVERY: Duration = Duration::from_millis(250);
+
+static WAKE_PENDING: AtomicBool = AtomicBool::new(false);
+
+/// Never blocks: the request path only sets a flag that the coalescer drains.
+pub fn request_wake() {
+    WAKE_PENDING.store(true, Ordering::Release);
+}
+
+pub async fn run_coalescer() {
+    coalesce(&WAKE_PENDING, || {
+        tokio::task::spawn(put_wake());
+    })
+    .await
+}
+
+/// Only signals, so the coordinator dispatcher never waits on this channel.
+pub async fn watch_wakes(notify: Arc<Notify>) -> Result<(), anyhow::Error> {
+    let mut events = get_coordinator().await.watch(WAKE_PREFIX).await?;
+    let events = Arc::get_mut(&mut events)
+        .ok_or_else(|| anyhow::anyhow!("wake watch receiver is shared"))?;
+    while events.recv().await.is_some() {
+        notify.notify_one();
+    }
+    log::warn!("[WORKFLOW_HOOK] wake watch channel closed");
+    Ok(())
+}
+
+async fn coalesce<F: FnMut()>(pending: &AtomicBool, mut put: F) {
+    let mut every = tokio::time::interval(COALESCE_EVERY);
+    every.set_missed_tick_behavior(MissedTickBehavior::Delay);
+    loop {
+        every.tick().await;
+        if take_pending(pending) {
+            put();
+        }
+    }
+}
+
+async fn put_wake() {
+    let key = format!("{WAKE_PREFIX}{}", LOCAL_NODE.uuid);
+    if let Err(e) = get_coordinator()
+        .await
+        .put(&key, Bytes::new(), NEED_WATCH, None)
+        .await
+    {
+        log::warn!("[WORKFLOW_HOOK] wake put failed, the worker tick covers it: {e}");
+    }
+}
+
+fn take_pending(pending: &AtomicBool) -> bool {
+    pending.swap(false, Ordering::AcqRel)
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::atomic::AtomicUsize;
+
+    use super::*;
+
+    #[tokio::test(start_paused = true)]
+    async fn a_thousand_wake_requests_in_a_second_produce_at_most_four_puts() {
+        let pending = Arc::new(AtomicBool::new(false));
+        let puts = Arc::new(AtomicUsize::new(0));
+        let (flag, counter) = (pending.clone(), puts.clone());
+        tokio::spawn(async move {
+            coalesce(&flag, || {
+                counter.fetch_add(1, Ordering::SeqCst);
+            })
+            .await
+        });
+        tokio::task::yield_now().await;
+        for _ in 0..1000 {
+            pending.store(true, Ordering::Release);
+            tokio::time::advance(Duration::from_millis(1)).await;
+        }
+        tokio::task::yield_now().await;
+        let puts = puts.load(Ordering::SeqCst);
+        assert!(puts <= 4, "{puts} puts in one second");
+        assert!(puts >= 3, "pending wakes must still be put, got {puts}");
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn no_put_happens_without_a_wake_request() {
+        let pending = Arc::new(AtomicBool::new(false));
+        let puts = Arc::new(AtomicUsize::new(0));
+        let (flag, counter) = (pending.clone(), puts.clone());
+        tokio::spawn(async move {
+            coalesce(&flag, || {
+                counter.fetch_add(1, Ordering::SeqCst);
+            })
+            .await
+        });
+        tokio::time::advance(Duration::from_secs(2)).await;
+        tokio::task::yield_now().await;
+        assert_eq!(puts.load(Ordering::SeqCst), 0);
+    }
+}
diff --git a/src/core/src/workflows/http_trigger/worker.rs b/src/core/src/workflows/http_trigger/worker.rs
new file mode 100644
index 0000000000..ddf33e0ce0
--- /dev/null
+++ b/src/core/src/workflows/http_trigger/worker.rs
@@ -0,0 +1,1446 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! The region's hook worker: one lock holder claims queued ledger rows and runs them.
+
+use std::{
+    collections::HashSet,
+    sync::{
+        Arc, LazyLock,
+        atomic::{AtomicBool, Ordering},
+    },
+    time::Duration,
+};
+
+use async_trait::async_trait;
+use bytes::Bytes;
+use config::{cluster::LOCAL_NODE, utils::time::now_micros};
+use infra::{
+    db::{NO_NEED_WATCH, get_orm_client_rw},
+    table::{
+        entity::{workflow_http_trigger_requests::Model as HookRequest, workflow_run_data},
+        workflow_http_trigger_requests::{
+            self as ledger, ERR_RUN_TIMEOUT, ERR_WORKFLOW_DISABLED, HookRunStatus, LocalClaims,
+            RunningCounts,
+        },
+    },
+};
+use sea_orm::{ColumnTrait, ConnectionTrait, EntityTrait, QueryFilter};
+use tokio::{
+    sync::Notify,
+    task::JoinHandle,
+    time::{Instant, MissedTickBehavior},
+};
+use tokio_util::sync::CancellationToken;
+
+use super::{HEARTBEAT_KEY, WORKER_LOCK_KEY, sweeper, wake};
+use crate::{
+    common::utils::get_nats_lock,
+    workflows::{WorkflowExecutionStatus, publish_hook_history, run_hook_workflow},
+};
+
+pub const HEARTBEAT_STALE_SECS: i64 = 15;
+pub const ERR_NODE_ERRORED: &str = "node_errored";
+pub const ERR_RUN_FAILED: &str = "run_failed";
+pub const ERR_PAYLOAD_MISSING: &str = "payload_missing";
+const TICK: Duration = Duration::from_secs(2);
+const HEARTBEAT_EVERY: Duration = Duration::from_secs(5);
+const MAINTENANCE_EVERY: Duration = Duration::from_secs(60);
+const RESTART_AFTER: Duration = Duration::from_secs(1);
+const REAP_GRACE_SECS: i64 = 60;
+// Bounds back-to-back passes so a long backlog cannot starve the heartbeat.
+const MAX_PASSES_PER_WAKE: usize = 32;
+
+static IN_FLIGHT: LazyLock<parking_lot::Mutex<HashSet<i64>>> = LazyLock::new(Default::default);
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub struct WorkerLimits {
+    pub global: u64,
+    pub per_org: u64,
+    pub run_timeout: Duration,
+    pub queue_ttl: Duration,
+}
+
+impl WorkerLimits {
+    pub fn from_config() -> Self {
+        let limit = &config::get_config().limit;
+        Self {
+            global: limit.workflow_hook_concurrency,
+            per_org: limit.workflow_hook_org_concurrency,
+            run_timeout: Duration::from_secs(limit.workflow_hook_run_timeout_secs),
+            queue_ttl: Duration::from_secs(limit.workflow_hook_queue_ttl_secs),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+pub enum ClaimDecision {
+    Run,
+    Expire,
+    WorkflowDisabled,
+}
+
+#[derive(serde::Serialize, serde::Deserialize, Clone, Debug, PartialEq, Eq)]
+pub struct Heartbeat {
+    pub node_uuid: String,
+    pub ts: i64,
+}
+
+#[async_trait]
+trait HookMetaStore: Send + Sync {
+    async fn get(&self, key: &str) -> Result<Option<Bytes>, anyhow::Error>;
+    async fn put(&self, key: &str, value: Bytes) -> Result<(), anyhow::Error>;
+    async fn delete(&self, key: &str) -> Result<(), anyhow::Error>;
+}
+
+struct MetaStore;
+
+#[async_trait]
+impl HookMetaStore for MetaStore {
+    async fn get(&self, key: &str) -> Result<Option<Bytes>, anyhow::Error> {
+        Ok(infra::db::get_db().await.get_if_exists(key).await?)
+    }
+
+    async fn put(&self, key: &str, value: Bytes) -> Result<(), anyhow::Error> {
+        Ok(infra::db::get_db()
+            .await
+            .put(key, value, NO_NEED_WATCH, None)
+            .await?)
+    }
+
+    async fn delete(&self, key: &str) -> Result<(), anyhow::Error> {
+        Ok(infra::db::get_db()
+            .await
+            .delete(key, false, NO_NEED_WATCH, None)
+            .await?)
+    }
+}
+
+/// What one claim pass reads besides the ledger, so tests can drive it on an in-memory DB.
+#[async_trait]
+trait ClaimHooks: Send + Sync {
+    async fn workflow_enabled(
+        &self,
+        org_id: &str,
+        workflow_id: &str,
+    ) -> Result<Option<bool>, anyhow::Error>;
+    fn org_blocked(&self, org_id: &str) -> bool;
+    fn start_run(&self, row: HookRequest);
+}
+
+struct LiveClaims {
+    node_uuid: String,
+    limits: WorkerLimits,
+    wake: Arc<Notify>,
+}
+
+#[async_trait]
+impl ClaimHooks for LiveClaims {
+    async fn workflow_enabled(
+        &self,
+        org_id: &str,
+        workflow_id: &str,
+    ) -> Result<Option<bool>, anyhow::Error> {
+        Ok(db::workflows::get_workflow(org_id, workflow_id)
+            .await?
+            .map(|workflow| workflow.enabled))
+    }
+
+    fn org_blocked(&self, org_id: &str) -> bool {
+        db::org_status::is_blocked(org_id)
+    }
+
+    fn start_run(&self, row: HookRequest) {
+        let id = row.id;
+        spawn_run(
+            id,
+            self.wake.clone(),
+            run_claimed(row, self.node_uuid.clone(), self.limits),
+        );
+    }
+}
+
+/// Holds a ledger id in `IN_FLIGHT` until its run task ends, a panic included.
+struct InFlight {
+    id: i64,
+    wake: Arc<Notify>,
+}
+
+impl InFlight {
+    fn enter(id: i64, wake: Arc<Notify>) -> Self {
+        IN_FLIGHT.lock().insert(id);
+        Self { id, wake }
+    }
+}
+
+impl Drop for InFlight {
+    fn drop(&mut self) {
+        IN_FLIGHT.lock().remove(&self.id);
+        // A run ending can free a slot; waiting for the tick caps a backlog at per_org per 2 s.
+        self.wake.notify_one();
+    }
+}
+
+/// The ledger keeps a stable code that callers poll; the error text goes to run history only.
+#[derive(Debug, PartialEq, Eq)]
+struct RunEnd {
+    status: HookRunStatus,
+    code: Option<&'static str>,
+    detail: Option<String>,
+}
+
+impl RunEnd {
+    fn failed(code: &'static str, detail: String) -> Self {
+        Self {
+            status: HookRunStatus::Failed,
+            code: Some(code),
+            detail: Some(detail),
+        }
+    }
+}
+
+struct ClaimPass {
+    node_uuid: String,
+    limits: WorkerLimits,
+    now_us: i64,
+    live_nodes: Option<HashSet<String>>,
+    in_flight: HashSet<i64>,
+}
+
+/// The loop's side effects, so the tick and leadership timing are testable without a cluster.
+#[async_trait]
+trait WorkerEnv: Send + Sync {
+    async fn hold_lock(&self) -> bool;
+    async fn claim_pass(&self, cursor: &mut usize) -> Result<usize, anyhow::Error>;
+    /// False while the previous maintenance is still running, so the caller retries later.
+    async fn maintain(&self, anti_entropy: bool) -> bool;
+}
+
+struct LiveWorker {
+    node_uuid: String,
+    limits: WorkerLimits,
+    maintaining: Arc<AtomicBool>,
+    wake: Arc<Notify>,
+}
+
+#[async_trait]
+impl WorkerEnv for LiveWorker {
+    async fn hold_lock(&self) -> bool {
+        match get_nats_lock(WORKER_LOCK_KEY.to_string()).await {
+            Ok(owner) if owner == self.node_uuid => {
+                if let Err(e) = write_heartbeat(&self.node_uuid).await {
+                    log::error!("[WORKFLOW_HOOK] heartbeat write failed: {e}");
+                }
+                true
+            }
+            Ok(_) => false,
+            Err(e) => {
+                log::error!("[WORKFLOW_HOOK] worker lock check failed: {e}");
+                false
+            }
+        }
+    }
+
+    async fn claim_pass(&self, cursor: &mut usize) -> Result<usize, anyhow::Error> {
+        claim_cycle(&self.node_uuid, self.limits, &self.wake, cursor).await
+    }
+
+    /// Detached, so a long anti-entropy pass never delays the heartbeat past its 15 s.
+    async fn maintain(&self, anti_entropy: bool) -> bool {
+        if self.maintaining.swap(true, Ordering::AcqRel) {
+            return false;
+        }
+        let maintaining = self.maintaining.clone();
+        tokio::task::spawn(async move {
+            if let Err(e) = tokio::task::spawn(maintain_once(anti_entropy)).await {
+                log::error!("[WORKFLOW_HOOK] maintenance panicked: {e}");
+            }
+            maintaining.store(false, Ordering::Release);
+        });
+        true
+    }
+}
+
+pub fn decide_at_claim(
+    received_at_us: i64,
+    now_us: i64,
+    ttl: Duration,
+    workflow_enabled: Option<bool>,
+) -> ClaimDecision {
+    let ttl_us = i64::try_from(ttl.as_micros()).unwrap_or(i64::MAX);
+    if now_us.saturating_sub(received_at_us) > ttl_us {
+        return ClaimDecision::Expire;
+    }
+    match workflow_enabled {
+        Some(true) => ClaimDecision::Run,
+        _ => ClaimDecision::WorkflowDisabled,
+    }
+}
+
+/// One entry per slot to fill, starting after the org served last, within both caps.
+pub fn pick_round_robin(
+    orgs_with_queued: &[String],
+    running: &RunningCounts,
+    limits: &WorkerLimits,
+    cursor: &mut usize,
+) -> Vec<String> {
+    let orgs = orgs_with_queued;
+    if orgs.is_empty() {
+        return Vec::new();
+    }
+    let mut total = running.total;
+    let mut taken: Vec<u64> = orgs
+        .iter()
+        .map(|org| running.by_org.get(org).copied().unwrap_or_default())
+        .collect();
+    let start = *cursor % orgs.len();
+    let mut picks = Vec::new();
+    let mut last = None;
+    let mut progressed = true;
+    while progressed && total < limits.global {
+        progressed = false;
+        for step in 0..orgs.len() {
+            let i = (start + step) % orgs.len();
+            if total < limits.global && taken[i] < limits.per_org {
+                taken[i] += 1;
+                total += 1;
+                picks.push(orgs[i].clone());
+                last = Some(i);
+                progressed = true;
+            }
+        }
+    }
+    if let Some(i) = last {
+        *cursor = i + 1;
+    }
+    picks
+}
+
+pub fn heartbeat_is_fresh_at(heartbeat: Option<&Heartbeat>, now_us: i64) -> bool {
+    heartbeat.is_some_and(|heartbeat| now_us - heartbeat.ts <= HEARTBEAT_STALE_SECS * 1_000_000)
+}
+
+pub async fn heartbeat_is_fresh() -> bool {
+    let heartbeat = match MetaStore.get(HEARTBEAT_KEY).await {
+        Ok(Some(value)) => serde_json::from_slice::<Heartbeat>(&value).ok(),
+        Ok(None) => None,
+        Err(e) => {
+            log::warn!("[WORKFLOW_HOOK] heartbeat read failed: {e}");
+            None
+        }
+    };
+    heartbeat_is_fresh_at(heartbeat.as_ref(), now_micros())
+}
+
+/// Reads the RW handle: a replica may not have the payload committed a moment ago.
+pub async fn load_run_input<C: ConnectionTrait>(
+    rw: &C,
+    row: &HookRequest,
+) -> Result<Option<serde_json::Value>, anyhow::Error> {
+    let payload = ledger::read_payload(rw, &row.org_id, &row.workflow_id, &row.run_id).await?;
+    Ok(payload
+        .map(|payload| serde_json::from_str(&payload))
+        .transpose()?)
+}
+
+pub async fn run_supervisor() {
+    let notify = Arc::new(Notify::new());
+    let watched = notify.clone();
+    tokio::task::spawn(async move {
+        if let Err(e) = wake::watch_wakes(watched).await {
+            log::error!("[WORKFLOW_HOOK] wake watch failed, the tick still claims: {e}");
+        }
+    });
+    let node_uuid = LOCAL_NODE.uuid.clone();
+    loop {
+        let worker = tokio::task::spawn(run_worker(notify.clone()));
+        let exit = supervise(&MetaStore, &node_uuid, worker).await;
+        log::error!("[WORKFLOW_HOOK] worker exited ({exit}), restarting");
+        tokio::time::sleep(RESTART_AFTER).await;
+    }
+}
+
+async fn run_worker(notify: Arc<Notify>) -> Result<(), anyhow::Error> {
+    let env = LiveWorker {
+        node_uuid: LOCAL_NODE.uuid.clone(),
+        limits: WorkerLimits::from_config(),
+        maintaining: Arc::new(AtomicBool::new(false)),
+        wake: notify.clone(),
+    };
+    worker_loop(&env, notify).await
+}
+
+async fn worker_loop<E: WorkerEnv>(env: &E, notify: Arc<Notify>) -> Result<(), anyhow::Error> {
+    let mut beat = tokio::time::interval(HEARTBEAT_EVERY);
+    beat.set_missed_tick_behavior(MissedTickBehavior::Delay);
+    let mut tick = tokio::time::interval(TICK);
+    tick.set_missed_tick_behavior(MissedTickBehavior::Delay);
+    let mut cursor = 0;
+    let mut held = false;
+    let mut maintained: Option<Instant> = None;
+    let mut anti_entropy_at: Option<Instant> = None;
+    loop {
+        let check_lock = tokio::select! {
+            biased;
+            _ = beat.tick() => true,
+            _ = tick.tick() => false,
+            () = notify.notified() => false,
+        };
+        if check_lock {
+            held = env.hold_lock().await;
+            if !held {
+                // A regained lock is a new holder's start, which re-emits every snapshot.
+                anti_entropy_at = None;
+                maintained = None;
+            }
+        }
+        if !held {
+            continue;
+        }
+        if maintained.is_none_or(|at| at.elapsed() >= MAINTENANCE_EVERY) {
+            let anti_entropy =
+                anti_entropy_at.is_none_or(|at| at.elapsed() >= sweeper::ANTI_ENTROPY_EVERY);
+            if env.maintain(anti_entropy).await {
+                maintained = Some(Instant::now());
+                if anti_entropy {
+                    anti_entropy_at = maintained;
+                }
+            }
+        }
+        drain(env, &mut cursor).await;
+    }
+}
+
+async fn drain<E: WorkerEnv>(env: &E, cursor: &mut usize) {
+    for _ in 0..MAX_PASSES_PER_WAKE {
+        match env.claim_pass(cursor).await {
+            Ok(0) => return,
+            Ok(_) => {}
+            Err(e) => {
+                log::error!("[WORKFLOW_HOOK] claim pass failed: {e}");
+                return;
+            }
+        }
+    }
+}
+
+async fn claim_cycle(
+    node_uuid: &str,
+    limits: WorkerLimits,
+    wake: &Arc<Notify>,
+    cursor: &mut usize,
+) -> Result<usize, anyhow::Error> {
+    let nodes = infra::cluster::get_cached_nodes(|_| true)
+        .await
+        .map(|nodes| nodes.into_iter().map(|node| node.uuid).collect());
+    let pass = ClaimPass {
+        node_uuid: node_uuid.to_string(),
+        limits,
+        now_us: now_micros(),
+        live_nodes: live_nodes_for_reap(nodes, node_uuid),
+        in_flight: IN_FLIGHT.lock().clone(),
+    };
+    let hooks = LiveClaims {
+        node_uuid: node_uuid.to_string(),
+        limits,
+        wake: wake.clone(),
+    };
+    claim_pass_in(get_orm_client_rw().await, &hooks, &pass, cursor).await
+}
+
+async fn claim_pass_in<C: ConnectionTrait, H: ClaimHooks>(
+    db: &C,
+    hooks: &H,
+    pass: &ClaimPass,
+    cursor: &mut usize,
+) -> Result<usize, anyhow::Error> {
+    let limits = &pass.limits;
+    if let Some(live_nodes) = &pass.live_nodes {
+        let run_timeout_us = i64::try_from(limits.run_timeout.as_micros()).unwrap_or(i64::MAX / 2);
+        let local = LocalClaims {
+            node_uuid: &pass.node_uuid,
+            in_flight: &pass.in_flight,
+            stale_before_us: pass.now_us - run_timeout_us - REAP_GRACE_SECS * 1_000_000,
+        };
+        ledger::reap(db, live_nodes, local, pass.now_us).await?;
+    }
+    let running = ledger::running_counts(db).await?;
+    let orgs = ledger::orgs_with_queued(db).await?;
+    let mut drained = HashSet::new();
+    let mut handled = 0;
+    for org in pick_round_robin(&orgs, &running, limits, cursor) {
+        if drained.contains(&org) {
+            continue;
+        }
+        let Some(row) = ledger::oldest_queued_for_org(db, &org).await? else {
+            drained.insert(org);
+            continue;
+        };
+        if claim_or_refuse(db, hooks, pass, row).await? {
+            handled += 1;
+        }
+    }
+    Ok(handled)
+}
+
+async fn claim_or_refuse<C: ConnectionTrait, H: ClaimHooks>(
+    db: &C,
+    hooks: &H,
+    pass: &ClaimPass,
+    row: HookRequest,
+) -> Result<bool, anyhow::Error> {
+    // A deleting org's rows never run; its cleanup removes them afterwards.
+    let decision = if hooks.org_blocked(&row.org_id) {
+        ClaimDecision::Expire
+    } else {
+        let enabled = hooks
+            .workflow_enabled(&row.org_id, &row.workflow_id)
+            .await?;
+        decide_at_claim(row.received_at, pass.now_us, pass.limits.queue_ttl, enabled)
+    };
+    let refusal = match decision {
+        ClaimDecision::Run => {
+            let claimed = ledger::claim(db, row.id, &pass.node_uuid, pass.now_us).await?;
+            if claimed {
+                hooks.start_run(HookRequest {
+                    status: HookRunStatus::Running.as_str().to_string(),
+                    claimed_by: Some(pass.node_uuid.clone()),
+                    claimed_at: Some(pass.now_us),
+                    ..row
+                });
+            }
+            return Ok(claimed);
+        }
+        ClaimDecision::Expire => (HookRunStatus::Expired, None),
+        ClaimDecision::WorkflowDisabled => (HookRunStatus::Failed, Some(ERR_WORKFLOW_DISABLED)),
+    };
+    let ended = ledger::finish_unclaimed(db, row.id, refusal.0, refusal.1, pass.now_us).await?;
+    if ended {
+        delete_payload_in(db, &row).await?;
+    }
+    Ok(ended)
+}
+
+async fn maintain_once(anti_entropy: bool) {
+    let now = now_micros();
+    if let Err(e) = sweeper::expire_retiring(now).await {
+        log::error!("[WORKFLOW_HOOK] credential expiry failed: {e}");
+    }
+    if let Err(e) = sweeper::sweep_tombstones(now).await {
+        log::error!("[WORKFLOW_HOOK] tombstone sweep failed: {e}");
+    }
+    if anti_entropy && let Err(e) = sweeper::anti_entropy_emit(now).await {
+        log::error!("[WORKFLOW_HOOK] anti-entropy emit failed: {e}");
+    }
+}
+
+fn spawn_run<F>(id: i64, wake: Arc<Notify>, run: F)
+where
+    F: std::future::Future<Output = ()> + Send + 'static,
+{
+    let in_flight = InFlight::enter(id, wake);
+    tokio::task::spawn(async move {
+        let _in_flight = in_flight;
+        run.await;
+    });
+}
+
+async fn run_claimed(row: HookRequest, node_uuid: String, limits: WorkerLimits) {
+    let rw = get_orm_client_rw().await;
+    let start = now_micros();
+    let end = match load_run_input(rw, &row).await {
+        Ok(Some(input)) => {
+            let cancel = CancellationToken::new();
+            let run = run_hook_workflow(
+                &row.org_id,
+                &row.workflow_id,
+                &row.run_id,
+                input,
+                cancel.clone(),
+            );
+            run_outcome(run_with_timeout(run, cancel, limits.run_timeout).await)
+        }
+        Ok(None) => RunEnd::failed(ERR_PAYLOAD_MISSING, ERR_PAYLOAD_MISSING.to_string()),
+        Err(e) => RunEnd::failed(ERR_RUN_FAILED, e.to_string()),
+    };
+    let end_time = now_micros();
+    match ledger::finish(rw, row.id, &node_uuid, end.status, end.code, end_time).await {
+        Ok(true) => {
+            publish_hook_history(
+                &row.org_id,
+                &row.workflow_id,
+                &row.trigger_id,
+                &row.run_id,
+                start,
+                end_time,
+                end.detail,
+            );
+            if let Err(e) =
+                infra::table::workflows::delete_run_data(&row.org_id, &row.workflow_id, &row.run_id)
+                    .await
+            {
+                log::error!(
+                    "[WORKFLOW_HOOK] run {} payload delete failed: {e}",
+                    row.run_id
+                );
+            }
+        }
+        Ok(false) => log::warn!(
+            "[WORKFLOW_HOOK] run {} was reaped before it finished; keeping the stored status",
+            row.run_id
+        ),
+        Err(e) => log::error!(
+            "[WORKFLOW_HOOK] run {} finish write failed: {e}",
+            row.run_id
+        ),
+    }
+}
+
+/// `None` on timeout, returned only once the cancelled run has drained.
+async fn run_with_timeout<F>(
+    run: F,
+    cancel: CancellationToken,
+    timeout: Duration,
+) -> Option<F::Output>
+where
+    F: std::future::Future,
+{
+    tokio::pin!(run);
+    tokio::select! {
+        output = &mut run => Some(output),
+        () = tokio::time::sleep(timeout) => {
+            cancel.cancel();
+            let _drained = run.await;
+            None
+        }
+    }
+}
+
+fn run_outcome(outcome: Option<Result<WorkflowExecutionStatus, anyhow::Error>>) -> RunEnd {
+    match outcome {
+        None => RunEnd::failed(ERR_RUN_TIMEOUT, ERR_RUN_TIMEOUT.to_string()),
+        Some(Ok(WorkflowExecutionStatus::Success)) => RunEnd {
+            status: HookRunStatus::Succeeded,
+            code: None,
+            detail: None,
+        },
+        Some(Ok(WorkflowExecutionStatus::Errored)) => RunEnd::failed(
+            ERR_NODE_ERRORED,
+            "some node errored during execution".to_string(),
+        ),
+        Some(Ok(WorkflowExecutionStatus::Disabled)) => RunEnd::failed(
+            ERR_WORKFLOW_DISABLED,
+            "the workflow was disabled before the run started".to_string(),
+        ),
+        Some(Err(e)) => RunEnd::failed(ERR_RUN_FAILED, e.to_string()),
+    }
+}
+
+/// `None` skips the reap: an unknown, empty or self-less view would fail live runs.
+fn live_nodes_for_reap(
+    nodes: Option<HashSet<String>>,
+    local_uuid: &str,
+) -> Option<HashSet<String>> {
+    nodes.filter(|nodes| nodes.contains(local_uuid))
+}
+
+async fn write_heartbeat(node_uuid: &str) -> Result<(), anyhow::Error> {
+    let heartbeat = Heartbeat {
+        node_uuid: node_uuid.to_string(),
+        ts: now_micros(),
+    };
+    MetaStore
+        .put(HEARTBEAT_KEY, serde_json::to_vec(&heartbeat)?.into())
+        .await
+}
+
+/// Frees an exited worker's keys, so another scheduler takes over without a lock timeout.
+async fn supervise<S: HookMetaStore>(
+    store: &S,
+    node_uuid: &str,
+    worker: JoinHandle<Result<(), anyhow::Error>>,
+) -> String {
+    let exit = match worker.await {
+        Ok(Ok(())) => "returned".to_string(),
+        Ok(Err(e)) => format!("error: {e}"),
+        Err(e) => format!("panic: {e}"),
+    };
+    clear_worker_keys(store, node_uuid).await;
+    exit
+}
+
+/// Only the local node's keys: a crashed non-holder must not unseat the live holder.
+async fn clear_worker_keys<S: HookMetaStore>(store: &S, node_uuid: &str) {
+    let heartbeat = store.get(HEARTBEAT_KEY).await.ok().flatten();
+    let beats_here = heartbeat.is_some_and(|value| {
+        serde_json::from_slice::<Heartbeat>(&value).is_ok_and(|beat| beat.node_uuid == node_uuid)
+    });
+    if beats_here && let Err(e) = store.delete(HEARTBEAT_KEY).await {
+        log::error!("[WORKFLOW_HOOK] heartbeat delete failed: {e}");
+    }
+    let owner = store.get(WORKER_LOCK_KEY).await.ok().flatten();
+    if owner.is_some_and(|owner| owner.as_ref() == node_uuid.as_bytes())
+        && let Err(e) = store.delete(WORKER_LOCK_KEY).await
+    {
+        log::error!("[WORKFLOW_HOOK] worker lock release failed: {e}");
+    }
+}
+
+async fn delete_payload_in<C: ConnectionTrait>(
+    db: &C,
+    row: &HookRequest,
+) -> Result<(), anyhow::Error> {
+    workflow_run_data::Entity::delete_many()
+        .filter(workflow_run_data::Column::OrgId.eq(&row.org_id))
+        .filter(workflow_run_data::Column::WorkflowId.eq(&row.workflow_id))
+        .filter(workflow_run_data::Column::RunId.eq(&row.run_id))
+        .exec(db)
+        .await?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use std::{
+        collections::HashMap,
+        sync::{Mutex, atomic::AtomicUsize},
+    };
+
+    use infra::table::workflow_http_trigger_requests::{LedgerInsert, NewHookRequest};
+    use sea_orm::{ConnectOptions, Database, DatabaseConnection};
+
+    use super::*;
+
+    const NOW: i64 = 1_760_000_000_000_000;
+    const SEC: i64 = 1_000_000;
+    const LOCAL: &str = "node-a";
+
+    #[derive(Default)]
+    struct FakeStore(Mutex<HashMap<String, Bytes>>);
+
+    #[async_trait]
+    impl HookMetaStore for FakeStore {
+        async fn get(&self, key: &str) -> Result<Option<Bytes>, anyhow::Error> {
+            Ok(self.0.lock().unwrap().get(key).cloned())
+        }
+
+        async fn put(&self, key: &str, value: Bytes) -> Result<(), anyhow::Error> {
+            self.0.lock().unwrap().insert(key.to_string(), value);
+            Ok(())
+        }
+
+        async fn delete(&self, key: &str) -> Result<(), anyhow::Error> {
+            self.0.lock().unwrap().remove(key);
+            Ok(())
+        }
+    }
+
+    #[derive(Default)]
+    struct FakeClaims {
+        enabled: HashMap<String, bool>,
+        blocked: HashSet<String>,
+        started: Mutex<Vec<HookRequest>>,
+    }
+
+    #[async_trait]
+    impl ClaimHooks for FakeClaims {
+        async fn workflow_enabled(
+            &self,
+            _org_id: &str,
+            workflow_id: &str,
+        ) -> Result<Option<bool>, anyhow::Error> {
+            Ok(self.enabled.get(workflow_id).copied())
+        }
+
+        fn org_blocked(&self, org_id: &str) -> bool {
+            self.blocked.contains(org_id)
+        }
+
+        fn start_run(&self, row: HookRequest) {
+            self.started.lock().unwrap().push(row);
+        }
+    }
+
+    #[derive(Default)]
+    struct FakeWorker {
+        locks: AtomicUsize,
+        queued: AtomicBool,
+        passes: AtomicUsize,
+        claimed: AtomicUsize,
+    }
+
+    #[async_trait]
+    impl WorkerEnv for FakeWorker {
+        async fn hold_lock(&self) -> bool {
+            self.locks.fetch_add(1, Ordering::SeqCst);
+            true
+        }
+
+        async fn claim_pass(&self, _cursor: &mut usize) -> Result<usize, anyhow::Error> {
+            self.passes.fetch_add(1, Ordering::SeqCst);
+            if self.queued.swap(false, Ordering::SeqCst) {
+                self.claimed.fetch_add(1, Ordering::SeqCst);
+                return Ok(1);
+            }
+            Ok(0)
+        }
+
+        async fn maintain(&self, _anti_entropy: bool) -> bool {
+            true
+        }
+    }
+
+    /// A backlog behind a per-org cap whose runs end at once, started through `spawn_run`.
+    struct BacklogWorker {
+        queued: AtomicUsize,
+        per_org: usize,
+        running: Arc<AtomicUsize>,
+        done: Arc<AtomicUsize>,
+        all_done: Arc<Notify>,
+        total: usize,
+        wake: Arc<Notify>,
+    }
+
+    impl BacklogWorker {
+        fn new(total: usize, per_org: usize, wake: Arc<Notify>) -> Self {
+            Self {
+                queued: AtomicUsize::new(total),
+                per_org,
+                running: Arc::default(),
+                done: Arc::default(),
+                all_done: Arc::default(),
+                total,
+                wake,
+            }
+        }
+    }
+
+    #[async_trait]
+    impl WorkerEnv for BacklogWorker {
+        async fn hold_lock(&self) -> bool {
+            true
+        }
+
+        async fn claim_pass(&self, _cursor: &mut usize) -> Result<usize, anyhow::Error> {
+            let free = self.per_org - self.running.load(Ordering::SeqCst);
+            let claimed = free.min(self.queued.load(Ordering::SeqCst));
+            for _ in 0..claimed {
+                let left = self.queued.fetch_sub(1, Ordering::SeqCst) - 1;
+                self.running.fetch_add(1, Ordering::SeqCst);
+                let (running, done, all_done) = (
+                    self.running.clone(),
+                    self.done.clone(),
+                    self.all_done.clone(),
+                );
+                let total = self.total;
+                let id = i64::MAX - 1_000 - i64::try_from(left).unwrap();
+                spawn_run(id, self.wake.clone(), async move {
+                    running.fetch_sub(1, Ordering::SeqCst);
+                    if done.fetch_add(1, Ordering::SeqCst) + 1 == total {
+                        all_done.notify_one();
+                    }
+                });
+            }
+            Ok(claimed)
+        }
+
+        async fn maintain(&self, _anti_entropy: bool) -> bool {
+            true
+        }
+    }
+
+    fn limits(global: u64, per_org: u64) -> WorkerLimits {
+        WorkerLimits {
+            global,
+            per_org,
+            run_timeout: Duration::from_secs(900),
+            queue_ttl: Duration::from_secs(3600),
+        }
+    }
+
+    fn pass(limits: WorkerLimits, live_nodes: Option<&[&str]>) -> ClaimPass {
+        ClaimPass {
+            node_uuid: LOCAL.to_string(),
+            limits,
+            now_us: NOW,
+            live_nodes: live_nodes.map(|nodes| nodes.iter().map(|n| n.to_string()).collect()),
+            in_flight: HashSet::new(),
+        }
+    }
+
+    fn counts(by_org: &[(&str, u64)]) -> RunningCounts {
+        RunningCounts {
+            total: by_org.iter().map(|(_, n)| n).sum(),
+            by_org: by_org.iter().map(|(o, n)| (o.to_string(), *n)).collect(),
+        }
+    }
+
+    fn orgs(names: &[&str]) -> Vec<String> {
+        names.iter().map(|n| n.to_string()).collect()
+    }
+
+    /// One connection: separate connections to `sqlite::memory:` are separate databases.
+    async fn db() -> DatabaseConnection {
+        let mut opts = ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = Database::connect(opts).await.unwrap();
+        ledger::create_tables_for_tests(&db).await.unwrap();
+        db
+    }
+
+    async fn enqueue(db: &DatabaseConnection, org: &str, run_id: &str, received_at: i64) -> i64 {
+        let request = NewHookRequest {
+            trigger_id: format!("t-{org}"),
+            org_id: org.to_string(),
+            workflow_id: format!("wf-{org}"),
+            run_id: run_id.to_string(),
+            idem_key: None,
+            body_sha256: "cd".repeat(32),
+            body_bytes: 2,
+            content_type: Some("application/json".to_string()),
+            meta: "{}".to_string(),
+            credential_id: "c1".to_string(),
+            credential_prefix: "o2wh_abcd…wxyz".to_string(),
+            caller_ip: "203.0.113.7".to_string(),
+            received_at,
+        };
+        let payload = format!(r#"{{"meta":{{"run_id":"{run_id}"}},"data":[1]}}"#);
+        let inserted = ledger::enqueue(db, request, payload).await.unwrap();
+        assert!(matches!(inserted, LedgerInsert::Inserted));
+        row(db, org, run_id).await.id
+    }
+
+    async fn row(db: &DatabaseConnection, org: &str, run_id: &str) -> HookRequest {
+        ledger::get_run(db, &format!("t-{org}"), run_id)
+            .await
+            .unwrap()
+            .unwrap()
+    }
+
+    fn enabled(orgs: &[&str]) -> FakeClaims {
+        FakeClaims {
+            enabled: orgs.iter().map(|o| (format!("wf-{o}"), true)).collect(),
+            ..Default::default()
+        }
+    }
+
+    /// Moves paused time, then lets the spawned loop see its fired timers.
+    async fn advance(by: Duration) {
+        tokio::time::advance(by).await;
+        for _ in 0..8 {
+            tokio::task::yield_now().await;
+        }
+    }
+
+    async fn crash() -> Result<(), anyhow::Error> {
+        panic!("worker crashed")
+    }
+
+    fn heartbeat_bytes(node: &str) -> Bytes {
+        serde_json::to_vec(&Heartbeat {
+            node_uuid: node.to_string(),
+            ts: NOW,
+        })
+        .unwrap()
+        .into()
+    }
+
+    #[test]
+    fn a_row_older_than_the_ttl_is_expired_at_claim_time() {
+        let ttl = Duration::from_secs(3600);
+        let received = NOW - 3600 * SEC - 1;
+        assert_eq!(
+            decide_at_claim(received, NOW, ttl, Some(true)),
+            ClaimDecision::Expire
+        );
+        assert_eq!(
+            decide_at_claim(NOW - 3600 * SEC, NOW, ttl, Some(true)),
+            ClaimDecision::Run
+        );
+        assert_eq!(
+            decide_at_claim(received, NOW, ttl, Some(false)),
+            ClaimDecision::Expire,
+            "an expired row is expired whatever its workflow"
+        );
+    }
+
+    #[test]
+    fn a_disabled_or_missing_workflow_is_refused_at_claim_time() {
+        let ttl = Duration::from_secs(3600);
+        assert_eq!(
+            decide_at_claim(NOW, NOW, ttl, Some(false)),
+            ClaimDecision::WorkflowDisabled
+        );
+        assert_eq!(
+            decide_at_claim(NOW, NOW, ttl, None),
+            ClaimDecision::WorkflowDisabled
+        );
+    }
+
+    #[test]
+    fn round_robin_serves_two_orgs_alternately() {
+        let orgs = orgs(&["a", "b"]);
+        let one_slot = limits(1, 2);
+        let mut cursor = 0;
+        let mut served = Vec::new();
+        for _ in 0..4 {
+            served.extend(pick_round_robin(
+                &orgs,
+                &counts(&[]),
+                &one_slot,
+                &mut cursor,
+            ));
+        }
+        assert_eq!(served, ["a", "b", "a", "b"]);
+
+        let mut cursor = 0;
+        assert_eq!(
+            pick_round_robin(&orgs, &counts(&[]), &limits(8, 2), &mut cursor),
+            ["a", "b", "a", "b"]
+        );
+    }
+
+    #[test]
+    fn round_robin_respects_the_per_org_and_global_caps() {
+        let orgs = orgs(&["a", "b", "c"]);
+        let mut cursor = 0;
+        assert_eq!(
+            pick_round_robin(&orgs, &counts(&[("a", 2)]), &limits(8, 2), &mut cursor),
+            ["b", "c", "b", "c"]
+        );
+        let mut cursor = 0;
+        assert_eq!(
+            pick_round_robin(&orgs, &counts(&[("x", 7)]), &limits(8, 2), &mut cursor),
+            ["a"]
+        );
+        let mut cursor = 0;
+        assert!(
+            pick_round_robin(&orgs, &counts(&[("x", 8)]), &limits(8, 2), &mut cursor).is_empty()
+        );
+        assert!(pick_round_robin(&[], &counts(&[]), &limits(8, 2), &mut cursor).is_empty());
+    }
+
+    #[test]
+    fn a_heartbeat_older_than_fifteen_seconds_is_stale() {
+        let at = |ts| Heartbeat {
+            node_uuid: LOCAL.to_string(),
+            ts,
+        };
+        assert!(heartbeat_is_fresh_at(Some(&at(NOW - 15 * SEC)), NOW));
+        assert!(!heartbeat_is_fresh_at(Some(&at(NOW - 15 * SEC - 1)), NOW));
+        assert!(!heartbeat_is_fresh_at(None, NOW));
+    }
+
+    #[test]
+    fn reap_is_skipped_when_nodes_are_unknown() {
+        assert_eq!(live_nodes_for_reap(None, LOCAL), None);
+        assert_eq!(live_nodes_for_reap(Some(HashSet::new()), LOCAL), None);
+        let without_local = HashSet::from(["node-b".to_string()]);
+        assert_eq!(live_nodes_for_reap(Some(without_local), LOCAL), None);
+        let live = HashSet::from([LOCAL.to_string(), "node-b".to_string()]);
+        assert_eq!(live_nodes_for_reap(Some(live.clone()), LOCAL), Some(live));
+    }
+
+    #[tokio::test]
+    async fn a_pass_without_a_node_view_leaves_running_rows_alone() {
+        let db = db().await;
+        let id = enqueue(&db, "a", "r1", NOW).await;
+        assert!(ledger::claim(&db, id, "gone-node", NOW).await.unwrap());
+        let hooks = enabled(&["a"]);
+        claim_pass_in(&db, &hooks, &pass(limits(8, 2), None), &mut 0)
+            .await
+            .unwrap();
+        assert_eq!(row(&db, "a", "r1").await.status, "running");
+        claim_pass_in(&db, &hooks, &pass(limits(8, 2), Some(&[LOCAL])), &mut 0)
+            .await
+            .unwrap();
+        let reaped = row(&db, "a", "r1").await;
+        assert_eq!(
+            (reaped.status.as_str(), reaped.error.as_deref()),
+            ("failed", Some("worker_lost"))
+        );
+    }
+
+    #[tokio::test]
+    async fn an_overdue_run_still_draining_keeps_its_slot() {
+        let db = db().await;
+        let claimed_at = NOW - 2000 * SEC;
+        let mut ids = HashMap::new();
+        for (run_id, claimer) in [
+            ("draining", LOCAL),
+            ("abandoned", LOCAL),
+            ("peer", "node-b"),
+        ] {
+            let id = enqueue(&db, "a", run_id, claimed_at).await;
+            assert!(ledger::claim(&db, id, claimer, claimed_at).await.unwrap());
+            ids.insert(run_id, id);
+        }
+        let mut pass = pass(limits(8, 8), Some(&[LOCAL, "node-b"]));
+        pass.in_flight = HashSet::from([ids["draining"]]);
+        claim_pass_in(&db, &enabled(&["a"]), &pass, &mut 0)
+            .await
+            .unwrap();
+        assert_eq!(row(&db, "a", "draining").await.status, "running");
+        assert_eq!(
+            row(&db, "a", "peer").await.status,
+            "running",
+            "a live peer may still be draining its run"
+        );
+        assert_eq!(row(&db, "a", "abandoned").await.status, "failed");
+    }
+
+    #[tokio::test]
+    async fn a_run_task_leaves_in_flight_when_it_ends_or_panics() {
+        let id = i64::MAX - 7;
+        let wake = Arc::new(Notify::new());
+        let guard = InFlight::enter(id, wake.clone());
+        assert!(IN_FLIGHT.lock().contains(&id));
+        let task = tokio::task::spawn(async move {
+            let _guard = guard;
+            panic!("run panicked");
+        });
+        assert!(task.await.is_err());
+        assert!(!IN_FLIGHT.lock().contains(&id));
+        let woken = tokio::time::timeout(Duration::from_millis(50), wake.notified()).await;
+        assert!(woken.is_ok(), "a panicked run still wakes the worker");
+    }
+
+    #[tokio::test]
+    async fn a_new_holder_does_not_exceed_the_caps_after_failover() {
+        let db = db().await;
+        for (i, org) in ["a", "a", "b", "b", "c", "c", "d", "d"].iter().enumerate() {
+            let id = enqueue(&db, org, &format!("running-{i}"), NOW - SEC).await;
+            assert!(ledger::claim(&db, id, "node-b", NOW - SEC).await.unwrap());
+        }
+        enqueue(&db, "e", "queued-e", NOW).await;
+        enqueue(&db, "a", "queued-a", NOW).await;
+        let hooks = enabled(&["a", "b", "c", "d", "e"]);
+        let claimed = claim_pass_in(
+            &db,
+            &hooks,
+            &pass(limits(8, 2), Some(&[LOCAL, "node-b"])),
+            &mut 0,
+        )
+        .await
+        .unwrap();
+        assert_eq!(claimed, 0);
+        assert!(hooks.started.lock().unwrap().is_empty());
+        assert_eq!(row(&db, "e", "queued-e").await.status, "queued");
+        assert_eq!(
+            ledger::running_counts(&db).await.unwrap().total,
+            8,
+            "the old holder's runs keep their slots"
+        );
+    }
+
+    #[tokio::test]
+    async fn a_claim_pass_starts_the_oldest_row_of_each_org_in_turn() {
+        let db = db().await;
+        enqueue(&db, "a", "a-old", NOW - 2 * SEC).await;
+        enqueue(&db, "a", "a-new", NOW - SEC).await;
+        enqueue(&db, "b", "b-old", NOW - SEC).await;
+        let hooks = enabled(&["a", "b"]);
+        let claimed = claim_pass_in(&db, &hooks, &pass(limits(2, 2), Some(&[LOCAL])), &mut 0)
+            .await
+            .unwrap();
+        assert_eq!(claimed, 2);
+        let started: Vec<String> = hooks
+            .started
+            .lock()
+            .unwrap()
+            .iter()
+            .map(|r| r.run_id.clone())
+            .collect();
+        assert_eq!(started, ["a-old", "b-old"]);
+        let running = row(&db, "a", "a-old").await;
+        assert_eq!(running.status, "running");
+        assert_eq!(running.claimed_by.as_deref(), Some(LOCAL));
+        assert_eq!(running.claimed_at, Some(NOW));
+        assert_eq!(row(&db, "a", "a-new").await.status, "queued");
+    }
+
+    #[tokio::test]
+    async fn a_row_older_than_the_ttl_is_expired_and_never_run() {
+        let db = db().await;
+        enqueue(&db, "a", "stale", NOW - 3601 * SEC).await;
+        let hooks = enabled(&["a"]);
+        claim_pass_in(&db, &hooks, &pass(limits(8, 2), Some(&[LOCAL])), &mut 0)
+            .await
+            .unwrap();
+        let expired = row(&db, "a", "stale").await;
+        assert_eq!(expired.status, "expired");
+        assert_eq!(expired.finished_at, Some(NOW));
+        assert!(hooks.started.lock().unwrap().is_empty());
+        assert_eq!(
+            ledger::read_payload(&db, "a", "wf-a", "stale")
+                .await
+                .unwrap(),
+            None,
+            "a row that never runs keeps no payload"
+        );
+    }
+
+    #[tokio::test]
+    async fn a_row_for_a_disabled_workflow_fails_with_workflow_disabled() {
+        let db = db().await;
+        enqueue(&db, "a", "disabled", NOW).await;
+        enqueue(&db, "b", "gone", NOW).await;
+        let hooks = FakeClaims {
+            enabled: HashMap::from([("wf-a".to_string(), false)]),
+            ..Default::default()
+        };
+        claim_pass_in(&db, &hooks, &pass(limits(8, 2), Some(&[LOCAL])), &mut 0)
+            .await
+            .unwrap();
+        for (org, run_id) in [("a", "disabled"), ("b", "gone")] {
+            let refused = row(&db, org, run_id).await;
+            assert_eq!(
+                (refused.status.as_str(), refused.error.as_deref()),
+                ("failed", Some(ERR_WORKFLOW_DISABLED)),
+                "{run_id}"
+            );
+        }
+        assert!(hooks.started.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn a_deleting_orgs_queued_rows_expire_without_running() {
+        let db = db().await;
+        enqueue(&db, "a", "deleting", NOW).await;
+        enqueue(&db, "b", "live", NOW).await;
+        let hooks = FakeClaims {
+            blocked: HashSet::from(["a".to_string()]),
+            ..enabled(&["a", "b"])
+        };
+        claim_pass_in(&db, &hooks, &pass(limits(8, 2), Some(&[LOCAL])), &mut 0)
+            .await
+            .unwrap();
+        let refused = row(&db, "a", "deleting").await;
+        assert_eq!(
+            (refused.status.as_str(), refused.error.as_deref()),
+            ("expired", None)
+        );
+        assert_eq!(
+            load_run_input(&db, &refused).await.unwrap(),
+            None,
+            "the refused run's payload goes with it"
+        );
+        let started: Vec<String> = hooks
+            .started
+            .lock()
+            .unwrap()
+            .iter()
+            .map(|row| row.org_id.clone())
+            .collect();
+        assert_eq!(started, ["b"]);
+    }
+
+    #[tokio::test]
+    async fn the_payload_loader_reads_the_rw_handle_not_the_replica() {
+        let rw = db().await;
+        let replica = db().await;
+        enqueue(&rw, "a", "r1", NOW).await;
+        let claimed = row(&rw, "a", "r1").await;
+        let input = load_run_input(&rw, &claimed).await.unwrap().unwrap();
+        assert_eq!(input["meta"]["run_id"], "r1");
+        assert_eq!(input["data"][0], 1);
+        assert_eq!(load_run_input(&replica, &claimed).await.unwrap(), None);
+    }
+
+    #[tokio::test]
+    async fn an_unreadable_payload_is_an_error() {
+        let rw = db().await;
+        enqueue(&rw, "a", "r1", NOW).await;
+        workflow_run_data::Entity::update_many()
+            .col_expr(
+                workflow_run_data::Column::Data,
+                sea_orm::sea_query::Expr::value("not json"),
+            )
+            .exec(&rw)
+            .await
+            .unwrap();
+        let claimed = row(&rw, "a", "r1").await;
+        assert!(load_run_input(&rw, &claimed).await.is_err());
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_timed_out_run_is_recorded_only_after_the_run_future_completes() {
+        let cancel = CancellationToken::new();
+        let drained = Arc::new(AtomicBool::new(false));
+        let (token, done) = (cancel.clone(), drained.clone());
+        let run = async move {
+            token.cancelled().await;
+            tokio::time::sleep(Duration::from_secs(3)).await;
+            done.store(true, Ordering::SeqCst);
+            "drained"
+        };
+        let started = Instant::now();
+        let outcome = run_with_timeout(run, cancel.clone(), Duration::from_secs(10)).await;
+        assert_eq!(outcome, None);
+        assert!(cancel.is_cancelled());
+        assert!(
+            drained.load(Ordering::SeqCst),
+            "the timeout returned before the cancelled run drained"
+        );
+        assert_eq!(started.elapsed(), Duration::from_secs(13));
+        assert_eq!(run_outcome(None).code, Some(ERR_RUN_TIMEOUT));
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_run_inside_the_timeout_returns_its_output() {
+        let cancel = CancellationToken::new();
+        let run = async {
+            tokio::time::sleep(Duration::from_secs(1)).await;
+            7
+        };
+        assert_eq!(
+            run_with_timeout(run, cancel.clone(), Duration::from_secs(10)).await,
+            Some(7)
+        );
+        assert!(!cancel.is_cancelled());
+    }
+
+    #[test]
+    fn run_results_map_to_ledger_statuses() {
+        let clean = run_outcome(Some(Ok(WorkflowExecutionStatus::Success)));
+        assert_eq!((clean.status, clean.code), (HookRunStatus::Succeeded, None));
+        let disabled = run_outcome(Some(Ok(WorkflowExecutionStatus::Disabled)));
+        assert_eq!(
+            (disabled.status, disabled.code),
+            (HookRunStatus::Failed, Some(ERR_WORKFLOW_DISABLED))
+        );
+        let errored = run_outcome(Some(Ok(WorkflowExecutionStatus::Errored)));
+        assert_eq!(
+            (errored.status, errored.code),
+            (HookRunStatus::Failed, Some(ERR_NODE_ERRORED))
+        );
+        let failed = run_outcome(Some(Err(anyhow::anyhow!("db password rejected"))));
+        assert_eq!(failed.code, Some(ERR_RUN_FAILED));
+        assert_eq!(
+            failed.detail.as_deref(),
+            Some("db password rejected"),
+            "the text reaches history, never the polled ledger row"
+        );
+    }
+
+    #[tokio::test]
+    async fn the_supervisor_clears_heartbeat_and_lock_owner_when_the_worker_exits() {
+        let store = FakeStore::default();
+        store
+            .put(HEARTBEAT_KEY, heartbeat_bytes(LOCAL))
+            .await
+            .unwrap();
+        store
+            .put(WORKER_LOCK_KEY, Bytes::from(LOCAL))
+            .await
+            .unwrap();
+        let worker = tokio::spawn(crash());
+        let exit = supervise(&store, LOCAL, worker).await;
+        assert!(exit.starts_with("panic"), "{exit}");
+        assert_eq!(store.get(HEARTBEAT_KEY).await.unwrap(), None);
+        assert_eq!(store.get(WORKER_LOCK_KEY).await.unwrap(), None);
+
+        store
+            .put(HEARTBEAT_KEY, heartbeat_bytes(LOCAL))
+            .await
+            .unwrap();
+        store
+            .put(WORKER_LOCK_KEY, Bytes::from(LOCAL))
+            .await
+            .unwrap();
+        let worker = tokio::spawn(async { Err(anyhow::anyhow!("db gone")) });
+        supervise(&store, LOCAL, worker).await;
+        assert_eq!(store.get(HEARTBEAT_KEY).await.unwrap(), None);
+        assert_eq!(store.get(WORKER_LOCK_KEY).await.unwrap(), None);
+    }
+
+    #[tokio::test]
+    async fn the_supervisor_keeps_the_keys_of_another_holder() {
+        let store = FakeStore::default();
+        store
+            .put(HEARTBEAT_KEY, heartbeat_bytes("node-b"))
+            .await
+            .unwrap();
+        store
+            .put(WORKER_LOCK_KEY, Bytes::from("node-b"))
+            .await
+            .unwrap();
+        let worker = tokio::spawn(crash());
+        supervise(&store, LOCAL, worker).await;
+        assert!(store.get(HEARTBEAT_KEY).await.unwrap().is_some());
+        assert_eq!(
+            store.get(WORKER_LOCK_KEY).await.unwrap(),
+            Some(Bytes::from("node-b"))
+        );
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_queued_row_without_a_wake_is_claimed_by_the_tick() {
+        let env = Arc::new(FakeWorker::default());
+        let notify = Arc::new(Notify::new());
+        let running = env.clone();
+        tokio::spawn(async move { worker_loop(running.as_ref(), notify).await });
+        advance(Duration::from_millis(10)).await;
+        assert!(env.passes.load(Ordering::SeqCst) >= 1, "a pass at start");
+        env.queued.store(true, Ordering::SeqCst);
+        advance(Duration::from_secs(1)).await;
+        assert_eq!(env.claimed.load(Ordering::SeqCst), 0);
+        advance(Duration::from_millis(1100)).await;
+        assert_eq!(env.claimed.load(Ordering::SeqCst), 1, "the 2 s tick claims");
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn the_holder_renews_the_lock_and_heartbeat_every_five_seconds() {
+        let env = Arc::new(FakeWorker::default());
+        let running = env.clone();
+        tokio::spawn(async move { worker_loop(running.as_ref(), Arc::new(Notify::new())).await });
+        advance(Duration::from_millis(10)).await;
+        assert_eq!(env.locks.load(Ordering::SeqCst), 1);
+        advance(Duration::from_secs(5)).await;
+        assert_eq!(env.locks.load(Ordering::SeqCst), 2);
+        advance(Duration::from_secs(5)).await;
+        assert_eq!(env.locks.load(Ordering::SeqCst), 3);
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_finished_run_wakes_the_next_claim_without_waiting_for_the_tick() {
+        let notify = Arc::new(Notify::new());
+        let env = Arc::new(BacklogWorker::new(40, 2, notify.clone()));
+        let (running, all_done) = (env.clone(), env.all_done.clone());
+        let start = Instant::now();
+        tokio::spawn(async move { worker_loop(running.as_ref(), notify).await });
+        let drained = tokio::time::timeout(Duration::from_secs(120), all_done.notified()).await;
+        assert!(drained.is_ok(), "the backlog never drained");
+        let elapsed = start.elapsed();
+        assert_eq!(env.done.load(Ordering::SeqCst), 40);
+        assert!(
+            elapsed < TICK,
+            "40 instant runs at 2 per org took {elapsed:?}, the tick rate is 20 x 2 s"
+        );
+    }
+
+    #[tokio::test(start_paused = true)]
+    async fn a_wake_runs_a_pass_before_the_tick() {
+        let env = Arc::new(FakeWorker::default());
+        let notify = Arc::new(Notify::new());
+        let (running, wake) = (env.clone(), notify.clone());
+        tokio::spawn(async move { worker_loop(running.as_ref(), wake).await });
+        advance(Duration::from_millis(10)).await;
+        env.queued.store(true, Ordering::SeqCst);
+        notify.notify_one();
+        advance(Duration::from_millis(10)).await;
+        assert_eq!(env.claimed.load(Ordering::SeqCst), 1);
+    }
+}
diff --git a/src/core/src/workflows/mod.rs b/src/core/src/workflows/mod.rs
index 6787f246ce..c1fc01e9cc 100644
--- a/src/core/src/workflows/mod.rs
+++ b/src/core/src/workflows/mod.rs
@@ -16,6 +16,7 @@
 use std::collections::{HashMap, HashSet};
 
 use config::meta::{
+    feature::Feature,
     folder::DEFAULT_FOLDER,
     pipeline::components::NodeData,
     self_reporting::usage::{RunOutcome, TriggerData, TriggerDataType},
@@ -39,7 +40,9 @@ use crate::{
     pipeline::batch_execution::{ExecutablePipeline, WorkflowResult, WorkflowRunOptions},
 };
 
+pub mod http_trigger;
 pub mod runtime;
+
 #[derive(Serialize, Deserialize)]
 pub struct InputMap {
     // even though a bad naming convention, node_map is
@@ -69,9 +72,22 @@ pub struct TestWorkflowOptions {
     pub suppress_destinations: bool,
 }
 
-enum WorkflowExecutionStatus {
+pub(crate) enum WorkflowExecutionStatus {
     Success,
     Errored,
+    Disabled,
+}
+
+pub struct TriggeredRun {
+    pub trace_id: String,
+    pub run_id: String,
+}
+
+#[derive(Debug)]
+pub enum TriggerWorkflowError {
+    NotFound,
+    Disabled,
+    Other(anyhow::Error),
 }
 
 // this function does not return error, as we do not have retry.
@@ -625,6 +641,8 @@ fn is_permitted(workflow_id: &str, org_id: &str, permitted: Option<&Vec<String>>
 }
 
 pub async fn delete_workflow(org_id: &str, id: &str) -> Result<(), anyhow::Error> {
+    // First, so a failed tombstone leaves the workflow in place for a retry.
+    http_trigger::sweeper::tombstone_workflow_trigger(org_id, id).await?;
     let associations = AssociationDeleteEvent::Workflow {
         org_id: org_id.to_string(),
         workflow_id: id.to_string(),
@@ -637,6 +655,10 @@ pub async fn delete_workflow(org_id: &str, id: &str) -> Result<(), anyhow::Error
 }
 
 pub async fn delete_draft(org_id: &str, id: &str) -> Result<(), anyhow::Error> {
+    // A published workflow with the same id still owns its endpoint.
+    if get_workflow_by_id(org_id, id).await?.is_none() {
+        http_trigger::sweeper::tombstone_workflow_trigger(org_id, id).await?;
+    }
     // a 0-row delete must not drop the owner's tuple or replay unscoped to peers
     if db::workflows::delete_draft_record(org_id, id).await? == 0 {
         return Ok(());
@@ -698,6 +720,32 @@ fn record_workflow_run(
     });
 }
 
+fn history_row_for(
+    org_id: &str,
+    key: String,
+    trace_id: &str,
+    start_time: i64,
+    end_time: i64,
+    error: Option<String>,
+) -> TriggerData {
+    TriggerData {
+        _timestamp: start_time,
+        org: org_id.to_string(),
+        module: TriggerDataType::Workflow,
+        key,
+        is_realtime: false,
+        is_silenced: false,
+        status: run_outcome_for(error.as_deref()),
+        start_time,
+        end_time,
+        error,
+        source_node: Some(config::cluster::LOCAL_NODE.name.clone()),
+        evaluation_took_in_secs: Some((end_time - start_time) as f64 / 1_000_000.0),
+        scheduler_trace_id: Some(trace_id.to_string()),
+        ..Default::default()
+    }
+}
+
 /// Folds a finished run into the row we persist: node errors plus the per-node input/output
 /// maps. A clean run yields an empty `data` and a fully populated map, which is what makes a
 /// successful run inspectable after the fact.
@@ -820,6 +868,7 @@ pub async fn test_workflow(
             from_node,
             WorkflowRunOptions {
                 suppress_destinations,
+                ..Default::default()
             },
         )
         .await;
@@ -854,9 +903,15 @@ pub async fn trigger_workflow(
     id: &str,
     inputs: Vec<serde_json::Value>,
     user_id: &str,
-) -> Result<String, anyhow::Error> {
-    if db::workflows::get_workflow(org_id, id).await?.is_none() {
-        return Err(anyhow::anyhow!("workflow with id {id} not found"));
+) -> Result<TriggeredRun, TriggerWorkflowError> {
+    let Some(workflow) = db::workflows::get_workflow(org_id, id)
+        .await
+        .map_err(TriggerWorkflowError::Other)?
+    else {
+        return Err(TriggerWorkflowError::NotFound);
+    };
+    if !workflow.enabled {
+        return Err(TriggerWorkflowError::Disabled);
     }
 
     let metadata = [("event_type", "manual"), ("user_id", user_id)]
@@ -869,7 +924,7 @@ pub async fn trigger_workflow(
         "received webhook trigger for workflow {org_id}/{id} from user {user_id}, assigning trace id {trace_id}"
     );
 
-    if let Err(e) = send_workflow_trigger(
+    let run_id = send_workflow_trigger(
         &trace_id,
         org_id,
         user_id.to_string(),
@@ -879,16 +934,16 @@ pub async fn trigger_workflow(
         &inputs,
     )
     .await
-    {
+    .map_err(|e| {
         log::error!(
             "error in sending webhook trigger for workflow {org_id}/{id} from user {user_id}, trace id {trace_id} error : {e}"
         );
-        return Err(e);
-    }
+        TriggerWorkflowError::Other(e)
+    })?;
     log::info!(
-        "successfully triggered workflow {org_id}/{id} from user {user_id}, with trace id {trace_id}"
+        "successfully triggered workflow {org_id}/{id} from user {user_id}, with trace id {trace_id} run id {run_id}"
     );
-    Ok(trace_id)
+    Ok(TriggeredRun { trace_id, run_id })
 }
 
 async fn execute_workflow(
@@ -896,19 +951,20 @@ async fn execute_workflow(
     id: &str,
     run_id: &str,
     inputs: Vec<serde_json::Value>,
+    options: WorkflowRunOptions,
 ) -> Result<WorkflowExecutionStatus, anyhow::Error> {
     let workflow = get_workflow_by_id(org_id, id)
         .await?
         .ok_or_else(|| anyhow::anyhow!("workflow with given id not found"))?;
 
     if !workflow.enabled {
-        return Ok(WorkflowExecutionStatus::Success);
+        return Ok(WorkflowExecutionStatus::Disabled);
     }
 
     let executable = ExecutablePipeline::new_from_workflow(&workflow).await?;
 
     let res = executable
-        .process_workflow(org_id, inputs, None, Default::default())
+        .process_workflow(org_id, inputs, None, options)
         .await?;
 
     let WorkflowResult {
@@ -929,6 +985,27 @@ async fn execute_workflow(
     }
 }
 
+/// The caller owns `cancel`, so a timed-out run stops dispatching before its slot is freed.
+pub(crate) async fn run_hook_workflow(
+    org_id: &str,
+    workflow_id: &str,
+    run_id: &str,
+    input: Value,
+    cancel: tokio_util::sync::CancellationToken,
+) -> Result<WorkflowExecutionStatus, anyhow::Error> {
+    execute_workflow(
+        org_id,
+        workflow_id,
+        run_id,
+        vec![input],
+        WorkflowRunOptions {
+            cancel: Some(cancel),
+            ..Default::default()
+        },
+    )
+    .await
+}
+
 pub async fn get_workflow_errors(
     org_id: &str,
     wid: &str,
@@ -1020,6 +1097,15 @@ pub async fn retry_run(
     res
 }
 
+// an error, not Ok, so alert history records the skipped delivery instead of a success
+fn require_workflows_license(entitled: bool) -> Result<(), anyhow::Error> {
+    if entitled {
+        return Ok(());
+    }
+    let feature: &str = Feature::Workflows.into();
+    Err(infra::errors::ErrorCodes::LicenseFeatureNotEntitled(feature.to_string()).into())
+}
+
 pub async fn send_workflow_trigger(
     trace_id: &str,
     org_id: &str,
@@ -1028,11 +1114,13 @@ pub async fn send_workflow_trigger(
     workflow_id: &str,
     metadata: HashMap<String, Value>,
     data: &[Value],
-) -> Result<(), anyhow::Error> {
-    let o2_cfg = get_o2_config();
-    if !o2_cfg.common.workflows_enabled {
-        return Ok(());
+) -> Result<String, anyhow::Error> {
+    if !get_o2_config().common.workflows_enabled {
+        return Ok(String::new());
     }
+    require_workflows_license(o2_enterprise::enterprise::license::check_features(&[
+        Feature::Workflows,
+    ]))?;
 
     let data = serde_json::to_string(data)?;
     let run_id = config::ider::uuid();
@@ -1064,7 +1152,7 @@ pub async fn send_workflow_trigger(
     runtime::send_workflow_trigger(trigger).await?;
     log::info!("successfully sent workflow trigger for trace id {trace_id} run id {run_id}");
 
-    Ok(())
+    Ok(run_id)
 }
 
 /// The 4-part positional run-history key. Display, not Debug: a Debug-formatted
@@ -1078,9 +1166,51 @@ pub fn workflow_history_key(
     format!("{workflow_id}/{trigger_type}/{source_id}/{run_id}")
 }
 
+pub(crate) fn publish_hook_history(
+    org_id: &str,
+    workflow_id: &str,
+    trigger_id: &str,
+    run_id: &str,
+    start_time: i64,
+    end_time: i64,
+    error: Option<String>,
+) {
+    publish_triggers_usage(hook_history_row(
+        org_id,
+        workflow_id,
+        trigger_id,
+        run_id,
+        start_time,
+        end_time,
+        error,
+    ));
+}
+
+/// Hook runs have no trace id of their own; the run id is what callers poll and search by.
+fn hook_history_row(
+    org_id: &str,
+    workflow_id: &str,
+    trigger_id: &str,
+    run_id: &str,
+    start_time: i64,
+    end_time: i64,
+    error: Option<String>,
+) -> TriggerData {
+    let key = workflow_history_key(
+        workflow_id,
+        WorkflowTriggerType::Webhook,
+        &format!("hook:{trigger_id}"),
+        run_id,
+    );
+    history_row_for(org_id, key, run_id, start_time, end_time, error)
+}
+
 pub async fn handle_workflow_trigger(trigger: WorkflowTrigger) {
-    let o2_cfg = get_o2_config();
-    if !o2_cfg.common.workflows_enabled {
+    if !get_o2_config().common.workflows_enabled
+        || !o2_enterprise::enterprise::license::check_features(&[
+            config::meta::feature::Feature::Workflows,
+        ])
+    {
         return;
     }
     match get_nats_lock(format!(
@@ -1166,6 +1296,7 @@ pub async fn handle_workflow_trigger(trigger: WorkflowTrigger) {
         &trigger.workflow_id,
         &run_id,
         vec![final_data],
+        WorkflowRunOptions::default(),
     )
     .await;
     let end_time = chrono::Utc::now().timestamp_micros();
@@ -1178,29 +1309,21 @@ pub async fn handle_workflow_trigger(trigger: WorkflowTrigger) {
         _ => None,
     };
 
-    let trigger_data_stream: TriggerData = TriggerData {
-        _timestamp: start_time,
-        org: trigger.org_id.clone(),
-        module: TriggerDataType::Workflow,
-        // this order matters in the workflow history api, as we parse this there
-        key: workflow_history_key(
-            &trigger.workflow_id,
-            trigger.trigger_type,
-            &trigger.source_id,
-            &run_id,
-        ),
-        is_realtime: false,
-        is_silenced: false,
-        status: RunOutcome::Succeeded,
+    // this order matters in the workflow history api, as we parse this there
+    let key = workflow_history_key(
+        &trigger.workflow_id,
+        trigger.trigger_type,
+        &trigger.source_id,
+        &run_id,
+    );
+    publish_triggers_usage(history_row_for(
+        &trigger.org_id,
+        key,
+        &trace_id,
         start_time,
         end_time,
         error,
-        source_node: Some(config::cluster::LOCAL_NODE.name.clone()),
-        evaluation_took_in_secs: Some((end_time - start_time) as f64 / 1_000_000.0),
-        scheduler_trace_id: Some(trace_id.clone()),
-        ..Default::default()
-    };
-    publish_triggers_usage(trigger_data_stream);
+    ));
 
     if let Err(e) = infra::table::workflows::delete_run_data(
         &trigger.org_id,
@@ -1233,6 +1356,22 @@ pub async fn get_data_for_run(
 mod tests {
     use super::*;
 
+    #[test]
+    fn a_licensed_trigger_passes_the_license_check() {
+        assert!(require_workflows_license(true).is_ok());
+    }
+
+    #[test]
+    fn trigger_without_workflows_license_is_an_error_naming_the_feature() {
+        let err = require_workflows_license(false).unwrap_err();
+        match err.downcast_ref::<infra::errors::ErrorCodes>() {
+            Some(infra::errors::ErrorCodes::LicenseFeatureNotEntitled(f)) => {
+                assert_eq!(f, "workflows")
+            }
+            other => panic!("expected LicenseFeatureNotEntitled, got {other:?}"),
+        }
+    }
+
     #[test]
     fn history_key_for_a_manual_run_records_manual_and_the_firing_user() {
         let key = workflow_history_key(
@@ -1472,4 +1611,46 @@ mod tests {
         assert_eq!(errors.data[0].node_id, "n1");
         assert_eq!(errors.data[0].error, vec!["boom".to_string()]);
     }
+
+    #[test]
+    fn a_hook_run_history_key_names_webhook_and_the_trigger() {
+        let row = hook_history_row("acme", "wf1", "t1", "run1", 10, 20, None);
+        assert_eq!(row.key, "wf1/Webhook/hook:t1/run1");
+        assert_eq!(row.status, RunOutcome::Succeeded);
+        assert_eq!(row.scheduler_trace_id.as_deref(), Some("run1"));
+        let failed = hook_history_row(
+            "acme",
+            "wf1",
+            "t1",
+            "run1",
+            10,
+            20,
+            Some("run_timeout".into()),
+        );
+        assert_eq!(failed.status, RunOutcome::Error);
+        assert_eq!(failed.error.as_deref(), Some("run_timeout"));
+    }
+
+    #[test]
+    fn an_errored_run_is_recorded_with_error_status() {
+        let key = workflow_history_key("wf1", WorkflowTriggerType::AlertFired, "alert1", "run1");
+        let errored = history_row_for(
+            "org1",
+            key.clone(),
+            "trace1",
+            10,
+            20,
+            Some("some node errored during execution".to_string()),
+        );
+        assert_eq!(errored.status, RunOutcome::Error);
+        assert_eq!(errored.key, key);
+        assert_eq!(errored.scheduler_trace_id.as_deref(), Some("trace1"));
+        assert_eq!(
+            errored.error.as_deref(),
+            Some("some node errored during execution")
+        );
+
+        let clean = history_row_for("org1", key, "trace1", 10, 20, None);
+        assert_eq!(clean.status, RunOutcome::Succeeded);
+    }
 }
diff --git a/src/core/src/workflows/runtime.rs b/src/core/src/workflows/runtime.rs
index 59fab172af..48624f6e14 100644
--- a/src/core/src/workflows/runtime.rs
+++ b/src/core/src/workflows/runtime.rs
@@ -16,7 +16,14 @@
 use std::sync::Arc;
 
 use config::get_config;
-use infra::{coordinator::get_coordinator, db::Event};
+use infra::{
+    coordinator::get_coordinator,
+    db::{Event, get_orm_client_rw},
+    table::workflow_http_trigger_requests::{
+        IDEM_KEY_TTL_US, delete_terminal_before, null_idem_keys_before,
+    },
+};
+use sea_orm::{ConnectionTrait, TransactionTrait};
 
 use super::{WorkflowTrigger, handle_workflow_trigger};
 
@@ -31,6 +38,12 @@ pub async fn clean() {
         interval.tick().await;
         let limit_time = chrono::Utc::now().timestamp_micros() - duration_limit;
 
+        // First, so a failed error or run cleanup below never skips the ledger's.
+        let now = chrono::Utc::now().timestamp_micros();
+        if let Err(e) = clean_hook_ledger(get_orm_client_rw().await, now, limit_time).await {
+            log::error!("error cleaning the workflow http trigger ledger : {e}");
+        }
+
         let errors = match db::workflows::delete_errors_older_than(limit_time).await {
             Ok(v) => v,
             Err(e) => {
@@ -121,3 +134,76 @@ pub async fn watch_workflow_triggers() -> Result<(), anyhow::Error> {
         }
     }
 }
+
+/// Region-local: each region's cleanup loop owns only its own ledger rows.
+async fn clean_hook_ledger<C: ConnectionTrait + TransactionTrait>(
+    db: &C,
+    now_us: i64,
+    terminal_before_us: i64,
+) -> Result<(), anyhow::Error> {
+    let keys = null_idem_keys_before(db, now_us - IDEM_KEY_TTL_US).await?;
+    let rows = delete_terminal_before(db, terminal_before_us).await?;
+    log::info!("cleaned {keys} idempotency keys and {rows} finished http trigger runs");
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use infra::table::workflow_http_trigger_requests::{
+        self as ledger, HookRunStatus, NewHookRequest, create_tables_for_tests, get_run,
+    };
+    use sea_orm::{ConnectOptions, Database};
+
+    use super::*;
+
+    const NOW: i64 = 1_760_000_000_000_000;
+    const DAY: i64 = 24 * 3600 * 1_000_000;
+
+    fn request(run_id: &str, idem_key: &str, received_at: i64) -> NewHookRequest {
+        NewHookRequest {
+            trigger_id: "t1".to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: "wf-1".to_string(),
+            run_id: run_id.to_string(),
+            idem_key: Some(idem_key.to_string()),
+            body_sha256: "cd".repeat(32),
+            body_bytes: 2,
+            content_type: None,
+            meta: "{}".to_string(),
+            credential_id: "c1".to_string(),
+            credential_prefix: "o2wh_abcd…wxyz".to_string(),
+            caller_ip: "203.0.113.7".to_string(),
+            received_at,
+        }
+    }
+
+    #[tokio::test]
+    async fn the_cleanup_loop_clears_old_keys_and_finished_runs() {
+        let mut opts = ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = Database::connect(opts).await.unwrap();
+        create_tables_for_tests(&db).await.unwrap();
+        for (run_id, key, at) in [
+            ("old", "k-old", NOW - 31 * DAY),
+            ("day", "k-day", NOW - 2 * DAY),
+        ] {
+            ledger::enqueue(&db, request(run_id, key, at), "{}".to_string())
+                .await
+                .unwrap();
+            let id = get_run(&db, "t1", run_id).await.unwrap().unwrap().id;
+            ledger::finish_unclaimed(&db, id, HookRunStatus::Expired, None, at)
+                .await
+                .unwrap();
+        }
+        ledger::enqueue(&db, request("fresh", "k-fresh", NOW), "{}".to_string())
+            .await
+            .unwrap();
+
+        clean_hook_ledger(&db, NOW, NOW - 30 * DAY).await.unwrap();
+        assert!(get_run(&db, "t1", "old").await.unwrap().is_none());
+        let day = get_run(&db, "t1", "day").await.unwrap().unwrap();
+        assert_eq!(day.idem_key, None, "keys live for a day");
+        let fresh = get_run(&db, "t1", "fresh").await.unwrap().unwrap();
+        assert_eq!(fresh.idem_key.as_deref(), Some("k-fresh"));
+    }
+}
diff --git a/src/db/src/downtimes.rs b/src/db/src/downtimes.rs
index 21bcc7c2f5..a839ecccd1 100644
--- a/src/db/src/downtimes.rs
+++ b/src/db/src/downtimes.rs
@@ -37,6 +37,16 @@ pub use super_cluster::replicates;
 static DOWNTIMES: LazyLock<RwLock<HashMap<String, Arc<Vec<Downtime>>>>> =
     LazyLock::new(Default::default);
 
+/// Held from a refresh's read to its apply, so a later apply always carries a later snapshot.
+static REFRESH: tokio::sync::Mutex<()> = tokio::sync::Mutex::const_new(());
+
+/// Proof that the caller holds [REFRESH]; every write to [DOWNTIMES] takes one.
+struct Refresh<'a>(#[allow(dead_code)] tokio::sync::MutexGuard<'a, ()>);
+
+async fn refresh() -> Refresh<'static> {
+    Refresh(REFRESH.lock().await)
+}
+
 /// Writes the row with its SLO re-measures, tells this region's nodes, then the other regions.
 pub async fn set(downtime: &Downtime, remeasures: &[Remeasure]) -> Result<(), anyhow::Error> {
     write(downtime, Guard::None, remeasures).await?;
@@ -118,7 +128,7 @@ pub async fn delete(org: &str, id: &str, stored: table::RowVersion) -> Result<bo
         return Ok(false);
     };
     coordinator::emit_delete_event(org, id).await?;
-    remove_cached(org, id);
+    remove_cached(&refresh().await, org, id);
     // Other regions order by the tombstone's own version and time, so both travel as written.
     #[cfg(feature = "enterprise")]
     super_cluster::emit_delete(org, id, tombstone.version, tombstone.updated_at).await;
@@ -165,15 +175,24 @@ pub async fn delete_ended_before(cutoff: i64) -> Result<u64, anyhow::Error> {
     for row in &ended {
         coordinator::emit_delete_event(&row.org, &row.id).await?;
         crate::authz::remove_ownership(&row.org, "downtimes", ownership(row)).await;
-        remove_cached(&row.org, &row.id);
+        remove_cached(&refresh().await, &row.org, &row.id);
     }
     Ok(removed)
 }
 
-/// Loads every row of every org, replacing the cache.
+/// Loads every row of every org from the primary, replacing the cache.
 pub async fn cache() -> Result<(), anyhow::Error> {
+    let conn = infra::db::get_orm_client_rw().await;
+    refresh_all(async { Ok(table::list_all_with(conn).await?) }).await
+}
+
+/// Replaces the whole cache with what `read` returns; an org it does not name is dropped.
+async fn refresh_all(
+    read: impl std::future::Future<Output = Result<Vec<Downtime>, anyhow::Error>>,
+) -> Result<(), anyhow::Error> {
+    let guard = refresh().await;
     let mut by_org: HashMap<String, Vec<Downtime>> = HashMap::new();
-    for downtime in table::list_all().await? {
+    for downtime in read.await? {
         by_org
             .entry(downtime.org.clone())
             .or_default()
@@ -183,7 +202,7 @@ pub async fn cache() -> Result<(), anyhow::Error> {
         .into_iter()
         .map(|(org, rows)| (org, Arc::new(rows)))
         .collect();
-    *DOWNTIMES.write().unwrap_or_else(|e| e.into_inner()) = fresh;
+    replace_all(&guard, fresh);
     Ok(())
 }
 
@@ -233,17 +252,24 @@ pub fn ownership(downtime: &Downtime) -> Authz {
     ownership_ref(&downtime.id, &downtime.folder_id)
 }
 
-/// Reloads one org from the table so the cache never holds half a row.
+/// Reloads one org from the primary, so a node sees its own write and no replica lag.
 pub async fn reload_org(org: &str) -> Result<(), anyhow::Error> {
-    let rows = table::list(org, None).await?;
-    replace_org(org, rows);
-    Ok(())
+    reload_org_with(infra::db::get_orm_client_rw().await, org).await
 }
 
-/// [reload_org] through `conn`, so a caller can read the primary instead of a replica.
+/// [reload_org] through `conn`.
 pub async fn reload_org_with<C: ConnectionTrait>(conn: &C, org: &str) -> Result<(), anyhow::Error> {
-    let rows = table::list_with(conn, org, None).await?;
-    replace_org(org, rows);
+    refresh_org(org, async { Ok(table::list_with(conn, org, None).await?) }).await
+}
+
+/// Replaces one org with what `read` returns, read and applied under [REFRESH].
+async fn refresh_org(
+    org: &str,
+    read: impl std::future::Future<Output = Result<Vec<Downtime>, anyhow::Error>>,
+) -> Result<(), anyhow::Error> {
+    let guard = refresh().await;
+    let rows = read.await?;
+    replace_org(&guard, org, rows);
     Ok(())
 }
 
@@ -267,7 +293,7 @@ async fn on_put(org: String, _id: String) -> Result<(), anyhow::Error> {
 }
 
 async fn on_delete(org: String, id: String) -> Result<(), anyhow::Error> {
-    remove_cached(&org, &id);
+    remove_cached(&refresh().await, &org, &id);
     Ok(())
 }
 
@@ -286,7 +312,11 @@ fn ownership_backfill(orgs: &[Arc<Vec<Downtime>>]) -> Vec<(String, Authz)> {
         .collect()
 }
 
-fn replace_org(org: &str, rows: Vec<Downtime>) {
+fn replace_all(_: &Refresh<'_>, fresh: HashMap<String, Arc<Vec<Downtime>>>) {
+    *DOWNTIMES.write().unwrap_or_else(|e| e.into_inner()) = fresh;
+}
+
+fn replace_org(_: &Refresh<'_>, org: &str, rows: Vec<Downtime>) {
     let mut cache = DOWNTIMES.write().unwrap_or_else(|e| e.into_inner());
     if rows.is_empty() {
         cache.remove(org);
@@ -295,7 +325,7 @@ fn replace_org(org: &str, rows: Vec<Downtime>) {
     }
 }
 
-fn remove_cached(org: &str, id: &str) {
+fn remove_cached(_: &Refresh<'_>, org: &str, id: &str) {
     let mut cache = DOWNTIMES.write().unwrap_or_else(|e| e.into_inner());
     let Some(rows) = cache.get(org) else {
         return;
@@ -311,7 +341,7 @@ fn remove_cached(org: &str, id: &str) {
     }
 }
 
-fn remove_org(org: &str) {
+fn remove_org(_: &Refresh<'_>, org: &str) {
     DOWNTIMES
         .write()
         .unwrap_or_else(|e| e.into_inner())
@@ -320,7 +350,7 @@ fn remove_org(org: &str) {
 
 /// Drops this node's rows of the org, then every node's and region's copy of each id.
 async fn evict_org(org: &str, ids: &[String]) -> Result<(), anyhow::Error> {
-    let local = async { remove_org(org) };
+    let local = async { remove_org(&refresh().await, org) };
     let broadcast = async {
         for id in ids {
             coordinator::emit_delete_event(org, id).await?;
@@ -442,35 +472,156 @@ mod tests {
         list_cached(org).iter().map(|d| d.id.clone()).collect()
     }
 
-    #[test]
-    fn a_reload_replaces_the_org_list_and_a_delete_removes_one_id() {
+    #[tokio::test]
+    async fn a_reload_replaces_the_org_list_and_a_delete_removes_one_id() {
         let org = "db_downtimes_cache_test";
-        replace_org(org, vec![downtime(org, "a"), downtime(org, "b")]);
+        let guard = refresh().await;
+        replace_org(&guard, org, vec![downtime(org, "a"), downtime(org, "b")]);
         assert_eq!(ids(org), ["a", "b"]);
 
-        replace_org(org, vec![downtime(org, "c")]);
+        replace_org(&guard, org, vec![downtime(org, "c")]);
         assert_eq!(ids(org), ["c"], "a reload replaces, never merges");
 
-        replace_org(org, vec![downtime(org, "c"), downtime(org, "d")]);
-        remove_cached(org, "c");
+        replace_org(&guard, org, vec![downtime(org, "c"), downtime(org, "d")]);
+        remove_cached(&guard, org, "c");
         assert_eq!(ids(org), ["d"]);
-        remove_cached(org, "missing");
+        remove_cached(&guard, org, "missing");
         assert_eq!(ids(org), ["d"]);
 
-        remove_cached(org, "d");
+        remove_cached(&guard, org, "d");
         assert!(list_cached(org).is_empty());
     }
 
-    #[test]
-    fn remove_org_drops_every_row_of_that_org_only() {
+    #[tokio::test]
+    async fn remove_org_drops_every_row_of_that_org_only() {
         let (a, b) = ("db_downtimes_org_a", "db_downtimes_org_b");
-        replace_org(a, vec![downtime(a, "x")]);
-        replace_org(b, vec![downtime(b, "y")]);
-        remove_org(a);
+        let guard = refresh().await;
+        replace_org(&guard, a, vec![downtime(a, "x")]);
+        replace_org(&guard, b, vec![downtime(b, "y")]);
+        remove_org(&guard, a);
         assert!(list_cached(a).is_empty());
         assert_eq!(ids(b), ["y"]);
     }
 
+    /// A refresh whose read signals `read_started`, then returns `rows` once `gate` opens.
+    fn gated_refresh(
+        org: &'static str,
+        rows: Vec<Downtime>,
+        read_started: tokio::sync::oneshot::Sender<()>,
+        gate: tokio::sync::oneshot::Receiver<()>,
+    ) -> tokio::task::JoinHandle<Result<(), anyhow::Error>> {
+        tokio::spawn(refresh_org(org, async move {
+            let _ = read_started.send(());
+            let _ = gate.await;
+            Ok(rows)
+        }))
+    }
+
+    #[tokio::test]
+    async fn a_refresh_that_starts_later_reads_after_the_earlier_one_applies() {
+        let org = "db_downtimes_refresh_order";
+        let (started_tx, started_rx) = tokio::sync::oneshot::channel();
+        let (gate_tx, gate_rx) = tokio::sync::oneshot::channel();
+        let first = gated_refresh(org, vec![downtime(org, "old")], started_tx, gate_rx);
+        started_rx.await.unwrap();
+
+        let second_read = Arc::new(std::sync::atomic::AtomicBool::new(false));
+        let flag = second_read.clone();
+        let second = tokio::spawn(refresh_org(org, async move {
+            flag.store(true, std::sync::atomic::Ordering::SeqCst);
+            Ok(vec![downtime(org, "new")])
+        }));
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+        assert!(
+            !second_read.load(std::sync::atomic::Ordering::SeqCst),
+            "the second read waits for the first apply"
+        );
+
+        gate_tx.send(()).unwrap();
+        first.await.unwrap().unwrap();
+        second.await.unwrap().unwrap();
+        assert_eq!(ids(org), ["new"], "the later snapshot is applied last");
+    }
+
+    #[tokio::test]
+    async fn a_delete_during_a_refresh_read_is_not_undone() {
+        let org = "db_downtimes_refresh_delete";
+        let (started_tx, started_rx) = tokio::sync::oneshot::channel();
+        let (gate_tx, gate_rx) = tokio::sync::oneshot::channel();
+        // The read saw the row before its delete committed.
+        let reload = gated_refresh(org, vec![downtime(org, "gone")], started_tx, gate_rx);
+        started_rx.await.unwrap();
+        let delete = tokio::spawn(on_delete(org.to_string(), "gone".to_string()));
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+
+        gate_tx.send(()).unwrap();
+        reload.await.unwrap().unwrap();
+        delete.await.unwrap().unwrap();
+        assert!(list_cached(org).is_empty());
+    }
+
+    #[tokio::test]
+    async fn an_org_eviction_during_a_refresh_read_is_not_undone() {
+        let org = "db_downtimes_refresh_evict";
+        let (started_tx, started_rx) = tokio::sync::oneshot::channel();
+        let (gate_tx, gate_rx) = tokio::sync::oneshot::channel();
+        let reload = gated_refresh(org, vec![downtime(org, "x")], started_tx, gate_rx);
+        started_rx.await.unwrap();
+        // The local half of `evict_org`.
+        let evict = tokio::spawn(async move { remove_org(&refresh().await, org) });
+        tokio::time::sleep(std::time::Duration::from_millis(50)).await;
+
+        gate_tx.send(()).unwrap();
+        reload.await.unwrap().unwrap();
+        evict.await.unwrap();
+        assert!(list_cached(org).is_empty());
+    }
+
+    #[tokio::test]
+    async fn a_full_refresh_drops_an_org_with_no_rows_left() {
+        let (kept, emptied) = ("db_downtimes_full_kept", "db_downtimes_full_emptied");
+        {
+            let guard = refresh().await;
+            replace_org(&guard, emptied, vec![downtime(emptied, "last")]);
+        }
+        // The read keeps every other test's org, so only `emptied` is missing from it.
+        refresh_all(async move {
+            let mut rows: Vec<Downtime> = all_cached()
+                .iter()
+                .flat_map(|org| org.iter().cloned())
+                .filter(|d| d.org != emptied)
+                .collect();
+            rows.push(downtime(kept, "k"));
+            Ok(rows)
+        })
+        .await
+        .unwrap();
+        assert!(list_cached(emptied).is_empty());
+        assert_eq!(ids(kept), ["k"]);
+    }
+
+    #[test]
+    fn every_write_to_the_cache_holds_the_refresh_lock() {
+        let src = include_str!("downtimes.rs");
+        let src = &src[..src.find("#[cfg(test)]\nmod tests").unwrap()];
+        let mut writers = 0;
+        for body in src.split("fn ").skip(1) {
+            let body = &body[..body.find("\nfn ").unwrap_or(body.len())];
+            if body.contains("DOWNTIMES") && body.contains(".write()") {
+                writers += 1;
+                let signature = &body[..body.find('{').unwrap()];
+                assert!(
+                    signature.contains("&Refresh<'_>"),
+                    "a writer of DOWNTIMES must take &Refresh: fn {signature}"
+                );
+            }
+        }
+        assert_eq!(
+            writers, 4,
+            "replace_all, replace_org, remove_cached, remove_org"
+        );
+    }
+
     #[test]
     fn ownership_parents_the_downtime_by_its_folder_public_id() {
         let mut row = downtime("acme", "dt-1");
diff --git a/src/db/src/lib.rs b/src/db/src/lib.rs
index 7ad31b3719..165dd275f4 100644
--- a/src/db/src/lib.rs
+++ b/src/db/src/lib.rs
@@ -66,6 +66,8 @@ pub mod system_settings;
 pub mod teardown;
 pub mod user;
 #[cfg(feature = "enterprise")]
+pub mod workflow_http_triggers;
+#[cfg(feature = "enterprise")]
 pub mod workflows;
 
 use infra_db::{Event, NEED_WATCH, NO_NEED_WATCH, get_coordinator};
diff --git a/src/db/src/schema.rs b/src/db/src/schema.rs
index c224dc51ae..59e45acc60 100644
--- a/src/db/src/schema.rs
+++ b/src/db/src/schema.rs
@@ -232,6 +232,12 @@ static GEN_AI_SCHEMA_FIELDS: std::sync::LazyLock<Vec<Field>> = std::sync::LazyLo
         // written for label-resolved calls, so it must be provisioned up front.
         Field::new("gen_ai_prompt_name", DataType::Utf8, true),
         Field::new("gen_ai_prompt_label", DataType::Utf8, true),
+        // Written only for unpriced/approximate spans, so provision it for the readers.
+        Field::new(
+            config::meta::model_pricing::COST_STATUS_COLUMN,
+            DataType::Utf8,
+            true,
+        ),
         // Integer fields
         Field::new("gen_ai_prompt_version", DataType::Int64, true),
         Field::new("gen_ai_usage_input_tokens", DataType::Int64, true),
diff --git a/src/db/src/workflow_http_triggers.rs b/src/db/src/workflow_http_triggers.rs
new file mode 100644
index 0000000000..a88d5581b1
--- /dev/null
+++ b/src/db/src/workflow_http_triggers.rs
@@ -0,0 +1,89 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Cache invalidation and super-cluster emit for HTTP triggers, each called after the local commit.
+
+use bytes::Bytes;
+use infra::{
+    coordinator::get_coordinator,
+    db::NEED_WATCH,
+    table::workflow_http_triggers::{TriggerSnapshot, load_snapshot},
+};
+
+pub const TRIGGER_KEY_PREFIX: &str = "/workflow_http_trigger/";
+
+pub async fn notify_local(trigger_id: &str) -> Result<(), anyhow::Error> {
+    get_coordinator()
+        .await
+        .put(
+            &format!("{TRIGGER_KEY_PREFIX}{trigger_id}"),
+            Bytes::new(),
+            NEED_WATCH,
+            None,
+        )
+        .await?;
+    Ok(())
+}
+
+/// Evicts a trigger whose rows are gone, then drops its key so the coordinator does not keep it.
+pub async fn forget_local(trigger_id: &str) -> Result<(), anyhow::Error> {
+    notify_local(trigger_id).await?;
+    get_coordinator()
+        .await
+        .delete_if_exists(
+            &format!("{TRIGGER_KEY_PREFIX}{trigger_id}"),
+            false,
+            NEED_WATCH,
+        )
+        .await?;
+    Ok(())
+}
+
+pub async fn emit_snapshot(trigger_id: &str) -> Result<(), anyhow::Error> {
+    notify_local(trigger_id).await?;
+    if !super_cluster_enabled() {
+        return Ok(());
+    }
+    match load_snapshot(trigger_id).await? {
+        Some(snapshot) => emit_prepared(&snapshot).await,
+        None => Ok(()),
+    }
+}
+
+/// Publishes a snapshot built by the caller, for org delete whose rows are gone before any reload.
+pub async fn emit_prepared(snapshot: &TriggerSnapshot) -> Result<(), anyhow::Error> {
+    if !super_cluster_enabled() {
+        return Ok(());
+    }
+    let trigger_id = snapshot.trigger.id.as_str();
+    let sent =
+        o2_enterprise::enterprise::super_cluster::queue::send_workflow_http_trigger_snapshot(
+            trigger_id,
+            serde_json::to_string(snapshot)?,
+        )
+        .await;
+    if let Err(e) = &sent {
+        log::error!(
+            "[WORKFLOW_HOOK] snapshot emit failed for key /workflow_http_triggers/{trigger_id}: {e}"
+        );
+    }
+    sent
+}
+
+fn super_cluster_enabled() -> bool {
+    o2_enterprise::enterprise::common::config::get_config()
+        .super_cluster
+        .enabled
+}
diff --git a/src/infra/src/errors/mod.rs b/src/infra/src/errors/mod.rs
index 87f7e9c6fe..2b16193630 100644
--- a/src/infra/src/errors/mod.rs
+++ b/src/infra/src/errors/mod.rs
@@ -260,6 +260,8 @@ pub enum ErrorCodes {
     /// Another turn is already running in this AI chat session; carries the
     /// session id. Retry once it finishes.
     AiChatSessionBusy(String),
+    /// The installed license does not entitle these features; carries the comma-joined keys.
+    LicenseFeatureNotEntitled(String),
 }
 
 impl From<sea_orm::DbErr> for Error {
@@ -341,6 +343,7 @@ impl ErrorCodes {
             ErrorCodes::SearchCancelQuery(_) | ErrorCodes::RatelimitExceeded(_) => 429,
             ErrorCodes::SearchTimeout(_) => 408,
             ErrorCodes::AiSessionOwnerUnavailable(_) | ErrorCodes::AiChatSessionBusy(_) => 409,
+            ErrorCodes::LicenseFeatureNotEntitled(_) => 403,
             ErrorCodes::ServerInternalError(_) | ErrorCodes::SearchParquetFileNotFound => 500,
             ErrorCodes::InvalidParams(_)
             | ErrorCodes::SearchSQLExecuteError(_)
@@ -372,6 +375,7 @@ impl ErrorCodes {
             ErrorCodes::SearchHistogramNotAvailable(_) => 20013,
             ErrorCodes::AiSessionOwnerUnavailable(_) => 30001,
             ErrorCodes::AiChatSessionBusy(_) => 30002,
+            ErrorCodes::LicenseFeatureNotEntitled(_) => 40001,
         }
     }
 
@@ -407,6 +411,9 @@ impl ErrorCodes {
             ErrorCodes::AiChatSessionBusy(_) => {
                 "Another turn is already running in this conversation".to_string()
             }
+            ErrorCodes::LicenseFeatureNotEntitled(features) => {
+                format!("Features not included in your license: {features}")
+            }
         }
     }
 
@@ -428,6 +435,7 @@ impl ErrorCodes {
             ErrorCodes::SearchHistogramNotAvailable(msg) => msg.to_owned(),
             ErrorCodes::AiSessionOwnerUnavailable(session_id) => session_id.to_owned(),
             ErrorCodes::AiChatSessionBusy(session_id) => session_id.to_owned(),
+            ErrorCodes::LicenseFeatureNotEntitled(features) => features.to_owned(),
         }
     }
 
@@ -449,6 +457,7 @@ impl ErrorCodes {
             ErrorCodes::SearchHistogramNotAvailable(msg) => msg.to_owned(),
             ErrorCodes::AiSessionOwnerUnavailable(session_id) => session_id.to_owned(),
             ErrorCodes::AiChatSessionBusy(session_id) => session_id.to_owned(),
+            ErrorCodes::LicenseFeatureNotEntitled(features) => features.to_owned(),
         }
     }
 
@@ -503,6 +512,7 @@ impl ErrorCodes {
             20013 => Ok(ErrorCodes::SearchHistogramNotAvailable(message)),
             30001 => Ok(ErrorCodes::AiSessionOwnerUnavailable(message)),
             30002 => Ok(ErrorCodes::AiChatSessionBusy(message)),
+            40001 => Ok(ErrorCodes::LicenseFeatureNotEntitled(message)),
             _ => Ok(ErrorCodes::ServerInternalError(json.to_string())),
         }
     }
@@ -573,6 +583,22 @@ mod tests {
         );
     }
 
+    #[test]
+    fn test_license_feature_not_entitled() {
+        let err = ErrorCodes::LicenseFeatureNotEntitled("oncall, workflows".into());
+        assert_eq!(err.get_code(), 40001);
+        assert_eq!(err.http_status(), 403);
+        assert_eq!(err.get_error_detail(), "oncall, workflows");
+        assert_eq!(
+            err.get_message(),
+            "Features not included in your license: oncall, workflows"
+        );
+        match ErrorCodes::from_json(&err.to_json()).unwrap() {
+            ErrorCodes::LicenseFeatureNotEntitled(keys) => assert_eq!(keys, "oncall, workflows"),
+            other => panic!("round trip lost the variant: {other:?}"),
+        }
+    }
+
     #[test]
     fn test_error_codes_get_message() {
         assert_eq!(
diff --git a/src/infra/src/secrets.rs b/src/infra/src/secrets.rs
index a3719ae6c6..715f76887b 100644
--- a/src/infra/src/secrets.rs
+++ b/src/infra/src/secrets.rs
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-//! Encrypted, write-only secrets for outbound LLM integrations.
+//! Encrypted secrets for outbound integrations and workflow HTTP triggers.
 //!
 //! Versioned Remote Task and Remote Scorer configuration stores only a stable
 //! `secret_ref`. This module owns the mutable value behind that reference and
@@ -44,6 +44,7 @@ pub enum SecretOwnerKind {
     Task,
     Scorer,
     PromptWebhook,
+    WorkflowTrigger,
 }
 
 impl SecretOwnerKind {
@@ -52,6 +53,7 @@ impl SecretOwnerKind {
             Self::Task => "task",
             Self::Scorer => "scorer",
             Self::PromptWebhook => "prompt_webhook",
+            Self::WorkflowTrigger => "workflow_trigger",
         }
     }
 }
@@ -227,6 +229,7 @@ fn metadata(model: &Model) -> Result<SecretMetadata, SecretError> {
             "task" => SecretOwnerKind::Task,
             "scorer" => SecretOwnerKind::Scorer,
             "prompt_webhook" => SecretOwnerKind::PromptWebhook,
+            "workflow_trigger" => SecretOwnerKind::WorkflowTrigger,
             other => {
                 return Err(SecretError::Malformed(format!(
                     "unknown secret owner kind '{other}'"
@@ -347,6 +350,50 @@ pub async fn insert_prepared<C: ConnectionTrait>(
     Ok(prepared.written)
 }
 
+/// A prepared signing row with placeholder ciphertext, for tests without an org DEK.
+#[cfg(any(test, feature = "test-utils"))]
+pub fn prepared_for_tests(
+    org_id: &str,
+    owner_kind: SecretOwnerKind,
+    owner_id: &str,
+) -> PreparedSecret {
+    let now = now_ms();
+    let metadata = SecretMetadata {
+        secret_ref: ider::generate(),
+        owner_kind,
+        owner_id: owner_id.to_string(),
+        purpose: SecretPurpose::Signing,
+        key_id: Some(generate_key_id()),
+        state: CURRENT.to_string(),
+        last_verified_at: None,
+        grace_expires_at: None,
+        created_at: now,
+        updated_at: now,
+    };
+    let active = ActiveModel {
+        id: Set(ider::generate()),
+        secret_ref: Set(metadata.secret_ref.clone()),
+        org_id: Set(org_id.to_string()),
+        owner_kind: Set(owner_kind.as_str().to_string()),
+        owner_id: Set(metadata.owner_id.clone()),
+        purpose: Set(SecretPurpose::Signing.as_str().to_string()),
+        key_id: Set(metadata.key_id.clone()),
+        state: Set(CURRENT.to_string()),
+        ciphertext: Set("test-ciphertext".to_string()),
+        last_verified_at: Set(None),
+        grace_expires_at: Set(None),
+        created_at: Set(now),
+        updated_at: Set(now),
+    };
+    PreparedSecret {
+        active,
+        written: WrittenSecret {
+            metadata,
+            material: generate_signing_material(),
+        },
+    }
+}
+
 /// Replace an auth credential in place. The stable reference and Task/Scorer
 /// version remain unchanged; auth has no candidate/grace protocol.
 pub async fn replace_auth(
@@ -668,6 +715,34 @@ mod tests {
         assert_eq!(MAX_GRACE_MS, 86_400_000);
     }
 
+    #[test]
+    fn workflow_trigger_owner_kind_round_trips() {
+        let kind = SecretOwnerKind::WorkflowTrigger;
+        assert_eq!(kind.as_str(), "workflow_trigger");
+        assert_eq!(
+            serde_json::to_string(&kind).unwrap(),
+            "\"workflow_trigger\""
+        );
+        let row = Model {
+            id: "value-1".to_string(),
+            secret_ref: "secret-1".to_string(),
+            org_id: "acme".to_string(),
+            owner_kind: kind.as_str().to_string(),
+            owner_id: "cred-1".to_string(),
+            purpose: SecretPurpose::Signing.as_str().to_string(),
+            key_id: Some("key-1".to_string()),
+            state: CURRENT.to_string(),
+            ciphertext: "encrypted".to_string(),
+            last_verified_at: None,
+            grace_expires_at: None,
+            created_at: 1,
+            updated_at: 1,
+        };
+        let safe = metadata(&row).expect("the owner kind parses back");
+        assert_eq!(safe.owner_kind, kind);
+        assert_eq!(safe.owner_id, "cred-1");
+    }
+
     #[test]
     fn generated_signing_material_has_no_empty_value() {
         let SecretMaterial::Token { value } = generate_signing_material() else {
diff --git a/src/infra/src/table/entity/llm_dataset_items.rs b/src/infra/src/table/entity/llm_dataset_items.rs
index 9c0caca924..3adba5b55d 100644
--- a/src/infra/src/table/entity/llm_dataset_items.rs
+++ b/src/infra/src/table/entity/llm_dataset_items.rs
@@ -19,6 +19,12 @@ pub struct Model {
     pub input: Json,
     pub expected_output: Json,
     pub global_version: i64,
+    /// The Dataset version shown for the write request that stored this row; every row of one
+    /// request shares it, while `global_version` stays unique per row. NULL for rows written
+    /// before the column existed or by an older node: such a row is its own write, numbered by
+    /// `global_version`. Display only: two regions can label different writes with one value.
+    #[serde(default)]
+    pub write_version: Option<i64>,
     pub is_deleted: bool,
     pub source: String,
     pub source_ref: Option<String>,
@@ -36,3 +42,32 @@ pub struct Model {
 pub enum Relation {}
 
 impl ActiveModelBehavior for ActiveModel {}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn replicated_rows_preserve_write_versions_and_accept_older_payloads() {
+        // EvalDatasetMessage carries this row as JSON; old nodes omit the new column.
+        let legacy = serde_json::json!({
+            "row_id": "row-1",
+            "logical_id": "item-1",
+            "org_id": "org-1",
+            "dataset_id": "dataset-1",
+            "input": "question",
+            "expected_output": "answer",
+            "global_version": 59,
+            "is_deleted": false,
+            "source": "manual",
+            "updated_by": "owner@example.com",
+            "updated_at": 100
+        });
+        let mut row: Model = serde_json::from_value(legacy).unwrap();
+        assert_eq!(row.write_version, None);
+        row.write_version = Some(57);
+        let payload = serde_json::to_value(&row).unwrap();
+        assert_eq!(payload["write_version"], 57);
+        assert_eq!(serde_json::from_value::<Model>(payload).unwrap(), row);
+    }
+}
diff --git a/src/infra/src/table/entity/mod.rs b/src/infra/src/table/entity/mod.rs
index b55bc22cad..6210d05890 100644
--- a/src/infra/src/table/entity/mod.rs
+++ b/src/infra/src/table/entity/mod.rs
@@ -156,5 +156,8 @@ pub mod users;
 pub mod workflow_associations;
 pub mod workflow_drafts;
 pub mod workflow_errors;
+pub mod workflow_http_trigger_credentials;
+pub mod workflow_http_trigger_requests;
+pub mod workflow_http_triggers;
 pub mod workflow_run_data;
 pub mod workflows;
diff --git a/src/infra/src/table/entity/workflow_http_trigger_credentials.rs b/src/infra/src/table/entity/workflow_http_trigger_credentials.rs
new file mode 100644
index 0000000000..d1b1af1792
--- /dev/null
+++ b/src/infra/src/table/entity/workflow_http_trigger_credentials.rs
@@ -0,0 +1,28 @@
+//! `SeaORM` Entity for `workflow_http_trigger_credentials`.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
+#[sea_orm(table_name = "workflow_http_trigger_credentials")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: String,
+    pub trigger_id: String,
+    pub org_id: String,
+    pub kind: String,
+    pub display_prefix: String,
+    pub token_sha256: Option<String>,
+    pub secret_ref: Option<String>,
+    pub state: String,
+    pub expires_at: Option<i64>,
+    pub revoked_at: Option<i64>,
+    pub created_by: String,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub last_used_at: Option<i64>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/src/infra/src/table/entity/workflow_http_trigger_requests.rs b/src/infra/src/table/entity/workflow_http_trigger_requests.rs
new file mode 100644
index 0000000000..8934dbfb2d
--- /dev/null
+++ b/src/infra/src/table/entity/workflow_http_trigger_requests.rs
@@ -0,0 +1,35 @@
+//! `SeaORM` Entity for `workflow_http_trigger_requests`.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
+#[sea_orm(table_name = "workflow_http_trigger_requests")]
+pub struct Model {
+    #[sea_orm(primary_key)]
+    pub id: i64,
+    pub trigger_id: String,
+    pub org_id: String,
+    pub workflow_id: String,
+    pub run_id: String,
+    pub idem_key: Option<String>,
+    pub body_sha256: String,
+    pub body_bytes: i64,
+    pub content_type: Option<String>,
+    #[sea_orm(column_type = "Text")]
+    pub meta: String,
+    pub status: String,
+    pub claimed_by: Option<String>,
+    pub claimed_at: Option<i64>,
+    #[sea_orm(column_type = "Text", nullable)]
+    pub error: Option<String>,
+    pub credential_id: String,
+    pub credential_prefix: String,
+    pub caller_ip: String,
+    pub received_at: i64,
+    pub finished_at: Option<i64>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/src/infra/src/table/entity/workflow_http_triggers.rs b/src/infra/src/table/entity/workflow_http_triggers.rs
new file mode 100644
index 0000000000..8c54ae336c
--- /dev/null
+++ b/src/infra/src/table/entity/workflow_http_triggers.rs
@@ -0,0 +1,30 @@
+//! `SeaORM` Entity for `workflow_http_triggers`.
+
+use sea_orm::entity::prelude::*;
+
+#[derive(Clone, Debug, PartialEq, Eq, DeriveEntityModel)]
+#[sea_orm(table_name = "workflow_http_triggers")]
+pub struct Model {
+    #[sea_orm(primary_key, auto_increment = false)]
+    pub id: String,
+    pub org_id: String,
+    pub workflow_id: String,
+    pub enabled: bool,
+    pub auth_mode: String,
+    pub max_body_bytes: i64,
+    pub rate_limit_per_minute: i32,
+    pub created_by: String,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub version: i64,
+    pub origin_cluster: String,
+    pub deleted_at: Option<i64>,
+    pub last_invoked_at: Option<i64>,
+    #[sea_orm(column_type = "Text", nullable)]
+    pub rejections: Option<String>,
+}
+
+#[derive(Copy, Clone, Debug, EnumIter, DeriveRelation)]
+pub enum Relation {}
+
+impl ActiveModelBehavior for ActiveModel {}
diff --git a/src/infra/src/table/fleet_rollouts.rs b/src/infra/src/table/fleet_rollouts.rs
index 0c1a05dd61..a9623dd452 100644
--- a/src/infra/src/table/fleet_rollouts.rs
+++ b/src/infra/src/table/fleet_rollouts.rs
@@ -184,9 +184,10 @@ pub async fn guard_with<C: ConnectionTrait>(
     Ok(res.rows_affected)
 }
 
-/// Writes status, from_version, phases, failure, events and gates of a row the caller fenced.
+/// Writes the strategy, status, from_version, phases, failure, events and gates of a fenced row.
 pub async fn save_state_with<C: ConnectionTrait>(conn: &C, row: &Model) -> Result<(), Error> {
     Entity::update_many()
+        .col_expr(Column::Strategy, Expr::value(row.strategy.clone()))
         .col_expr(Column::Status, Expr::value(row.status.clone()))
         .col_expr(Column::FromVersion, Expr::value(row.from_version))
         .col_expr(Column::Phases, Expr::value(row.phases.clone()))
@@ -505,6 +506,7 @@ mod tests {
             .unwrap();
         assert_eq!(members_with(&db, "r1").await.unwrap()[1].state, "running");
 
+        row.strategy = serde_json::json!({"verify": true}).to_string();
         row.status = "halted".to_string();
         row.from_version = Some(7);
         row.failure =
diff --git a/src/infra/src/table/llm_secrets.rs b/src/infra/src/table/llm_secrets.rs
index 8bc38a4f31..de5a5e3c00 100644
--- a/src/infra/src/table/llm_secrets.rs
+++ b/src/infra/src/table/llm_secrets.rs
@@ -206,6 +206,19 @@ pub async fn delete_by_org(org_id: &str) -> Result<(), errors::Error> {
     Ok(())
 }
 
+pub async fn delete_by_org_owner_kind<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+    owner_kind: &str,
+) -> Result<u64, sea_orm::DbErr> {
+    Ok(Entity::delete_many()
+        .filter(Column::OrgId.eq(org_id))
+        .filter(Column::OwnerKind.eq(owner_kind))
+        .exec(db)
+        .await?
+        .rows_affected)
+}
+
 pub async fn delete_expired_retired<C: ConnectionTrait>(
     db: &C,
     now: i64,
diff --git a/src/infra/src/table/migration/m20261026_000001_create_workflow_http_triggers.rs b/src/infra/src/table/migration/m20261026_000001_create_workflow_http_triggers.rs
new file mode 100644
index 0000000000..b628a29da0
--- /dev/null
+++ b/src/infra/src/table/migration/m20261026_000001_create_workflow_http_triggers.rs
@@ -0,0 +1,281 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! One HTTP trigger per workflow; `version` and `origin_cluster` order replicated snapshots.
+
+use sea_orm_migration::prelude::*;
+
+const WORKFLOW_ID_IDX: &str = "workflow_http_triggers_workflow_id_idx";
+const ORG_ID_IDX: &str = "workflow_http_triggers_org_id_idx";
+const ORIGIN_CLUSTER_IDX: &str = "workflow_http_triggers_origin_cluster_idx";
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(create_workflow_http_triggers_statement())
+            .await?;
+        for index in create_indexes() {
+            manager.create_index(index).await?;
+        }
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        for name in [WORKFLOW_ID_IDX, ORG_ID_IDX, ORIGIN_CLUSTER_IDX] {
+            manager
+                .drop_index(
+                    Index::drop()
+                        .if_exists()
+                        .name(name)
+                        .table(WorkflowHttpTriggers::Table)
+                        .to_owned(),
+                )
+                .await?;
+        }
+        manager
+            .drop_table(
+                Table::drop()
+                    .table(WorkflowHttpTriggers::Table)
+                    .if_exists()
+                    .to_owned(),
+            )
+            .await?;
+        Ok(())
+    }
+}
+
+#[derive(DeriveIden)]
+enum WorkflowHttpTriggers {
+    Table,
+    Id,
+    OrgId,
+    WorkflowId,
+    Enabled,
+    AuthMode,
+    MaxBodyBytes,
+    RateLimitPerMinute,
+    CreatedBy,
+    CreatedAt,
+    UpdatedAt,
+    Version,
+    OriginCluster,
+    DeletedAt,
+    LastInvokedAt,
+    Rejections,
+}
+
+fn create_workflow_http_triggers_statement() -> TableCreateStatement {
+    Table::create()
+        .table(WorkflowHttpTriggers::Table)
+        .if_not_exists()
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::Id)
+                .string_len(32)
+                .not_null()
+                .primary_key(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::OrgId)
+                .string_len(256)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::WorkflowId)
+                .string_len(100)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::Enabled)
+                .boolean()
+                .not_null()
+                .default(true),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::AuthMode)
+                .string_len(16)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::MaxBodyBytes)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::RateLimitPerMinute)
+                .integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::CreatedBy)
+                .string_len(256)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::CreatedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::UpdatedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::Version)
+                .big_integer()
+                .not_null()
+                .default(1),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::OriginCluster)
+                .string_len(64)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::DeletedAt)
+                .big_integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::LastInvokedAt)
+                .big_integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggers::Rejections)
+                .text()
+                .null(),
+        )
+        .to_owned()
+}
+
+fn create_indexes() -> Vec<IndexCreateStatement> {
+    vec![
+        Index::create()
+            .if_not_exists()
+            .name(WORKFLOW_ID_IDX)
+            .table(WorkflowHttpTriggers::Table)
+            .col(WorkflowHttpTriggers::WorkflowId)
+            .unique()
+            .to_owned(),
+        Index::create()
+            .if_not_exists()
+            .name(ORG_ID_IDX)
+            .table(WorkflowHttpTriggers::Table)
+            .col(WorkflowHttpTriggers::OrgId)
+            .to_owned(),
+        Index::create()
+            .if_not_exists()
+            .name(ORIGIN_CLUSTER_IDX)
+            .table(WorkflowHttpTriggers::Table)
+            .col(WorkflowHttpTriggers::OriginCluster)
+            .to_owned(),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use collapse::*;
+
+    use super::*;
+
+    #[test]
+    fn test_postgres_workflow_http_triggers() {
+        collapsed_eq!(
+            &create_workflow_http_triggers_statement().to_string(PostgresQueryBuilder),
+            r#"CREATE TABLE IF NOT EXISTS "workflow_http_triggers" (
+                "id" varchar(32) NOT NULL PRIMARY KEY,
+                "org_id" varchar(256) NOT NULL,
+                "workflow_id" varchar(100) NOT NULL,
+                "enabled" bool NOT NULL DEFAULT TRUE,
+                "auth_mode" varchar(16) NOT NULL,
+                "max_body_bytes" bigint NOT NULL,
+                "rate_limit_per_minute" integer NOT NULL,
+                "created_by" varchar(256) NOT NULL,
+                "created_at" bigint NOT NULL,
+                "updated_at" bigint NOT NULL,
+                "version" bigint NOT NULL DEFAULT 1,
+                "origin_cluster" varchar(64) NOT NULL,
+                "deleted_at" bigint NULL,
+                "last_invoked_at" bigint NULL,
+                "rejections" text NULL
+            )"#
+        );
+        let indexes: Vec<String> = create_indexes()
+            .iter()
+            .map(|index| index.to_string(PostgresQueryBuilder))
+            .collect();
+        assert_eq!(
+            indexes,
+            [
+                r#"CREATE UNIQUE INDEX IF NOT EXISTS "workflow_http_triggers_workflow_id_idx" ON "workflow_http_triggers" ("workflow_id")"#,
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_triggers_org_id_idx" ON "workflow_http_triggers" ("org_id")"#,
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_triggers_origin_cluster_idx" ON "workflow_http_triggers" ("origin_cluster")"#,
+            ]
+        );
+    }
+
+    #[test]
+    fn every_statement_builds_on_both_backends() {
+        let table = create_workflow_http_triggers_statement();
+        for sql in [
+            table.to_string(PostgresQueryBuilder),
+            table.to_string(SqliteQueryBuilder),
+        ] {
+            assert!(sql.starts_with("CREATE TABLE IF NOT EXISTS"), "{sql}");
+            assert!(!sql.contains("FOREIGN KEY"), "{sql}");
+        }
+        for index in create_indexes() {
+            for sql in [
+                index.to_string(PostgresQueryBuilder),
+                index.to_string(SqliteQueryBuilder),
+            ] {
+                assert!(sql.contains("IF NOT EXISTS"), "{sql}");
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn down_then_up_is_idempotent() {
+        let mut opts = sea_orm::ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = sea_orm::Database::connect(opts).await.unwrap();
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.expect("first up");
+        Migration.up(&manager).await.expect("second up");
+        Migration.down(&manager).await.expect("first down");
+        assert!(!manager.has_table("workflow_http_triggers").await.unwrap());
+        Migration.down(&manager).await.expect("second down");
+        Migration.up(&manager).await.expect("up after down");
+        assert!(manager.has_table("workflow_http_triggers").await.unwrap());
+        for index in [
+            "workflow_http_triggers_workflow_id_idx",
+            "workflow_http_triggers_org_id_idx",
+            "workflow_http_triggers_origin_cluster_idx",
+        ] {
+            assert!(
+                manager
+                    .has_index("workflow_http_triggers", index)
+                    .await
+                    .unwrap(),
+                "{index}"
+            );
+        }
+    }
+}
diff --git a/src/infra/src/table/migration/m20261026_000002_create_workflow_http_trigger_credentials.rs b/src/infra/src/table/migration/m20261026_000002_create_workflow_http_trigger_credentials.rs
new file mode 100644
index 0000000000..af09656f8d
--- /dev/null
+++ b/src/infra/src/table/migration/m20261026_000002_create_workflow_http_trigger_credentials.rs
@@ -0,0 +1,273 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Tokens and signing secrets of HTTP triggers; key material lives in `llm_secrets`, never here.
+
+use sea_orm_migration::prelude::*;
+
+const TRIGGER_ID_IDX: &str = "workflow_http_trigger_credentials_trigger_id_idx";
+const ORG_ID_IDX: &str = "workflow_http_trigger_credentials_org_id_idx";
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(create_workflow_http_trigger_credentials_statement())
+            .await?;
+        for index in create_indexes() {
+            manager.create_index(index).await?;
+        }
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        for name in [TRIGGER_ID_IDX, ORG_ID_IDX] {
+            manager
+                .drop_index(
+                    Index::drop()
+                        .if_exists()
+                        .name(name)
+                        .table(WorkflowHttpTriggerCredentials::Table)
+                        .to_owned(),
+                )
+                .await?;
+        }
+        manager
+            .drop_table(
+                Table::drop()
+                    .table(WorkflowHttpTriggerCredentials::Table)
+                    .if_exists()
+                    .to_owned(),
+            )
+            .await?;
+        Ok(())
+    }
+}
+
+#[derive(DeriveIden)]
+enum WorkflowHttpTriggerCredentials {
+    Table,
+    Id,
+    TriggerId,
+    OrgId,
+    Kind,
+    DisplayPrefix,
+    #[sea_orm(iden = "token_sha256")]
+    TokenSha256,
+    SecretRef,
+    State,
+    ExpiresAt,
+    RevokedAt,
+    CreatedBy,
+    CreatedAt,
+    UpdatedAt,
+    LastUsedAt,
+}
+
+fn create_workflow_http_trigger_credentials_statement() -> TableCreateStatement {
+    Table::create()
+        .table(WorkflowHttpTriggerCredentials::Table)
+        .if_not_exists()
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::Id)
+                .string_len(32)
+                .not_null()
+                .primary_key(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::TriggerId)
+                .string_len(32)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::OrgId)
+                .string_len(256)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::Kind)
+                .string_len(16)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::DisplayPrefix)
+                .string_len(32)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::TokenSha256)
+                .string_len(64)
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::SecretRef)
+                .string_len(64)
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::State)
+                .string_len(16)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::ExpiresAt)
+                .big_integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::RevokedAt)
+                .big_integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::CreatedBy)
+                .string_len(256)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::CreatedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::UpdatedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerCredentials::LastUsedAt)
+                .big_integer()
+                .null(),
+        )
+        .to_owned()
+}
+
+fn create_indexes() -> Vec<IndexCreateStatement> {
+    vec![
+        Index::create()
+            .if_not_exists()
+            .name(TRIGGER_ID_IDX)
+            .table(WorkflowHttpTriggerCredentials::Table)
+            .col(WorkflowHttpTriggerCredentials::TriggerId)
+            .to_owned(),
+        Index::create()
+            .if_not_exists()
+            .name(ORG_ID_IDX)
+            .table(WorkflowHttpTriggerCredentials::Table)
+            .col(WorkflowHttpTriggerCredentials::OrgId)
+            .to_owned(),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use collapse::*;
+
+    use super::*;
+
+    #[test]
+    fn test_postgres_workflow_http_trigger_credentials() {
+        collapsed_eq!(
+            &create_workflow_http_trigger_credentials_statement().to_string(PostgresQueryBuilder),
+            r#"CREATE TABLE IF NOT EXISTS "workflow_http_trigger_credentials" (
+                "id" varchar(32) NOT NULL PRIMARY KEY,
+                "trigger_id" varchar(32) NOT NULL,
+                "org_id" varchar(256) NOT NULL,
+                "kind" varchar(16) NOT NULL,
+                "display_prefix" varchar(32) NOT NULL,
+                "token_sha256" varchar(64) NULL,
+                "secret_ref" varchar(64) NULL,
+                "state" varchar(16) NOT NULL,
+                "expires_at" bigint NULL,
+                "revoked_at" bigint NULL,
+                "created_by" varchar(256) NOT NULL,
+                "created_at" bigint NOT NULL,
+                "updated_at" bigint NOT NULL,
+                "last_used_at" bigint NULL
+            )"#
+        );
+        let indexes: Vec<String> = create_indexes()
+            .iter()
+            .map(|index| index.to_string(PostgresQueryBuilder))
+            .collect();
+        assert_eq!(
+            indexes,
+            [
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_trigger_credentials_trigger_id_idx" ON "workflow_http_trigger_credentials" ("trigger_id")"#,
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_trigger_credentials_org_id_idx" ON "workflow_http_trigger_credentials" ("org_id")"#,
+            ]
+        );
+    }
+
+    #[test]
+    fn every_statement_builds_on_both_backends() {
+        let table = create_workflow_http_trigger_credentials_statement();
+        for sql in [
+            table.to_string(PostgresQueryBuilder),
+            table.to_string(SqliteQueryBuilder),
+        ] {
+            assert!(sql.starts_with("CREATE TABLE IF NOT EXISTS"), "{sql}");
+            assert!(!sql.contains("FOREIGN KEY"), "{sql}");
+        }
+        for index in create_indexes() {
+            for sql in [
+                index.to_string(PostgresQueryBuilder),
+                index.to_string(SqliteQueryBuilder),
+            ] {
+                assert!(sql.contains("IF NOT EXISTS"), "{sql}");
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn down_then_up_is_idempotent() {
+        let mut opts = sea_orm::ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = sea_orm::Database::connect(opts).await.unwrap();
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.expect("first up");
+        Migration.up(&manager).await.expect("second up");
+        Migration.down(&manager).await.expect("first down");
+        assert!(
+            !manager
+                .has_table("workflow_http_trigger_credentials")
+                .await
+                .unwrap()
+        );
+        Migration.down(&manager).await.expect("second down");
+        Migration.up(&manager).await.expect("up after down");
+        assert!(
+            manager
+                .has_table("workflow_http_trigger_credentials")
+                .await
+                .unwrap()
+        );
+        for index in [
+            "workflow_http_trigger_credentials_trigger_id_idx",
+            "workflow_http_trigger_credentials_org_id_idx",
+        ] {
+            assert!(
+                manager
+                    .has_index("workflow_http_trigger_credentials", index)
+                    .await
+                    .unwrap(),
+                "{index}"
+            );
+        }
+    }
+}
diff --git a/src/infra/src/table/migration/m20261026_000003_create_workflow_http_trigger_requests.rs b/src/infra/src/table/migration/m20261026_000003_create_workflow_http_trigger_requests.rs
new file mode 100644
index 0000000000..c58bdd152a
--- /dev/null
+++ b/src/infra/src/table/migration/m20261026_000003_create_workflow_http_trigger_requests.rs
@@ -0,0 +1,373 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Region-local ledger of HTTP trigger runs; never replicated, so it has no `version`.
+
+use sea_orm_migration::prelude::*;
+
+const TRIGGER_IDEM_IDX: &str = "workflow_http_trigger_requests_trigger_idem_idx";
+const RUN_ID_IDX: &str = "workflow_http_trigger_requests_run_id_idx";
+const STATUS_ORG_RECEIVED_IDX: &str = "workflow_http_trigger_requests_status_org_received_idx";
+const WORKFLOW_RECEIVED_IDX: &str = "workflow_http_trigger_requests_workflow_received_idx";
+const RECEIVED_IDX: &str = "workflow_http_trigger_requests_received_idx";
+const TRIGGER_RECEIVED_IDX: &str = "workflow_http_trigger_requests_trigger_received_idx";
+const ORG_FINISHED_IDX: &str = "workflow_http_trigger_requests_org_finished_idx";
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .create_table(create_workflow_http_trigger_requests_statement())
+            .await?;
+        for index in create_indexes() {
+            manager.create_index(index).await?;
+        }
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        for name in [
+            TRIGGER_IDEM_IDX,
+            RUN_ID_IDX,
+            STATUS_ORG_RECEIVED_IDX,
+            WORKFLOW_RECEIVED_IDX,
+            RECEIVED_IDX,
+            TRIGGER_RECEIVED_IDX,
+            ORG_FINISHED_IDX,
+        ] {
+            manager
+                .drop_index(
+                    Index::drop()
+                        .if_exists()
+                        .name(name)
+                        .table(WorkflowHttpTriggerRequests::Table)
+                        .to_owned(),
+                )
+                .await?;
+        }
+        manager
+            .drop_table(
+                Table::drop()
+                    .table(WorkflowHttpTriggerRequests::Table)
+                    .if_exists()
+                    .to_owned(),
+            )
+            .await?;
+        Ok(())
+    }
+}
+
+#[derive(DeriveIden)]
+enum WorkflowHttpTriggerRequests {
+    Table,
+    Id,
+    TriggerId,
+    OrgId,
+    WorkflowId,
+    RunId,
+    IdemKey,
+    #[sea_orm(iden = "body_sha256")]
+    BodySha256,
+    BodyBytes,
+    ContentType,
+    Meta,
+    Status,
+    ClaimedBy,
+    ClaimedAt,
+    Error,
+    CredentialId,
+    CredentialPrefix,
+    CallerIp,
+    ReceivedAt,
+    FinishedAt,
+}
+
+fn create_workflow_http_trigger_requests_statement() -> TableCreateStatement {
+    Table::create()
+        .table(WorkflowHttpTriggerRequests::Table)
+        .if_not_exists()
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::Id)
+                .big_integer()
+                .not_null()
+                .primary_key()
+                .auto_increment(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::TriggerId)
+                .string_len(32)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::OrgId)
+                .string_len(256)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::WorkflowId)
+                .string_len(100)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::RunId)
+                .string_len(100)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::IdemKey)
+                .string_len(255)
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::BodySha256)
+                .string_len(64)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::BodyBytes)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::ContentType)
+                .string_len(128)
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::Meta)
+                .text()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::Status)
+                .string_len(16)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::ClaimedBy)
+                .string_len(64)
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::ClaimedAt)
+                .big_integer()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::Error)
+                .text()
+                .null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::CredentialId)
+                .string_len(32)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::CredentialPrefix)
+                .string_len(32)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::CallerIp)
+                .string_len(64)
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::ReceivedAt)
+                .big_integer()
+                .not_null(),
+        )
+        .col(
+            ColumnDef::new(WorkflowHttpTriggerRequests::FinishedAt)
+                .big_integer()
+                .null(),
+        )
+        .to_owned()
+}
+
+fn create_indexes() -> Vec<IndexCreateStatement> {
+    vec![
+        // NULL keys never collide on either backend, so keyless requests share no slot.
+        Index::create()
+            .if_not_exists()
+            .name(TRIGGER_IDEM_IDX)
+            .table(WorkflowHttpTriggerRequests::Table)
+            .col(WorkflowHttpTriggerRequests::TriggerId)
+            .col(WorkflowHttpTriggerRequests::IdemKey)
+            .unique()
+            .to_owned(),
+        Index::create()
+            .if_not_exists()
+            .name(RUN_ID_IDX)
+            .table(WorkflowHttpTriggerRequests::Table)
+            .col(WorkflowHttpTriggerRequests::RunId)
+            .unique()
+            .to_owned(),
+        Index::create()
+            .if_not_exists()
+            .name(STATUS_ORG_RECEIVED_IDX)
+            .table(WorkflowHttpTriggerRequests::Table)
+            .col(WorkflowHttpTriggerRequests::Status)
+            .col(WorkflowHttpTriggerRequests::OrgId)
+            .col(WorkflowHttpTriggerRequests::ReceivedAt)
+            .to_owned(),
+        Index::create()
+            .if_not_exists()
+            .name(WORKFLOW_RECEIVED_IDX)
+            .table(WorkflowHttpTriggerRequests::Table)
+            .col(WorkflowHttpTriggerRequests::WorkflowId)
+            .col(WorkflowHttpTriggerRequests::ReceivedAt)
+            .to_owned(),
+        Index::create()
+            .if_not_exists()
+            .name(RECEIVED_IDX)
+            .table(WorkflowHttpTriggerRequests::Table)
+            .col(WorkflowHttpTriggerRequests::ReceivedAt)
+            .to_owned(),
+        // The endpoint view reads a trigger's newest call on every load.
+        Index::create()
+            .if_not_exists()
+            .name(TRIGGER_RECEIVED_IDX)
+            .table(WorkflowHttpTriggerRequests::Table)
+            .col(WorkflowHttpTriggerRequests::TriggerId)
+            .col(WorkflowHttpTriggerRequests::ReceivedAt)
+            .to_owned(),
+        // Every accepted call reads the org's newest finished runs for its queue-wait estimate.
+        Index::create()
+            .if_not_exists()
+            .name(ORG_FINISHED_IDX)
+            .table(WorkflowHttpTriggerRequests::Table)
+            .col(WorkflowHttpTriggerRequests::OrgId)
+            .col(WorkflowHttpTriggerRequests::FinishedAt)
+            .to_owned(),
+    ]
+}
+
+#[cfg(test)]
+mod tests {
+    use collapse::*;
+
+    use super::*;
+
+    #[test]
+    fn test_postgres_workflow_http_trigger_requests() {
+        collapsed_eq!(
+            &create_workflow_http_trigger_requests_statement().to_string(PostgresQueryBuilder),
+            r#"CREATE TABLE IF NOT EXISTS "workflow_http_trigger_requests" (
+                "id" bigserial NOT NULL PRIMARY KEY,
+                "trigger_id" varchar(32) NOT NULL,
+                "org_id" varchar(256) NOT NULL,
+                "workflow_id" varchar(100) NOT NULL,
+                "run_id" varchar(100) NOT NULL,
+                "idem_key" varchar(255) NULL,
+                "body_sha256" varchar(64) NOT NULL,
+                "body_bytes" bigint NOT NULL,
+                "content_type" varchar(128) NULL,
+                "meta" text NOT NULL,
+                "status" varchar(16) NOT NULL,
+                "claimed_by" varchar(64) NULL,
+                "claimed_at" bigint NULL,
+                "error" text NULL,
+                "credential_id" varchar(32) NOT NULL,
+                "credential_prefix" varchar(32) NOT NULL,
+                "caller_ip" varchar(64) NOT NULL,
+                "received_at" bigint NOT NULL,
+                "finished_at" bigint NULL
+            )"#
+        );
+        let indexes: Vec<String> = create_indexes()
+            .iter()
+            .map(|index| index.to_string(PostgresQueryBuilder))
+            .collect();
+        assert_eq!(
+            indexes,
+            [
+                r#"CREATE UNIQUE INDEX IF NOT EXISTS "workflow_http_trigger_requests_trigger_idem_idx" ON "workflow_http_trigger_requests" ("trigger_id", "idem_key")"#,
+                r#"CREATE UNIQUE INDEX IF NOT EXISTS "workflow_http_trigger_requests_run_id_idx" ON "workflow_http_trigger_requests" ("run_id")"#,
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_trigger_requests_status_org_received_idx" ON "workflow_http_trigger_requests" ("status", "org_id", "received_at")"#,
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_trigger_requests_workflow_received_idx" ON "workflow_http_trigger_requests" ("workflow_id", "received_at")"#,
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_trigger_requests_received_idx" ON "workflow_http_trigger_requests" ("received_at")"#,
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_trigger_requests_trigger_received_idx" ON "workflow_http_trigger_requests" ("trigger_id", "received_at")"#,
+                r#"CREATE INDEX IF NOT EXISTS "workflow_http_trigger_requests_org_finished_idx" ON "workflow_http_trigger_requests" ("org_id", "finished_at")"#,
+            ]
+        );
+    }
+
+    #[test]
+    fn every_statement_builds_on_both_backends() {
+        let table = create_workflow_http_trigger_requests_statement();
+        for sql in [
+            table.to_string(PostgresQueryBuilder),
+            table.to_string(SqliteQueryBuilder),
+        ] {
+            assert!(sql.starts_with("CREATE TABLE IF NOT EXISTS"), "{sql}");
+            assert!(!sql.contains("FOREIGN KEY"), "{sql}");
+        }
+        for index in create_indexes() {
+            for sql in [
+                index.to_string(PostgresQueryBuilder),
+                index.to_string(SqliteQueryBuilder),
+            ] {
+                assert!(sql.contains("IF NOT EXISTS"), "{sql}");
+            }
+        }
+    }
+
+    #[tokio::test]
+    async fn down_then_up_is_idempotent() {
+        let mut opts = sea_orm::ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = sea_orm::Database::connect(opts).await.unwrap();
+        let manager = SchemaManager::new(&db);
+        Migration.up(&manager).await.expect("first up");
+        Migration.up(&manager).await.expect("second up");
+        Migration.down(&manager).await.expect("first down");
+        assert!(
+            !manager
+                .has_table("workflow_http_trigger_requests")
+                .await
+                .unwrap()
+        );
+        Migration.down(&manager).await.expect("second down");
+        Migration.up(&manager).await.expect("up after down");
+        assert!(
+            manager
+                .has_table("workflow_http_trigger_requests")
+                .await
+                .unwrap()
+        );
+        for index in [
+            "workflow_http_trigger_requests_trigger_idem_idx",
+            "workflow_http_trigger_requests_run_id_idx",
+            "workflow_http_trigger_requests_status_org_received_idx",
+            "workflow_http_trigger_requests_workflow_received_idx",
+            "workflow_http_trigger_requests_received_idx",
+            "workflow_http_trigger_requests_trigger_received_idx",
+            "workflow_http_trigger_requests_org_finished_idx",
+        ] {
+            assert!(
+                manager
+                    .has_index("workflow_http_trigger_requests", index)
+                    .await
+                    .unwrap(),
+                "{index}"
+            );
+        }
+    }
+}
diff --git a/src/infra/src/table/migration/m20261028_000001_add_llm_dataset_item_write_version.rs b/src/infra/src/table/migration/m20261028_000001_add_llm_dataset_item_write_version.rs
new file mode 100644
index 0000000000..fe062d1e48
--- /dev/null
+++ b/src/infra/src/table/migration/m20261028_000001_add_llm_dataset_item_write_version.rs
@@ -0,0 +1,222 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Adds the nullable `write_version` to `llm_dataset_items`: the Dataset version a row's write
+//! request was shown as. NULL marks a row written before this column or by an older node.
+//! The existing row-version indexes are untouched; one new index lets a write find the Dataset's
+//! highest label (and the highest legacy row version) without scanning its history.
+
+use sea_orm_migration::prelude::*;
+
+const LLM_DATASET_ITEMS: &str = "llm_dataset_items";
+const WRITE_VERSION: &str = "write_version";
+const WRITE_VERSION_IDX: &str = "idx_llm_dataset_items_write_version";
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        if !manager.has_column(LLM_DATASET_ITEMS, WRITE_VERSION).await? {
+            manager
+                .alter_table(
+                    Table::alter()
+                        .table(LlmDatasetItems::Table)
+                        .add_column(
+                            ColumnDef::new(LlmDatasetItems::WriteVersion)
+                                .big_integer()
+                                .null(),
+                        )
+                        .to_owned(),
+                )
+                .await?;
+        }
+        if !manager
+            .has_index(LLM_DATASET_ITEMS, WRITE_VERSION_IDX)
+            .await?
+        {
+            manager
+                .create_index(
+                    Index::create()
+                        .name(WRITE_VERSION_IDX)
+                        .table(LlmDatasetItems::Table)
+                        .col(LlmDatasetItems::DatasetId)
+                        .col(LlmDatasetItems::WriteVersion)
+                        .col(LlmDatasetItems::GlobalVersion)
+                        .to_owned(),
+                )
+                .await?;
+        }
+        Ok(())
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        if manager
+            .has_index(LLM_DATASET_ITEMS, WRITE_VERSION_IDX)
+            .await?
+        {
+            manager
+                .drop_index(
+                    Index::drop()
+                        .name(WRITE_VERSION_IDX)
+                        .table(LlmDatasetItems::Table)
+                        .to_owned(),
+                )
+                .await?;
+        }
+        if !manager.has_column(LLM_DATASET_ITEMS, WRITE_VERSION).await? {
+            return Ok(());
+        }
+        manager
+            .alter_table(
+                Table::alter()
+                    .table(LlmDatasetItems::Table)
+                    .drop_column(LlmDatasetItems::WriteVersion)
+                    .to_owned(),
+            )
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum LlmDatasetItems {
+    Table,
+    DatasetId,
+    WriteVersion,
+    GlobalVersion,
+}
+
+#[cfg(test)]
+mod tests {
+    use sea_orm::{ConnectionTrait, Database, DatabaseConnection, Statement};
+    use sea_orm_migration::MigrationName;
+
+    use super::*;
+
+    #[test]
+    fn test_migration_name() {
+        assert_eq!(
+            Migration.name(),
+            "m20261028_000001_add_llm_dataset_item_write_version"
+        );
+    }
+
+    async fn items_db() -> DatabaseConnection {
+        let db = Database::connect("sqlite::memory:").await.unwrap();
+        for sql in [
+            "CREATE TABLE llm_dataset_items (row_id TEXT PRIMARY KEY, dataset_id TEXT NOT NULL, \
+             logical_id TEXT NOT NULL, global_version BIGINT NOT NULL)",
+            "CREATE UNIQUE INDEX uq_llm_dataset_items_version ON llm_dataset_items (dataset_id, \
+             global_version)",
+            "CREATE INDEX idx_llm_dataset_items_latest ON llm_dataset_items (dataset_id, \
+             logical_id, global_version)",
+            "INSERT INTO llm_dataset_items VALUES ('row-1', 'dataset-1', 'item-1', 1)",
+        ] {
+            db.execute_unprepared(sql).await.unwrap();
+        }
+        db
+    }
+
+    async fn index_names(db: &DatabaseConnection) -> Vec<String> {
+        let rows = db
+            .query_all(Statement::from_string(
+                db.get_database_backend(),
+                "SELECT name FROM sqlite_master WHERE type = 'index' AND tbl_name = \
+                 'llm_dataset_items' AND sql IS NOT NULL ORDER BY name",
+            ))
+            .await
+            .unwrap();
+        rows.iter()
+            .map(|row| row.try_get::<String>("", "name").unwrap())
+            .collect()
+    }
+
+    async fn insert(db: &DatabaseConnection, row_id: &str, version: i64) -> bool {
+        db.execute(Statement::from_sql_and_values(
+            db.get_database_backend(),
+            "INSERT INTO llm_dataset_items (row_id, dataset_id, logical_id, global_version, \
+             write_version) VALUES (?, 'dataset-1', ?, ?, 2)",
+            [row_id.into(), row_id.into(), version.into()],
+        ))
+        .await
+        .is_ok()
+    }
+
+    #[tokio::test]
+    async fn up_adds_a_nullable_column_and_one_head_index_keeping_the_version_indexes() {
+        let db = items_db().await;
+        let manager = SchemaManager::new(&db);
+        let mut indexes = index_names(&db).await;
+
+        Migration.up(&manager).await.unwrap();
+        Migration.up(&manager).await.unwrap();
+
+        assert!(
+            manager
+                .has_column(LLM_DATASET_ITEMS, WRITE_VERSION)
+                .await
+                .unwrap()
+        );
+        indexes.push(WRITE_VERSION_IDX.to_string());
+        indexes.sort();
+        assert_eq!(index_names(&db).await, indexes);
+        // The pre-existing row reads as NULL: a legacy write.
+        let legacy = db
+            .query_one(Statement::from_string(
+                db.get_database_backend(),
+                "SELECT write_version FROM llm_dataset_items WHERE row_id = 'row-1'",
+            ))
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(
+            legacy.try_get::<Option<i64>>("", WRITE_VERSION).unwrap(),
+            None
+        );
+        // Rows of one write share a write version but never a row version.
+        assert!(insert(&db, "row-2", 2).await);
+        assert!(insert(&db, "row-3", 3).await);
+        assert!(!insert(&db, "row-4", 3).await);
+    }
+
+    #[tokio::test]
+    async fn down_drops_the_column_and_its_index() {
+        let db = items_db().await;
+        let manager = SchemaManager::new(&db);
+        let indexes = index_names(&db).await;
+        Migration.up(&manager).await.unwrap();
+        assert!(insert(&db, "row-2", 2).await);
+
+        Migration.down(&manager).await.unwrap();
+        Migration.down(&manager).await.unwrap();
+
+        assert!(
+            !manager
+                .has_column(LLM_DATASET_ITEMS, WRITE_VERSION)
+                .await
+                .unwrap()
+        );
+        assert_eq!(index_names(&db).await, indexes);
+        let rows = db
+            .query_all(Statement::from_string(
+                db.get_database_backend(),
+                "SELECT row_id FROM llm_dataset_items",
+            ))
+            .await
+            .unwrap();
+        assert_eq!(rows.len(), 2);
+    }
+}
diff --git a/src/infra/src/table/migration/m20261102_000001_add_workflow_run_data_run_id_index.rs b/src/infra/src/table/migration/m20261102_000001_add_workflow_run_data_run_id_index.rs
new file mode 100644
index 0000000000..2b45690a4c
--- /dev/null
+++ b/src/infra/src/table/migration/m20261102_000001_add_workflow_run_data_run_id_index.rs
@@ -0,0 +1,103 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Indexes `workflow_run_data.run_id`, which each HTTP trigger run reads and deletes by.
+
+use sea_orm_migration::prelude::*;
+
+const RUN_ID_IDX: &str = "workflow_run_data_run_id_idx";
+
+#[derive(DeriveMigrationName)]
+pub struct Migration;
+
+#[async_trait::async_trait]
+impl MigrationTrait for Migration {
+    async fn up(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager.create_index(create_run_id_index()).await
+    }
+
+    async fn down(&self, manager: &SchemaManager) -> Result<(), DbErr> {
+        manager
+            .drop_index(
+                Index::drop()
+                    .if_exists()
+                    .name(RUN_ID_IDX)
+                    .table(WorkflowRunData::Table)
+                    .to_owned(),
+            )
+            .await
+    }
+}
+
+#[derive(DeriveIden)]
+enum WorkflowRunData {
+    Table,
+    RunId,
+}
+
+fn create_run_id_index() -> IndexCreateStatement {
+    Index::create()
+        .if_not_exists()
+        .name(RUN_ID_IDX)
+        .table(WorkflowRunData::Table)
+        .col(WorkflowRunData::RunId)
+        .to_owned()
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn the_index_builds_on_both_backends() {
+        let expected = r#"CREATE INDEX IF NOT EXISTS "workflow_run_data_run_id_idx" ON "workflow_run_data" ("run_id")"#;
+        assert_eq!(
+            create_run_id_index().to_string(PostgresQueryBuilder),
+            expected
+        );
+        assert_eq!(
+            create_run_id_index().to_string(SqliteQueryBuilder),
+            expected
+        );
+    }
+
+    #[tokio::test]
+    async fn down_then_up_is_idempotent() {
+        let mut opts = sea_orm::ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = sea_orm::Database::connect(opts).await.unwrap();
+        let manager = SchemaManager::new(&db);
+        super::super::m20260720_000001_create_workflow_run_data_table::Migration
+            .up(&manager)
+            .await
+            .unwrap();
+        Migration.up(&manager).await.expect("first up");
+        Migration.up(&manager).await.expect("second up");
+        assert!(
+            manager
+                .has_index("workflow_run_data", RUN_ID_IDX)
+                .await
+                .unwrap()
+        );
+        Migration.down(&manager).await.expect("first down");
+        Migration.down(&manager).await.expect("second down");
+        assert!(
+            !manager
+                .has_index("workflow_run_data", RUN_ID_IDX)
+                .await
+                .unwrap()
+        );
+    }
+}
diff --git a/src/infra/src/table/migration/mod.rs b/src/infra/src/table/migration/mod.rs
index 75d04ddf52..7cd7a93d67 100644
--- a/src/infra/src/table/migration/mod.rs
+++ b/src/infra/src/table/migration/mod.rs
@@ -241,13 +241,18 @@ mod m20261025_000003_add_mute_targets_to_downtimes;
 mod m20261025_000004_create_slack_alert_messages;
 mod m20261025_000005_add_held_action_to_slack_link_requests;
 mod m20261026_000001_backfill_v1_rca_pointer;
+mod m20261026_000001_create_workflow_http_triggers;
+mod m20261026_000002_create_workflow_http_trigger_credentials;
+mod m20261026_000003_create_workflow_http_trigger_requests;
 mod m20261027_000001_alter_query_history;
 mod m20261028_000001_add_group_label_set_to_alert_states;
+mod m20261028_000001_add_llm_dataset_item_write_version;
 mod m20261029_000001_widen_alert_dedup_fingerprint;
 mod m20261030_000001_add_suppress_repeats_to_alerts;
 mod m20261030_000001_create_org_domain_ownership_table;
 mod m20261030_000002_create_org_domain_ownership_req_table;
 mod m20261101_000001_create_oncall_slack;
+mod m20261102_000001_add_workflow_run_data_run_id_index;
 mod m20261103_000001_add_status_streaks_to_synthetics;
 /// Shared body of the two `folder_id` migrations above; not a migration itself.
 mod workflow_folder_id;
@@ -532,6 +537,33 @@ pub(crate) async fn create_query_history_table(
         .await
 }
 
+/// Apply only the HTTP trigger tables and the tables they write, for tests in any crate.
+#[cfg(any(test, feature = "test-utils"))]
+pub(crate) async fn create_workflow_http_trigger_tables(
+    db: &sea_orm::DatabaseConnection,
+) -> Result<(), DbErr> {
+    use sea_orm_migration::MigrationTrait;
+    let manager = SchemaManager::new(db);
+    m20260720_000001_create_workflow_run_data_table::Migration
+        .up(&manager)
+        .await?;
+    m20260820_000003_create_llm_secrets::Migration
+        .up(&manager)
+        .await?;
+    m20261026_000001_create_workflow_http_triggers::Migration
+        .up(&manager)
+        .await?;
+    m20261026_000002_create_workflow_http_trigger_credentials::Migration
+        .up(&manager)
+        .await?;
+    m20261026_000003_create_workflow_http_trigger_requests::Migration
+        .up(&manager)
+        .await?;
+    m20261102_000001_add_workflow_run_data_run_id_index::Migration
+        .up(&manager)
+        .await
+}
+
 pub struct Migrator;
 
 #[async_trait::async_trait]
@@ -769,6 +801,11 @@ impl MigratorTrait for Migrator {
             Box::new(m20261030_000002_create_org_domain_ownership_req_table::Migration),
             Box::new(m20261101_000001_create_oncall_slack::Migration),
             Box::new(m20261103_000001_add_status_streaks_to_synthetics::Migration),
+            Box::new(m20261028_000001_add_llm_dataset_item_write_version::Migration),
+            Box::new(m20261026_000001_create_workflow_http_triggers::Migration),
+            Box::new(m20261026_000002_create_workflow_http_trigger_credentials::Migration),
+            Box::new(m20261026_000003_create_workflow_http_trigger_requests::Migration),
+            Box::new(m20261102_000001_add_workflow_run_data_run_id_index::Migration),
         ]
     }
 }
@@ -870,6 +907,8 @@ mod tests {
         ),
         (132, "m20261101_000001_create_oncall_slack"),
         (133, "m20261103_000001_add_status_streaks_to_synthetics"),
+        (134, "m20261028_000001_add_llm_dataset_item_write_version"),
+        (135, "m20261102_000001_add_workflow_run_data_run_id_index"),
     ];
 
     // Two branches that each claim the next version merge cleanly, so a reused number must fail
@@ -1044,6 +1083,10 @@ mod tests {
                 "m20260806_000001_create_oncall_tables",
                 "m20261101_000001_create_oncall_slack",
             ),
+            (
+                "m20260720_000001_create_workflow_run_data_table",
+                "m20261102_000001_add_workflow_run_data_run_id_index",
+            ),
         ] {
             assert!(
                 position(earlier) < position(later),
diff --git a/src/infra/src/table/mod.rs b/src/infra/src/table/mod.rs
index 9a8767fada..aeb680f939 100644
--- a/src/infra/src/table/mod.rs
+++ b/src/infra/src/table/mod.rs
@@ -145,6 +145,8 @@ mod ttl_cache;
 pub mod user_auth_state;
 pub mod user_password_history;
 pub mod users;
+pub mod workflow_http_trigger_requests;
+pub mod workflow_http_triggers;
 pub mod workflows;
 
 pub async fn init() -> Result<(), anyhow::Error> {
diff --git a/src/infra/src/table/model_pricing.rs b/src/infra/src/table/model_pricing.rs
index e179ba7e0e..bf5825d709 100644
--- a/src/infra/src/table/model_pricing.rs
+++ b/src/infra/src/table/model_pricing.rs
@@ -21,8 +21,8 @@ use config::{
     utils::json,
 };
 use sea_orm::{
-    ActiveModelTrait, ColumnTrait, DatabaseConnection, EntityTrait, ModelTrait, QueryFilter,
-    QueryOrder, QuerySelect, Set, TryIntoModel,
+    ActiveModelTrait, ColumnTrait, ConnectionTrait, DatabaseConnection, EntityTrait, ModelTrait,
+    QueryFilter, QueryOrder, QuerySelect, Set, TryIntoModel, sea_query::OnConflict,
 };
 
 use crate::{
@@ -136,6 +136,49 @@ pub async fn put(item: ModelPricingDefinition) -> Result<ModelPricingDefinition,
     }
 }
 
+/// Fill missing built-ins atomically without replacing synced or disabled prices.
+pub async fn insert_missing_built_ins(items: Vec<ModelPricingDefinition>) -> Result<u64, Error> {
+    insert_missing_built_ins_with_db(get_orm_client_rw().await, items).await
+}
+
+async fn insert_missing_built_ins_with_db<C: ConnectionTrait>(
+    db: &C,
+    items: Vec<ModelPricingDefinition>,
+) -> Result<u64, Error> {
+    if items.is_empty() {
+        return Ok(0);
+    }
+    let now = chrono::Utc::now().timestamp_micros();
+    let rows = items
+        .into_iter()
+        .map(|item| {
+            Ok(ActiveModel {
+                id: Set(ider::uuid()),
+                org: Set(config::meta::model_pricing::BUILT_IN_ORG.to_string()),
+                name: Set(item.name),
+                match_pattern: Set(item.match_pattern),
+                enabled: Set(item.enabled),
+                tiers: Set(json::to_value(&item.tiers)?),
+                valid_from: Set(item.valid_from),
+                sort_order: Set(item.sort_order),
+                source: Set(PricingSource::BuiltIn.as_str().to_string()),
+                provider: Set((!item.provider.is_empty()).then_some(item.provider)),
+                description: Set((!item.description.is_empty()).then_some(item.description)),
+                created_at: Set(now),
+                updated_at: Set(now),
+            })
+        })
+        .collect::<Result<Vec<_>, Error>>()?;
+    Ok(Entity::insert_many(rows)
+        .on_conflict(
+            OnConflict::columns([Column::Org, Column::Name])
+                .do_nothing()
+                .to_owned(),
+        )
+        .exec_without_returning(db)
+        .await?)
+}
+
 pub async fn get(org_id: &str, name: &str) -> Result<Option<ModelPricingDefinition>, Error> {
     let client = get_orm_client_ro().await;
     match get_by_org_and_name(client, org_id, name).await? {
@@ -153,9 +196,9 @@ pub async fn get_by_id(id: &str) -> Result<Option<ModelPricingDefinition>, Error
 }
 
 /// Return the distinct org IDs that have at least one model pricing definition.
-/// Used for startup cache warming.
+/// Startup and coordinator-driven cache loads must see committed prices, not replica lag.
 pub async fn list_orgs() -> Result<Vec<String>, Error> {
-    let client = get_orm_client_ro().await;
+    let client = get_orm_client_rw().await;
     let rows: Vec<(String,)> = Entity::find()
         .select_only()
         .column(Column::Org)
@@ -167,7 +210,7 @@ pub async fn list_orgs() -> Result<Vec<String>, Error> {
 }
 
 pub async fn list(org_id: &str) -> Result<Vec<ModelPricingDefinition>, Error> {
-    let client = get_orm_client_ro().await;
+    let client = get_orm_client_rw().await;
     let rows = Entity::find()
         .filter(Column::Org.eq(org_id))
         .order_by(Column::Name, sea_orm::Order::Asc)
@@ -217,9 +260,10 @@ pub async fn delete_by_org(org_id: &str) -> Result<(), Error> {
 }
 
 /// Return all model names belonging to the built-in org.
-/// Used by the sync job to detect models removed from the upstream source.
+/// Used for synchronization and seed initialization; read the primary so a
+/// lagging replica cannot make a stored built-in list appear empty.
 pub async fn list_built_in_names() -> Result<Vec<String>, Error> {
-    let client = get_orm_client_ro().await;
+    let client = get_orm_client_rw().await;
     let rows: Vec<(String,)> = Entity::find()
         .select_only()
         .column(Column::Name)
@@ -266,6 +310,53 @@ mod tests {
         }
     }
 
+    #[tokio::test]
+    async fn seed_retries_missing_names_without_overwriting_synced_prices() {
+        let db = sea_orm::Database::connect("sqlite::memory:").await.unwrap();
+        let backend = db.get_database_backend();
+        let schema = sea_orm::Schema::new(backend);
+        db.execute(backend.build(&schema.create_table_from_entity(Entity)))
+            .await
+            .unwrap();
+        db.execute_unprepared("CREATE UNIQUE INDEX seed_model_names ON model_pricing (org, name)")
+            .await
+            .unwrap();
+        let id = svix_ksuid::Ksuid::new(None, None).to_string();
+        let mut stored: ModelPricingDefinition = make_model(&id).try_into().unwrap();
+        stored.enabled = false;
+        stored.match_pattern = "^newer-synced-pattern$".to_string();
+        assert_eq!(
+            insert_missing_built_ins_with_db(&db, vec![stored.clone()])
+                .await
+                .unwrap(),
+            1
+        );
+        let mut old_seed = stored.clone();
+        old_seed.enabled = true;
+        old_seed.match_pattern = "^old-seed-pattern$".to_string();
+        let mut missing = old_seed.clone();
+        missing.name = "missing-model".to_string();
+        assert_eq!(
+            insert_missing_built_ins_with_db(&db, vec![old_seed.clone(), missing.clone()])
+                .await
+                .unwrap(),
+            1
+        );
+        let saved =
+            get_by_org_and_name(&db, config::meta::model_pricing::BUILT_IN_ORG, &stored.name)
+                .await
+                .unwrap()
+                .unwrap();
+        assert!(!saved.enabled);
+        assert_eq!(saved.match_pattern, "^newer-synced-pattern$");
+        assert_eq!(
+            insert_missing_built_ins_with_db(&db, vec![old_seed, missing])
+                .await
+                .unwrap(),
+            0
+        );
+    }
+
     #[test]
     fn test_try_from_model_valid_ksuid() {
         let id = svix_ksuid::Ksuid::new(None, None).to_string();
diff --git a/src/infra/src/table/oncall_responses.rs b/src/infra/src/table/oncall_responses.rs
index 8de6afda74..f3360b1b78 100644
--- a/src/infra/src/table/oncall_responses.rs
+++ b/src/infra/src/table/oncall_responses.rs
@@ -664,6 +664,36 @@ pub async fn snooze(
     .await
 }
 
+/// Ends a snooze at `now`, giving the ladder's clock back the quiet that was not used.
+pub async fn unsnooze(org_id: &str, id: &str, now: i64) -> Result<Option<Response>, errors::Error> {
+    let client = get_orm_client_rw().await;
+    let Some(existing) = oncall_responses::Entity::find_by_id(id)
+        .filter(oncall_responses::Column::OrgId.eq(org_id))
+        .one(client)
+        .await?
+    else {
+        return Ok(None);
+    };
+    let anchor = config::meta::oncall::response::unsnoozed_ladder_anchor(
+        existing.ladder_anchor,
+        existing.opened_at,
+        existing.snoozed_until,
+        now,
+    );
+    save(
+        org_id,
+        id,
+        vec![
+            (
+                oncall_responses::Column::SnoozedUntil,
+                Expr::value(Option::<i64>::None),
+            ),
+            (oncall_responses::Column::LadderAnchor, Expr::value(anchor)),
+        ],
+    )
+    .await
+}
+
 /// Writes a new severity onto an open record.
 ///
 /// The severity is what SLO reporting, digests and the post-incident review
diff --git a/src/infra/src/table/score_configs.rs b/src/infra/src/table/score_configs.rs
index 78b5f7546c..1e30531b70 100644
--- a/src/infra/src/table/score_configs.rs
+++ b/src/infra/src/table/score_configs.rs
@@ -245,27 +245,26 @@ pub async fn get_versions(
     Ok(records)
 }
 
+/// Updating a score config deactivates its previous versions, so each entity
+/// has one active row; the dedupe only guards legacy rows written before that
+/// rule. Reads the primary: the web refetches this list right after a save, and a
+/// lagging read-only replica would return the pre-save rows.
 pub async fn get_all_by_org(org_id: &str) -> Result<Vec<ScoreConfig>, errors::Error> {
-    let client = get_orm_client_rw().await;
-
-    // Get the latest version per logical entity.
     let records: Vec<Model> = Entity::find()
         .filter(Column::OrgId.eq(org_id))
         .filter(Column::IsActive.eq(true))
         .order_by(Column::Name, Order::Asc)
         .order_by(Column::Version, Order::Desc)
-        .all(client)
+        .all(get_orm_client_rw().await)
         .await?;
 
-    // Deduplicate: keep only the highest version per entity.
+    // Keep the highest version per logical entity.
     let mut seen = std::collections::HashSet::new();
-    let records: Vec<_> = records
+    Ok(records
         .into_iter()
         .map(ScoreConfig::from)
         .filter(|c| seen.insert(c.entity_id.clone()))
-        .collect();
-
-    Ok(records)
+        .collect())
 }
 
 pub async fn delete(entity_id: &str, org_id: &str) -> Result<(), errors::Error> {
diff --git a/src/infra/src/table/scorers.rs b/src/infra/src/table/scorers.rs
index ece9709437..52f91d4b0b 100644
--- a/src/infra/src/table/scorers.rs
+++ b/src/infra/src/table/scorers.rs
@@ -236,52 +236,45 @@ pub async fn get_versions(org_id: &str, entity_id: &str) -> Result<Vec<Scorer>,
     Ok(records)
 }
 
+/// Updating a scorer deactivates its previous versions, so each entity has one
+/// active row; the dedupe only guards legacy rows written before that rule.
+/// Use the primary: provider deletion also uses this list to reject dependencies.
 pub async fn get_all_by_org(org_id: &str) -> Result<Vec<Scorer>, errors::Error> {
-    let client = get_orm_client_rw().await;
-
     let records: Vec<Model> = Entity::find()
         .filter(Column::OrgId.eq(org_id))
         .filter(Column::IsActive.eq(true))
         .order_by(Column::Name, Order::Asc)
         .order_by(Column::Version, Order::Desc)
-        .all(client)
+        .all(get_orm_client_rw().await)
         .await?;
 
-    // Deduplicate: keep highest version per logical entity.
-    let mut seen = std::collections::HashSet::new();
-    let records: Vec<_> = records
-        .into_iter()
-        .map(Scorer::from)
-        .filter(|s| seen.insert(s.entity_id.clone()))
-        .collect();
-
-    Ok(records)
+    Ok(latest_per_entity(records))
 }
 
 pub async fn get_by_type(
     org_id: &str,
     scorer_type: &ScorerType,
 ) -> Result<Vec<Scorer>, errors::Error> {
-    let client = get_orm_client_rw().await;
-
     let records: Vec<Model> = Entity::find()
         .filter(Column::OrgId.eq(org_id))
         .filter(Column::ScorerType.eq(*scorer_type))
         .filter(Column::IsActive.eq(true))
         .order_by(Column::Name, Order::Asc)
         .order_by(Column::Version, Order::Desc)
-        .all(client)
+        .all(get_orm_client_ro().await)
         .await?;
 
-    // Deduplicate by logical entity.
+    Ok(latest_per_entity(records))
+}
+
+/// Keep the highest version per logical entity (rows arrive version-descending).
+fn latest_per_entity(records: Vec<Model>) -> Vec<Scorer> {
     let mut seen = std::collections::HashSet::new();
-    let records: Vec<_> = records
+    records
         .into_iter()
         .map(Scorer::from)
         .filter(|s| seen.insert(s.entity_id.clone()))
-        .collect();
-
-    Ok(records)
+        .collect()
 }
 
 pub async fn has_active_by_score_config_id(
diff --git a/src/infra/src/table/workflow_http_trigger_requests.rs b/src/infra/src/table/workflow_http_trigger_requests.rs
new file mode 100644
index 0000000000..2a2a97e716
--- /dev/null
+++ b/src/infra/src/table/workflow_http_trigger_requests.rs
@@ -0,0 +1,1067 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Region-local run ledger of HTTP triggers; each queued row owns one `workflow_run_data` payload.
+
+use std::collections::{HashMap, HashSet};
+
+use sea_orm::{
+    ColumnTrait, ConnectionTrait, DbBackend, DbErr, EntityTrait, NotSet, PaginatorTrait,
+    QueryFilter, QueryOrder, QuerySelect, Set, SqlErr, TransactionTrait,
+    sea_query::{Expr, Query},
+};
+
+use crate::table::entity::{
+    organizations, workflow_http_trigger_requests as requests, workflow_run_data,
+};
+
+pub const ERR_RUN_TIMEOUT: &str = "run_timeout";
+pub const ERR_WORKER_LOST: &str = "worker_lost";
+pub const ERR_WORKFLOW_DISABLED: &str = "workflow_disabled";
+pub const IDEM_KEY_TTL_US: i64 = 24 * 3600 * 1_000_000;
+const DELETE_BATCH: usize = 500;
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, serde::Serialize, serde::Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum HookRunStatus {
+    Queued,
+    Running,
+    Succeeded,
+    Failed,
+    Expired,
+}
+
+impl HookRunStatus {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Queued => "queued",
+            Self::Running => "running",
+            Self::Succeeded => "succeeded",
+            Self::Failed => "failed",
+            Self::Expired => "expired",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "queued" => Some(Self::Queued),
+            "running" => Some(Self::Running),
+            "succeeded" => Some(Self::Succeeded),
+            "failed" => Some(Self::Failed),
+            "expired" => Some(Self::Expired),
+            _ => None,
+        }
+    }
+
+    pub fn is_terminal(self) -> bool {
+        matches!(self, Self::Succeeded | Self::Failed | Self::Expired)
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct NewHookRequest {
+    pub trigger_id: String,
+    pub org_id: String,
+    pub workflow_id: String,
+    pub run_id: String,
+    pub idem_key: Option<String>,
+    pub body_sha256: String,
+    pub body_bytes: i64,
+    pub content_type: Option<String>,
+    pub meta: String,
+    pub credential_id: String,
+    pub credential_prefix: String,
+    pub caller_ip: String,
+    pub received_at: i64,
+}
+
+impl NewHookRequest {
+    fn queued_row(self) -> requests::ActiveModel {
+        requests::ActiveModel {
+            id: NotSet,
+            trigger_id: Set(self.trigger_id),
+            org_id: Set(self.org_id),
+            workflow_id: Set(self.workflow_id),
+            run_id: Set(self.run_id),
+            idem_key: Set(self.idem_key),
+            body_sha256: Set(self.body_sha256),
+            body_bytes: Set(self.body_bytes),
+            content_type: Set(self.content_type),
+            meta: Set(self.meta),
+            status: Set(HookRunStatus::Queued.as_str().to_string()),
+            claimed_by: Set(None),
+            claimed_at: Set(None),
+            error: Set(None),
+            credential_id: Set(self.credential_id),
+            credential_prefix: Set(self.credential_prefix),
+            caller_ip: Set(self.caller_ip),
+            received_at: Set(self.received_at),
+            finished_at: Set(None),
+        }
+    }
+}
+
+#[derive(Debug)]
+pub enum LedgerInsert {
+    Inserted,
+    KeyTaken(Box<requests::Model>),
+    QueueFull,
+}
+
+#[derive(Clone, Debug, Default, PartialEq, Eq)]
+pub struct RunningCounts {
+    pub total: u64,
+    pub by_org: HashMap<String, u64>,
+}
+
+/// The reaping node and the ledger ids its own tasks still run.
+#[derive(Clone, Copy, Debug)]
+pub struct LocalClaims<'a> {
+    pub node_uuid: &'a str,
+    pub in_flight: &'a HashSet<i64>,
+    pub stale_before_us: i64,
+}
+
+/// Writes payload and queued row in one transaction; a lost idempotency race returns the winner.
+pub async fn enqueue<C: TransactionTrait>(
+    db: &C,
+    request: NewHookRequest,
+    payload: String,
+) -> Result<LedgerInsert, DbErr> {
+    write_queued(db, None, request, payload, None).await
+}
+
+/// Frees an expired original's key and enqueues its replacement in the same transaction.
+pub async fn reissue_expired<C: TransactionTrait>(
+    db: &C,
+    expired_id: i64,
+    request: NewHookRequest,
+    payload: String,
+) -> Result<LedgerInsert, DbErr> {
+    write_queued(db, Some(expired_id), request, payload, None).await
+}
+
+/// Enqueues (or reissues `expired_id`); refused once the org has `queue_max` queued rows.
+pub async fn enqueue_capped<C: TransactionTrait>(
+    db: &C,
+    expired_id: Option<i64>,
+    request: NewHookRequest,
+    payload: String,
+    queue_max: u64,
+) -> Result<LedgerInsert, DbErr> {
+    write_queued(db, expired_id, request, payload, Some(queue_max)).await
+}
+
+pub async fn find_by_idem_key<C: ConnectionTrait>(
+    db: &C,
+    trigger_id: &str,
+    idem_key: &str,
+) -> Result<Option<requests::Model>, DbErr> {
+    requests::Entity::find()
+        .filter(requests::Column::TriggerId.eq(trigger_id))
+        .filter(requests::Column::IdemKey.eq(idem_key))
+        .one(db)
+        .await
+}
+
+pub async fn get_run<C: ConnectionTrait>(
+    db: &C,
+    trigger_id: &str,
+    run_id: &str,
+) -> Result<Option<requests::Model>, DbErr> {
+    requests::Entity::find()
+        .filter(requests::Column::TriggerId.eq(trigger_id))
+        .filter(requests::Column::RunId.eq(run_id))
+        .one(db)
+        .await
+}
+
+pub async fn count_queued_for_org<C: ConnectionTrait>(db: &C, org_id: &str) -> Result<u64, DbErr> {
+    requests::Entity::find()
+        .filter(requests::Column::Status.eq(HookRunStatus::Queued.as_str()))
+        .filter(requests::Column::OrgId.eq(org_id))
+        .count(db)
+        .await
+}
+
+pub async fn running_counts<C: ConnectionTrait>(db: &C) -> Result<RunningCounts, DbErr> {
+    let rows: Vec<(String, i64)> = requests::Entity::find()
+        .select_only()
+        .column(requests::Column::OrgId)
+        .column_as(requests::Column::Id.count(), "running")
+        .filter(requests::Column::Status.eq(HookRunStatus::Running.as_str()))
+        .group_by(requests::Column::OrgId)
+        .into_tuple()
+        .all(db)
+        .await?;
+    let mut counts = RunningCounts::default();
+    for (org_id, running) in rows {
+        let running = u64::try_from(running).unwrap_or_default();
+        counts.total += running;
+        counts.by_org.insert(org_id, running);
+    }
+    Ok(counts)
+}
+
+pub async fn orgs_with_queued<C: ConnectionTrait>(db: &C) -> Result<Vec<String>, DbErr> {
+    requests::Entity::find()
+        .select_only()
+        .column(requests::Column::OrgId)
+        .distinct()
+        .filter(requests::Column::Status.eq(HookRunStatus::Queued.as_str()))
+        .order_by_asc(requests::Column::OrgId)
+        .into_tuple()
+        .all(db)
+        .await
+}
+
+pub async fn oldest_queued_for_org<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+) -> Result<Option<requests::Model>, DbErr> {
+    requests::Entity::find()
+        .filter(requests::Column::Status.eq(HookRunStatus::Queued.as_str()))
+        .filter(requests::Column::OrgId.eq(org_id))
+        .order_by_asc(requests::Column::ReceivedAt)
+        .order_by_asc(requests::Column::Id)
+        .one(db)
+        .await
+}
+
+pub async fn claim<C: ConnectionTrait>(
+    db: &C,
+    id: i64,
+    node_uuid: &str,
+    now_us: i64,
+) -> Result<bool, DbErr> {
+    let updated = requests::Entity::update_many()
+        .col_expr(
+            requests::Column::Status,
+            Expr::value(HookRunStatus::Running.as_str()),
+        )
+        .col_expr(requests::Column::ClaimedBy, Expr::value(node_uuid))
+        .col_expr(requests::Column::ClaimedAt, Expr::value(now_us))
+        .filter(requests::Column::Id.eq(id))
+        .filter(requests::Column::Status.eq(HookRunStatus::Queued.as_str()))
+        .exec(db)
+        .await?;
+    Ok(updated.rows_affected == 1)
+}
+
+/// Ends a row that is still queued, for runs refused at claim time.
+pub async fn finish_unclaimed<C: ConnectionTrait>(
+    db: &C,
+    id: i64,
+    status: HookRunStatus,
+    error: Option<&str>,
+    now_us: i64,
+) -> Result<bool, DbErr> {
+    let updated = finished(status, error, now_us)
+        .filter(requests::Column::Id.eq(id))
+        .filter(requests::Column::Status.eq(HookRunStatus::Queued.as_str()))
+        .exec(db)
+        .await?;
+    Ok(updated.rows_affected == 1)
+}
+
+/// Conditional on the claim, so a row the reaper already failed keeps `worker_lost`.
+pub async fn finish<C: ConnectionTrait>(
+    db: &C,
+    id: i64,
+    node_uuid: &str,
+    status: HookRunStatus,
+    error: Option<&str>,
+    now_us: i64,
+) -> Result<bool, DbErr> {
+    let updated = finished(status, error, now_us)
+        .filter(requests::Column::Id.eq(id))
+        .filter(requests::Column::Status.eq(HookRunStatus::Running.as_str()))
+        .filter(requests::Column::ClaimedBy.eq(node_uuid))
+        .exec(db)
+        .await?;
+    Ok(updated.rows_affected == 1)
+}
+
+/// Fails rows whose claimer left `live_nodes`, and own overdue rows no local task runs any more.
+pub async fn reap<C: ConnectionTrait>(
+    db: &C,
+    live_nodes: &HashSet<String>,
+    local: LocalClaims<'_>,
+    now_us: i64,
+) -> Result<u64, DbErr> {
+    let running: Vec<(i64, Option<String>, Option<i64>)> = requests::Entity::find()
+        .select_only()
+        .column(requests::Column::Id)
+        .column(requests::Column::ClaimedBy)
+        .column(requests::Column::ClaimedAt)
+        .filter(requests::Column::Status.eq(HookRunStatus::Running.as_str()))
+        .into_tuple()
+        .all(db)
+        .await?;
+    let mut reaped = 0;
+    for (id, claimed_by, claimed_at) in running {
+        let claimer_gone = claimed_by
+            .as_ref()
+            .is_none_or(|node| !live_nodes.contains(node));
+        // A live peer's overdue run may still be draining after its cancel, holding its slot.
+        let abandoned_here = claimed_by.as_deref() == Some(local.node_uuid)
+            && !local.in_flight.contains(&id)
+            && claimed_at.is_none_or(|at| at < local.stale_before_us);
+        if !claimer_gone && !abandoned_here {
+            continue;
+        }
+        reaped += finished(HookRunStatus::Failed, Some(ERR_WORKER_LOST), now_us)
+            .filter(requests::Column::Id.eq(id))
+            .filter(requests::Column::Status.eq(HookRunStatus::Running.as_str()))
+            .exec(db)
+            .await?
+            .rows_affected;
+    }
+    Ok(reaped)
+}
+
+pub async fn read_payload<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+    workflow_id: &str,
+    run_id: &str,
+) -> Result<Option<String>, DbErr> {
+    let data: Option<String> = workflow_run_data::Entity::find()
+        .select_only()
+        .column(workflow_run_data::Column::Data)
+        .filter(workflow_run_data::Column::OrgId.eq(org_id))
+        .filter(workflow_run_data::Column::WorkflowId.eq(workflow_id))
+        .filter(workflow_run_data::Column::RunId.eq(run_id))
+        .into_tuple()
+        .one(db)
+        .await?;
+    Ok(data)
+}
+
+/// Mean claim-to-finish seconds of the org's last `sample` finished runs.
+pub async fn recent_mean_run_secs<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+    sample: u64,
+) -> Result<Option<f64>, DbErr> {
+    let spans: Vec<(i64, i64)> = requests::Entity::find()
+        .select_only()
+        .column(requests::Column::ClaimedAt)
+        .column(requests::Column::FinishedAt)
+        .filter(requests::Column::OrgId.eq(org_id))
+        .filter(requests::Column::Status.is_in([
+            HookRunStatus::Succeeded.as_str(),
+            HookRunStatus::Failed.as_str(),
+        ]))
+        .filter(requests::Column::ClaimedAt.is_not_null())
+        .filter(requests::Column::FinishedAt.is_not_null())
+        .order_by_desc(requests::Column::FinishedAt)
+        .limit(sample)
+        .into_tuple()
+        .all(db)
+        .await?;
+    if spans.is_empty() {
+        return Ok(None);
+    }
+    let total_us: i64 = spans
+        .iter()
+        .map(|(claimed, finished)| (finished - claimed).max(0))
+        .sum();
+    Ok(Some(total_us as f64 / 1_000_000.0 / spans.len() as f64))
+}
+
+pub async fn list_for_workflow<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+    workflow_id: &str,
+    start_us: i64,
+    end_us: i64,
+    limit: u64,
+) -> Result<Vec<requests::Model>, DbErr> {
+    requests::Entity::find()
+        .filter(requests::Column::OrgId.eq(org_id))
+        .filter(requests::Column::WorkflowId.eq(workflow_id))
+        .filter(requests::Column::ReceivedAt.between(start_us, end_us))
+        .order_by_desc(requests::Column::ReceivedAt)
+        .order_by_desc(requests::Column::Id)
+        .limit(limit)
+        .all(db)
+        .await
+}
+
+pub async fn null_idem_keys_before<C: ConnectionTrait>(
+    db: &C,
+    before_us: i64,
+) -> Result<u64, DbErr> {
+    let updated = requests::Entity::update_many()
+        .col_expr(
+            requests::Column::IdemKey,
+            Expr::value(Option::<String>::None),
+        )
+        .filter(requests::Column::IdemKey.is_not_null())
+        .filter(requests::Column::ReceivedAt.lt(before_us))
+        .exec(db)
+        .await?;
+    Ok(updated.rows_affected)
+}
+
+/// Deletes terminal rows received before the cutoff together with their payloads.
+pub async fn delete_terminal_before<C: TransactionTrait>(
+    db: &C,
+    before_us: i64,
+) -> Result<u64, DbErr> {
+    delete_terminal_in_batches(db, before_us, DELETE_BATCH).await
+}
+
+/// Deletes the trigger's queued rows and their payloads; running rows finish on their own.
+pub async fn delete_queued_for_trigger<C: ConnectionTrait>(
+    db: &C,
+    trigger_id: &str,
+) -> Result<u64, DbErr> {
+    let queued_runs = Query::select()
+        .column(requests::Column::RunId)
+        .from(requests::Entity)
+        .and_where(Expr::col(requests::Column::TriggerId).eq(trigger_id))
+        .and_where(Expr::col(requests::Column::Status).eq(HookRunStatus::Queued.as_str()))
+        .to_owned();
+    workflow_run_data::Entity::delete_many()
+        .filter(workflow_run_data::Column::RunId.in_subquery(queued_runs))
+        .exec(db)
+        .await?;
+    let deleted = requests::Entity::delete_many()
+        .filter(requests::Column::TriggerId.eq(trigger_id))
+        .filter(requests::Column::Status.eq(HookRunStatus::Queued.as_str()))
+        .exec(db)
+        .await?;
+    Ok(deleted.rows_affected)
+}
+
+pub async fn delete_by_org<C: ConnectionTrait>(db: &C, org_id: &str) -> Result<u64, DbErr> {
+    let deleted = requests::Entity::delete_many()
+        .filter(requests::Column::OrgId.eq(org_id))
+        .exec(db)
+        .await?;
+    Ok(deleted.rows_affected)
+}
+
+#[cfg(any(test, feature = "test-utils"))]
+pub async fn create_tables_for_tests(db: &sea_orm::DatabaseConnection) -> Result<(), DbErr> {
+    super::migration::create_workflow_http_trigger_tables(db).await
+}
+
+/// The cap is counted inside the insert's transaction, so concurrent calls cannot overshoot it.
+/// One transaction per batch, so a large backlog never holds one long write transaction.
+async fn delete_terminal_in_batches<C: TransactionTrait>(
+    db: &C,
+    before_us: i64,
+    batch: usize,
+) -> Result<u64, DbErr> {
+    let mut deleted = 0;
+    loop {
+        let txn = db.begin().await?;
+        let rows: Vec<(i64, String)> = requests::Entity::find()
+            .select_only()
+            .column(requests::Column::Id)
+            .column(requests::Column::RunId)
+            .filter(requests::Column::Status.is_in([
+                HookRunStatus::Succeeded.as_str(),
+                HookRunStatus::Failed.as_str(),
+                HookRunStatus::Expired.as_str(),
+            ]))
+            .filter(requests::Column::ReceivedAt.lt(before_us))
+            .limit(batch as u64)
+            .into_tuple()
+            .all(&txn)
+            .await?;
+        if !rows.is_empty() {
+            let run_ids = rows.iter().map(|(_, run_id)| run_id.as_str());
+            workflow_run_data::Entity::delete_many()
+                .filter(workflow_run_data::Column::RunId.is_in(run_ids))
+                .exec(&txn)
+                .await?;
+            deleted += requests::Entity::delete_many()
+                .filter(requests::Column::Id.is_in(rows.iter().map(|(id, _)| *id)))
+                .exec(&txn)
+                .await?
+                .rows_affected;
+        }
+        txn.commit().await?;
+        if rows.len() < batch {
+            return Ok(deleted);
+        }
+    }
+}
+
+async fn write_queued<C: TransactionTrait>(
+    db: &C,
+    expired_id: Option<i64>,
+    request: NewHookRequest,
+    payload: String,
+    queue_max: Option<u64>,
+) -> Result<LedgerInsert, DbErr> {
+    let trigger_id = request.trigger_id.clone();
+    let idem_key = request.idem_key.clone();
+    let txn = db.begin().await?;
+    if let Some(queue_max) = queue_max
+        && !has_queue_room(&txn, &request.org_id, queue_max).await?
+    {
+        txn.rollback().await?;
+        return Ok(LedgerInsert::QueueFull);
+    }
+    let written = async {
+        if let Some(expired_id) = expired_id {
+            requests::Entity::update_many()
+                .col_expr(
+                    requests::Column::IdemKey,
+                    Expr::value(Option::<String>::None),
+                )
+                .filter(requests::Column::Id.eq(expired_id))
+                .filter(requests::Column::Status.eq(HookRunStatus::Expired.as_str()))
+                .exec(&txn)
+                .await?;
+        }
+        insert_queued(&txn, request, payload).await
+    }
+    .await;
+    match written {
+        Ok(()) => {
+            txn.commit().await?;
+            Ok(LedgerInsert::Inserted)
+        }
+        Err(error) => {
+            txn.rollback().await?;
+            key_taken(db, &trigger_id, idem_key.as_deref(), error).await
+        }
+    }
+}
+
+/// Postgres serialises on the org row lock; the SQLite pool already has one writer connection.
+async fn has_queue_room<C: ConnectionTrait>(
+    txn: &C,
+    org_id: &str,
+    queue_max: u64,
+) -> Result<bool, DbErr> {
+    if txn.get_database_backend() != DbBackend::Sqlite {
+        organizations::Entity::find()
+            .filter(organizations::Column::Identifier.eq(org_id))
+            .lock_exclusive()
+            .one(txn)
+            .await?;
+    }
+    Ok(count_queued_for_org(txn, org_id).await? < queue_max)
+}
+
+async fn insert_queued<C: ConnectionTrait>(
+    db: &C,
+    request: NewHookRequest,
+    payload: String,
+) -> Result<(), DbErr> {
+    workflow_run_data::Entity::insert(workflow_run_data::ActiveModel {
+        id: NotSet,
+        org_id: Set(request.org_id.clone()),
+        workflow_id: Set(request.workflow_id.clone()),
+        run_id: Set(request.run_id.clone()),
+        triggered_at: Set(request.received_at),
+        data: Set(payload),
+    })
+    .exec_without_returning(db)
+    .await?;
+    requests::Entity::insert(request.queued_row())
+        .exec_without_returning(db)
+        .await?;
+    Ok(())
+}
+
+/// Re-reads the holder of a duplicate idempotency key; any other insert failure is returned as is.
+async fn key_taken<C: TransactionTrait>(
+    db: &C,
+    trigger_id: &str,
+    idem_key: Option<&str>,
+    error: DbErr,
+) -> Result<LedgerInsert, DbErr> {
+    let (Some(idem_key), Some(SqlErr::UniqueConstraintViolation(_))) = (idem_key, error.sql_err())
+    else {
+        return Err(error);
+    };
+    let txn = db.begin().await?;
+    let winner = find_by_idem_key(&txn, trigger_id, idem_key).await?;
+    txn.commit().await?;
+    winner
+        .map(|winner| LedgerInsert::KeyTaken(Box::new(winner)))
+        .ok_or(error)
+}
+
+fn finished(
+    status: HookRunStatus,
+    error: Option<&str>,
+    now_us: i64,
+) -> sea_orm::UpdateMany<requests::Entity> {
+    requests::Entity::update_many()
+        .col_expr(requests::Column::Status, Expr::value(status.as_str()))
+        .col_expr(
+            requests::Column::Error,
+            Expr::value(error.map(str::to_string)),
+        )
+        .col_expr(requests::Column::FinishedAt, Expr::value(now_us))
+}
+
+#[cfg(test)]
+mod tests {
+    use sea_orm::{ConnectOptions, Database, DatabaseConnection};
+
+    use super::*;
+
+    const NOW: i64 = 1_760_000_000_000_000;
+
+    /// One connection: separate connections to `sqlite::memory:` are separate databases.
+    async fn db() -> DatabaseConnection {
+        let mut opts = ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = Database::connect(opts).await.unwrap();
+        create_tables_for_tests(&db).await.unwrap();
+        db
+    }
+
+    fn request(run_id: &str, idem_key: Option<&str>, received_at: i64) -> NewHookRequest {
+        NewHookRequest {
+            trigger_id: "t1".to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: "wf-1".to_string(),
+            run_id: run_id.to_string(),
+            idem_key: idem_key.map(str::to_string),
+            body_sha256: "cd".repeat(32),
+            body_bytes: 7,
+            content_type: Some("application/json".to_string()),
+            meta: r#"{"method":"POST"}"#.to_string(),
+            credential_id: "c1".to_string(),
+            credential_prefix: "o2wh_abcd…wxyz".to_string(),
+            caller_ip: "203.0.113.7".to_string(),
+            received_at,
+        }
+    }
+
+    async fn enqueue_one(db: &DatabaseConnection, run_id: &str, received_at: i64) -> i64 {
+        let inserted = enqueue(
+            db,
+            request(run_id, None, received_at),
+            format!("p-{run_id}"),
+        )
+        .await
+        .unwrap();
+        assert!(matches!(inserted, LedgerInsert::Inserted));
+        get_run(db, "t1", run_id).await.unwrap().unwrap().id
+    }
+
+    async fn status_of(db: &DatabaseConnection, run_id: &str) -> (String, Option<String>) {
+        let row = get_run(db, "t1", run_id).await.unwrap().unwrap();
+        (row.status, row.error)
+    }
+
+    fn local<'a>(node_uuid: &'a str, in_flight: &'a HashSet<i64>, stale: i64) -> LocalClaims<'a> {
+        LocalClaims {
+            node_uuid,
+            in_flight,
+            stale_before_us: stale,
+        }
+    }
+
+    async fn payloads(db: &DatabaseConnection) -> u64 {
+        workflow_run_data::Entity::find().count(db).await.unwrap()
+    }
+
+    #[test]
+    fn hook_run_statuses_round_trip() {
+        for status in [
+            HookRunStatus::Queued,
+            HookRunStatus::Running,
+            HookRunStatus::Succeeded,
+            HookRunStatus::Failed,
+            HookRunStatus::Expired,
+        ] {
+            assert_eq!(HookRunStatus::parse(status.as_str()), Some(status));
+        }
+        assert!(!HookRunStatus::Running.is_terminal());
+        assert!(HookRunStatus::Expired.is_terminal());
+    }
+
+    #[tokio::test]
+    async fn enqueue_writes_the_ledger_row_and_payload_together() {
+        let db = db().await;
+        enqueue_one(&db, "run-1", NOW).await;
+        let row = get_run(&db, "t1", "run-1").await.unwrap().unwrap();
+        assert_eq!(row.status, "queued");
+        assert_eq!(row.run_id, "run-1");
+        assert_eq!(
+            read_payload(&db, "acme", "wf-1", "run-1").await.unwrap(),
+            Some("p-run-1".to_string())
+        );
+        assert_eq!(count_queued_for_org(&db, "acme").await.unwrap(), 1);
+    }
+
+    #[tokio::test]
+    async fn enqueue_rolls_back_the_payload_when_the_ledger_insert_fails() {
+        let db = db().await;
+        enqueue_one(&db, "run-1", NOW).await;
+        let duplicate = enqueue(&db, request("run-1", None, NOW), "second".to_string()).await;
+        assert!(duplicate.is_err(), "a reused run_id must not insert");
+        assert_eq!(payloads(&db).await, 1);
+        assert_eq!(
+            read_payload(&db, "acme", "wf-1", "run-1").await.unwrap(),
+            Some("p-run-1".to_string())
+        );
+    }
+
+    #[tokio::test]
+    async fn a_duplicate_key_insert_reports_the_winner() {
+        let db = db().await;
+        let first = enqueue(&db, request("run-1", Some("k1"), NOW), "a".to_string())
+            .await
+            .unwrap();
+        assert!(matches!(first, LedgerInsert::Inserted));
+        let second = enqueue(&db, request("run-2", Some("k1"), NOW), "b".to_string())
+            .await
+            .unwrap();
+        let LedgerInsert::KeyTaken(winner) = second else {
+            panic!("the second insert must lose the key");
+        };
+        assert_eq!(winner.run_id, "run-1");
+        assert_eq!(payloads(&db).await, 1);
+    }
+
+    #[tokio::test]
+    async fn reissue_expired_nulls_the_old_key_and_inserts_a_new_run() {
+        let db = db().await;
+        enqueue(&db, request("run-1", Some("k1"), NOW), "a".to_string())
+            .await
+            .unwrap();
+        let original = find_by_idem_key(&db, "t1", "k1").await.unwrap().unwrap();
+        assert!(
+            finish_unclaimed(&db, original.id, HookRunStatus::Expired, None, NOW + 1)
+                .await
+                .unwrap()
+        );
+
+        let reissued = reissue_expired(
+            &db,
+            original.id,
+            request("run-2", Some("k1"), NOW + 2),
+            "b".to_string(),
+        )
+        .await
+        .unwrap();
+        assert!(matches!(reissued, LedgerInsert::Inserted));
+        let holder = find_by_idem_key(&db, "t1", "k1").await.unwrap().unwrap();
+        assert_eq!(
+            (holder.run_id.as_str(), holder.status.as_str()),
+            ("run-2", "queued")
+        );
+        let old = get_run(&db, "t1", "run-1").await.unwrap().unwrap();
+        assert_eq!((old.idem_key, old.status.as_str()), (None, "expired"));
+    }
+
+    #[tokio::test]
+    async fn reap_fails_rows_claimed_by_a_node_missing_from_nodes() {
+        let db = db().await;
+        let id = enqueue_one(&db, "run-1", NOW).await;
+        assert!(claim(&db, id, "gone-node", NOW).await.unwrap());
+        let live = HashSet::from(["live-node".to_string()]);
+        assert_eq!(
+            reap(
+                &db,
+                &live,
+                local("live-node", &HashSet::new(), NOW - 1),
+                NOW + 1
+            )
+            .await
+            .unwrap(),
+            1
+        );
+        assert_eq!(
+            status_of(&db, "run-1").await,
+            ("failed".to_string(), Some(ERR_WORKER_LOST.to_string()))
+        );
+    }
+
+    #[tokio::test]
+    async fn reap_fails_own_rows_claimed_longer_than_timeout_plus_a_minute() {
+        let db = db().await;
+        let id = enqueue_one(&db, "run-1", NOW).await;
+        assert!(claim(&db, id, "live-node", NOW).await.unwrap());
+        let live = HashSet::from(["live-node".to_string()]);
+        let timeout_plus_minute = (900 + 60) * 1_000_000;
+        let now = NOW + timeout_plus_minute + 1;
+        let stale = now - timeout_plus_minute;
+        let draining = HashSet::from([id]);
+        assert_eq!(
+            reap(&db, &live, local("live-node", &draining, stale), now)
+                .await
+                .unwrap(),
+            0,
+            "a run its task still drains keeps its slot"
+        );
+        assert_eq!(
+            reap(&db, &live, local("live-node", &HashSet::new(), stale), now)
+                .await
+                .unwrap(),
+            1
+        );
+        assert_eq!(status_of(&db, "run-1").await.0, "failed");
+    }
+
+    #[tokio::test]
+    async fn reap_leaves_live_rows_alone() {
+        let db = db().await;
+        let running = enqueue_one(&db, "run-1", NOW).await;
+        enqueue_one(&db, "run-2", NOW).await;
+        assert!(claim(&db, running, "live-node", NOW).await.unwrap());
+        let live = HashSet::from(["live-node".to_string()]);
+        assert_eq!(
+            reap(
+                &db,
+                &live,
+                local("live-node", &HashSet::new(), NOW - 1),
+                NOW + 1
+            )
+            .await
+            .unwrap(),
+            0
+        );
+        assert_eq!(status_of(&db, "run-1").await.0, "running");
+        assert_eq!(status_of(&db, "run-2").await.0, "queued");
+    }
+
+    #[tokio::test]
+    async fn finish_write_loses_to_the_reaper() {
+        let db = db().await;
+        let id = enqueue_one(&db, "run-1", NOW).await;
+        assert!(claim(&db, id, "node-a", NOW).await.unwrap());
+        assert_eq!(
+            reap(
+                &db,
+                &HashSet::new(),
+                local("node-b", &HashSet::new(), NOW - 1),
+                NOW + 1
+            )
+            .await
+            .unwrap(),
+            1
+        );
+        let finished = finish(&db, id, "node-a", HookRunStatus::Succeeded, None, NOW + 2)
+            .await
+            .unwrap();
+        assert!(!finished);
+        assert_eq!(
+            status_of(&db, "run-1").await,
+            ("failed".to_string(), Some(ERR_WORKER_LOST.to_string()))
+        );
+    }
+
+    #[tokio::test]
+    async fn reap_leaves_a_live_peers_overdue_run_alone() {
+        let db = db().await;
+        let id = enqueue_one(&db, "run-1", NOW).await;
+        assert!(claim(&db, id, "peer-node", NOW).await.unwrap());
+        let live = HashSet::from(["peer-node".to_string(), "local-node".to_string()]);
+        let now = NOW + 10_000 * 1_000_000;
+        assert_eq!(
+            reap(
+                &db,
+                &live,
+                local("local-node", &HashSet::new(), now - 1),
+                now
+            )
+            .await
+            .unwrap(),
+            0,
+            "a live peer may still be draining the run"
+        );
+        assert_eq!(status_of(&db, "run-1").await.0, "running");
+    }
+
+    #[tokio::test]
+    async fn a_capped_enqueue_refuses_once_the_org_queue_is_full() {
+        let db = db().await;
+        let first = enqueue_capped(&db, None, request("run-1", None, NOW), "p".to_string(), 1)
+            .await
+            .unwrap();
+        assert!(matches!(first, LedgerInsert::Inserted));
+        let full = enqueue_capped(&db, None, request("run-2", None, NOW), "p".to_string(), 1)
+            .await
+            .unwrap();
+        assert!(matches!(full, LedgerInsert::QueueFull));
+        assert!(get_run(&db, "t1", "run-2").await.unwrap().is_none());
+        assert_eq!(payloads(&db).await, 1, "a refused run leaves no payload");
+        let mut other = request("run-3", None, NOW);
+        other.org_id = "globex".to_string();
+        let other = enqueue_capped(&db, None, other, "p".to_string(), 1)
+            .await
+            .unwrap();
+        assert!(
+            matches!(other, LedgerInsert::Inserted),
+            "the cap is per org"
+        );
+    }
+
+    #[tokio::test]
+    async fn concurrent_capped_enqueues_never_overshoot_the_cap() {
+        let db = db().await;
+        let attempts = (0..8).map(|i| {
+            enqueue_capped(
+                &db,
+                None,
+                request(&format!("run-{i}"), None, NOW),
+                "p".to_string(),
+                3,
+            )
+        });
+        let inserted = futures::future::join_all(attempts)
+            .await
+            .into_iter()
+            .filter(|written| matches!(written, Ok(LedgerInsert::Inserted)))
+            .count();
+        assert_eq!(inserted, 3);
+        assert_eq!(count_queued_for_org(&db, "acme").await.unwrap(), 3);
+    }
+
+    #[tokio::test]
+    async fn idem_keys_older_than_a_day_are_cleared() {
+        let db = db().await;
+        enqueue(
+            &db,
+            request("old", Some("k-old"), NOW - IDEM_KEY_TTL_US - 1),
+            "a".into(),
+        )
+        .await
+        .unwrap();
+        enqueue(&db, request("new", Some("k-new"), NOW), "b".into())
+            .await
+            .unwrap();
+        assert_eq!(
+            null_idem_keys_before(&db, NOW - IDEM_KEY_TTL_US)
+                .await
+                .unwrap(),
+            1
+        );
+        assert!(
+            find_by_idem_key(&db, "t1", "k-old")
+                .await
+                .unwrap()
+                .is_none()
+        );
+        assert!(
+            find_by_idem_key(&db, "t1", "k-new")
+                .await
+                .unwrap()
+                .is_some()
+        );
+    }
+
+    #[tokio::test]
+    async fn terminal_rows_past_retention_are_deleted_with_their_payload() {
+        let db = db().await;
+        let old = NOW - 31 * 24 * 3600 * 1_000_000;
+        for (run_id, status) in [
+            ("succeeded", HookRunStatus::Succeeded),
+            ("failed", HookRunStatus::Failed),
+            ("expired", HookRunStatus::Expired),
+        ] {
+            let id = enqueue_one(&db, run_id, old).await;
+            assert!(
+                finish_unclaimed(&db, id, status, None, old + 1)
+                    .await
+                    .unwrap()
+            );
+        }
+        let recent = enqueue_one(&db, "recent", NOW).await;
+        assert!(
+            finish_unclaimed(&db, recent, HookRunStatus::Succeeded, None, NOW)
+                .await
+                .unwrap()
+        );
+
+        let cutoff = NOW - 30 * 24 * 3600 * 1_000_000;
+        assert_eq!(delete_terminal_before(&db, cutoff).await.unwrap(), 3);
+        assert!(get_run(&db, "t1", "succeeded").await.unwrap().is_none());
+        assert!(get_run(&db, "t1", "recent").await.unwrap().is_some());
+        assert_eq!(payloads(&db).await, 1);
+    }
+
+    #[tokio::test]
+    async fn the_purge_walks_a_backlog_larger_than_one_batch() {
+        let db = db().await;
+        let old = NOW - 31 * 24 * 3600 * 1_000_000;
+        for run_id in ["a", "b", "c", "d", "e"] {
+            let id = enqueue_one(&db, run_id, old).await;
+            assert!(
+                finish_unclaimed(&db, id, HookRunStatus::Succeeded, None, old + 1)
+                    .await
+                    .unwrap()
+            );
+        }
+        enqueue_one(&db, "queued", old).await;
+        assert_eq!(delete_terminal_in_batches(&db, NOW, 2).await.unwrap(), 5);
+        assert_eq!(payloads(&db).await, 1);
+        assert_eq!(status_of(&db, "queued").await.0, "queued");
+    }
+
+    #[tokio::test]
+    async fn queued_and_running_rows_are_never_purged() {
+        let db = db().await;
+        let old = NOW - 31 * 24 * 3600 * 1_000_000;
+        enqueue_one(&db, "queued", old).await;
+        let running = enqueue_one(&db, "running", old).await;
+        assert!(claim(&db, running, "node-a", old).await.unwrap());
+        assert_eq!(delete_terminal_before(&db, NOW).await.unwrap(), 0);
+        assert_eq!(payloads(&db).await, 2);
+        assert_eq!(status_of(&db, "running").await.0, "running");
+    }
+
+    #[tokio::test]
+    async fn running_counts_are_read_per_org_and_in_total() {
+        let db = db().await;
+        let mut other = request("other-1", None, NOW);
+        other.org_id = "globex".to_string();
+        enqueue(&db, other, "p".to_string()).await.unwrap();
+        let other_id = get_run(&db, "t1", "other-1").await.unwrap().unwrap().id;
+        for run_id in ["run-1", "run-2", "run-3"] {
+            let id = enqueue_one(&db, run_id, NOW).await;
+            if run_id != "run-3" {
+                assert!(claim(&db, id, "node-a", NOW).await.unwrap());
+            }
+        }
+        assert!(claim(&db, other_id, "node-b", NOW).await.unwrap());
+        let counts = running_counts(&db).await.unwrap();
+        assert_eq!(counts.total, 3);
+        assert_eq!(counts.by_org.get("acme"), Some(&2));
+        assert_eq!(counts.by_org.get("globex"), Some(&1));
+        assert_eq!(orgs_with_queued(&db).await.unwrap(), ["acme"]);
+    }
+
+    #[tokio::test]
+    async fn claim_succeeds_once_for_two_concurrent_claimers() {
+        let db = db().await;
+        let id = enqueue_one(&db, "run-1", NOW).await;
+        let (a, b) = tokio::join!(
+            claim(&db, id, "node-a", NOW),
+            claim(&db, id, "node-b", NOW + 1)
+        );
+        let (a, b) = (a.unwrap(), b.unwrap());
+        assert!(a ^ b, "exactly one claimer wins: {a} {b}");
+        let row = get_run(&db, "t1", "run-1").await.unwrap().unwrap();
+        let winner = if a { "node-a" } else { "node-b" };
+        assert_eq!(row.claimed_by.as_deref(), Some(winner));
+        assert!(!claim(&db, id, "node-c", NOW + 2).await.unwrap());
+    }
+}
diff --git a/src/infra/src/table/workflow_http_triggers.rs b/src/infra/src/table/workflow_http_triggers.rs
new file mode 100644
index 0000000000..1110c0dce0
--- /dev/null
+++ b/src/infra/src/table/workflow_http_triggers.rs
@@ -0,0 +1,1824 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! HTTP triggers of workflows and their credentials, replicated as one versioned snapshot.
+
+use std::collections::{BTreeMap, HashMap, HashSet};
+
+use config::utils::time::now_micros;
+use sea_orm::{
+    ActiveModelTrait, ColumnTrait, Condition, ConnectionTrait, DbErr, EntityTrait, IntoActiveModel,
+    NotSet, QueryFilter, QueryOrder, QuerySelect, Set, TransactionTrait,
+    sea_query::{Expr, Query},
+};
+use serde::{Deserialize, Serialize};
+use sha2::{Digest, Sha256};
+
+use crate::{
+    db::get_orm_client_rw,
+    errors,
+    secrets::{self, PreparedSecret, SecretError, SecretMaterial, SecretOwnerKind, SecretPurpose},
+    table::{
+        entity::{
+            workflow_http_trigger_credentials as credentials, workflow_http_triggers as triggers,
+        },
+        workflow_http_trigger_requests,
+    },
+};
+
+pub const TOMBSTONE_TTL_US: i64 = 7 * 24 * 3600 * 1_000_000;
+pub const REJECTION_WINDOW_US: i64 = 24 * 3600 * 1_000_000;
+// A collision loser keeps its row as a tombstone, so it must give up the UNIQUE workflow_id.
+const LOST_WORKFLOW_ID_PREFIX: &str = "lost:";
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum AuthMode {
+    Token,
+    Signature,
+}
+
+impl AuthMode {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Token => "token",
+            Self::Signature => "signature",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "token" => Some(Self::Token),
+            "signature" => Some(Self::Signature),
+            _ => None,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CredentialKind {
+    Token,
+    SigningSecret,
+}
+
+impl CredentialKind {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Token => "token",
+            Self::SigningSecret => "signing_secret",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "token" => Some(Self::Token),
+            "signing_secret" => Some(Self::SigningSecret),
+            _ => None,
+        }
+    }
+
+    pub fn for_mode(mode: AuthMode) -> Self {
+        match mode {
+            AuthMode::Token => Self::Token,
+            AuthMode::Signature => Self::SigningSecret,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq, Serialize, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub enum CredentialState {
+    Active,
+    Retiring,
+    Revoked,
+}
+
+impl CredentialState {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Active => "active",
+            Self::Retiring => "retiring",
+            Self::Revoked => "revoked",
+        }
+    }
+
+    pub fn parse(value: &str) -> Option<Self> {
+        match value {
+            "active" => Some(Self::Active),
+            "retiring" => Some(Self::Retiring),
+            "revoked" => Some(Self::Revoked),
+            _ => None,
+        }
+    }
+}
+
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct TriggerSnapshot {
+    pub version: i64,
+    pub origin_cluster: String,
+    pub deleted: bool,
+    pub trigger: ReplicatedTrigger,
+    pub credentials: Vec<ReplicatedCredential>,
+}
+
+impl TriggerSnapshot {
+    /// Lexicographic `(version, updated_at, origin_cluster)`, so two writing regions converge.
+    pub fn supersedes(&self, local: Option<&triggers::Model>) -> bool {
+        let Some(local) = local else {
+            return true;
+        };
+        (
+            self.version,
+            self.trigger.updated_at,
+            self.origin_cluster.as_str(),
+        ) > (
+            local.version,
+            local.updated_at,
+            local.origin_cluster.as_str(),
+        )
+    }
+}
+
+impl std::fmt::Debug for TriggerSnapshot {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("TriggerSnapshot")
+            .field("version", &self.version)
+            .field("origin_cluster", &self.origin_cluster)
+            .field("deleted", &self.deleted)
+            .field("trigger", &self.trigger)
+            .field("credentials", &self.credentials)
+            .finish()
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReplicatedTrigger {
+    pub id: String,
+    pub org_id: String,
+    pub workflow_id: String,
+    pub enabled: bool,
+    pub auth_mode: AuthMode,
+    pub max_body_bytes: i64,
+    pub rate_limit_per_minute: i32,
+    pub created_by: String,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub deleted_at: Option<i64>,
+}
+
+#[derive(Clone, PartialEq, Eq, Serialize, Deserialize)]
+pub struct ReplicatedCredential {
+    pub id: String,
+    pub kind: CredentialKind,
+    pub display_prefix: String,
+    pub token_sha256: Option<String>,
+    pub state: CredentialState,
+    pub expires_at: Option<i64>,
+    pub revoked_at: Option<i64>,
+    pub created_by: String,
+    pub created_at: i64,
+    pub updated_at: i64,
+    pub secret: Option<String>,
+}
+
+impl std::fmt::Debug for ReplicatedCredential {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("ReplicatedCredential")
+            .field("id", &self.id)
+            .field("kind", &self.kind)
+            .field("display_prefix", &self.display_prefix)
+            .field(
+                "token_sha256",
+                &self.token_sha256.as_ref().map(|_| "<redacted>"),
+            )
+            .field("state", &self.state)
+            .field("expires_at", &self.expires_at)
+            .field("revoked_at", &self.revoked_at)
+            .field("created_by", &self.created_by)
+            .field("created_at", &self.created_at)
+            .field("updated_at", &self.updated_at)
+            .field("secret", &self.secret.as_ref().map(|_| "<redacted>"))
+            .finish()
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq, Serialize, Deserialize)]
+pub struct RejectionEntry {
+    pub count_24h: u64,
+    pub last_at: i64,
+    pub last_ip: String,
+    pub window_start: i64,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct RejectionDelta {
+    pub count: u64,
+    pub last_at: i64,
+    pub last_ip: String,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub enum ApplyOutcome {
+    Applied,
+    Stale,
+    CollisionWon { loser: String },
+    CollisionLost,
+}
+
+pub fn is_live(state: CredentialState, expires_at: Option<i64>, now_us: i64) -> bool {
+    matches!(state, CredentialState::Active | CredentialState::Retiring)
+        && expires_at.is_none_or(|at| at > now_us)
+}
+
+pub fn merge_rejection_entry(
+    existing: Option<&RejectionEntry>,
+    delta: &RejectionDelta,
+    now_us: i64,
+) -> RejectionEntry {
+    let Some(existing) = existing.filter(|e| now_us - e.window_start < REJECTION_WINDOW_US) else {
+        return RejectionEntry {
+            count_24h: delta.count,
+            last_at: delta.last_at,
+            last_ip: delta.last_ip.clone(),
+            window_start: now_us,
+        };
+    };
+    let delta_is_newer = delta.last_at >= existing.last_at;
+    RejectionEntry {
+        count_24h: existing.count_24h.saturating_add(delta.count),
+        last_at: existing.last_at.max(delta.last_at),
+        last_ip: if delta_is_newer {
+            delta.last_ip.clone()
+        } else {
+            existing.last_ip.clone()
+        },
+        window_start: existing.window_start,
+    }
+}
+
+pub async fn get<C: ConnectionTrait>(
+    db: &C,
+    trigger_id: &str,
+) -> Result<Option<triggers::Model>, DbErr> {
+    triggers::Entity::find_by_id(trigger_id).one(db).await
+}
+
+/// Includes a tombstone, which still holds the workflow's UNIQUE `workflow_id`.
+pub async fn get_by_workflow<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+    workflow_id: &str,
+) -> Result<Option<triggers::Model>, DbErr> {
+    triggers::Entity::find()
+        .filter(triggers::Column::OrgId.eq(org_id))
+        .filter(triggers::Column::WorkflowId.eq(workflow_id))
+        .one(db)
+        .await
+}
+
+pub async fn get_for_update<C: ConnectionTrait>(
+    db: &C,
+    trigger_id: &str,
+) -> Result<Option<triggers::Model>, DbErr> {
+    triggers::Entity::find_by_id(trigger_id)
+        .lock_exclusive()
+        .one(db)
+        .await
+}
+
+pub async fn list_credentials<C: ConnectionTrait>(
+    db: &C,
+    trigger_id: &str,
+) -> Result<Vec<credentials::Model>, DbErr> {
+    credentials::Entity::find()
+        .filter(credentials::Column::TriggerId.eq(trigger_id))
+        .order_by_asc(credentials::Column::CreatedAt)
+        .order_by_asc(credentials::Column::Id)
+        .all(db)
+        .await
+}
+
+pub async fn insert_trigger<C: ConnectionTrait>(
+    db: &C,
+    model: triggers::Model,
+) -> Result<(), DbErr> {
+    triggers::Entity::insert(model.into_active_model().reset_all())
+        .exec_without_returning(db)
+        .await?;
+    Ok(())
+}
+
+pub async fn update_trigger<C: ConnectionTrait>(
+    db: &C,
+    model: triggers::ActiveModel,
+) -> Result<(), DbErr> {
+    model.update(db).await?;
+    Ok(())
+}
+
+pub async fn insert_credential<C: ConnectionTrait>(
+    db: &C,
+    model: credentials::Model,
+) -> Result<(), DbErr> {
+    credentials::Entity::insert(model.into_active_model().reset_all())
+        .exec_without_returning(db)
+        .await?;
+    Ok(())
+}
+
+pub async fn update_credential<C: ConnectionTrait>(
+    db: &C,
+    model: credentials::ActiveModel,
+) -> Result<(), DbErr> {
+    model.update(db).await?;
+    Ok(())
+}
+
+pub async fn enabled_workflow_ids<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+) -> Result<HashSet<String>, DbErr> {
+    let ids: Vec<String> = triggers::Entity::find()
+        .select_only()
+        .column(triggers::Column::WorkflowId)
+        .filter(triggers::Column::OrgId.eq(org_id))
+        .filter(triggers::Column::Enabled.eq(true))
+        .filter(triggers::Column::DeletedAt.is_null())
+        .into_tuple()
+        .all(db)
+        .await?;
+    Ok(ids.into_iter().collect())
+}
+
+pub async fn list_by_org<C: ConnectionTrait>(
+    db: &C,
+    org_id: &str,
+) -> Result<Vec<triggers::Model>, DbErr> {
+    triggers::Entity::find()
+        .filter(triggers::Column::OrgId.eq(org_id))
+        .order_by_asc(triggers::Column::Id)
+        .all(db)
+        .await
+}
+
+pub async fn list_originated<C: ConnectionTrait>(
+    db: &C,
+    origin_cluster: &str,
+    tombstones_since_us: i64,
+) -> Result<Vec<triggers::Model>, DbErr> {
+    triggers::Entity::find()
+        .filter(triggers::Column::OriginCluster.eq(origin_cluster))
+        .filter(
+            Condition::any()
+                .add(triggers::Column::DeletedAt.is_null())
+                .add(triggers::Column::DeletedAt.gte(tombstones_since_us)),
+        )
+        .order_by_asc(triggers::Column::Id)
+        .all(db)
+        .await
+}
+
+pub async fn list_expired_retiring<C: ConnectionTrait>(
+    db: &C,
+    origin_cluster: &str,
+    now_us: i64,
+) -> Result<Vec<credentials::Model>, DbErr> {
+    let originated = Query::select()
+        .column(triggers::Column::Id)
+        .from(triggers::Entity)
+        .and_where(Expr::col(triggers::Column::OriginCluster).eq(origin_cluster))
+        .and_where(Expr::col(triggers::Column::DeletedAt).is_null())
+        .to_owned();
+    credentials::Entity::find()
+        .filter(credentials::Column::State.eq(CredentialState::Retiring.as_str()))
+        .filter(credentials::Column::ExpiresAt.lt(now_us))
+        .filter(credentials::Column::TriggerId.in_subquery(originated))
+        .order_by_asc(credentials::Column::Id)
+        .all(db)
+        .await
+}
+
+pub async fn delete_tombstones_before<C: ConnectionTrait>(
+    db: &C,
+    before_us: i64,
+) -> Result<u64, DbErr> {
+    let tombstoned = Query::select()
+        .column(triggers::Column::Id)
+        .from(triggers::Entity)
+        .and_where(Expr::col(triggers::Column::DeletedAt).lt(before_us))
+        .to_owned();
+    let orphaned = credentials::Entity::delete_many()
+        .filter(credentials::Column::TriggerId.in_subquery(tombstoned))
+        .exec(db)
+        .await?
+        .rows_affected;
+    let revoked = credentials::Entity::delete_many()
+        .filter(credentials::Column::State.eq(CredentialState::Revoked.as_str()))
+        .filter(credentials::Column::RevokedAt.lt(before_us))
+        .exec(db)
+        .await?
+        .rows_affected;
+    let deleted = triggers::Entity::delete_many()
+        .filter(triggers::Column::DeletedAt.lt(before_us))
+        .exec(db)
+        .await?
+        .rows_affected;
+    Ok(orphaned + revoked + deleted)
+}
+
+/// Tombstones the workflow's live trigger by workflow id, all that `WorkflowDelete` carries.
+pub async fn tombstone_for_workflow<C: TransactionTrait>(
+    db: &C,
+    workflow_id: &str,
+    now_us: i64,
+) -> Result<Option<String>, errors::Error> {
+    let txn = db.begin().await?;
+    let Some(trigger) = triggers::Entity::find()
+        .filter(triggers::Column::WorkflowId.eq(workflow_id))
+        .filter(triggers::Column::DeletedAt.is_null())
+        .lock_exclusive()
+        .one(&txn)
+        .await?
+    else {
+        txn.rollback().await?;
+        return Ok(None);
+    };
+    retire_in(&txn, &trigger, now_us).await?;
+    triggers::Entity::update_many()
+        .col_expr(triggers::Column::DeletedAt, Expr::value(now_us))
+        .col_expr(triggers::Column::UpdatedAt, Expr::value(now_us))
+        .col_expr(triggers::Column::Version, Expr::value(trigger.version + 1))
+        .filter(triggers::Column::Id.eq(&trigger.id))
+        .exec(&txn)
+        .await?;
+    txn.commit().await?;
+    Ok(Some(trigger.id))
+}
+
+pub async fn delete_by_org<C: ConnectionTrait>(db: &C, org_id: &str) -> Result<u64, DbErr> {
+    let credentials = credentials::Entity::delete_many()
+        .filter(credentials::Column::OrgId.eq(org_id))
+        .exec(db)
+        .await?
+        .rows_affected;
+    let triggers = triggers::Entity::delete_many()
+        .filter(triggers::Column::OrgId.eq(org_id))
+        .exec(db)
+        .await?
+        .rows_affected;
+    Ok(credentials + triggers)
+}
+
+/// Writes only `rejections`, so a merge never takes over `version` or `updated_at`.
+pub async fn merge_rejections<C: TransactionTrait>(
+    db: &C,
+    trigger_id: &str,
+    deltas: &BTreeMap<String, RejectionDelta>,
+    now_us: i64,
+) -> Result<(), DbErr> {
+    let txn = db.begin().await?;
+    let Some(trigger) = get_for_update(&txn, trigger_id).await? else {
+        txn.rollback().await?;
+        return Ok(());
+    };
+    let mut entries: BTreeMap<String, RejectionEntry> = trigger
+        .rejections
+        .as_deref()
+        .and_then(|raw| serde_json::from_str(raw).ok())
+        .unwrap_or_default();
+    for (reason, delta) in deltas {
+        let merged = merge_rejection_entry(entries.get(reason), delta, now_us);
+        entries.insert(reason.clone(), merged);
+    }
+    let encoded = serde_json::to_string(&entries).map_err(|e| DbErr::Custom(e.to_string()))?;
+    triggers::Entity::update_many()
+        .col_expr(triggers::Column::Rejections, Expr::value(encoded))
+        .filter(triggers::Column::Id.eq(trigger_id))
+        .exec(&txn)
+        .await?;
+    txn.commit().await
+}
+
+pub async fn touch_last_used<C: ConnectionTrait>(
+    db: &C,
+    trigger_id: &str,
+    invoked_at: i64,
+    credential_ids: &[String],
+) -> Result<(), DbErr> {
+    triggers::Entity::update_many()
+        .col_expr(triggers::Column::LastInvokedAt, Expr::value(invoked_at))
+        .filter(triggers::Column::Id.eq(trigger_id))
+        .exec(db)
+        .await?;
+    if credential_ids.is_empty() {
+        return Ok(());
+    }
+    credentials::Entity::update_many()
+        .col_expr(credentials::Column::LastUsedAt, Expr::value(invoked_at))
+        .filter(credentials::Column::TriggerId.eq(trigger_id))
+        .filter(credentials::Column::Id.is_in(credential_ids.iter().map(String::as_str)))
+        .exec(db)
+        .await?;
+    Ok(())
+}
+
+pub async fn load_snapshot(trigger_id: &str) -> Result<Option<TriggerSnapshot>, errors::Error> {
+    load_snapshot_in(get_orm_client_rw().await, trigger_id, resolve_secret).await
+}
+
+pub async fn apply_snapshot(snapshot: TriggerSnapshot) -> Result<ApplyOutcome, errors::Error> {
+    let db = get_orm_client_rw().await;
+    let local = list_credentials(db, &snapshot.trigger.id).await?;
+    let prepared = prepare_missing_secrets_with(&snapshot, &local, prepare_secret).await;
+    Ok(apply_snapshot_in(db, snapshot, prepared).await?)
+}
+
+/// Applies AC-SC-16 on a UNIQUE(`workflow_id`) clash instead of failing, so the message is acked.
+pub async fn apply_snapshot_in<C: TransactionTrait>(
+    db: &C,
+    snapshot: TriggerSnapshot,
+    prepared: Vec<(String, PreparedSecret)>,
+) -> Result<ApplyOutcome, DbErr> {
+    let txn = db.begin().await?;
+    let outcome = apply_locked(&txn, &snapshot, prepared.into_iter().collect()).await?;
+    txn.commit().await?;
+    Ok(outcome)
+}
+
+#[cfg(any(test, feature = "test-utils"))]
+pub async fn create_tables_for_tests(db: &sea_orm::DatabaseConnection) -> Result<(), DbErr> {
+    super::migration::create_workflow_http_trigger_tables(db).await
+}
+
+/// A secret that cannot be read is omitted, so the snapshot still replicates every other field.
+async fn load_snapshot_in<C, R, F>(
+    db: &C,
+    trigger_id: &str,
+    resolve: R,
+) -> Result<Option<TriggerSnapshot>, errors::Error>
+where
+    C: ConnectionTrait,
+    R: Fn(String, String, String) -> F,
+    F: Future<Output = Result<String, SecretError>>,
+{
+    let Some(trigger) = get(db, trigger_id).await? else {
+        return Ok(None);
+    };
+    let credentials = list_credentials(db, trigger_id).await?;
+    let now = now_micros();
+    let mut plaintexts = HashMap::new();
+    for credential in credentials
+        .iter()
+        .filter(|c| carries_secret(&trigger, c, now))
+    {
+        let Some(secret_ref) = credential.secret_ref.clone() else {
+            continue;
+        };
+        match resolve(trigger.org_id.clone(), secret_ref, credential.id.clone()).await {
+            Ok(value) => {
+                plaintexts.insert(credential.id.clone(), value);
+            }
+            Err(e) => log::warn!(
+                "[WORKFLOW_HOOK] trigger {} snapshot omits unreadable secret of credential {}: {e}",
+                trigger.id,
+                credential.id
+            ),
+        }
+    }
+    build_snapshot(&trigger, &credentials, &plaintexts).map(Some)
+}
+
+async fn resolve_secret(
+    org_id: String,
+    secret_ref: String,
+    credential_id: String,
+) -> Result<String, SecretError> {
+    let (_, material) = secrets::resolve_record(
+        &org_id,
+        &secret_ref,
+        SecretOwnerKind::WorkflowTrigger,
+        &credential_id,
+        secrets::CURRENT,
+    )
+    .await?;
+    match material {
+        SecretMaterial::Token { value } => Ok(value),
+        _ => Err(SecretError::Malformed(
+            "workflow trigger secret is not token material".to_string(),
+        )),
+    }
+}
+
+/// Skips, and logs by id, a secret it cannot prepare, so a snapshot always applies.
+async fn prepare_missing_secrets_with<P, F>(
+    snapshot: &TriggerSnapshot,
+    local: &[credentials::Model],
+    prepare: P,
+) -> Vec<(String, PreparedSecret)>
+where
+    P: Fn(String, String, SecretPurpose, String) -> F,
+    F: Future<Output = Result<PreparedSecret, SecretError>>,
+{
+    if snapshot.deleted {
+        return Vec::new();
+    }
+    let stored: HashSet<&str> = local
+        .iter()
+        .filter(|c| c.secret_ref.is_some())
+        .map(|c| c.id.as_str())
+        .collect();
+    let mut prepared = Vec::new();
+    for credential in &snapshot.credentials {
+        let Some(secret) = credential.secret.as_ref() else {
+            continue;
+        };
+        if credential.state == CredentialState::Revoked || stored.contains(credential.id.as_str()) {
+            continue;
+        }
+        let purpose = match credential.kind {
+            CredentialKind::Token if credential.token_sha256 != Some(sha256_hex(secret)) => {
+                log::warn!(
+                    "[WORKFLOW_HOOK] token {} does not match its hash, secret not stored",
+                    credential.id
+                );
+                continue;
+            }
+            CredentialKind::Token => SecretPurpose::Auth,
+            CredentialKind::SigningSecret => SecretPurpose::Signing,
+        };
+        let org_id = snapshot.trigger.org_id.clone();
+        match prepare(org_id, credential.id.clone(), purpose, secret.clone()).await {
+            Ok(secret) => prepared.push((credential.id.clone(), secret)),
+            Err(e) => log::warn!(
+                "[WORKFLOW_HOOK] credential {} applied without a local secret: {e}",
+                credential.id
+            ),
+        }
+    }
+    prepared
+}
+
+async fn prepare_secret(
+    org_id: String,
+    credential_id: String,
+    purpose: SecretPurpose,
+    value: String,
+) -> Result<PreparedSecret, SecretError> {
+    secrets::prepare_create(
+        &org_id,
+        SecretOwnerKind::WorkflowTrigger,
+        &credential_id,
+        purpose,
+        None,
+        SecretMaterial::Token { value },
+    )
+    .await
+}
+
+async fn apply_locked<C: ConnectionTrait>(
+    txn: &C,
+    snapshot: &TriggerSnapshot,
+    prepared: HashMap<String, PreparedSecret>,
+) -> Result<ApplyOutcome, DbErr> {
+    let now = now_micros();
+    let local = get_for_update(txn, &snapshot.trigger.id).await?;
+    if !snapshot.supersedes(local.as_ref()) {
+        return Ok(ApplyOutcome::Stale);
+    }
+    let rival = triggers::Entity::find()
+        .filter(triggers::Column::WorkflowId.eq(&snapshot.trigger.workflow_id))
+        .filter(triggers::Column::Id.ne(&snapshot.trigger.id))
+        .lock_exclusive()
+        .one(txn)
+        .await?;
+    let Some(rival) = rival else {
+        write_snapshot(txn, snapshot, local.is_some(), prepared, false, now).await?;
+        return Ok(ApplyOutcome::Applied);
+    };
+    // A live endpoint outranks a tombstone, or a region's delete could leave none anywhere.
+    let incoming = (
+        !snapshot.deleted,
+        snapshot.trigger.created_at,
+        snapshot.origin_cluster.as_str(),
+        snapshot.trigger.id.as_str(),
+    );
+    let held = (
+        rival.deleted_at.is_none(),
+        rival.created_at,
+        rival.origin_cluster.as_str(),
+        rival.id.as_str(),
+    );
+    if incoming > held {
+        lose_in(txn, &rival, now).await?;
+        write_snapshot(txn, snapshot, local.is_some(), prepared, false, now).await?;
+        Ok(ApplyOutcome::CollisionWon { loser: rival.id })
+    } else {
+        write_snapshot(txn, snapshot, local.is_some(), HashMap::new(), true, now).await?;
+        Ok(ApplyOutcome::CollisionLost)
+    }
+}
+
+/// Upserts the snapshot's R columns; a `lost` one becomes a tombstone that holds no workflow.
+async fn write_snapshot<C: ConnectionTrait>(
+    txn: &C,
+    snapshot: &TriggerSnapshot,
+    exists: bool,
+    mut prepared: HashMap<String, PreparedSecret>,
+    lost: bool,
+    now: i64,
+) -> Result<(), DbErr> {
+    let replicated = &snapshot.trigger;
+    let deleted = snapshot.deleted || lost;
+    let trigger = triggers::ActiveModel {
+        id: Set(replicated.id.clone()),
+        org_id: Set(replicated.org_id.clone()),
+        workflow_id: Set(if lost {
+            lost_workflow_id(&replicated.id)
+        } else {
+            replicated.workflow_id.clone()
+        }),
+        enabled: Set(replicated.enabled),
+        auth_mode: Set(replicated.auth_mode.as_str().to_string()),
+        max_body_bytes: Set(replicated.max_body_bytes),
+        rate_limit_per_minute: Set(replicated.rate_limit_per_minute),
+        created_by: Set(replicated.created_by.clone()),
+        created_at: Set(replicated.created_at),
+        updated_at: Set(replicated.updated_at),
+        version: Set(snapshot.version),
+        origin_cluster: Set(snapshot.origin_cluster.clone()),
+        deleted_at: Set(deleted.then(|| replicated.deleted_at.unwrap_or(now))),
+        last_invoked_at: NotSet,
+        rejections: NotSet,
+    };
+    if exists {
+        trigger.update(txn).await?;
+    } else {
+        triggers::Entity::insert(trigger)
+            .exec_without_returning(txn)
+            .await?;
+    }
+
+    let mut local: HashMap<String, credentials::Model> = list_credentials(txn, &replicated.id)
+        .await?
+        .into_iter()
+        .map(|c| (c.id.clone(), c))
+        .collect();
+    for credential in &snapshot.credentials {
+        let held = local.remove(&credential.id);
+        let state = if lost {
+            CredentialState::Revoked
+        } else {
+            credential.state
+        };
+        let keeps_secret = !deleted && state != CredentialState::Revoked;
+        let held_ref = held.as_ref().and_then(|c| c.secret_ref.clone());
+        let secret_ref = match (keeps_secret, held_ref) {
+            (true, Some(secret_ref)) => Some(secret_ref),
+            (true, None) => match prepared.remove(&credential.id) {
+                Some(secret) => Some(
+                    secrets::insert_prepared(txn, secret)
+                        .await
+                        .map_err(secret_db_err)?
+                        .metadata
+                        .secret_ref,
+                ),
+                None => None,
+            },
+            (false, _) => {
+                delete_secret_in(txn, &replicated.org_id, &credential.id).await?;
+                None
+            }
+        };
+        let row = credentials::ActiveModel {
+            id: Set(credential.id.clone()),
+            trigger_id: Set(replicated.id.clone()),
+            org_id: Set(replicated.org_id.clone()),
+            kind: Set(credential.kind.as_str().to_string()),
+            display_prefix: Set(credential.display_prefix.clone()),
+            token_sha256: Set(credential.token_sha256.clone()),
+            secret_ref: Set(secret_ref),
+            state: Set(state.as_str().to_string()),
+            expires_at: Set(credential.expires_at),
+            revoked_at: Set(if lost {
+                credential.revoked_at.or(Some(now))
+            } else {
+                credential.revoked_at
+            }),
+            created_by: Set(credential.created_by.clone()),
+            created_at: Set(credential.created_at),
+            updated_at: Set(credential.updated_at),
+            last_used_at: NotSet,
+        };
+        if held.is_some() {
+            row.update(txn).await?;
+        } else {
+            credentials::Entity::insert(row)
+                .exec_without_returning(txn)
+                .await?;
+        }
+    }
+
+    for dropped in local.into_values() {
+        delete_secret_in(txn, &dropped.org_id, &dropped.id).await?;
+        credentials::Entity::delete_by_id(dropped.id)
+            .exec(txn)
+            .await?;
+    }
+    if deleted {
+        workflow_http_trigger_requests::delete_queued_for_trigger(txn, &replicated.id).await?;
+    }
+    Ok(())
+}
+
+/// Tombstones the local loser of a create collision and frees its `workflow_id` for the winner.
+async fn lose_in<C: ConnectionTrait>(
+    txn: &C,
+    trigger: &triggers::Model,
+    now: i64,
+) -> Result<(), DbErr> {
+    retire_in(txn, trigger, now).await?;
+    triggers::Entity::update_many()
+        .col_expr(
+            triggers::Column::WorkflowId,
+            Expr::value(lost_workflow_id(&trigger.id)),
+        )
+        .col_expr(
+            triggers::Column::DeletedAt,
+            Expr::value(trigger.deleted_at.unwrap_or(now)),
+        )
+        .filter(triggers::Column::Id.eq(&trigger.id))
+        .exec(txn)
+        .await?;
+    Ok(())
+}
+
+/// Revokes every credential of the trigger, deletes their local secrets and its queued runs.
+async fn retire_in<C: ConnectionTrait>(
+    txn: &C,
+    trigger: &triggers::Model,
+    now: i64,
+) -> Result<(), DbErr> {
+    for credential in list_credentials(txn, &trigger.id).await? {
+        delete_secret_in(txn, &trigger.org_id, &credential.id).await?;
+    }
+    credentials::Entity::update_many()
+        .col_expr(
+            credentials::Column::State,
+            Expr::value(CredentialState::Revoked.as_str()),
+        )
+        .col_expr(credentials::Column::RevokedAt, Expr::value(now))
+        .col_expr(credentials::Column::UpdatedAt, Expr::value(now))
+        .filter(credentials::Column::TriggerId.eq(&trigger.id))
+        .filter(credentials::Column::State.ne(CredentialState::Revoked.as_str()))
+        .exec(txn)
+        .await?;
+    credentials::Entity::update_many()
+        .col_expr(
+            credentials::Column::SecretRef,
+            Expr::value(Option::<String>::None),
+        )
+        .filter(credentials::Column::TriggerId.eq(&trigger.id))
+        .exec(txn)
+        .await?;
+    workflow_http_trigger_requests::delete_queued_for_trigger(txn, &trigger.id).await?;
+    Ok(())
+}
+
+async fn delete_secret_in<C: ConnectionTrait>(
+    txn: &C,
+    org_id: &str,
+    credential_id: &str,
+) -> Result<(), DbErr> {
+    secrets::delete_for_owner_in(txn, org_id, SecretOwnerKind::WorkflowTrigger, credential_id)
+        .await
+        .map_err(secret_db_err)?;
+    Ok(())
+}
+
+fn sha256_hex(value: &str) -> String {
+    format!("{:x}", Sha256::digest(value.as_bytes()))
+}
+
+fn carries_secret(trigger: &triggers::Model, credential: &credentials::Model, now: i64) -> bool {
+    trigger.deleted_at.is_none()
+        && CredentialState::parse(&credential.state)
+            .is_some_and(|state| is_live(state, credential.expires_at, now))
+}
+
+/// Pairs each live credential with its plaintext from `plaintexts`; no other gets one.
+fn build_snapshot(
+    trigger: &triggers::Model,
+    credentials: &[credentials::Model],
+    plaintexts: &HashMap<String, String>,
+) -> Result<TriggerSnapshot, errors::Error> {
+    let malformed = |what: &str, value: &str| {
+        errors::Error::Message(format!(
+            "workflow http trigger {}: unknown {what} '{value}'",
+            trigger.id
+        ))
+    };
+    let auth_mode = AuthMode::parse(&trigger.auth_mode)
+        .ok_or_else(|| malformed("auth mode", &trigger.auth_mode))?;
+    let now = now_micros();
+    let mut replicated = Vec::with_capacity(credentials.len());
+    for credential in credentials {
+        let kind = CredentialKind::parse(&credential.kind)
+            .ok_or_else(|| malformed("credential kind", &credential.kind))?;
+        let state = CredentialState::parse(&credential.state)
+            .ok_or_else(|| malformed("credential state", &credential.state))?;
+        let secret = carries_secret(trigger, credential, now)
+            .then(|| plaintexts.get(&credential.id).cloned())
+            .flatten();
+        replicated.push(ReplicatedCredential {
+            id: credential.id.clone(),
+            kind,
+            display_prefix: credential.display_prefix.clone(),
+            token_sha256: credential.token_sha256.clone(),
+            state,
+            expires_at: credential.expires_at,
+            revoked_at: credential.revoked_at,
+            created_by: credential.created_by.clone(),
+            created_at: credential.created_at,
+            updated_at: credential.updated_at,
+            secret,
+        });
+    }
+    Ok(TriggerSnapshot {
+        version: trigger.version,
+        origin_cluster: trigger.origin_cluster.clone(),
+        deleted: trigger.deleted_at.is_some(),
+        trigger: ReplicatedTrigger {
+            id: trigger.id.clone(),
+            org_id: trigger.org_id.clone(),
+            workflow_id: trigger.workflow_id.clone(),
+            enabled: trigger.enabled,
+            auth_mode,
+            max_body_bytes: trigger.max_body_bytes,
+            rate_limit_per_minute: trigger.rate_limit_per_minute,
+            created_by: trigger.created_by.clone(),
+            created_at: trigger.created_at,
+            updated_at: trigger.updated_at,
+            deleted_at: trigger.deleted_at,
+        },
+        credentials: replicated,
+    })
+}
+
+fn lost_workflow_id(trigger_id: &str) -> String {
+    format!("{LOST_WORKFLOW_ID_PREFIX}{trigger_id}")
+}
+
+fn secret_db_err(error: SecretError) -> DbErr {
+    match error {
+        SecretError::Database(error) => error,
+        other => DbErr::Custom(other.to_string()),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use sea_orm::{ConnectOptions, Database, DatabaseConnection, PaginatorTrait};
+
+    use super::*;
+    use crate::table::{
+        entity::{llm_secrets, workflow_http_trigger_requests as requests, workflow_run_data},
+        workflow_http_trigger_requests::{self as ledger, NewHookRequest},
+    };
+
+    const NOW: i64 = 1_760_000_000_000_000;
+
+    type Calls = std::sync::Mutex<Vec<(String, SecretPurpose, String)>>;
+
+    /// One connection: separate connections to `sqlite::memory:` are separate databases.
+    async fn db() -> DatabaseConnection {
+        let mut opts = ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = Database::connect(opts).await.unwrap();
+        create_tables_for_tests(&db).await.unwrap();
+        db
+    }
+
+    fn trigger(id: &str, workflow_id: &str) -> triggers::Model {
+        triggers::Model {
+            id: id.to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: workflow_id.to_string(),
+            enabled: true,
+            auth_mode: AuthMode::Signature.as_str().to_string(),
+            max_body_bytes: 1_048_576,
+            rate_limit_per_minute: 60,
+            created_by: "a@x.io".to_string(),
+            created_at: NOW,
+            updated_at: NOW,
+            version: 1,
+            origin_cluster: "r1".to_string(),
+            deleted_at: None,
+            last_invoked_at: None,
+            rejections: None,
+        }
+    }
+
+    fn credential(id: &str, trigger_id: &str, kind: CredentialKind) -> credentials::Model {
+        credentials::Model {
+            id: id.to_string(),
+            trigger_id: trigger_id.to_string(),
+            org_id: "acme".to_string(),
+            kind: kind.as_str().to_string(),
+            display_prefix: "whsec_abcd…wxyz".to_string(),
+            token_sha256: (kind == CredentialKind::Token).then(|| "ab".repeat(32)),
+            secret_ref: None,
+            state: CredentialState::Active.as_str().to_string(),
+            expires_at: None,
+            revoked_at: None,
+            created_by: "a@x.io".to_string(),
+            created_at: NOW,
+            updated_at: NOW,
+            last_used_at: None,
+        }
+    }
+
+    fn snapshot(
+        trigger: &triggers::Model,
+        credentials: &[credentials::Model],
+        secrets: &[(&str, &str)],
+    ) -> TriggerSnapshot {
+        let secrets = secrets
+            .iter()
+            .map(|(id, value)| (id.to_string(), value.to_string()))
+            .collect();
+        build_snapshot(trigger, credentials, &secrets).unwrap()
+    }
+
+    fn prepared(org_id: &str, credential_id: &str) -> Vec<(String, PreparedSecret)> {
+        vec![(
+            credential_id.to_string(),
+            secrets::prepared_for_tests(org_id, SecretOwnerKind::WorkflowTrigger, credential_id),
+        )]
+    }
+
+    fn hook_request(trigger_id: &str, run_id: &str) -> NewHookRequest {
+        NewHookRequest {
+            trigger_id: trigger_id.to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: "wf-1".to_string(),
+            run_id: run_id.to_string(),
+            idem_key: None,
+            body_sha256: "cd".repeat(32),
+            body_bytes: 2,
+            content_type: Some("application/json".to_string()),
+            meta: "{}".to_string(),
+            credential_id: "c1".to_string(),
+            credential_prefix: "o2wh_abcd…wxyz".to_string(),
+            caller_ip: "203.0.113.7".to_string(),
+            received_at: NOW,
+        }
+    }
+
+    async fn secret_count(db: &DatabaseConnection, owner_id: &str) -> u64 {
+        llm_secrets::Entity::find()
+            .filter(llm_secrets::Column::OwnerKind.eq("workflow_trigger"))
+            .filter(llm_secrets::Column::OwnerId.eq(owner_id))
+            .count(db)
+            .await
+            .unwrap()
+    }
+
+    async fn credential_row(db: &DatabaseConnection, id: &str) -> credentials::Model {
+        credentials::Entity::find_by_id(id)
+            .one(db)
+            .await
+            .unwrap()
+            .unwrap()
+    }
+
+    fn token(id: &str, trigger_id: &str, plaintext: &str) -> credentials::Model {
+        let mut row = credential(id, trigger_id, CredentialKind::Token);
+        row.display_prefix = "o2wh_abcd…wxyz".to_string();
+        row.token_sha256 = Some(sha256_hex(plaintext));
+        row
+    }
+
+    /// Records each prepare call; `secrets_on == false` plays a region with stored secrets off.
+    async fn prepare_recorded(
+        snapshot: &TriggerSnapshot,
+        local: &[credentials::Model],
+        calls: &Calls,
+        secrets_on: bool,
+    ) -> Vec<(String, PreparedSecret)> {
+        prepare_missing_secrets_with(snapshot, local, |org, id, purpose, value| {
+            calls.lock().unwrap().push((id.clone(), purpose, value));
+            async move {
+                if secrets_on {
+                    Ok(secrets::prepared_for_tests(
+                        &org,
+                        SecretOwnerKind::WorkflowTrigger,
+                        &id,
+                    ))
+                } else {
+                    Err(SecretError::Encryption(
+                        "stored secrets are off".to_string(),
+                    ))
+                }
+            }
+        })
+        .await
+    }
+
+    #[test]
+    fn enum_strings_round_trip() {
+        for mode in [AuthMode::Token, AuthMode::Signature] {
+            assert_eq!(AuthMode::parse(mode.as_str()), Some(mode));
+        }
+        for kind in [CredentialKind::Token, CredentialKind::SigningSecret] {
+            assert_eq!(CredentialKind::parse(kind.as_str()), Some(kind));
+        }
+        for state in [
+            CredentialState::Active,
+            CredentialState::Retiring,
+            CredentialState::Revoked,
+        ] {
+            assert_eq!(CredentialState::parse(state.as_str()), Some(state));
+        }
+        assert_eq!(
+            CredentialKind::for_mode(AuthMode::Signature),
+            CredentialKind::SigningSecret
+        );
+        assert_eq!(AuthMode::parse("basic"), None);
+    }
+
+    #[test]
+    fn an_expired_retiring_credential_is_not_live() {
+        assert!(!is_live(CredentialState::Retiring, Some(NOW - 1), NOW));
+        assert!(!is_live(CredentialState::Retiring, Some(NOW), NOW));
+        assert!(is_live(CredentialState::Retiring, Some(NOW + 1), NOW));
+    }
+
+    #[test]
+    fn a_revoked_credential_is_not_live() {
+        assert!(!is_live(CredentialState::Revoked, None, NOW));
+        assert!(!is_live(CredentialState::Revoked, Some(NOW + 1), NOW));
+    }
+
+    #[test]
+    fn an_active_credential_without_expiry_is_live() {
+        assert!(is_live(CredentialState::Active, None, NOW));
+    }
+
+    #[test]
+    fn rejection_merge_adds_within_the_window_and_resets_after_it() {
+        let first = merge_rejection_entry(
+            None,
+            &RejectionDelta {
+                count: 2,
+                last_at: NOW,
+                last_ip: "198.51.100.1".to_string(),
+            },
+            NOW,
+        );
+        assert_eq!((first.count_24h, first.window_start), (2, NOW));
+        let older_delta = RejectionDelta {
+            count: 3,
+            last_at: NOW - 5,
+            last_ip: "198.51.100.2".to_string(),
+        };
+        let added = merge_rejection_entry(Some(&first), &older_delta, NOW + 10);
+        assert_eq!(added.count_24h, 5);
+        assert_eq!(
+            (added.last_at, added.last_ip.as_str()),
+            (NOW, "198.51.100.1")
+        );
+        let reset = merge_rejection_entry(Some(&added), &older_delta, NOW + REJECTION_WINDOW_US);
+        assert_eq!(reset.count_24h, 3);
+        assert_eq!(reset.window_start, NOW + REJECTION_WINDOW_US);
+    }
+
+    #[test]
+    fn snapshot_carries_the_secret_of_every_live_credential() {
+        let trigger = trigger("t1", "wf-1");
+        let live = credential("live", "t1", CredentialKind::SigningSecret);
+        let mut expired = credential("expired", "t1", CredentialKind::SigningSecret);
+        expired.state = CredentialState::Retiring.as_str().to_string();
+        expired.expires_at = Some(NOW - 1);
+        let mut revoked = credential("revoked", "t1", CredentialKind::Token);
+        revoked.state = CredentialState::Revoked.as_str().to_string();
+        revoked.revoked_at = Some(NOW);
+        let token = token("token", "t1", "o2wh_token");
+        let snap = snapshot(
+            &trigger,
+            &[live, expired, revoked, token],
+            &[
+                ("live", "whsec_live"),
+                ("expired", "whsec_expired"),
+                ("revoked", "o2wh_revoked"),
+                ("token", "o2wh_token"),
+            ],
+        );
+        let ids: Vec<&str> = snap.credentials.iter().map(|c| c.id.as_str()).collect();
+        assert_eq!(ids, ["live", "expired", "revoked", "token"]);
+        let secrets: Vec<Option<&str>> = snap
+            .credentials
+            .iter()
+            .map(|c| c.secret.as_deref())
+            .collect();
+        assert_eq!(
+            secrets,
+            [Some("whsec_live"), None, None, Some("o2wh_token")]
+        );
+        assert_eq!(
+            (snap.version, snap.origin_cluster.as_str(), snap.deleted),
+            (1, "r1", false)
+        );
+        assert_eq!(snap.credentials[2].state, CredentialState::Revoked);
+    }
+
+    #[test]
+    fn snapshot_debug_omits_secrets() {
+        let trigger = trigger("t1", "wf-1");
+        let snap = snapshot(
+            &trigger,
+            &[
+                credential("c1", "t1", CredentialKind::SigningSecret),
+                token("c2", "t1", "o2wh_dG9rZW4tdmFsdWU"),
+            ],
+            &[
+                ("c1", "whsec_c2VjcmV0LXZhbHVl"),
+                ("c2", "o2wh_dG9rZW4tdmFsdWU"),
+            ],
+        );
+        assert!(snap.credentials.iter().all(|c| c.secret.is_some()));
+        let printed = format!("{snap:?}");
+        assert!(!printed.contains("whsec_c2VjcmV0LXZhbHVl"), "{printed}");
+        assert!(!printed.contains("o2wh_dG9rZW4tdmFsdWU"), "{printed}");
+        assert!(
+            !printed.contains(&sha256_hex("o2wh_dG9rZW4tdmFsdWU")),
+            "{printed}"
+        );
+        assert!(printed.contains("<redacted>"), "{printed}");
+        assert!(printed.contains("t1"), "{printed}");
+    }
+
+    #[tokio::test]
+    async fn emit_skips_an_unreadable_token_secret() {
+        let db = db().await;
+        let mut local = trigger("t1", "wf-1");
+        local.auth_mode = AuthMode::Token.as_str().to_string();
+        insert_trigger(&db, local).await.unwrap();
+        for (id, plaintext) in [("c-good", "o2wh_good"), ("c-bad", "o2wh_bad")] {
+            let mut row = token(id, "t1", plaintext);
+            row.secret_ref = Some(format!("ref-{id}"));
+            insert_credential(&db, row).await.unwrap();
+        }
+        let snap = load_snapshot_in(&db, "t1", |org, secret_ref, id| async move {
+            assert_eq!((org.as_str(), secret_ref), ("acme", format!("ref-{id}")));
+            match id.as_str() {
+                "c-good" => Ok("o2wh_good".to_string()),
+                _ => Err(SecretError::Encryption("no key".to_string())),
+            }
+        })
+        .await
+        .unwrap()
+        .unwrap();
+        let carried: Vec<(&str, Option<&str>)> = snap
+            .credentials
+            .iter()
+            .map(|c| (c.id.as_str(), c.secret.as_deref()))
+            .collect();
+        assert_eq!(carried, [("c-bad", None), ("c-good", Some("o2wh_good"))]);
+        let bad = &snap.credentials[0];
+        assert_eq!(bad.token_sha256, Some(sha256_hex("o2wh_bad")));
+        assert_eq!(bad.state, CredentialState::Active);
+        assert_eq!(snap.trigger.auth_mode, AuthMode::Token);
+    }
+
+    #[tokio::test]
+    async fn a_newer_snapshot_is_applied() {
+        let db = db().await;
+        insert_trigger(&db, trigger("t1", "wf-1")).await.unwrap();
+        let mut newer = trigger("t1", "wf-1");
+        newer.version = 2;
+        newer.enabled = false;
+        newer.updated_at = NOW + 1;
+        let outcome = apply_snapshot_in(&db, snapshot(&newer, &[], &[]), Vec::new())
+            .await
+            .unwrap();
+        assert_eq!(outcome, ApplyOutcome::Applied);
+        let stored = get(&db, "t1").await.unwrap().unwrap();
+        assert_eq!((stored.version, stored.enabled), (2, false));
+    }
+
+    #[tokio::test]
+    async fn an_equal_version_is_ignored() {
+        let db = db().await;
+        insert_trigger(&db, trigger("t1", "wf-1")).await.unwrap();
+        let mut same = trigger("t1", "wf-1");
+        same.enabled = false;
+        let outcome = apply_snapshot_in(&db, snapshot(&same, &[], &[]), Vec::new())
+            .await
+            .unwrap();
+        assert_eq!(outcome, ApplyOutcome::Stale);
+        assert!(get(&db, "t1").await.unwrap().unwrap().enabled);
+    }
+
+    #[tokio::test]
+    async fn ties_break_on_updated_at_then_origin_cluster() {
+        let db = db().await;
+        insert_trigger(&db, trigger("t1", "wf-1")).await.unwrap();
+        let mut later = trigger("t1", "wf-1");
+        later.updated_at = NOW + 1;
+        later.origin_cluster = "r0".to_string();
+        let applied = apply_snapshot_in(&db, snapshot(&later, &[], &[]), Vec::new()).await;
+        assert_eq!(applied.unwrap(), ApplyOutcome::Applied);
+
+        let mut lower_origin = later.clone();
+        lower_origin.origin_cluster = "q9".to_string();
+        let stale = apply_snapshot_in(&db, snapshot(&lower_origin, &[], &[]), Vec::new()).await;
+        assert_eq!(stale.unwrap(), ApplyOutcome::Stale);
+
+        let mut higher_origin = later.clone();
+        higher_origin.origin_cluster = "r2".to_string();
+        let applied = apply_snapshot_in(&db, snapshot(&higher_origin, &[], &[]), Vec::new()).await;
+        assert_eq!(applied.unwrap(), ApplyOutcome::Applied);
+        assert_eq!(get(&db, "t1").await.unwrap().unwrap().origin_cluster, "r2");
+    }
+
+    #[tokio::test]
+    async fn apply_never_overwrites_local_columns() {
+        let db = db().await;
+        let mut local = trigger("t1", "wf-1");
+        local.last_invoked_at = Some(NOW + 5);
+        local.rejections = Some(r#"{"bad_signature":{"count_24h":1}}"#.to_string());
+        insert_trigger(&db, local).await.unwrap();
+        let mut held = credential("c1", "t1", CredentialKind::SigningSecret);
+        held.secret_ref = Some("local-ref".to_string());
+        held.last_used_at = Some(NOW + 6);
+        insert_credential(&db, held).await.unwrap();
+
+        let mut remote = trigger("t1", "wf-1");
+        remote.version = 2;
+        remote.rate_limit_per_minute = 10;
+        let mut remote_credential = credential("c1", "t1", CredentialKind::SigningSecret);
+        remote_credential.display_prefix = "whsec_new…".to_string();
+        let snap = snapshot(&remote, &[remote_credential], &[("c1", "whsec_remote")]);
+        let outcome = apply_snapshot_in(&db, snap, prepared("acme", "c1")).await;
+        assert_eq!(outcome.unwrap(), ApplyOutcome::Applied);
+
+        let stored = get(&db, "t1").await.unwrap().unwrap();
+        assert_eq!(stored.rate_limit_per_minute, 10);
+        assert_eq!(stored.last_invoked_at, Some(NOW + 5));
+        assert!(stored.rejections.unwrap().contains("bad_signature"));
+        let stored = credential_row(&db, "c1").await;
+        assert_eq!(stored.display_prefix, "whsec_new…");
+        assert_eq!(stored.secret_ref.as_deref(), Some("local-ref"));
+        assert_eq!(stored.last_used_at, Some(NOW + 6));
+        assert_eq!(secret_count(&db, "c1").await, 0, "a held secret is kept");
+    }
+
+    #[tokio::test]
+    async fn a_signing_secret_is_stored_from_the_prepared_row_on_first_sight() {
+        let db = db().await;
+        let remote = trigger("t1", "wf-1");
+        let snap = snapshot(
+            &remote,
+            &[credential("c1", "t1", CredentialKind::SigningSecret)],
+            &[("c1", "whsec_remote")],
+        );
+        let outcome = apply_snapshot_in(&db, snap, prepared("acme", "c1")).await;
+        assert_eq!(outcome.unwrap(), ApplyOutcome::Applied);
+        let stored = credential_row(&db, "c1").await;
+        let secret = llm_secrets::Entity::find()
+            .filter(llm_secrets::Column::OwnerId.eq("c1"))
+            .one(&db)
+            .await
+            .unwrap()
+            .unwrap();
+        assert_eq!(stored.secret_ref, Some(secret.secret_ref));
+        assert_eq!(secret.owner_kind, "workflow_trigger");
+    }
+
+    #[tokio::test]
+    async fn a_revoked_credential_loses_its_local_secret() {
+        let db = db().await;
+        let remote = trigger("t1", "wf-1");
+        let signing = credential("c1", "t1", CredentialKind::SigningSecret);
+        let token = token("c2", "t1", "o2wh_x");
+        let first = snapshot(
+            &remote,
+            &[signing.clone(), token.clone()],
+            &[("c1", "whsec_x"), ("c2", "o2wh_x")],
+        );
+        let mut held = prepared("acme", "c1");
+        held.extend(prepared("acme", "c2"));
+        apply_snapshot_in(&db, first, held).await.unwrap();
+        assert_eq!(secret_count(&db, "c1").await, 1);
+        assert_eq!(secret_count(&db, "c2").await, 1);
+
+        let mut revoked_trigger = remote.clone();
+        revoked_trigger.version = 2;
+        let revoked: Vec<credentials::Model> = [signing, token]
+            .into_iter()
+            .map(|mut c| {
+                c.state = CredentialState::Revoked.as_str().to_string();
+                c.revoked_at = Some(NOW + 1);
+                c
+            })
+            .collect();
+        let second = snapshot(&revoked_trigger, &revoked, &[]);
+        let outcome = apply_snapshot_in(&db, second, Vec::new()).await;
+        assert_eq!(outcome.unwrap(), ApplyOutcome::Applied);
+        for id in ["c1", "c2"] {
+            assert_eq!(secret_count(&db, id).await, 0, "{id}");
+            let stored = credential_row(&db, id).await;
+            assert_eq!(stored.state, "revoked", "{id}");
+            assert_eq!(stored.secret_ref, None, "{id}");
+        }
+    }
+
+    #[tokio::test]
+    async fn a_token_is_encrypted_locally_on_first_sight_with_purpose_auth() {
+        let db = db().await;
+        let snap = snapshot(
+            &trigger("t1", "wf-1"),
+            &[token("c1", "t1", "o2wh_first")],
+            &[("c1", "o2wh_first")],
+        );
+        let calls = Calls::default();
+        let prepared = prepare_recorded(&snap, &[], &calls, true).await;
+        assert_eq!(
+            *calls.lock().unwrap(),
+            [(
+                "c1".to_string(),
+                SecretPurpose::Auth,
+                "o2wh_first".to_string()
+            )]
+        );
+        let outcome = apply_snapshot_in(&db, snap, prepared).await;
+        assert_eq!(outcome.unwrap(), ApplyOutcome::Applied);
+        let stored = credential_row(&db, "c1").await;
+        assert!(stored.secret_ref.is_some());
+        assert_eq!(stored.token_sha256, Some(sha256_hex("o2wh_first")));
+        assert_eq!(secret_count(&db, "c1").await, 1);
+    }
+
+    #[tokio::test]
+    async fn a_token_whose_secret_does_not_match_its_hash_is_skipped() {
+        let db = db().await;
+        let snap = snapshot(
+            &trigger("t1", "wf-1"),
+            &[
+                token("c-ok", "t1", "o2wh_ok"),
+                token("c-forged", "t1", "o2wh_original"),
+            ],
+            &[("c-ok", "o2wh_ok"), ("c-forged", "o2wh_tampered")],
+        );
+        let calls = Calls::default();
+        let prepared = prepare_recorded(&snap, &[], &calls, true).await;
+        let asked: Vec<String> = calls.lock().unwrap().iter().map(|c| c.0.clone()).collect();
+        assert_eq!(asked, ["c-ok"]);
+        let outcome = apply_snapshot_in(&db, snap, prepared).await;
+        assert_eq!(outcome.unwrap(), ApplyOutcome::Applied);
+        let forged = credential_row(&db, "c-forged").await;
+        assert_eq!(forged.secret_ref, None);
+        assert_eq!(forged.token_sha256, Some(sha256_hex("o2wh_original")));
+        assert_eq!(secret_count(&db, "c-forged").await, 0);
+        assert_eq!(secret_count(&db, "c-ok").await, 1);
+    }
+
+    #[tokio::test]
+    async fn apply_with_secrets_off_still_revokes_a_token() {
+        let db = db().await;
+        let remote = trigger("t1", "wf-1");
+        let live = token("c1", "t1", "o2wh_first");
+        let first = snapshot(
+            &remote,
+            std::slice::from_ref(&live),
+            &[("c1", "o2wh_first")],
+        );
+        let calls = Calls::default();
+        let prepared = prepare_recorded(&first, &[], &calls, true).await;
+        apply_snapshot_in(&db, first, prepared).await.unwrap();
+        assert_eq!(secret_count(&db, "c1").await, 1);
+
+        let mut newer = remote.clone();
+        newer.version = 2;
+        let mut revoked = live;
+        revoked.state = CredentialState::Revoked.as_str().to_string();
+        revoked.revoked_at = Some(NOW + 1);
+        let second = snapshot(
+            &newer,
+            &[revoked, token("c2", "t1", "o2wh_second")],
+            &[("c2", "o2wh_second")],
+        );
+        let local = list_credentials(&db, "t1").await.unwrap();
+        let prepared = prepare_recorded(&second, &local, &calls, false).await;
+        assert!(prepared.is_empty());
+        assert_eq!(
+            calls.lock().unwrap().last().map(|c| (c.0.as_str(), c.1)),
+            Some(("c2", SecretPurpose::Auth)),
+            "the failed prepare was attempted"
+        );
+        let outcome = apply_snapshot_in(&db, second, prepared).await;
+        assert_eq!(outcome.unwrap(), ApplyOutcome::Applied);
+        let c1 = credential_row(&db, "c1").await;
+        assert_eq!((c1.state.as_str(), c1.secret_ref), ("revoked", None));
+        assert_eq!(secret_count(&db, "c1").await, 0);
+        let c2 = credential_row(&db, "c2").await;
+        assert_eq!((c2.state.as_str(), c2.secret_ref), ("active", None));
+        assert_eq!(c2.token_sha256, Some(sha256_hex("o2wh_second")));
+    }
+
+    #[tokio::test]
+    async fn a_deleted_snapshot_tombstones_and_drops_queued_rows() {
+        let db = db().await;
+        let remote = trigger("t1", "wf-1");
+        let live = credential("c1", "t1", CredentialKind::SigningSecret);
+        let first = snapshot(&remote, std::slice::from_ref(&live), &[("c1", "whsec_x")]);
+        apply_snapshot_in(&db, first, prepared("acme", "c1"))
+            .await
+            .unwrap();
+        ledger::enqueue(&db, hook_request("t1", "run-1"), "{}".to_string())
+            .await
+            .unwrap();
+
+        let mut gone = remote.clone();
+        gone.version = 2;
+        gone.deleted_at = Some(NOW + 1);
+        let mut revoked = live;
+        revoked.state = CredentialState::Revoked.as_str().to_string();
+        let outcome = apply_snapshot_in(&db, snapshot(&gone, &[revoked], &[]), Vec::new()).await;
+        assert_eq!(outcome.unwrap(), ApplyOutcome::Applied);
+
+        let stored = get(&db, "t1").await.unwrap().unwrap();
+        assert_eq!(stored.deleted_at, Some(NOW + 1));
+        assert_eq!(secret_count(&db, "c1").await, 0);
+        assert_eq!(requests::Entity::find().count(&db).await.unwrap(), 0);
+        assert_eq!(
+            workflow_run_data::Entity::find().count(&db).await.unwrap(),
+            0
+        );
+    }
+
+    #[tokio::test]
+    async fn a_stale_snapshot_after_a_revoke_does_not_resurrect_the_credential() {
+        let db = db().await;
+        let mut remote = trigger("t1", "wf-1");
+        let live = credential("c1", "t1", CredentialKind::SigningSecret);
+        let old = snapshot(&remote, std::slice::from_ref(&live), &[("c1", "whsec_x")]);
+        remote.version = 2;
+        let mut revoked = live;
+        revoked.state = CredentialState::Revoked.as_str().to_string();
+        let revoke = snapshot(&remote, &[revoked], &[]);
+        apply_snapshot_in(&db, revoke, Vec::new()).await.unwrap();
+
+        let redelivered = apply_snapshot_in(&db, old, prepared("acme", "c1")).await;
+        assert_eq!(redelivered.unwrap(), ApplyOutcome::Stale);
+        assert_eq!(credential_row(&db, "c1").await.state, "revoked");
+        assert_eq!(secret_count(&db, "c1").await, 0);
+    }
+
+    #[tokio::test]
+    async fn a_credential_missing_from_a_newer_snapshot_is_dropped() {
+        let db = db().await;
+        let mut remote = trigger("t1", "wf-1");
+        let first = snapshot(
+            &remote,
+            &[credential("c1", "t1", CredentialKind::SigningSecret)],
+            &[("c1", "whsec_x")],
+        );
+        apply_snapshot_in(&db, first, prepared("acme", "c1"))
+            .await
+            .unwrap();
+        remote.version = 2;
+        apply_snapshot_in(&db, snapshot(&remote, &[], &[]), Vec::new())
+            .await
+            .unwrap();
+        assert!(list_credentials(&db, "t1").await.unwrap().is_empty());
+        assert_eq!(secret_count(&db, "c1").await, 0);
+    }
+
+    #[tokio::test]
+    async fn a_create_collision_keeps_the_greater_created_at_and_origin() {
+        let db = db().await;
+        insert_trigger(&db, trigger("tA", "wf-1")).await.unwrap();
+        let mut held = credential("cA", "tA", CredentialKind::SigningSecret);
+        held.secret_ref = Some("ref-a".to_string());
+        insert_credential(&db, held).await.unwrap();
+        ledger::enqueue(&db, hook_request("tA", "run-a"), "{}".to_string())
+            .await
+            .unwrap();
+
+        let mut newer = trigger("tB", "wf-1");
+        newer.created_at = NOW + 1;
+        newer.origin_cluster = "r2".to_string();
+        let won = apply_snapshot_in(
+            &db,
+            snapshot(
+                &newer,
+                &[credential("cB", "tB", CredentialKind::SigningSecret)],
+                &[("cB", "whsec_b")],
+            ),
+            prepared("acme", "cB"),
+        )
+        .await;
+        assert_eq!(
+            won.unwrap(),
+            ApplyOutcome::CollisionWon {
+                loser: "tA".to_string()
+            }
+        );
+        assert_eq!(
+            get_by_workflow(&db, "acme", "wf-1")
+                .await
+                .unwrap()
+                .unwrap()
+                .id,
+            "tB"
+        );
+        let loser = get(&db, "tA").await.unwrap().unwrap();
+        assert!(loser.deleted_at.is_some());
+        assert_ne!(loser.workflow_id, "wf-1");
+        let loser_credential = credential_row(&db, "cA").await;
+        assert_eq!(loser_credential.state, "revoked");
+        assert_eq!(loser_credential.secret_ref, None);
+        assert_eq!(ledger::count_queued_for_org(&db, "acme").await.unwrap(), 0);
+
+        let mut older = trigger("tC", "wf-1");
+        older.created_at = NOW - 1;
+        let lost = apply_snapshot_in(
+            &db,
+            snapshot(
+                &older,
+                &[credential("cC", "tC", CredentialKind::SigningSecret)],
+                &[("cC", "whsec_c")],
+            ),
+            prepared("acme", "cC"),
+        )
+        .await;
+        assert_eq!(lost.unwrap(), ApplyOutcome::CollisionLost);
+        assert_eq!(
+            get_by_workflow(&db, "acme", "wf-1")
+                .await
+                .unwrap()
+                .unwrap()
+                .id,
+            "tB"
+        );
+        assert!(get(&db, "tC").await.unwrap().unwrap().deleted_at.is_some());
+        assert_eq!(credential_row(&db, "cC").await.state, "revoked");
+        assert_eq!(secret_count(&db, "cC").await, 0);
+        assert_eq!(secret_count(&db, "cB").await, 1);
+    }
+
+    #[tokio::test]
+    async fn a_tombstone_never_displaces_a_live_endpoint_in_a_collision() {
+        let db = db().await;
+        insert_trigger(&db, trigger("tA", "wf-1")).await.unwrap();
+        let mut deleted = trigger("tB", "wf-1");
+        deleted.created_at = NOW + 1;
+        deleted.origin_cluster = "r2".to_string();
+        deleted.deleted_at = Some(NOW + 2);
+        let lost = apply_snapshot_in(&db, snapshot(&deleted, &[], &[]), Vec::new()).await;
+        assert_eq!(lost.unwrap(), ApplyOutcome::CollisionLost);
+        let live = get_by_workflow(&db, "acme", "wf-1").await.unwrap().unwrap();
+        assert_eq!((live.id.as_str(), live.deleted_at), ("tA", None));
+
+        let db = db_with_tombstone().await;
+        let older = trigger("tC", "wf-1");
+        let won = apply_snapshot_in(&db, snapshot(&older, &[], &[]), Vec::new()).await;
+        assert_eq!(
+            won.unwrap(),
+            ApplyOutcome::CollisionWon {
+                loser: "tB".to_string()
+            }
+        );
+        let live = get_by_workflow(&db, "acme", "wf-1").await.unwrap().unwrap();
+        assert_eq!((live.id.as_str(), live.deleted_at), ("tC", None));
+    }
+
+    async fn db_with_tombstone() -> DatabaseConnection {
+        let db = db().await;
+        let mut tombstone = trigger("tB", "wf-1");
+        tombstone.created_at = NOW + 1;
+        tombstone.origin_cluster = "r2".to_string();
+        tombstone.deleted_at = Some(NOW + 2);
+        insert_trigger(&db, tombstone).await.unwrap();
+        db
+    }
+
+    #[tokio::test]
+    async fn tombstone_for_workflow_finds_the_trigger_by_workflow_id() {
+        let db = db().await;
+        insert_trigger(&db, trigger("t1", "wf-1")).await.unwrap();
+        insert_trigger(&db, trigger("t2", "wf-2")).await.unwrap();
+        insert_credential(&db, credential("c1", "t1", CredentialKind::Token))
+            .await
+            .unwrap();
+        ledger::enqueue(&db, hook_request("t1", "run-1"), "{}".to_string())
+            .await
+            .unwrap();
+
+        let found = tombstone_for_workflow(&db, "wf-1", NOW + 9).await.unwrap();
+        assert_eq!(found.as_deref(), Some("t1"));
+        let stored = get(&db, "t1").await.unwrap().unwrap();
+        assert_eq!((stored.deleted_at, stored.version), (Some(NOW + 9), 2));
+        assert_eq!(credential_row(&db, "c1").await.state, "revoked");
+        assert_eq!(ledger::count_queued_for_org(&db, "acme").await.unwrap(), 0);
+        assert!(get(&db, "t2").await.unwrap().unwrap().deleted_at.is_none());
+        assert_eq!(
+            tombstone_for_workflow(&db, "wf-1", NOW + 10).await.unwrap(),
+            None
+        );
+    }
+
+    #[tokio::test]
+    async fn merge_leaves_version_and_updated_at() {
+        let db = db().await;
+        insert_trigger(&db, trigger("t1", "wf-1")).await.unwrap();
+        let deltas = BTreeMap::from([(
+            "bad_signature".to_string(),
+            RejectionDelta {
+                count: 4,
+                last_at: NOW,
+                last_ip: "198.51.100.9".to_string(),
+            },
+        )]);
+        merge_rejections(&db, "t1", &deltas, NOW).await.unwrap();
+        merge_rejections(&db, "t1", &deltas, NOW + 1).await.unwrap();
+        let stored = get(&db, "t1").await.unwrap().unwrap();
+        assert_eq!((stored.version, stored.updated_at), (1, NOW));
+        let entries: BTreeMap<String, RejectionEntry> =
+            serde_json::from_str(&stored.rejections.unwrap()).unwrap();
+        assert_eq!(entries["bad_signature"].count_24h, 8);
+    }
+
+    #[tokio::test]
+    async fn tombstones_and_revoked_credentials_older_than_the_cutoff_are_swept() {
+        let db = db().await;
+        let mut old = trigger("t1", "wf-1");
+        old.deleted_at = Some(NOW - TOMBSTONE_TTL_US - 1);
+        insert_trigger(&db, old).await.unwrap();
+        insert_credential(&db, credential("c1", "t1", CredentialKind::Token))
+            .await
+            .unwrap();
+        insert_trigger(&db, trigger("t2", "wf-2")).await.unwrap();
+        let mut revoked = credential("c2", "t2", CredentialKind::Token);
+        revoked.state = CredentialState::Revoked.as_str().to_string();
+        revoked.revoked_at = Some(NOW - TOMBSTONE_TTL_US - 1);
+        insert_credential(&db, revoked).await.unwrap();
+        insert_credential(&db, credential("c3", "t2", CredentialKind::Token))
+            .await
+            .unwrap();
+
+        let swept = delete_tombstones_before(&db, NOW - TOMBSTONE_TTL_US)
+            .await
+            .unwrap();
+        assert_eq!(swept, 3);
+        assert!(get(&db, "t1").await.unwrap().is_none());
+        let left: Vec<String> = list_credentials(&db, "t2")
+            .await
+            .unwrap()
+            .into_iter()
+            .map(|c| c.id)
+            .collect();
+        assert_eq!(left, ["c3"]);
+    }
+
+    #[tokio::test]
+    async fn originated_and_expiring_lists_are_scoped_to_the_local_cluster() {
+        let db = db().await;
+        insert_trigger(&db, trigger("t1", "wf-1")).await.unwrap();
+        let mut remote = trigger("t2", "wf-2");
+        remote.origin_cluster = "r9".to_string();
+        insert_trigger(&db, remote).await.unwrap();
+        for (id, trigger_id) in [("c1", "t1"), ("c2", "t2")] {
+            let mut retiring = credential(id, trigger_id, CredentialKind::Token);
+            retiring.state = CredentialState::Retiring.as_str().to_string();
+            retiring.expires_at = Some(NOW - 1);
+            insert_credential(&db, retiring).await.unwrap();
+        }
+        let originated = list_originated(&db, "r1", NOW).await.unwrap();
+        assert_eq!(originated.len(), 1);
+        let expiring = list_expired_retiring(&db, "r1", NOW).await.unwrap();
+        assert_eq!(expiring.len(), 1);
+        assert_eq!(expiring[0].id, "c1");
+        let enabled = enabled_workflow_ids(&db, "acme").await.unwrap();
+        assert_eq!(enabled.len(), 2);
+        touch_last_used(&db, "t1", NOW + 3, &["c1".to_string()])
+            .await
+            .unwrap();
+        assert_eq!(credential_row(&db, "c1").await.last_used_at, Some(NOW + 3));
+        assert_eq!(delete_by_org(&db, "acme").await.unwrap(), 4);
+    }
+}
diff --git a/src/infra/src/table/workflows.rs b/src/infra/src/table/workflows.rs
index 562115325c..caeaab8a58 100644
--- a/src/infra/src/table/workflows.rs
+++ b/src/infra/src/table/workflows.rs
@@ -925,6 +925,27 @@ async fn get_draft_org_id_in<C: ConnectionTrait>(
     Ok(res)
 }
 
+#[cfg(any(test, feature = "test-utils"))]
+pub async fn create_tables_for_tests(
+    db: &sea_orm::DatabaseConnection,
+) -> Result<(), sea_orm::DbErr> {
+    use sea_orm::ConnectionTrait;
+
+    let backend = db.get_database_backend();
+    let schema = sea_orm::Schema::new(backend);
+    for mut table in [
+        schema.create_table_from_entity(workflows::Entity),
+        schema.create_table_from_entity(workflow_drafts::Entity),
+        schema.create_table_from_entity(workflow_errors::Entity),
+        schema.create_table_from_entity(workflow_associations::Entity),
+        schema.create_table_from_entity(workflow_run_data::Entity),
+    ] {
+        table.if_not_exists();
+        db.execute(backend.build(&table)).await?;
+    }
+    Ok(())
+}
+
 #[cfg(test)]
 mod tests {
     use sea_orm::{ConnectOptions, Database, DatabaseConnection, Schema};
diff --git a/src/infra/tests/workflow_http_trigger_snapshot.rs b/src/infra/tests/workflow_http_trigger_snapshot.rs
new file mode 100644
index 0000000000..ee1565559e
--- /dev/null
+++ b/src/infra/tests/workflow_http_trigger_snapshot.rs
@@ -0,0 +1,210 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Own test binary: the meta store, its DEK and the master key are process-wide.
+
+use std::sync::LazyLock;
+
+use base64::{Engine, prelude::BASE64_STANDARD};
+use infra::{
+    db::get_orm_client_rw,
+    secrets::{self, SecretMaterial, SecretOwnerKind},
+    table::{
+        cipher,
+        entity::llm_secrets,
+        workflow_http_triggers::{
+            self as triggers, ApplyOutcome, AuthMode, CredentialKind, CredentialState,
+            ReplicatedCredential, ReplicatedTrigger, TriggerSnapshot,
+        },
+    },
+};
+use sea_orm::{ColumnTrait, EntityTrait, PaginatorTrait, QueryFilter};
+use sha2::{Digest, Sha256};
+use tokio::sync::OnceCell;
+
+const PLAINTEXT: &str = "whsec_cGxhaW4tdGV4dC1zaWduaW5nLXNlY3JldA==";
+const TOKEN: &str = "o2wh_cGxhaW4tdGV4dC10b2tlbi12YWx1ZS1mb3ItdGVzdHM";
+
+// One runtime for every test: the global DB pool must not outlive the runtime that opened it.
+static RUNTIME: LazyLock<tokio::runtime::Runtime> = LazyLock::new(|| {
+    tokio::runtime::Builder::new_multi_thread()
+        .worker_threads(2)
+        .enable_all()
+        .build()
+        .unwrap()
+});
+static DATA_DIR: LazyLock<tempfile::TempDir> = LazyLock::new(|| tempfile::tempdir().unwrap());
+static BOOTED: OnceCell<()> = OnceCell::const_new();
+
+async fn boot_with_master_key() {
+    BOOTED
+        .get_or_init(|| async {
+            let data_dir = DATA_DIR.path();
+            let dir = format!("{}/", data_dir.display());
+            // SAFETY: set before any thread reads the config, which is loaded once on first use.
+            unsafe {
+                std::env::set_var("ZO_LOCAL_MODE", "true");
+                std::env::set_var("ZO_META_STORE", "sqlite");
+                std::env::set_var("ZO_DATA_DIR", &dir);
+                std::env::set_var("ZO_DATA_DB_DIR", format!("{dir}db/"));
+            }
+            std::fs::create_dir_all(data_dir.join("db")).unwrap();
+            infra::db::create_table().await.unwrap();
+            infra::db_init().await.unwrap();
+            infra::table::migrate().await.unwrap();
+            cipher::boot(Some(&BASE64_STANDARD.encode([7u8; 64])))
+                .await
+                .unwrap();
+            assert!(cipher::is_encrypting());
+        })
+        .await;
+}
+
+fn snapshot(version: i64, state: CredentialState, secret: Option<&str>) -> TriggerSnapshot {
+    TriggerSnapshot {
+        version,
+        origin_cluster: "r2".to_string(),
+        deleted: false,
+        trigger: ReplicatedTrigger {
+            id: "trig-1".to_string(),
+            org_id: "acme".to_string(),
+            workflow_id: "wf-1".to_string(),
+            enabled: true,
+            auth_mode: AuthMode::Signature,
+            max_body_bytes: 1_048_576,
+            rate_limit_per_minute: 60,
+            created_by: "a@x.io".to_string(),
+            created_at: 1,
+            updated_at: version,
+            deleted_at: None,
+        },
+        credentials: vec![ReplicatedCredential {
+            id: "cred-1".to_string(),
+            kind: CredentialKind::SigningSecret,
+            display_prefix: "whsec_cGxh…PQ==".to_string(),
+            token_sha256: None,
+            state,
+            expires_at: None,
+            revoked_at: (state == CredentialState::Revoked).then_some(version),
+            created_by: "a@x.io".to_string(),
+            created_at: 1,
+            updated_at: version,
+            secret: secret.map(str::to_string),
+        }],
+    }
+}
+
+fn token_snapshot() -> TriggerSnapshot {
+    let mut snap = snapshot(1, CredentialState::Active, Some(TOKEN));
+    snap.trigger.id = "trig-tok".to_string();
+    snap.trigger.workflow_id = "wf-tok".to_string();
+    snap.trigger.auth_mode = AuthMode::Token;
+    let credential = &mut snap.credentials[0];
+    credential.id = "cred-tok".to_string();
+    credential.kind = CredentialKind::Token;
+    credential.display_prefix = "o2wh_cGxh…ZXN0".to_string();
+    credential.token_sha256 = Some(format!("{:x}", Sha256::digest(TOKEN.as_bytes())));
+    snap
+}
+
+async fn secret_row(trigger_id: &str) -> llm_secrets::Model {
+    let db = get_orm_client_rw().await;
+    let stored = triggers::list_credentials(db, trigger_id).await.unwrap();
+    let secret_ref = stored[0].secret_ref.clone().expect("a local secret");
+    llm_secrets::Entity::find()
+        .filter(llm_secrets::Column::SecretRef.eq(&secret_ref))
+        .one(db)
+        .await
+        .unwrap()
+        .expect("the secret row")
+}
+
+#[test]
+fn a_signing_secret_is_encrypted_locally_on_first_sight() {
+    RUNTIME.block_on(async {
+        boot_with_master_key().await;
+        let db = get_orm_client_rw().await;
+
+        let first = snapshot(1, CredentialState::Active, Some(PLAINTEXT));
+        let applied = triggers::apply_snapshot(first.clone()).await.unwrap();
+        assert_eq!(applied, ApplyOutcome::Applied);
+        let row = secret_row("trig-1").await;
+        assert_eq!(
+            (
+                row.owner_kind.as_str(),
+                row.owner_id.as_str(),
+                row.purpose.as_str()
+            ),
+            ("workflow_trigger", "cred-1", "signing")
+        );
+        assert!(!row.ciphertext.contains(PLAINTEXT));
+        assert_eq!(
+            triggers::load_snapshot("trig-1").await.unwrap(),
+            Some(first)
+        );
+
+        let redelivered = snapshot(1, CredentialState::Active, Some(PLAINTEXT));
+        let stale = triggers::apply_snapshot(redelivered).await.unwrap();
+        assert_eq!(stale, ApplyOutcome::Stale);
+
+        let revoked = triggers::apply_snapshot(snapshot(2, CredentialState::Revoked, None))
+            .await
+            .unwrap();
+        assert_eq!(revoked, ApplyOutcome::Applied);
+        let left = llm_secrets::Entity::find()
+            .filter(llm_secrets::Column::OwnerId.eq("cred-1"))
+            .count(db)
+            .await
+            .unwrap();
+        assert_eq!(left, 0, "a revoked credential keeps no local secret");
+        let reloaded = triggers::load_snapshot("trig-1").await.unwrap().unwrap();
+        assert_eq!(reloaded.credentials[0].secret, None);
+    });
+}
+
+#[test]
+fn a_token_is_encrypted_locally_on_first_sight_with_purpose_auth() {
+    RUNTIME.block_on(async {
+        boot_with_master_key().await;
+        let first = token_snapshot();
+        let applied = triggers::apply_snapshot(first.clone()).await.unwrap();
+        assert_eq!(applied, ApplyOutcome::Applied);
+        let row = secret_row("trig-tok").await;
+        assert_eq!(
+            (
+                row.owner_kind.as_str(),
+                row.owner_id.as_str(),
+                row.purpose.as_str()
+            ),
+            ("workflow_trigger", "cred-tok", "auth")
+        );
+        assert!(!row.ciphertext.contains(TOKEN));
+        let (_, material) = secrets::resolve_record(
+            "acme",
+            &row.secret_ref,
+            SecretOwnerKind::WorkflowTrigger,
+            "cred-tok",
+            secrets::CURRENT,
+        )
+        .await
+        .unwrap();
+        assert!(matches!(material, SecretMaterial::Token { value } if value == TOKEN));
+        assert_eq!(
+            triggers::load_snapshot("trig-tok").await.unwrap(),
+            Some(first),
+            "the receiver re-emits the plaintext it stored"
+        );
+    });
+}
diff --git a/src/jobs/src/job/incidents.rs b/src/jobs/src/job/incidents.rs
index 6939cc01bf..04275d09bc 100644
--- a/src/jobs/src/job/incidents.rs
+++ b/src/jobs/src/job/incidents.rs
@@ -64,9 +64,14 @@ pub async fn run() -> Result<(), anyhow::Error> {
             "incidents_auto_resolve",
             config.incidents.cleanup_interval_secs,
             {
-                log::debug!("[INCIDENTS::JOB] Running incident auto-resolve");
-                if let Err(e) = auto_resolve_stale_incidents().await {
-                    log::error!("[INCIDENTS::JOB] Auto-resolve failed: {e}");
+                // license read per tick so a change applies; `continue` here would skip sleep_after
+                if o2_enterprise::enterprise::license::check_features(&[
+                    config::meta::feature::Feature::Incidents,
+                ]) {
+                    log::debug!("[INCIDENTS::JOB] Running incident auto-resolve");
+                    if let Err(e) = auto_resolve_stale_incidents().await {
+                        log::error!("[INCIDENTS::JOB] Auto-resolve failed: {e}");
+                    }
                 }
             },
             sleep_after
diff --git a/src/jobs/src/job/mod.rs b/src/jobs/src/job/mod.rs
index beeb3557f9..ab42627da2 100644
--- a/src/jobs/src/job/mod.rs
+++ b/src/jobs/src/job/mod.rs
@@ -691,6 +691,10 @@ pub async fn init() -> Result<(), anyhow::Error> {
     #[cfg(feature = "enterprise")]
     slack_hooks::register();
 
+    // Routers serve the hook routes, so the hook node tasks start before the router return.
+    #[cfg(feature = "enterprise")]
+    openobserve_core::workflows::http_trigger::spawn_node_tasks();
+
     // Router doesn't need to initialize job
     if LOCAL_NODE.is_router() && LOCAL_NODE.is_single_role() {
         return Ok(());
@@ -869,11 +873,15 @@ pub async fn init() -> Result<(), anyhow::Error> {
     o2_enterprise::enterprise::common::remote_defaults::spawn_refresher();
 
     if config::get_config().common.model_pricing_enabled {
+        // Warm from committed seed rows even offline or when coordinator notification fails.
+        if let Err(e) = openobserve_builtins::model_pricing::load_seed().await {
+            log::error!("[model_pricing] loading seed prices failed: {e}");
+        }
         db::model_pricing::cache()
             .await
             .expect("model pricing cache failed");
 
-        // Sync built-in model pricing from GitHub (initial + periodic)
+        // Only queriers perform the initial and periodic GitHub sync.
         if LOCAL_NODE.is_querier() {
             tokio::task::spawn(async {
                 if let Err(e) =
diff --git a/src/jobs/src/job/oncall_maintenance.rs b/src/jobs/src/job/oncall_maintenance.rs
index 1ff5466f5a..81e3019c36 100644
--- a/src/jobs/src/job/oncall_maintenance.rs
+++ b/src/jobs/src/job/oncall_maintenance.rs
@@ -54,7 +54,10 @@ pub fn run() {
         log::debug!("[ONCALL_MAINTENANCE] not a scheduler node, skipping");
         return;
     }
-    if !o2_enterprise::enterprise::oncall::is_enabled() {
+    if !o2_enterprise::enterprise::common::config::get_config()
+        .oncall
+        .enabled
+    {
         log::debug!("[ONCALL_MAINTENANCE] on-call is disabled, skipping");
         return;
     }
@@ -62,6 +65,10 @@ pub fn run() {
     log::info!("[ONCALL_MAINTENANCE] initialized with interval: {INTERVAL_SECS}s");
 
     spawn_pausable_job!("oncall_maintenance", INTERVAL_SECS, {
+        // spawned on the operator flag alone, so a license granted or revoked later applies here
+        if !o2_enterprise::enterprise::oncall::is_enabled() {
+            continue;
+        }
         if !is_leader().await {
             log::debug!("[ONCALL_MAINTENANCE] not leader, skipping this pass");
             continue;
@@ -76,6 +83,9 @@ pub fn run() {
 
     // Separate jobs, not counters in one loop: a failed pass must not stop the others running.
     spawn_pausable_job!("oncall_retention", RETENTION_INTERVAL_SECS, {
+        if !o2_enterprise::enterprise::oncall::is_enabled() {
+            continue;
+        }
         if !is_leader().await {
             log::debug!("[ONCALL_RETENTION] not leader, skipping this pass");
             continue;
@@ -89,6 +99,9 @@ pub fn run() {
     log::info!("[ONCALL_COVERAGE] initialized with interval: {COVERAGE_INTERVAL_SECS}s");
 
     spawn_pausable_job!("oncall_coverage", COVERAGE_INTERVAL_SECS, {
+        if !o2_enterprise::enterprise::oncall::is_enabled() {
+            continue;
+        }
         if !is_leader().await {
             log::debug!("[ONCALL_COVERAGE] not leader, skipping this pass");
             continue;
diff --git a/src/jobs/tests/slack_hooks.rs b/src/jobs/tests/slack_hooks.rs
index 8900b7d8c2..4671e97929 100644
--- a/src/jobs/tests/slack_hooks.rs
+++ b/src/jobs/tests/slack_hooks.rs
@@ -282,6 +282,8 @@ fn audit_publishes_a_slack_record_to_the_meta_audit_stream() {
                 trace_id: None,
             },
             delegated: None,
+            fleet_id: None,
+            target: None,
         })
         .await;
         let published = std::mem::take(&mut *PUBLISHED.lock().unwrap());
diff --git a/src/main.rs b/src/main.rs
index 5394f85892..0c8b3abe8e 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -460,6 +460,10 @@ async fn run() -> Result<(), anyhow::Error> {
 /// Initializes enterprise features.
 #[cfg(feature = "enterprise")]
 async fn init_enterprise() -> Result<(), anyhow::Error> {
+    let node = &config::cluster::LOCAL_NODE;
+    // before routes and jobs start, so their first license check sees the loaded license
+    o2_enterprise::enterprise::license::load_license(node.is_router() || node.is_single_role())
+        .await;
     o2_enterprise::enterprise::search::init().await?;
 
     if o2_enterprise::enterprise::common::config::get_config()
diff --git a/src/search_service/src/streaming/mod.rs b/src/search_service/src/streaming/mod.rs
index 95c45564c6..85545fb26b 100644
--- a/src/search_service/src/streaming/mod.rs
+++ b/src/search_service/src/streaming/mod.rs
@@ -307,6 +307,8 @@ pub async fn process_search_stream_request(
                                 trace_id: Some(trace_id.to_string()),
                             },
                             delegated: None,
+                            fleet_id: None,
+                            target: None,
                         })
                         .await;
                     }
@@ -413,6 +415,8 @@ pub async fn process_search_stream_request(
                                 trace_id: Some(trace_id.to_string()),
                             },
                             delegated: None,
+                            fleet_id: None,
+                            target: None,
                         })
                         .await;
                     }
@@ -494,6 +498,8 @@ pub async fn process_search_stream_request(
                                 trace_id: Some(trace_id.to_string()),
                             },
                             delegated: None,
+                            fleet_id: None,
+                            target: None,
                         })
                         .await;
                     }
@@ -566,6 +572,8 @@ pub async fn process_search_stream_request(
                                 trace_id: Some(trace_id.to_string()),
                             },
                             delegated: None,
+                            fleet_id: None,
+                            target: None,
                         })
                         .await;
                     }
@@ -630,6 +638,8 @@ pub async fn process_search_stream_request(
                             trace_id: Some(trace_id.to_string()),
                         },
                         delegated: None,
+                        fleet_id: None,
+                        target: None,
                     })
                     .await;
                 }
@@ -705,6 +715,8 @@ pub async fn process_search_stream_request(
                     trace_id: Some(trace_id.to_string()),
                 },
                 delegated: None,
+                fleet_id: None,
+                target: None,
             })
             .await;
         }
@@ -1130,6 +1142,8 @@ pub async fn process_search_stream_request_multi(
                 trace_id: Some(trace_id.to_string()),
             },
             delegated: None,
+            fleet_id: None,
+            target: None,
         })
         .await;
     }
diff --git a/src/super_cluster_queue/src/downtimes.rs b/src/super_cluster_queue/src/downtimes.rs
index 46d19ff953..627e8b9473 100644
--- a/src/super_cluster_queue/src/downtimes.rs
+++ b/src/super_cluster_queue/src/downtimes.rs
@@ -15,6 +15,11 @@
 
 //! Applies downtime rows replicated from another region, so each region decides locally.
 
+use std::{
+    collections::{HashMap, HashSet},
+    sync::{LazyLock, Mutex, MutexGuard, PoisonError},
+};
+
 use config::{
     meta::{
         downtimes::Downtime,
@@ -37,6 +42,15 @@ use sea_orm::{ConnectionTrait, TransactionTrait};
 /// Compare-and-swap rounds before a replicated write gives up on a row that keeps changing.
 const WRITE_ATTEMPTS: usize = 8;
 
+/// The queue has no delivery limit, and a folder made while replication was off never arrives.
+const FOLDER_WAIT_MICROS: i64 = 10 * 60 * 1_000_000;
+
+/// `org/id` -> when this node first saw the row wait for its folder, so a backlog still waits.
+static FOLDER_WAITS: LazyLock<Mutex<HashMap<String, i64>>> = LazyLock::new(Default::default);
+
+/// `org/id` of rows this node filed under `default` after the wait, so their later edits skip it.
+static FILED_UNDER_DEFAULT: LazyLock<Mutex<HashSet<String>>> = LazyLock::new(Default::default);
+
 /// The re-measure plan of a put, injected so a test plans against its own database.
 type PlanFuture<'a> = std::pin::Pin<
     Box<dyn Future<Output = std::result::Result<RemeasurePlan, anyhow::Error>> + Send + 'a>,
@@ -79,6 +93,20 @@ struct WrittenPut {
     plan: RemeasurePlan,
 }
 
+/// Whether the stored live row and the incoming row are cancelled.
+#[derive(Clone, Copy, Debug, Default)]
+struct Cancels {
+    stored: bool,
+    incoming: bool,
+}
+
+#[derive(Debug, PartialEq)]
+enum FolderAction {
+    Use,
+    UseDefault,
+    Missing,
+}
+
 pub(crate) async fn process(msg: Message) -> Result<()> {
     let msg: DowntimeMessage = msg
         .try_into()
@@ -91,9 +119,13 @@ async fn apply(msg: DowntimeMessage, enabled: bool) -> Result<()> {
     match msg {
         DowntimeMessage::Put { org, mut downtime } => {
             downtime.org = org;
-            downtime.folder_id = local_folder_id(&downtime).await?;
+            let wait_key = format!("{}/{}", downtime.org, downtime.id);
+            downtime.folder_id = local_folder_id(&downtime, &wait_key).await?;
             let client = infra::db::get_orm_client_rw().await;
-            let Some(written) = apply_put(client, &downtime, &planner(enabled)).await? else {
+            let written = apply_put(client, &downtime, &planner(enabled)).await?;
+            // Written or stale: either way a later put of this row starts a fresh wait.
+            locked(&FOLDER_WAITS).remove(&wait_key);
+            let Some(written) = written else {
                 return Ok(());
             };
             if !enabled {
@@ -218,7 +250,7 @@ async fn apply_put<'a, C: ConnectionTrait + TransactionTrait>(
     planner: &(dyn Fn(Option<Downtime>, Downtime) -> PlanFuture<'a> + Sync),
 ) -> Result<Option<WrittenPut>> {
     for _ in 0..WRITE_ATTEMPTS {
-        let Some(planned) = plan_put(conn, downtime).await? else {
+        let Some(planned) = plan_put(conn, downtime, true).await? else {
             return Ok(None);
         };
         let plan = remeasure_plan(&planned, planner).await?;
@@ -233,17 +265,28 @@ async fn apply_put<'a, C: ConnectionTrait + TransactionTrait>(
 }
 
 /// Orders the put against the stored row; `None` if the stored row wins.
-async fn plan_put<C: ConnectionTrait>(conn: &C, downtime: &Downtime) -> Result<Option<PlannedPut>> {
+async fn plan_put<C: ConnectionTrait>(
+    conn: &C,
+    downtime: &Downtime,
+    log: bool,
+) -> Result<Option<PlannedPut>> {
     let stored = table::downtimes::version_with(conn, &downtime.org, &downtime.id).await?;
+    // The live row only; a tombstone's cancel state never decides (rule 2 of put_order).
+    let before = table::downtimes::get_with(conn, &downtime.org, &downtime.id).await?;
+    let cancels = Cancels {
+        stored: before.as_ref().is_some_and(|b| b.cancelled_at.is_some()),
+        incoming: downtime.cancelled_at.is_some(),
+    };
     // The queue neither orders nor deduplicates, so an older Put must not undo a newer edit.
     let order = stored.map_or(PutOrder::Apply, |stored| {
-        put_order(stored, downtime.version, downtime.updated_at)
+        put_order(stored, cancels, downtime.version, downtime.updated_at)
     });
-    log_order(order, downtime, stored);
+    if log {
+        log_order(order, downtime, stored);
+    }
     if !order.applies() {
         return Ok(None);
     }
-    let before = table::downtimes::get_with(conn, &downtime.org, &downtime.id).await?;
     let mut downtime = downtime.clone();
     if let Some(before) = &before {
         downtime.origin_region = before.origin_region.clone();
@@ -300,11 +343,18 @@ fn log_order(order: PutOrder, downtime: &Downtime, stored: Option<RowVersion>) {
     }
 }
 
-/// Version first, since region clocks differ; equal versions from two regions fall to `updated_at`.
-fn put_order(stored: RowVersion, version: i64, updated_at: i64) -> PutOrder {
+/// Version first, since region clocks differ; on a tie a sent cancel is never undone by an edit.
+fn put_order(stored: RowVersion, cancels: Cancels, version: i64, updated_at: i64) -> PutOrder {
     match version.cmp(&stored.version) {
         std::cmp::Ordering::Less => PutOrder::Stale,
         std::cmp::Ordering::Greater => PutOrder::Apply,
+        std::cmp::Ordering::Equal if !stored.deleted && cancels.stored != cancels.incoming => {
+            if cancels.incoming {
+                PutOrder::Apply
+            } else {
+                PutOrder::Stale
+            }
+        }
         std::cmp::Ordering::Equal => {
             // A tombstone wins a tie, so only a strictly later row restores it.
             let apply = if stored.deleted {
@@ -353,22 +403,74 @@ async fn remeasure_plan<'a>(
     })
 }
 
-/// A row that arrives before its folder is filed in the default folder until its next edit.
-async fn local_folder_id(downtime: &Downtime) -> Result<String> {
-    if table::folders::get_pk_by_name(&downtime.org, &downtime.folder_id, FolderType::Downtimes)
-        .await?
-        .is_some()
+/// The local folder of a replicated row, waiting for a folder that has not replicated yet.
+async fn local_folder_id(downtime: &Downtime, wait_key: &str) -> Result<String> {
+    let known =
+        table::folders::get_pk_by_name(&downtime.org, &downtime.folder_id, FolderType::Downtimes)
+            .await?
+            .is_some();
+    if known {
+        locked(&FILED_UNDER_DEFAULT).remove(wait_key);
+    }
+    let (filed_under_default, waited) = if known || downtime.folder_id == DEFAULT_FOLDER {
+        (false, 0)
+    } else {
+        let client = infra::db::get_orm_client_rw().await;
+        // Quiet: `apply_put` plans again and logs the order once.
+        let Some(planned) = plan_put(client, downtime, false).await? else {
+            // `apply_put` drops a stale put before any write, so its folder does not matter.
+            return Ok(downtime.folder_id.clone());
+        };
+        // A row the origin keeps in `default` may be moving into a new folder, so only ours skip.
+        let filed_under_default = planned
+            .before
+            .is_some_and(|before| before.folder_id == DEFAULT_FOLDER)
+            && locked(&FILED_UNDER_DEFAULT).contains(wait_key);
+        let now = now_micros();
+        let first_seen = *locked(&FOLDER_WAITS)
+            .entry(wait_key.to_owned())
+            .or_insert(now);
+        (filed_under_default, now.saturating_sub(first_seen))
+    };
+    match folder_action(&downtime.folder_id, known, filed_under_default, waited) {
+        FolderAction::Use => Ok(downtime.folder_id.clone()),
+        FolderAction::Missing => Err(Error::Message(format!(
+            "[DOWNTIMES] folder {} of downtime {}/{} is not in this region yet",
+            downtime.folder_id, downtime.org, downtime.id
+        ))),
+        FolderAction::UseDefault => {
+            if downtime.folder_id != DEFAULT_FOLDER {
+                log::warn!(
+                    "[DOWNTIMES] folder {} of downtime {}/{} is not in this region; filing it under {DEFAULT_FOLDER}",
+                    downtime.folder_id,
+                    downtime.org,
+                    downtime.id
+                );
+                locked(&FILED_UNDER_DEFAULT).insert(wait_key.to_owned());
+            }
+            table::folders::get_or_create(&downtime.org, default_folder(), FolderType::Downtimes)
+                .await?;
+            Ok(DEFAULT_FOLDER.to_owned())
+        }
+    }
+}
+
+fn folder_action(
+    folder_id: &str,
+    known: bool,
+    filed_under_default: bool,
+    waited_micros: i64,
+) -> FolderAction {
+    if known {
+        FolderAction::Use
+    } else if folder_id == DEFAULT_FOLDER
+        || filed_under_default
+        || waited_micros >= FOLDER_WAIT_MICROS
     {
-        return Ok(downtime.folder_id.clone());
+        FolderAction::UseDefault
+    } else {
+        FolderAction::Missing
     }
-    log::warn!(
-        "[DOWNTIMES] folder {} of downtime {}/{} is not in this region yet, filing it in the default folder",
-        downtime.folder_id,
-        downtime.org,
-        downtime.id
-    );
-    table::folders::get_or_create(&downtime.org, default_folder(), FolderType::Downtimes).await?;
-    Ok(DEFAULT_FOLDER.to_owned())
 }
 
 async fn default_folder_pk<C: ConnectionTrait>(conn: &C, org: &str, id: &str) -> Result<String> {
@@ -391,6 +493,11 @@ fn default_folder() -> Folder {
     }
 }
 
+/// The maps hold only timestamps and ids, so a panic elsewhere leaves them usable.
+fn locked<T>(mutex: &Mutex<T>) -> MutexGuard<'_, T> {
+    mutex.lock().unwrap_or_else(PoisonError::into_inner)
+}
+
 #[cfg(test)]
 mod tests {
     use std::collections::HashMap;
@@ -636,6 +743,95 @@ mod tests {
         assert_eq!(stored.updated_at, 110);
     }
 
+    #[test]
+    fn a_row_waits_for_its_folder_and_then_falls_back_to_the_default_folder() {
+        assert_eq!(folder_action("ops", true, false, 0), FolderAction::Use);
+        assert_eq!(folder_action("ops", false, false, 0), FolderAction::Missing);
+        assert_eq!(
+            folder_action("ops", false, false, FOLDER_WAIT_MICROS - 1),
+            FolderAction::Missing
+        );
+        assert_eq!(
+            folder_action("ops", false, false, FOLDER_WAIT_MICROS),
+            FolderAction::UseDefault
+        );
+        assert_eq!(
+            folder_action(DEFAULT_FOLDER, false, false, 0),
+            FolderAction::UseDefault
+        );
+        assert_eq!(
+            folder_action(DEFAULT_FOLDER, true, false, 0),
+            FolderAction::Use
+        );
+    }
+
+    #[test]
+    fn a_later_edit_of_a_row_filed_under_default_does_not_wait_again() {
+        assert_eq!(
+            folder_action("ops", false, true, 0),
+            FolderAction::UseDefault
+        );
+    }
+
+    #[test]
+    fn a_cancel_wins_a_version_tie_over_a_live_edit() {
+        let live = |version, updated_at| RowVersion {
+            version,
+            updated_at,
+            deleted: false,
+        };
+        let stored_cancelled = Cancels {
+            stored: true,
+            incoming: false,
+        };
+        let incoming_cancel = Cancels {
+            stored: false,
+            incoming: true,
+        };
+        let both = Cancels {
+            stored: true,
+            incoming: true,
+        };
+        // A later edit at the cancel's version does not undo the cancel ...
+        assert_eq!(
+            put_order(live(2, 100), stored_cancelled, 2, 900),
+            PutOrder::Stale
+        );
+        // ... and an earlier cancel at the edit's version still lands.
+        assert_eq!(
+            put_order(live(2, 900), incoming_cancel, 2, 100),
+            PutOrder::Apply
+        );
+        // Both arrival orders end cancelled: region A holds the cancel, region B the edit.
+        let region_a = put_order(live(2, 100), stored_cancelled, 2, 900).applies();
+        let region_b = put_order(live(2, 900), incoming_cancel, 2, 100).applies();
+        assert!(!region_a && region_b);
+        // The same cancel twice is idempotent.
+        assert_eq!(put_order(live(2, 100), both, 2, 100), PutOrder::Apply);
+        // Version still rules first: a later edit at a higher version applies.
+        assert_eq!(
+            put_order(live(2, 100), stored_cancelled, 3, 50),
+            PutOrder::Apply
+        );
+        assert_eq!(
+            put_order(live(3, 100), incoming_cancel, 2, 900),
+            PutOrder::Stale
+        );
+        // A tombstone keeps its own rule; a cancel does not change it.
+        let tombstone = RowVersion {
+            deleted: true,
+            ..live(2, 100)
+        };
+        assert_eq!(
+            put_order(tombstone, incoming_cancel, 2, 100),
+            PutOrder::Stale
+        );
+        assert_eq!(
+            put_order(tombstone, incoming_cancel, 2, 101),
+            PutOrder::Conflict { apply: true }
+        );
+    }
+
     #[test]
     fn put_order_reads_the_version_then_the_clock() {
         let live = |version, updated_at| RowVersion {
@@ -643,22 +839,34 @@ mod tests {
             updated_at,
             deleted: false,
         };
-        assert_eq!(put_order(live(2, 100), 1, 900), PutOrder::Stale);
-        assert_eq!(put_order(live(2, 100), 3, 1), PutOrder::Apply);
-        assert_eq!(put_order(live(2, 100), 2, 100), PutOrder::Apply);
         assert_eq!(
-            put_order(live(2, 100), 2, 101),
+            put_order(live(2, 100), Cancels::default(), 1, 900),
+            PutOrder::Stale
+        );
+        assert_eq!(
+            put_order(live(2, 100), Cancels::default(), 3, 1),
+            PutOrder::Apply
+        );
+        assert_eq!(
+            put_order(live(2, 100), Cancels::default(), 2, 100),
+            PutOrder::Apply
+        );
+        assert_eq!(
+            put_order(live(2, 100), Cancels::default(), 2, 101),
             PutOrder::Conflict { apply: true }
         );
         assert_eq!(
-            put_order(live(2, 100), 2, 99),
+            put_order(live(2, 100), Cancels::default(), 2, 99),
             PutOrder::Conflict { apply: false }
         );
         let tombstone = RowVersion {
             deleted: true,
             ..live(2, 100)
         };
-        assert_eq!(put_order(tombstone, 2, 100), PutOrder::Stale);
+        assert_eq!(
+            put_order(tombstone, Cancels::default(), 2, 100),
+            PutOrder::Stale
+        );
     }
 
     #[tokio::test]
@@ -741,7 +949,7 @@ mod tests {
         let db = db().await;
         put(&db, &versioned(1, 10)).await.unwrap();
         let incoming = versioned(2, 20);
-        let planned = plan_put(&db, &incoming).await.unwrap().unwrap();
+        let planned = plan_put(&db, &incoming, true).await.unwrap().unwrap();
 
         table::downtimes::delete_with(&db, "acme", "d1")
             .await
@@ -764,7 +972,7 @@ mod tests {
         let db = db().await;
         put(&db, &versioned(1, 10)).await.unwrap();
         let incoming = versioned(2, 20);
-        let planned = plan_put(&db, &incoming).await.unwrap().unwrap();
+        let planned = plan_put(&db, &incoming, true).await.unwrap().unwrap();
 
         let mut local = versioned(3, 30);
         local.name = "local edit".to_string();
@@ -789,7 +997,7 @@ mod tests {
     async fn a_put_planned_against_a_missing_row_loses_to_a_delete_that_lands_first() {
         let db = db().await;
         let incoming = versioned(1, 10);
-        let planned = plan_put(&db, &incoming).await.unwrap().unwrap();
+        let planned = plan_put(&db, &incoming, true).await.unwrap().unwrap();
 
         assert!(apply_delete(&db, "acme", "d1", 2, 20).await.unwrap());
         assert!(
@@ -817,7 +1025,8 @@ mod tests {
         assert!(delete_applies(row(2, 100, true), 2, 101));
         for (stored_at, incoming_at) in [(100, 99), (100, 100), (100, 101)] {
             let live_after_delete = !delete_applies(row(2, stored_at, false), 2, incoming_at);
-            let live_after_put = put_order(row(2, incoming_at, true), 2, stored_at).applies();
+            let live_after_put =
+                put_order(row(2, incoming_at, true), Cancels::default(), 2, stored_at).applies();
             assert_eq!(live_after_delete, live_after_put);
         }
     }
diff --git a/src/super_cluster_queue/src/eval_datasets.rs b/src/super_cluster_queue/src/eval_datasets.rs
index b08f7e0db9..a9eeb7fb71 100644
--- a/src/super_cluster_queue/src/eval_datasets.rs
+++ b/src/super_cluster_queue/src/eval_datasets.rs
@@ -11,13 +11,16 @@ use infra::{
     table::entity::{llm_dataset_items as dataset_items, llm_datasets as datasets},
 };
 use o2_enterprise::enterprise::super_cluster::queue::{EvalDatasetMessage, Message, MessageType};
-use sea_orm::{ActiveModelTrait, ColumnTrait, EntityTrait, QueryFilter, Set, TransactionTrait};
+use sea_orm::{
+    ActiveModelTrait, ColumnTrait, ConnectionTrait, EntityTrait, QueryFilter, Set,
+    TransactionTrait, sea_query::Expr,
+};
 
 pub(crate) async fn process(msg: Message) -> Result<()> {
     match msg.message_type {
         MessageType::EvalDatasetPut => {
             let EvalDatasetMessage::Put { dataset, items } = msg.try_into()?;
-            apply_put(dataset, items).await?;
+            apply_put(get_orm_client_rw().await, dataset, items).await?;
         }
         MessageType::EvalDatasetDelete => {
             let (org_id, dataset_id) =
@@ -36,7 +39,11 @@ pub(crate) async fn process(msg: Message) -> Result<()> {
     Ok(())
 }
 
-async fn apply_put(dataset: datasets::Model, items: Vec<dataset_items::Model>) -> Result<()> {
+async fn apply_put<C: ConnectionTrait + TransactionTrait>(
+    db: &C,
+    dataset: datasets::Model,
+    items: Vec<dataset_items::Model>,
+) -> Result<()> {
     // Item messages carry the parent only as a version watermark. Dataset
     // metadata is authoritative only in a metadata-only snapshot, preventing
     // an item written from stale regional state from reverting a rename.
@@ -50,7 +57,6 @@ async fn apply_put(dataset: datasets::Model, items: Vec<dataset_items::Model>) -
         ));
     }
 
-    let db = get_orm_client_rw().await;
     let txn = db.begin().await?;
     match datasets::Entity::find_by_id(&dataset.id).one(&txn).await? {
         Some(current) if current.org_id != dataset.org_id => {
@@ -81,11 +87,25 @@ async fn apply_put(dataset: datasets::Model, items: Vec<dataset_items::Model>) -
             .one(&txn)
             .await?
         {
-            if current != item {
+            // This region may hold the row without its display label (an older node's echo,
+            // or a row from before the column). Fill in that one column so MAX(write_version)
+            // and the snapshot pins agree with the origin region; a stored label stays.
+            let missing_label = item
+                .write_version
+                .filter(|_| current.write_version.is_none());
+            if !compatible_item_rows(current, &item) {
                 return Err(Error::Message(
                     "Dataset Item row ID contains conflicting data".to_string(),
                 ));
             }
+            if let Some(label) = missing_label {
+                dataset_items::Entity::update_many()
+                    .col_expr(dataset_items::Column::WriteVersion, Expr::value(label))
+                    .filter(dataset_items::Column::RowId.eq(&item.row_id))
+                    .filter(dataset_items::Column::WriteVersion.is_null())
+                    .exec(&txn)
+                    .await?;
+            }
             continue;
         }
         if dataset_items::Entity::find()
@@ -107,6 +127,18 @@ async fn apply_put(dataset: datasets::Model, items: Vec<dataset_items::Model>) -
     Ok(())
 }
 
+/// Older nodes omit the display label when echoing an otherwise identical immutable row, so a
+/// missing label on either side is not a conflict; two different labels still are.
+fn compatible_item_rows(
+    mut current: dataset_items::Model,
+    incoming: &dataset_items::Model,
+) -> bool {
+    if current.write_version.is_none() || incoming.write_version.is_none() {
+        current.write_version = incoming.write_version;
+    }
+    current == *incoming
+}
+
 async fn apply_delete(org_id: &str, dataset_id: &str) -> Result<()> {
     let db = get_orm_client_rw().await;
     let txn = db.begin().await?;
@@ -123,3 +155,115 @@ async fn apply_delete(org_id: &str, dataset_id: &str) -> Result<()> {
     txn.commit().await?;
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use sea_orm::{ConnectOptions, Database, DatabaseConnection, Schema};
+
+    use super::*;
+
+    fn row(write_version: Option<i64>) -> dataset_items::Model {
+        serde_json::from_value(serde_json::json!({
+            "row_id": "row-1",
+            "logical_id": "item-1",
+            "org_id": "org-1",
+            "dataset_id": "dataset-1",
+            "input": "question",
+            "expected_output": "answer",
+            "global_version": 59,
+            "write_version": write_version,
+            "is_deleted": false,
+            "source": "telemetry",
+            "updated_by": "owner@example.com",
+            "updated_at": 100
+        }))
+        .unwrap()
+    }
+
+    #[test]
+    fn an_older_node_can_echo_a_row_without_its_display_label() {
+        assert!(compatible_item_rows(row(Some(57)), &row(None)));
+        assert!(compatible_item_rows(row(None), &row(Some(57))));
+        assert!(compatible_item_rows(row(Some(57)), &row(Some(57))));
+        assert!(!compatible_item_rows(row(Some(57)), &row(Some(58))));
+    }
+
+    #[test]
+    fn missing_display_labels_do_not_hide_immutable_content_conflicts() {
+        let mut changed = row(None);
+        changed.input = serde_json::json!("different question");
+        assert!(!compatible_item_rows(row(Some(57)), &changed));
+        let mut changed = row(None);
+        changed.global_version = 60;
+        assert!(!compatible_item_rows(row(Some(57)), &changed));
+    }
+
+    // One connection: separate connections to `sqlite::memory:` get separate databases.
+    async fn db() -> DatabaseConnection {
+        let mut opts = ConnectOptions::new("sqlite::memory:".to_string());
+        opts.max_connections(1);
+        let db = Database::connect(opts).await.unwrap();
+        let backend = db.get_database_backend();
+        let schema = Schema::new(backend);
+        for stmt in [
+            schema.create_table_from_entity(datasets::Entity),
+            schema.create_table_from_entity(dataset_items::Entity),
+        ] {
+            db.execute(backend.build(&stmt)).await.unwrap();
+        }
+        db
+    }
+
+    fn dataset() -> datasets::Model {
+        datasets::Model {
+            id: "dataset-1".to_string(),
+            org_id: "org-1".to_string(),
+            name: "Golden set".to_string(),
+            description: None,
+            tags: None,
+            global_version: 59,
+            created_by: "owner@example.com".to_string(),
+            created_at: 1,
+            updated_by: "owner@example.com".to_string(),
+            updated_at: 1,
+        }
+    }
+
+    async fn stored(db: &DatabaseConnection) -> dataset_items::Model {
+        dataset_items::Entity::find_by_id("row-1")
+            .one(db)
+            .await
+            .unwrap()
+            .unwrap()
+    }
+
+    #[tokio::test]
+    async fn a_replayed_label_reaches_a_row_stored_without_one() {
+        let db = db().await;
+        apply_put(&db, dataset(), vec![row(None)]).await.unwrap();
+        apply_put(&db, dataset(), vec![row(Some(57))])
+            .await
+            .unwrap();
+        assert_eq!(stored(&db).await, row(Some(57)));
+    }
+
+    #[tokio::test]
+    async fn an_unlabelled_echo_never_erases_a_stored_label() {
+        let db = db().await;
+        apply_put(&db, dataset(), vec![row(Some(57))])
+            .await
+            .unwrap();
+        apply_put(&db, dataset(), vec![row(None)]).await.unwrap();
+        assert_eq!(stored(&db).await.write_version, Some(57));
+    }
+
+    #[tokio::test]
+    async fn a_label_is_not_filled_in_beside_conflicting_content() {
+        let db = db().await;
+        apply_put(&db, dataset(), vec![row(None)]).await.unwrap();
+        let mut changed = row(Some(57));
+        changed.input = serde_json::json!("different question");
+        assert!(apply_put(&db, dataset(), vec![changed]).await.is_err());
+        assert_eq!(stored(&db).await, row(None));
+    }
+}
diff --git a/src/super_cluster_queue/src/search_job/mod.rs b/src/super_cluster_queue/src/search_job/mod.rs
index af5881e1f0..bd48799ed6 100644
--- a/src/super_cluster_queue/src/search_job/mod.rs
+++ b/src/super_cluster_queue/src/search_job/mod.rs
@@ -16,6 +16,7 @@
 pub mod search_job_partitions;
 pub mod search_job_results;
 pub mod search_jobs;
+mod workflow_http_triggers;
 
 use config::utils::json;
 use db::{
@@ -175,12 +176,23 @@ pub(crate) async fn process(msg: Message) -> Result<()> {
                     log::error!("error while deleting workflow from db {id} : {e}");
                 }
             }
-            log::info!("successfully handled workflow delete for {id}");
+            let tombstoned = infra::table::workflow_http_triggers::tombstone_for_workflow(
+                infra::db::get_orm_client_rw().await,
+                &id,
+                config::utils::time::now_micros(),
+            )
+            .await;
             // trigger watch event by putting value to cluster coordinator
             let cluster_coordinator = get_coordinator().await;
             cluster_coordinator
                 .delete(&format!("{WORKFLOWS_PREFIX}{id}",), false, true, None)
                 .await?;
+            if let Some(trigger_id) = tombstoned?
+                && let Err(e) = db::workflow_http_triggers::notify_local(&trigger_id).await
+            {
+                log::error!("error while evicting workflow http trigger {trigger_id} : {e}");
+            }
+            log::info!("successfully handled workflow delete for {id}");
         }
         MessageType::WorkflowDraftPut => {
             let draft: Workflow = json::from_slice(&msg.value.unwrap())?;
@@ -344,6 +356,7 @@ pub(crate) async fn process(msg: Message) -> Result<()> {
                 }
             }
         }
+        MessageType::WorkflowHttpTriggerPut => workflow_http_triggers::process(msg).await?,
 
         _ => {
             log::error!(
diff --git a/src/super_cluster_queue/src/search_job/workflow_http_triggers.rs b/src/super_cluster_queue/src/search_job/workflow_http_triggers.rs
new file mode 100644
index 0000000000..c3ecb0cfa6
--- /dev/null
+++ b/src/super_cluster_queue/src/search_job/workflow_http_triggers.rs
@@ -0,0 +1,259 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+//! Receive arm of message type 96: one HTTP trigger and its credentials as a versioned snapshot.
+
+use infra::{
+    errors::{Error, Result},
+    table::workflow_http_triggers::{self as table, ApplyOutcome, TriggerSnapshot},
+};
+use o2_enterprise::enterprise::super_cluster::queue::Message;
+
+const KEY_PREFIX: &str = "/workflow_http_triggers/";
+
+/// Seam over the store and the coordinator so the ack rules are testable without either.
+trait SnapshotSink {
+    async fn apply(&self, snapshot: TriggerSnapshot) -> Result<ApplyOutcome>;
+    async fn invalidate(&self, trigger_id: &str) -> Result<()>;
+}
+
+struct MetaStore;
+
+impl SnapshotSink for MetaStore {
+    async fn apply(&self, snapshot: TriggerSnapshot) -> Result<ApplyOutcome> {
+        table::apply_snapshot(snapshot).await
+    }
+
+    async fn invalidate(&self, trigger_id: &str) -> Result<()> {
+        db::workflow_http_triggers::notify_local(trigger_id)
+            .await
+            .map_err(|e| Error::Message(e.to_string()))
+    }
+}
+
+pub(crate) async fn process(msg: Message) -> Result<()> {
+    process_with(&MetaStore, msg).await
+}
+
+/// Acks a poison message, returns DB errors for redelivery, and evicts every trigger it wrote.
+async fn process_with<S: SnapshotSink>(sink: &S, msg: Message) -> Result<()> {
+    let Some(snapshot) = decode(&msg) else {
+        log::error!(
+            "[SUPER_CLUSTER:DB] skipped an undecodable workflow http trigger snapshot, key {}",
+            msg.key
+        );
+        return Ok(());
+    };
+    let trigger_id = snapshot.trigger.id.clone();
+    let origin_cluster = snapshot.origin_cluster.clone();
+    let outcome = match sink.apply(snapshot).await {
+        Ok(outcome) => outcome,
+        Err(e) => {
+            config::metrics::WORKFLOW_HOOK_SNAPSHOT_APPLY_FAILURES
+                .with_label_values(&[origin_cluster.as_str()])
+                .inc();
+            log::error!("{}: {e}", apply_failure_log(&msg.key));
+            return Err(e);
+        }
+    };
+    if outcome == ApplyOutcome::Stale {
+        return Ok(());
+    }
+    evict(sink, &trigger_id).await;
+    if let ApplyOutcome::CollisionWon { loser } = &outcome {
+        evict(sink, loser).await;
+    }
+    Ok(())
+}
+
+async fn evict<S: SnapshotSink>(sink: &S, trigger_id: &str) {
+    if let Err(e) = sink.invalidate(trigger_id).await {
+        log::error!(
+            "[SUPER_CLUSTER:DB] workflow http trigger cache eviction failed for {trigger_id}: {e}"
+        );
+    }
+}
+
+/// A body whose trigger id differs from the key's is treated as malformed, not applied.
+fn decode(msg: &Message) -> Option<TriggerSnapshot> {
+    let snapshot: TriggerSnapshot = serde_json::from_slice(msg.value.as_deref()?).ok()?;
+    (msg.key.strip_prefix(KEY_PREFIX) == Some(snapshot.trigger.id.as_str())).then_some(snapshot)
+}
+
+fn apply_failure_log(key: &str) -> String {
+    format!(
+        "[SUPER_CLUSTER:DB] workflow http trigger snapshot apply failed, key {key}, left for redelivery"
+    )
+}
+
+#[cfg(test)]
+mod tests {
+    use std::sync::Mutex;
+
+    use infra::table::workflow_http_triggers::{
+        AuthMode, CredentialKind, CredentialState, ReplicatedCredential, ReplicatedTrigger,
+    };
+    use o2_enterprise::enterprise::super_cluster::queue::MessageType;
+
+    use super::*;
+
+    /// Records what reached the store and the coordinator.
+    struct FakeSink {
+        outcome: std::result::Result<ApplyOutcome, String>,
+        applied: Mutex<Vec<String>>,
+        evicted: Mutex<Vec<String>>,
+    }
+
+    impl FakeSink {
+        fn new(outcome: std::result::Result<ApplyOutcome, String>) -> Self {
+            Self {
+                outcome,
+                applied: Mutex::new(Vec::new()),
+                evicted: Mutex::new(Vec::new()),
+            }
+        }
+    }
+
+    impl SnapshotSink for FakeSink {
+        async fn apply(&self, snapshot: TriggerSnapshot) -> Result<ApplyOutcome> {
+            self.applied.lock().unwrap().push(snapshot.trigger.id);
+            self.outcome.clone().map_err(Error::Message)
+        }
+
+        async fn invalidate(&self, trigger_id: &str) -> Result<()> {
+            self.evicted.lock().unwrap().push(trigger_id.to_string());
+            Ok(())
+        }
+    }
+
+    fn snapshot(trigger_id: &str, origin_cluster: &str) -> TriggerSnapshot {
+        TriggerSnapshot {
+            version: 2,
+            origin_cluster: origin_cluster.to_string(),
+            deleted: false,
+            trigger: ReplicatedTrigger {
+                id: trigger_id.to_string(),
+                org_id: "acme".to_string(),
+                workflow_id: "wf-1".to_string(),
+                enabled: true,
+                auth_mode: AuthMode::Signature,
+                max_body_bytes: 1_048_576,
+                rate_limit_per_minute: 60,
+                created_by: "a@x.io".to_string(),
+                created_at: 1,
+                updated_at: 2,
+                deleted_at: None,
+            },
+            credentials: vec![ReplicatedCredential {
+                id: "c1".to_string(),
+                kind: CredentialKind::SigningSecret,
+                display_prefix: "whsec_abcd…wxyz".to_string(),
+                token_sha256: None,
+                state: CredentialState::Active,
+                expires_at: None,
+                revoked_at: None,
+                created_by: "a@x.io".to_string(),
+                created_at: 1,
+                updated_at: 2,
+                secret: Some("whsec_c2VjcmV0".to_string()),
+            }],
+        }
+    }
+
+    fn message(key: &str, value: Vec<u8>) -> Message {
+        Message::new(
+            key.to_string(),
+            Some(value.into()),
+            None,
+            true,
+            MessageType::WorkflowHttpTriggerPut,
+        )
+    }
+
+    fn snapshot_message(snapshot: &TriggerSnapshot) -> Message {
+        message(
+            &format!("{KEY_PREFIX}{}", snapshot.trigger.id),
+            serde_json::to_vec(snapshot).unwrap(),
+        )
+    }
+
+    #[tokio::test]
+    async fn a_malformed_snapshot_is_acked() {
+        let sink = FakeSink::new(Ok(ApplyOutcome::Applied));
+        let garbage = message("/workflow_http_triggers/t1", b"{not json".to_vec());
+        assert!(process_with(&sink, garbage).await.is_ok());
+        let mismatched = message(
+            "/workflow_http_triggers/other",
+            serde_json::to_vec(&snapshot("t1", "r1")).unwrap(),
+        );
+        assert!(process_with(&sink, mismatched).await.is_ok());
+        assert!(sink.applied.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn a_db_error_is_returned_for_redelivery() {
+        let origin = "r-db-error";
+        let failures = || {
+            config::metrics::WORKFLOW_HOOK_SNAPSHOT_APPLY_FAILURES
+                .with_label_values(&[origin])
+                .get()
+        };
+        let before = failures();
+        let sink = FakeSink::new(Err("database is locked".to_string()));
+        let result = process_with(&sink, snapshot_message(&snapshot("t1", origin))).await;
+        assert!(result.is_err(), "a DB error must not be acked");
+        assert_eq!(failures(), before + 1);
+        assert!(sink.evicted.lock().unwrap().is_empty());
+    }
+
+    #[tokio::test]
+    async fn apply_puts_the_cache_invalidation_key() {
+        let applied = FakeSink::new(Ok(ApplyOutcome::Applied));
+        process_with(&applied, snapshot_message(&snapshot("t1", "r1")))
+            .await
+            .unwrap();
+        assert_eq!(*applied.evicted.lock().unwrap(), ["t1"]);
+
+        let stale = FakeSink::new(Ok(ApplyOutcome::Stale));
+        process_with(&stale, snapshot_message(&snapshot("t1", "r1")))
+            .await
+            .unwrap();
+        assert!(stale.evicted.lock().unwrap().is_empty());
+        assert_eq!(
+            db::workflow_http_triggers::TRIGGER_KEY_PREFIX,
+            "/workflow_http_trigger/"
+        );
+    }
+
+    #[tokio::test]
+    async fn a_won_collision_also_evicts_the_losing_trigger() {
+        let won = FakeSink::new(Ok(ApplyOutcome::CollisionWon {
+            loser: "t-lost".to_string(),
+        }));
+        process_with(&won, snapshot_message(&snapshot("t1", "r1")))
+            .await
+            .unwrap();
+        assert_eq!(*won.evicted.lock().unwrap(), ["t1", "t-lost"]);
+    }
+
+    #[test]
+    fn apply_failure_log_names_only_the_key() {
+        let line = apply_failure_log("/workflow_http_triggers/t1");
+        assert!(line.contains("/workflow_http_triggers/t1"), "{line}");
+        let body = serde_json::to_string(&snapshot("t1", "r1")).unwrap();
+        assert!(!line.contains("whsec_"), "{line}");
+        assert!(!line.contains(&body), "{line}");
+    }
+}
diff --git a/tests/api-testing/tests/workflows/test_workflow_http_trigger.py b/tests/api-testing/tests/workflows/test_workflow_http_trigger.py
new file mode 100644
index 0000000000..3c1fe8917e
--- /dev/null
+++ b/tests/api-testing/tests/workflows/test_workflow_http_trigger.py
@@ -0,0 +1,705 @@
+"""
+Workflow HTTP endpoints: management API, credentials, reveal and run history.
+
+Endpoints (context path /api, org in path):
+    GET    /{org}/workflows/{id}/http_trigger                               config + credentials
+    PUT    /{org}/workflows/{id}/http_trigger                               create / update / mode switch
+    DELETE /{org}/workflows/{id}/http_trigger                               delete (tombstone)
+    POST   /{org}/workflows/{id}/http_trigger/credentials                   rotate {overlap_seconds}
+    DELETE /{org}/workflows/{id}/http_trigger/credentials/{cred_id}         revoke
+    GET    /{org}/workflows/{id}/http_trigger/credentials/{cred_id}/secret  reveal
+    POST   /{org}/workflows/{id}/http_trigger/test                          test run
+    POST   /v2/{org}/workflows/hooks/{trigger_id}                           public invoke (Bearer token)
+    GET    /v2/{org}/workflows/hooks/{trigger_id}/runs/{run_id}             public status poll
+
+The routes exist only when the server runs with O2_WORKFLOW_HOOKS_ENABLED=true, which
+`/config` reports as `workflow_hooks_enabled`; until that is the default the module skips
+(WORKFLOW_HOOKS_REQUIRED=1 turns the skip into a failure). Invokes use `?dry_run=true`
+where only authentication matters, so no run is started.
+
+All artifacts are namespaced `wf_auto_http_*` and torn down by fixtures.
+"""
+
+import os
+import time
+import uuid
+
+import pytest
+import requests
+
+ORG_ID = os.environ.get("TEST_ORG_ID", "default")
+SINK_URL = "http://example.com/sink"
+NO_STORE = "no-store, private"
+
+
+def _suffix():
+    return f"{int(time.time())}{uuid.uuid4().hex[:6]}"
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _require_hooks(create_session, base_url):
+    resp = create_session.get(f"{base_url}api/{ORG_ID}/config")
+    enabled = resp.status_code == 200 and resp.json().get("workflow_hooks_enabled") is True
+    if not enabled:
+        msg = "Workflow HTTP endpoints are off on this server (/config workflow_hooks_enabled is not true)."
+        if os.environ.get("WORKFLOW_HOOKS_REQUIRED") == "1":
+            pytest.fail(f"{msg} WORKFLOW_HOOKS_REQUIRED=1 expects them on.")
+        pytest.skip(msg)
+
+
+def _workflow_payload(name, dest_name, trigger_type="AlertFired", trigger_kind="alert_fired"):
+    """The endpoint is not a trigger kind, so test workflows use the kinds the UI creates."""
+    return {
+        "workflow": {
+            "id": "",
+            "org_id": "",
+            "created_at": 0,
+            "updated_at": 0,
+            "created_by": "",
+            "name": name,
+            "description": "http endpoint automation",
+            "enabled": True,
+            "nodes": [
+                {
+                    "id": "trigger-1",
+                    "data": {"node_type": "workflow_trigger"},
+                    "meta": {"trigger_kind": trigger_kind},
+                    "position": {"x": 100, "y": 100},
+                    "io_type": "input",
+                },
+                {
+                    "id": "dest-1",
+                    "data": {
+                        "node_type": "destination",
+                        "destination_id": dest_name,
+                        "template_override": None,
+                    },
+                    "position": {"x": 400, "y": 100},
+                    "io_type": "output",
+                },
+            ],
+            "edges": [{"id": "etrigger-1-dest-1", "source": "trigger-1", "target": "dest-1"}],
+        },
+        "trigger_type": trigger_type,
+    }
+
+
+@pytest.fixture(scope="module")
+def destination(create_session, base_url):
+    name = f"wf_auto_http_dest_{_suffix()}"
+    resp = create_session.post(
+        f"{base_url}api/{ORG_ID}/alerts/destinations?module=pipeline",
+        json={"name": name, "url": SINK_URL, "method": "post", "type": "http"},
+    )
+    assert resp.status_code == 200, f"destination create failed: {resp.status_code} {resp.text[:300]}"
+    yield name
+    create_session.delete(f"{base_url}api/{ORG_ID}/alerts/destinations/{name}")
+
+
+@pytest.fixture(scope="module")
+def sink_destination(create_session, base_url):
+    """Posts back into this server's own ingestion, so a run that reaches it succeeds (needs ZO_SSRF_ALLOW_LOOPBACK)."""
+    name = f"wf_auto_http_sink_{_suffix()}"
+    resp = create_session.post(
+        f"{base_url}api/{ORG_ID}/alerts/destinations?module=pipeline",
+        json={
+            "name": name,
+            "url": f"{base_url}api/{ORG_ID}/wf_auto_http_sink/_json",
+            "method": "post",
+            "type": "http",
+            "headers": {"Authorization": create_session.headers["Authorization"]},
+        },
+    )
+    assert resp.status_code == 200, f"sink create failed: {resp.status_code} {resp.text[:300]}"
+    yield name
+    create_session.delete(f"{base_url}api/{ORG_ID}/alerts/destinations/{name}")
+
+
+@pytest.fixture
+def make_workflow(create_session, base_url, destination):
+    """Creates published workflows on demand and deletes them (and their endpoints) after."""
+    created = []
+
+    def _make(trigger_type="AlertFired", trigger_kind="alert_fired", dest=None):
+        name = f"wf_auto_http_{_suffix()}"
+        resp = create_session.post(
+            f"{base_url}api/{ORG_ID}/workflows",
+            json=_workflow_payload(name, dest or destination, trigger_type, trigger_kind),
+        )
+        assert resp.status_code == 200, f"workflow create failed: {resp.status_code} {resp.text[:300]}"
+        wf_id = resp.json()["id"]
+        created.append(wf_id)
+        return wf_id
+
+    yield _make
+    for wf_id in created:
+        create_session.delete(f"{base_url}api/{ORG_ID}/workflows/{wf_id}/http_trigger")
+        create_session.delete(f"{base_url}api/{ORG_ID}/workflows/{wf_id}")
+
+
+def _url(base_url, wf_id, rest=""):
+    return f"{base_url}api/{ORG_ID}/workflows/{wf_id}/http_trigger{rest}"
+
+
+def _enable(session, base_url, wf_id, mode="token", **limits):
+    resp = session.put(_url(base_url, wf_id), json={"enabled": True, "auth_mode": mode, **limits})
+    assert resp.status_code == 201, f"enable failed: {resp.status_code} {resp.text[:300]}"
+    return resp
+
+
+def _invoke(base_url, trigger_id, token, dry_run=True, body=None, headers=None):
+    hdrs = {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}
+    hdrs.update(headers or {})
+    return requests.post(
+        f"{base_url}api/v2/{ORG_ID}/workflows/hooks/{trigger_id}",
+        params={"dry_run": "true"} if dry_run else None,
+        json=body if body is not None else {"event": "pytest"},
+        headers=hdrs,
+    )
+
+
+def _rotate(session, base_url, wf_id, overlap):
+    return session.post(_url(base_url, wf_id, "/credentials"), json={"overlap_seconds": overlap})
+
+
+def _reveal(session, base_url, wf_id, cred_id):
+    return session.get(_url(base_url, wf_id, f"/credentials/{cred_id}/secret"))
+
+
+def _poll_terminal(base_url, trigger_id, run_id, token, timeout=60):
+    path = f"{base_url}api/v2/{ORG_ID}/workflows/hooks/{trigger_id}/runs/{run_id}"
+    deadline = time.time() + timeout
+    last = None
+    while time.time() < deadline:
+        resp = requests.get(path, headers={"Authorization": f"Bearer {token}"})
+        assert resp.status_code == 200, f"poll failed: {resp.status_code} {resp.text[:300]}"
+        last = resp.json()
+        if last["status"] in ("succeeded", "failed", "expired"):
+            return last
+        time.sleep(1)
+    pytest.fail(f"run {run_id} never finished: {last}")
+
+
+def _list_row(session, base_url, wf_id):
+    resp = session.get(f"{base_url}api/{ORG_ID}/workflows")
+    assert resp.status_code == 200, resp.text[:300]
+    data = resp.json()
+    items = data if isinstance(data, list) else data.get("list", data.get("data", []))
+    row = next((w for w in items if w.get("id") == wf_id), None)
+    assert row is not None, f"workflow {wf_id} is not listed"
+    return row
+
+
+def _kind_and_links(session, base_url, wf_id):
+    """The trigger node's meta and the workflow's (entity, entity type, trigger type) links."""
+    row = _list_row(session, base_url, wf_id)
+    trigger = next(n for n in row["nodes"] if n["data"]["node_type"] == "workflow_trigger")
+    links = sorted(
+        (a["entity_id"], a["entity_type"], a["trigger_type"]) for a in row.get("associations") or []
+    )
+    return trigger.get("meta"), links
+
+
+def _run_to_end(base_url, created):
+    """Starts a real HTTP run and waits until the worker has run the workflow's steps."""
+    resp = _invoke(
+        base_url, created["id"], created["secret"], dry_run=False, headers={"Idempotency-Key": f"k-{_suffix()}"}
+    )
+    assert resp.status_code == 202, resp.text[:300]
+    run_id = resp.json()["run_id"]
+    last = _poll_terminal(base_url, created["id"], run_id, created["secret"])
+    assert last["status"] == "succeeded", last
+    return run_id
+
+
+def _history_row(session, base_url, wf_id, run_id):
+    history = session.get(f"{base_url}api/{ORG_ID}/workflows/{wf_id}/history").json()
+    rows = [r for r in history if r.get("run_id") == run_id]
+    assert len(rows) == 1, history
+    return rows[0]
+
+
+@pytest.fixture
+def alert_linked_workflow(create_session, base_url, make_workflow, sink_destination):
+    """An Alert Fired workflow linked to a disabled alert through the alerts API; yields (wf_id, alert_id)."""
+    wf_id = make_workflow(dest=sink_destination)
+    stream = f"wf_auto_http_alert_{_suffix()}"
+    ingest = create_session.post(f"{base_url}api/{ORG_ID}/{stream}/_json", json=[{"level": "info"}])
+    assert ingest.status_code == 200, ingest.text[:300]
+    name = f"wf_auto_http_alert_{_suffix()}"
+    payload = {
+        "name": name,
+        "stream_type": "logs",
+        "stream_name": stream,
+        "is_real_time": False,
+        "context_attributes": {},
+        "query_condition": {
+            "conditions": [
+                {"column": "level", "operator": "=", "value": "never", "type": None, "id": uuid.uuid4().hex}
+            ],
+            "search_event_type": "ui",
+            "sql": "",
+            "promql": "",
+            "type": "custom",
+            "promql_condition": None,
+            "vrl_function": None,
+            "multi_time_range": [],
+        },
+        "trigger_condition": {
+            "period": 10,
+            "operator": ">=",
+            "frequency": 60,
+            "cron": "",
+            "threshold": 1000,
+            "silence": 10,
+            "frequency_type": "minutes",
+            "timezone": "UTC",
+            "tolerance_in_secs": 0,
+        },
+        "org_id": ORG_ID,
+        "destinations": [],
+        "workflows": [wf_id],
+        "enabled": False,
+        "description": "http endpoint automation",
+    }
+    resp = create_session.post(f"{base_url}api/v2/{ORG_ID}/alerts?folder=default", json=payload)
+    assert resp.status_code == 200, f"alert create failed: {resp.status_code} {resp.text[:300]}"
+    listed = create_session.get(f"{base_url}api/v2/{ORG_ID}/alerts").json().get("list", [])
+    alert_id = next((a["alert_id"] for a in listed if a.get("name") == name), None)
+    assert alert_id, f"alert {name} is not listed"
+    yield wf_id, alert_id
+    create_session.delete(f"{base_url}api/v2/{ORG_ID}/alerts/{alert_id}")
+
+
+# --------------------------------------------------------------------------- config / GET
+
+
+def test_config_exposes_workflow_hooks_enabled(create_session, base_url):
+    """AC-API-21."""
+    body = create_session.get(f"{base_url}api/{ORG_ID}/config").json()
+    assert body["workflow_hooks_enabled"] is True
+    assert body["workflows_enabled"] is True
+
+
+def test_get_unconfigured_is_404_with_permissions(create_session, base_url, make_workflow):
+    """AC-API-10 404 body."""
+    wf_id = make_workflow()
+    resp = create_session.get(_url(base_url, wf_id))
+    assert resp.status_code == 404
+    body = resp.json()
+    assert body["error_detail"] == "not_configured"
+    assert body["permissions"] == {"edit": True, "test": True, "reveal": True}
+    assert isinstance(body["org_rate_limit_per_minute"], int)
+    assert isinstance(body["secrets_encrypted_at_rest"], bool)
+
+
+def test_get_http_trigger_reports_secrets_encrypted_at_rest(create_session, base_url, make_workflow):
+    """AC-API-25: EXPECT_SECRETS_ENCRYPTED names the server's mode when the runner knows it."""
+    wf_id = make_workflow()
+    _enable(create_session, base_url, wf_id)
+    value = create_session.get(_url(base_url, wf_id)).json()["secrets_encrypted_at_rest"]
+    assert isinstance(value, bool)
+    expected = os.environ.get("EXPECT_SECRETS_ENCRYPTED")
+    if expected is not None:
+        assert value == (expected == "true")
+
+
+def test_get_http_trigger_omits_revoked_and_flags_creator_in_org(create_session, base_url, make_workflow):
+    """AC-API-10: revoked rows are omitted, live ones carry creator_in_org and only a prefix."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    first = created["credentials"][0]["id"]
+    assert _rotate(create_session, base_url, wf_id, 0).status_code == 201
+    view = create_session.get(_url(base_url, wf_id)).json()
+    ids = [c["id"] for c in view["credentials"]]
+    assert first not in ids
+    assert len(ids) == 1
+    cred = view["credentials"][0]
+    assert cred["creator_in_org"] is True
+    assert cred["display_prefix"].startswith("o2wh_")
+    assert "…" in cred["display_prefix"]
+    assert "secret" not in cred
+    assert "token_sha256" not in cred
+    for key in ("url", "enabled", "auth_mode", "max_body_bytes", "rate_limit_per_minute",
+                "org_rate_limit_per_minute", "created_by", "created_at", "updated_at",
+                "last_invoked_at", "last_call", "rejections", "permissions"):
+        assert key in view, key
+    assert view["url"].endswith(f"/api/v2/{ORG_ID}/workflows/hooks/{view['id']}")
+
+
+# --------------------------------------------------------------------------- PUT
+
+
+def test_put_create_201_with_secret(create_session, base_url, make_workflow):
+    """AC-API-11 create, AC-API-27 no-store, AC-SEC-01 token shape."""
+    wf_id = make_workflow()
+    resp = _enable(create_session, base_url, wf_id)
+    assert resp.headers.get("Cache-Control") == NO_STORE
+    body = resp.json()
+    assert body["secret"].startswith("o2wh_")
+    assert len(body["secret"]) == 48
+    assert body["auth_mode"] == "token"
+    assert body["enabled"] is True
+    assert body["max_body_bytes"] == 1048576
+    assert _invoke(base_url, body["id"], body["secret"]).status_code == 200
+
+
+def test_put_update_200_without_secret(create_session, base_url, make_workflow):
+    """AC-API-11 update."""
+    wf_id = make_workflow()
+    _enable(create_session, base_url, wf_id)
+    resp = create_session.put(
+        _url(base_url, wf_id),
+        json={"enabled": False, "auth_mode": "token", "rate_limit_per_minute": 5},
+    )
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body.get("secret") is None
+    assert body["enabled"] is False
+    assert body["rate_limit_per_minute"] == 5
+    assert "no-store" not in resp.headers.get("Cache-Control", "")
+
+
+def test_put_limits_above_budget_400(create_session, base_url, make_workflow):
+    """AC-API-11: limits outside their range and unknown modes are refused."""
+    wf_id = make_workflow()
+    for payload, code in (
+        ({"enabled": True, "auth_mode": "token", "rate_limit_per_minute": 10_000_000}, "invalid_limit"),
+        ({"enabled": True, "auth_mode": "token", "max_body_bytes": 5 * 1024 * 1024}, "invalid_limit"),
+        ({"enabled": True, "auth_mode": "token", "max_body_bytes": 0}, "invalid_limit"),
+        ({"enabled": True, "auth_mode": "basic"}, "invalid_auth_mode"),
+    ):
+        resp = create_session.put(_url(base_url, wf_id), json=payload)
+        assert resp.status_code == 400, payload
+        assert resp.json()["error_detail"] == code
+
+
+def test_put_on_draft_only_id_201(create_session, base_url, destination):
+    """AC-API-11: a draft-only id is accepted; calls are 403 workflow_not_published."""
+    name = f"wf_auto_http_draft_{_suffix()}"
+    resp = create_session.post(
+        f"{base_url}api/{ORG_ID}/workflows?draft=true", json=_workflow_payload(name, destination)
+    )
+    assert resp.status_code == 200, resp.text[:300]
+    wf_id = resp.json()["id"]
+    try:
+        body = _enable(create_session, base_url, wf_id).json()
+        call = _invoke(base_url, body["id"], body["secret"])
+        assert call.status_code == 403
+        assert call.json()["error_detail"] == "workflow_not_published"
+        missing = create_session.put(
+            _url(base_url, f"wf-missing-{_suffix()}"), json={"enabled": True, "auth_mode": "token"}
+        )
+        assert missing.status_code == 404
+        assert missing.json()["error_detail"] == "workflow_not_found"
+    finally:
+        create_session.delete(_url(base_url, wf_id))
+        create_session.delete(f"{base_url}api/{ORG_ID}/workflows/{wf_id}?draft=true")
+
+
+def test_mode_switch_revokes_the_old_kind_and_returns_a_new_secret(create_session, base_url, make_workflow):
+    """AC-SEC-07, AC-API-11 mode switch."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    resp = create_session.put(_url(base_url, wf_id), json={"enabled": True, "auth_mode": "signature"})
+    assert resp.status_code == 200
+    assert resp.headers.get("Cache-Control") == NO_STORE
+    body = resp.json()
+    assert body["secret"].startswith("whsec_")
+    assert [c["kind"] for c in body["credentials"]] == ["signing_secret"]
+    assert _invoke(base_url, created["id"], created["secret"]).status_code == 401
+
+
+# --------------------------------------------------------------------------- DELETE / rotate / revoke
+
+
+def test_delete_http_trigger_204_then_invoke_401(create_session, base_url, make_workflow):
+    """AC-API-12."""
+    wf_id = make_workflow()
+    body = _enable(create_session, base_url, wf_id).json()
+    assert create_session.delete(_url(base_url, wf_id)).status_code == 204
+    assert _invoke(base_url, body["id"], body["secret"]).status_code == 401
+    assert create_session.delete(_url(base_url, wf_id)).status_code == 404
+    assert create_session.get(_url(base_url, wf_id)).status_code == 404
+
+
+def test_deleting_the_workflow_removes_the_endpoint(create_session, base_url, destination):
+    """AC-ENG-22: deleting a published workflow tombstones its endpoint."""
+    resp = create_session.post(
+        f"{base_url}api/{ORG_ID}/workflows", json=_workflow_payload(f"wf_auto_http_{_suffix()}", destination)
+    )
+    assert resp.status_code == 200, resp.text[:300]
+    wf_id = resp.json()["id"]
+    body = _enable(create_session, base_url, wf_id).json()
+    assert _invoke(base_url, body["id"], body["secret"]).status_code == 200
+    assert create_session.delete(f"{base_url}api/{ORG_ID}/workflows/{wf_id}").status_code == 200
+    assert _invoke(base_url, body["id"], body["secret"]).status_code == 401
+    assert create_session.get(_url(base_url, wf_id)).status_code == 404
+
+
+def test_deleting_a_draft_removes_the_endpoint(create_session, base_url, destination):
+    """AC-ENG-22: deleting a draft-only workflow tombstones its endpoint."""
+    resp = create_session.post(
+        f"{base_url}api/{ORG_ID}/workflows?draft=true",
+        json=_workflow_payload(f"wf_auto_http_draft_{_suffix()}", destination),
+    )
+    assert resp.status_code == 200, resp.text[:300]
+    wf_id = resp.json()["id"]
+    body = _enable(create_session, base_url, wf_id).json()
+    assert _invoke(base_url, body["id"], body["secret"]).status_code == 403
+    assert create_session.delete(f"{base_url}api/{ORG_ID}/workflows/{wf_id}?draft=true").status_code == 200
+    assert _invoke(base_url, body["id"], body["secret"]).status_code == 401
+    assert create_session.get(_url(base_url, wf_id)).status_code == 404
+
+
+def test_rotate_with_overlap_keeps_old_token_until_expiry(create_session, base_url, make_workflow):
+    """AC-API-13: overlap keeps the old token live and retiring."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    resp = _rotate(create_session, base_url, wf_id, 3600)
+    assert resp.status_code == 201
+    assert resp.headers.get("Cache-Control") == NO_STORE
+    rotated = resp.json()
+    assert rotated["secret"].startswith("o2wh_")
+    assert rotated["state"] == "active"
+    assert _invoke(base_url, created["id"], created["secret"]).status_code == 200
+    assert _invoke(base_url, created["id"], rotated["secret"]).status_code == 200
+    states = {c["id"]: c for c in create_session.get(_url(base_url, wf_id)).json()["credentials"]}
+    old = states[created["credentials"][0]["id"]]
+    assert old["state"] == "retiring"
+    assert old["expires_at"] > int(time.time() * 1_000_000)
+
+
+def test_rotate_immediate_revokes_old(create_session, base_url, make_workflow):
+    """AC-API-13 overlap 0."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    rotated = _rotate(create_session, base_url, wf_id, 0).json()
+    assert _invoke(base_url, created["id"], created["secret"]).status_code == 401
+    assert _invoke(base_url, created["id"], rotated["secret"]).status_code == 200
+
+
+def test_rotate_bad_overlap_400(create_session, base_url, make_workflow):
+    """AC-API-13 invalid overlap."""
+    wf_id = make_workflow()
+    _enable(create_session, base_url, wf_id)
+    resp = _rotate(create_session, base_url, wf_id, 60)
+    assert resp.status_code == 400
+    assert resp.json()["error_detail"] == "invalid_overlap"
+
+
+def test_rotate_while_retiring_is_409(create_session, base_url, make_workflow):
+    """AC-SEC-05."""
+    wf_id = make_workflow()
+    _enable(create_session, base_url, wf_id)
+    assert _rotate(create_session, base_url, wf_id, 3600).status_code == 201
+    resp = _rotate(create_session, base_url, wf_id, 0)
+    assert resp.status_code == 409
+    assert resp.json()["error_detail"] == "credential_retiring"
+    assert len(create_session.get(_url(base_url, wf_id)).json()["credentials"]) == 2
+
+
+def test_revoked_token_gets_401_immediately(create_session, base_url, make_workflow):
+    """AC-SEC-06."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    cred = created["credentials"][0]["id"]
+    assert _invoke(base_url, created["id"], created["secret"]).status_code == 200
+    assert create_session.delete(_url(base_url, wf_id, f"/credentials/{cred}")).status_code == 204
+    assert _invoke(base_url, created["id"], created["secret"]).status_code == 401
+
+
+def test_revoke_credential_of_other_trigger_404(create_session, base_url, make_workflow):
+    """AC-API-14."""
+    a, b = make_workflow(), make_workflow()
+    created_a = _enable(create_session, base_url, a).json()
+    _enable(create_session, base_url, b)
+    foreign = created_a["credentials"][0]["id"]
+    resp = create_session.delete(_url(base_url, b, f"/credentials/{foreign}"))
+    assert resp.status_code == 404
+    assert resp.json()["error_detail"] == "credential_not_found"
+    assert _invoke(base_url, created_a["id"], created_a["secret"]).status_code == 200
+
+
+# --------------------------------------------------------------------------- reveal
+
+
+def test_reveal_credential_secret_200(create_session, base_url, make_workflow):
+    """AC-API-26."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    cred = created["credentials"][0]
+    resp = _reveal(create_session, base_url, wf_id, cred["id"])
+    assert resp.status_code == 200
+    body = resp.json()
+    assert body == {
+        "id": cred["id"],
+        "kind": "token",
+        "display_prefix": cred["display_prefix"],
+        "state": "active",
+        "expires_at": None,
+        "secret": created["secret"],
+    }
+
+
+def test_reveal_after_revoke_404(create_session, base_url, make_workflow):
+    """AC-API-26: revoked and unknown credentials do not reveal."""
+    wf_id = make_workflow()
+    cred = _enable(create_session, base_url, wf_id).json()["credentials"][0]["id"]
+    assert create_session.delete(_url(base_url, wf_id, f"/credentials/{cred}")).status_code == 204
+    resp = _reveal(create_session, base_url, wf_id, cred)
+    assert resp.status_code == 404
+    assert resp.json()["error_detail"] == "credential_not_found"
+    assert _reveal(create_session, base_url, wf_id, "unknown").status_code == 404
+
+
+def test_reveal_after_mode_switch_404(create_session, base_url, make_workflow):
+    """AC-API-26: a mode-switched credential is revoked, the new one reveals."""
+    wf_id = make_workflow()
+    old = _enable(create_session, base_url, wf_id).json()["credentials"][0]["id"]
+    switched = create_session.put(
+        _url(base_url, wf_id), json={"enabled": True, "auth_mode": "signature"}
+    ).json()
+    assert _reveal(create_session, base_url, wf_id, old).status_code == 404
+    new = switched["credentials"][0]["id"]
+    resp = _reveal(create_session, base_url, wf_id, new)
+    assert resp.status_code == 200
+    assert resp.json()["secret"] == switched["secret"]
+
+
+def test_secret_responses_are_no_store(create_session, base_url, make_workflow):
+    """AC-API-27: create, rotate, mode switch and reveal all send no-store."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id)
+    rotated = _rotate(create_session, base_url, wf_id, 0)
+    revealed = _reveal(create_session, base_url, wf_id, rotated.json()["id"])
+    switched = create_session.put(_url(base_url, wf_id), json={"enabled": True, "auth_mode": "signature"})
+    for resp in (created, rotated, revealed, switched):
+        assert resp.headers.get("Cache-Control") == NO_STORE, resp.url
+
+
+# --------------------------------------------------------------------------- test route, runs, scope
+
+
+def test_http_trigger_test_suppresses_destinations_by_default(create_session, base_url, make_workflow):
+    """AC-API-15: the steps get the hook-shaped input; the destination is not called."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    resp = create_session.post(_url(base_url, wf_id, "/test"), json={"data": [{"event": "deploy"}]})
+    assert resp.status_code == 200, resp.text[:500]
+    text = resp.text
+    assert '"event_type":"webhook"' in text.replace(" ", "")
+    assert created["id"] in text
+    assert "deploy" in text
+    assert '"suppressed":true' in text.replace(" ", "")
+
+
+def test_history_lists_a_finished_http_run(create_session, base_url, make_workflow):
+    """AC-API-16 and AC-OBS-07: a real run is listed with its request facts."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    resp = _invoke(
+        base_url, created["id"], created["secret"], dry_run=False, headers={"Idempotency-Key": f"k-{_suffix()}"}
+    )
+    assert resp.status_code == 202, resp.text[:300]
+    accepted = resp.json()
+    assert resp.headers.get("Location") == accepted["status_url"]
+    _poll_terminal(base_url, created["id"], accepted["run_id"], created["secret"])
+    history = create_session.get(f"{base_url}api/{ORG_ID}/workflows/{wf_id}/history").json()
+    rows = [r for r in history if r.get("run_id") == accepted["run_id"]]
+    assert len(rows) == 1, history
+    row = rows[0]
+    assert row["status"] in ("succeeded", "failed")
+    assert row["event_type"] == "Webhook"
+    facts = row["http_request"]
+    assert facts["credential_prefix"] == created["credentials"][0]["display_prefix"]
+    assert facts["content_type"] == "application/json"
+    assert facts["body_bytes"] > 0
+    assert facts["idempotency_key"].startswith("k-")
+    assert facts["caller_ip"]
+    view = create_session.get(_url(base_url, wf_id)).json()
+    assert view["last_call"]["run_id"] == accepted["run_id"]
+
+
+def test_an_alert_fired_workflow_runs_on_http_and_keeps_its_alert_link(
+    create_session, base_url, alert_linked_workflow
+):
+    """AC-API-28: an alert-linked workflow accepts HTTP runs; its kind and alert link never change."""
+    wf_id, alert_id = alert_linked_workflow
+    before = _kind_and_links(create_session, base_url, wf_id)
+    assert before == ({"trigger_kind": "alert_fired"}, [(alert_id, "alert", "AlertFired")])
+    created = _enable(create_session, base_url, wf_id).json()
+    assert _kind_and_links(create_session, base_url, wf_id) == before
+    run_id = _run_to_end(base_url, created)
+    row = _history_row(create_session, base_url, wf_id, run_id)
+    assert row["event_type"] == "Webhook"
+    assert row["status"] == "succeeded"
+    assert row["http_request"]["credential_prefix"] == created["credentials"][0]["display_prefix"]
+    assert _kind_and_links(create_session, base_url, wf_id) == before
+    assert create_session.delete(_url(base_url, wf_id)).status_code == 204
+    assert _kind_and_links(create_session, base_url, wf_id) == before
+    _enable(create_session, base_url, wf_id)
+    assert _kind_and_links(create_session, base_url, wf_id) == before
+
+
+def test_an_incident_event_workflow_runs_on_http_and_keeps_its_incident_link(
+    create_session, base_url, make_workflow, sink_destination
+):
+    """AC-API-28: PUT, DELETE and re-PUT of the endpoint leave the incident link and kind as they were."""
+    wf_id = make_workflow(trigger_type="IncidentEvent", trigger_kind="incident_event", dest=sink_destination)
+    before = _kind_and_links(create_session, base_url, wf_id)
+    assert before[0] == {"trigger_kind": "incident_event"}
+    assert [link[1:] for link in before[1]] == [("incident", "IncidentEvent")], before
+    created = _enable(create_session, base_url, wf_id).json()
+    assert _kind_and_links(create_session, base_url, wf_id) == before
+    run_id = _run_to_end(base_url, created)
+    row = _history_row(create_session, base_url, wf_id, run_id)
+    assert row["event_type"] == "Webhook"
+    assert row["status"] == "succeeded"
+    assert row["http_request"]["body_bytes"] > 0
+    assert create_session.delete(_url(base_url, wf_id)).status_code == 204
+    assert _kind_and_links(create_session, base_url, wf_id) == before
+    _enable(create_session, base_url, wf_id)
+    assert _kind_and_links(create_session, base_url, wf_id) == before
+
+
+def test_http_run_input_carries_trigger_source(create_session, base_url, make_workflow):
+    """AC-API-03, AC-API-28: the dry run and the test run both mark the input as an HTTP run."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    dry = _invoke(base_url, created["id"], created["secret"])
+    assert dry.status_code == 200, dry.text[:300]
+    meta = dry.json()["input"]["meta"]
+    assert meta["event_type"] == "webhook"
+    assert meta["trigger_source"] == "http"
+    test = create_session.post(_url(base_url, wf_id, "/test"), json={"data": [{"event": "deploy"}]})
+    assert test.status_code == 200, test.text[:500]
+    assert '"trigger_source":"http"' in test.text.replace(" ", "")
+
+
+def test_endpoint_disabled_hint_names_the_http_endpoint_settings(create_session, base_url, make_workflow):
+    """AC-API-29: the hint says where the endpoint lives, not a trigger step."""
+    wf_id = make_workflow()
+    created = _enable(create_session, base_url, wf_id).json()
+    resp = create_session.put(_url(base_url, wf_id), json={"enabled": False, "auth_mode": "token"})
+    assert resp.status_code == 200, resp.text[:300]
+    call = _invoke(base_url, created["id"], created["secret"])
+    assert call.status_code == 403, call.text[:300]
+    assert call.json()["error_detail"] == "endpoint_disabled"
+    assert call.json()["hint"] == "Turn the endpoint on in the workflow's HTTP endpoint settings"
+
+
+def test_credential_scope_end_to_end(create_session, base_url, make_workflow):
+    """AC-RBAC-06: a credential of A is 401 on B, and B's runs are 404 on A's URL."""
+    a, b = make_workflow(), make_workflow()
+    created_a = _enable(create_session, base_url, a).json()
+    created_b = _enable(create_session, base_url, b).json()
+    assert _invoke(base_url, created_b["id"], created_a["secret"]).status_code == 401
+    run_b = _invoke(base_url, created_b["id"], created_b["secret"], dry_run=False)
+    assert run_b.status_code == 202, run_b.text[:300]
+    poll = requests.get(
+        f"{base_url}api/v2/{ORG_ID}/workflows/hooks/{created_a['id']}/runs/{run_b.json()['run_id']}",
+        headers={"Authorization": f"Bearer {created_a['secret']}"},
+    )
+    assert poll.status_code == 404
+    assert poll.json()["error_detail"] == "run_not_found"
diff --git a/tests/api-testing/tests/workflows/test_workflow_http_trigger_rbac.py b/tests/api-testing/tests/workflows/test_workflow_http_trigger_rbac.py
new file mode 100644
index 0000000000..89824fac22
--- /dev/null
+++ b/tests/api-testing/tests/workflows/test_workflow_http_trigger_rbac.py
@@ -0,0 +1,274 @@
+"""
+Workflow HTTP endpoints: who may read, change, test and reveal (AC-RBAC-05).
+
+With OpenFGA on, the route table decides: GET on `workflows:{id}` reads the endpoint, PUT
+changes it (and, with `require_credential_access`, reveals or mints a credential), POST runs
+the test. A viewer therefore reads but changes nothing; an editor does everything.
+
+With OpenFGA off every member passes the route table, so edit and test are open to all, but
+only Admin/Root may obtain a credential value: the reveal, the secret-returning PUT (create,
+mode switch) and rotate answer 403 to anyone else. The server refuses viewer and editor users
+while OpenFGA is off, so the non-admin member there is a service account.
+
+Each group runs only on the server config it describes (`/api/{org}/config` `rbac_enabled`)
+and skips with the reason otherwise; the whole module skips while `workflow_hooks_enabled`
+is false. Artifacts are namespaced `wf_auto_httprbac_*` and torn down by fixtures.
+"""
+
+import base64
+import os
+import time
+import uuid
+
+import pytest
+import requests
+
+ORG_ID = os.environ.get("TEST_ORG_ID", "default")
+USER_PASSWORD = "Complexpass#123"
+SINK_URL = "http://example.com/sink"
+
+
+def _suffix():
+    return f"{int(time.time())}{uuid.uuid4().hex[:6]}"
+
+
+def _config(session, base_url):
+    resp = session.get(f"{base_url}api/{ORG_ID}/config")
+    return resp.json() if resp.status_code == 200 else {}
+
+
+@pytest.fixture(scope="module", autouse=True)
+def _require_hooks(create_session, base_url):
+    if _config(create_session, base_url).get("workflow_hooks_enabled") is not True:
+        msg = "Workflow HTTP endpoints are off on this server (workflow_hooks_enabled is not true)."
+        if os.environ.get("WORKFLOW_HOOKS_REQUIRED") == "1":
+            pytest.fail(msg)
+        pytest.skip(msg)
+
+
+@pytest.fixture(scope="module")
+def rbac_enabled(create_session, base_url):
+    return _config(create_session, base_url).get("rbac_enabled") is True
+
+
+def _session_for(email, password=USER_PASSWORD):
+    s = requests.Session()
+    token = base64.b64encode(f"{email}:{password}".encode()).decode()
+    s.headers.update({"Authorization": f"Basic {token}"})
+    return s
+
+
+def _workflow_payload(name, dest_name):
+    return {
+        "workflow": {
+            "id": "",
+            "org_id": "",
+            "created_at": 0,
+            "updated_at": 0,
+            "created_by": "",
+            "name": name,
+            "description": "http endpoint rbac automation",
+            "enabled": True,
+            "nodes": [
+                {
+                    "id": "trigger-1",
+                    "data": {"node_type": "workflow_trigger"},
+                    "meta": {"trigger_kind": "alert_fired"},
+                    "position": {"x": 100, "y": 100},
+                    "io_type": "input",
+                },
+                {
+                    "id": "dest-1",
+                    "data": {
+                        "node_type": "destination",
+                        "destination_id": dest_name,
+                        "template_override": None,
+                    },
+                    "position": {"x": 400, "y": 100},
+                    "io_type": "output",
+                },
+            ],
+            "edges": [{"id": "etrigger-1-dest-1", "source": "trigger-1", "target": "dest-1"}],
+        },
+        "trigger_type": "AlertFired",
+    }
+
+
+@pytest.fixture(scope="module")
+def env(create_session, base_url, rbac_enabled):
+    """A workflow with a token endpoint, one user per role the server accepts, and a member."""
+    root = create_session
+    tag = _suffix()
+    dest = f"wf_auto_httprbac_dest_{tag}"
+    resp = root.post(
+        f"{base_url}api/{ORG_ID}/alerts/destinations?module=pipeline",
+        json={"name": dest, "url": SINK_URL, "method": "post", "type": "http"},
+    )
+    assert resp.status_code == 200, resp.text[:300]
+    resp = root.post(
+        f"{base_url}api/{ORG_ID}/workflows", json=_workflow_payload(f"wf_auto_httprbac_{tag}", dest)
+    )
+    assert resp.status_code == 200, resp.text[:300]
+    wf_id = resp.json()["id"]
+    users = {}
+    roles = ("viewer", "editor", "admin") if rbac_enabled else ("admin",)
+    for role in roles:
+        email = f"wf_auto_httprbac_{role}_{tag}@automation.local"
+        resp = root.post(
+            f"{base_url}api/{ORG_ID}/users",
+            json={
+                "email": email,
+                "password": USER_PASSWORD,
+                "first_name": "Http",
+                "last_name": role.title(),
+                "role": role,
+            },
+        )
+        assert resp.status_code in (200, 201), f"user create failed: {resp.status_code} {resp.text[:300]}"
+        users[role] = _session_for(email)
+        users[f"{role}_email"] = email
+    member_email = None
+    if not rbac_enabled:
+        member_email = f"wf_auto_httprbac_member_{tag}@automation.local"
+        resp = root.post(
+            f"{base_url}api/{ORG_ID}/service_accounts",
+            json={"email": member_email, "first_name": "Http", "last_name": "Member"},
+        )
+        assert resp.status_code == 200, f"service account create failed: {resp.status_code} {resp.text[:300]}"
+        users["member"] = _session_for(member_email, resp.json()["token"])
+    created = root.put(
+        f"{base_url}api/{ORG_ID}/workflows/{wf_id}/http_trigger",
+        json={"enabled": True, "auth_mode": "token"},
+    )
+    assert created.status_code == 201, created.text[:300]
+    yield {"wf_id": wf_id, "users": users, "created": created.json(), "dest": dest}
+    root.delete(f"{base_url}api/{ORG_ID}/workflows/{wf_id}/http_trigger")
+    root.delete(f"{base_url}api/{ORG_ID}/workflows/{wf_id}")
+    root.delete(f"{base_url}api/{ORG_ID}/alerts/destinations/{dest}")
+    for role in roles:
+        root.delete(f"{base_url}api/{ORG_ID}/users/{users[f'{role}_email']}")
+    if member_email:
+        root.delete(f"{base_url}api/{ORG_ID}/service_accounts/{member_email}")
+
+
+def _own_endpoint(root, base_url, dest):
+    """A second workflow with a token endpoint, for a test that changes its credentials."""
+    resp = root.post(
+        f"{base_url}api/{ORG_ID}/workflows", json=_workflow_payload(f"wf_auto_httprbac_{_suffix()}", dest)
+    )
+    assert resp.status_code == 200, resp.text[:300]
+    wf_id = resp.json()["id"]
+    created = root.put(
+        f"{base_url}api/{ORG_ID}/workflows/{wf_id}/http_trigger",
+        json={"enabled": True, "auth_mode": "token"},
+    )
+    assert created.status_code == 201, created.text[:300]
+    return {"wf_id": wf_id, "created": created.json()}
+
+
+def _url(base_url, wf_id, rest=""):
+    return f"{base_url}api/{ORG_ID}/workflows/{wf_id}/http_trigger{rest}"
+
+
+def _attempts(session, base_url, env):
+    """Every management call once, the destructive ones last, with each status."""
+    wf_id = env["wf_id"]
+    cred = env["created"]["credentials"][0]["id"]
+    return {
+        "get": session.get(_url(base_url, wf_id)).status_code,
+        "reveal": session.get(_url(base_url, wf_id, f"/credentials/{cred}/secret")).status_code,
+        "test": session.post(_url(base_url, wf_id, "/test"), json={"data": [{}]}).status_code,
+        "update": session.put(
+            _url(base_url, wf_id), json={"enabled": True, "auth_mode": "token"}
+        ).status_code,
+        "rotate": session.post(
+            _url(base_url, wf_id, "/credentials"), json={"overlap_seconds": 0}
+        ).status_code,
+        "revoke": session.delete(_url(base_url, wf_id, "/credentials/not-a-credential")).status_code,
+    }
+
+
+# --------------------------------------------------------------------------- OpenFGA on
+
+
+def test_viewer_can_read_but_not_change_the_endpoint(env, base_url, rbac_enabled):
+    if not rbac_enabled:
+        pytest.skip("needs OpenFGA on (rbac_enabled)")
+    got = _attempts(env["users"]["viewer"], base_url, env)
+    assert got["get"] == 200
+    for action in ("update", "rotate", "revoke", "test"):
+        assert got[action] == 403, (action, got)
+    assert env["users"]["viewer"].delete(_url(base_url, env["wf_id"])).status_code == 403
+
+
+def test_viewer_cannot_reveal(env, base_url, rbac_enabled):
+    if not rbac_enabled:
+        pytest.skip("needs OpenFGA on (rbac_enabled)")
+    cred = env["created"]["credentials"][0]["id"]
+    resp = env["users"]["viewer"].get(_url(base_url, env["wf_id"], f"/credentials/{cred}/secret"))
+    assert resp.status_code == 403
+
+
+def test_editor_can_reveal(env, base_url, rbac_enabled):
+    if not rbac_enabled:
+        pytest.skip("needs OpenFGA on (rbac_enabled)")
+    cred = env["created"]["credentials"][0]["id"]
+    resp = env["users"]["editor"].get(_url(base_url, env["wf_id"], f"/credentials/{cred}/secret"))
+    assert resp.status_code == 200
+    assert resp.json()["secret"] == env["created"]["secret"]
+
+
+def test_permissions_flags_match_the_role(env, base_url, rbac_enabled):
+    if not rbac_enabled:
+        pytest.skip("needs OpenFGA on (rbac_enabled)")
+    expected = {
+        "viewer": {"edit": False, "test": False, "reveal": False},
+        "editor": {"edit": True, "test": True, "reveal": True},
+        "admin": {"edit": True, "test": True, "reveal": True},
+    }
+    for role, flags in expected.items():
+        body = env["users"][role].get(_url(base_url, env["wf_id"])).json()
+        assert body["permissions"] == flags, role
+
+
+def test_editor_can_manage_the_endpoint(env, base_url, rbac_enabled, create_session):
+    if not rbac_enabled:
+        pytest.skip("needs OpenFGA on (rbac_enabled)")
+    # Its rotate revokes the credential, so it runs on its own endpoint, not the shared one.
+    own = _own_endpoint(create_session, base_url, env["dest"])
+    try:
+        got = _attempts(env["users"]["editor"], base_url, own)
+    finally:
+        create_session.delete(f"{base_url}api/{ORG_ID}/workflows/{own['wf_id']}/http_trigger")
+        create_session.delete(f"{base_url}api/{ORG_ID}/workflows/{own['wf_id']}")
+    for action, status in {"get": 200, "reveal": 200, "test": 200, "update": 200, "rotate": 201, "revoke": 404}.items():
+        assert got[action] == status, (action, got)
+
+
+# --------------------------------------------------------------------------- OpenFGA off
+
+
+def test_member_cannot_reveal_or_mint_without_admin(env, base_url, rbac_enabled):
+    if rbac_enabled:
+        pytest.skip("needs OpenFGA off (rbac_enabled false)")
+    member = env["users"]["member"]
+    view = member.get(_url(base_url, env["wf_id"]))
+    assert view.status_code == 200
+    assert view.json()["permissions"] == {"edit": True, "test": True, "reveal": False}
+    got = _attempts(member, base_url, env)
+    for action, status in {"reveal": 403, "rotate": 403, "update": 200, "test": 200, "revoke": 404}.items():
+        assert got[action] == status, (action, got)
+    switch = member.put(_url(base_url, env["wf_id"]), json={"enabled": True, "auth_mode": "signature"})
+    assert switch.status_code == 403
+
+
+def test_admin_can_reveal_with_openfga_off(env, base_url, rbac_enabled, create_session):
+    if rbac_enabled:
+        pytest.skip("needs OpenFGA off (rbac_enabled false)")
+    admin = env["users"]["admin"]
+    view = admin.get(_url(base_url, env["wf_id"])).json()
+    assert view["permissions"] == {"edit": True, "test": True, "reveal": True}
+    cred = view["credentials"][0]["id"]
+    resp = admin.get(_url(base_url, env["wf_id"], f"/credentials/{cred}/secret"))
+    assert resp.status_code == 200
+    assert resp.json()["secret"].startswith("o2wh_")
diff --git a/tests/api-testing/tests/workflows/test_workflows.py b/tests/api-testing/tests/workflows/test_workflows.py
index 3a901dd703..b4937791db 100644
--- a/tests/api-testing/tests/workflows/test_workflows.py
+++ b/tests/api-testing/tests/workflows/test_workflows.py
@@ -231,6 +231,30 @@ def test_workflow_retry_unknown_run(create_session, base_url, workflow):
     assert resp.status_code in (400, 404), f"expected 4xx, got {resp.status_code}: {resp.text[:300]}"
 
 
+def test_trigger_returns_run_id(create_session, base_url, workflow):
+    """AC-ENG-01 — a manual trigger answers with the run id it started, next to the trace id."""
+    resp = create_session.post(
+        f"{base_url}api/{ORG_ID}/workflows/{workflow['id']}/trigger", json=[{"source": "api-test"}]
+    )
+    assert resp.status_code == 200, f"trigger failed: {resp.status_code} {resp.text[:300]}"
+    body = resp.json()
+    assert body.get("trace_id"), f"no trace_id in trigger response: {resp.text[:300]}"
+    assert isinstance(body.get("run_id"), str) and body["run_id"], f"no run_id in trigger response: {resp.text[:300]}"
+
+
+def test_trigger_on_disabled_workflow_is_409(create_session, base_url, workflow):
+    """AC-ENG-02 — triggering a disabled workflow is refused with 409 workflow_disabled and starts no run."""
+    disable = create_session.put(f"{base_url}api/{ORG_ID}/workflows/{workflow['id']}/enable?value=false")
+    assert disable.status_code == 200, f"disable failed: {disable.status_code} {disable.text[:300]}"
+    resp = create_session.post(
+        f"{base_url}api/{ORG_ID}/workflows/{workflow['id']}/trigger", json=[{"source": "api-test"}]
+    )
+    assert resp.status_code == 409, f"expected 409, got {resp.status_code}: {resp.text[:300]}"
+    body = resp.json()
+    assert body.get("error_detail") == "workflow_disabled", f"unexpected body: {resp.text[:300]}"
+    assert "run_id" not in body, f"a refused trigger must not report a run: {resp.text[:300]}"
+
+
 # --------------------------------------------------------------------------- CT-15: security / auth
 
 def test_workflows_requires_auth(base_url):
@@ -246,6 +270,52 @@ def test_workflows_cross_org_isolation(create_session, base_url, workflow):
     assert resp.status_code in (401, 403, 404)
 
 
+# --------------------------------------------------------------------------- incident link and HTTP endpoint flag
+
+def _incident_associated(session, base_url, wf_id):
+    found = _find_in_list(session, base_url, wf_id)
+    assert found is not None
+    return any(a.get("trigger_type") == "IncidentEvent" for a in found.get("associations") or [])
+
+
+def test_switching_an_incident_workflow_to_another_trigger_type_drops_the_incident_association(
+    create_session, base_url, pipeline_destination
+):
+    """AC-API-24 — saving an incident workflow with another trigger type removes the incident link."""
+    payload = _workflow_payload(f"wf_auto_api_{_suffix()}", pipeline_destination)
+    payload["trigger_type"] = "IncidentEvent"
+    created = create_session.post(f"{base_url}api/{ORG_ID}/workflows", json=payload)
+    assert created.status_code == 200, f"create failed: {created.status_code} {created.text[:300]}"
+    wf_id = created.json()["id"]
+    try:
+        assert _incident_associated(create_session, base_url, wf_id)
+        payload["workflow"]["id"] = wf_id
+        payload["trigger_type"] = "AlertResolved"
+        resp = create_session.put(f"{base_url}api/{ORG_ID}/workflows/{wf_id}", json=payload)
+        assert resp.status_code == 200, f"update failed: {resp.status_code} {resp.text[:300]}"
+        assert not _incident_associated(create_session, base_url, wf_id)
+    finally:
+        create_session.delete(f"{base_url}api/{ORG_ID}/workflows/{wf_id}")
+
+
+def test_list_marks_http_endpoint_enabled(create_session, base_url, workflow):
+    """AC-API-17 — `http_endpoint_enabled` follows a live, enabled endpoint."""
+    config = create_session.get(f"{base_url}api/{ORG_ID}/config").json()
+    if config.get("workflow_hooks_enabled") is not True:
+        pytest.skip("Workflow HTTP endpoints are off on this server (workflow_hooks_enabled is not true).")
+    wf_id = workflow["id"]
+    url = f"{base_url}api/{ORG_ID}/workflows/{wf_id}/http_trigger"
+    assert _find_in_list(create_session, base_url, wf_id)["http_endpoint_enabled"] is False
+    resp = create_session.put(url, json={"enabled": True, "auth_mode": "token"})
+    assert resp.status_code == 201, resp.text[:300]
+    try:
+        assert _find_in_list(create_session, base_url, wf_id)["http_endpoint_enabled"] is True
+        create_session.put(url, json={"enabled": False, "auth_mode": "token"})
+        assert _find_in_list(create_session, base_url, wf_id)["http_endpoint_enabled"] is False
+    finally:
+        create_session.delete(url)
+
+
 # --------------------------------------------------------------------------- Fixmes (documented gaps)
 
 @pytest.mark.skip(reason="No public API to seed a genuinely-errored run_id (runs come from an alert firing).")
diff --git a/tests/ui-testing/ci-matrix/ci_matrix.json b/tests/ui-testing/ci-matrix/ci_matrix.json
index 39c7839edc..6c8d083d70 100644
--- a/tests/ui-testing/ci-matrix/ci_matrix.json
+++ b/tests/ui-testing/ci-matrix/ci_matrix.json
@@ -593,6 +593,7 @@
       "tracesTriageLoop.spec.js",
       "traceGenAiParts.spec.js",
       "tracesCharts.spec.js",
+      "tracesRedActions.spec.js",
       "traceSessionReplay.spec.js",
       "traces-jk-navigation.spec.js",
       "service-graph-side-panel.spec.js"
diff --git a/tests/ui-testing/pages/alertsPages/alertSaveQueryModePage.js b/tests/ui-testing/pages/alertsPages/alertSaveQueryModePage.js
index c2e6ac819c..c7bda64fc6 100644
--- a/tests/ui-testing/pages/alertsPages/alertSaveQueryModePage.js
+++ b/tests/ui-testing/pages/alertsPages/alertSaveQueryModePage.js
@@ -280,9 +280,9 @@ export class AlertSaveQueryModePage {
     ).toBeVisible({ timeout: 15000 });
   }
 
-  async expectDetailConditionEmpty() {
+  async expectDetailConditionCountOnly() {
     const condition = this.page.locator(this.locators.detailCondition);
-    await expect(condition).toContainText('—');
+    await expect(condition).toContainText('count >=');
     await expect(condition).not.toContainText('SELECT');
   }
 
diff --git a/tests/ui-testing/pages/logsPages/logsPage.js b/tests/ui-testing/pages/logsPages/logsPage.js
index f721098477..aef687db06 100644
--- a/tests/ui-testing/pages/logsPages/logsPage.js
+++ b/tests/ui-testing/pages/logsPages/logsPage.js
@@ -3447,13 +3447,7 @@ export class LogsPage {
         // Create lives in the Saved views submenu, which only renders while open.
         const createSavedViewBtn = this.page.locator(this.menuCreateSavedViewBtn);
         if (!(await createSavedViewBtn.isVisible({ timeout: 500 }).catch(() => false))) {
-            const submenuTrigger = this.page.locator(this.menuListSavedViewsBtn);
-            if (!(await submenuTrigger.isVisible().catch(() => false))) {
-                await this.page.locator(this.utilitiesMenuButton).click({ force: true });
-                await submenuTrigger.waitFor({ state: 'visible', timeout: 5000 });
-            }
-            await submenuTrigger.click({ force: true });
-            await createSavedViewBtn.waitFor({ state: 'visible', timeout: 5000 });
+            await this.openSavedViewsSubmenu(this.menuCreateSavedViewBtn);
         }
         await createSavedViewBtn.click();
         await this.page.locator(this.savedViewDialog).waitFor({ state: 'visible', timeout: 10000 });
@@ -9035,12 +9029,29 @@ export class LogsPage {
             await listMenuItem.waitFor({ state: 'hidden', timeout: 2000 }).catch(() => {});
         }
         if (!opened) throw new Error('Could not open saved views menu after 3 attempts');
-        // force: true — ODropdown portal transiently detaches items during initial render
-        await listMenuItem.click({ force: true });
-        await this.page.locator(this.savedViewSearchInput).waitFor({ state: 'visible', timeout: 10000 });
+        await this.openSavedViewsSubmenu(this.savedViewSearchInput);
         testLogger.info('Clicked saved views dropdown arrow');
     }
 
+    /**
+     * Open the Saved views submenu of the utilities menu and wait for `targetSelector` inside it.
+     * @param {string} targetSelector - element that only renders while the submenu is open
+     */
+    async openSavedViewsSubmenu(targetSelector) {
+        const trigger = this.page.locator(this.menuListSavedViewsBtn);
+        const target = this.page.locator(targetSelector);
+        for (let attempt = 0; attempt < 3; attempt++) {
+            if (!(await trigger.isVisible().catch(() => false))) {
+                await this.page.locator(this.utilitiesMenuButton).click({ force: true });
+                await trigger.waitFor({ state: 'visible', timeout: 5000 }).catch(() => {});
+            }
+            // No force: a click during the menu's open animation lands outside it and dismisses the whole menu.
+            await trigger.click({ timeout: 5000 }).catch(() => {});
+            if (await target.waitFor({ state: 'visible', timeout: 3000 }).then(() => true).catch(() => false)) return;
+        }
+        await target.waitFor({ state: 'visible', timeout: 5000 });
+    }
+
     /**
      * Expand the saved views dropdown and wait for search input
      * Tries arrow click first, then main button if search input doesn't appear
diff --git a/tests/ui-testing/pages/page-manager.js b/tests/ui-testing/pages/page-manager.js
index 19ab633e88..c4b24a1162 100644
--- a/tests/ui-testing/pages/page-manager.js
+++ b/tests/ui-testing/pages/page-manager.js
@@ -145,6 +145,7 @@ const SchemaLoadPage = require("./generalPages/schemaLoadPage.js");
 const APICleanup = require("./apiCleanup.js");
 const WorkflowsPage = require("./workflowsPages/workflowsPage.js");
 const WorkflowFoldersPage = require("./workflowsPages/workflowFoldersPage.js");
+const WorkflowHttpPage = require("./workflowsPages/workflowHttpPage.js");
 const FleetManagerPage = require("./fleetPages/fleetManagerPage.js");
 const FleetFleetsPage = require("./fleetPages/fleetFleetsPage.js");
 const FleetInstallPage = require("./fleetPages/fleetInstallPage.js");
@@ -266,6 +267,7 @@ class PageManager {
     // ===== WORKFLOWS (v1) PAGE OBJECT =====
     this.workflowsPage = new WorkflowsPage(page);
     this.workflowFoldersPage = new WorkflowFoldersPage(page);
+    this.workflowHttpPage = new WorkflowHttpPage(page);
 
     // ===== FLEET MANAGEMENT PAGE OBJECTS =====
     this.fleetManagerPage = new FleetManagerPage(page);
diff --git a/tests/ui-testing/pages/syntheticsPages/syntheticsResultsPage.js b/tests/ui-testing/pages/syntheticsPages/syntheticsResultsPage.js
index 1839ab9fab..6acf1b0a1d 100644
--- a/tests/ui-testing/pages/syntheticsPages/syntheticsResultsPage.js
+++ b/tests/ui-testing/pages/syntheticsPages/syntheticsResultsPage.js
@@ -83,8 +83,8 @@ export class SyntheticsResultsPage {
     await this.page.goto(
       `/web/synthetics/${checkId}/results/run/${runId}/${executionId}?org_identifier=${orgId}`,
     );
-    await expect(this.page.locator(this.locators.statusBadge)).toBeVisible({ timeout: 30000 });
-    // The badge shows a default before the run query resolves; the skeleton is the real readiness signal.
+    // The badge renders only once the run query resolves, so it gets the query's full budget.
+    await expect(this.page.locator(this.locators.statusBadge)).toBeVisible({ timeout: 60000 });
     await expect(this.page.locator(this.locators.infoSkeleton)).toHaveCount(0, { timeout: 60000 });
     testLogger.navigation('Synthetics run detail', { checkId, runId, executionId });
   }
diff --git a/tests/ui-testing/pages/tracesPages/tracesPage.js b/tests/ui-testing/pages/tracesPages/tracesPage.js
index cb3c831d7a..6b7ddff954 100644
--- a/tests/ui-testing/pages/tracesPages/tracesPage.js
+++ b/tests/ui-testing/pages/tracesPages/tracesPage.js
@@ -6,6 +6,7 @@ import { confirmDraftSignOut } from '../generalPages/draftSignOut.js';
 import { dateTimeButtonLocator, relative30SecondsButtonLocator, absoluteTabLocator, Past30SecondsValue } from '../commonActions.js';
 const testLogger = require('../../playwright-tests/utils/test-logger.js');
 const { isCloudEnvironment } = require('../cloudPages/cloud-env.js');
+const { ingestTraces } = require('../../playwright-tests/utils/trace-ingestion.js');
 
 // Rate and Errors come from web/src/plugins/traces/metrics/metrics.json; Duration is the latency heatmap.
 const TRACES_METRICS_PANELS = ['Rate', 'Errors', 'Duration'];
@@ -13,8 +14,50 @@ const CHART_ZOOM_START_RATIO = 0.35;
 const CHART_ZOOM_END_RATIO = 0.75;
 const CHART_DRAG_STEPS = 20;
 const QUERY_CLEAR_ATTEMPTS = 10;
+const DURATION_UNIT_US = { us: 1, ms: 1000, s: 1000000 };
+
+export function decodedSqlOf(request) {
+  if (request.method() !== 'POST' || !/_search/.test(request.url())) return null;
+  const body = request.postDataJSON?.() ?? null;
+  const query = body?.query ?? {};
+  if (typeof query.sql !== 'string') return null;
+  const base64 = body.encoding === 'base64' || query.encoding === 'base64';
+  return {
+    sql: base64 ? Buffer.from(query.sql, 'base64').toString('utf8') : query.sql,
+    start: query.start_time,
+    end: query.end_time,
+  };
+}
+
+// The comparison sends its own counts and LIMIT 4000 samples; nothing else does.
+export const isComparison = (q) => /^SELECT count\(\*\) AS n\b/.test(q.sql) || /LIMIT 4000$/.test(q.sql);
+export const isCount = (q) => /^SELECT count\(\*\) AS n\b/.test(q.sql);
+// The table search: spans mode posts a base64 `SELECT *` SQL.
+export const isTableSearch = (q) => /^SELECT \* FROM/.test(q.sql);
+
+// The band's bounds in µs as the SQL writes them; a missing side is absent.
+export function bandSql(editorBand) {
+  const toUs = (m) => (m ? Number(m[1]) * DURATION_UNIT_US[m[2]] : null);
+  const lo = toUs(editorBand.match(/duration >= '(\d+)(us|ms|s)'/));
+  const hi = toUs(editorBand.match(/duration < '(\d+)(us|ms|s)'/));
+  return [lo ? `duration >= ${lo}` : '', hi !== null ? `duration < ${hi}` : ''].filter(Boolean).join(' AND ');
+}
 
 export class TracesPage {
+  // Static so a beforeAll, which has no page fixture, can seed through its own context.
+  static async seedTraces(browser, ageMs = 0) {
+    const context = await browser.newContext({ storageState: 'playwright-tests/utils/auth/user.json' });
+    const page = await context.newPage();
+    try {
+      for (const scenario of [{ count: 6, forceScenario: 'error' }, { count: 10, forceScenario: 'success' }]) {
+        const seeded = await ingestTraces(page, scenario.count, { forceScenario: scenario.forceScenario, ageMs });
+        expect(seeded.failed, `Seeding ${scenario.forceScenario} traces must succeed`).toBe(0);
+      }
+    } finally {
+      await context.close();
+    }
+  }
+
   constructor(page) {
     this.page = page;
 
@@ -3355,4 +3398,68 @@ export class TracesPage {
       const cap = setTimeout(finish, maxMs);
     }), { minExamples, maxMs, intervalMs });
   }
+
+  // ============================================
+  // CREATE ALERT / ADD TO DASHBOARD (RED actions)
+  // Source: web/src/plugins/traces/SearchBar.vue, PanelContainer.vue, metrics/TracesLatencyHeatmap.vue
+  // ============================================
+
+  async openMoreActionsMenu() {
+    await this.page.locator('[data-test="traces-search-bar-more-actions-btn"]').click();
+  }
+
+  async clickAddRedChartsToDashboard() {
+    await this.openMoreActionsMenu();
+    await this.page.locator('[data-test="traces-add-red-to-dashboard-btn"]').click();
+  }
+
+  async createAlertFromChartMenu(title) {
+    const panel = this.metricsPanelLocator(title);
+    if (title === 'Duration') {
+      await panel.hover();
+      await this.page.locator('[data-test="traces-duration-actions-btn"]').click();
+      await this.page.locator('[data-test="traces-duration-create-alert"]').click();
+      return;
+    }
+    // Hovering the chart body opens its tooltip, which then covers this button.
+    const actionsBtn = panel.locator('[data-test="panel-explore-actions-btn"]');
+    await actionsBtn.hover();
+    await actionsBtn.click();
+    await this.page.locator('[data-test="panel-explore-create-alert"]').click();
+  }
+
+  async expectAddToDashboardPanels(count) {
+    const dialog = this.page.locator('[data-test="add-to-dashboard-dialog"]');
+    await expect(dialog).toBeVisible({ timeout: 15000 });
+    await expect(this.page.locator('[data-test="add-to-dashboard-notice"]')).toBeVisible();
+    await expect(this.page.locator('[data-test="add-to-dashboard-panel-title"]')).toHaveCount(count);
+  }
+
+  async selectDashboardInAddDialog(title) {
+    await this.page.locator('[data-test="dashboard-dropdown-dashboard-selection-trigger"]').click();
+    await this.page
+      .locator('[data-test="dashboard-dropdown-dashboard-selection-option"]')
+      .filter({ hasText: title })
+      .first()
+      .click();
+  }
+
+  async confirmAddToDashboard() {
+    await this.page
+      .locator('[data-test="add-to-dashboard-dialog"] [data-test="o-dialog-primary-btn"]')
+      .click();
+  }
+
+  async expectAlertFormPrefilledFromTraces() {
+    await expect(this.page).toHaveURL(/prefill=traces/, { timeout: 30000 });
+    await expect(
+      this.page.locator('[data-test="add-alert-stream-type-select-dropdown"]').first()
+    ).toContainText('traces', { timeout: 30000 });
+    await expect(
+      this.page.locator('[data-test="alert-trigger-threshold-input-field"]').first()
+    ).toHaveValue('1');
+    await expect(
+      this.page.locator('[data-test="alert-trigger-operator-select"]').first()
+    ).toContainText('>=');
+  }
 }
diff --git a/tests/ui-testing/pages/workflowsPages/workflowHttpPage.js b/tests/ui-testing/pages/workflowsPages/workflowHttpPage.js
new file mode 100644
index 0000000000..101d7ac304
--- /dev/null
+++ b/tests/ui-testing/pages/workflowsPages/workflowHttpPage.js
@@ -0,0 +1,334 @@
+// Workflow HTTP endpoint page object; OSwitch and OCodeBlock suffix their own ids (`-btn`, `-pre`, `-reveal-btn`, `-copy-btn`).
+
+const { expect } = require('@playwright/test');
+const { getAuthHeaders, getOrgIdentifier } = require('../../playwright-tests/utils/cloud-auth.js');
+const seed = require('./workflowFolderSeed.js');
+
+const PANEL_TIMEOUT_MS = 25000;
+const LIST_TIMEOUT_MS = 45000;
+// Rejections are merged into the endpoint row once a minute (rejections.rs MERGE_EVERY).
+const REJECTION_MERGE_TIMEOUT_MS = 150000;
+
+const api = () => `${process.env.ZO_BASE_URL}/api`;
+const triggerUrl = (id) => `${api()}/${getOrgIdentifier()}/workflows/${id}/http_trigger`;
+
+class WorkflowHttpPage {
+  constructor(page) {
+    this.page = page;
+    this.editorButton = '[data-test="workflow-editor-http-endpoint"]';
+    this.editorChip = '[data-test="workflow-editor-http-endpoint-chip"]';
+    this.nodeBadge = '[data-test="workflow-trigger-http-badge"]';
+    this.panel = '[data-test="workflow-http-panel"]';
+    this.panelClose = '[data-test="workflow-http-panel"] [data-test="o-drawer-close-btn"]';
+    this.kindNote = '[data-test="workflow-http-kind-note"]';
+    this.section = '[data-test="workflow-http-section"]';
+    this.toggle = '[data-test="workflow-http-toggle-btn"]';
+    this.disableConfirm = '[data-test="workflow-http-disable-confirm"]';
+    this.saveAndCreate = '[data-test="workflow-http-save-and-create"]';
+    this.draftBanner = '[data-test="workflow-http-draft-banner"]';
+    this.reveal = '[data-test="workflow-http-reveal"]';
+    this.revealBanner = '[data-test="workflow-http-reveal-banner"]';
+    this.revealDone = '[data-test="workflow-http-reveal-done"]';
+    this.url = '[data-test="workflow-http-url"]';
+    this.tokenPre = '[data-test="workflow-http-token-pre"]';
+    this.tokenReveal = '[data-test="workflow-http-token-reveal-btn"]';
+    this.tokenCopy = '[data-test="workflow-http-token-copy-btn"]';
+    this.sendTest = '[data-test="workflow-http-send-test"]';
+    this.sendTestHint = '[data-test="workflow-http-send-test-hint"]';
+    this.testResult = '[data-test="workflow-http-test-result"]';
+    this.testInput = '[data-test="workflow-http-test-input"]';
+    this.runTestInstead = '[data-test="workflow-http-run-test-instead"]';
+    this.steady = '[data-test="workflow-http-steady"]';
+    this.lastCall = '[data-test="workflow-http-last-call"]';
+    this.credentials = '[data-test="workflow-http-credentials"]';
+    this.retiringRow = '[data-test="workflow-http-credential-retiring"]';
+    this.rotate = '[data-test="workflow-http-rotate"]';
+    this.rotatePopover = '[data-test="workflow-http-rotate-popover"]';
+    this.rotateOverlap = (s) => `[data-test="workflow-http-rotate-overlap-${s}"]`;
+    this.rotateConsequence = '[data-test="workflow-http-rotate-consequence"]';
+    this.rotateConfirm = '[data-test="workflow-http-rotate-confirm"]';
+    // OTooltip owns its bubble's data-test, so the consumer id never reaches the DOM.
+    this.tooltip = '[data-test="o-tooltip-content"]';
+    this.credShow = (id) => `[data-test="workflow-http-credential-${id}-show"]`;
+    this.credCopy = (id) => `[data-test="workflow-http-credential-${id}-copy"]`;
+    this.credValue = (id) => `[data-test="workflow-http-credential-${id}-value"]`;
+    this.credRevoke = (id) => `[data-test="workflow-http-credential-${id}-revoke"]`;
+    this.credRevokeConfirm = (id) => `[data-test="workflow-http-credential-${id}-revoke-confirm"]`;
+    this.revealDenied = '[data-test="workflow-http-credential-reveal-denied"]';
+    this.advanced = '[data-test="workflow-http-advanced"]';
+    this.runTest = '[data-test="workflow-http-run-test"]';
+    this.rejectionsLine = '[data-test="workflow-http-rejections-line"]';
+    this.rejectionsShow = '[data-test="workflow-http-rejections-show"]';
+    this.rejections = '[data-test="workflow-http-rejections"]';
+    this.rejectionRow = (reason) => `[data-test="workflow-http-rejection-${reason}"]`;
+    this.testPayloadFrom = '[data-test="workflow-test-payload-from"]';
+    this.listHttpTag = '[data-test="workflow-list-http-tag"]';
+    this.listMore = (n) => `[data-test="workflow-list-${n}-more-options"]`;
+    this.listMenuPanel = (n) => `[data-test="workflow-list-${n}-http-endpoint"]`;
+    this.listMenuCopy = (n) => `[data-test="workflow-list-${n}-copy-endpoint"]`;
+    this.runsTable = '[data-test="workflow-runs-table"]';
+    this.runsHttpFilter = '[data-test="workflow-runs-trigger-filter-http_request"]';
+    this.runsSearch = '[data-test="workflow-runs-search"]';
+    this.runTestListHint = '[data-test="workflow-http-run-test-list-hint"]';
+  }
+
+  // ---------- API seeding ----------
+
+  /** A published (or draft) Trigger -> Destination workflow; returns { id, name }. */
+  async seedWorkflow({ name, kind = 'alert_fired', draft = false }) {
+    const destName = await seed.createPipelineDestination(this.page, `${name}_dest`);
+    return await seed.createWorkflow(this.page, { name, destName, draft, triggerKind: kind });
+  }
+
+  async deleteWorkflow(id) {
+    await seed.deleteWorkflow(this.page, id).catch(() => {});
+  }
+
+  async deleteDestination(name) {
+    await seed.deleteDestination(this.page, `${name}_dest`).catch(() => {});
+  }
+
+  /** Deletes the published workflow or, failing that, the draft saved under `name`. */
+  async deleteWorkflowNamed(name) {
+    const rows = await seed.listWorkflows(this.page).catch(() => []);
+    const row = rows.find((r) => r.name === name);
+    if (!row) return;
+    const published = await seed.deleteWorkflow(this.page, row.id).catch(() => null);
+    if (published?.ok()) return;
+    await this.page.request
+      .delete(`${api()}/${getOrgIdentifier()}/workflows/${row.id}?draft=true`, {
+        headers: getAuthHeaders(),
+      })
+      .catch(() => {});
+  }
+
+  /** Creates an org viewer over REST; returns its email and password. */
+  async createViewer(suffix) {
+    const email = `wf_auto_viewer_${suffix}@example.com`;
+    const password = `Vw#${suffix}Pass2026!`;
+    const created = await this.page.request.post(`${api()}/${getOrgIdentifier()}/users`, {
+      headers: getAuthHeaders(),
+      data: { email, password, role: 'viewer', first_name: 'wf', last_name: 'viewer' },
+    });
+    expect(created.ok(), await created.text()).toBeTruthy();
+    return { email, password };
+  }
+
+  async deleteUser(email) {
+    const resp = await this.page.request.delete(
+      `${api()}/${getOrgIdentifier()}/users/${encodeURIComponent(email)}`,
+      { headers: getAuthHeaders() }
+    );
+    expect.soft(resp.ok(), `viewer ${email} not deleted: ${resp.status()}`).toBeTruthy();
+  }
+
+  /** Signs `email` in on a fresh page of `ctx` and returns that page. */
+  async loginInContext(ctx, email, password) {
+    const vp = await ctx.newPage();
+    await vp.goto(`${process.env.ZO_BASE_URL}/web/login?org_identifier=${getOrgIdentifier()}`);
+    const internal = vp.locator('[data-test="login-as-internal-user"]');
+    if (await internal.isVisible().catch(() => false)) await internal.click();
+    await vp.locator('[data-test="login-user-id-field"]').fill(email);
+    await vp.locator('[data-test="login-password-field"]').fill(password);
+    await vp.locator('[data-test="login-sign-in"]').click();
+    await vp.waitForURL((u) => !u.pathname.endsWith('/login'), { timeout: 30000 });
+    return vp;
+  }
+
+  /** Turn the endpoint on over REST; the 201 body carries the new token once as `secret`. */
+  async enableEndpointApi(id, authMode = 'token') {
+    const resp = await this.page.request.put(triggerUrl(id), {
+      headers: getAuthHeaders(),
+      data: { enabled: true, auth_mode: authMode },
+    });
+    if (!resp.ok()) throw new Error(`enable endpoint: ${resp.status()} ${(await resp.text()).slice(0, 300)}`);
+    return await resp.json();
+  }
+
+  async getEndpointApi(id) {
+    const resp = await this.page.request.get(triggerUrl(id), { headers: getAuthHeaders() });
+    return { status: resp.status(), body: await resp.json().catch(() => null) };
+  }
+
+  async revealSecretApi(id, credentialId) {
+    const resp = await this.page.request.get(`${triggerUrl(id)}/credentials/${credentialId}/secret`, {
+      headers: getAuthHeaders(),
+    });
+    if (!resp.ok()) throw new Error(`reveal secret: ${resp.status()}`);
+    return (await resp.json()).secret;
+  }
+
+  /** The active credential's id and value, read through the API the panel uses. */
+  async activeSecret(id) {
+    const { body } = await this.getEndpointApi(id);
+    const active = body.credentials.find((c) => c.state === 'active');
+    return { id: active.id, secret: await this.revealSecretApi(id, active.id), url: body.url };
+  }
+
+  /** POST to the public hook URL with plain fetch, so no browser cookie reaches the hook route. */
+  async invokeHook(url, { token, body = { service: 'checkout', deploy_id: 'd-4821' }, headers = {}, dryRun = false } = {}) {
+    const h = { 'Content-Type': 'application/json', ...headers };
+    if (token) h.Authorization = `Bearer ${token}`;
+    const target = dryRun ? `${url}${url.includes('?') ? '&' : '?'}dry_run=true` : url;
+    const resp = await fetch(target, { method: 'POST', headers: h, body: JSON.stringify(body) });
+    const text = await resp.text();
+    let json = null;
+    try {
+      json = JSON.parse(text);
+    } catch (_e) {
+      json = null;
+    }
+    return { status: resp.status, body: json };
+  }
+
+  /** Wait until the once-a-minute merge has recorded `reason` for this endpoint. */
+  async waitForRejection(id, reason) {
+    await expect
+      .poll(async () => Boolean((await this.getEndpointApi(id)).body?.rejections?.[reason]), {
+        timeout: REJECTION_MERGE_TIMEOUT_MS,
+        intervals: [5000],
+        message: `rejection "${reason}" never merged`,
+      })
+      .toBe(true);
+  }
+
+  async waitForHttpRun(workflowId, runId) {
+    await expect
+      .poll(
+        async () => {
+          const now = Date.now() * 1000;
+          const resp = await this.page.request.get(
+            `${api()}/${getOrgIdentifier()}/workflows/${workflowId}/history?start_time=${now - 3600e6}&end_time=${now + 60e6}`,
+            { headers: getAuthHeaders() }
+          );
+          const rows = resp.ok() ? await resp.json() : [];
+          return rows.some((r) => r.run_id === runId && r.status !== 'queued' && r.status !== 'running');
+        },
+        { timeout: 60000, intervals: [2000], message: `HTTP run ${runId} never finished` }
+      )
+      .toBe(true);
+  }
+
+  // ---------- panel ----------
+
+  async grantClipboard() {
+    await this.page.context().grantPermissions(['clipboard-read', 'clipboard-write'], {
+      origin: new URL(process.env.ZO_BASE_URL).origin,
+    });
+  }
+
+  async clipboardText() {
+    return await this.page.evaluate(() => navigator.clipboard.readText());
+  }
+
+  async openFromEditor() {
+    await this.page.locator(this.editorButton).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.panel).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async openFromList(name) {
+    await this.page.locator(this.listMore(name)).first().click({ timeout: LIST_TIMEOUT_MS });
+    await this.page.locator(this.listMenuPanel(name)).first().click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.panel).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async copyUrlFromList(name) {
+    await this.page.locator(this.listMore(name)).first().click({ timeout: LIST_TIMEOUT_MS });
+    await this.page.locator(this.listMenuCopy(name)).first().click({ timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async closePanel() {
+    await this.page.locator(this.panelClose).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.panel).waitFor({ state: 'hidden', timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async panelText() {
+    return (await this.page.locator(this.panel).innerText()).replace(/\s+/g, ' ');
+  }
+
+  async turnOn() {
+    await this.page.locator(this.toggle).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.reveal).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async tokenOnScreen() {
+    return ((await this.page.locator(this.tokenPre).innerText()) || '').trim();
+  }
+
+  async revealToken() {
+    await this.page.locator(this.tokenReveal).click({ timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async copyToken() {
+    await this.page.locator(this.tokenCopy).click({ timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async urlOnScreen() {
+    return ((await this.page.locator(this.url).innerText()) || '').trim();
+  }
+
+  /** Send test request (dry run) and return the result box text. */
+  async sendDryRun() {
+    await this.page.locator(this.sendTest).click({ timeout: PANEL_TIMEOUT_MS });
+    const box = this.page.locator(this.testResult);
+    await box.waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+    return (await box.innerText()).replace(/\s+/g, ' ');
+  }
+
+  async finishReveal() {
+    await this.page.locator(this.revealDone).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.steady).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async rotateWithOverlap(seconds) {
+    await this.page.locator(this.rotate).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.rotatePopover).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.rotateOverlap(seconds)).click({ timeout: PANEL_TIMEOUT_MS });
+    const consequence = (await this.page.locator(this.rotateConsequence).innerText()).trim();
+    await this.page.locator(this.rotateConfirm).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.retiringRow).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+    return consequence;
+  }
+
+  /** Rotate with no live credential: the popover offers no overlap, confirm mints a new one. */
+  async rotateWithoutCredential() {
+    await this.page.locator(this.rotate).click({ timeout: PANEL_TIMEOUT_MS });
+    const popover = this.page.locator(this.rotatePopover);
+    await popover.waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+    const lead = (await popover.innerText()).replace(/\s+/g, ' ');
+    const overlapOptions = await this.page.locator(this.rotateOverlap(3600)).count();
+    await this.page.locator(this.rotateConfirm).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.revealBanner).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+    return { lead, overlapOptions };
+  }
+
+  async revokeCredential(credentialId) {
+    await this.page.locator(this.credRevoke(credentialId)).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.credRevokeConfirm(credentialId)).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.credRevoke(credentialId)).waitFor({ state: 'detached', timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async showRejections() {
+    await this.page.locator(this.rejectionsLine).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.rejectionsShow).click({ timeout: PANEL_TIMEOUT_MS });
+    await this.page.locator(this.rejections).waitFor({ state: 'visible', timeout: PANEL_TIMEOUT_MS });
+  }
+
+  // ---------- runs ----------
+
+  async goToRuns(workflowId) {
+    const url = `${process.env.ZO_BASE_URL}/web/workflows/runs?id=${workflowId}&org_identifier=${getOrgIdentifier()}`;
+    await this.page.goto(url, { timeout: 60000 });
+    await this.page.locator(this.runsTable).first().waitFor({ state: 'visible', timeout: LIST_TIMEOUT_MS });
+  }
+
+  async filterRunsToHttp() {
+    await this.page.locator(this.runsHttpFilter).first().click({ timeout: PANEL_TIMEOUT_MS });
+  }
+
+  async runsTableText() {
+    return (await this.page.locator(this.runsTable).first().innerText()).replace(/\s+/g, ' ');
+  }
+}
+
+module.exports = WorkflowHttpPage;
diff --git a/tests/ui-testing/playwright-tests/Alerts/alerts-save-query-mode.spec.js b/tests/ui-testing/playwright-tests/Alerts/alerts-save-query-mode.spec.js
index 56c7bba526..f1557dd2fc 100644
--- a/tests/ui-testing/playwright-tests/Alerts/alerts-save-query-mode.spec.js
+++ b/tests/ui-testing/playwright-tests/Alerts/alerts-save-query-mode.spec.js
@@ -317,14 +317,13 @@ test.describe('Alerts — Choose Query Mode on save', {
     expect(saved.query_condition.multi_time_range).toEqual([]);
   });
 
-  test('the detail page shows no condition for a Builder alert that still stores SQL', async ({ page }) => {
+  test('the detail page shows the Builder count, not the SQL a Builder alert still stores', async ({ page }) => {
     const builderId = await seed(page, builderEmptyWithSql(uniq('auto_qm_detbuilder')));
     const sqlId = await seed(page, sqlWithBuilderCondition(uniq('auto_qm_detsql')));
 
-    // The stored SQL never runs on a Builder alert, so showing it here would
-    // claim the alert watches something it does not.
+    // The stored SQL never runs on a Builder alert; with no filters it counts every row.
     await pm.alertSaveQueryModePage.openDetailConfiguration(builderId);
-    await pm.alertSaveQueryModePage.expectDetailConditionEmpty();
+    await pm.alertSaveQueryModePage.expectDetailConditionCountOnly();
 
     // A SQL alert still shows the query it actually evaluates.
     await pm.alertSaveQueryModePage.openDetailConfiguration(sqlId);
diff --git a/tests/ui-testing/playwright-tests/RUM-Analytics/rum-product-analytics.spec.js b/tests/ui-testing/playwright-tests/RUM-Analytics/rum-product-analytics.spec.js
index adb994eb34..7aeb45850e 100644
--- a/tests/ui-testing/playwright-tests/RUM-Analytics/rum-product-analytics.spec.js
+++ b/tests/ui-testing/playwright-tests/RUM-Analytics/rum-product-analytics.spec.js
@@ -914,7 +914,9 @@ test.describe('RUM Product Analytics', () => {
       await expect(pa.addToDashboardDialog).toBeVisible();
       await expect(pa.addToDashboardNotice).toBeVisible();
       await pa.pickOption('dashboard-dropdown-dashboard-selection', { label: title, search: title });
-      await page.locator('[data-test="metrics-new-dashboard-panel-title-field"]').fill('Funnel e2e');
+      const panelTitles = pa.addToDashboardDialog.locator('[data-test="add-to-dashboard-panel-title"]');
+      await expect(panelTitles).toHaveCount(1);
+      await expect(panelTitles.first()).toContainText('Funnel:');
       const add = pa.addToDashboardDialog.locator('[data-test="o-dialog-primary-btn"]');
       await expect(add).toBeEnabled({ timeout: 15000 });
       await add.click();
diff --git a/tests/ui-testing/playwright-tests/Traces/tracesRedActions.spec.js b/tests/ui-testing/playwright-tests/Traces/tracesRedActions.spec.js
new file mode 100644
index 0000000000..fffa88e4a1
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Traces/tracesRedActions.spec.js
@@ -0,0 +1,96 @@
+// tracesRedActions.spec.js — Create alert and Add to dashboard from the Traces RED charts and the ≡ menu.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const { ingestTraces } = require('../utils/trace-ingestion.js');
+
+const RED_TITLE_PREFIXES = ['Rate · ', 'Errors · ', 'Duration · '];
+
+test.describe('Traces RED actions', () => {
+  let pm;
+
+  // The Errors seed query needs at least one error span in the window.
+  test.beforeAll(async ({ browser }) => {
+    test.setTimeout(120000);
+    const context = await browser.newContext({
+      storageState: 'playwright-tests/utils/auth/user.json',
+    });
+    const page = await context.newPage();
+    try {
+      await ingestTraces(page, 6, { forceScenario: 'error' });
+      await ingestTraces(page, 10, { forceScenario: 'success' });
+    } catch (e) {
+      testLogger.warn('RED actions trace seeding failed (continuing)', { error: e.message });
+    } finally {
+      await context.close();
+    }
+  });
+
+  test.beforeEach(async ({ page }, testInfo) => {
+    testLogger.testStart(testInfo.title, testInfo.file);
+    await navigateToBase(page);
+    pm = new PageManager(page);
+    await page.waitForLoadState('networkidle');
+    await pm.tracesPage.navigateToTraces();
+    await pm.tracesPage.isStreamSelectVisible();
+    await pm.tracesPage.selectTraceStream('default');
+  });
+
+  test.afterEach(async ({}, testInfo) => {
+    testLogger.testEnd(testInfo.title, testInfo.status);
+  });
+
+  async function searchAndShowCharts() {
+    await pm.tracesPage.setupTraceSearch();
+    await pm.tracesPage.waitForTraceSearchResults();
+    expect(await pm.tracesPage.hasTraceResults(), 'Trace results must be available').toBeTruthy();
+    expect(await pm.tracesPage.ensureMetricsDashboardVisible(), 'RED charts must show').toBeTruthy();
+    const rendered = await pm.tracesPage.waitForMetricsPanels();
+    expect(rendered, `Panels rendered: ${rendered.join(', ')}`).toContain('Errors');
+  }
+
+  test('Errors ⋮ → Create alert opens the alert form with a traces HAVING query and a ≥ 1 row trigger', {
+    tag: ['@tracesRedActions', '@traces', '@P0', '@all'],
+  }, async ({ page }) => {
+    await searchAndShowCharts();
+
+    await pm.tracesPage.createAlertFromChartMenu('Errors');
+
+    await pm.createAlertFromSourceDialog.expectDialogVisible();
+    const preview = pm.createAlertFromSourceDialog.queryPreview;
+    await expect(preview).toBeVisible({ timeout: 15000 });
+    await expect(preview).toContainText(/HAVING/i);
+    await expect(preview).toContainText("span_status = 'ERROR'");
+
+    await pm.createAlertFromSourceDialog.clickContinue();
+    await pm.tracesPage.expectAlertFormPrefilledFromTraces();
+  });
+
+  test('≡ → Add RED charts to dashboard adds Rate, Errors and Duration panels', {
+    tag: ['@tracesRedActions', '@traces', '@P0', '@all'],
+  }, async ({ page }) => {
+    const dashboardTitle = `traces_red_${Date.now()}`;
+    const { dashboardId, folderId } = await pm.apiCleanup.createDashboardWithPanel(
+      dashboardTitle,
+      'seed',
+      'e2e_automate',
+    );
+
+    try {
+      await searchAndShowCharts();
+
+      await pm.tracesPage.clickAddRedChartsToDashboard();
+      await pm.tracesPage.expectAddToDashboardPanels(3);
+      await pm.tracesPage.selectDashboardInAddDialog(dashboardTitle);
+      await pm.tracesPage.confirmAddToDashboard();
+
+      await expect(page).toHaveURL(new RegExp(`dashboard=${dashboardId}`), { timeout: 30000 });
+      for (const prefix of RED_TITLE_PREFIXES) {
+        await expect(page.getByText(prefix, { exact: false }).first()).toBeVisible({ timeout: 30000 });
+      }
+    } finally {
+      await pm.apiCleanup.deleteDashboard(dashboardId, folderId);
+    }
+  });
+});
diff --git a/tests/ui-testing/playwright-tests/Traces/tracesTriageLoop.spec.js b/tests/ui-testing/playwright-tests/Traces/tracesTriageLoop.spec.js
index 9f5a77500d..68a783c97a 100644
--- a/tests/ui-testing/playwright-tests/Traces/tracesTriageLoop.spec.js
+++ b/tests/ui-testing/playwright-tests/Traces/tracesTriageLoop.spec.js
@@ -3,39 +3,21 @@
 const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
 const testLogger = require('../utils/test-logger.js');
 const PageManager = require('../../pages/page-manager.js');
-const { ingestTraces } = require('../utils/trace-ingestion.js');
+const {
+  TracesPage,
+  decodedSqlOf,
+  isComparison,
+  isCount,
+  isTableSearch,
+  bandSql,
+} = require('../../pages/tracesPages/tracesPage.js');
 
 const USER_FILTER = "duration >= '1ms'";
-const DURATION_UNIT_US = { us: 1, ms: 1000, s: 1000000 };
 const MINUTE_US = 60 * 1000000;
 const HOUR_US = 60 * MINUTE_US;
 
-function decodedSqlOf(request) {
-  if (request.method() !== 'POST' || !/_search/.test(request.url())) return null;
-  const body = request.postDataJSON?.() ?? null;
-  const query = body?.query ?? {};
-  if (typeof query.sql !== 'string') return null;
-  const base64 = body.encoding === 'base64' || query.encoding === 'base64';
-  return {
-    sql: base64 ? Buffer.from(query.sql, 'base64').toString('utf8') : query.sql,
-    start: query.start_time,
-    end: query.end_time,
-  };
-}
-
-// The comparison sends its own counts and LIMIT 4000 samples; nothing else does.
-const isComparison = (q) => /^SELECT count\(\*\) AS n\b/.test(q.sql) || /LIMIT 4000$/.test(q.sql);
-const isCount = (q) => /^SELECT count\(\*\) AS n\b/.test(q.sql);
-// The table search: spans mode posts a base64 `SELECT *` SQL.
-const isTableSearch = (q) => /^SELECT \* FROM/.test(q.sql);
-
-// The band's bounds in µs as the SQL writes them; a missing side is absent.
-function bandSql(editorBand) {
-  const toUs = (m) => (m ? Number(m[1]) * DURATION_UNIT_US[m[2]] : null);
-  const lo = toUs(editorBand.match(/duration >= '(\d+)(us|ms|s)'/));
-  const hi = toUs(editorBand.match(/duration < '(\d+)(us|ms|s)'/));
-  return [lo ? `duration >= ${lo}` : '', hi !== null ? `duration < ${hi}` : ''].filter(Boolean).join(' AND ');
-}
+// The default brush spans 35-75% of a 15m range (~10-4 min ago); spans stamped now sit right of it.
+const BRUSH_WINDOW_AGE_MS = 6 * 60 * 1000;
 
 test.describe('Traces triage loop', () => {
   let pm;
@@ -43,16 +25,7 @@ test.describe('Traces triage loop', () => {
 
   test.beforeAll(async ({ browser }) => {
     test.setTimeout(120000);
-    const context = await browser.newContext({ storageState: 'playwright-tests/utils/auth/user.json' });
-    const page = await context.newPage();
-    try {
-      for (const scenario of [{ count: 6, forceScenario: 'error' }, { count: 10, forceScenario: 'success' }]) {
-        const seeded = await ingestTraces(page, scenario.count, { forceScenario: scenario.forceScenario });
-        expect(seeded.failed, `Seeding ${scenario.forceScenario} traces must succeed`).toBe(0);
-      }
-    } finally {
-      await context.close();
-    }
+    await TracesPage.seedTraces(browser);
   });
 
   test.beforeEach(async ({ page }, testInfo) => {
@@ -246,8 +219,9 @@ test.describe('Traces triage loop', () => {
 
   test('P1: an Errors brush compares error spans with the rest of its window', {
     tag: ['@tracesTriageLoop', '@traces', '@functional', '@P1', '@all'],
-  }, async ({ page }) => {
+  }, async ({ page, browser }) => {
     test.setTimeout(240000);
+    await TracesPage.seedTraces(browser, BRUSH_WINDOW_AGE_MS);
     await searchWith('');
     const preBox = queries.filter(isTableSearch).at(-1);
     expect(await pm.tracesPage.zoomOnMetricsPanel('Errors')).toBeTruthy();
@@ -267,8 +241,9 @@ test.describe('Traces triage loop', () => {
 
   test('P1: a Rate brush compares its window with the rest of the range', {
     tag: ['@tracesTriageLoop', '@traces', '@functional', '@P1', '@all'],
-  }, async ({ page }) => {
+  }, async ({ page, browser }) => {
     test.setTimeout(240000);
+    await TracesPage.seedTraces(browser, BRUSH_WINDOW_AGE_MS);
     await searchWith('');
     expect(await pm.tracesPage.zoomOnMetricsPanel('Rate')).toBeTruthy();
     await page.waitForTimeout(2000);
@@ -296,8 +271,9 @@ test.describe('Traces triage loop across time zones', () => {
 
   test('P2: an Errors brush under an Asia/Kolkata app zone keeps the brushed window', {
     tag: ['@tracesTriageLoop', '@traces', '@functional', '@P2', '@all'],
-  }, async ({ page }) => {
+  }, async ({ page, browser }) => {
     test.setTimeout(240000);
+    await TracesPage.seedTraces(browser, BRUSH_WINDOW_AGE_MS);
     const queries = [];
     page.on('request', (r) => {
       const q = decodedSqlOf(r);
diff --git a/tests/ui-testing/playwright-tests/Workflows/workflows-http-endpoint.spec.js b/tests/ui-testing/playwright-tests/Workflows/workflows-http-endpoint.spec.js
new file mode 100644
index 0000000000..5957595ba2
--- /dev/null
+++ b/tests/ui-testing/playwright-tests/Workflows/workflows-http-endpoint.spec.js
@@ -0,0 +1,278 @@
+// Workflows HTTP endpoint (HTTP-01..08): panel from the editor and the list, reveal, dry run, drafts, rotate, rejections, runs, viewer.
+
+const { test, expect, navigateToBase } = require('../utils/enhanced-baseFixtures.js');
+const testLogger = require('../utils/test-logger.js');
+const PageManager = require('../../pages/page-manager.js');
+const seed = require('../../pages/workflowsPages/workflowFolderSeed.js');
+
+const uniq = () => `${Date.now().toString(36).slice(-5)}${Math.random().toString(36).slice(2, 5)}`;
+const MASK = '•';
+// Secrets are compared inside booleans, so a failing assertion never prints one into the report or trace.
+const sameValue = (value, secret) => value === secret;
+const shownInFull = (value, secret) =>
+  !value.includes(MASK) && value.length === secret.length && value.startsWith(secret.slice(0, 5));
+
+test.describe(
+  'Workflows HTTP endpoint',
+  { tag: ['@workflows', '@workflowsHttp', '@enterprise', '@all'] },
+  () => {
+    let pm;
+    let http;
+    const cleanup = [];
+
+    test.beforeEach(async ({ page }, testInfo) => {
+      testLogger.testStart(testInfo.title, testInfo.file);
+      await navigateToBase(page);
+      pm = new PageManager(page);
+      http = pm.workflowHttpPage;
+      await pm.workflowsPage.assertEnabled();
+      await http.grantClipboard();
+    });
+
+    test.afterEach(async () => {
+      while (cleanup.length) {
+        const { id, name } = cleanup.pop();
+        if (id) await http.deleteWorkflow(id);
+        else await http.deleteWorkflowNamed(name);
+        await http.deleteDestination(name);
+      }
+    });
+
+    const seeded = async (opts) => {
+      const wf = await http.seedWorkflow(opts);
+      cleanup.push(wf);
+      return wf;
+    };
+
+    test('HTTP-01: alert workflow gets an endpoint from the editor header, reveal, copy and dry run', async ({ page }) => {
+      const wf = await seeded({ name: `wf_auto_http_a_${uniq()}` });
+      await pm.workflowsPage.goToList();
+      await pm.workflowsPage.openEdit(wf.name);
+
+      await expect(page.locator(http.editorButton)).toBeVisible();
+      await expect(page.locator(http.editorChip)).toHaveCount(0);
+      await expect(page.locator(http.nodeBadge)).toHaveCount(0);
+
+      await http.openFromEditor();
+      await expect(page.locator(http.kindNote)).toContainText('Alert Fired');
+      expect(await http.panelText()).toContain(wf.name);
+
+      await http.turnOn();
+      const { secret, url } = await http.activeSecret(wf.id);
+      const masked = await http.tokenOnScreen();
+      expect(masked).toContain(MASK);
+      expect(masked.includes(secret), 'the masked token holds the plaintext').toBe(false);
+      expect(await http.urlOnScreen()).toContain(url);
+
+      await http.revealToken();
+      await expect.poll(async () => shownInFull(await http.tokenOnScreen(), secret)).toBe(true);
+      await http.copyToken();
+      await expect.poll(async () => sameValue(await http.clipboardText(), secret)).toBe(true);
+
+      const result = await http.sendDryRun();
+      expect(result).toContain('200');
+      await expect(page.locator(http.testInput)).toContainText('"trigger_source": "http"');
+
+      await http.finishReveal();
+      await http.closePanel();
+      await expect(page.locator(http.editorChip)).toBeVisible();
+      await expect(page.locator(http.nodeBadge)).toBeVisible();
+
+      // The dry run never started a run, so the endpoint still has no last call.
+      const { body } = await http.getEndpointApi(wf.id);
+      expect(body.last_call).toBeNull();
+      testLogger.info('endpoint created from the editor', { id: wf.id });
+    });
+
+    test('HTTP-02: incident workflow gets an endpoint from the list row menu', async ({ page }) => {
+      const wf = await seeded({ name: `wf_auto_http_i_${uniq()}`, kind: 'incident_event' });
+      await pm.workflowsPage.goToList();
+      await pm.workflowsPage.search(wf.name);
+      await pm.workflowsPage.rowByName(wf.name).first().waitFor({ state: 'visible', timeout: 45000 });
+      await expect(page.locator(http.listHttpTag)).toHaveCount(0);
+
+      await http.openFromList(wf.name);
+      await expect(page.locator(http.kindNote)).toContainText('Incident Event');
+      expect(await http.panelText()).toContain('Incident Event workflow');
+      await http.turnOn();
+      await http.finishReveal();
+      await expect(page.locator(http.runTest)).toHaveCount(0);
+      await http.closePanel();
+
+      await pm.workflowsPage.refreshList();
+      await pm.workflowsPage.search(wf.name);
+      await expect(page.locator(http.listHttpTag).first()).toBeVisible();
+
+      await pm.workflowsPage.openEdit(wf.name);
+      await expect(page.locator(http.editorChip)).toBeVisible();
+      await expect(page.locator(http.nodeBadge)).toBeVisible();
+      await page.locator(http.nodeBadge).click();
+      await page.locator(http.steady).waitFor({ state: 'visible', timeout: 25000 });
+    });
+
+    test('HTTP-03: unsaved workflow saves a draft with its endpoint, is refused until published', async ({ page }) => {
+      const id = uniq();
+      const name = `wf_auto_http_d_${id}`;
+      // Registered before anything exists, so a failure at any step still removes what was made.
+      const created = { id: null, name };
+      cleanup.push(created);
+      const destName = await seed.createPipelineDestination(page, `${name}_dest`);
+      await pm.workflowsPage.goToAdd('alert_fired');
+      await pm.workflowsPage.setName(name);
+      await pm.workflowsPage.addNodeFromPalette('destination');
+      await pm.workflowsPage.pickExistingDestination(destName);
+      await pm.workflowsPage.saveNodeDrawer();
+
+      await http.openFromEditor();
+      await expect(page.locator(http.toggle)).toHaveCount(0);
+      await page.locator(http.saveAndCreate).click();
+      await page.locator(http.reveal).waitFor({ state: 'visible', timeout: 25000 });
+      await expect(page.locator(http.draftBanner)).toContainText('This workflow is a draft');
+      await expect(page.locator(http.sendTest)).toHaveCount(0);
+
+      await http.finishReveal();
+      await http.closePanel();
+      await expect(page.locator(http.editorChip)).toBeVisible();
+      await pm.workflowsPage.expectDraftTagInEditor();
+
+      const rows = await seed.listWorkflows(page);
+      const draft = rows.find((r) => r.name === name);
+      expect(draft, 'draft row saved with the endpoint').toBeTruthy();
+      created.id = draft.id;
+      const { secret, url } = await http.activeSecret(draft.id);
+      expect((await http.invokeHook(url, { token: secret })).status).toBe(403);
+
+      await pm.workflowsPage.publishAndExpectAccepted();
+      await pm.workflowsPage.skipLinkAlerts();
+      await pm.workflowsPage.goToList();
+      expect(await pm.workflowsPage.isPresent(name)).toBeTruthy();
+      await expect(page.locator(http.listHttpTag).first()).toBeVisible();
+
+      const published = await http.invokeHook(url, { token: secret });
+      expect(published.status).toBe(202);
+      testLogger.info('draft endpoint answers 202 after publish', { run: published.body?.run_id });
+    });
+
+    test('HTTP-04: rotate keeps the old token for the overlap, revoke ends it', async ({ page }) => {
+      const wf = await seeded({ name: `wf_auto_http_r_${uniq()}` });
+      await http.enableEndpointApi(wf.id);
+      const old = await http.activeSecret(wf.id);
+      await pm.workflowsPage.goToList();
+      await pm.workflowsPage.openEdit(wf.name);
+      await http.openFromEditor();
+      await page.locator(http.steady).waitFor({ state: 'visible', timeout: 25000 });
+
+      const consequence = await http.rotateWithOverlap(3600);
+      expect(consequence.length).toBeGreaterThan(0);
+      await expect(page.locator(http.revealBanner)).toBeVisible();
+      await expect(page.locator(http.rotate)).toHaveAttribute('aria-disabled', 'true');
+      await page.locator(http.rotate).hover();
+      await expect(page.locator(http.tooltip).filter({ hasText: 'Revoke the retiring' })).toBeVisible();
+
+      // Both tokens stay viewable from their rows while the old one retires.
+      await page.locator(http.credShow(old.id)).click();
+      await expect
+        .poll(async () => (await page.locator(http.credValue(old.id)).innerText()).includes(old.secret))
+        .toBe(true);
+
+      const fresh = await http.activeSecret(wf.id);
+      expect(sameValue(fresh.secret, old.secret), 'rotate minted the same value').toBe(false);
+      expect((await http.invokeHook(old.url, { token: old.secret, dryRun: true })).status).toBe(200);
+      expect((await http.invokeHook(old.url, { token: fresh.secret, dryRun: true })).status).toBe(200);
+
+      await http.revokeCredential(old.id);
+      await expect(page.locator(http.retiringRow)).toHaveCount(0);
+      expect((await http.invokeHook(old.url, { token: old.secret, dryRun: true })).status).toBe(401);
+      expect((await http.invokeHook(old.url, { token: fresh.secret, dryRun: true })).status).toBe(200);
+      await expect(page.locator(http.rotate)).not.toHaveAttribute('aria-disabled', 'true');
+
+      // A leaked token is revoked first; Rotate must still mint a working one.
+      await http.finishReveal();
+      await http.revokeCredential(fresh.id);
+      expect((await http.invokeHook(old.url, { token: fresh.secret, dryRun: true })).status).toBe(401);
+      const { lead, overlapOptions } = await http.rotateWithoutCredential();
+      expect(lead).toContain('No token is active');
+      expect(overlapOptions).toBe(0);
+      await expect(page.locator(http.revealBanner)).toBeVisible();
+      const minted = await http.activeSecret(wf.id);
+      expect(minted.id === fresh.id).toBe(false);
+      expect((await http.invokeHook(old.url, { token: minted.secret, dryRun: true })).status).toBe(200);
+    });
+
+    test('HTTP-05: rejected calls show their reasons in the panel', async ({ page }) => {
+      test.setTimeout(5 * 60 * 1000);
+      const wf = await seeded({ name: `wf_auto_http_x_${uniq()}` });
+      const view = await http.enableEndpointApi(wf.id);
+      expect((await http.invokeHook(view.url, { token: 'o2wh_not_a_real_token' })).status).toBe(401);
+      const inUrl = await http.invokeHook(`${view.url}?token=${view.secret}`, { token: view.secret });
+      expect(inUrl.status).toBe(400);
+      expect(inUrl.body?.error_detail).toBe('credential_in_url');
+      await http.waitForRejection(wf.id, 'invalid_token');
+      await http.waitForRejection(wf.id, 'credential_in_url');
+
+      await pm.workflowsPage.goToList();
+      await pm.workflowsPage.openEdit(wf.name);
+      await http.openFromEditor();
+      await http.showRejections();
+      await expect(page.locator(http.rejectionRow('invalid_token'))).toBeVisible();
+      await expect(page.locator(http.rejectionRow('credential_in_url'))).toBeVisible();
+    });
+
+    test('HTTP-06: list row carries the HTTP tag and copies the endpoint URL', async ({ page }) => {
+      const wf = await seeded({ name: `wf_auto_http_l_${uniq()}` });
+      const view = await http.enableEndpointApi(wf.id);
+      await pm.workflowsPage.goToList();
+      await pm.workflowsPage.search(wf.name);
+      await pm.workflowsPage.rowByName(wf.name).first().waitFor({ state: 'visible', timeout: 45000 });
+      await expect(page.locator(http.listHttpTag).first()).toBeVisible();
+
+      await http.copyUrlFromList(wf.name);
+      await expect.poll(() => http.clipboardText()).toBe(view.url);
+
+      await http.openFromList(wf.name);
+      await page.locator(http.steady).waitFor({ state: 'visible', timeout: 25000 });
+      await expect(page.locator(http.runTestListHint)).toBeVisible();
+    });
+
+    test('HTTP-07: an HTTP-sourced run shows in the runs view under the HTTP filter', async ({ page }) => {
+      const wf = await seeded({ name: `wf_auto_http_h_${uniq()}` });
+      const view = await http.enableEndpointApi(wf.id);
+      const key = `wf-auto-${uniq()}`;
+      const call = await http.invokeHook(view.url, { token: view.secret, headers: { 'Idempotency-Key': key } });
+      expect(call.status).toBe(202);
+      const runId = call.body.run_id;
+      await http.waitForHttpRun(wf.id, runId);
+
+      await http.goToRuns(wf.id);
+      await expect.poll(() => http.runsTableText(), { timeout: 30000 }).toContain('HTTP request');
+      await http.filterRunsToHttp();
+      await expect.poll(() => http.runsTableText(), { timeout: 30000 }).toContain(key);
+      expect(await http.runsTableText()).toContain(runId.slice(0, 8));
+    });
+
+    test('HTTP-08: a viewer sees the endpoint read-only', async ({ browser }) => {
+      const wf = await seeded({ name: `wf_auto_http_v_${uniq()}` });
+      await http.enableEndpointApi(wf.id);
+      const { email, password } = await http.createViewer(uniq());
+      const ctx = await browser.newContext({ storageState: { cookies: [], origins: [] } });
+      try {
+        const vp = await http.loginInContext(ctx, email, password);
+        const vpm = new PageManager(vp);
+        const vhttp = vpm.workflowHttpPage;
+        await vpm.workflowsPage.goToList();
+        await vpm.workflowsPage.search(wf.name);
+        await vhttp.openFromList(wf.name);
+        await vp.locator(vhttp.steady).waitFor({ state: 'visible', timeout: 25000 });
+        await expect(vp.locator(vhttp.toggle)).toBeDisabled();
+        await expect(vp.locator(vhttp.rotate)).toHaveCount(0);
+        await expect(vp.locator(vhttp.advanced)).toHaveCount(0);
+        await expect(vp.locator(`${vhttp.credentials} [data-test$="-show"]`)).toHaveCount(0);
+        await expect(vp.locator(`${vhttp.credentials} [data-test$="-revoke"]`)).toHaveCount(0);
+        await expect(vp.locator(vhttp.url)).toBeVisible();
+      } finally {
+        await ctx.close();
+        await http.deleteUser(email);
+      }
+    });
+  }
+);
diff --git a/web/package-lock.json b/web/package-lock.json
index ed48df6fd6..4387a08298 100644
--- a/web/package-lock.json
+++ b/web/package-lock.json
@@ -8599,7 +8599,9 @@
       }
     },
     "node_modules/express": {
-      "version": "4.22.2",
+      "version": "4.22.3",
+      "resolved": "https://registry.npmjs.org/express/-/express-4.22.3.tgz",
+      "integrity": "sha512-Bdcs4+3qlpVlx2NRn6fgX2Ue2/gGRaPeawebgclM0ERSCqDpA+owF1fdPwjJUTAJWMTuAaxjDf+hzb0/4eKvvw==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
@@ -8622,9 +8624,9 @@
         "methods": "~1.1.2",
         "on-finished": "~2.4.1",
         "parseurl": "~1.3.3",
-        "path-to-regexp": "~0.1.12",
+        "path-to-regexp": "~0.1.13",
         "proxy-addr": "~2.0.7",
-        "qs": "~6.15.1",
+        "qs": "~6.16.0",
         "range-parser": "~1.2.1",
         "safe-buffer": "5.2.1",
         "send": "~0.19.0",
@@ -8669,6 +8671,23 @@
       "dev": true,
       "license": "MIT"
     },
+    "node_modules/express/node_modules/qs": {
+      "version": "6.16.2",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.16.2.tgz",
+      "integrity": "sha512-VYdnB5S7/0IeXzBacUtwNAaM6d7Y/PgYnNC7bJCI6meqA/OgnsQbZMtVW8Dt2D1PHgbHGtYmhSoEIgvt7xZ2ZA==",
+      "dev": true,
+      "license": "BSD-3-Clause",
+      "dependencies": {
+        "es-define-property": "^1.0.1",
+        "side-channel": "^1.1.1"
+      },
+      "engines": {
+        "node": ">=0.6"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/ljharb"
+      }
+    },
     "node_modules/exsolve": {
       "version": "1.0.8",
       "dev": true,
@@ -8907,9 +8926,9 @@
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.16.1",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz",
-      "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==",
+      "version": "1.16.2",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.2.tgz",
+      "integrity": "sha512-/kVP2U8z596Ia0gwFrwyIeo74ta5aVmSeU1FfAUMAmcEP5EP7zydmag3SLiN64NaRKef3lxsq7i/g7ltJQDGow==",
       "dev": true,
       "funding": [
         {
@@ -13390,7 +13409,9 @@
       "license": "MIT"
     },
     "node_modules/qs": {
-      "version": "6.15.3",
+      "version": "6.15.4",
+      "resolved": "https://registry.npmjs.org/qs/-/qs-6.15.4.tgz",
+      "integrity": "sha512-d1zNHS+ltAfSgTmYjzXXH9gy9d6pEb33n0ZtUUkukA8UHhFSjv2mSYRiePyjbRiJh0g5sFJbMdAtMIg01Xf5/w==",
       "dev": true,
       "license": "BSD-3-Clause",
       "dependencies": {
diff --git a/web/src/components/CodeQueryEditor.spec.ts b/web/src/components/CodeQueryEditor.spec.ts
index e982a62ec4..4633239b57 100644
--- a/web/src/components/CodeQueryEditor.spec.ts
+++ b/web/src/components/CodeQueryEditor.spec.ts
@@ -153,6 +153,7 @@ vi.mock("@/composables/useLogs/searchState", () => ({
 
 const nlq = vi.hoisted(() => ({
   generateSQL: vi.fn(() => Promise.resolve(null as string | null)),
+  transformToSQL: vi.fn((_nl: string, sql: string) => `-- nl\n${sql}`),
   refusalNotice: null as unknown as { value: string },
   showErrorNotification: vi.fn(),
 }));
@@ -165,7 +166,7 @@ vi.mock("@/composables/useNLQuery", async () => {
     useNLQuery: () => ({
       detectNaturalLanguage: vi.fn(() => false),
       generateSQL: nlq.generateSQL,
-      transformToSQL: vi.fn((_nl: string, sql: string) => sql),
+      transformToSQL: nlq.transformToSQL,
       isGenerating: { value: false },
       streamingResponse: { value: "" },
       refusalNotice: nlq.refusalNotice,
@@ -485,6 +486,46 @@ describe("CodeQueryEditor", () => {
     });
   });
 
+  describe("generated query transform", () => {
+    const sql = "SELECT * FROM default WHERE a = 1 LIMIT 10";
+    const lastQuery = (wrapper: ReturnType<typeof createWrapper>) =>
+      wrapper.emitted("update:query")?.at(-1)?.[0];
+
+    it("writes the commented SQL by default, as Logs expects", async () => {
+      nlq.generateSQL.mockResolvedValueOnce(sql);
+      const wrapper = createWrapper();
+      await wrapper.vm.handleGenerateSQL("rows where a is 1");
+      expect(lastQuery(wrapper)).toBe(`-- nl\n${sql}`);
+      expect(wrapper.emitted("generation-success")?.[0]?.[0]).toEqual({
+        type: "sql",
+        message: sql,
+      });
+      wrapper.unmount();
+    });
+
+    it("writes the page's transform of the SQL instead", async () => {
+      nlq.generateSQL.mockResolvedValueOnce(sql);
+      nlq.transformToSQL.mockClear();
+      const transformGeneratedQuery = vi.fn(() => "a = 1");
+      const wrapper = createWrapper({ transformGeneratedQuery });
+      await wrapper.vm.handleGenerateSQL("rows where a is 1");
+      expect(transformGeneratedQuery).toHaveBeenCalledWith(sql);
+      expect(nlq.transformToSQL).not.toHaveBeenCalled();
+      expect(lastQuery(wrapper)).toBe("a = 1");
+      expect(wrapper.emitted("generation-success")).toHaveLength(1);
+      wrapper.unmount();
+    });
+
+    it("leaves the editor alone when the transform returns null", async () => {
+      nlq.generateSQL.mockResolvedValueOnce(sql);
+      const wrapper = createWrapper({ transformGeneratedQuery: () => null });
+      await wrapper.vm.handleGenerateSQL("count errors per service");
+      expect(wrapper.emitted("update:query")).toBeUndefined();
+      expect(wrapper.emitted("generation-success")).toBeUndefined();
+      wrapper.unmount();
+    });
+  });
+
   describe("Exposed Methods", () => {
     it("should expose setValue method", () => {
       const wrapper = createWrapper();
diff --git a/web/src/components/CodeQueryEditor.vue b/web/src/components/CodeQueryEditor.vue
index aecaf3b356..70625fd742 100644
--- a/web/src/components/CodeQueryEditor.vue
+++ b/web/src/components/CodeQueryEditor.vue
@@ -491,6 +491,11 @@ export default defineComponent({
       type: Boolean,
       default: false,
     },
+    /** Replaces the default commented-SQL write of an AI result; null leaves the editor unchanged. */
+    transformGeneratedQuery: {
+      type: Function as PropType<(sql: string) => string | null>,
+      default: null,
+    },
     /** The range the field-value resolver searches, in microseconds; null means the default lookback. */
     valuesTimeRange: {
       type: Object as PropType<{ startTime: number; endTime: number } | null>,
@@ -716,7 +721,10 @@ export default defineComponent({
         }
 
         // Normal query generation - transform and update editor with language-specific comments
-        const transformedText = transformToSQL(currentText, generatedSQL, props.language);
+        const transformedText = props.transformGeneratedQuery
+          ? props.transformGeneratedQuery(generatedSQL)
+          : transformToSQL(currentText, generatedSQL, props.language);
+        if (transformedText === null) return;
 
         // Update editor value
         setValue(transformedText);
diff --git a/web/src/components/DateTime.spec.ts b/web/src/components/DateTime.spec.ts
index 232d0fb7e6..9497f66ba3 100644
--- a/web/src/components/DateTime.spec.ts
+++ b/web/src/components/DateTime.spec.ts
@@ -322,6 +322,26 @@ describe("DateTime Component", () => {
       expect(result2).toBe(false);
     });
 
+    // C8: a forward-looking caller lifts the cap; every other caller keeps today.
+    it("caps the calendar at today unless a later max date is passed", () => {
+      // "Today" is the mocked timestampToTimezoneDate above.
+      wrapper = createWrapper({ disableRelative: true });
+      expect(wrapper.vm.calendarMaxDate).toBe("2025/01/01");
+      wrapper.unmount();
+
+      wrapper = createWrapper({ disableRelative: true, maxDate: "2099/01/01" });
+      expect(wrapper.vm.calendarMaxDate).toBe("2099/01/01");
+      wrapper.unmount();
+
+      wrapper = createWrapper({
+        disableRelative: true,
+        minDate: "2023/01/01",
+        maxDate: "2099/01/01",
+      });
+      expect(wrapper.vm.optionsFn("2098/06/15")).toBe(true);
+      expect(wrapper.vm.optionsFn("2099/01/02")).toBe(false);
+    });
+
     it("should test computeRelativePeriod function", () => {
       wrapper = createWrapper({
         queryRangeRestrictionInHour: 48,
@@ -661,6 +681,24 @@ describe("DateTime Component", () => {
         ).toBeUndefined();
       });
 
+      // F2: a caller that lifts the calendar cap lifts the › cap with it, up to the end of maxDate.
+      it("should shift forward past now up to the end of maxDate", () => {
+        wrapper = createWrapper({ disableRelative: true, maxDate: "2026/09/11" });
+        store.state.savedViewFlag = false;
+
+        wrapper.vm.selectedType = "absolute";
+        wrapper.vm.selectedDate = { from: "2026/09/10", to: "2026/09/10" };
+        wrapper.vm.selectedTime = { startTime: "11:00:00", endTime: "12:00:00" };
+        expect(wrapper.vm.isNextShiftDisabled()).toBe(false);
+
+        wrapper.vm.shiftTimeRange("next");
+        expect(wrapper.vm.selectedTime).toEqual({ startTime: "12:00:00", endTime: "13:00:00" });
+
+        wrapper.vm.selectedDate = { from: "2026/09/11", to: "2026/09/11" };
+        wrapper.vm.selectedTime = { startTime: "23:00:00", endTime: "23:59:59" };
+        expect(wrapper.vm.isNextShiftDisabled()).toBe(true);
+      });
+
       it("should still shift backward from a window that ends at now", () => {
         wrapper = createWrapper();
         store.state.savedViewFlag = false;
diff --git a/web/src/components/DateTime.vue b/web/src/components/DateTime.vue
index 5da0760016..af38b4b7a7 100644
--- a/web/src/components/DateTime.vue
+++ b/web/src/components/DateTime.vue
@@ -557,6 +557,11 @@ export default defineComponent({
       type: String,
       default: null,
     },
+    /** The last pickable calendar day (yyyy/MM/dd); absent means today, for a caller that schedules ahead. */
+    maxDate: {
+      type: String,
+      default: null,
+    },
     menuAlign: {
       type: String as PropType<"center" | "start" | "end">,
       default: "end",
@@ -842,6 +847,7 @@ export default defineComponent({
     });
 
     const calendarMaxDate = computed(() => {
+      if (props.maxDate) return props.maxDate;
       return timestampToTimezoneDate(new Date().getTime(), store.state.timezone, "yyyy/MM/dd");
     });
 
@@ -1572,11 +1578,7 @@ export default defineComponent({
     };
 
     const optionsFn = (date: string) => {
-      const formattedDate = timestampToTimezoneDate(
-        new Date().getTime(),
-        store.state.timezone,
-        "yyyy/MM/dd",
-      );
+      const formattedDate = calendarMaxDate.value;
       if (props.disableRelative) {
         return date >= props.minDate && date <= formattedDate;
       }
@@ -1649,8 +1651,8 @@ export default defineComponent({
 
       let delta = (direction === "prev" ? -1 : 1) * duration;
       if (direction === "next") {
-        // The calendar rejects future dates, so a forward shift stops at now.
-        delta = Math.min(delta, Date.now() * 1000 - endTime);
+        // A forward shift stops where the calendar does: now, or the end of `maxDate`.
+        delta = Math.min(delta, forwardCeilingMicros() - endTime);
         if (delta < MICROS_PER_SECOND) return;
       }
       const startDateTime = convertUnixTime(startTime + delta);
@@ -1666,12 +1668,17 @@ export default defineComponent({
       if (!props.autoApply) saveDate("absolute");
     };
 
+    const forwardCeilingMicros = () =>
+      props.maxDate
+        ? convertToUtcTimestamp(`${props.maxDate} 23:59:59`, store.state.timezone)
+        : Date.now() * 1000;
+
     const isNextShiftDisabled = () => {
       if (selectedType.value === "relative") {
         return (parseCalendarToken(calendarToken.value)?.offset ?? 0) === 0;
       }
       const { endUTC } = getUTCTimeStamp();
-      return !(endUTC + MICROS_PER_SECOND <= Date.now() * 1000);
+      return !(endUTC + MICROS_PER_SECOND <= forwardCeilingMicros());
     };
 
     // Only the calendar section is a 2-column grid of this/last pairs; every other row is 1-item.
diff --git a/web/src/components/OnlineEvalsDisabled.vue b/web/src/components/OnlineEvalsDisabled.vue
new file mode 100644
index 0000000000..b9cb9c5d96
--- /dev/null
+++ b/web/src/components/OnlineEvalsDisabled.vue
@@ -0,0 +1,40 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!-- Rendered in place of a page whose API exists only with online evaluations on. -->
+<template>
+  <OPageLayout
+    :title="t('onlineEvals.disabled.title')"
+    icon="toggle-off"
+    constrained
+    data-test="online-evals-disabled"
+  >
+    <OEmptyState
+      size="hero"
+      icon="toggle-off"
+      :title="t('onlineEvals.disabled.title')"
+      :description="t('onlineEvals.disabled.description')"
+    />
+  </OPageLayout>
+</template>
+
+<script setup lang="ts">
+import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import { useI18nTyped } from "@/types/i18n";
+
+const { t } = useI18nTyped();
+</script>
diff --git a/web/src/components/QueryEditor.spec.ts b/web/src/components/QueryEditor.spec.ts
index 1bfbc80c9b..06d75e1ab8 100644
--- a/web/src/components/QueryEditor.spec.ts
+++ b/web/src/components/QueryEditor.spec.ts
@@ -68,6 +68,7 @@ const codeQueryEditorStub = {
     "editorId",
     "valuesTimeRange",
     "textPreview",
+    "transformGeneratedQuery",
   ],
   emits: [
     "update:query",
@@ -581,6 +582,29 @@ describe("QueryEditor", () => {
     });
   });
 
+  describe("page hooks for the code editor", () => {
+    it("names the editor from the prefix and language by default", () => {
+      wrapper = mountQueryEditor({ dataTestPrefix: "logs-search-bar" });
+      expect(wrapper.findComponent(codeQueryEditorStub).props("editorId")).toBe(
+        "logs-search-bar-editor-sql",
+      );
+      expect(
+        wrapper.findComponent(codeQueryEditorStub).props("transformGeneratedQuery"),
+      ).toBeUndefined();
+    });
+
+    it("forwards a page's editor id and generated-query transform", () => {
+      const transform = (sql: string) => sql;
+      wrapper = mountQueryEditor({
+        editorId: "traces-query-editor",
+        transformGeneratedQuery: transform,
+      });
+      const editor = wrapper.findComponent(codeQueryEditorStub);
+      expect(editor.props("editorId")).toBe("traces-query-editor");
+      expect(editor.props("transformGeneratedQuery")).toBe(transform);
+    });
+  });
+
   describe("values time range", () => {
     it("forwards the range to the code editor", () => {
       const range = { startTime: 1, endTime: 2 };
diff --git a/web/src/components/QueryEditor.vue b/web/src/components/QueryEditor.vue
index 1e0898fce4..8c275c3934 100644
--- a/web/src/components/QueryEditor.vue
+++ b/web/src/components/QueryEditor.vue
@@ -85,7 +85,7 @@
       <CodeQueryEditor
         :ref="(el) => (editorRef = el)"
         :key="currentLanguage"
-        :editor-id="`${dataTestPrefix}-editor-${currentLanguage}`"
+        :editor-id="editorId ?? `${dataTestPrefix}-editor-${currentLanguage}`"
         :language="currentLanguage"
         :query="query"
         :nlp-mode="nlpMode"
@@ -101,6 +101,7 @@
         :filter-mode="filterMode"
         :values-time-range="valuesTimeRange ?? null"
         :recent-queries="recentQueries ?? []"
+        :transform-generated-query="transformGeneratedQuery ?? undefined"
         @update:query="handleQueryUpdate"
         @user-edit="(isBlank: boolean, wasBlank: boolean) => emit('user-edit', isBlank, wasBlank)"
         @run-query="emit('run-query')"
@@ -193,6 +194,7 @@ interface Props {
   filterMode?: boolean; // The query is a bare WHERE fragment (Logs without SQL mode)
   valuesTimeRange?: { startTime: number; endTime: number } | null; // Range field values are looked up in (microseconds)
   recentQueries?: string[]; // The user's recent queries, offered as clock rows while typing
+  transformGeneratedQuery?: ((sql: string) => string | null) | null; // Page-specific write of an AI result (null result = keep the editor)
 
   // NL Mode (optional external control)
   nlpMode?: boolean; // External NLP mode control (undefined = internal control)
@@ -208,6 +210,7 @@ interface Props {
 
   // Testing
   dataTestPrefix?: string;
+  editorId?: string; // Monaco host id; defaults to `<dataTestPrefix>-editor-<language>`
 }
 
 const props = withDefaults(defineProps<Props>(), {
diff --git a/web/src/components/alerts/IncidentTimeline.spec.ts b/web/src/components/alerts/IncidentTimeline.spec.ts
index ac6ff1c6e7..6cc00dc293 100644
--- a/web/src/components/alerts/IncidentTimeline.spec.ts
+++ b/web/src/components/alerts/IncidentTimeline.spec.ts
@@ -353,6 +353,15 @@ describe("IncidentTimeline - getInlineEventText", () => {
     expect(text).toContain("5 times");
   });
 
+  /// O1: a page Resolve that ended the incident's ack says so, not "Reopened".
+  it("says a page Resolve ended the acknowledgement", async () => {
+    const w = await mountComp();
+    await flushPromises();
+    const event = { type: "AckEndedByPageResolve", data: { user_id: "ana@o2.ai" } };
+    expect((w.vm as any).getEventBadgeText(event)).toBe("Acknowledgement ended");
+    expect((w.vm as any).getInlineEventText(event)).toBe("by resolving one of its pages");
+  });
+
   it("returns text for ai_analysis_begin", async () => {
     const w = await mountComp();
     await flushPromises();
diff --git a/web/src/components/alerts/IncidentTimeline.vue b/web/src/components/alerts/IncidentTimeline.vue
index 3367156de7..d86bb1c53c 100644
--- a/web/src/components/alerts/IncidentTimeline.vue
+++ b/web/src/components/alerts/IncidentTimeline.vue
@@ -160,6 +160,8 @@ const getEventIcon = (event: any): string => {
       return "check";
     case "Reopened":
       return "replay";
+    case "AckEndedByPageResolve":
+      return "check";
     case "DimensionsUpgraded":
       return "arrow-upward";
     case "TitleChanged":
@@ -201,6 +203,8 @@ const getEventBadgeColor = (event: any): string => {
       return "var(--color-success-600)";
     case "Reopened":
       return "var(--color-orange-500)";
+    case "AckEndedByPageResolve":
+      return "var(--color-blue-500)";
     case "DimensionsUpgraded":
       return "var(--color-ai-accent)";
     case "TitleChanged":
@@ -239,6 +243,8 @@ const getEventBadgeText = (event: any): string => {
       return t("alerts.incidents.timeline.badgeResolved");
     case "Reopened":
       return t("alerts.incidents.timeline.badgeReopened");
+    case "AckEndedByPageResolve":
+      return t("alerts.incidents.timeline.badgeAckEnded");
     case "DimensionsUpgraded":
       return t("alerts.incidents.timeline.badgeDimensionsUpgraded");
     case "TitleChanged":
@@ -340,6 +346,9 @@ const getInlineEventText = (event: any): string => {
         ? t("alerts.incidents.timeline.incidentWas")
         : t("alerts.incidents.timeline.theIncident");
 
+    case "AckEndedByPageResolve":
+      return t("alerts.incidents.timeline.ackEndedByPageResolve");
+
     case "Alert": {
       const alertName = bold(data.alert_name || t("alerts.incidents.timeline.unnamedAlert"));
       const count = Number(data.count ?? 0);
diff --git a/web/src/components/common/KpiCard.vue b/web/src/components/common/KpiCard.vue
index ea4304d72d..2fdfa36ed7 100644
--- a/web/src/components/common/KpiCard.vue
+++ b/web/src/components/common/KpiCard.vue
@@ -30,15 +30,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 <template>
   <component
     :is="as"
-    class="bg-card-glass-bg rounded-default border-border-default flex flex-col gap-1 border px-3.5 py-2.5 transition-shadow duration-200 ease-in-out hover:shadow-md max-lg:shrink-0 max-lg:basis-auto max-lg:flex-row-reverse max-lg:items-center max-lg:gap-1.5 max-lg:px-1.5 max-lg:py-1"
+    class="bg-card-glass-bg rounded-default border-border-default flex min-w-0 flex-col gap-1 border px-3.5 py-2.5 transition-shadow duration-200 ease-in-out hover:shadow-md max-lg:shrink-0 max-lg:basis-auto max-lg:gap-0.5 max-lg:px-2 max-lg:py-1.5"
     :data-test="dataTest"
-    :title="label && !lgUp ? String(label) : undefined"
   >
+    <!-- The label stays visible at every width: a compact tile without its
+         label is a bare number nobody can read. -->
     <div class="mb-1 flex items-center justify-between gap-2 max-lg:mb-0">
       <OTruncatedText
         as="div"
         :tooltip="$slots.label ? false : undefined"
-        class="max-lg:hidden"
         :class="labelClass || 'text-2xs text-text-secondary leading-normal font-semibold'"
       >
         <slot name="label">{{ label }}</slot>
@@ -80,9 +80,6 @@ import { raw, type I18nText } from "@/types/i18n";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
-import useBreakpoint from "@/composables/useBreakpoint";
-
-const { lgUp } = useBreakpoint();
 
 withDefaults(
   defineProps<{
diff --git a/web/src/components/dashboards/PanelContainer.spec.ts b/web/src/components/dashboards/PanelContainer.spec.ts
index 8e2101a7db..4f41b401ad 100644
--- a/web/src/components/dashboards/PanelContainer.spec.ts
+++ b/web/src/components/dashboards/PanelContainer.spec.ts
@@ -2931,4 +2931,53 @@ describe("PanelContainer", () => {
       expect(wrapper.find(button).exists()).toBe(shown);
     });
   });
+
+  describe("Explore actions", () => {
+    const menuStubs = {
+      ODropdown: {
+        name: "ODropdown",
+        template: '<div class="o-dropdown-stub"><slot name="trigger" /><slot /></div>',
+      },
+      ODropdownItem: {
+        name: "ODropdownItem",
+        emits: ["select"],
+        template:
+          '<div class="o-dropdown-item-stub" v-bind="$attrs" @click="$emit(\'select\')"><slot /></div>',
+      },
+    };
+    const trigger = '[data-test="panel-explore-actions-btn"]';
+
+    it("shows the explore menu only with viewOnly and exploreActions", () => {
+      wrapper = createWrapper({ viewOnly: true, exploreActions: true }, menuStubs);
+      expect(wrapper.find(trigger).exists()).toBe(true);
+    });
+
+    it.each([
+      [{ viewOnly: false, exploreActions: true }],
+      [{ viewOnly: true, exploreActions: false }],
+      [{ viewOnly: true }],
+    ])("hides the explore menu for %o", (props) => {
+      wrapper = createWrapper(props, menuStubs);
+      expect(wrapper.find(trigger).exists()).toBe(false);
+      expect(wrapper.find('[data-test="panel-explore-create-alert"]').exists()).toBe(false);
+    });
+
+    it("never shows next to the panel's own menu", () => {
+      wrapper = createWrapper({ viewOnly: false, exploreActions: true }, menuStubs);
+      expect(wrapper.find('[data-test="dashboard-edit-panel"]').exists()).toBe(true);
+      expect(wrapper.find('[data-test="panel-explore-add-to-dashboard"]').exists()).toBe(false);
+    });
+
+    it("emits exploreCreateAlert with the panel schema", async () => {
+      wrapper = createWrapper({ viewOnly: true, exploreActions: true }, menuStubs);
+      await wrapper.find('[data-test="panel-explore-create-alert"]').trigger("click");
+      expect(wrapper.emitted("exploreCreateAlert")).toEqual([[mockPanelData]]);
+    });
+
+    it("emits exploreAddToDashboard with the panel schema", async () => {
+      wrapper = createWrapper({ viewOnly: true, exploreActions: true }, menuStubs);
+      await wrapper.find('[data-test="panel-explore-add-to-dashboard"]').trigger("click");
+      expect(wrapper.emitted("exploreAddToDashboard")).toEqual([[mockPanelData]]);
+    });
+  });
 });
diff --git a/web/src/components/dashboards/PanelContainer.vue b/web/src/components/dashboards/PanelContainer.vue
index 3cb1fc531a..c4ff1b2186 100644
--- a/web/src/components/dashboards/PanelContainer.vue
+++ b/web/src/components/dashboards/PanelContainer.vue
@@ -348,6 +348,33 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         >
         </OButton>
 
+        <!-- Only in viewOnly, so it can never sit beside the panel's own Create alert. -->
+        <ODropdown v-if="viewOnly && exploreActions" side="bottom" align="end">
+          <template #trigger>
+            <OButton
+              :aria-label="t('dashboard.moreActions')"
+              variant="ghost"
+              size="icon"
+              data-test="panel-explore-actions-btn"
+            >
+              <OIcon name="more-vert" size="sm" />
+            </OButton>
+          </template>
+          <ODropdownItem
+            data-test="panel-explore-create-alert"
+            icon-left="shield-alert-outline"
+            @select="$emit('exploreCreateAlert', props.data)"
+          >
+            {{ t("dashboard.panelContainer.exploreCreateAlert") }}
+          </ODropdownItem>
+          <ODropdownItem
+            data-test="panel-explore-add-to-dashboard"
+            icon-left="dashboard"
+            @select="$emit('exploreAddToDashboard', props.data)"
+          >
+            {{ t("dashboard.panelContainer.exploreAddToDashboard") }}
+          </ODropdownItem>
+        </ODropdown>
         <!-- Dropdown menu (shown when simplifiedPanelView is false) -->
         <ODropdown side="bottom" align="end" v-if="!viewOnly && !simplifiedPanelView">
           <template #trigger>
@@ -747,6 +774,8 @@ export default defineComponent({
     "update:runId",
     "contextmenu",
     "sendToAiChat",
+    "exploreCreateAlert",
+    "exploreAddToDashboard",
   ],
   props: [
     "data",
@@ -775,6 +804,7 @@ export default defineComponent({
     "injectedPanelData",
     "layoutMode",
     "kiosk",
+    "exploreActions",
   ],
   components: {
     OTag,
diff --git a/web/src/components/dashboards/PublicLinksPanel.spec.ts b/web/src/components/dashboards/PublicLinksPanel.spec.ts
index a7bdaf9b5d..761e0bae2b 100644
--- a/web/src/components/dashboards/PublicLinksPanel.spec.ts
+++ b/web/src/components/dashboards/PublicLinksPanel.spec.ts
@@ -17,6 +17,7 @@ import { mount, flushPromises } from "@vue/test-utils";
 import { describe, expect, it, beforeEach, vi } from "vitest";
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
+import ODate from "@/lib/forms/Date/ODate.vue";
 import { queryClient } from "@/composables/query/queryClient";
 
 vi.mock("@/services/public_dashboards_admin", () => ({
@@ -997,6 +998,44 @@ describe("PublicLinksPanel", () => {
     });
   });
 
+  describe("date variables", () => {
+    const day = { name: "from_date", type: "date", value: "2026-01-01", dateFormat: "epochus" };
+
+    beforeEach(() => {
+      vi.mocked(admin.list).mockResolvedValue({ data: { list: [] } } as never);
+      vi.mocked(admin.create).mockResolvedValue({ data: link() } as never);
+    });
+
+    it("edits the default value with the date picker and freezes the picked YYYY-MM-DD", async () => {
+      const w = build(
+        {
+          variablesConfig: { list: [day] },
+          dashboardVariables: { getUrlParams: () => ({ "var-from_date": "2026-02-02" }) },
+        },
+        { VariablesValueSelector: false },
+      );
+      await flushPromises();
+
+      // the link form has date pickers of its own, so find this variable's by its data-test
+      const picker = w
+        .findAllComponents(ODate)
+        .find((it) => it.attributes("data-test") === "variable-selector-from_date")!;
+      expect(picker).toBeTruthy();
+      expect(picker.props("modelValue")).toBe("2026-02-02");
+
+      picker.vm.$emit("update:modelValue", "2026-03-03");
+      await flushPromises();
+      (
+        w.vm as unknown as { form: { setFieldValue: (k: string, v: string) => void } }
+      ).form.setFieldValue("name", "NOC wall");
+      await submit(w);
+      // the stored value stays the raw date, whatever the variable's output format is
+      expect(vi.mocked(admin.create).mock.calls[0]?.[2].frozen_variables).toEqual({
+        from_date: "2026-03-03",
+      });
+    });
+  });
+
   it("lists variable values for the link's own ranges, not the dashboard's time range", async () => {
     vi.mocked(admin.list).mockResolvedValue({ data: { list: [] } } as never);
     const w = build({ timeObj: { start_time: new Date(0), end_time: new Date(900_000) } });
diff --git a/web/src/components/dashboards/SelectDashboardDropdown.spec.ts b/web/src/components/dashboards/SelectDashboardDropdown.spec.ts
index 1c2d27b3a5..fcbea87129 100644
--- a/web/src/components/dashboards/SelectDashboardDropdown.spec.ts
+++ b/web/src/components/dashboards/SelectDashboardDropdown.spec.ts
@@ -370,4 +370,36 @@ describe("SelectDashboardDropdown", () => {
       );
     });
   });
+
+  describe("preferredDashboardId", () => {
+    it("preselects the preferred dashboard when the folder has it", async () => {
+      const wrapper = mountComponent({ preferredDashboardId: "dash2" }, store);
+      await flushPromises();
+
+      expect(wrapper.vm.selectedDashboard).toBe("dash2");
+      expect(wrapper.emitted("dashboard-selected")?.at(-1)).toEqual([
+        { label: "Dashboard 2", value: "dash2" },
+      ]);
+    });
+
+    it("falls back to the first dashboard when the preferred one is gone", async () => {
+      const wrapper = mountComponent({ preferredDashboardId: "deleted" }, store);
+      await flushPromises();
+
+      expect(wrapper.vm.selectedDashboard).toBe("dash1");
+    });
+
+    it("emits the preselected dashboard when the folder's list is already cached", async () => {
+      mountComponent({}, store).unmount();
+      await flushPromises();
+
+      const wrapper = mountComponent({ preferredDashboardId: "dash2" }, store);
+      await flushPromises();
+
+      expect(wrapper.vm.selectedDashboard).toBe("dash2");
+      expect(wrapper.emitted("dashboard-selected")?.at(-1)).toEqual([
+        { label: "Dashboard 2", value: "dash2" },
+      ]);
+    });
+  });
 });
diff --git a/web/src/components/dashboards/SelectDashboardDropdown.vue b/web/src/components/dashboards/SelectDashboardDropdown.vue
index d949b00d6c..15ae8b8cdb 100644
--- a/web/src/components/dashboards/SelectDashboardDropdown.vue
+++ b/web/src/components/dashboards/SelectDashboardDropdown.vue
@@ -83,6 +83,11 @@ export default defineComponent({
         return typeof value === "string" || value === null;
       },
     },
+    /** Picked instead of the newest dashboard when the folder still has it. */
+    preferredDashboardId: {
+      type: String,
+      default: undefined,
+    },
   },
   setup(props, { emit }) {
     const store: any = useStore();
@@ -113,21 +118,7 @@ export default defineComponent({
       selectedDashboard.value = dashboardId ?? null;
     };
 
-    // Each (re)load: keep a still-valid selection, else fall back to the first
-    // row — covers mount, folder switch and background revalidation alike.
-    watch(
-      () => dashboardsQuery.data.value,
-      (data) => {
-        if (data === undefined) return; // pending, or disabled by a null folder
-        const list = dashboardList.value;
-        if (!list.some((d: any) => d.value === selectedDashboard.value)) {
-          selectedDashboard.value = list[0]?.value ?? null;
-        }
-        emit("dashboard-list-updated");
-      },
-      { immediate: true },
-    );
-
+    // Registered before the list watcher, whose immediate run on a cached list selects during setup.
     watch(
       () => selectedDashboard.value,
       (dashboardId) => {
@@ -140,6 +131,22 @@ export default defineComponent({
       },
     );
 
+    // Each (re)load: keep a still-valid selection, else fall back to the first
+    // row — covers mount, folder switch and background revalidation alike.
+    watch(
+      () => dashboardsQuery.data.value,
+      (data) => {
+        if (data === undefined) return; // pending, or disabled by a null folder
+        const list = dashboardList.value;
+        if (!list.some((d: any) => d.value === selectedDashboard.value)) {
+          const preferred = list.find((d: any) => d.value === props.preferredDashboardId);
+          selectedDashboard.value = (preferred ?? list[0])?.value ?? null;
+        }
+        emit("dashboard-list-updated");
+      },
+      { immediate: true },
+    );
+
     return {
       t,
       store,
diff --git a/web/src/components/dashboards/SelectTabDropdown.spec.ts b/web/src/components/dashboards/SelectTabDropdown.spec.ts
index 39a5d5bc5a..80611e8193 100644
--- a/web/src/components/dashboards/SelectTabDropdown.spec.ts
+++ b/web/src/components/dashboards/SelectTabDropdown.spec.ts
@@ -220,4 +220,21 @@ describe("SelectTabDropdown", () => {
     expect(wrapper.vm.showAddTabDialog).toBe(false);
     expect(wrapper.vm.selectedTab).toBe("emitted123");
   });
+  it("selects the preferred tab when the dashboard has it", async () => {
+    const wrapper = mountComponent(
+      { folderId: "folder1", dashboardId: "dash1", preferredTabId: "tab2" },
+      store,
+    );
+    await flushPromises();
+    expect(wrapper.vm.selectedTab).toBe("tab2");
+  });
+
+  it("falls back to the first tab when the preferred tab is gone", async () => {
+    const wrapper = mountComponent(
+      { folderId: "folder1", dashboardId: "dash1", preferredTabId: "missing" },
+      store,
+    );
+    await flushPromises();
+    expect(wrapper.vm.selectedTab).toBe("tab1");
+  });
 });
diff --git a/web/src/components/dashboards/SelectTabDropdown.vue b/web/src/components/dashboards/SelectTabDropdown.vue
index 418b9c8af8..5683b5fdd9 100644
--- a/web/src/components/dashboards/SelectTabDropdown.vue
+++ b/web/src/components/dashboards/SelectTabDropdown.vue
@@ -79,6 +79,11 @@ export default defineComponent({
         return typeof value === "string" || value === null;
       },
     },
+    /** Selected when the dashboard has it; otherwise the first tab is. */
+    preferredTabId: {
+      type: String,
+      default: null,
+    },
   },
   setup(props, { emit }) {
     const store: any = useStore();
@@ -107,12 +112,8 @@ export default defineComponent({
         value: tab.tabId,
       }));
 
-      // select first tab
-      if (tabList?.value?.length > 0) {
-        selectedTab.value = tabList?.value[0]?.value ?? null;
-      } else {
-        selectedTab.value = null;
-      }
+      const preferred = tabList.value?.find((tab: any) => tab.value === props.preferredTabId);
+      selectedTab.value = preferred?.value ?? tabList.value?.[0]?.value ?? null;
 
       emit("tab-list-updated");
     });
diff --git a/web/src/components/dashboards/VariablesValueSelector.spec.ts b/web/src/components/dashboards/VariablesValueSelector.spec.ts
index 5213ff9f1e..a2dc09b50b 100644
--- a/web/src/components/dashboards/VariablesValueSelector.spec.ts
+++ b/web/src/components/dashboards/VariablesValueSelector.spec.ts
@@ -17,6 +17,7 @@ import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
 import { mount, VueWrapper } from "@vue/test-utils";
 import { nextTick, reactive } from "vue";
 import VariablesValueSelector from "./VariablesValueSelector.vue";
+import ODate from "@/lib/forms/Date/ODate.vue";
 
 // Mock external dependencies
 vi.mock("vue-i18n", () => ({
@@ -2880,6 +2881,74 @@ describe("VariablesValueSelector", () => {
     });
   });
 
+  describe("Date variables in a filter", () => {
+    afterEach(async () => {
+      const { addLabelsToSQlQuery } = await import("@/utils/query/sqlUtils");
+      vi.mocked(addLabelsToSQlQuery).mockImplementation((query: string) => Promise.resolve(query));
+    });
+
+    it("passes a date variable in its effective format, like a scalar value", async () => {
+      const { addLabelsToSQlQuery } = await import("@/utils/query/sqlUtils");
+      vi.mocked(addLabelsToSQlQuery).mockImplementation(
+        async (query: string, labels: any[]) =>
+          `${query} WHERE ${labels.map((l: any) => `${l.name} = '${l.value}'`).join(" AND ")}`,
+      );
+
+      wrapper = createWrapper({
+        variablesConfig: {
+          list: [
+            { name: "d", type: "date", label: "d", value: "2026-03-08", dateFormat: "dmy" },
+            { name: "blank", type: "date", label: "blank", value: "" },
+            {
+              name: "spans",
+              type: "query_values",
+              label: "spans",
+              multiSelect: false,
+              query_data: {
+                field: "span_id",
+                stream: "default",
+                stream_type: "logs",
+                max_record_size: 10,
+                filter: [
+                  { name: "a", operator: "=", value: "$d" },
+                  { name: "b", operator: "=", value: "${d:epochus}" },
+                  { name: "c", operator: "=", value: "'$d'" },
+                  { name: "e", operator: "=", value: "$blank" },
+                ],
+              },
+            },
+          ],
+        },
+        initialVariableValues: { value: {} },
+      });
+      await nextTick();
+
+      const vm = wrapper.vm as any;
+      const byName = (name: string) => vm.variablesData.values.find((v: any) => v.name === name);
+      ["d", "blank"].forEach((name) => {
+        byName(name).isVariablePartialLoaded = true;
+      });
+
+      let capturedSql = "";
+      mockStreamingComposable.fetchQueryDataWithHttpStream.mockImplementation(
+        (payload: any, handlers: any) => {
+          capturedSql = atob(payload.queryReq.sql);
+          handlers.complete(payload, { type: "end" });
+        },
+      );
+
+      const spans = byName("spans");
+      spans.isLoading = false;
+      spans.isVariablePartialLoaded = true;
+      spans.isVariableLoadingPending = false;
+      await vm.loadVariableOptions(spans);
+
+      expect(capturedSql).toContain(
+        "WHERE a = '08/03/2026' AND b = '1772928000000000' AND c = ''08/03/2026'' AND e = ''",
+      );
+    });
+  });
+
   describe("textbox debounce follows Auto Run", () => {
     it("uses 1s normally and 300ms while the manager is in live mode", async () => {
       const { useVariablesManager, LIVE_COMMIT_DEBOUNCE_MS } =
@@ -3020,4 +3089,75 @@ describe("VariablesValueSelector", () => {
       expect(state.isVariablePartialLoaded).toBe(false);
     });
   });
+
+  describe("Date variable", () => {
+    const dateConfig = {
+      list: [
+        { name: "from_date", type: "date", label: "From", value: "2026-01-01" },
+        { name: "to_date", type: "date", label: "To", value: "" },
+      ],
+    };
+
+    it("should render ODate and fall back to the default value", async () => {
+      wrapper = createWrapper({
+        variablesConfig: dateConfig,
+        initialVariableValues: { value: {} },
+      });
+      await nextTick();
+
+      const vm = wrapper.vm as any;
+      expect(vm.variablesData.values.find((v: any) => v.name === "from_date").value).toBe(
+        "2026-01-01",
+      );
+      expect(wrapper.findAllComponents(ODate)).toHaveLength(2);
+      // label inside the border, like the textbox and select variables next to it
+      expect(wrapper.findAllComponents(ODate)[0].props("labelPosition")).toBe("inside");
+      expect(wrapper.find('[data-test="variable-selector-from_date"]').exists()).toBe(true);
+    });
+
+    it("should prefer the initial value over the default", async () => {
+      wrapper = createWrapper({
+        variablesConfig: dateConfig,
+        initialVariableValues: { value: { from_date: "2026-02-02" } },
+      });
+      await nextTick();
+
+      const vm = wrapper.vm as any;
+      expect(vm.variablesData.values.find((v: any) => v.name === "from_date").value).toBe(
+        "2026-02-02",
+      );
+    });
+
+    it("should update the variable value when the date changes", async () => {
+      wrapper = createWrapper({
+        variablesConfig: dateConfig,
+        initialVariableValues: { value: {} },
+      });
+      await nextTick();
+
+      wrapper.findAllComponents(ODate)[1].vm.$emit("update:modelValue", "2026-03-03");
+      await nextTick();
+
+      const vm = wrapper.vm as any;
+      expect(vm.variablesData.values.find((v: any) => v.name === "to_date").value).toBe(
+        "2026-03-03",
+      );
+    });
+
+    it("should load without running a query", async () => {
+      wrapper = createWrapper({
+        variablesConfig: dateConfig,
+        initialVariableValues: { value: {} },
+      });
+      await nextTick();
+      await new Promise((resolve) => setTimeout(resolve, 100));
+
+      const vm = wrapper.vm as any;
+      expect(vm.variablesData.values.every((v: any) => v.isVariableLoadingPending !== true)).toBe(
+        true,
+      );
+      expect(vm.variablesData.isVariablesLoading).toBe(false);
+      expect(mockStreamingComposable.fetchQueryDataWithHttpStream).not.toHaveBeenCalled();
+    });
+  });
 });
diff --git a/web/src/components/dashboards/VariablesValueSelector.vue b/web/src/components/dashboards/VariablesValueSelector.vue
index 6b56cb31bd..79692fdde4 100644
--- a/web/src/components/dashboards/VariablesValueSelector.vue
+++ b/web/src/components/dashboards/VariablesValueSelector.vue
@@ -74,6 +74,19 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           @update:model-value="onVariablesValueUpdated(Number(index))"
         />
       </div>
+      <div v-else-if="item.type == 'date'" class="max-w-[40rem] min-w-37.5">
+        <ODate
+          v-show="!item.hideOnDashboard"
+          class="me-4 mt-1 w-37.5!"
+          v-model="item.value"
+          :label="item.label || item.name"
+          label-position="inside"
+          :clearable="!item.readOnly"
+          :readonly="item.readOnly === true"
+          :data-test="`variable-selector-${item.name}`"
+          @update:model-value="onVariablesValueUpdated(Number(index))"
+        />
+      </div>
       <div v-else-if="item.type == 'custom'" class="max-w-[40rem] min-w-37.5">
         <VariableCustomValueSelector
           v-show="!item.hideOnDashboard"
@@ -129,6 +142,7 @@ import VariableCustomValueSelector from "./settings/VariableCustomValueSelector.
 import VariableAdHocValueSelector from "./settings/VariableAdHocValueSelector.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OInput from "@/lib/forms/Input/OInput.vue";
+import ODate from "@/lib/forms/Date/ODate.vue";
 import { isInvalidDate } from "@/utils/date";
 import { addLabelsToSQlQuery } from "@/utils/query/sqlUtils";
 import { b64EncodeUnicode, escapeSingleQuotes, generateTraceContext } from "@/utils/zincutils";
@@ -136,6 +150,7 @@ import { buildVariablesDependencyGraph } from "@/utils/dashboard/variables/varia
 import {
   normalizeVariableSyntax,
   replaceVariablePlaceholders,
+  formatDateVariable,
 } from "@/utils/dashboard/variables/variablesUtils";
 import useHttpStreaming from "@/composables/useStreamingSearch";
 import { SELECT_ALL_VALUE } from "@/utils/dashboard/constants";
@@ -198,6 +213,7 @@ export default defineComponent({
     VariableCustomValueSelector,
     OButton,
     OInput,
+    ODate,
   },
   setup(props: any, { emit }) {
     const store = useStore();
@@ -877,8 +893,8 @@ export default defineComponent({
             variableData.value = item.multiSelect ? [] : null;
           }
         } else if (item.type != "constant") {
-          // for textbox type variable, if initial value is not exist, use the default value
-          if (item.type == "textbox") {
+          // for textbox/date type variable, if initial value is not exist, use the default value
+          if (item.type == "textbox" || item.type == "date") {
             variableData.value = initialValue ?? variableData.value;
           } else {
             // use the initial value
@@ -1828,6 +1844,7 @@ export default defineComponent({
         }
         case "constant":
         case "textbox":
+        case "date":
         case "dynamic_filters": {
           finalizePartialVariableLoading(variableObject, true, isInitialLoad);
           finalizeVariableLoading(variableObject, true);
@@ -1946,7 +1963,7 @@ export default defineComponent({
       queryContext = replaceVariablePlaceholders(
         queryContext,
         variablesByName.keys(),
-        ({ name, quoted }) => {
+        ({ name, quoted, format }) => {
           const variable = variablesByName.get(name);
           // an unloaded variable keeps its placeholder rather than resolving as a shorter name
           if (!variable.isVariablePartialLoaded) return undefined;
@@ -1959,7 +1976,8 @@ export default defineComponent({
               : values.map((value: any) => `'${value}'`).join(", ");
           }
           if (variable.value === null || variable.value === undefined) return undefined;
-          return `${escapeSingleQuotes(variable.value)}`;
+          // a date variable passes its effective format, like a scalar value
+          return `${escapeSingleQuotes(formatDateVariable(variable, format) ?? variable.value)}`;
         },
       );
 
diff --git a/web/src/components/dashboards/settings/AddSettingVariable.schema.ts b/web/src/components/dashboards/settings/AddSettingVariable.schema.ts
index c7be3642f2..b907a963ed 100644
--- a/web/src/components/dashboards/settings/AddSettingVariable.schema.ts
+++ b/web/src/components/dashboards/settings/AddSettingVariable.schema.ts
@@ -17,6 +17,7 @@
 // non-`custom`/non-`query_values` type's default rows never block submit.
 
 import { z } from "zod";
+import { DEFAULT_DATE_VARIABLE_FORMAT } from "@/utils/dashboard/variables/variablesUtils";
 
 export const VARIABLE_NAME_REGEX = /^[a-zA-Z0-9_-]*$/;
 
@@ -62,6 +63,8 @@ export const makeAddSettingVariableSchema = (t: (_key: string) => string) =>
           filter: [],
         }),
       value: z.string().optional().default(""),
+      // Only saved for `date` variables.
+      dateFormat: z.string().optional().default(DEFAULT_DATE_VARIABLE_FORMAT),
       // form-owned custom option rows; row rules enforced in superRefine below.
       options: z.array(z.record(z.string(), z.any())).optional().default([]),
       multiSelect: z.boolean().optional().default(false),
diff --git a/web/src/components/dashboards/settings/AddSettingVariable.spec.ts b/web/src/components/dashboards/settings/AddSettingVariable.spec.ts
index bc6af72f6e..0fab7a2a3b 100644
--- a/web/src/components/dashboards/settings/AddSettingVariable.spec.ts
+++ b/web/src/components/dashboards/settings/AddSettingVariable.spec.ts
@@ -23,7 +23,7 @@ import OInput from "@/lib/forms/Input/OInput.vue";
 import OFormCombobox from "@/lib/forms/Combobox/OFormCombobox.vue";
 import OCombobox from "@/lib/forms/Combobox/OCombobox.vue";
 import analytics from "@/services/product_analytics";
-import { addVariable, updateVariable } from "../../../utils/commons";
+import { addVariable, getDashboard, updateVariable } from "../../../utils/commons";
 
 vi.mock("@/services/product_analytics", () => ({ default: { track: vi.fn() } }));
 
@@ -53,6 +53,7 @@ vi.mock("vue-i18n", () => ({
         "dashboard.queryValues": "Query Values",
         "dashboard.constant": "Constant",
         "dashboard.textbox": "Textbox",
+        "dashboard.date": "Date",
         "dashboard.custom": "Custom",
       };
       return translations[key] || key;
@@ -243,6 +244,122 @@ describe("AddSettingVariable", () => {
       expect(wrapper.find('[data-test="dashboard-variable-textbox-default-value"]').exists()).toBe(
         true,
       );
+
+      // Test date type
+      wrapper.vm.variableData.type = "date";
+      await nextTick();
+
+      expect(wrapper.find('[data-test="dashboard-variable-date-default-value"]').exists()).toBe(
+        true,
+      );
+    });
+
+    it("should keep a valid YYYY-MM-DD value when switching textbox to date", async () => {
+      wrapper.vm.variableData.type = "textbox";
+      wrapper.vm.variableData.value = "2026-01-31";
+      await nextTick();
+      wrapper.vm.variableData.type = "date";
+      await nextTick();
+      await nextTick();
+
+      expect(wrapper.vm.variableData.value).toBe("2026-01-31");
+    });
+
+    it("should clear a non-date value when switching textbox to date", async () => {
+      wrapper.vm.variableData.type = "textbox";
+      wrapper.vm.variableData.value = "not a date";
+      await nextTick();
+      wrapper.vm.variableData.type = "date";
+      await nextTick();
+      await nextTick();
+
+      expect(wrapper.vm.variableData.value).toBe("");
+    });
+  });
+
+  describe("Date variable format", () => {
+    const formatSelect = '[data-test="dashboard-variable-date-format-select"]';
+    const dateForm = (extra: Record<string, unknown> = {}) => ({
+      scope: "global",
+      selectedTabs: [],
+      selectedPanels: [],
+      name: "from_date",
+      type: "date",
+      value: "2026-03-08",
+      dateFormat: "dmy",
+      options: [],
+      ...extra,
+    });
+
+    it("shows the format select only for a date variable", async () => {
+      expect(wrapper.find(formatSelect).exists()).toBe(false);
+
+      wrapper.vm.variableData.type = "date";
+      await nextTick();
+      expect(wrapper.find(formatSelect).exists()).toBe(true);
+
+      wrapper.vm.variableData.type = "textbox";
+      await nextTick();
+      expect(wrapper.find(formatSelect).exists()).toBe(false);
+    });
+
+    it("defaults to iso and offers every format with its name", () => {
+      expect(wrapper.vm.variableData.dateFormat).toBe("iso");
+      expect(wrapper.vm.dateFormatOptions.map((o: any) => o.value)).toEqual([
+        "iso",
+        "dmy",
+        "mdy",
+        "epochms",
+        "epochus",
+        "epoch",
+      ]);
+    });
+
+    it("saves dateFormat for a date variable", () => {
+      const payload = wrapper.vm.buildVariablePayload(dateForm());
+      expect(payload.dateFormat).toBe("dmy");
+      expect(payload.value).toBe("2026-03-08");
+    });
+
+    it("drops it when the variable is not a date", () => {
+      const payload = wrapper.vm.buildVariablePayload(dateForm({ type: "textbox" }));
+      expect(payload).not.toHaveProperty("dateFormat");
+    });
+
+    it("shows the default when editing a date variable saved without one", async () => {
+      vi.mocked(getDashboard).mockResolvedValueOnce({
+        variables: { list: [{ name: "old_date", type: "date", value: "2026-01-01" }] },
+      } as any);
+      const editWrapper = mount(AddSettingVariable, {
+        global: { plugins: [] },
+        props: { variableName: "old_date", dashboardVariablesList: [] },
+      });
+      await flushPromises();
+      expect(editWrapper.vm.variableData.type).toBe("date");
+      expect(editWrapper.vm.variableData.dateFormat).toBe("iso");
+      editWrapper.unmount();
+    });
+
+    it("keeps the saved format when editing", async () => {
+      vi.mocked(getDashboard).mockResolvedValueOnce({
+        variables: {
+          list: [
+            {
+              name: "d2",
+              type: "date",
+              value: "",
+              dateFormat: "epochus",
+            },
+          ],
+        },
+      } as any);
+      const editWrapper = mount(AddSettingVariable, {
+        global: { plugins: [] },
+        props: { variableName: "d2", dashboardVariablesList: [] },
+      });
+      await flushPromises();
+      expect(editWrapper.vm.variableData.dateFormat).toBe("epochus");
+      editWrapper.unmount();
     });
   });
 
diff --git a/web/src/components/dashboards/settings/AddSettingVariable.vue b/web/src/components/dashboards/settings/AddSettingVariable.vue
index 03b73e17c5..f7e069ea09 100644
--- a/web/src/components/dashboards/settings/AddSettingVariable.vue
+++ b/web/src/components/dashboards/settings/AddSettingVariable.vue
@@ -289,6 +289,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               data-test="dashboard-variable-textbox-default-value"
             />
           </div>
+          <div class="mt-3" v-if="variableData.type === 'date'">
+            <OFormDate
+              name="value"
+              :label="t('dashboard.DefaultValue')"
+              clearable
+              data-test="dashboard-variable-date-default-value"
+            />
+          </div>
+          <div class="mt-3 flex flex-col" v-if="variableData.type === 'date'">
+            <OFormSelect
+              name="dateFormat"
+              :label="t('dashboard.dateFormat')"
+              :options="dateFormatOptions"
+              :help-text="t('dashboard.dateFormatHelp')"
+              data-test="dashboard-variable-date-format-select"
+            />
+          </div>
           <div v-if="variableData.type == 'custom'">
             <div class="flex">
               <div class="w-6"></div>
@@ -515,6 +532,10 @@ import {
   nextTick,
 } from "vue";
 import { raw, useI18nTyped } from "@/types/i18n";
+import {
+  DATE_VARIABLE_FORMATS,
+  DEFAULT_DATE_VARIABLE_FORMAT,
+} from "@/utils/dashboard/variables/variablesUtils";
 import { useSelectAutoComplete } from "../../../composables/useSelectAutocomplete";
 import { useStore } from "vuex";
 import { addVariable, getDashboard, updateVariable } from "../../../utils/commons";
@@ -531,6 +552,7 @@ import OForm from "@/lib/forms/Form/OForm.vue";
 import { useOForm, type FormFieldPath } from "@/lib/forms/Form/useOForm";
 import OFormSelect from "@/lib/forms/Select/OFormSelect.vue";
 import OFormInput from "@/lib/forms/Input/OFormInput.vue";
+import OFormDate from "@/lib/forms/Date/OFormDate.vue";
 import OFormSwitch from "@/lib/forms/Switch/OFormSwitch.vue";
 import OFormCheckbox from "@/lib/forms/Checkbox/OFormCheckbox.vue";
 import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
@@ -562,6 +584,7 @@ export default defineComponent({
     OForm,
     OFormSelect,
     OFormInput,
+    OFormDate,
     OFormSwitch,
     OFormCheckbox,
     OCheckbox,
@@ -596,6 +619,7 @@ export default defineComponent({
         filter: [],
       },
       value: "",
+      dateFormat: DEFAULT_DATE_VARIABLE_FORMAT,
       options: [{ label: raw(""), value: "", selected: true }],
       multiSelect: false,
       hideOnDashboard: false,
@@ -673,6 +697,7 @@ export default defineComponent({
         name: fieldView("name"),
         label: fieldView("label"),
         value: fieldView("value"),
+        dateFormat: fieldView("dateFormat"),
         query_data: {
           get: () => formValues.value?.query_data ?? {},
           set: (v: unknown) => {
@@ -855,12 +880,32 @@ export default defineComponent({
         label: t("dashboard.textbox"),
         value: "textbox",
       },
+      {
+        label: t("dashboard.date"),
+        value: "date",
+      },
       {
         label: t("dashboard.custom"),
         value: "custom",
       },
     ]);
 
+    // Each option shows its format name as written in `${name:<format>}`.
+    const dateFormatLabels = {
+      iso: "dashboard.dateFormatIso",
+      dmy: "dashboard.dateFormatDmy",
+      mdy: "dashboard.dateFormatMdy",
+      epoch: "dashboard.dateFormatEpoch",
+      epochms: "dashboard.dateFormatEpochms",
+      epochus: "dashboard.dateFormatEpochus",
+    } as const satisfies Record<(typeof DATE_VARIABLE_FORMATS)[number], string>;
+    const dateFormatOptions = computed(() =>
+      DATE_VARIABLE_FORMATS.map((format) => ({
+        label: t(dateFormatLabels[format]),
+        value: format,
+      })),
+    );
+
     const filterCycleError: any = ref("");
 
     // select all values as default value for custom typed variable
@@ -956,6 +1001,7 @@ export default defineComponent({
           filter: variable.query_data?.filter ?? [],
         },
         value: variable.value ?? "",
+        dateFormat: variable.dateFormat ?? DEFAULT_DATE_VARIABLE_FORMAT,
         options,
         multiSelect: variable.multiSelect ?? false,
         hideOnDashboard: variable.hideOnDashboard ?? false,
@@ -1068,6 +1114,15 @@ export default defineComponent({
     watch(
       () => [variableData.type],
       async () => {
+        // a date variable keeps its value only when it is a valid YYYY-MM-DD
+        // (only write when non-empty: the write re-triggers this watcher)
+        if (
+          variableData.type == "date" &&
+          variableData.value &&
+          !/^\d{4}-\d{2}-\d{2}$/.test(String(variableData.value))
+        ) {
+          form.setFieldValue("value", "" as never);
+        }
         if (variableData.type == "query_values") {
           // query_data always exists via the schema defaults (no manual init).
 
@@ -1183,6 +1238,7 @@ export default defineComponent({
       delete v.selectedPanels;
 
       if (v.type !== "query_values") delete v.query_data;
+      if (v.type !== "date") delete v.dateFormat;
       if (v.type !== "query_values" && v.type !== "custom") {
         v.multiSelect = false;
         v.selectAllValueForMultiSelect = "";
@@ -1647,6 +1703,7 @@ export default defineComponent({
       streamsFilteredOptions,
       fieldsFilteredOptions,
       variableTypes,
+      dateFormatOptions,
       streamTypeUpdated,
       streamUpdated,
       onActivated,
diff --git a/web/src/components/dashboards/settings/VariableSettings.vue b/web/src/components/dashboards/settings/VariableSettings.vue
index 0adab9df46..4e021cf4f7 100644
--- a/web/src/components/dashboards/settings/VariableSettings.vue
+++ b/web/src/components/dashboards/settings/VariableSettings.vue
@@ -401,6 +401,10 @@ export default defineComponent({
         label: t("dashboard.textbox"),
         value: "textbox",
       },
+      {
+        label: t("dashboard.date"),
+        value: "date",
+      },
       {
         label: t("dashboard.custom"),
         value: "custom",
diff --git a/web/src/components/dbm/DbmCoverageLine.spec.ts b/web/src/components/dbm/DbmCoverageLine.spec.ts
index b1511e418c..d32e631a73 100644
--- a/web/src/components/dbm/DbmCoverageLine.spec.ts
+++ b/web/src/components/dbm/DbmCoverageLine.spec.ts
@@ -62,6 +62,22 @@ describe("DbmCoverageLine", () => {
       expect(lineText(wrapper)).toContain("they're exact");
     });
 
+    it("says a several-schema database shows its slowest schema's speeds", () => {
+      const wrapper = mountLine({ exactPercentiles: true, slowestSchemaSpeeds: true });
+      expect(lineText(wrapper)).toBe(
+        "All databases reporting. Speeds are exact per schema; a database with several schemas shows its slowest one.",
+      );
+    });
+
+    it("keeps the estimated copy when the server fused windows, several schemas or not", () => {
+      const wrapper = mountLine({
+        exactPercentiles: true,
+        slowestSchemaSpeeds: true,
+        freshness: freshness({ percentiles_estimated: true }),
+      });
+      expect(lineText(wrapper)).toContain("close but not exact");
+    });
+
     it("never claims exactness when the server fused windows", () => {
       const wrapper = mountLine({
         exactPercentiles: false,
diff --git a/web/src/components/dbm/DbmCoverageLine.vue b/web/src/components/dbm/DbmCoverageLine.vue
index e60961a4f2..3ada771d54 100644
--- a/web/src/components/dbm/DbmCoverageLine.vue
+++ b/web/src/components/dbm/DbmCoverageLine.vue
@@ -155,6 +155,8 @@ const props = withDefaults(
      * separate question the response answers via `percentiles_estimated`.
      */
     exactPercentiles?: boolean;
+    /** Some row folds several schemas, so its speeds are its slowest schema's, not its own. */
+    slowestSchemaSpeeds?: boolean;
     /**
      * What these rows ARE. `list` (default) is a ranked table, where the share
      * of total time is the headline claim. `query` is one statement, where that
@@ -172,6 +174,7 @@ const props = withDefaults(
     other: () => [],
     topNSubset: false,
     exactPercentiles: false,
+    slowestSchemaSpeeds: false,
     filterLabel: null,
     subject: "list",
     inline: false,
@@ -411,8 +414,9 @@ const summary = computed<I18nText>(() => {
   // The Overview grain measures every call, so it states exactness plainly
   // rather than borrowing the per-query "heaviest N" sentence.
   if (props.exactPercentiles) {
-    return estimatedSpeeds.value
-      ? t("dbm.coverage.lineExactEstimated")
+    if (estimatedSpeeds.value) return t("dbm.coverage.lineExactEstimated");
+    return props.slowestSchemaSpeeds
+      ? t("dbm.coverage.lineExactSlowestSchema")
       : t("dbm.coverage.lineExact");
   }
   if (otherTime.value <= 0) {
diff --git a/web/src/components/fleet/FleetAudit.spec.ts b/web/src/components/fleet/FleetAudit.spec.ts
index 927ffc6525..e2c2e26857 100644
--- a/web/src/components/fleet/FleetAudit.spec.ts
+++ b/web/src/components/fleet/FleetAudit.spec.ts
@@ -20,6 +20,7 @@ import store from "@/test/unit/helpers/store";
 import fleet from "@/services/fleet";
 import { queryClient } from "@/composables/query/queryClient";
 import FleetAudit from "./FleetAudit.vue";
+import { apiFleet } from "./fleet.fixtures";
 
 vi.mock("@/aws-exports", async (importOriginal) => {
   const actual: any = await importOriginal();
@@ -27,9 +28,11 @@ vi.mock("@/aws-exports", async (importOriginal) => {
 });
 
 vi.mock("@/services/fleet", () => ({
-  default: { listAudit: vi.fn() },
+  default: { listAudit: vi.fn(), listFleets: vi.fn() },
 }));
 
+const DAY_MS = 86_400_000;
+
 const event = (over: Record<string, unknown> = {}) => ({
   id: "a1",
   at: Date.now(),
@@ -48,17 +51,29 @@ const settle = async () => {
 
 describe("FleetAudit", () => {
   let wrapper: VueWrapper;
+  const org = () => store.state.selectedOrganization.identifier;
+  const lastParams = () => vi.mocked(fleet.listAudit).mock.calls.at(-1)?.[1] as any;
 
   beforeEach(() => {
     queryClient.clear();
     vi.mocked(fleet.listAudit).mockResolvedValue({
       data: {
+        total: 120,
         items: [
           event(),
           event({ id: "a2", action: "fleet.audit.someFutureAction", target: "tok-1" }),
         ],
       },
     } as any);
+    vi.mocked(fleet.listFleets).mockResolvedValue({
+      data: {
+        items: [
+          apiFleet({ id: "prod", name: "Production" }),
+          apiFleet({ id: "hidden", name: "Hidden", state: null }),
+        ],
+        total: 2,
+      },
+    } as any);
   });
 
   afterEach(() => {
@@ -67,45 +82,144 @@ describe("FleetAudit", () => {
   });
 
   async function mountAudit() {
-    wrapper = mount(FleetAudit, { attachTo: document.body, global: { plugins: [i18n, store] } });
+    wrapper = mount(FleetAudit, {
+      attachTo: document.body,
+      global: { plugins: [i18n, store], stubs: { DateTime: true } },
+    });
     await settle();
     return wrapper;
   }
 
   const auditText = (w: VueWrapper) => w.find('[data-test="fleet-audit-table"]').text();
+  const pick = async (testId: string, value: unknown) => {
+    wrapper.findComponent(`[data-test="${testId}"]`).vm.$emit("update:modelValue", value);
+    await settle();
+  };
 
-  it("reads the audit rows from the API", async () => {
+  it("reads the first page of the last 30 days from the API", async () => {
+    const before = Date.now();
     await mountAudit();
-    expect(fleet.listAudit).toHaveBeenCalledWith(store.state.selectedOrganization.identifier);
+    const after = Date.now();
+    expect(fleet.listAudit).toHaveBeenCalledTimes(1);
+    const [orgId, params] = vi.mocked(fleet.listAudit).mock.calls[0] as any;
+    expect(orgId).toBe(org());
+    expect(params).toMatchObject({ offset: 0, limit: 50 });
+    expect(params.from).toBeGreaterThanOrEqual(before - 30 * DAY_MS);
+    expect(params.from).toBeLessThanOrEqual(after - 30 * DAY_MS);
+    expect(params.to).toBeUndefined();
+    expect(params).not.toHaveProperty("fleet");
+    expect(params).not.toHaveProperty("module");
     expect(auditText(wrapper)).toContain("edge-minimal v1");
     expect(auditText(wrapper)).toContain("ana@acme.io");
   });
+
+  it("pages on the server with the total the response reports", async () => {
+    await mountAudit();
+    const table = wrapper.findComponent({ name: "OTable" });
+    expect(table.props("pagination")).toBe("server");
+    expect(table.props("totalCount")).toBe(120);
+    expect(wrapper.find('[data-test="o2-table-pagination-info"]').text()).toContain("120");
+    await wrapper.find('[data-test="o2-table-next-page-btn"]').trigger("click");
+    await settle();
+    expect(lastParams()).toMatchObject({ offset: 50, limit: 50 });
+    expect(table.props("currentPage")).toBe(2);
+  });
+
+  it("sends the module filter and goes back to the first page", async () => {
+    await mountAudit();
+    await wrapper.find('[data-test="o2-table-next-page-btn"]').trigger("click");
+    await settle();
+    expect(lastParams().offset).toBe(50);
+    await pick("fleet-audit-module-filter", "configs");
+    expect(lastParams()).toMatchObject({ offset: 0, module: "configs" });
+    expect(wrapper.findComponent({ name: "OTable" }).props("currentPage")).toBe(1);
+  });
+
+  it("offers only the fleets the caller can read and sends the one picked", async () => {
+    await mountAudit();
+    const options = wrapper
+      .findComponent('[data-test="fleet-audit-fleet-filter"]')
+      .props("options") as { label: string; value: string }[];
+    expect(options.map((o) => o.value)).toEqual(["prod"]);
+    await pick("fleet-audit-fleet-filter", "prod");
+    expect(lastParams()).toMatchObject({ offset: 0, fleet: "prod" });
+  });
+
+  it("searches the actor and target on the server from the first page", async () => {
+    vi.mocked(fleet.listAudit).mockImplementation(async (_org, params: any) => ({
+      data: { total: 120, items: [event({ target: `q:${params.q ?? "none"}` })] },
+    }));
+    await mountAudit();
+    await wrapper.find('[data-test="o2-table-next-page-btn"]').trigger("click");
+    await settle();
+    await pick("fleet-audit-search", "  web-1 ");
+    expect(lastParams()).toMatchObject({ offset: 0, q: "web-1" });
+    expect(auditText(wrapper)).toContain("q:web-1");
+    await pick("fleet-audit-search", " ");
+    expect(auditText(wrapper)).toContain("q:none");
+  });
+
+  it("has no actor filter and keeps the period beside the refresh button", async () => {
+    await mountAudit();
+    expect(wrapper.find('[data-test="fleet-audit-actor-filter"]').exists()).toBe(false);
+    const trailing = wrapper.find('[data-test="fleet-audit-toolbar-trailing"]');
+    expect(trailing.find('[data-test="fleet-audit-range"]').exists()).toBe(true);
+    expect(trailing.find('[data-test="fleet-audit-refresh"]').exists()).toBe(true);
+  });
+
+  it("narrows the period to a shorter preset", async () => {
+    await mountAudit();
+    const before = Date.now();
+    await pick("fleet-audit-range", "24h");
+    expect(lastParams().from).toBeGreaterThanOrEqual(before - DAY_MS);
+    expect(lastParams().offset).toBe(0);
+  });
+
+  it("sends a custom period in epoch milliseconds", async () => {
+    await mountAudit();
+    await pick("fleet-audit-range", "custom");
+    wrapper
+      .findComponent('[data-test="fleet-audit-date-picker"]')
+      .vm.$emit("on:date-change", { startTime: 1_000_000_000, endTime: 2_000_000_000 });
+    await settle();
+    expect(lastParams()).toMatchObject({ offset: 0, from: 1_000_000, to: 2_000_000 });
+  });
+
   it("says the audit trail needs O2_AUDIT_ENABLED when the server has it off", async () => {
     vi.mocked(fleet.listAudit).mockResolvedValue({
-      data: { items: [], audit_disabled: true },
+      data: { total: 0, items: [], audit_disabled: true },
     } as any);
     await mountAudit();
     expect(auditText(wrapper)).toContain("O2_AUDIT_ENABLED");
   });
+
   it("says entries arrive with the audit publish interval when the trail is empty", async () => {
-    vi.mocked(fleet.listAudit).mockResolvedValue({ data: { items: [] } } as any);
+    vi.mocked(fleet.listAudit).mockResolvedValue({ data: { total: 0, items: [] } } as any);
     await mountAudit();
     expect(auditText(wrapper)).toContain("O2_AUDIT_PUBLISH_INTERVAL");
   });
-  it("files each row under its object and filters by it", async () => {
+
+  it("clears every filter from the filtered empty state", async () => {
+    vi.mocked(fleet.listAudit).mockImplementation(async (_org, params: any) => ({
+      data: { total: params.module ? 0 : 1, items: params.module ? [] : [event()] },
+    }));
+    await mountAudit();
+    await pick("fleet-audit-module-filter", "tokens");
+    expect(lastParams()).toMatchObject({ module: "tokens" });
+    const empty = wrapper.findComponent({ name: "OEmptyState" });
+    expect(empty.props("filtered")).toBe(true);
+    empty.vm.$emit("action", "clear-filters");
+    await settle();
+    expect(auditText(wrapper)).toContain("edge-minimal v1");
+    expect(
+      wrapper.findComponent('[data-test="fleet-audit-module-filter"]').props("modelValue"),
+    ).toBe(null);
+  });
+
+  it("files each row under its object", async () => {
     wrapper = await mountAudit();
     expect(wrapper.find('[data-test="fleet-audit-kind-a1"]').text()).toBe("Configuration");
     expect(wrapper.find('[data-test="fleet-audit-kind-a2"]').text()).toBe("Other");
-    wrapper
-      .findComponent('[data-test="fleet-audit-kind-filter"]')
-      .vm.$emit("update:modelValue", "token");
-    await flushPromises();
-    expect(wrapper.findAll("tbody tr").length).toBe(0);
-    wrapper
-      .findComponent('[data-test="fleet-audit-kind-filter"]')
-      .vm.$emit("update:modelValue", "configuration");
-    await flushPromises();
-    expect(wrapper.findAll("tbody tr").map((tr) => tr.text())).toHaveLength(1);
   });
 
   it("translates a known action key and shows an unknown one raw", async () => {
@@ -118,7 +232,7 @@ describe("FleetAudit", () => {
     vi.mocked(fleet.listAudit).mockRejectedValue(new Error("boom"));
     await mountAudit();
     expect(wrapper.find('[data-test="fleet-audit-error"]').exists()).toBe(true);
-    vi.mocked(fleet.listAudit).mockResolvedValue({ data: { items: [event()] } } as any);
+    vi.mocked(fleet.listAudit).mockResolvedValue({ data: { total: 1, items: [event()] } } as any);
     wrapper
       .find('[data-test="fleet-audit-error"]')
       .findComponent({ name: "OEmptyState" })
diff --git a/web/src/components/fleet/FleetAudit.vue b/web/src/components/fleet/FleetAudit.vue
index 4ea657fe7f..37d675d341 100644
--- a/web/src/components/fleet/FleetAudit.vue
+++ b/web/src/components/fleet/FleetAudit.vue
@@ -18,49 +18,100 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
   <div class="card-container flex min-h-0 flex-1 flex-col overflow-hidden" data-test="fleet-audit">
     <OTable
       class="min-h-0 flex-1"
-      :data="rows"
+      :data="audit.rows.value"
       :columns="auditColumns"
       row-key="id"
       :frame="false"
-      pagination="client"
-      :page-size="20"
+      pagination="server"
+      :current-page="page"
+      :page-size="pageSize"
+      :total-count="audit.total.value"
+      sorting="none"
       :show-global-filter="false"
-      :loading="auditLoading"
+      :loading="audit.loading.value"
       :forbidden="auditForbidden"
       :error="auditError"
       :empty-message="audit.disabled.value ? t('fleet.settings.auditDisabled') : undefined"
       data-test="fleet-audit-table"
+      @pagination-change="onPaginationChange"
     >
       <template #toolbar>
-        <div class="flex min-w-0 flex-1 items-center gap-2 max-md:min-w-40">
+        <div class="flex min-w-0 flex-1 items-center gap-2 max-md:contents">
           <OSearchInput
-            v-model="search"
+            :model-value="filters.q"
             class="min-w-0 flex-1"
             size="sm"
             clearable
+            :debounce="300"
             :placeholder="t('fleet.audit.search')"
             data-test="fleet-audit-search"
+            @update:model-value="(v) => setFilters({ q: v ?? '' })"
           />
           <OSelect
-            v-model="kindFilter"
+            :model-value="filters.fleet"
             width="sm"
             size="sm"
             clearable
-            :options="kindOptions"
+            :options="fleetOptions"
+            :placeholder="t('fleet.collectors.allFleets')"
+            data-test="fleet-audit-fleet-filter"
+            @update:model-value="(v) => setFilters({ fleet: (v as string | null) ?? null })"
+          />
+          <OSelect
+            :model-value="filters.module"
+            width="sm"
+            size="sm"
+            clearable
+            :options="moduleOptions"
             :placeholder="t('fleet.audit.allObjects')"
-            data-test="fleet-audit-kind-filter"
+            data-test="fleet-audit-module-filter"
+            @update:model-value="
+              (v) => setFilters({ module: (v as FleetAuditModule | null) ?? null })
+            "
           />
         </div>
       </template>
       <template #toolbar-trailing>
-        <ORefreshButton
-          layout="inline"
-          variant="outline"
-          :last-run-at="audit.lastUpdatedAt.value || null"
-          :loading="audit.fetching.value"
-          data-test="fleet-audit-refresh"
-          @click="audit.refetch()"
-        />
+        <div class="flex items-center gap-2" data-test="fleet-audit-toolbar-trailing">
+          <OToggleGroup
+            :model-value="filters.range"
+            mobile-dropdown
+            data-test="fleet-audit-range"
+            @update:model-value="(v) => v && onRangeChange(v as AuditRange)"
+          >
+            <OToggleGroupItem
+              v-for="option in AUDIT_RANGES"
+              :key="option.value"
+              :value="option.value"
+              size="sm"
+              :data-test="`fleet-audit-range-${option.value}`"
+            >
+              {{ t(option.labelKey) }}
+            </OToggleGroupItem>
+            <OToggleGroupItem value="custom" size="sm" data-test="fleet-audit-range-custom">
+              {{ t("reports.history.rangeCustom") }}
+            </OToggleGroupItem>
+          </OToggleGroup>
+          <DateTime
+            v-if="filters.range === 'custom'"
+            auto-apply
+            default-type="absolute"
+            :default-absolute-time="{
+              startTime: customRange.from * 1000,
+              endTime: customRange.to * 1000,
+            }"
+            data-test="fleet-audit-date-picker"
+            @on:date-change="onCustomRange"
+          />
+          <ORefreshButton
+            layout="inline"
+            variant="outline"
+            :last-run-at="audit.lastUpdatedAt.value || null"
+            :loading="audit.fetching.value"
+            data-test="fleet-audit-refresh"
+            @click="audit.refetch()"
+          />
+        </div>
       </template>
       <template #cell-at="{ row }">
         <OTimeCell :value="row.at" unit="ms" mode="relative" />
@@ -80,12 +131,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <OEmptyState
           size="block"
           preset="no-data"
-          :filtered="!!search || !!kindFilter"
+          :filtered="isFiltered"
           :title="audit.disabled.value ? t('fleet.settings.auditDisabled') : undefined"
           :description="
-            audit.disabled.value || search || kindFilter
-              ? undefined
-              : t('fleet.settings.auditDelayHint')
+            audit.disabled.value || isFiltered ? undefined : t('fleet.settings.auditDelayHint')
           "
           @action="clearFilters"
         />
@@ -101,25 +150,76 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <script setup lang="ts">
 import { computed, ref } from "vue";
+import DateTime from "@/components/DateTime.vue";
 import OText from "@/lib/core/Typography/OText.vue";
 import OTable from "@/lib/core/Table/OTable.vue";
-import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import type { OTableColumnDef, OTablePaginationParams } from "@/lib/core/Table/OTable.types";
 import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
+import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
+import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
-import { raw, useI18nTyped } from "@/types/i18n";
-import type { FleetAuditEvent } from "@/services/fleet";
-import { isForbidden, useFleetAudit } from "./useFleetApi";
-import { AUDIT_KINDS, auditKind, type AuditKind } from "./auditKind";
+import { raw, useI18nTyped, type I18nKey } from "@/types/i18n";
+import type { FleetAuditEvent, FleetAuditModule, FleetAuditParams } from "@/services/fleet";
+import { isForbidden, useFleetAudit, useFleets } from "./useFleetApi";
+import { AUDIT_MODULES, auditKind, type AuditKind } from "./auditKind";
+
+interface AuditFilters {
+  q: string;
+  fleet: string | null;
+  module: FleetAuditModule | null;
+  range: AuditRange;
+}
+
+const DAY_MS = 86_400_000;
+const PAGE_SIZE = 50;
+
+const AUDIT_RANGES = [
+  { value: "24h", labelKey: "reports.history.range24h", ms: DAY_MS },
+  { value: "7d", labelKey: "reports.history.range7d", ms: 7 * DAY_MS },
+  { value: "30d", labelKey: "reports.history.range30d", ms: 30 * DAY_MS },
+] as const satisfies readonly { value: string; labelKey: I18nKey; ms: number }[];
+
+type AuditRange = (typeof AUDIT_RANGES)[number]["value"] | "custom";
+
+// The server's default period, so only a different one counts as a filter.
+const DEFAULT_RANGE: AuditRange = "30d";
+
+const DEFAULT_FILTERS: AuditFilters = {
+  q: "",
+  fleet: null,
+  module: null,
+  range: DEFAULT_RANGE,
+};
 
 const { t, te } = useI18nTyped();
 
-const audit = useFleetAudit();
-const search = ref("");
-const kindFilter = ref<AuditKind | null>(null);
-const auditLoading = audit.loading;
+const page = ref(1);
+const pageSize = ref(PAGE_SIZE);
+const filters = ref<AuditFilters>({ ...DEFAULT_FILTERS });
+const anchor = ref(Date.now());
+const customRange = ref({ from: Date.now() - 30 * DAY_MS, to: Date.now() });
+
+const period = computed((): Pick<FleetAuditParams, "from" | "to"> => {
+  if (filters.value.range === "custom") return { ...customRange.value };
+  const preset = AUDIT_RANGES.find((r) => r.value === filters.value.range)!;
+  // No `to`: the server ends the period at now, so a refetch picks up events newer than the anchor.
+  return { from: anchor.value - preset.ms };
+});
+
+const params = computed((): FleetAuditParams => ({
+  offset: (page.value - 1) * pageSize.value,
+  limit: pageSize.value,
+  q: filters.value.q.trim() || undefined,
+  fleet: filters.value.fleet ?? undefined,
+  module: filters.value.module ?? undefined,
+  ...period.value,
+}));
+
+const audit = useFleetAudit(() => params.value);
+const fleets = useFleets();
 const auditForbidden = computed(() => isForbidden(audit.error.value));
 const auditError = computed(() =>
   audit.error.value && !auditForbidden.value && !audit.rows.value.length
@@ -127,44 +227,62 @@ const auditError = computed(() =>
     : null,
 );
 
-const actionText = (e: FleetAuditEvent) => (te(e.action) ? t(e.action) : e.action);
 const kindLabel = (kind: AuditKind) => t(`fleet.audit.kind.${kind}`);
-const kindOptions = computed(() =>
-  AUDIT_KINDS.map((kind) => ({ label: kindLabel(kind), value: kind })),
+const moduleOptions = computed(() =>
+  Object.entries(AUDIT_MODULES).map(([kind, module]) => ({
+    label: kindLabel(kind as AuditKind),
+    value: module,
+  })),
+);
+// The server returns an empty page for a fleet the caller may not read.
+const fleetOptions = computed(() =>
+  fleets.rows.value.filter((f) => f.readable).map((f) => ({ label: raw(f.name), value: f.id })),
 );
 
-function clearFilters() {
-  search.value = "";
-  kindFilter.value = null;
+const isFiltered = computed(
+  () =>
+    !!filters.value.q.trim() ||
+    !!filters.value.fleet ||
+    !!filters.value.module ||
+    filters.value.range !== DEFAULT_RANGE,
+);
+
+function setFilters(patch: Partial<AuditFilters>) {
+  filters.value = { ...filters.value, ...patch };
+  page.value = 1;
 }
 
-const rows = computed(() => {
-  const q = search.value.trim().toLowerCase();
-  return audit.rows.value.filter((e) => {
-    const kind = auditKind(e.action);
-    if (kindFilter.value && kind !== kindFilter.value) return false;
-    if (!q) return true;
-    return [e.actor, kindLabel(kind), actionText(e), e.target ?? ""].some((s) =>
-      String(s).toLowerCase().includes(q),
-    );
-  });
-});
+function onRangeChange(range: AuditRange) {
+  anchor.value = Date.now();
+  setFilters({ range });
+}
+
+function onCustomRange(value: { startTime: number; endTime: number }) {
+  customRange.value = {
+    from: Math.floor(value.startTime / 1000),
+    to: Math.floor(value.endTime / 1000),
+  };
+  page.value = 1;
+}
+
+function clearFilters() {
+  anchor.value = Date.now();
+  setFilters({ ...DEFAULT_FILTERS });
+}
+
+function onPaginationChange({ page: next, size }: OTablePaginationParams) {
+  page.value = size === pageSize.value ? next : 1;
+  pageSize.value = size;
+}
 
 const auditColumns = computed<OTableColumnDef<FleetAuditEvent>[]>(() => [
-  { id: "at", header: t("fleet.settings.when"), accessorKey: "at", size: 140, sortable: true },
-  {
-    id: "actor",
-    header: t("fleet.settings.actor"),
-    accessorKey: "actor",
-    size: 220,
-    sortable: true,
-  },
+  { id: "at", header: t("fleet.settings.when"), accessorKey: "at", size: 140 },
+  { id: "actor", header: t("fleet.settings.actor"), accessorKey: "actor", size: 220 },
   {
     id: "kind",
     header: t("fleet.audit.object"),
     accessorFn: (e) => auditKind(e.action),
     size: 140,
-    sortable: true,
   },
   { id: "action", header: t("fleet.settings.action"), accessorKey: "action", size: 240 },
   { id: "target", header: t("fleet.settings.target"), accessorKey: "target", size: 320 },
diff --git a/web/src/components/fleet/FleetFlowOverview.spec.ts b/web/src/components/fleet/FleetFlowOverview.spec.ts
index 714d31c77f..ea5abde5d2 100644
--- a/web/src/components/fleet/FleetFlowOverview.spec.ts
+++ b/web/src/components/fleet/FleetFlowOverview.spec.ts
@@ -193,10 +193,10 @@ afterEach(() => {
 });
 
 describe("FleetFlowOverview map", () => {
-  it("draws the four columns fleet, receiver, exporter, destination", async () => {
+  it("draws the three columns fleet, receiver, destination", async () => {
     serve(basePipelines());
     await mountOverview();
-    const columns = ["f:", "r:", "e:", "d:"].map((prefix) =>
+    const columns = ["f:", "r:", "d:"].map((prefix) =>
       nodes()
         .filter((n) => n.id.startsWith(prefix))
         .map((n) => n.id),
@@ -204,44 +204,44 @@ describe("FleetFlowOverview map", () => {
     expect(columns).toEqual([
       ["f:prod", "f:edge"],
       ["r:prod|filelog", "r:prod|hostmetrics", "r:edge|otlp"],
-      ["e:prod|otlphttp/o2", "e:prod|kafka/bus", "e:edge|otlphttp/o2"],
       [`d:${D1.id}`, `d:${D2.id}`],
     ]);
     const x = (id: string) => nodes().find((n) => n.id === id).position.x;
     expect(x("f:prod")).toBeLessThan(x("r:prod|filelog"));
-    expect(x("r:prod|filelog")).toBeLessThan(x("e:prod|kafka/bus"));
-    expect(x("e:prod|kafka/bus")).toBeLessThan(x(`d:${D1.id}`));
+    expect(x("r:prod|filelog")).toBeLessThan(x(`d:${D1.id}`));
   });
 
   it("colours edges by signal and sizes them by rate, never by severity", async () => {
     serve(basePipelines());
     await mountOverview();
-    const metrics = edge(`ed:prod|otlphttp/o2|${D1.id}|metrics`).data;
-    const logs = edge(`ed:prod|otlphttp/o2|${D1.id}|logs`).data;
+    const metrics = edge(`rd:prod|hostmetrics|${D1.id}|metrics`).data;
+    const logs = edge(`rd:prod|filelog|${D1.id}|logs`).data;
     expect(metrics.signal).toBe("metrics");
     expect(logs.signal).toBe("logs");
     expect(metrics.width).toBeGreaterThan(logs.width);
     expect(Object.keys(logs)).not.toContain("severity");
   });
 
-  it("branches the failing exporter off with a dashed send-failed line and rings it", async () => {
+  it("branches the failing destination off with a dashed send-failed line and rings it", async () => {
     serve(basePipelines());
     await mountOverview();
-    const branch = edge("br:e:prod|otlphttp/o2");
-    expect(branch.source).toBe("e:prod|otlphttp/o2");
-    expect(branch.data).toMatchObject({ branch: true, label: "Send failed 3.3%" });
+    const branch = edge(`br:d:${D1.id}`);
+    expect(branch.source).toBe(`d:${D1.id}`);
+    expect(branch.data).toMatchObject({ branch: true, label: "Send failed 20%" });
     expect(edges().filter((e) => e.data.branch)).toHaveLength(1);
-    const ring = (id: string) => nodes().find((n) => n.id === id).data.ring;
-    expect(ring("e:prod|otlphttp/o2")).toBe("error");
-    expect(ring("e:prod|kafka/bus")).toBe("warning");
-    expect(ring("e:edge|otlphttp/o2")).toBeUndefined();
+    const data = (id: string) => nodes().find((n) => n.id === id).data;
+    expect(data(`d:${D1.id}`)).toMatchObject({ ring: "error", outbound: true });
+    expect(data(`d:${D2.id}`)).toMatchObject({ ring: "warning", outbound: false });
+    const sink = nodes().find((n) => n.id === `x:d:${D1.id}`);
+    expect(sink.ariaLabel).toBe("o2.acme.io");
+    expect(sink.data.label).toBe("o2.acme.io");
   });
 
-  it("opens the failing exporter's details from the branch", async () => {
+  it("opens the failing destination's details from the branch", async () => {
     serve(basePipelines());
     await mountOverview();
-    await clickEdge("br:e:prod|otlphttp/o2");
-    expect(details().props("title")).toBe("otlphttp/o2");
+    await clickEdge(`br:d:${D1.id}`);
+    expect(details().props("title")).toBe("o2.acme.io");
     expect(
       details()
         .props("issues")
@@ -259,13 +259,13 @@ describe("FleetFlowOverview map", () => {
     expect(nodes().find((n) => n.id === "f:edge").data.selected).toBe(true);
   });
 
-  it("drops the exporters of an unchecked destination from the map", async () => {
+  it("drops an unchecked destination and its lines from the map", async () => {
     serve(basePipelines());
     await mountOverview();
     lists()[1].vm.$emit("update:modelValue", [D1.id]);
     await flushPromises();
     expect(nodes().some((n) => n.id === `d:${D2.id}`)).toBe(false);
-    expect(nodes().some((n) => n.id === "e:prod|kafka/bus")).toBe(false);
+    expect(edges().some((e) => e.target === `d:${D2.id}`)).toBe(false);
   });
 });
 
diff --git a/web/src/components/fleet/FleetFlowOverview.vue b/web/src/components/fleet/FleetFlowOverview.vue
index 51bdf1a2d9..5665a2be13 100644
--- a/web/src/components/fleet/FleetFlowOverview.vue
+++ b/web/src/components/fleet/FleetFlowOverview.vue
@@ -346,9 +346,9 @@ const DESTINATION_ICON: Record<string, IconName> = {
   awss3: "inventory-2",
 };
 
-const COLUMN_ICON: Record<string, IconName> = { f: "dns", r: "input", e: "send" };
+const COLUMN_ICON: Record<string, IconName> = { f: "dns", r: "input" };
 
-// An exporter failing at least this share of its items, or a receiver refusing it, is rung like its issue.
+// A destination failing at least this share of its items, or a receiver refusing it, is rung like its issue.
 const ISSUE_RATIO = 0.01;
 const QUEUE_WARNING = 0.8;
 
@@ -574,13 +574,13 @@ function nodeSignal(n: MapNode): FlowSignal {
 
 function nodeLabel(n: MapNode): I18nText {
   if (n.column === "fleet") return raw(fleetName(n.name));
-  if (n.column === "destination") return destinationLabel(n.name);
+  if (n.column === "destination" || n.column === "sink") return destinationLabel(n.name);
   return raw(n.name);
 }
 
 function nodeRing(n: MapNode): PathSeverity | undefined {
-  if (n.column === "exporter") {
-    if (ratio(n.failed, n.rate) >= ISSUE_RATIO || n.dropped > 0) return "error";
+  if (n.column === "destination") {
+    if (n.failedRatio >= ISSUE_RATIO || n.dropped > 0) return "error";
     if ((n.queue ?? 0) >= QUEUE_WARNING) return "warning";
   }
   if (n.column === "receiver" && ratio(n.refused, n.rate) >= ISSUE_RATIO) return "warning";
@@ -623,7 +623,7 @@ function nodeData(n: MapNode): FleetFlowNodeData {
     compact: !destination,
     selected: sel?.kind === "node" && sel.id === n.id,
     inbound: true,
-    outbound: !destination,
+    outbound: !destination || n.failed > 0 || n.dropped > 0,
     ring: nodeRing(n),
   };
 }
diff --git a/web/src/components/fleet/auditKind.spec.ts b/web/src/components/fleet/auditKind.spec.ts
index ada5099d92..642abffd44 100644
--- a/web/src/components/fleet/auditKind.spec.ts
+++ b/web/src/components/fleet/auditKind.spec.ts
@@ -18,7 +18,7 @@ import { auditKind } from "./auditKind";
 
 describe("auditKind", () => {
   it("files each action under what it acted on", () => {
-    expect(auditKind("fleet.audit.setDesired")).toBe("rollout");
+    expect(auditKind("fleet.audit.setDesired")).toBe("fleet");
     expect(auditKind("fleet.audit.autoRollback")).toBe("rollout");
     expect(auditKind("fleet.audit.publishedVersion")).toBe("configuration");
     expect(auditKind("fleet.audit.movedByToken")).toBe("collector");
@@ -29,6 +29,7 @@ describe("auditKind", () => {
 
   it("keeps an action it does not know under other, with or without the key prefix", () => {
     expect(auditKind("fleet.audit.someFutureAction")).toBe("other");
+    expect(auditKind("fleet.audit.assignedFleetConfig")).toBe("other");
     expect(auditKind("createdToken")).toBe("token");
   });
 });
diff --git a/web/src/components/fleet/auditKind.ts b/web/src/components/fleet/auditKind.ts
index edeac35693..fee140bbcf 100644
--- a/web/src/components/fleet/auditKind.ts
+++ b/web/src/components/fleet/auditKind.ts
@@ -13,36 +13,39 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
+import type { FleetAuditModule } from "@/services/fleet";
+
 /** What an audit action acted on, derived from the action key the server stores. */
 export type AuditKind =
   "fleet" | "collector" | "configuration" | "rollout" | "token" | "settings" | "other";
 
-export const AUDIT_KINDS: AuditKind[] = [
-  "fleet",
-  "collector",
-  "configuration",
-  "rollout",
-  "token",
-  "settings",
-];
+/** The server's `module` filter for each kind, in the order the filter offers them. */
+export const AUDIT_MODULES: Record<Exclude<AuditKind, "other">, FleetAuditModule> = {
+  fleet: "fleets",
+  collector: "collectors",
+  configuration: "configs",
+  rollout: "rollouts",
+  token: "tokens",
+  settings: "settings",
+};
 
 const KIND_OF: Record<string, AuditKind> = {
   createdFleet: "fleet",
   renamedFleet: "fleet",
   deletedFleet: "fleet",
   updatedFleetSettings: "fleet",
+  // The server files it by its path, fleets/{id}/desired, though it starts a rollout.
+  setDesired: "fleet",
   enrolledCollector: "collector",
   movedByToken: "collector",
   removedCollector: "collector",
   renamedCollector: "collector",
   restartedCollector: "collector",
   redeliveredCollector: "collector",
-  assignedFleetConfig: "collector",
   createdConfig: "configuration",
   editedConfig: "configuration",
   publishedVersion: "configuration",
   deletedConfig: "configuration",
-  setDesired: "rollout",
   rolloutHalted: "rollout",
   autoRollback: "rollout",
   resumedRollout: "rollout",
diff --git a/web/src/components/fleet/pipelineGraph.spec.ts b/web/src/components/fleet/pipelineGraph.spec.ts
index 33783814ce..cb3ade8d77 100644
--- a/web/src/components/fleet/pipelineGraph.spec.ts
+++ b/web/src/components/fleet/pipelineGraph.spec.ts
@@ -65,57 +65,112 @@ const traces = pipeline({
 const byId = <T extends { id: string }>(list: T[]) => new Map(list.map((x) => [x.id, x]));
 
 describe("buildPipelineMap", () => {
-  it("lays out four columns: fleet, receiver, exporter, destination", () => {
+  it("lays out three columns: fleet, receiver, destination", () => {
     const map = buildPipelineMap([logs, traces], layout);
-    const columns = ["fleet", "receiver", "exporter", "destination"].map((c) =>
+    const columns = ["fleet", "receiver", "destination"].map((c) =>
       map.nodes.filter((n) => n.column === c).map((n) => n.id),
     );
-    expect(columns).toEqual([
-      ["f:prod"],
-      ["r:prod|filelog", "r:prod|otlp"],
-      ["e:prod|otlphttp", "e:prod|s3"],
-      ["d:d_o2", "d:d_s3"],
-    ]);
+    expect(columns).toEqual([["f:prod"], ["r:prod|filelog", "r:prod|otlp"], ["d:d_o2", "d:d_s3"]]);
     const xs = columns.map((ids) => byId(map.nodes).get(ids[0])!.x);
     expect(xs).toEqual([...xs].sort((a, b) => a - b));
-    expect(new Set(xs).size).toBe(4);
+    expect(new Set(xs).size).toBe(3);
   });
 
-  it("splits an exporter's rate over the receivers by their share of the pipeline input", () => {
+  it("splits a destination's rate over the receivers by their share of the pipeline input", () => {
     const edges = byId(buildPipelineMap([logs], layout).edges);
-    expect(edges.get("re:prod|filelog|otlphttp|logs")?.rate).toBe(150);
-    expect(edges.get("re:prod|otlp|otlphttp|logs")?.rate).toBe(50);
-    expect(edges.get("re:prod|filelog|s3|logs")?.rate).toBe(300);
+    expect(edges.get("rd:prod|filelog|d_o2|logs")?.rate).toBe(150);
+    expect(edges.get("rd:prod|otlp|d_o2|logs")?.rate).toBe(50);
+    expect(edges.get("rd:prod|filelog|d_s3|logs")?.rate).toBe(300);
   });
 
-  it("keeps one line per signal, so a shared receiver and exporter carry each signal apart", () => {
+  it("merges every exporter sending to one destination, across fleets, into one node", () => {
+    const prod = pipeline({
+      fleet: "prod",
+      name: "logs",
+      receivers: [{ name: "otlp", rate: 100, refused: 0 }],
+      exporters: [
+        exporter("otlphttp/a", "d_o2", 60, { failed: 10, queue: 0.2 }),
+        exporter("otlphttp/b", "d_o2", 40),
+      ],
+    });
+    const edge = pipeline({
+      fleet: "edge",
+      name: "logs",
+      receivers: [{ name: "otlp", rate: 30, refused: 0 }],
+      exporters: [exporter("otlphttp/c", "d_o2", 30, { dropped: 5, queue: 0.9 })],
+    });
+    const map = buildPipelineMap([prod, edge], layout);
+    expect(map.nodes.filter((n) => n.column === "destination").map((n) => n.id)).toEqual([
+      "d:d_o2",
+    ]);
+    expect(byId(map.nodes).get("d:d_o2")).toMatchObject({
+      rate: 130,
+      failed: 10,
+      dropped: 5,
+      queue: 0.9,
+      pipelines: ["prod/logs", "edge/logs"],
+    });
+    const edges = byId(map.edges);
+    expect(edges.get("rd:prod|otlp|d_o2|logs")?.rate).toBe(100);
+    expect(edges.get("rd:edge|otlp|d_o2|logs")?.rate).toBe(30);
+  });
+
+  it("keeps one line per signal, so a shared receiver and destination carry each signal apart", () => {
     const map = buildPipelineMap([logs, traces], layout);
     const edges = byId(map.edges);
     expect(edges.get("fr:prod|otlp|logs")?.rate).toBe(100);
     expect(edges.get("fr:prod|otlp|traces")?.rate).toBe(80);
-    expect(edges.get("ed:prod|otlphttp|d_o2|logs")?.signal).toBe("logs");
-    expect(edges.get("ed:prod|otlphttp|d_o2|traces")?.signal).toBe("traces");
-    expect(byId(map.nodes).get("e:prod|otlphttp")?.rate).toBe(280);
+    expect(edges.get("rd:prod|otlp|d_o2|logs")?.signal).toBe("logs");
+    expect(edges.get("rd:prod|otlp|d_o2|traces")?.signal).toBe("traces");
+    expect(byId(map.nodes).get("d:d_o2")?.rate).toBe(280);
     expect(byId(map.nodes).get("r:prod|otlp")?.rate).toBe(180);
-    expect(byId(map.nodes).get("e:prod|otlphttp")?.pipelines).toEqual(["prod/logs", "prod/traces"]);
+    expect(byId(map.nodes).get("d:d_o2")?.pipelines).toEqual(["prod/logs", "prod/traces"]);
   });
 
-  it("draws a failure branch off the failing exporter with its failed share", () => {
+  it("draws a failure branch off the failing destination with its failed share", () => {
     const map = buildPipelineMap([logs], layout);
     const branch = map.edges.find((e) => e.branch);
     expect(branch).toMatchObject({
-      id: "br:e:prod|otlphttp",
-      source: "e:prod|otlphttp",
-      target: "x:e:prod|otlphttp",
+      id: "br:d:d_o2",
+      source: "d:d_o2",
+      target: "x:d:d_o2",
       branch: { kind: "failed", ratio: 0.2 },
     });
     expect(map.edges.filter((e) => e.branch)).toHaveLength(1);
-    const sink = byId(map.nodes).get("x:e:prod|otlphttp")!;
-    const from = byId(map.nodes).get("e:prod|otlphttp")!;
+    const sink = byId(map.nodes).get("x:d:d_o2")!;
+    const from = byId(map.nodes).get("d:d_o2")!;
     expect(sink.x).toBeGreaterThan(from.x);
     expect(sink.y).toBeGreaterThan(from.y);
   });
 
+  it("keeps a failure branch and its label inside the canvas, past the last column", () => {
+    const failing = buildPipelineMap([logs], layout).nodes;
+    const healthy = buildPipelineMap([traces], layout).nodes;
+    const x = (nodes: typeof failing, id: string) => byId(nodes).get(id)!.x;
+    expect(x(healthy, "d:d_o2") + layout.nodeWidth).toBe(layout.width - 16);
+    const sink = x(failing, "x:d:d_o2");
+    expect(sink).toBeGreaterThan(x(failing, "d:d_o2") + layout.nodeWidth);
+    expect(sink + 120).toBeLessThanOrEqual(layout.width);
+  });
+
+  it("reports the worst exporter's share, so a busy healthy fleet cannot hide a failing one", () => {
+    const failing = pipeline({
+      fleet: "edge",
+      name: "logs",
+      receivers: [{ name: "otlp", rate: 100, refused: 0 }],
+      exporters: [exporter("otlphttp/a", "d_o2", 50, { failed: 50 })],
+    });
+    const healthy = pipeline({
+      fleet: "prod",
+      name: "logs",
+      receivers: [{ name: "otlp", rate: 100000, refused: 0 }],
+      exporters: [exporter("otlphttp/b", "d_o2", 100000)],
+    });
+    const map = buildPipelineMap([failing, healthy], layout);
+    expect(byId(map.nodes).get("d:d_o2")?.failedRatio).toBe(0.5);
+    expect(map.edges.find((e) => e.branch)?.branch).toEqual({ kind: "failed", ratio: 0.5 });
+  });
+
   it("names a drop-only branch as dropped", () => {
     const dropping = pipeline({
       fleet: "edge",
@@ -145,8 +200,8 @@ describe("buildPipelineMap", () => {
     });
     const edges = byId(buildPipelineMap([silent], layout).edges);
     expect(edges.get("fr:edge|a|logs")?.rate).toBeNull();
-    expect(edges.get("re:edge|a|otlp|logs")?.rate).toBe(5);
-    expect(edges.get("re:edge|a|debug|logs")?.rate).toBeNull();
+    expect(edges.get("rd:edge|a|d_o2|logs")?.rate).toBe(5);
+    expect(edges.get("rd:edge|a|d_dbg|logs")?.rate).toBeNull();
   });
 });
 
diff --git a/web/src/components/fleet/pipelineGraph.ts b/web/src/components/fleet/pipelineGraph.ts
index a3673730a0..a5b674bd52 100644
--- a/web/src/components/fleet/pipelineGraph.ts
+++ b/web/src/components/fleet/pipelineGraph.ts
@@ -17,7 +17,7 @@ import type { FleetPipeline } from "@/services/fleet";
 import { ratio } from "./flowIssues";
 import type { Telemetry } from "./flowTypes";
 
-export type MapColumn = "fleet" | "receiver" | "exporter" | "destination" | "sink";
+export type MapColumn = "fleet" | "receiver" | "destination" | "sink";
 
 export interface MapNode {
   id: string;
@@ -30,6 +30,8 @@ export interface MapNode {
   dropped: number;
   refused: number;
   queue: number | null;
+  failedRatio: number;
+  droppedRatio: number;
   pipelines: string[];
   x: number;
   y: number;
@@ -57,9 +59,12 @@ export interface PipelineMap {
   edges: MapEdge[];
 }
 
-const COLUMNS: MapColumn[] = ["fleet", "receiver", "exporter", "destination"];
+const COLUMNS: MapColumn[] = ["fleet", "receiver", "destination"];
 const MIN_COLUMN_GAP = 168;
 const PAD = 16;
+// The last column has no neighbour, so its failure branch and the label after it need their own room.
+const BRANCH_ROOM = 168;
+const BRANCH_REACH = 40;
 export const MIN_WIDTH = 1.5;
 export const MAX_WIDTH = 8;
 
@@ -99,6 +104,8 @@ class MapBuilder {
       dropped: 0,
       refused: 0,
       queue: null,
+      failedRatio: 0,
+      droppedRatio: 0,
       pipelines: [],
       x: 0,
       y: 0,
@@ -121,24 +128,17 @@ class MapBuilder {
     if (!n.pipelines.includes(p.id)) n.pipelines.push(p.id);
   }
 
-  addExporters(p: FleetPipeline) {
+  addDestinations(p: FleetPipeline) {
     for (const ex of p.exporters) {
-      const en = this.node(`e:${p.fleet}|${ex.name}`, "exporter", p.fleet, ex.name);
-      this.touch(en, p);
-      en.rate = addRate(en.rate, ex.rate);
-      en.failed += ex.failed;
-      en.dropped += ex.dropped;
-      en.queue = maxRate(en.queue, ex.queue);
       const dn = this.node(`d:${ex.destination}`, "destination", p.fleet, ex.destination);
       this.touch(dn, p);
       dn.rate = addRate(dn.rate, ex.rate);
-      const ed = this.edge(
-        `ed:${p.fleet}|${ex.name}|${ex.destination}|${p.signal}`,
-        en.id,
-        dn.id,
-        p,
-      );
-      ed.rate = addRate(ed.rate, ex.rate);
+      dn.failed += ex.failed;
+      dn.dropped += ex.dropped;
+      dn.queue = maxRate(dn.queue, ex.queue);
+      // Per exporter, because a destination is shared and a busy healthy fleet must not dilute a failing one.
+      dn.failedRatio = Math.max(dn.failedRatio, ratio(ex.failed, ex.rate));
+      dn.droppedRatio = Math.max(dn.droppedRatio, ratio(ex.dropped, ex.rate));
     }
   }
 
@@ -156,31 +156,31 @@ class MapBuilder {
       fr.rate = maxRate(fr.rate, r.rate);
       const share = receiverShare(p, r.rate);
       for (const ex of p.exporters) {
-        const id = `re:${p.fleet}|${r.name}|${ex.name}|${p.signal}`;
-        const re = this.edge(id, rn.id, `e:${p.fleet}|${ex.name}`, p);
-        re.rate = addRate(re.rate, ex.rate === null ? null : ex.rate * share);
+        const id = `rd:${p.fleet}|${r.name}|${ex.destination}|${p.signal}`;
+        const rd = this.edge(id, rn.id, `d:${ex.destination}`, p);
+        rd.rate = addRate(rd.rate, ex.rate === null ? null : ex.rate * share);
       }
     }
   }
 
   addBranches() {
-    for (const en of [...this.nodes.values()].filter((n) => n.column === "exporter")) {
-      if (en.failed <= 0 && en.dropped <= 0) continue;
-      const failed = en.failed > 0;
-      const sink = this.node(`x:${en.id}`, "sink", en.fleet, en.name);
-      sink.pipelines = [...en.pipelines];
-      sink.rate = failed ? en.failed : en.dropped;
-      const signal = [...this.edges.values()].find((e) => e.target === en.id)?.signal ?? "logs";
-      this.edges.set(`br:${en.id}`, {
-        id: `br:${en.id}`,
-        source: en.id,
+    for (const dn of [...this.nodes.values()].filter((n) => n.column === "destination")) {
+      if (dn.failed <= 0 && dn.dropped <= 0) continue;
+      const failed = dn.failed > 0;
+      const sink = this.node(`x:${dn.id}`, "sink", dn.fleet, dn.name);
+      sink.pipelines = [...dn.pipelines];
+      sink.rate = failed ? dn.failed : dn.dropped;
+      const signal = [...this.edges.values()].find((e) => e.target === dn.id)?.signal ?? "logs";
+      this.edges.set(`br:${dn.id}`, {
+        id: `br:${dn.id}`,
+        source: dn.id,
         target: sink.id,
         signal,
         rate: sink.rate,
-        pipelines: [...en.pipelines],
+        pipelines: [...dn.pipelines],
         branch: {
           kind: failed ? "failed" : "dropped",
-          ratio: ratio(failed ? en.failed : en.dropped, en.rate),
+          ratio: failed ? dn.failedRatio : dn.droppedRatio,
         },
       });
     }
@@ -188,8 +188,9 @@ class MapBuilder {
 }
 
 function place(nodes: MapNode[], layout: MapLayout) {
+  const room = nodes.some((n) => n.column === "sink") ? BRANCH_ROOM : 0;
   const gap = Math.max(
-    (layout.width - 2 * PAD - layout.nodeWidth) / (COLUMNS.length - 1),
+    (layout.width - 2 * PAD - layout.nodeWidth - room) / (COLUMNS.length - 1),
     MIN_COLUMN_GAP,
   );
   const columns = COLUMNS.map((c) => nodes.filter((n) => n.column === c));
@@ -206,19 +207,19 @@ function place(nodes: MapNode[], layout: MapLayout) {
   for (const sink of nodes.filter((n) => n.column === "sink")) {
     const from = byId.get(sink.id.slice(2));
     if (!from) continue;
-    sink.x = from.x + layout.nodeWidth / 2 + gap / 2;
+    sink.x = from.x + layout.nodeWidth + BRANCH_REACH;
     sink.y = from.y + layout.row * 0.7;
   }
 }
 
-/** Fleet → receiver → exporter → destination; nodes keep the order of the pipelines they first appear in. */
+/** Fleet → receiver → destination; nodes keep the order of the pipelines they first appear in. */
 export function buildPipelineMap(pipelines: FleetPipeline[], layout: MapLayout): PipelineMap {
   const b = new MapBuilder();
   for (const p of pipelines) {
     const fleetNode = b.node(`f:${p.fleet}`, "fleet", p.fleet, p.fleet);
     b.touch(fleetNode, p);
     fleetNode.rate = addRate(fleetNode.rate, p.out_rate);
-    b.addExporters(p);
+    b.addDestinations(p);
   }
   for (const p of pipelines) b.addReceivers(p, b.node(`f:${p.fleet}`, "fleet", p.fleet, p.fleet));
   b.addBranches();
diff --git a/web/src/components/fleet/useFleetApi.ts b/web/src/components/fleet/useFleetApi.ts
index a130d55d25..d0aa1e1b33 100644
--- a/web/src/components/fleet/useFleetApi.ts
+++ b/web/src/components/fleet/useFleetApi.ts
@@ -37,6 +37,7 @@ import {
   fleetTokensQuery,
 } from "@/services/fleet.queries";
 import type {
+  FleetAuditParams,
   FleetCollector,
   FleetCollectorDetail,
   FleetCollectorEvent,
@@ -566,15 +567,20 @@ export function useFleetConfigVersion(
   };
 }
 
-export function useFleetAudit() {
+export function useFleetAudit(params: () => FleetAuditParams = () => ({})) {
   const orgId = useOrgId();
   const query = useQuery(() =>
-    Object.assign(fleetAuditQuery(orgId.value), { enabled: !!orgId.value }),
+    Object.assign(fleetAuditQuery(orgId.value, params()), {
+      enabled: !!orgId.value,
+      placeholderData: keepPreviousData,
+    }),
   );
   return {
     rows: computed(() => (isForbidden(query.error.value) ? [] : (query.data.value?.items ?? []))),
+    total: computed(() => (isForbidden(query.error.value) ? 0 : (query.data.value?.total ?? 0))),
     disabled: computed(() => !!query.data.value?.audit_disabled),
-    loading: query.isPending,
+    // The previous page stays on screen while the next one loads, and the table dims it.
+    loading: computed(() => query.isPending.value || query.isPlaceholderData.value),
     fetching: query.isFetching,
     lastUpdatedAt: query.dataUpdatedAt,
     error: query.error,
diff --git a/web/src/components/flow/StepPickerDialog.spec.ts b/web/src/components/flow/StepPickerDialog.spec.ts
index 81997cacb3..e923ad8ca9 100644
--- a/web/src/components/flow/StepPickerDialog.spec.ts
+++ b/web/src/components/flow/StepPickerDialog.spec.ts
@@ -309,3 +309,28 @@ describe("StepPickerDialog", () => {
     });
   });
 });
+
+describe("StepPickerDialog footnote", () => {
+  it("renders the footnote under the cards when set", () => {
+    const w = mount(StepPickerDialog, {
+      props: {
+        items,
+        testPrefix: "workflow-step",
+        footnote: "Any workflow…",
+        footnoteIcon: "webhook",
+        footnoteTestId: "workflow-step-picker-http-cue",
+      },
+      global: globalConfig,
+    });
+    expect(w.find('[data-test="workflow-step-picker-http-cue"]').text()).toContain("Any workflow…");
+  });
+
+  it("renders nothing extra without one (the pipeline editor is unchanged)", () => {
+    const w = mount(StepPickerDialog, {
+      props: { items, testPrefix: "workflow-step" },
+      global: globalConfig,
+    });
+    expect(w.find('[data-test="workflow-step-picker-http-cue"]').exists()).toBe(false);
+    expect(w.find('[data-test$="-footnote"]').exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/flow/StepPickerDialog.vue b/web/src/components/flow/StepPickerDialog.vue
index b8106eb31b..1c1d20f9c3 100644
--- a/web/src/components/flow/StepPickerDialog.vue
+++ b/web/src/components/flow/StepPickerDialog.vue
@@ -96,6 +96,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <div v-else class="text-text-secondary py-8 text-center text-sm">
           {{ emptyText }}
         </div>
+
+        <div
+          v-if="footnote"
+          class="border-border-default text-text-secondary flex shrink-0 items-start gap-2 border-t px-3 py-2 text-xs leading-snug"
+          :data-test="footnoteTestId || `${testPrefix}-footnote`"
+        >
+          <OIcon v-if="footnoteIcon" :name="footnoteIcon" size="xs" class="mt-0.5 shrink-0" />
+          <span>{{ footnote }}</span>
+        </div>
       </div>
     </div>
   </Teleport>
@@ -124,6 +133,10 @@ const props = withDefaults(
     testPrefix?: string;
     /** Viewport point to open at (usually the click). Null = screen-centred. */
     anchor?: { x: number; y: number } | null;
+    /** One line under the cards; unset renders nothing. */
+    footnote?: I18nText;
+    footnoteIcon?: string;
+    footnoteTestId?: string;
   }>(),
   {
     anchor: null,
diff --git a/web/src/components/ingestion/ai/AIIntegrationDetail.spec.ts b/web/src/components/ingestion/ai/AIIntegrationDetail.spec.ts
index e805f0c1d8..bb0ddd5a6b 100644
--- a/web/src/components/ingestion/ai/AIIntegrationDetail.spec.ts
+++ b/web/src/components/ingestion/ai/AIIntegrationDetail.spec.ts
@@ -1,6 +1,6 @@
 // Copyright 2026 OpenObserve Inc.
 
-import { mount, VueWrapper } from "@vue/test-utils";
+import { flushPromises, mount, VueWrapper } from "@vue/test-utils";
 import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
 
 vi.mock("@/composables/useIngestion", () => ({
@@ -26,8 +26,15 @@ vi.mock("./content", () => ({
   },
 }));
 
+import { createMemoryHistory, createRouter } from "vue-router";
 import AIIntegrationDetail from "./AIIntegrationDetail.vue";
 import store from "@/test/unit/helpers/store";
+import { INSTRUMENT_SKILL_URL } from "./codingAgentPrompt";
+
+const router = createRouter({
+  history: createMemoryHistory(),
+  routes: [{ path: "/", component: { template: "<div />" } }],
+});
 
 const CARD_STUB = {
   name: "AIIntegrationCard",
@@ -52,11 +59,15 @@ describe("AIIntegrationDetail", () => {
     mount(AIIntegrationDetail, {
       props,
       global: {
-        plugins: [store],
+        plugins: [store, router],
         stubs: { AIIntegrationCard: CARD_STUB, CredentialCodeBlock: COPY_STUB },
       },
     });
 
+  beforeEach(async () => {
+    await router.push({ path: "/", query: {} });
+  });
+
   afterEach(() => {
     wrapper?.unmount();
     vi.clearAllMocks();
@@ -119,4 +130,42 @@ describe("AIIntegrationDetail", () => {
       expect(wrapper.text()).toContain("Select an integration to view details.");
     });
   });
+
+  describe("setup tabs", () => {
+    const agentTab = '[data-test="ai-integration-tab-coding-agent"]';
+    const agentPanel = '[data-test="ai-coding-agent-setup"]';
+
+    it("opens on the step-by-step card by default", () => {
+      wrapper = mountDetail({ categorySlug: "frameworks", integrationSlug: "langchain" });
+      expect(wrapper.find('[data-test="ai-integration-card-stub"]').exists()).toBe(true);
+      expect(wrapper.find(agentPanel).exists()).toBe(false);
+    });
+
+    it("switches to the coding-agent prompt when its tab is clicked", async () => {
+      wrapper = mountDetail({ categorySlug: "frameworks", integrationSlug: "langchain" });
+      await wrapper.find(agentTab).trigger("mousedown", { button: 0 });
+      await wrapper.find(agentTab).trigger("click");
+      await flushPromises();
+      expect(wrapper.find(agentPanel).exists()).toBe(true);
+      expect(wrapper.find('[data-test="ai-integration-card-stub"]').exists()).toBe(false);
+    });
+
+    it("preselects the coding-agent tab from ?tab=agent and names the org and stream", async () => {
+      await router.push({ path: "/", query: { tab: "agent" } });
+      wrapper = mountDetail({ categorySlug: "frameworks", integrationSlug: "langchain" });
+      await flushPromises();
+      const prompt = wrapper.findComponent({ name: "OCodeBlock" }).props("code") as string;
+      const org = store.state.selectedOrganization.identifier;
+      expect(prompt).toContain(INSTRUMENT_SKILL_URL);
+      expect(prompt).toContain(`org ${org}, stream default.`);
+    });
+
+    it("follows a later ?tab change on the same integration", async () => {
+      wrapper = mountDetail({ categorySlug: "frameworks", integrationSlug: "langchain" });
+      expect(wrapper.find(agentPanel).exists()).toBe(false);
+      await router.push({ path: "/", query: { tab: "agent" } });
+      await flushPromises();
+      expect(wrapper.find(agentPanel).exists()).toBe(true);
+    });
+  });
 });
diff --git a/web/src/components/ingestion/ai/AIIntegrationDetail.vue b/web/src/components/ingestion/ai/AIIntegrationDetail.vue
index 911d20374a..c8a2231e4e 100644
--- a/web/src/components/ingestion/ai/AIIntegrationDetail.vue
+++ b/web/src/components/ingestion/ai/AIIntegrationDetail.vue
@@ -15,7 +15,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 -->
 
 <script setup lang="ts">
-import { computed } from "vue";
+import { computed, ref, watch } from "vue";
+import { useRoute } from "vue-router";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { useStore } from "vuex";
 import CredentialCodeBlock from "@/components/ingestion/CredentialCodeBlock.vue";
@@ -29,6 +30,10 @@ import { getRichCardContent } from "./content/richCard/registry";
 import AIIntegrationCard from "./content/AIIntegrationCard.vue";
 import AIRichSetupCard from "@/components/ingestion/setupCard/SetupCardRenderer.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
+import OTab from "@/lib/navigation/Tabs/OTab.vue";
+import CodingAgentSetup from "./CodingAgentSetup.vue";
+import { CODING_AGENT_TAB, STEP_BY_STEP_TAB } from "./codingAgentPrompt";
 
 const props = defineProps<{
   categorySlug: string;
@@ -38,6 +43,7 @@ const props = defineProps<{
 const { t } = useI18nTyped();
 const store = useStore();
 const { aiContent, endpoint } = useIngestion();
+const route = useRoute();
 
 const category = computed<AICategory | undefined>(() =>
   aiCategories.find((c) => c.slug === props.categorySlug),
@@ -84,12 +90,56 @@ const richContentNeedsPasscode = computed(() =>
 const richContent = computed(() =>
   getRichCardContent(integration.value?.contentSlug ?? integration.value?.slug, subs.value, t),
 );
+
+// "With a coding agent" / "Step by step". `?tab=agent` (e.g. from the LLM
+// Insights empty state) opens the coding-agent tab; anything else opens the
+// stepped card, which stays the default.
+const tabFromQuery = (tab: unknown) =>
+  tab === CODING_AGENT_TAB ? CODING_AGENT_TAB : STEP_BY_STEP_TAB;
+const activeTab = ref<string | number>(tabFromQuery(route?.query?.tab));
+watch(
+  () => route?.query?.tab,
+  (tab) => {
+    activeTab.value = tabFromQuery(tab);
+  },
+);
+
+// The stream the prompt names: the card's own stream default, else "default".
+const agentDefaultStream = computed(
+  () =>
+    richContent.value?.streamInput?.default || richContent.value?.detect?.streamName || "default",
+);
+const agentGuideName = computed(
+  () => richContent.value?.provider.name ?? String(integration.value?.name ?? ""),
+);
 </script>
 
 <template>
   <div v-if="integration" class="p-2">
+    <OTabs v-model="activeTab" dense bordered data-test="ai-integration-setup-tabs">
+      <OTab
+        :name="CODING_AGENT_TAB"
+        :label="t('ingestion.ai.codingAgent.tabAgent')"
+        data-test="ai-integration-tab-coding-agent"
+      />
+      <OTab
+        :name="STEP_BY_STEP_TAB"
+        :label="t('ingestion.ai.codingAgent.tabSteps')"
+        data-test="ai-integration-tab-step-by-step"
+      />
+    </OTabs>
+    <CodingAgentSetup
+      v-if="activeTab === CODING_AGENT_TAB"
+      :key="`agent-${integrationSlug}`"
+      :subs="subs"
+      :default-stream="agentDefaultStream"
+      :detect="richContent?.detect"
+      :guide-name="agentGuideName"
+      :doc-url="richContent?.docUrl ?? docURL"
+      :passcode-forbidden="passcodeForbidden"
+    />
     <OBanner
-      v-if="passcodeForbidden && richContent && richContentNeedsPasscode"
+      v-else-if="passcodeForbidden && richContent && richContentNeedsPasscode"
       variant="warning"
       data-test="ai-integration-detail-passcode-forbidden"
       :content="t('ingestion.passcodeForbiddenMessage')"
diff --git a/web/src/components/ingestion/ai/CodingAgentSetup.spec.ts b/web/src/components/ingestion/ai/CodingAgentSetup.spec.ts
new file mode 100644
index 0000000000..d089323b18
--- /dev/null
+++ b/web/src/components/ingestion/ai/CodingAgentSetup.spec.ts
@@ -0,0 +1,97 @@
+// Copyright 2026 OpenObserve Inc.
+
+import { flushPromises, mount, VueWrapper } from "@vue/test-utils";
+import { afterEach, describe, expect, it, vi } from "vitest";
+
+const downloadEnvFile = vi.fn();
+vi.mock("@/components/ingestion/setupCard/envFile", () => ({
+  downloadEnvFile: (...args: unknown[]) => downloadEnvFile(...args),
+}));
+
+import CodingAgentSetup from "./CodingAgentSetup.vue";
+import store from "@/test/unit/helpers/store";
+
+const SUBS = { url: "https://api.example.com", org: "team1", token: "dG9rZW4=" };
+const startCheck = vi.fn();
+const FIRST_EVENT_STUB = {
+  name: "FirstEventStatus",
+  template: '<div data-test="first-event-status-stub" />',
+  props: ["org", "signal", "targetStream", "match", "filter", "guideName", "docUrl"],
+  emits: ["copy-command"],
+  methods: { start: startCheck, probeNow: vi.fn() },
+};
+
+describe("CodingAgentSetup", () => {
+  let wrapper: VueWrapper;
+
+  const mountSetup = (props: Partial<InstanceType<typeof CodingAgentSetup>["$props"]> = {}) =>
+    mount(CodingAgentSetup, {
+      props: {
+        subs: SUBS,
+        defaultStream: "default",
+        guideName: "OpenAI",
+        passcodeForbidden: false,
+        ...props,
+      },
+      global: { plugins: [store], stubs: { FirstEventStatus: FIRST_EVENT_STUB } },
+    });
+
+  const promptCode = () => wrapper.findComponent({ name: "OCodeBlock" }).props("code") as string;
+
+  afterEach(() => {
+    wrapper?.unmount();
+    vi.clearAllMocks();
+  });
+
+  it("puts the edited stream into the prompt and the first-span check", async () => {
+    wrapper = mountSetup({
+      detect: { streamType: "traces", filter: "gen_ai_provider_name = 'openai'" },
+    });
+    expect(promptCode()).toContain("org team1, stream default.");
+
+    await wrapper.find('[data-test="ai-coding-agent-stream-input"] input').setValue("ai_traces");
+    await flushPromises();
+
+    expect(promptCode()).toContain("org team1, stream ai_traces.");
+    expect(wrapper.findComponent(FIRST_EVENT_STUB).props("targetStream")).toBe("ai_traces");
+  });
+
+  it("starts the first-span check when the prompt is copied, as the status row says", async () => {
+    wrapper = mountSetup({ detect: { streamType: "traces" } });
+    wrapper.findComponent({ name: "OCodeBlock" }).vm.$emit("copy", { partial: false });
+    expect(startCheck).toHaveBeenCalledWith("copy");
+  });
+
+  it("re-copies through the prompt block when the status bar asks for the command", async () => {
+    wrapper = mountSetup({ detect: { streamType: "traces" } });
+    const click = vi.fn();
+    wrapper
+      .find('[data-test="ai-coding-agent-prompt-copy-btn"]')
+      .element.addEventListener("click", click);
+    wrapper.findComponent(FIRST_EVENT_STUB).vm.$emit("copy-command");
+    expect(click).toHaveBeenCalled();
+  });
+
+  it("downloads the card's .env plus the chosen stream and the web UI root", async () => {
+    wrapper = mountSetup();
+    await wrapper.find('[data-test="ai-coding-agent-stream-input"] input').setValue("ai_traces");
+    await wrapper.find('[data-test="ai-coding-agent-env-btn"]').trigger("click");
+    expect(downloadEnvFile).toHaveBeenCalledWith(SUBS, {
+      OPENOBSERVE_TRACES_STREAM_NAME: "ai_traces",
+      OPENOBSERVE_UI_URL: window.location.origin,
+    });
+  });
+
+  it("offers no .env when the org forbids its passcode", () => {
+    wrapper = mountSetup({ passcodeForbidden: true });
+    expect(wrapper.find('[data-test="ai-coding-agent-passcode-forbidden"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="ai-coding-agent-env-btn"]').exists()).toBe(false);
+  });
+
+  it("names the coding agents in the prompt step title from code, not the translation", () => {
+    wrapper = mountSetup();
+    const title = wrapper.find('[data-test="ai-coding-agent-prompt-step"]').text();
+    expect(title).toContain("Claude Code, Cursor or Codex");
+    expect(title).not.toContain("{client");
+  });
+});
diff --git a/web/src/components/ingestion/ai/CodingAgentSetup.vue b/web/src/components/ingestion/ai/CodingAgentSetup.vue
new file mode 100644
index 0000000000..4cc4b1d5f2
--- /dev/null
+++ b/web/src/components/ingestion/ai/CodingAgentSetup.vue
@@ -0,0 +1,164 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!--
+  "With a coding agent" setup for an AI integration: download the per-org .env,
+  then paste one prompt into Claude Code / Cursor / Codex. The prompt points the
+  agent at the openobserve-instrument skill by URL, so nothing has to be
+  installed and the token stays in the .env, never in the chat.
+-->
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OCodeBlock from "@/lib/core/Code/OCodeBlock.vue";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OInput from "@/lib/forms/Input/OInput.vue";
+import OStepper from "@/lib/navigation/Stepper/OStepper.vue";
+import OStep from "@/lib/navigation/Stepper/OStep.vue";
+import FirstEventStatus from "@/components/ingestion/FirstEventStatus.vue";
+import { downloadEnvFile } from "@/components/ingestion/setupCard/envFile";
+import { getPath } from "@/utils/zincutils";
+import { safeHttpUrl } from "@/components/ingestion/setupCard/subs";
+import type { CardSubstitutions, RichCardDetect } from "@/components/ingestion/setupCard/types";
+import { STREAM_NAME_RE, buildCodingAgentPrompt } from "./codingAgentPrompt";
+
+const props = defineProps<{
+  /** Per-org url/org/token — the same values the stepped card's .env carries. */
+  subs: CardSubstitutions;
+  /** Stream the prompt names before the user edits it. */
+  defaultStream: string;
+  /** The integration's first-span check; omitted → no live status bar. */
+  detect?: RichCardDetect;
+  guideName: string;
+  docUrl?: string;
+  /** The org forbids showing its ingestion passcode, so there is no .env to hand out. */
+  passcodeForbidden: boolean;
+}>();
+
+const { t } = useI18nTyped();
+
+const streamName = ref(props.defaultStream);
+const streamNameError = computed(() =>
+  streamName.value.trim() && !STREAM_NAME_RE.test(streamName.value.trim())
+    ? t("ingestion.setupCard.streamNameError")
+    : raw(""),
+);
+const effectiveStream = computed(() => streamName.value.trim() || props.defaultStream);
+
+const prompt = computed(() => buildCodingAgentPrompt(props.subs.org, effectiveStream.value));
+const promptTitle = computed(() =>
+  t("ingestion.ai.codingAgent.promptTitle", {
+    client1: raw("Claude Code"),
+    client2: raw("Cursor"),
+    client3: raw("Codex"),
+  }),
+);
+
+const root = ref<HTMLElement | null>(null);
+const statusBar = ref<InstanceType<typeof FirstEventStatus> | null>(null);
+// Copying the prompt is the go signal, so the first-span check starts then, as on the stepped card.
+const onPromptCopy = () => statusBar.value?.start("copy");
+// The status bar's copy button re-copies through the prompt block, so the clipboard and toast match.
+const copyPrompt = () =>
+  root.value?.querySelector<HTMLElement>('[data-test="ai-coding-agent-prompt-copy-btn"]')?.click();
+
+// Beyond the card's three keys: the stream the prompt names (the SDK reads this
+// name) and the web UI root (the skill appends /web/…), so its trace and fix
+// links open the UI even where the API lives on another host or port.
+const downloadEnv = () =>
+  downloadEnvFile(props.subs, {
+    OPENOBSERVE_TRACES_STREAM_NAME: effectiveStream.value,
+    OPENOBSERVE_UI_URL: window.location.origin + getPath().replace(/\/?web\/$/, ""),
+  });
+</script>
+
+<template>
+  <div
+    ref="root"
+    class="text-text-heading max-w-[61.25rem] px-1 py-4 text-sm"
+    data-test="ai-coding-agent-setup"
+  >
+    <div class="mb-7 [&_.text-input-hint]:whitespace-nowrap [&_label]:mb-0.5">
+      <OInput
+        v-model="streamName"
+        :label="t('ingestion.ai.codingAgent.streamLabel')"
+        :placeholder="raw(defaultStream)"
+        :help-text="!streamNameError ? t('ingestion.ai.codingAgent.streamHelp') : undefined"
+        :error="!!streamNameError"
+        :error-message="streamNameError"
+        size="sm"
+        width="md"
+        data-test="ai-coding-agent-stream-input"
+      />
+    </div>
+
+    <OStepper :model-value="1" orientation="vertical" expanded :animated="false">
+      <OStep
+        :name="1"
+        :title="t('ingestion.ai.codingAgent.envTitle')"
+        data-test="ai-coding-agent-env-step"
+      >
+        <OBanner
+          v-if="passcodeForbidden"
+          variant="warning"
+          data-test="ai-coding-agent-passcode-forbidden"
+          :content="t('ingestion.passcodeForbiddenMessage')"
+        />
+        <template v-else>
+          <p class="text-text-secondary text-compact mt-0 mb-2.5 leading-[1.45]">
+            {{ t("ingestion.ai.codingAgent.envHelp") }}
+          </p>
+          <OButton
+            variant="outline"
+            size="sm"
+            icon-left="download"
+            data-test="ai-coding-agent-env-btn"
+            @click="downloadEnv"
+          >
+            {{ t("ingestion.ai.codingAgent.envButton") }}
+          </OButton>
+        </template>
+      </OStep>
+
+      <OStep :name="2" :title="promptTitle" data-test="ai-coding-agent-prompt-step">
+        <OCodeBlock
+          :code="prompt"
+          lang="text"
+          chrome="editor"
+          :filename="t('ingestion.ai.codingAgent.promptLabel')"
+          wrap
+          :copy-message="t('ingestion.ai.codingAgent.promptCopied')"
+          data-test="ai-coding-agent-prompt"
+          @copy="onPromptCopy"
+        />
+        <FirstEventStatus
+          v-if="detect"
+          ref="statusBar"
+          class="mt-3"
+          :org="subs.org"
+          :signal="detect.streamType"
+          :target-stream="effectiveStream"
+          :match="detect.match"
+          :filter="detect.filter || undefined"
+          :guide-name="guideName"
+          :doc-url="docUrl ? safeHttpUrl(docUrl) : undefined"
+          @copy-command="copyPrompt"
+        />
+      </OStep>
+    </OStepper>
+  </div>
+</template>
diff --git a/web/src/components/ingestion/ai/codingAgentPrompt.spec.ts b/web/src/components/ingestion/ai/codingAgentPrompt.spec.ts
new file mode 100644
index 0000000000..b8ecdd6e82
--- /dev/null
+++ b/web/src/components/ingestion/ai/codingAgentPrompt.spec.ts
@@ -0,0 +1,22 @@
+// Copyright 2026 OpenObserve Inc.
+
+import { describe, expect, it } from "vitest";
+import { INSTRUMENT_SKILL_URL, buildCodingAgentPrompt } from "./codingAgentPrompt";
+
+describe("buildCodingAgentPrompt", () => {
+  it("names the skill URL, the org and the stream", () => {
+    expect(buildCodingAgentPrompt("team1", "ai_traces")).toBe(
+      `Instrument this app for OpenObserve with the openobserve-instrument skill (${INSTRUMENT_SKILL_URL}).\n` +
+        "Use the .env in the project root, org team1, stream ai_traces.\n" +
+        "Run one sample request, then check the data.",
+    );
+  });
+
+  it("substitutes each org and stream independently", () => {
+    const prompt = buildCodingAgentPrompt("default", "default");
+    expect(prompt).toContain("org default, stream default.");
+    expect(buildCodingAgentPrompt("aiobs_ux_test", "llm")).toContain(
+      "org aiobs_ux_test, stream llm.",
+    );
+  });
+});
diff --git a/web/src/components/ingestion/ai/codingAgentPrompt.ts b/web/src/components/ingestion/ai/codingAgentPrompt.ts
new file mode 100644
index 0000000000..f74e7089be
--- /dev/null
+++ b/web/src/components/ingestion/ai/codingAgentPrompt.ts
@@ -0,0 +1,42 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+/**
+ * The openobserve-instrument skill, served from the openobserve repo so any
+ * coding agent can fetch and follow it without installing a plugin.
+ */
+export const INSTRUMENT_SKILL_URL =
+  "https://raw.githubusercontent.com/openobserve/openobserve/main/skills/openobserve-instrument/SKILL.md";
+
+/** `?tab=` value that opens an AI integration on its "With a coding agent" tab. */
+export const CODING_AGENT_TAB = "agent";
+/** The default tab: the integration's existing stepped card. */
+export const STEP_BY_STEP_TAB = "steps";
+
+/** Stream names the installer accepts (letters, digits, underscore). */
+export const STREAM_NAME_RE = /^[a-zA-Z0-9_]+$/;
+
+/**
+ * The prompt the user pastes into their coding agent. It carries the org and
+ * stream but never the token: the skill reads that from the downloaded .env.
+ * Agent-facing text, so it stays English regardless of the UI locale.
+ */
+export function buildCodingAgentPrompt(org: string, stream: string): string {
+  return (
+    `Instrument this app for OpenObserve with the openobserve-instrument skill (${INSTRUMENT_SKILL_URL}).\n` +
+    `Use the .env in the project root, org ${org}, stream ${stream}.\n` +
+    `Run one sample request, then check the data.`
+  );
+}
diff --git a/web/src/components/ingestion/setupCard/SetupCardRenderer.vue b/web/src/components/ingestion/setupCard/SetupCardRenderer.vue
index 4d7ab4e558..6ff065c3b8 100644
--- a/web/src/components/ingestion/setupCard/SetupCardRenderer.vue
+++ b/web/src/components/ingestion/setupCard/SetupCardRenderer.vue
@@ -50,6 +50,7 @@ import { OPEN_TOKEN_PICKER } from "@/composables/useCredentialSnippet";
 import type { FirstEventState, StreamSignal } from "@/composables/firstEvent/useFirstEventWatch";
 import FirstEventStatus from "../FirstEventStatus.vue";
 import { cliFlagArg, safeHttpUrl, sanitizeInput, shellQuote } from "./subs";
+import { downloadEnvFile } from "./envFile";
 import type {
   CardSubstitutions,
   IngestTokenState,
@@ -412,18 +413,7 @@ const onStepCopy = (step: RichCardStep, index: number, payload?: CodeBlockCopyPa
 };
 
 // ── .env download (from the per-org subs) ────────────────────────────────────
-const downloadEnv = () => {
-  const body =
-    `OPENOBSERVE_URL=${props.subs.url}\n` +
-    `OPENOBSERVE_ORG=${props.subs.org}\n` +
-    `OPENOBSERVE_AUTH_TOKEN=Basic ${props.subs.token}\n`;
-  const blob = new Blob([body], { type: "text/plain" });
-  const a = document.createElement("a");
-  a.href = URL.createObjectURL(blob);
-  a.download = ".env";
-  a.click();
-  setTimeout(() => URL.revokeObjectURL(a.href), 1000);
-};
+const downloadEnv = () => downloadEnvFile(props.subs);
 
 // ── presentation helpers ─────────────────────────────────────────────────────
 const escapeHtml = (s: string) =>
diff --git a/web/src/components/ingestion/setupCard/envFile.ts b/web/src/components/ingestion/setupCard/envFile.ts
new file mode 100644
index 0000000000..4c8f2aac3d
--- /dev/null
+++ b/web/src/components/ingestion/setupCard/envFile.ts
@@ -0,0 +1,41 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { CardSubstitutions } from "./types";
+
+/**
+ * The `.env` body a setup card hands out: the per-org url, org and Basic-auth
+ * token, then any `extra` entries the caller adds (e.g. the web URL for links).
+ */
+export function buildEnvFile(subs: CardSubstitutions, extra: Record<string, string> = {}): string {
+  return (
+    `OPENOBSERVE_URL=${subs.url}\n` +
+    `OPENOBSERVE_ORG=${subs.org}\n` +
+    `OPENOBSERVE_AUTH_TOKEN=Basic ${subs.token}\n` +
+    Object.entries(extra)
+      .map(([key, value]) => `${key}=${value}\n`)
+      .join("")
+  );
+}
+
+/** Save the per-org `.env` as a browser download. */
+export function downloadEnvFile(subs: CardSubstitutions, extra: Record<string, string> = {}): void {
+  const blob = new Blob([buildEnvFile(subs, extra)], { type: "text/plain" });
+  const a = document.createElement("a");
+  a.href = URL.createObjectURL(blob);
+  a.download = ".env";
+  a.click();
+  setTimeout(() => URL.revokeObjectURL(a.href), 1000);
+}
diff --git a/web/src/components/oncall/OnCallCoverForm.schema.ts b/web/src/components/oncall/OnCallCoverForm.schema.ts
index f2a5b1d3b8..6e3d5debbc 100644
--- a/web/src/components/oncall/OnCallCoverForm.schema.ts
+++ b/web/src/components/oncall/OnCallCoverForm.schema.ts
@@ -25,7 +25,7 @@ const MAX_SPAN_MICROS = 90 * MICROS_PER_DAY;
  * catch a milliseconds-for-microseconds mistake, which lands roughly 55,000
  * years out — so the message says the limit rather than guessing at the cause.
  */
-const MAX_AHEAD_MICROS = 730 * MICROS_PER_DAY;
+export const MAX_AHEAD_MICROS = 730 * MICROS_PER_DAY;
 
 export const makeOnCallCoverSchema = (
   t: TranslateFn,
diff --git a/web/src/components/oncall/OnCallCoverForm.spec.ts b/web/src/components/oncall/OnCallCoverForm.spec.ts
index 000a795b84..16667d660f 100644
--- a/web/src/components/oncall/OnCallCoverForm.spec.ts
+++ b/web/src/components/oncall/OnCallCoverForm.spec.ts
@@ -248,6 +248,18 @@ describe("OnCallCoverForm — which clock the times are on", () => {
     expect(fieldText(wrapper)).toContain("UTC");
   });
 
+  // C8: a cover looks ahead, so the calendar runs from today to the 730-day limit, on the picker's clock.
+  it("offers today up to 730 days ahead, and says a refusal under the picker", () => {
+    const wrapper = renderCover({ viewerTimezone: IST });
+    const day = (micros: number) => toZonedInputValue(micros, IST).slice(0, 10).replace(/-/g, "/");
+    const now = Date.now() * 1000;
+
+    const picker = wrapper.findComponent({ name: "OFormDateTimeRange" });
+    expect(picker.attributes("min-date")).toBe(day(now));
+    expect(picker.attributes("max-date")).toBe(day(now + 730 * MICROS_PER_DAY));
+    expect(picker.attributes()).toHaveProperty("show-error");
+  });
+
   /// One clock, said once: the summary names who covers, never the window again.
   it("says the window once, in the field, when the reader is on the team's clock", async () => {
     const wrapper = renderCover({ viewerTimezone: "UTC" });
diff --git a/web/src/components/oncall/OnCallCoverForm.vue b/web/src/components/oncall/OnCallCoverForm.vue
index f8b736f57b..8856dd3073 100644
--- a/web/src/components/oncall/OnCallCoverForm.vue
+++ b/web/src/components/oncall/OnCallCoverForm.vue
@@ -123,6 +123,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           disable-relative
           auto-apply
           :trigger-text="windowLabel"
+          show-error
+          :min-date="calendarDay(0)"
+          :max-date="calendarDay(MAX_AHEAD_MICROS)"
           data-test="oncall-cover-window"
         >
           <!-- The presets set this same field, so they sit inside it; the one matching the range is lit. -->
@@ -191,7 +194,7 @@ export interface UpcomingShift extends Shift {
   rotationName: string;
 }
 import { formatInZone, fromZonedInputValue, toZonedInputValue } from "@/utils/oncall";
-import { makeOnCallCoverSchema } from "./OnCallCoverForm.schema";
+import { MAX_AHEAD_MICROS, makeOnCallCoverSchema } from "./OnCallCoverForm.schema";
 import OnCallPersonName from "./OnCallPersonName.vue";
 import { useOrgUserNames } from "@/composables/useOrgUserNames";
 
@@ -463,6 +466,12 @@ function applyPreset(key: (typeof PRESETS)[number]["key"]) {
 const activePreset = ref<string | null>(null);
 let presetApplied: { key: string; from: number; to: number } | null = null;
 
+/// The picker's calendar day `aheadMicros` from now, on the clock the picker shows.
+function calendarDay(aheadMicros: number): string {
+  const at = Date.now() * 1000 + aheadMicros;
+  return toZonedInputValue(at, props.viewerTimezone).slice(0, 10).replace(/-/g, "/");
+}
+
 watch(windowValue, (value) => {
   const applied = presetApplied;
   activePreset.value =
diff --git a/web/src/components/oncall/OnCallEscalationCell.vue b/web/src/components/oncall/OnCallEscalationCell.vue
index 98a495faa7..91d4e24753 100644
--- a/web/src/components/oncall/OnCallEscalationCell.vue
+++ b/web/src/components/oncall/OnCallEscalationCell.vue
@@ -73,8 +73,10 @@ const props = withDefaults(
     totalRungs?: number | null;
     /** The step the record says it reached, for a list with no progress per row. */
     reachedStep?: number | null;
+    /** The page names a team that no longer exists, so its ladder pages nobody. */
+    teamDeleted?: boolean;
   }>(),
-  { progress: null, progressLoaded: true, totalRungs: null, reachedStep: null },
+  { progress: null, progressLoaded: true, totalRungs: null, reachedStep: null, teamDeleted: false },
 );
 
 const { t } = useI18nTyped();
@@ -89,6 +91,7 @@ const phrase = computed(() =>
     progressLoaded: props.progressLoaded,
     totalRungs: props.totalRungs,
     reachedStep: props.reachedStep,
+    teamDeleted: props.teamDeleted,
     nowMicros: nowMicros.value,
   }),
 );
@@ -104,6 +107,7 @@ const toneClass = computed(() => {
       return "text-text-body";
     case "snoozed":
     case "reachedNobody":
+    case "nobodyPaged":
       return "text-status-warning-text";
     case "nobodyAnswered":
     case "held":
@@ -143,6 +147,8 @@ const headline = computed<I18nText>(() => {
       });
     case "nobodyAnswered":
       return t("oncall.state_exhausted");
+    case "nobodyPaged":
+      return t("oncall.escalationNobodyPaged");
     case "held":
       return t("oncall.escalationHeld", { n: p.secondsLeft });
     case "pagesNobody":
diff --git a/web/src/components/oncall/OnCallMembers.spec.ts b/web/src/components/oncall/OnCallMembers.spec.ts
index 9fb70d901c..d45d36a36e 100644
--- a/web/src/components/oncall/OnCallMembers.spec.ts
+++ b/web/src/components/oncall/OnCallMembers.spec.ts
@@ -484,6 +484,35 @@ describe("OnCallMembers", () => {
       );
     });
 
+    /// R9: a following rotation shares the roster, so the dialog says its person can change.
+    it("says a rotation whose order the remove changes can change who is on call", async () => {
+      const rule = (members: string[]) => ({
+        name: "Base",
+        members,
+        shift_micros: 604_800_000_000,
+        anchor_micros: 0,
+      });
+      const wrapper = render({
+        members: [member("ana@o2.ai"), member("bob@o2.ai")],
+        onCallNow: [
+          ...now,
+          { rotation_id: "r2", rotation_name: "Secondary", rule: "Base", user_email: "bob@o2.ai" },
+        ],
+        rotations: [
+          { id: "r1", name: "Primary", shift_rules: [rule(["ana@o2.ai", "bob@o2.ai"])] },
+          { id: "r2", name: "Secondary", shift_rules: [rule(["ana@o2.ai", "bob@o2.ai"])] },
+          { id: "r3", name: "Weekend", shift_rules: [rule(["bob@o2.ai"])] },
+        ],
+      } as any);
+      await flushPromises();
+      await wrapper.find('[data-test="oncall-members-remove-ana@o2.ai"]').trigger("click");
+      await flushPromises();
+
+      expect(wrapper.find('[data-test="dialog-box"]').text()).toBe(
+        "They will no longer be paged for this team. Bob takes over Ana Sharma's current shift in Primary. They also leave Secondary, so who is on call there can change too.",
+      );
+    });
+
     // Before the team name loads, the title names the person alone rather than "from ?".
     it("names only the person while the team name is unknown", async () => {
       const wrapper = render({ members: [member("ana@o2.ai")], onCallNow: now });
diff --git a/web/src/components/oncall/OnCallMembers.vue b/web/src/components/oncall/OnCallMembers.vue
index 761c7f429f..0df117ffe6 100644
--- a/web/src/components/oncall/OnCallMembers.vue
+++ b/web/src/components/oncall/OnCallMembers.vue
@@ -909,20 +909,33 @@ const removeTitle = computed<I18nText>(() => {
     : t("oncall.removeMemberTitlePerson", { name });
 });
 
-/// Who takes the shift the removed person holds now. A cover is skipped: it is not the roster handing over.
+/// Who takes the removed person's current shifts (a cover is not the roster handing over), and which rotations reorder.
 const removeMessage = computed<I18nText>(() => {
-  const email = memberToRemove.value?.user_email.toLowerCase();
+  const email = memberToRemove.value?.user_email.toLowerCase() ?? "";
   const leaving = raw(nameOf(memberToRemove.value?.user_email ?? ""));
-  const handovers = props.onCallNow
-    .filter((position) => position.user_email.toLowerCase() === email && !position.override_id)
-    .map((position) => {
-      const next = position.next_user_email;
-      const rotation = raw(position.rotation_name);
-      return next && next.toLowerCase() !== email
-        ? t("oncall.removeMemberHandsOver", { name: raw(nameOf(next)), leaving, rotation })
-        : t("oncall.removeMemberLeavesGap", { leaving, rotation });
-    });
-  return raw([t("oncall.removeMemberBody"), ...handovers].join(" "));
+  const held = props.onCallNow.filter(
+    (position) => position.user_email.toLowerCase() === email && !position.override_id,
+  );
+  const handovers = held.map((position) => {
+    const next = position.next_user_email;
+    const rotation = raw(position.rotation_name);
+    return next && next.toLowerCase() !== email
+      ? t("oncall.removeMemberHandsOver", { name: raw(nameOf(next)), leaving, rotation })
+      : t("oncall.removeMemberLeavesGap", { leaving, rotation });
+  });
+  // Who these rotations put on call next is the server's shift maths, so the dialog names them without guessing.
+  const reordered = (props.rotations ?? [])
+    .filter((rotation) => !held.some((position) => position.rotation_id === rotation.id))
+    .filter((rotation) => rotationMembers(rotation).some((m) => m.toLowerCase() === email))
+    .map((rotation) => rotation.name);
+  const reshuffle = reordered.length
+    ? [
+        t("oncall.removeMemberReorders", {
+          rotations: raw(listInLocale(reordered, locale.value)),
+        }),
+      ]
+    : [];
+  return raw([t("oncall.removeMemberBody"), ...handovers, ...reshuffle].join(" "));
 });
 
 async function confirmRemoveMember() {
diff --git a/web/src/components/oncall/OnCallPolicyEditor.spec.ts b/web/src/components/oncall/OnCallPolicyEditor.spec.ts
index 9b02ee6260..3f307ff1c3 100644
--- a/web/src/components/oncall/OnCallPolicyEditor.spec.ts
+++ b/web/src/components/oncall/OnCallPolicyEditor.spec.ts
@@ -1197,6 +1197,49 @@ describe("targets that name a rotation", () => {
     expect(savedTargets().filter((t: any) => t.rotation_id === "rot_primary")).toHaveLength(2);
   });
 
+  /// R8: a rotation lands on the open priority alone until "All priorities" is ticked.
+  it("adds a rotation to the open priority only, unless All priorities is ticked", async () => {
+    const twoPriorities: OnCallPolicy = {
+      ...policy,
+      rungs: [1, 2].map((priority) => ({
+        priority,
+        steps: [{ after_micros: 0, targets: [{ kind: "user", email: "ana@o2.ai" }] }],
+        channels: ["email"],
+      })),
+    };
+    const wrapper = mount(OnCallPolicyEditor, {
+      props: { teamId: "team_1", policy: twoPriorities, open: true, rotations: TWO },
+      global: { plugins: [i18n, store], stubs },
+    });
+    await flushPromises();
+    const pick = async (rotationId: string, allPriorities?: boolean) => {
+      targetPicker(wrapper).vm.$emit("update:modelValue", "rotation");
+      await flushPromises();
+      const box = wrapper.findComponent('[data-test="oncall-policy-rotation-all-priorities"]');
+      if (allPriorities === undefined) expect(box.props("modelValue")).toBe(false);
+      else box.vm.$emit("update:modelValue", allPriorities);
+      await flushPromises();
+      wrapper
+        .findComponent('[data-test="oncall-policy-pick-rotation-1-0"]')
+        .vm.$emit("update:modelValue", rotationId);
+      await flushPromises();
+    };
+    await pick("rot_primary");
+    await pick("rot_secondary", true);
+
+    await wrapper.find('[data-test="oncall-policy-save"]').trigger("click");
+    await flushPromises();
+
+    const { rungs } = (service.setPolicy.mock.calls.at(-1)![0] as any).data;
+    const rotationsOf = (priority: number) =>
+      rungs
+        .find((r: any) => r.priority === priority)
+        .steps[0].targets.filter((t: any) => t.kind === "rotation")
+        .map((t: any) => t.rotation_id);
+    expect(rotationsOf(1)).toEqual(["rot_primary", "rot_secondary"]);
+    expect(rotationsOf(2)).toEqual(["rot_secondary"]);
+  });
+
   /// Found by this suite leaking between tests: `reset` shallow-copied each
   /// step, so the draft shared `targets` with `props.policy` and every add or
   /// remove edited the policy in place. Cancel throws the draft away, which
diff --git a/web/src/components/oncall/OnCallPolicyEditor.vue b/web/src/components/oncall/OnCallPolicyEditor.vue
index 934b8a47fb..a73783dd42 100644
--- a/web/src/components/oncall/OnCallPolicyEditor.vue
+++ b/web/src/components/oncall/OnCallPolicyEditor.vue
@@ -235,9 +235,6 @@
                             @update:model-value="(v: any) => addRotation(String(v))"
                           />
                         </span>
-                        <!-- On by default. A rotation is a position on the team, and
-                       one that exists at P1 but not P2 is a decision almost
-                       nobody means to make. -->
                         <OCheckbox
                           v-model="applyToAllPriorities"
                           size="sm"
@@ -710,11 +707,8 @@ const pendingUserStep = ref<LadderStep | null>(null);
 /// person on call in it or everyone on it, and which was asked for decides
 /// what the picked rotation MEANS.
 const pendingRotation = ref<{ step: LadderStep; mode: RotationMode } | null>(null);
-/// Whether the next rotation lands on every priority at once. Sticky for the
-/// life of the dialog: somebody adding a position to the ladder is doing it for
-/// the ladder, not for one priority, and re-ticking per priority would be the
-/// same chore in a different shape.
-const applyToAllPriorities = ref(true);
+/// Off until ticked, so an edit on one priority tab changes only that priority.
+const applyToAllPriorities = ref(false);
 const memberOptions = ref<{ label: I18nText; value: string }[]>([]);
 const teamMembers = computed(() => memberOptions.value.map((m) => m.value));
 /// The rotation in force, so the preview names people rather than target
diff --git a/web/src/components/oncall/OnCallRotationPreview.vue b/web/src/components/oncall/OnCallRotationPreview.vue
index 2bf80ce804..36fc5eb2b7 100644
--- a/web/src/components/oncall/OnCallRotationPreview.vue
+++ b/web/src/components/oncall/OnCallRotationPreview.vue
@@ -48,7 +48,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         class="flex flex-wrap items-center gap-2"
         :data-test="`oncall-rotation-preview-${shift.startMicros}`"
       >
-        <OTag variant="default-soft" size="sm">{{ raw(shift.when) }}</OTag>
+        <OTag variant="default-soft" size="sm">{{ shift.when }}</OTag>
         <OUserCell :value="shift.member" />
         <!-- The second rotation's holder for the same week. Side by side is the
              point: it is how "these two can never be the same person" stops
@@ -84,6 +84,7 @@ import {
   memberAt,
   offsetAnchor,
   shiftBoundary,
+  shiftsBackToNow,
 } from "@/utils/oncall";
 
 const { t } = useI18nTyped();
@@ -128,26 +129,31 @@ const shifts = computed(() => {
     shift_micros: shift,
     anchor_micros: anchorFor,
   });
-  const primary = rule(anchorMicros);
+  // Counted from the shift containing now, as the team form writes it.
+  const back = shiftsBackToNow(rule(anchorMicros), Date.now() * 1000, timezone.value);
+  const primary = rule(offsetAnchor(rule(anchorMicros), back, timezone.value));
   // One shift BEHIND, which is the whole mechanism: the second rotation is
   // holding the week the first one has not reached yet, so the two are never
   // the same person while the roster has two or more.
   const secondary = rule(offsetAnchor(primary, 1, timezone.value));
+  const format = (micros: number) =>
+    formatInZone(micros, timezone.value, { dateStyle: "medium", timeStyle: "short" });
 
   return [0, 1, 2].flatMap((index) => {
     // A handover is a wall-clock time, so a DST change between turns moves the instant.
     const startMicros = shiftBoundary(primary, index, timezone.value);
-    if (startMicros === null) return [];
+    const next = shiftBoundary(primary, index + 1, timezone.value);
+    if (startMicros === null || next === null) return [];
     return {
       startMicros,
       member: memberAt(primary, startMicros, timezone.value) ?? "",
       secondary: showSecondary.value
         ? (memberAt(secondary, startMicros, timezone.value) ?? "")
         : "",
-      when: formatInZone(startMicros, timezone.value, {
-        dateStyle: "medium",
-        timeStyle: "short",
-      }),
+      when:
+        index === 0
+          ? t("oncall.rotationPreviewNow", { until: raw(format(next)) })
+          : raw(format(startMicros)),
     };
   });
 });
diff --git a/web/src/components/oncall/OnCallRuleEditor.spec.ts b/web/src/components/oncall/OnCallRuleEditor.spec.ts
index a0291fefe1..c94b9d3cad 100644
--- a/web/src/components/oncall/OnCallRuleEditor.spec.ts
+++ b/web/src/components/oncall/OnCallRuleEditor.spec.ts
@@ -101,6 +101,18 @@ describe("OnCallRuleEditor", () => {
     whoIsOnCall.mockResolvedValue({ data: [] });
   });
 
+  /// R10: a path nothing claims is judged on the draft's conditions alone, so no conflict is named.
+  it("names only the drafted team when nothing claims the path", async () => {
+    const wrapper = render({
+      initialDimensions: { "k8s-namespace": "risk" },
+      conflict: { decision: null, team_id: null },
+    });
+    await flushPromises();
+    expect(wrapper.find('[data-test="oncall-rule-editor-outcome"]').text()).toBe(
+      "Future alerts like this go to Search",
+    );
+  });
+
   it("opens a new rule on one live row, field preset to service, and no Add button", () => {
     const wrapper = render();
     expect(wrapper.findAll('[data-test^="oncall-rule-editor-row-"]')).toHaveLength(1);
diff --git a/web/src/components/oncall/OnCallScheduleEditor.spec.ts b/web/src/components/oncall/OnCallScheduleEditor.spec.ts
index 8799eb7229..f7c47a2370 100644
--- a/web/src/components/oncall/OnCallScheduleEditor.spec.ts
+++ b/web/src/components/oncall/OnCallScheduleEditor.spec.ts
@@ -1202,6 +1202,33 @@ describe("OnCallScheduleEditor", () => {
       ).toEqual([]);
     });
 
+    // C12: the server refuses a From == To window, so Save stays off until they differ.
+    it("keeps Save off while a window starts and ends at the same minute", async () => {
+      const wrapper = render({
+        schedule: schedule([
+          rota("Primary", [
+            layer({ restrictions: [{ days: [0], start_minute: 540, end_minute: 540 }] }),
+          ]),
+        ]),
+      });
+      await openRotation(wrapper);
+      const save = () => wrapper.find('[data-test="oncall-rotation-done"]');
+
+      const warning = wrapper.find('[data-test="oncall-schedule-restriction-zero-length-0-0"]');
+      expect(warning.text()).toContain("Save stays off");
+      expect(save().attributes("disabled")).toBeDefined();
+
+      // Days, From, To.
+      const to = wrapper
+        .find('[data-test="oncall-schedule-restriction-0-0"]')
+        .findAllComponents({ name: "OSelect" })
+        .at(2)!;
+      to.vm.$emit("update:modelValue", 1020);
+      await flushPromises();
+
+      expect(save().attributes("disabled")).toBeUndefined();
+    });
+
     /// Two rules of ONE rotation with the same priority and the same hours are
     /// refused as a WHOLE, so Save has to be unreachable rather than a 400.
     it("blocks a save when two rules have the same priority and hours", async () => {
diff --git a/web/src/components/oncall/OnCallScheduleEditor.vue b/web/src/components/oncall/OnCallScheduleEditor.vue
index a40bd55d8e..00ba9096e1 100644
--- a/web/src/components/oncall/OnCallScheduleEditor.vue
+++ b/web/src/components/oncall/OnCallScheduleEditor.vue
@@ -677,6 +677,8 @@ const activeIsSavable = computed(() => {
   if (!rotation?.name?.trim()) return false;
   if (!rotation.shift_rules.length) return false;
   if (rotation.shift_rules.some((rule) => !rule.members.length)) return false;
+  // The server refuses a From == To window outright.
+  if (rotation.shift_rules.some(hasZeroLengthWindow)) return false;
   return !rotation.shift_rules.some((rule) => priorityClashFor(rule));
 });
 
@@ -779,6 +781,10 @@ function priorityClashFor(rule: ShiftRule): I18nText | "" {
   return rival < 0 ? "" : t("oncall.ruleClash", { name: raw(namedShiftRules.value[rival].name) });
 }
 
+function hasZeroLengthWindow(rule: ShiftRule): boolean {
+  return (rule.restrictions ?? []).some((window) => window.start_minute === window.end_minute);
+}
+
 function overlapNames(index: number): string {
   const rules = active.value?.shift_rules ?? [];
   return overlappingRules(rules, index)
diff --git a/web/src/components/oncall/OnCallShiftRuleFields.vue b/web/src/components/oncall/OnCallShiftRuleFields.vue
index ed21433461..5d320fc53c 100644
--- a/web/src/components/oncall/OnCallShiftRuleFields.vue
+++ b/web/src/components/oncall/OnCallShiftRuleFields.vue
@@ -165,6 +165,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <p
             v-if="window.start_minute === window.end_minute"
             class="text-status-warning-text text-xs sm:col-span-4"
+            :data-test="`oncall-schedule-restriction-zero-length-${ruleIndex}-${index}`"
           >
             {{ t("oncall.rotationRestrictionZeroLength") }}
           </p>
diff --git a/web/src/components/oncall/OnCallTeamForm.spec.ts b/web/src/components/oncall/OnCallTeamForm.spec.ts
index da5ad0659d..e14fc9178d 100644
--- a/web/src/components/oncall/OnCallTeamForm.spec.ts
+++ b/web/src/components/oncall/OnCallTeamForm.spec.ts
@@ -14,15 +14,16 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { flushPromises, mount } from "@vue/test-utils";
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 
 import OnCallTeamForm from "@/components/oncall/OnCallTeamForm.vue";
 import i18n from "@/locales";
 import { queryClient } from "@/composables/query/queryClient";
-import { MICROS_PER_WEEK } from "@/ts/interfaces/oncall";
+import { MICROS_PER_DAY, MICROS_PER_WEEK } from "@/ts/interfaces/oncall";
 import oncallService from "@/services/oncall";
 import store from "@/test/unit/helpers/store";
 import usersService from "@/services/users";
+import { formatInZone, memberAt } from "@/utils/oncall";
 
 vi.mock("@/services/oncall", () => ({
   default: {
@@ -73,6 +74,9 @@ function submit(wrapper: any) {
 
 describe("OnCallTeamForm", () => {
   beforeEach(() => {
+    // The week before the fixtures' 17 Aug handover, since the form anchors on the shift containing now.
+    vi.useFakeTimers({ toFake: ["Date"] });
+    vi.setSystemTime(Date.UTC(2026, 7, 15));
     vi.clearAllMocks();
     users.orgUsers.mockResolvedValue({ data: { data: ORG_USERS } } as any);
     oncall.createTeam.mockResolvedValue({ data: { id: "team_new" } } as any);
@@ -80,6 +84,7 @@ describe("OnCallTeamForm", () => {
     oncall.getSchedule.mockResolvedValue({ data: null } as any);
     oncall.setSchedule.mockResolvedValue({ data: {} } as any);
   });
+  afterEach(() => vi.useRealTimers());
 
   // E2: the rotation editor's handover phrases stay out of the standalone shift-length labels.
   it("labels the shift lengths on their own, without the handover phrases", async () => {
@@ -129,13 +134,129 @@ describe("OnCallTeamForm", () => {
     // has no roster of its own.
     const [primary] = schedule.data.rotations;
     expect(primary.shift_rules[0].members).toEqual(["ana@o2.ai", "bob@o2.ai"]);
-    expect(primary.shift_rules[0].anchor_micros).toBe(Date.parse("2026-08-17T10:00") * 1000);
+    expect(primary.shift_rules[0].anchor_micros).toBe(
+      Date.parse("2026-08-17T10:00") * 1000 - MICROS_PER_WEEK,
+    );
     // A rotation is a position; a rule is who holds it and when. Naming both
     // "Secondary" put one word on two concepts and was a real defect.
     expect(primary.shift_rules[0].name).toBe("Base");
     expect(primary.name).toBe("Primary");
   });
 
+  // C3: the first member picked holds the shift that ends at the first handover; the second takes over there.
+  it.each([
+    ["written by the form", null],
+    [
+      "staffed by the server",
+      {
+        timezone: "UTC",
+        rotations: ["rot_primary", "rot_secondary"].map((id) => ({
+          id,
+          name: id,
+          shift_rules: [
+            {
+              name: "Base",
+              members: ["ana@o2.ai", "bob@o2.ai", "cy@o2.ai"],
+              shift_micros: 1,
+              anchor_micros: 1,
+            },
+          ],
+        })),
+      },
+    ],
+  ])("puts the first member on call until the first handover (%s)", async (_, data) => {
+    oncall.getSchedule.mockResolvedValue({ data } as any);
+    const wrapper = render();
+    await flushPromises();
+    setValues(wrapper, {
+      name: "Payments",
+      timezone: "UTC",
+      members: ["ana@o2.ai", "bob@o2.ai", "cy@o2.ai"],
+      first_handover_date: "2026-08-17",
+      first_handover_time: "10:00",
+    });
+    await submit(wrapper);
+    await flushPromises();
+
+    const [primary, secondary] = (oncall.setSchedule.mock.calls[0][0] as any).data.rotations;
+    const handover = Date.UTC(2026, 7, 17, 10, 0) * 1000;
+    const holder = (rotation: any, at: number) => memberAt(rotation.shift_rules[0], at, "UTC");
+    expect(holder(primary, handover - 1)).toBe("ana@o2.ai");
+    expect(holder(secondary, handover - 1)).toBe("bob@o2.ai");
+    expect(holder(primary, handover)).toBe("bob@o2.ai");
+    expect(holder(secondary, handover)).toBe("cy@o2.ai");
+  });
+
+  // C3/F1/F5: wherever the first handover sits, the first member is on now, until the next real handover.
+  // Daily shifts, first handover Monday 17 Aug 10:00 UTC; now is a Tuesday before it or a Thursday after it.
+  describe.each([
+    ["more than one shift away", Date.UTC(2026, 7, 11, 15, 0), Date.UTC(2026, 7, 12, 10, 0)],
+    ["already past", Date.UTC(2026, 7, 20, 15, 0), Date.UTC(2026, 7, 21, 10, 0)],
+  ])("when the first handover is %s", (_, NOW, nextHandoverMs) => {
+    const NEXT_HANDOVER = nextHandoverMs * 1000;
+    const values = {
+      name: "Payments",
+      timezone: "UTC",
+      members: ["ana@o2.ai", "bob@o2.ai", "cy@o2.ai"],
+      shift_micros: MICROS_PER_DAY,
+      first_handover_date: "2026-08-17",
+      first_handover_time: "10:00",
+    };
+
+    beforeEach(() => vi.setSystemTime(NOW));
+
+    it("anchors on the shift that contains now", async () => {
+      const wrapper = render();
+      await flushPromises();
+      setValues(wrapper, values);
+      await submit(wrapper);
+      await flushPromises();
+
+      const [primary, secondary] = (oncall.setSchedule.mock.calls[0][0] as any).data.rotations;
+      const holder = (rotation: any, at: number) => memberAt(rotation.shift_rules[0], at, "UTC");
+      expect(primary.shift_rules[0].anchor_micros).toBeLessThanOrEqual(NOW * 1000);
+      expect(holder(primary, NOW * 1000)).toBe("ana@o2.ai");
+      expect(holder(secondary, NOW * 1000)).toBe("bob@o2.ai");
+      expect(holder(primary, NEXT_HANDOVER - 1)).toBe("ana@o2.ai");
+      expect(holder(primary, NEXT_HANDOVER)).toBe("bob@o2.ai");
+    });
+
+    it("previews now until the next real handover", async () => {
+      const wrapper = render();
+      await flushPromises();
+      setValues(wrapper, values);
+      await flushPromises();
+
+      const first = wrapper.findAll('[data-test="oncall-rotation-preview"] li')[0];
+      const next = formatInZone(NEXT_HANDOVER, "UTC", { dateStyle: "medium", timeStyle: "short" });
+      expect(first.text()).toContain(`Now – ${next}`);
+      expect(first.text()).toContain("ana@o2.ai");
+    });
+  });
+
+  // C3: the preview opens on the shift running now, which ends at the first handover.
+  it("previews the current shift as now until the first handover", async () => {
+    const wrapper = render();
+    await flushPromises();
+    setValues(wrapper, {
+      timezone: "UTC",
+      members: ["ana@o2.ai", "bob@o2.ai"],
+      first_handover_date: "2026-08-17",
+      first_handover_time: "10:00",
+    });
+    await flushPromises();
+
+    const rows = wrapper.findAll('[data-test="oncall-rotation-preview"] li');
+    const handover = formatInZone(Date.UTC(2026, 7, 17, 10, 0) * 1000, "UTC", {
+      dateStyle: "medium",
+      timeStyle: "short",
+    });
+    expect(rows[0].text()).toContain(`Now – ${handover}`);
+    expect(rows[0].text()).toContain("ana@o2.ai");
+    expect(rows[1].text()).toContain(handover);
+    expect(rows[1].text()).toContain("bob@o2.ai");
+  });
+
   /// The date/time fields hold a WALL clock, meaningless without a zone. It
   /// must resolve in the team's chosen timezone, not whatever zone the
   /// browser running the form happens to be in.
@@ -154,8 +275,8 @@ describe("OnCallTeamForm", () => {
     await flushPromises();
 
     const { rotations } = (oncall.setSchedule.mock.calls[0][0] as any).data;
-    // 10:00 America/New_York on 2026-08-17 (EDT, UTC-4) is 14:00 UTC.
-    expect(rotations[0].shift_rules[0].anchor_micros).toBe(Date.UTC(2026, 7, 17, 14, 0) * 1000);
+    // 10:00 America/New_York on 2026-08-10 (EDT, UTC-4), a shift before the handover, is 14:00 UTC.
+    expect(rotations[0].shift_rules[0].anchor_micros).toBe(Date.UTC(2026, 7, 10, 14, 0) * 1000);
   });
 
   /// Adding members auto-staffs the team, and this PUT is a full replace: the
@@ -217,8 +338,8 @@ describe("OnCallTeamForm", () => {
     /// onto one instant, which is the opposite of what a second position is
     /// for.
     const anchor = Date.parse("2026-08-17T10:00") * 1000;
-    expect(rotations[0].shift_rules[0].anchor_micros).toBe(anchor);
-    expect(rotations[1].shift_rules[0].anchor_micros).toBe(anchor - MICROS_PER_WEEK);
+    expect(rotations[0].shift_rules[0].anchor_micros).toBe(anchor - MICROS_PER_WEEK);
+    expect(rotations[1].shift_rules[0].anchor_micros).toBe(anchor - 2 * MICROS_PER_WEEK);
   });
 
   /// A Secondary is one shift earlier on the team's clock: a clock change moves the instant, not the wall time.
@@ -236,6 +357,7 @@ describe("OnCallTeamForm", () => {
       },
     ],
   ])("anchors the Secondary across a clock change in the team's zone (%s)", async (_, data) => {
+    vi.setSystemTime(Date.UTC(2026, 9, 22));
     oncall.getSchedule.mockResolvedValue({ data } as any);
     const wrapper = render();
     await flushPromises();
@@ -250,9 +372,9 @@ describe("OnCallTeamForm", () => {
     await flushPromises();
 
     const { rotations } = (oncall.setSchedule.mock.calls[0][0] as any).data;
-    // Monday 26 Oct 09:00 GMT, and the Monday before at 09:00 BST: the clocks went back in between.
-    expect(rotations[0].shift_rules[0].anchor_micros).toBe(Date.UTC(2026, 9, 26, 9, 0) * 1000);
-    expect(rotations[1].shift_rules[0].anchor_micros).toBe(Date.UTC(2026, 9, 19, 8, 0) * 1000);
+    // The handover is Monday 26 Oct 09:00 GMT; the two Mondays before are 09:00 BST: the clocks went back in between.
+    expect(rotations[0].shift_rules[0].anchor_micros).toBe(Date.UTC(2026, 9, 19, 8, 0) * 1000);
+    expect(rotations[1].shift_rules[0].anchor_micros).toBe(Date.UTC(2026, 9, 12, 8, 0) * 1000);
   });
 
   /// The checkbox has to be able to say no. The backend staffs a second
@@ -360,8 +482,8 @@ describe("OnCallTeamForm", () => {
     expect(rotations[0].id).not.toBe(rotations[1].id);
 
     const anchor = Date.parse("2026-08-17T10:00") * 1000;
-    expect(rotations[0].shift_rules[0].anchor_micros).toBe(anchor);
-    expect(rotations[1].shift_rules[0].anchor_micros).toBe(anchor - MICROS_PER_WEEK);
+    expect(rotations[0].shift_rules[0].anchor_micros).toBe(anchor - MICROS_PER_WEEK);
+    expect(rotations[1].shift_rules[0].anchor_micros).toBe(anchor - 2 * MICROS_PER_WEEK);
   });
 
   it("writes only the one rotation when the box is cleared and the read-back fails", async () => {
diff --git a/web/src/components/oncall/OnCallTeamForm.vue b/web/src/components/oncall/OnCallTeamForm.vue
index 7d0cb817a7..fd1ab1d410 100644
--- a/web/src/components/oncall/OnCallTeamForm.vue
+++ b/web/src/components/oncall/OnCallTeamForm.vue
@@ -174,6 +174,7 @@ import {
   fromZonedInputValue,
   offsetAnchor,
   resolvableTimezones,
+  shiftsBackToNow,
   SHIFT_PRESETS,
 } from "@/utils/oncall";
 import OnCallRotationPreview from "./OnCallRotationPreview.vue";
@@ -448,18 +449,21 @@ async function amendStaffedRotations(
     shift_micros: shift,
     anchor_micros: anchor,
   });
+  // Primary counts from the shift containing now, so the first member picked is on call from now; rotation `index` sits `index` shifts behind.
+  const back = shiftsBackToNow(rule(anchorMicros), Date.now() * 1000, timezone);
+  const anchorFor = (index: number) => offsetAnchor(rule(anchorMicros), back + index, timezone);
   const fallback: Rotation[] = [
     {
       id: mintRotationId(),
       name: DEFAULT_ROTATION_NAME,
-      shift_rules: [rule(anchorMicros)],
+      shift_rules: [rule(anchorFor(0))],
     },
     ...(wantSecondary
       ? [
           {
             id: mintRotationId(),
             name: SECONDARY_ROTATION_NAME,
-            shift_rules: [rule(offsetAnchor(rule(anchorMicros), 1, timezone))],
+            shift_rules: [rule(anchorFor(1))],
           },
         ]
       : []),
@@ -480,7 +484,7 @@ async function amendStaffedRotations(
       shift_rules: (rotation.shift_rules ?? []).map((r) => ({
         ...r,
         shift_micros: shift,
-        anchor_micros: offsetAnchor(rule(anchorMicros), index, timezone),
+        anchor_micros: anchorFor(index),
       })),
       // A human has now chosen the timezone, the handover and the cadence, so
       // this is no longer the rotation nobody chose. The marker is the
diff --git a/web/src/components/oncall/OnCallWhatFired.spec.ts b/web/src/components/oncall/OnCallWhatFired.spec.ts
new file mode 100644
index 0000000000..14daedc4d5
--- /dev/null
+++ b/web/src/components/oncall/OnCallWhatFired.spec.ts
@@ -0,0 +1,46 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { mount } from "@vue/test-utils";
+import { describe, expect, it } from "vitest";
+
+import OnCallWhatFired from "@/components/oncall/OnCallWhatFired.vue";
+import i18n from "@/locales";
+
+describe("OnCallWhatFired", () => {
+  /// L4: a condition wraps at word boundaries and breaks inside a word only when one word overflows.
+  it("wraps the conditions between words, not mid-word", () => {
+    const wrapper = mount(OnCallWhatFired, {
+      props: {
+        alert: {
+          query_condition: {
+            type: "custom",
+            aggregation: {
+              function: "avg",
+              having: { column: "latency", operator: ">", value: 500 },
+              warning_value: 300,
+            },
+          },
+        },
+      },
+      global: { plugins: [i18n] },
+    });
+    for (const hook of ["oncall-what-fired-condition", "oncall-what-fired-warning"]) {
+      const classes = wrapper.find(`[data-test="${hook}"]`).classes();
+      expect(classes, hook).toContain("wrap-anywhere");
+      expect(classes, hook).not.toContain("break-all");
+    }
+  });
+});
diff --git a/web/src/components/oncall/OnCallWhatFired.vue b/web/src/components/oncall/OnCallWhatFired.vue
index 36ae1f7f4a..071e7d7c80 100644
--- a/web/src/components/oncall/OnCallWhatFired.vue
+++ b/web/src/components/oncall/OnCallWhatFired.vue
@@ -29,13 +29,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <OCardSection role="body" dense>
       <ODescriptionList dense>
         <ODescriptionItem :label="t('alerts.groups.criticalCondition')">
-          <span class="font-mono text-sm break-all" data-test="oncall-what-fired-condition">
+          <span class="font-mono text-sm wrap-anywhere" data-test="oncall-what-fired-condition">
             {{ raw(conditionText) }}
           </span>
         </ODescriptionItem>
 
         <ODescriptionItem v-if="hasWarning" :label="t('alerts.groups.warningCondition')">
-          <span class="font-mono text-sm break-all" data-test="oncall-what-fired-warning">
+          <span class="font-mono text-sm wrap-anywhere" data-test="oncall-what-fired-warning">
             {{ raw(warningText) }}
           </span>
         </ODescriptionItem>
diff --git a/web/src/components/settings/ModelPricingEditor.spec.ts b/web/src/components/settings/ModelPricingEditor.spec.ts
index 2c8b4bccbc..0b6fc71339 100644
--- a/web/src/components/settings/ModelPricingEditor.spec.ts
+++ b/web/src/components/settings/ModelPricingEditor.spec.ts
@@ -257,6 +257,34 @@ describe("ModelPricingEditor.vue", () => {
       expect((wrapper.vm as any).model.id).toBeNull();
       expect((wrapper.vm as any).model.name).toContain("(Copy)");
     });
+
+    it("prefills a new model's name and pattern from the route, as Create price links do", async () => {
+      const wrapper = createWrapper({
+        query: { name: "gpt-5.4-mini", match_pattern: "^gpt-5\\.4-mini$" },
+      });
+      await flushPromises();
+      const form = getForm(wrapper);
+      expect(form.state.values.name).toBe("gpt-5.4-mini");
+      expect(form.state.values.match_pattern).toBe("^gpt-5\\.4-mini$");
+      expect((wrapper.vm as any).model.id).toBeNull();
+    });
+
+    it("ignores prefill parameters when editing an existing model", async () => {
+      mockService.get.mockResolvedValue({
+        data: {
+          id: "abc",
+          name: "Existing",
+          match_pattern: "gpt-.*",
+          enabled: true,
+          tiers: [{ name: "Default", condition: null, prices: { input: 0.001 } }],
+        },
+      });
+      const wrapper = createWrapper({ query: { id: "abc", name: "other", match_pattern: "^x$" } });
+      await flushPromises();
+      const form = getForm(wrapper);
+      expect(form.state.values.name).toBe("Existing");
+      expect(form.state.values.match_pattern).toBe("gpt-.*");
+    });
   });
 
   describe("Layout and explanatory copy", () => {
@@ -1573,6 +1601,18 @@ describe("ModelPricingEditor.vue", () => {
       });
     });
 
+    it("returns to Pricing gaps for the same stream when opened from there", async () => {
+      const wrapper = createWrapper({
+        query: { name: "acme-llm", match_pattern: "^acme-llm$", from: "gaps", stream: "llm" },
+      });
+      await flushPromises();
+      (wrapper.vm as any).goBack();
+      expect(mockRouterPush).toHaveBeenCalledWith({
+        name: "modelPricingGaps",
+        query: { org_identifier: "test-org", stream: "llm" },
+      });
+    });
+
     it("uses an empty org identifier when selectedOrganization is null", async () => {
       mockStore.state.selectedOrganization = null as any;
       const wrapper = createWrapper();
diff --git a/web/src/components/settings/ModelPricingEditor.vue b/web/src/components/settings/ModelPricingEditor.vue
index 2f5d566e2e..1804e1008a 100644
--- a/web/src/components/settings/ModelPricingEditor.vue
+++ b/web/src/components/settings/ModelPricingEditor.vue
@@ -17,7 +17,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 <template>
   <OPageLayout
     :back="{
-      label: t('modelPricing.header'),
+      label: backToGaps ? t('modelPricing.unpriced.title') : t('modelPricing.header'),
       onClick: goBack,
       dataTest: 'model-pricing-editor-back-btn',
     }"
@@ -879,7 +879,17 @@ const headerTitle = computed(() =>
   isEdit.value ? t("modelPricing.editTitle") : t("modelPricing.newTitle"),
 );
 
-const model = ref<any>(createEmptyModel());
+/** A new model can open prefilled through `?name=&match_pattern=`, as Pricing gaps' Create price does. */
+function prefilledNewModel() {
+  const empty = createEmptyModel();
+  if (route.query.id) return empty;
+  const { name, match_pattern } = route.query;
+  if (typeof name === "string") empty.name = name;
+  if (typeof match_pattern === "string") empty.match_pattern = match_pattern;
+  return empty;
+}
+
+const model = ref<any>(prefilledNewModel());
 
 // Dynamic defaults (edit-prefill projects the working model) → a typed computed.
 // `model.value` holds the API-shaped record (per-token price MAP); the form holds
@@ -1417,7 +1427,22 @@ function validateUsageKey(key: string): string | null {
   return null;
 }
 
+// Pricing gaps' Create price sets `from=gaps&stream=`, so Back and Save return to that stream's gaps.
+const backToGaps = computed(() => route.query.from === "gaps");
+
 function goBack() {
+  if (backToGaps.value) {
+    router.push({
+      name: "modelPricingGaps",
+      query: {
+        org_identifier: orgIdentifier.value,
+        stream: route.query.stream as string,
+        start_time: route.query.start_time,
+        end_time: route.query.end_time,
+      },
+    });
+    return;
+  }
   router.push({
     name: "modelPricing",
     query: { org_identifier: orgIdentifier.value },
diff --git a/web/src/components/settings/ModelPricingGaps.spec.ts b/web/src/components/settings/ModelPricingGaps.spec.ts
new file mode 100644
index 0000000000..1392bc2477
--- /dev/null
+++ b/web/src/components/settings/ModelPricingGaps.spec.ts
@@ -0,0 +1,189 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount } from "@vue/test-utils";
+import { createStore } from "vuex";
+import ModelPricingGaps from "./ModelPricingGaps.vue";
+
+vi.mock("@/services/model_pricing");
+
+vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: vi.fn() }));
+
+const routerPushMock = vi.fn();
+const routerReplaceMock = vi.fn();
+const currentRouteRef = { value: { query: {} as Record<string, any> } };
+vi.mock("vue-router", () => ({
+  useRouter: () => ({
+    push: routerPushMock,
+    replace: routerReplaceMock,
+    currentRoute: currentRouteRef,
+  }),
+}));
+
+// The stream picker lists LLM trace streams.
+const mockGetStreams = vi.fn();
+vi.mock("@/composables/useStreams", () => ({
+  default: () => ({ getStreams: mockGetStreams }),
+}));
+
+import modelPricingService from "@/services/model_pricing";
+
+const unpricedResponse = {
+  models: [
+    {
+      model: "acme-internal-llm",
+      status: "unpriced",
+      spans: 1870,
+      tokens: 2_330_000,
+      cost: 0,
+      agents: ["research-agent"],
+      agent_count: 1,
+      matched: null,
+    },
+    {
+      model: "gpt-5.4-mini",
+      status: "approximate",
+      spans: 1204,
+      tokens: 9_100_000,
+      cost: 41.22,
+      agents: ["support-bot"],
+      agent_count: 1,
+      matched: {
+        name: "GPT-5.4",
+        match_pattern: "^gpt-5\\.4",
+        source: "built_in",
+        tiers: [{ name: "Default", condition: null, prices: { input: 2.5e-6, output: 1.5e-5 } }],
+      },
+    },
+  ],
+};
+
+function mountPage(query: Record<string, any> = {}) {
+  const store = createStore({ state: { selectedOrganization: { identifier: "test-org" } } });
+  currentRouteRef.value.query = query;
+  return mount(ModelPricingGaps, {
+    global: { provide: { store }, mocks: { $store: store } },
+  });
+}
+
+describe("ModelPricingGaps", () => {
+  let w: any;
+
+  beforeEach(() => {
+    vi.mocked(modelPricingService.listUnpriced).mockResolvedValue({
+      data: unpricedResponse,
+    } as any);
+    mockGetStreams.mockResolvedValue({
+      list: [
+        { name: "default", settings: { is_llm_stream: true } },
+        { name: "llm", settings: {} },
+        { name: "plain", settings: { is_llm_stream: false } },
+      ],
+    });
+  });
+
+  afterEach(() => {
+    w?.unmount();
+    vi.clearAllMocks();
+  });
+
+  it("opens the stream named by ?stream= and renders the last 24 h of unpriced models", async () => {
+    w = mountPage({ stream: "llm" });
+    await flushPromises();
+
+    const [org, params] = vi.mocked(modelPricingService.listUnpriced).mock.calls.at(-1)!;
+    expect(org).toBe("test-org");
+    expect(params.stream_name).toBe("llm");
+    expect(params.end_time - params.start_time).toBe(24 * 60 * 60 * 1_000_000);
+
+    expect(w.findComponent({ name: "UnpricedModelsTable" }).props("streams")).toEqual([
+      "default",
+      "llm",
+    ]);
+    await vi.waitFor(() =>
+      expect(w.findAll('[data-test="model-pricing-unpriced-row"]')).toHaveLength(2),
+    );
+  });
+
+  it("lists the window a link counted over, so it matches the count that linked here", async () => {
+    w = mountPage({ stream: "llm", start_time: "1000000", end_time: "9000000" });
+    await flushPromises();
+
+    const params = vi.mocked(modelPricingService.listUnpriced).mock.calls.at(-1)![1];
+    expect([params.start_time, params.end_time]).toEqual([1_000_000, 9_000_000]);
+    // A date range, not "Last 24 hours".
+    expect(String(w.findComponent({ name: "UnpricedModelsTable" }).props("windowLabel"))).toContain(
+      " – ",
+    );
+
+    // Refresh re-reads the same window instead of moving to the last 24 h.
+    w.findComponent({ name: "UnpricedModelsTable" }).vm.$emit("refresh");
+    await flushPromises();
+    const again = vi.mocked(modelPricingService.listUnpriced).mock.calls.at(-1)![1];
+    expect([again.start_time, again.end_time]).toEqual([1_000_000, 9_000_000]);
+  });
+
+  it("reads the first LLM stream when the link names none", async () => {
+    w = mountPage();
+    await flushPromises();
+    expect(vi.mocked(modelPricingService.listUnpriced).mock.calls.at(-1)![1].stream_name).toBe(
+      "default",
+    );
+  });
+
+  it("writes a picked stream to the route query, so a reload reopens it", async () => {
+    w = mountPage({ stream: "default", org_identifier: "test-org" });
+    await flushPromises();
+
+    w.findComponent({ name: "UnpricedModelsTable" }).vm.$emit("update:stream", "llm");
+    await flushPromises();
+
+    expect(routerReplaceMock).toHaveBeenLastCalledWith({
+      query: { stream: "llm", org_identifier: "test-org" },
+    });
+    expect(vi.mocked(modelPricingService.listUnpriced).mock.calls.at(-1)![1].stream_name).toBe(
+      "llm",
+    );
+  });
+
+  it("shows the load error when the read fails, and Retry reads again", async () => {
+    vi.mocked(modelPricingService.listUnpriced).mockRejectedValue({ response: { status: 400 } });
+    w = mountPage();
+    await vi.waitFor(() =>
+      expect(w.find('[data-test="model-pricing-unpriced-error"]').exists()).toBe(true),
+    );
+    expect(w.find('[data-test="model-pricing-unpriced-empty"]').exists()).toBe(false);
+    const calls = vi.mocked(modelPricingService.listUnpriced).mock.calls.length;
+
+    // A later timestamp gives the retried read a new window, so it never reuses the failed one.
+    const now = vi.spyOn(Date, "now").mockReturnValue(Date.now() + 1000);
+    await w.find('[data-test="o2-empty-state-action-retry"]').trigger("click");
+    await flushPromises();
+    now.mockRestore();
+
+    expect(vi.mocked(modelPricingService.listUnpriced).mock.calls.length).toBeGreaterThan(calls);
+  });
+
+  it("Back returns to the price list", async () => {
+    w = mountPage();
+    await flushPromises();
+    await w.find('[data-test="model-pricing-gaps-back-btn"]').trigger("click");
+    expect(routerPushMock).toHaveBeenCalledWith({
+      name: "modelPricing",
+      query: { org_identifier: "test-org" },
+    });
+  });
+});
diff --git a/web/src/components/settings/ModelPricingGaps.vue b/web/src/components/settings/ModelPricingGaps.vue
new file mode 100644
index 0000000000..9d6aa23775
--- /dev/null
+++ b/web/src/components/settings/ModelPricingGaps.vue
@@ -0,0 +1,179 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!-- Pricing gaps: the models a stream's spans priced at nothing or only
+     approximately over the last 24 h. Insights, cost cells and data-health links
+     open it with `?stream=<name>` and the window they counted over
+     (`&start_time=&end_time=`, µs), so the list shows what the link named. -->
+<template>
+  <OPageLayout
+    :back="{
+      label: t('modelPricing.header'),
+      onClick: goBack,
+      dataTest: 'model-pricing-gaps-back-btn',
+    }"
+    :title="t('modelPricing.unpriced.title')"
+    :subtitle="t('modelPricing.unpriced.subtitle')"
+    bleed
+  >
+    <div class="bg-card-glass-bg min-h-0 flex-1 overflow-hidden">
+      <UnpricedModelsTable
+        :stream="stream"
+        :window-label="windowLabel"
+        :models="models"
+        :truncated-of="truncatedOf"
+        :loading="unpricedQuery.isLoading.value"
+        :fetching="unpricedQuery.isFetching.value"
+        :error="unpricedQuery.isError.value"
+        :loaded="unpricedQuery.isSuccess.value"
+        :last-run-at="unpricedQuery.dataUpdatedAt.value"
+        :streams="streams"
+        :streams-loaded="streamsLoaded"
+        @update:stream="onStreamChange"
+        @refresh="refresh"
+      />
+    </div>
+  </OPageLayout>
+</template>
+
+<script lang="ts" setup>
+import { computed, onActivated, onBeforeMount, ref, watch } from "vue";
+import { useQuery } from "@tanstack/vue-query";
+import { useRouter } from "vue-router";
+import { useStore } from "vuex";
+import { useI18nTyped } from "@/types/i18n";
+import { unpricedModelsQuery } from "@/services/model_pricing.queries";
+import { useLlmTraceStreams } from "@/enterprise/composables/useLlmTraceStreams";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import { timestampToTimezoneDate } from "@/utils/timezone";
+import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
+import UnpricedModelsTable from "@/components/settings/UnpricedModelsTable.vue";
+
+const { t } = useI18nTyped();
+const store = useStore();
+const router = useRouter();
+
+const orgIdentifier = computed(() => store.state.selectedOrganization?.identifier || "");
+
+const WINDOW_US = 24 * 60 * 60 * 1_000_000;
+const lastDayWindow = () => {
+  const end = Date.now() * 1000;
+  return { start: end - WINDOW_US, end };
+};
+/** `?start_time=&end_time=` (µs): the window the linking page counted over. */
+function routeWindow(): { start: number; end: number } | null {
+  const q = router.currentRoute.value.query;
+  const start = Number(q.start_time);
+  const end = Number(q.end_time);
+  return Number.isSafeInteger(start) && Number.isSafeInteger(end) && start > 0 && start < end
+    ? { start, end }
+    : null;
+}
+const stream = ref("");
+// Fixed when set, so the query key stays stable until a refresh moves it.
+const timeWindow = ref(lastDayWindow());
+// A linked window stays put on refresh; the default one moves to the last 24 h.
+const linkedWindow = ref(false);
+const windowLabel = computed(() => {
+  if (!linkedWindow.value) return t("modelPricing.unpriced.window");
+  const fmt = (us: number) =>
+    timestampToTimezoneDate(us / 1000, store.state.timezone || "UTC", "MMM d, HH:mm");
+  return t("modelPricing.unpriced.windowRange", {
+    from: fmt(timeWindow.value.start),
+    to: fmt(timeWindow.value.end),
+  });
+});
+const {
+  availableStreams: streams,
+  streamsLoaded,
+  ensureStreamsLoaded,
+  loadTraceStreams,
+} = useLlmTraceStreams(stream, t);
+// The kept-alive page outlives an org switch; the stream names belong to the old org.
+watch(orgIdentifier, () => loadTraceStreams());
+
+const unpricedQuery = useQuery(() =>
+  Object.assign(
+    unpricedModelsQuery(
+      orgIdentifier.value,
+      stream.value,
+      timeWindow.value.start,
+      timeWindow.value.end,
+    ),
+    { enabled: !!orgIdentifier.value && !!stream.value },
+  ),
+);
+const models = computed(() => unpricedQuery.data.value?.models ?? []);
+// The server lists the models with the most tokens; the banner names the full count then.
+const truncatedOf = computed(() =>
+  unpricedQuery.data.value?.models_truncated ? unpricedQuery.data.value.model_count : null,
+);
+
+function refresh() {
+  if (linkedWindow.value) unpricedQuery.refetch();
+  else timeWindow.value = lastDayWindow();
+}
+
+watch(unpricedQuery.error, (e: any) => {
+  // 403s already raise the global no-access banner.
+  if (!e || e.response?.status === 403) return;
+  const msg = e.response?.data?.message || e.message || t("modelPricing.errUnknown");
+  toast({
+    variant: "error",
+    message: t("toastMessages.settings.message", {
+      prefix: t("modelPricing.unpriced.errLoad"),
+      message: msg,
+    }),
+    timeout: 5000,
+  });
+});
+
+/** Reads `?stream=` from a link or a reload. */
+function applyRouteStream() {
+  const s = router.currentRoute.value.query.stream;
+  // Before the list loads, the loader keeps a valid name and clamps an unknown one.
+  if (typeof s === "string" && s && (!streamsLoaded.value || streams.value.includes(s))) {
+    stream.value = s;
+  }
+  const linked = routeWindow();
+  if (linked) {
+    linkedWindow.value = true;
+    timeWindow.value = linked;
+    return;
+  }
+  // A link back into a kept-alive page should show the last 24 h from now; mount
+  // and its first activation both land here, so only a stale window moves.
+  if (linkedWindow.value || Date.now() * 1000 - timeWindow.value.end > 60_000_000) {
+    linkedWindow.value = false;
+    timeWindow.value = lastDayWindow();
+  }
+}
+
+function onStreamChange(s: string) {
+  stream.value = s;
+  router.replace({ query: { ...router.currentRoute.value.query, stream: s } });
+}
+
+function goBack() {
+  router.push({ name: "modelPricing", query: { org_identifier: orgIdentifier.value } });
+}
+
+onBeforeMount(() => {
+  applyRouteStream();
+  ensureStreamsLoaded();
+});
+onActivated(applyRouteStream);
+</script>
diff --git a/web/src/components/settings/ModelPricingList.spec.ts b/web/src/components/settings/ModelPricingList.spec.ts
index 1d2af7adf2..b3719ef5b2 100644
--- a/web/src/components/settings/ModelPricingList.spec.ts
+++ b/web/src/components/settings/ModelPricingList.spec.ts
@@ -46,10 +46,12 @@ vi.mock("@/lib/feedback/Toast/useToast", () => ({
 
 // Router mock — capture push calls
 const routerPushMock = vi.fn();
+const routerReplaceMock = vi.fn();
 const currentRouteRef = { value: { query: {} as Record<string, any> } };
 vi.mock("vue-router", () => ({
   useRouter: () => ({
     push: routerPushMock,
+    replace: routerReplaceMock,
     currentRoute: currentRouteRef,
   }),
 }));
@@ -309,6 +311,12 @@ const mockI18n = createI18n({
         localTimeHint: "In your timezone: {range}",
         tierAlwaysActive: "Always active (default)",
         tierDefaultName: "Default",
+        builtInStatus: {
+          seed: "seed {date}.",
+          neverSynced: "never synced",
+          lastSynced: "synced at {time}",
+        },
+        unpriced: { title: "Pricing gaps" },
       },
     },
   },
@@ -1383,3 +1391,67 @@ describe("list view state", () => {
     });
   });
 });
+
+describe("Route tabs and header", () => {
+  let w: any;
+
+  beforeEach(() => {
+    vi.mocked(modelPricingService.list).mockResolvedValue({ data: mockModels } as any);
+  });
+
+  afterEach(() => {
+    w?.unmount();
+    vi.clearAllMocks();
+  });
+
+  it("switching tab writes it to the route query, keeping the other params", async () => {
+    w = mountComponent({ query: { tab: "all", org_identifier: "test-org" } });
+    await flushPromises();
+
+    w.findComponent({ name: "AppTabs" }).vm.$emit("update:activeTab", "org");
+    await flushPromises();
+
+    expect(w.vm.selectedTab).toBe("org");
+    expect(routerReplaceMock).toHaveBeenLastCalledWith({
+      query: { tab: "org", org_identifier: "test-org" },
+    });
+  });
+
+  it("Pricing gaps opens its own page", async () => {
+    w = mountComponent();
+    await flushPromises();
+    await w.find('[data-test="model-pricing-gaps-btn"]').trigger("click");
+    expect(routerPushMock).toHaveBeenCalledWith({
+      name: "modelPricingGaps",
+      query: { org_identifier: "test-org" },
+    });
+  });
+
+  it("reopens the tab named in the route query after a reload", async () => {
+    w = mountComponent({ query: { tab: "inherited" } });
+    await flushPromises();
+    expect(w.vm.selectedTab).toBe("inherited");
+  });
+
+  it("says online sync has not run when the built-in list was never synced", async () => {
+    vi.mocked(modelPricingService.getBuiltIn).mockResolvedValue({
+      data: { models: [], source_url: "", last_updated: 0, seed_date: "2026-10-14" },
+    } as any);
+    w = mountComponent();
+    await flushPromises();
+    const status = w.find('[data-test="model-pricing-built-in-status"]');
+    expect(status.text()).toContain("2026-10-14");
+    expect(status.text()).toContain("never synced");
+  });
+
+  it("gives the last online sync time once the built-in list has synced", async () => {
+    vi.mocked(modelPricingService.getBuiltIn).mockResolvedValue({
+      data: { models: [], source_url: "", last_updated: 1_798_000_000, seed_date: "2026-10-14" },
+    } as any);
+    w = mountComponent();
+    await flushPromises();
+    const status = w.find('[data-test="model-pricing-built-in-status"]');
+    expect(status.text()).toContain("synced at 2026-12-");
+    expect(status.text()).not.toContain("never synced");
+  });
+});
diff --git a/web/src/components/settings/ModelPricingList.vue b/web/src/components/settings/ModelPricingList.vue
index eefd085f43..0b92a02406 100644
--- a/web/src/components/settings/ModelPricingList.vue
+++ b/web/src/components/settings/ModelPricingList.vue
@@ -43,6 +43,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </OButton>
       </template>
       <template #actions-overflow>
+        <OButton variant="outline" size="sm" @click="openGaps" data-test="model-pricing-gaps-btn">
+          {{ t("modelPricing.unpriced.title") }}
+        </OButton>
         <OButton
           variant="outline"
           size="sm"
@@ -90,6 +93,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           />
         </OButton>
       </template>
+      <template v-if="builtInStatus" #subnav>
+        <div
+          class="px-page-edge text-text-secondary flex items-center gap-1.5 py-1.5 text-xs"
+          data-test="model-pricing-built-in-status"
+        >
+          <OIcon name="info-outline" size="xs" class="shrink-0" />
+          <span>{{ builtInStatus }}</span>
+        </div>
+      </template>
 
       <!-- List Table -->
       <div class="bg-card-glass-bg min-h-0 flex-1 overflow-hidden">
@@ -693,7 +705,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <script lang="ts" setup>
 import { useQuery } from "@tanstack/vue-query";
-import { modelPricingQuery } from "@/services/model_pricing.queries";
+import { builtInPricingQuery, modelPricingQuery } from "@/services/model_pricing.queries";
 import { modelPricingKeys } from "@/services/model_pricing.querykeys";
 import { queryClient } from "@/composables/query/queryClient";
 import { ref, computed, onBeforeMount, onActivated, watch } from "vue";
@@ -723,6 +735,7 @@ import ODimensionChip from "@/lib/core/Badge/ODimensionChip.vue";
 import OSeparator from "@/lib/core/Separator/OSeparator.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import UtcHoursBar from "@/components/settings/UtcHoursBar.vue";
+import { timestampToTimezoneDate } from "@/utils/timezone";
 import OCode from "@/lib/core/Code/OCode.vue";
 import OText from "@/lib/core/Typography/OText.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
@@ -765,6 +778,45 @@ const dropPricingDrafts = (ids: string[]) => {
   }
 };
 
+// ── Built-in price list status (header note) ────────────────────────────────
+const builtInQuery = useQuery(() =>
+  Object.assign(builtInPricingQuery(orgIdentifier.value, true), { enabled: !!orgIdentifier.value }),
+);
+
+/** How old the built-in prices are, and whether this server has synced them online. */
+const builtInStatus = computed(() => {
+  const info = builtInQuery.data.value;
+  if (!info?.seed_date) return "";
+  const seed = t("modelPricing.builtInStatus.seed", { date: info.seed_date });
+  const sync = info.last_updated
+    ? t("modelPricing.builtInStatus.lastSynced", {
+        time: timestampToTimezoneDate(
+          info.last_updated * 1000,
+          store.state.timezone || "UTC",
+          "yyyy-MM-dd HH:mm ZZZZ",
+        ),
+      })
+    : t("modelPricing.builtInStatus.neverSynced");
+  return raw(`${seed} ${sync}`);
+});
+
+const viewState = useListViewState("model-pricing", {
+  filterQuery: "",
+  selectedTab: "all",
+  pageSize: 20,
+  currentPage: 1,
+  sortBy: "",
+  sortOrder: "asc" as "asc" | "desc",
+});
+const selectedTab = ref(viewState.selectedTab);
+
+/** `?tab=<tab>` reopens a tab after a reload. */
+function applyRouteTab() {
+  const { tab } = router.currentRoute.value.query;
+  if (typeof tab !== "string" || !tabOptions.value.some((o) => o.value === tab)) return;
+  selectedTab.value = tab;
+}
+
 const modelsQuery = useQuery(() =>
   Object.assign(modelPricingQuery(orgIdentifier.value), { enabled: !!orgIdentifier.value }),
 );
@@ -826,14 +878,6 @@ const confirmDialogMeta = ref({
 const resetConfirmDialog = () => {
   confirmDialogMeta.value.show = false;
 };
-const viewState = useListViewState("model-pricing", {
-  filterQuery: "",
-  selectedTab: "all",
-  pageSize: 20,
-  currentPage: 1,
-  sortBy: "",
-  sortOrder: "asc" as "asc" | "desc",
-});
 const filterQuery = ref(viewState.filterQuery);
 const pageSize = ref(viewState.pageSize);
 const currentPage = ref(viewState.currentPage);
@@ -843,7 +887,6 @@ const showImportModelPricingPage = ref(false);
 const showTestMatchDialog = ref(false);
 const selectedIds = ref<string[]>([]);
 const bulkDeleteLoading = ref(false);
-const selectedTab = ref(viewState.selectedTab);
 
 watch([filterQuery, selectedTab, pageSize, currentPage, sortBy, sortOrder], () => {
   Object.assign(viewState, {
@@ -864,6 +907,7 @@ const tabOptions = computed(() => [
 
 function onTabChange() {
   selectedIds.value = [];
+  router.replace({ query: { ...router.currentRoute.value.query, tab: selectedTab.value } });
 }
 
 /** Flat list of all models (parents + children) for ID-based lookups. */
@@ -970,6 +1014,7 @@ const isFiltered = computed(() => !!filterQuery.value.trim() || selectedTab.valu
 function clearFilters() {
   filterQuery.value = "";
   selectedTab.value = "all";
+  onTabChange();
 }
 
 const filteredModels = computed(() => {
@@ -1107,6 +1152,10 @@ watch(modelsQuery.error, (e: any) => {
   if (e) notifyError(t("modelPricing.errLoadModels"), e);
 });
 
+function openGaps() {
+  router.push({ name: "modelPricingGaps", query: { org_identifier: orgIdentifier.value } });
+}
+
 function openEditor(model: any) {
   if (model) {
     router.push({
@@ -1196,7 +1245,7 @@ async function refreshBuiltIn() {
       variant: "success",
       message: t("modelPricing.builtInPricesSynced"),
     });
-    await fetchModels(true);
+    await Promise.all([fetchModels(true), builtInQuery.refetch()]);
   } catch (e: any) {
     notifyError(t("modelPricing.errSync"), e);
   } finally {
@@ -1277,6 +1326,7 @@ onBeforeMount(() => {
   if (router.currentRoute.value.query.action === "import") {
     showImportModelPricingPage.value = true;
   }
+  applyRouteTab();
 });
 
 onActivated(() => {
@@ -1284,6 +1334,7 @@ onActivated(() => {
   if (router.currentRoute.value.query.action === "import") {
     showImportModelPricingPage.value = true;
   }
+  applyRouteTab();
 });
 
 useShortcuts([
diff --git a/web/src/components/settings/UnpricedModelsTable.spec.ts b/web/src/components/settings/UnpricedModelsTable.spec.ts
new file mode 100644
index 0000000000..456ae5ab19
--- /dev/null
+++ b/web/src/components/settings/UnpricedModelsTable.spec.ts
@@ -0,0 +1,315 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { createStore } from "vuex";
+import type { AxiosResponse } from "axios";
+import type { UnpricedModel } from "@/services/model_pricing";
+import UnpricedModelsTable from "./UnpricedModelsTable.vue";
+
+vi.mock("@/services/model_pricing", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), { default: { create: vi.fn() } });
+});
+
+vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: vi.fn() }));
+
+const routerPushMock = vi.fn();
+vi.mock("vue-router", () => ({
+  useRouter: () => ({ push: routerPushMock, currentRoute: { value: { query: {} } } }),
+}));
+
+import modelPricingService from "@/services/model_pricing";
+
+const ConfirmDialogStub = {
+  name: "ConfirmDialog",
+  props: ["modelValue", "title", "message", "okLabel"],
+  emits: ["update:ok", "update:cancel", "update:modelValue"],
+  template: `
+    <div data-test="confirm-dialog-stub" :data-open="String(!!modelValue)">
+      <button data-test="confirm-dialog-ok" @click="$emit('update:ok')">ok</button>
+    </div>
+  `,
+};
+
+/** The two rows of a GET /llm/models/unpriced response, as the design draws them. */
+const unpricedResponse: { models: UnpricedModel[] } = {
+  models: [
+    {
+      model: "acme-internal-llm",
+      status: "unpriced",
+      spans: 1870,
+      tokens: 2_330_000,
+      cost: 0,
+      agents: ["research-agent"],
+      agent_count: 1,
+      matched: null,
+    },
+    {
+      model: "gpt-5.4-mini",
+      status: "approximate",
+      spans: 1204,
+      tokens: 9_100_000,
+      cost: 41.22,
+      agents: ["support-bot"],
+      agent_count: 1,
+      matched: {
+        name: "GPT-5.4",
+        match_pattern: "^gpt-5\\.4",
+        source: "built_in",
+        tiers: [{ name: "Default", condition: null, prices: { input: 2.5e-6, output: 1.5e-5 } }],
+      },
+    },
+  ],
+};
+
+function mountTab(
+  models: UnpricedModel[] = unpricedResponse.models,
+  overrides: Record<string, unknown> = {},
+) {
+  const store = createStore({ state: { selectedOrganization: { identifier: "test-org" } } });
+  return mount(UnpricedModelsTable, {
+    props: {
+      models,
+      loading: false,
+      fetching: false,
+      error: false,
+      loaded: true,
+      lastRunAt: 0,
+      streams: ["default"],
+      streamsLoaded: true,
+      stream: "default",
+      ...overrides,
+    },
+    global: {
+      provide: { store },
+      mocks: { $store: store },
+      stubs: { ConfirmDialog: ConfirmDialogStub },
+    },
+  });
+}
+
+// OTable keeps its loading skeleton up for a minimum real-time window.
+async function waitForRow(w: VueWrapper, model: string) {
+  return vi.waitFor(() => {
+    const row = w.findAll('[data-test^="o2-table-row-"]').find((r) => r.text().includes(model));
+    expect(row).toBeTruthy();
+    return row!;
+  });
+}
+
+describe("UnpricedModelsTable", () => {
+  let wrapper: VueWrapper;
+
+  beforeEach(() => {
+    vi.mocked(modelPricingService.create).mockResolvedValue({ data: {} } as AxiosResponse);
+  });
+
+  afterEach(() => {
+    wrapper?.unmount();
+    vi.clearAllMocks();
+  });
+
+  it("renders one row per model, with Mute for unpriced and Keep for approximate", async () => {
+    wrapper = mountTab();
+    const unpriced = await waitForRow(wrapper, "acme-internal-llm");
+    const approximate = await waitForRow(wrapper, "gpt-5.4-mini");
+
+    expect(wrapper.findAll('[data-test="model-pricing-unpriced-row"]')).toHaveLength(2);
+    expect(unpriced.text()).toContain("research-agent");
+    expect(unpriced.find('[data-test="model-pricing-unpriced-mute-btn"]').exists()).toBe(true);
+    expect(unpriced.find('[data-test="model-pricing-unpriced-keep-btn"]').exists()).toBe(false);
+
+    expect(approximate.text()).toContain("GPT-5.4");
+    expect(approximate.text()).toContain("$2.50");
+    expect(approximate.text()).toContain("$15.00");
+    expect(approximate.find('[data-test="model-pricing-unpriced-keep-btn"]').exists()).toBe(true);
+    expect(approximate.find('[data-test="model-pricing-unpriced-mute-btn"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="model-pricing-unpriced-banner"]').exists()).toBe(true);
+  });
+
+  it("shows how many agents the server left out of a capped list", async () => {
+    const [first, second] = unpricedResponse.models;
+    wrapper = mountTab([
+      { ...first, agents: ["research-agent", "triage"], agent_count: 7 },
+      second,
+    ]);
+    const row = await waitForRow(wrapper, "acme-internal-llm");
+    expect(row.text()).toContain("research-agent, triage, +5 more");
+  });
+
+  it("keeps a historical gap visible after an exact price covers new spans", async () => {
+    const row = { ...unpricedResponse.models[1], priced_now: true };
+    wrapper = mountTab([row]);
+    const shown = await waitForRow(wrapper, row.model!);
+    expect(shown.text()).toContain("Priced for new spans");
+    expect(shown.find('[data-test="model-pricing-unpriced-priced-since"]').text()).toBe(
+      "No action needed",
+    );
+    expect(shown.find('[data-test="model-pricing-unpriced-create-btn"]').exists()).toBe(false);
+    expect(shown.find('[data-test="model-pricing-unpriced-keep-btn"]').exists()).toBe(false);
+    expect(shown.find('[data-test="model-pricing-unpriced-mute-btn"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="model-pricing-unpriced-empty"]').exists()).toBe(false);
+  });
+
+  it("shows the all-priced empty state and no banner when no model is listed", async () => {
+    wrapper = mountTab([]);
+    await vi.waitFor(() =>
+      expect(wrapper.find('[data-test="model-pricing-unpriced-empty"]').exists()).toBe(true),
+    );
+    expect(wrapper.find('[data-test="model-pricing-unpriced-banner"]').exists()).toBe(false);
+  });
+
+  it("names every marked model in the banner when the server listed only the top ones", async () => {
+    wrapper = mountTab(unpricedResponse.models, { truncatedOf: 140 });
+    await waitForRow(wrapper, "acme-internal-llm");
+    const banner = wrapper.find('[data-test="model-pricing-unpriced-banner"]').text();
+    expect(banner).toContain("140 models");
+    expect(banner).toContain("top 2 by tokens");
+  });
+
+  it("shows the load error, not the all-priced state, and Retry asks for a new read", async () => {
+    wrapper = mountTab([], { error: true, loaded: false });
+    await vi.waitFor(() =>
+      expect(wrapper.find('[data-test="model-pricing-unpriced-error"]').exists()).toBe(true),
+    );
+    expect(wrapper.find('[data-test="model-pricing-unpriced-empty"]').exists()).toBe(false);
+
+    await wrapper.find('[data-test="o2-empty-state-action-retry"]').trigger("click");
+    expect(wrapper.emitted("refresh")).toHaveLength(1);
+  });
+
+  it("holds the skeleton, not the all-priced state, while the stream list loads", async () => {
+    wrapper = mountTab([], { streams: [], streamsLoaded: false, stream: "", loaded: false });
+    await flushPromises();
+    expect(wrapper.find('[data-test="o2-table-skeleton-body"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="model-pricing-unpriced-empty"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="model-pricing-unpriced-no-streams"]').exists()).toBe(false);
+  });
+
+  it("holds the skeleton, not the all-priced state, until the first read succeeds", async () => {
+    wrapper = mountTab([], { loading: true, loaded: false });
+    await flushPromises();
+    expect(wrapper.find('[data-test="o2-table-skeleton-body"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="model-pricing-unpriced-empty"]').exists()).toBe(false);
+  });
+
+  it("shows a missing price side as not priced and Keep saves only the priced side", async () => {
+    const oneSided: UnpricedModel = {
+      ...unpricedResponse.models[1],
+      matched: {
+        ...unpricedResponse.models[1].matched!,
+        tiers: [{ name: "Default", condition: null, prices: { input: 2.5e-6 } }],
+      },
+    };
+    wrapper = mountTab([oneSided]);
+    const row = await waitForRow(wrapper, "gpt-5.4-mini");
+    expect(row.text()).toContain("$2.50");
+    expect(row.text()).toContain("not priced");
+    expect(row.text()).not.toContain("$0.00");
+
+    await row.find('[data-test="model-pricing-unpriced-keep-btn"]').trigger("click");
+    await flushPromises();
+    const saved = vi.mocked(modelPricingService.create).mock.calls[0][1];
+    expect(saved.tiers[0].prices).toEqual({ input: 2.5e-6 });
+    expect(saved.tiers[0].prices).not.toHaveProperty("output");
+  });
+
+  it("Create price opens the New model editor with the exact pattern filled in", async () => {
+    wrapper = mountTab();
+    const row = await waitForRow(wrapper, "gpt-5.4-mini");
+    await row.find('[data-test="model-pricing-unpriced-create-btn"]').trigger("click");
+
+    expect(routerPushMock).toHaveBeenCalledWith({
+      name: "modelPricingEditor",
+      query: {
+        org_identifier: "test-org",
+        name: "gpt-5.4-mini",
+        match_pattern: "^gpt-5\\.4-mini$",
+        from: "gaps",
+        stream: "default",
+      },
+    });
+  });
+
+  it("lists spans without a model name as one row that links to the instrumentation guide", async () => {
+    const noModel: UnpricedModel = {
+      model: null,
+      status: "unpriced",
+      spans: 4,
+      tokens: 1200,
+      cost: 0,
+      agents: [],
+      agent_count: 0,
+      matched: null,
+    };
+    const open = vi.spyOn(window, "open").mockReturnValue(null);
+    wrapper = mountTab([noModel, ...unpricedResponse.models]);
+    const row = await waitForRow(wrapper, "(no model name)");
+
+    expect(wrapper.findAll('[data-test="model-pricing-unpriced-row"]')).toHaveLength(3);
+    // Nothing to price: no Create price or Mute, a pointer to the fix instead.
+    expect(row.find('[data-test="model-pricing-unpriced-create-btn"]').exists()).toBe(false);
+    expect(row.find('[data-test="model-pricing-unpriced-mute-btn"]').exists()).toBe(false);
+    expect(row.find('[data-test="model-pricing-unpriced-no-model"]').exists()).toBe(true);
+    await row.find('[data-test="model-pricing-unpriced-docs-btn"]').trigger("click");
+    expect(open).toHaveBeenCalledWith(
+      "https://openobserve.ai/docs/integration/ai/",
+      "_blank",
+      "noopener,noreferrer",
+    );
+    expect(routerPushMock).not.toHaveBeenCalled();
+    open.mockRestore();
+  });
+
+  it("Keep saves an exact org price that copies the matched tiers", async () => {
+    wrapper = mountTab();
+    const row = await waitForRow(wrapper, "gpt-5.4-mini");
+    await row.find('[data-test="model-pricing-unpriced-keep-btn"]').trigger("click");
+    await flushPromises();
+
+    expect(modelPricingService.create).toHaveBeenCalledTimes(1);
+    expect(vi.mocked(modelPricingService.create).mock.calls[0]).toEqual([
+      "test-org",
+      expect.objectContaining({
+        name: "gpt-5.4-mini",
+        match_pattern: "^gpt-5\\.4-mini$",
+        tiers: unpricedResponse.models[1].matched!.tiers,
+      }),
+    ]);
+  });
+
+  it("Mute saves a zero price only after the confirm", async () => {
+    wrapper = mountTab();
+    const row = await waitForRow(wrapper, "acme-internal-llm");
+    await row.find('[data-test="model-pricing-unpriced-mute-btn"]').trigger("click");
+    await flushPromises();
+    expect(modelPricingService.create).not.toHaveBeenCalled();
+    expect(wrapper.find('[data-test="confirm-dialog-stub"]').attributes("data-open")).toBe("true");
+
+    await wrapper.find('[data-test="confirm-dialog-ok"]').trigger("click");
+    await flushPromises();
+
+    expect(vi.mocked(modelPricingService.create).mock.calls[0]).toEqual([
+      "test-org",
+      expect.objectContaining({
+        name: "acme-internal-llm (muted)",
+        match_pattern: "^acme-internal-llm$",
+        tiers: [{ name: "Default", condition: null, prices: { input: 0, output: 0 } }],
+      }),
+    ]);
+  });
+});
diff --git a/web/src/components/settings/UnpricedModelsTable.vue b/web/src/components/settings/UnpricedModelsTable.vue
new file mode 100644
index 0000000000..843fc9a9bd
--- /dev/null
+++ b/web/src/components/settings/UnpricedModelsTable.vue
@@ -0,0 +1,467 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!-- Models seen in a stream's spans over the last 24 h that matched no price, or
+     only part of a pattern, each with a one-step fix. The Pricing gaps page owns
+     the read; this view owns the fixes. -->
+<template>
+  <div class="flex h-full min-h-0 flex-col" data-test="model-pricing-unpriced-tab">
+    <OBanner
+      v-if="models.length"
+      variant="warning"
+      icon="warning-amber"
+      dense
+      class="mx-page-edge mt-2 shrink-0"
+      :content="bannerText"
+      data-test="model-pricing-unpriced-banner"
+    />
+    <div class="min-h-0 flex-1 overflow-hidden">
+      <OTable
+        :frame="false"
+        data-test="model-pricing-unpriced-table"
+        :data="models"
+        :columns="columns"
+        :row-key="rowKey"
+        :loading="showSkeleton"
+        :error="error ? t('emptyState.loadError.title') : null"
+        pagination="none"
+        sorting="client"
+        :default-columns="false"
+        :show-global-filter="false"
+      >
+        <template #toolbar>
+          <div class="flex w-full min-w-0 flex-wrap items-center gap-2">
+            <div class="w-64" data-test="model-pricing-unpriced-stream-select">
+              <OSelect
+                :model-value="stream"
+                :label="t('modelPricing.unpriced.streamLabel')"
+                label-position="inside"
+                :options="streams"
+                :disabled="!streams.length"
+                class="w-full"
+                @update:model-value="(v) => emit('update:stream', String(v ?? ''))"
+              />
+            </div>
+            <OBadge
+              variant="default-outline"
+              icon="schedule"
+              data-test="model-pricing-unpriced-window"
+            >
+              {{ windowLabel }}
+            </OBadge>
+          </div>
+        </template>
+        <template #toolbar-trailing>
+          <ORefreshButton
+            layout="inline"
+            variant="outline"
+            :last-run-at="lastRunAt"
+            :loading="fetching"
+            data-test="model-pricing-unpriced-refresh-btn"
+            @click="emit('refresh')"
+          />
+        </template>
+
+        <template #cell-model="{ row }">
+          <div class="flex min-w-0 flex-col py-1" data-test="model-pricing-unpriced-row">
+            <OTruncatedText as="div" class="font-medium">{{
+              row.model ?? t("modelPricing.unpriced.noModelName")
+            }}</OTruncatedText>
+            <span class="text-text-secondary text-xs">{{ seenBy(row) }}</span>
+          </div>
+        </template>
+        <template #cell-priced_as="{ row }">
+          <OBadge v-if="!row.matched" variant="error-soft" size="sm">
+            {{ t("modelPricing.unpriced.noMatch") }}
+          </OBadge>
+          <div v-else class="flex min-w-0 flex-col py-1">
+            <div class="flex min-w-0 items-center gap-1.5">
+              <OTruncatedText as="span">{{ row.matched.name }}</OTruncatedText>
+              <OBadge
+                :variant="row.priced_now ? 'success-soft' : 'warning-soft'"
+                size="sm"
+                class="shrink-0"
+              >
+                {{
+                  t(
+                    row.priced_now
+                      ? "modelPricing.unpriced.pricedNow"
+                      : "modelPricing.unpriced.approximate",
+                  )
+                }}
+              </OBadge>
+            </div>
+            <span v-if="matchedPrices(row)" class="text-text-secondary text-xs">
+              {{ matchedPrices(row) }}
+            </span>
+          </div>
+        </template>
+        <template #cell-tokens="{ row }">{{ formatTokens(row.tokens) }}</template>
+        <template #cell-cost="{ row }">${{ formatCost(row.cost) }}</template>
+        <template #cell-actions="{ row }">
+          <div
+            v-if="row.model === null"
+            class="flex items-center justify-end gap-1.5"
+            data-test="model-pricing-unpriced-no-model"
+          >
+            <!-- The hint rides in a tooltip so the pinned column never outgrows its width. -->
+            <OButton
+              variant="outline"
+              size="sm"
+              data-test="model-pricing-unpriced-docs-btn"
+              @click.stop="openInstrumentationDocs"
+            >
+              {{ t("modelPricing.unpriced.instrumentationDocs") }}
+              <OTooltip :content="t('modelPricing.unpriced.noModelHint')" />
+            </OButton>
+          </div>
+          <span
+            v-else-if="row.priced_now"
+            class="text-text-secondary inline-flex items-center gap-1 text-xs"
+            data-test="model-pricing-unpriced-priced-since"
+          >
+            {{ t("modelPricing.unpriced.noActionNeeded") }}
+            <OIcon name="info-outline" size="xs" />
+            <OTooltip :content="t('modelPricing.unpriced.historicalGap')" />
+          </span>
+          <div v-else class="flex items-center justify-end gap-1">
+            <OButton
+              variant="outline"
+              size="sm"
+              data-test="model-pricing-unpriced-create-btn"
+              @click.stop="createPrice(row)"
+            >
+              {{ t("modelPricing.unpriced.createPrice") }}
+            </OButton>
+            <OButton
+              v-if="row.matched"
+              variant="outline"
+              size="sm"
+              :loading="pendingModel === row.model"
+              :disabled="!!pendingModel"
+              data-test="model-pricing-unpriced-keep-btn"
+              @click.stop="keepPrices(row)"
+            >
+              {{ t("modelPricing.unpriced.keepPrices", { name: row.matched.name }) }}
+            </OButton>
+            <OButton
+              v-else
+              variant="outline"
+              size="sm"
+              :loading="pendingModel === row.model"
+              :disabled="!!pendingModel"
+              data-test="model-pricing-unpriced-mute-btn"
+              @click.stop="confirmMute(row)"
+            >
+              {{ t("modelPricing.unpriced.mute") }}
+            </OButton>
+          </div>
+        </template>
+
+        <template #error>
+          <OEmptyState
+            size="block"
+            preset="load-error"
+            data-test="model-pricing-unpriced-error"
+            @action="emit('refresh')"
+          />
+        </template>
+        <template #empty>
+          <OEmptyState
+            v-if="noStreams"
+            size="block"
+            illustration="stream-select"
+            :title="t('modelPricing.unpriced.noStreamsTitle')"
+            :description="t('modelPricing.unpriced.noStreamsDesc')"
+            data-test="model-pricing-unpriced-no-streams"
+          />
+          <OEmptyState
+            v-else-if="loaded"
+            size="block"
+            illustration="check"
+            :title="t('modelPricing.unpriced.emptyTitle')"
+            data-test="model-pricing-unpriced-empty"
+          />
+        </template>
+      </OTable>
+    </div>
+    <p
+      class="text-text-secondary px-page-edge shrink-0 py-2 text-xs"
+      data-test="model-pricing-unpriced-note"
+    >
+      {{ t("modelPricing.unpriced.recordedCostNote") }}
+    </p>
+
+    <ConfirmDialog
+      v-model="muteDialog.show"
+      :title="t('modelPricing.unpriced.muteConfirmTitle')"
+      :message="muteDialog.message"
+      :ok-label="t('modelPricing.unpriced.mute')"
+      @update:ok="mute"
+      @update:cancel="muteDialog.show = false"
+    />
+  </div>
+</template>
+
+<script lang="ts" setup>
+import { computed, ref } from "vue";
+import { useMutation } from "@tanstack/vue-query";
+import { useRouter } from "vue-router";
+import { useStore } from "vuex";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import type { UnpricedModel } from "@/services/model_pricing";
+import { saveModelPricingMutation } from "@/services/model_pricing.queries";
+import {
+  buildKeepPricesPayload,
+  buildMutePayload,
+  defaultTier,
+  exactModelPattern,
+} from "@/components/settings/unpricedModelPricing";
+import { formatCost, formatTokens } from "@/utils/llmUtils";
+import { AI_INSTRUMENTATION_DOCS_URL } from "@/plugins/traces/llmDataTrust.utils";
+import { isAxiosError } from "axios";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import ConfirmDialog from "@/components/ConfirmDialog.vue";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
+import OSelect from "@/lib/forms/Select/OSelect.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+
+const props = defineProps<{
+  models: UnpricedModel[];
+  /** Every model ingest marked in the window when the server listed only the top ones by tokens. */
+  truncatedOf?: number | null;
+  /** Cold read with nothing to show yet: the table skeleton. */
+  loading: boolean;
+  /** Any read in flight: the refresh button's spinner. */
+  fetching: boolean;
+  /** The last read failed: the load-error state, whose Retry emits `refresh`. */
+  error: boolean;
+  /** A read for the current stream succeeded, so zero rows means everything is priced. */
+  loaded: boolean;
+  lastRunAt: number;
+  streams: string[];
+  streamsLoaded: boolean;
+  stream: string;
+  /** The window the list covers, for the toolbar badge. */
+  windowLabel: I18nText;
+}>();
+
+const emit = defineEmits<{
+  "update:stream": [stream: string];
+  refresh: [];
+}>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+const router = useRouter();
+
+const orgIdentifier = computed(() => store.state.selectedOrganization?.identifier || "");
+// The save invalidates the whole model-pricing scope, so the rows here and the
+// price list both refetch after Keep or Mute with no wiring of their own.
+const saveModelPricing = useMutation(() => saveModelPricingMutation(orgIdentifier.value));
+const pendingModel = ref("");
+
+const noStreams = computed(() => props.streamsLoaded && !props.streams.length);
+// Until the stream list and a read resolve there is nothing to judge, so the
+// skeleton holds instead of a premature "everything is priced".
+const showSkeleton = computed(
+  () => !props.error && !noStreams.value && (props.loading || !props.loaded),
+);
+
+const bannerText = computed(() =>
+  props.truncatedOf
+    ? t("modelPricing.unpriced.bannerTruncated", {
+        shown: props.models.length,
+        total: props.truncatedOf.toLocaleString(),
+      })
+    : t("modelPricing.unpriced.banner", { count: props.models.length }, props.models.length),
+);
+
+const columns: OTableColumnDef<UnpricedModel>[] = [
+  {
+    id: "model",
+    header: t("modelPricing.unpriced.colModel"),
+    accessorKey: "model",
+    sortable: true,
+    minSize: 180,
+    meta: { align: "left", flex: true },
+  },
+  {
+    id: "priced_as",
+    header: t("modelPricing.unpriced.colPricedAs"),
+    accessorFn: (row) => row.matched?.name ?? "",
+    sortable: true,
+    minSize: 180,
+    meta: { align: "left", flex: true },
+  },
+  {
+    id: "tokens",
+    header: t("modelPricing.unpriced.colTokens"),
+    accessorKey: "tokens",
+    sortable: true,
+    size: 100,
+    meta: { align: "right" },
+  },
+  {
+    id: "cost",
+    header: t("modelPricing.unpriced.colCost"),
+    accessorKey: "cost",
+    sortable: true,
+    size: 120,
+    meta: { align: "right" },
+  },
+  {
+    id: "actions",
+    header: t("modelPricing.unpriced.colActions"),
+    isAction: true,
+    pinned: "right",
+    // Fits "Create price" next to "Keep <model name> prices" for a typical model name.
+    size: 330,
+    meta: { align: "right", actionCount: 2 },
+  },
+];
+
+/** "research-agent, +4 more · 1,870 spans": who sends the model, and how often. */
+function seenBy(row: UnpricedModel): I18nText {
+  const spans = t("modelPricing.unpriced.spans", { count: row.spans.toLocaleString() }, row.spans);
+  if (!row.agents.length) return spans;
+  const hidden = row.agent_count - row.agents.length;
+  const names =
+    hidden > 0
+      ? [...row.agents, t("modelPricing.unpriced.moreAgents", { count: hidden.toLocaleString() })]
+      : row.agents;
+  return raw(`${names.join(", ")} · ${spans}`);
+}
+
+function perMillion(pricePerToken: number | undefined): string {
+  if (pricePerToken === undefined || !Number.isFinite(pricePerToken)) {
+    return t("modelPricing.unpriced.notPriced");
+  }
+  return `$${(pricePerToken * 1_000_000).toFixed(2)}`;
+}
+
+/** The input/output prices of the default tier the model is priced at today. */
+function matchedPrices(row: UnpricedModel): I18nText | "" {
+  const prices = row.matched ? defaultTier(row.matched.tiers)?.prices : undefined;
+  if (!prices || (!Number.isFinite(prices.input) && !Number.isFinite(prices.output))) return "";
+  return t("modelPricing.unpriced.defaultTierPrices", {
+    input: perMillion(prices.input),
+    output: perMillion(prices.output),
+  });
+}
+
+/** Spans without a model name group into one row, keyed apart from every named model. */
+function rowKey(row: UnpricedModel): string {
+  return row.model ?? "";
+}
+
+function createPrice(row: UnpricedModel) {
+  if (row.model === null) return;
+  router.push({
+    name: "modelPricingEditor",
+    query: {
+      org_identifier: orgIdentifier.value,
+      name: row.model,
+      match_pattern: exactModelPattern(row.model),
+      // The editor's Back and Save return here instead of to the price list, in the same window.
+      from: "gaps",
+      stream: props.stream,
+      start_time: router.currentRoute.value.query.start_time,
+      end_time: router.currentRoute.value.query.end_time,
+    },
+  });
+}
+
+/** Spans without a model name have nothing to price; the fix is in the instrumentation. */
+function openInstrumentationDocs() {
+  window.open(AI_INSTRUMENTATION_DOCS_URL, "_blank", "noopener,noreferrer");
+}
+
+function notifySaveError(e: unknown) {
+  // 403s already raise the global no-access banner.
+  if (isAxiosError(e) && e.response?.status === 403) return;
+  const msg =
+    (isAxiosError(e) && e.response?.data?.message) ||
+    (e instanceof Error && e.message) ||
+    t("modelPricing.errUnknown");
+  toast({
+    variant: "error",
+    message: t("toastMessages.settings.message", {
+      prefix: t("modelPricing.unpriced.errSave"),
+      message: msg,
+    }),
+    timeout: 5000,
+  });
+}
+
+async function keepPrices(row: UnpricedModel) {
+  const model = row.model;
+  if (!row.matched || model === null) return;
+  pendingModel.value = model;
+  try {
+    await saveModelPricing.mutateAsync({ data: buildKeepPricesPayload(model, row.matched) });
+    toast({
+      variant: "success",
+      message: t("modelPricing.unpriced.keptNotif", { model, name: row.matched.name }),
+    });
+  } catch (e) {
+    notifySaveError(e);
+  } finally {
+    pendingModel.value = "";
+  }
+}
+
+const muteDialog = ref<{ show: boolean; model: string; message: I18nText }>({
+  show: false,
+  model: "",
+  message: raw(""),
+});
+
+function confirmMute(row: UnpricedModel) {
+  const model = row.model;
+  if (model === null) return;
+  muteDialog.value = {
+    show: true,
+    model,
+    message: t("modelPricing.unpriced.muteConfirmMessage", {
+      model,
+      name: buildMutePayload(model).name,
+    }),
+  };
+}
+
+async function mute() {
+  const model = muteDialog.value.model;
+  muteDialog.value.show = false;
+  pendingModel.value = model;
+  try {
+    await saveModelPricing.mutateAsync({ data: buildMutePayload(model) });
+    toast({ variant: "success", message: t("modelPricing.unpriced.mutedNotif", { model }) });
+  } catch (e) {
+    notifySaveError(e);
+  } finally {
+    pendingModel.value = "";
+  }
+}
+</script>
diff --git a/web/src/components/settings/index.spec.ts b/web/src/components/settings/index.spec.ts
index 096080f659..58cd6d436a 100644
--- a/web/src/components/settings/index.spec.ts
+++ b/web/src/components/settings/index.spec.ts
@@ -15,9 +15,11 @@
 
 import { mount } from "@vue/test-utils";
 import { describe, expect, it, beforeEach, vi, afterEach } from "vitest";
+import { nextTick, reactive } from "vue";
 import SettingsIndex from "./index.vue";
 import i18n from "@/locales";
-import { createRouter, createWebHistory } from "vue-router";
+import { createMemoryHistory, createRouter, createWebHistory } from "vue-router";
+import awsConfig from "@/aws-exports";
 
 // Mock external dependencies
 vi.mock("@/aws-exports", () => ({
@@ -600,3 +602,88 @@ describe("SettingsIndex", () => {
     });
   });
 });
+
+// `/providers` exists only with online evaluations on, so the rail hides it and deep links disable.
+describe("SettingsIndex — LLM providers with online evaluations off", () => {
+  const LlmProvidersPage = { template: "<div data-test='llm-providers-page'></div>" };
+  // SettingsIndex is a route component; its own <router-view> renders the section.
+  const App = { template: "<router-view />" };
+
+  async function mountOnLlmProviders(onlineEvalsEnabled: boolean | undefined, version?: string) {
+    vi.mocked(awsConfig).isEnterprise = "true";
+    const store = {
+      state: reactive({
+        theme: "light",
+        selectedOrganization: { identifier: "test-org" },
+        organizationData: { organizationSettings: { org_storage_enabled: false } },
+        zoConfig: {
+          ...(version === undefined ? {} : { version }),
+          ...(onlineEvalsEnabled === undefined ? {} : { online_evals_enabled: onlineEvalsEnabled }),
+        } as Record<string, unknown>,
+      }),
+    };
+    const settingsRouter = createRouter({
+      history: createMemoryHistory(),
+      routes: [
+        {
+          path: "/settings",
+          component: SettingsIndex,
+          children: [
+            { path: "general", name: "general", component: { template: "<div />" } },
+            {
+              path: "llm_providers",
+              name: "llmProviders",
+              component: LlmProvidersPage,
+              meta: { requiresOnlineEvals: true },
+            },
+          ],
+        },
+      ],
+    });
+    await settingsRouter.push("/settings/llm_providers");
+    await settingsRouter.isReady();
+    const wrapper = mount(App, {
+      global: {
+        plugins: [i18n, settingsRouter],
+        provide: { store },
+        stubs: {
+          OPageLayout: { template: "<div><slot name='sidebar' /><slot /></div>" },
+          SectionRail: { template: "<div />", props: ["groups", "activeKey", "title"] },
+          OEmptyState: { template: "<div />", props: ["size", "icon", "title", "description"] },
+        },
+      },
+    });
+    const llmProvidersItemVisible = () =>
+      (
+        wrapper.findComponent(SettingsIndex).vm.sectionGroups as Array<{
+          items: Array<{ key: string; visible?: boolean }>;
+        }>
+      )
+        .flatMap((g) => g.items)
+        .find((i) => i.key === "llm_providers")?.visible;
+    return { wrapper, store, llmProvidersItemVisible };
+  }
+
+  it("hides the rail entry and renders the disabled state on a deep link when the flag is false", async () => {
+    const { wrapper, llmProvidersItemVisible } = await mountOnLlmProviders(false, "v1");
+    expect(llmProvidersItemVisible()).toBe(false);
+    expect(wrapper.find('[data-test="online-evals-disabled"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="llm-providers-page"]').exists()).toBe(false);
+  });
+
+  it("lists the entry and renders the page when the flag is true", async () => {
+    const { wrapper, llmProvidersItemVisible } = await mountOnLlmProviders(true, "v1");
+    expect(llmProvidersItemVisible()).toBe(true);
+    expect(wrapper.find('[data-test="llm-providers-page"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="online-evals-disabled"]').exists()).toBe(false);
+  });
+
+  it("keeps the page while /config is in flight, then switches once it reports evaluations off", async () => {
+    const { wrapper, store } = await mountOnLlmProviders(undefined);
+    expect(wrapper.find('[data-test="llm-providers-page"]').exists()).toBe(true);
+    store.state.zoConfig = { version: "v1", online_evals_enabled: false };
+    await nextTick();
+    expect(wrapper.find('[data-test="online-evals-disabled"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="llm-providers-page"]').exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/settings/index.vue b/web/src/components/settings/index.vue
index 30d230951e..fe66bfec39 100644
--- a/web/src/components/settings/index.vue
+++ b/web/src/components/settings/index.vue
@@ -26,9 +26,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       />
     </template>
 
+    <!-- A section whose API needs online evaluations, on a server with them off. -->
+    <OnlineEvalsDisabled v-if="onlineEvalsRouteOff" />
     <!-- Form-style sections (general, org params, license, domain): a section
          header above a centered reading column. -->
-    <div v-if="isConstrainedSection" class="flex h-full min-h-0 flex-col">
+    <div v-else-if="isConstrainedSection" class="flex h-full min-h-0 flex-col">
       <OPageHeader
         :title="raw(activeSectionItem?.label || '')"
         :title-data-test="`settings-${activeSectionItem?.key}-page-title`"
@@ -71,6 +73,8 @@ import useIsMetaOrg from "@/composables/useIsMetaOrg";
 import { getImageURL } from "@/utils/zincutils";
 import { checkFeatureAccess, buildFeatureGateContext } from "@/utils/enterpriseFeatures";
 import { isSlackSettingsVisible, readSlackOrgConfig } from "@/utils/slackSettings";
+import { useOnlineEvalsRouteOff } from "@/composables/shared/useOnlineEvalsGate";
+import OnlineEvalsDisabled from "@/components/OnlineEvalsDisabled.vue";
 
 export default defineComponent({
   name: "AppSettings",
@@ -79,6 +83,7 @@ export default defineComponent({
     ConstrainedPage,
     OPageLayout,
     SectionRail,
+    OnlineEvalsDisabled,
   },
   setup() {
     const { t } = useI18nTyped();
@@ -105,6 +110,7 @@ export default defineComponent({
       alertTemplates: "templates",
       modelPricing: "model_pricing",
       modelPricingEditor: "model_pricing",
+      modelPricingGaps: "model_pricing",
       llmProviders: "llm_providers",
       storageSettings: "storageSettings",
       cipherKeys: "cipher-keys",
@@ -138,6 +144,7 @@ export default defineComponent({
     const isConstrainedSection = computed(() => CONSTRAINED_SECTIONS.has(activeSection.value));
     // Card-and-table sections use the row width, like Telephony and the destination lists.
     const FULL_WIDTH_SECTIONS = new Set(["password_policy", "slack"]);
+    const onlineEvalsRouteOff = useOnlineEvalsRouteOff();
 
     const slackVisible = computed(() => {
       const edition = buildFeatureGateContext(store.state.zoConfig);
@@ -549,6 +556,7 @@ export default defineComponent({
       activeSection,
       isConstrainedSection,
       FULL_WIDTH_SECTIONS,
+      onlineEvalsRouteOff,
       activeSectionItem,
       sectionGroups,
       handleSettingsRouting,
diff --git a/web/src/components/settings/unpricedModelPricing.spec.ts b/web/src/components/settings/unpricedModelPricing.spec.ts
new file mode 100644
index 0000000000..1f51ad3da5
--- /dev/null
+++ b/web/src/components/settings/unpricedModelPricing.spec.ts
@@ -0,0 +1,113 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import type { PricingMatch } from "@/services/model_pricing";
+import {
+  buildKeepPricesPayload,
+  buildMutePayload,
+  defaultTier,
+  exactModelPattern,
+} from "./unpricedModelPricing";
+
+describe("exactModelPattern", () => {
+  it("anchors the name and escapes regex metacharacters", () => {
+    expect(exactModelPattern("gpt-5.4-mini")).toBe("^gpt-5\\.4-mini$");
+    expect(exactModelPattern("acme-internal-llm")).toBe("^acme-internal-llm$");
+  });
+
+  it("matches only the model it names, whatever characters it holds", () => {
+    const names = ["gpt-5.4-mini", "a+b(c)[d]{1}|e*f?^$\\g", "models/gemini-2.5-pro:latest"];
+    for (const name of names) {
+      const re = new RegExp(exactModelPattern(name));
+      expect(re.test(name)).toBe(true);
+      expect(re.test(`${name}-2`)).toBe(false);
+      expect(re.test(`x${name}`)).toBe(false);
+    }
+    // An unescaped dot would also match this sibling.
+    expect(new RegExp(exactModelPattern("gpt-5.4-mini")).test("gpt-5x4-mini")).toBe(false);
+  });
+});
+
+const gpt54: PricingMatch = {
+  name: "GPT-5.4",
+  match_pattern: "^gpt-5\\.4",
+  source: "built_in",
+  tiers: [
+    {
+      name: "Long context",
+      condition: { usage_key: "input", operator: "gt", value: 200000 },
+      prices: { input: 5e-6, output: 2.25e-5 },
+    },
+    { name: "Default", condition: null, prices: { input: 2.5e-6, output: 1.5e-5 } },
+  ],
+};
+
+describe("defaultTier", () => {
+  it("picks the unrestricted tier over a conditional first tier", () => {
+    expect(defaultTier(gpt54.tiers)?.name).toBe("Default");
+  });
+
+  it("falls back to the first tier when every tier is restricted", () => {
+    expect(defaultTier([gpt54.tiers[0]])?.name).toBe("Long context");
+  });
+});
+
+describe("buildKeepPricesPayload", () => {
+  it("prices the model exactly with a copy of the tiers it matches today", () => {
+    const payload = buildKeepPricesPayload("gpt-5.4-mini", gpt54);
+    expect(payload).toMatchObject({
+      name: "gpt-5.4-mini",
+      match_pattern: "^gpt-5\\.4-mini$",
+      enabled: true,
+      tiers: gpt54.tiers,
+    });
+    expect(payload.description).toContain("GPT-5.4");
+  });
+
+  it("copies the tiers, so editing the new price leaves the source untouched", () => {
+    const payload = buildKeepPricesPayload("gpt-5.4-mini", gpt54);
+    payload.tiers[1].prices.input = 1;
+    expect(gpt54.tiers[1].prices.input).toBe(2.5e-6);
+  });
+
+  it("leaves a side the matched tier does not price unset instead of $0", () => {
+    const oneSided = {
+      ...gpt54,
+      tiers: [
+        {
+          name: "Default",
+          condition: null,
+          prices: { input: 2.5e-6, output: null as unknown as number },
+        },
+      ],
+    };
+    const [tier] = buildKeepPricesPayload("gpt-5.4-mini", oneSided).tiers;
+    expect(tier.prices).toEqual({ input: 2.5e-6 });
+    expect(tier.prices).not.toHaveProperty("output");
+  });
+});
+
+describe("buildMutePayload", () => {
+  it("prices the model exactly at zero under a muted name", () => {
+    expect(buildMutePayload("acme-internal-llm")).toEqual({
+      name: "acme-internal-llm (muted)",
+      match_pattern: "^acme-internal-llm$",
+      enabled: true,
+      tiers: [{ name: "Default", condition: null, prices: { input: 0, output: 0 } }],
+      description: "Muted on Pricing gaps: this model is treated as free.",
+    });
+  });
+});
diff --git a/web/src/components/settings/unpricedModelPricing.ts b/web/src/components/settings/unpricedModelPricing.ts
new file mode 100644
index 0000000000..c73f03296b
--- /dev/null
+++ b/web/src/components/settings/unpricedModelPricing.ts
@@ -0,0 +1,57 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { NewPricingDefinition, PricingMatch, PricingTier } from "@/services/model_pricing";
+
+/** A pattern that matches exactly `model` and nothing else, e.g. `^gpt-5\.4-mini$`. */
+export function exactModelPattern(model: string): string {
+  return `^${model.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}$`;
+}
+
+/** Mirrors the backend: the tier with no usage condition, UTC window or attribute rule, else the first. */
+export function defaultTier(tiers: PricingTier[]): PricingTier | undefined {
+  return tiers.find((t) => !t.condition && !t.utc_windows?.length && !t.rules?.length) ?? tiers[0];
+}
+
+// The descriptions below are persisted with the definition, so they stay English
+// for every locale, like the editor's "Default" tier name.
+
+/** An exact org price for `model` that copies the prices it matches approximately today; a side the match leaves unpriced stays unset, never $0. */
+export function buildKeepPricesPayload(model: string, matched: PricingMatch): NewPricingDefinition {
+  return {
+    name: model,
+    match_pattern: exactModelPattern(model),
+    enabled: true,
+    // JSON round-trip, not structuredClone: query data may be a Vue proxy, which structuredClone rejects.
+    tiers: (JSON.parse(JSON.stringify(matched.tiers)) as PricingTier[]).map((tier) => ({
+      ...tier,
+      prices: Object.fromEntries(
+        Object.entries(tier.prices ?? {}).filter(([, price]) => Number.isFinite(price)),
+      ),
+    })),
+    description: `Prices copied from "${matched.name}" on Pricing gaps.`,
+  };
+}
+
+/** An exact org price of $0 for new spans; historical gaps keep their recorded cost. */
+export function buildMutePayload(model: string): NewPricingDefinition {
+  return {
+    name: `${model} (muted)`,
+    match_pattern: exactModelPattern(model),
+    enabled: true,
+    tiers: [{ name: "Default", condition: null, prices: { input: 0, output: 0 } }],
+    description: "Muted on Pricing gaps: this model is treated as free.",
+  };
+}
diff --git a/web/src/components/traces/ChartZoomControls.spec.ts b/web/src/components/traces/ChartZoomControls.spec.ts
new file mode 100644
index 0000000000..c4b644f7c0
--- /dev/null
+++ b/web/src/components/traces/ChartZoomControls.spec.ts
@@ -0,0 +1,44 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import ChartZoomControls from "@/components/traces/ChartZoomControls.vue";
+
+const mountControls = () =>
+  mount(ChartZoomControls, {
+    props: { dataTestPrefix: "trace-graph" },
+    global: { plugins: [i18n] },
+  });
+
+describe("ChartZoomControls", () => {
+  it("prefixes every data-test with dataTestPrefix", () => {
+    const wrapper = mountControls();
+    for (const suffix of ["zoom-controls", "zoom-in", "zoom-out", "fit-screen"]) {
+      expect(wrapper.find(`[data-test="trace-graph-${suffix}"]`).exists()).toBe(true);
+    }
+  });
+
+  it.each([
+    ["zoom-in", "zoom-in"],
+    ["zoom-out", "zoom-out"],
+    ["fit-screen", "fit"],
+  ])("clicking %s emits %s", async (suffix, event) => {
+    const wrapper = mountControls();
+    await wrapper.find(`[data-test="trace-graph-${suffix}"]`).trigger("click");
+    expect(wrapper.emitted(event)).toHaveLength(1);
+  });
+});
diff --git a/web/src/components/traces/ChartZoomControls.vue b/web/src/components/traces/ChartZoomControls.vue
new file mode 100644
index 0000000000..35759c4f19
--- /dev/null
+++ b/web/src/components/traces/ChartZoomControls.vue
@@ -0,0 +1,72 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div
+    class="rounded-default border-border-default bg-surface-panel absolute right-3 bottom-3 z-10 flex flex-col overflow-hidden border"
+    :data-test="`${dataTestPrefix}-zoom-controls`"
+  >
+    <OButton
+      variant="ghost"
+      size="icon-sm"
+      icon-left="add"
+      class="rounded-none"
+      :data-test="`${dataTestPrefix}-zoom-in`"
+      @click="emit('zoom-in')"
+    >
+      <OTooltip side="left" :content="t('traces.serviceGraph.zoomIn')" />
+    </OButton>
+    <OSeparator />
+    <OButton
+      variant="ghost"
+      size="icon-sm"
+      icon-left="remove"
+      class="rounded-none"
+      :data-test="`${dataTestPrefix}-zoom-out`"
+      @click="emit('zoom-out')"
+    >
+      <OTooltip side="left" :content="t('traces.serviceGraph.zoomOut')" />
+    </OButton>
+    <OSeparator />
+    <OButton
+      variant="ghost"
+      size="icon-sm"
+      icon-left="fullscreen"
+      class="rounded-none"
+      :data-test="`${dataTestPrefix}-fit-screen`"
+      @click="emit('fit')"
+    >
+      <OTooltip side="left" :content="t('traces.serviceGraph.fitToScreen')" />
+    </OButton>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useI18nTyped } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OSeparator from "@/lib/core/Separator/OSeparator.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+
+defineProps<{ dataTestPrefix: string }>();
+
+const emit = defineEmits<{
+  "zoom-in": [];
+  "zoom-out": [];
+  fit: [];
+}>();
+
+const { t } = useI18nTyped();
+</script>
diff --git a/web/src/components/traces/FlameGraphView.spec.ts b/web/src/components/traces/FlameGraphView.spec.ts
index 0cce033f4e..40e23205be 100644
--- a/web/src/components/traces/FlameGraphView.spec.ts
+++ b/web/src/components/traces/FlameGraphView.spec.ts
@@ -1617,6 +1617,259 @@ describe("FlameGraphView span event markers", () => {
   });
 });
 
+describe("FlameGraphView zoom", () => {
+  const span = (span_id: string, startOffsetMs: number, durationMs: number) =>
+    createMockSpan({ span_id, startOffsetMs, durationMs, events: [] });
+
+  beforeEach(() => {
+    config.global.stubs = {
+      ChartRenderer: ChartRendererStub,
+      TraceDetailsSidebar: TraceDetailsSidebarStub,
+    };
+  });
+
+  afterEach(() => {
+    config.global.stubs = {};
+  });
+
+  const mountView = () =>
+    mount(FlameGraphView, {
+      props: {
+        spans: [span("left", 0, 5), span("edge", 5, 10), span("middle", 40, 20)],
+        traceDuration: 100,
+        selectedSpanId: null,
+      },
+    });
+
+  const xRange = (wrapper: any) => {
+    const { min, max } = wrapper.vm.chartOptions.xAxis;
+    return [min, max];
+  };
+
+  // Mirrors ECharts' value-to-pixel mapping for a 480px plot starting at x = 10.
+  const renderAt = (wrapper: any, dataIndex: number) => {
+    const [min, max] = xRange(wrapper);
+    const coordSys = { x: 10, y: 10, width: 480, height: 100 };
+    const item = wrapper.vm.chartOptions.series[0].data[dataIndex];
+    const api = {
+      value: (i: number) => item.value[i],
+      coord: ([xPct]: number[]) => [coordSys.x + ((xPct - min) / (max - min)) * coordSys.width, 0],
+      style: (s: any) => s,
+    };
+    return wrapper.vm.chartOptions.series[0].renderItem({ dataIndex, coordSys }, api);
+  };
+
+  it("shows the zoom controls when there is data", () => {
+    const wrapper = mountView();
+    expect(wrapper.find('[data-test="flame-graph-zoom-controls"]').exists()).toBe(true);
+  });
+
+  it("hides the zoom controls without data", () => {
+    const wrapper = mount(FlameGraphView, {
+      props: { spans: [], traceDuration: 0, selectedSpanId: null },
+    });
+    expect(wrapper.find('[data-test="flame-graph-zoom-controls"]').exists()).toBe(false);
+  });
+
+  it("zoom in narrows the x range around its centre and zoom out widens it", async () => {
+    const wrapper = mountView();
+    expect(xRange(wrapper)).toEqual([0, 100]);
+
+    await wrapper.find('[data-test="flame-graph-zoom-in"]').trigger("click");
+    expect(xRange(wrapper)).toEqual([10, 90]);
+
+    await wrapper.find('[data-test="flame-graph-zoom-out"]').trigger("click");
+    const [min, max] = xRange(wrapper);
+    expect(min).toBeCloseTo(0);
+    expect(max).toBeCloseTo(100);
+  });
+
+  it("stops zooming in at a 1% window", async () => {
+    const wrapper = mountView();
+    for (let i = 0; i < 40; i++) {
+      await wrapper.find('[data-test="flame-graph-zoom-in"]').trigger("click");
+    }
+    const [min, max] = xRange(wrapper);
+    expect(max - min).toBeCloseTo(1);
+  });
+
+  it("fit resets the x range to the whole trace", async () => {
+    const wrapper = mountView();
+    await wrapper.find('[data-test="flame-graph-zoom-in"]').trigger("click");
+    await wrapper.find('[data-test="flame-graph-fit-screen"]').trigger("click");
+    expect(xRange(wrapper)).toEqual([0, 100]);
+  });
+
+  it("labels the ruler with the visible window", async () => {
+    const wrapper = mountView();
+    await wrapper.find('[data-test="flame-graph-zoom-in"]').trigger("click");
+    const labels = wrapper.vm.timelineTicks.map((tick: any) => tick.label);
+    expect(labels[0]).toBe("10.00ms");
+    expect(labels[4]).toBe("90.00ms");
+  });
+
+  it("maps the cursor onto the visible window", async () => {
+    const wrapper = mountView();
+    await wrapper.find('[data-test="flame-graph-zoom-in"]').trigger("click");
+    // offsetX 10 is the plot's left edge, so it reads the window start.
+    wrapper.vm.handleChartMouseMove({
+      clientX: 10,
+      currentTarget: { getBoundingClientRect: () => ({ left: 0, width: 500 }) },
+    });
+    expect(wrapper.vm.cursorTimeLabel).toBe("10.00ms");
+  });
+
+  it("hides the time cursor while the pointer is over the zoom controls", async () => {
+    const wrapper = mountView();
+    const chartWrapper = wrapper.find('[data-test="flame-graph-view-chart-wrapper"]');
+    const controls = wrapper.find('[data-test="flame-graph-zoom-controls"]');
+    const rect = { left: 0, top: 0, width: 500, height: 300, right: 500, bottom: 300 };
+    chartWrapper.element.getBoundingClientRect = () => rect as DOMRect;
+
+    await chartWrapper.trigger("mousemove", { clientX: 100 });
+    expect(wrapper.vm.cursorVisible).toBe(true);
+
+    await controls.trigger("mouseenter");
+    expect(wrapper.vm.cursorVisible).toBe(false);
+    await controls.trigger("mousemove", { clientX: 480 });
+    expect(wrapper.vm.cursorVisible).toBe(false);
+
+    await chartWrapper.trigger("mousemove", { clientX: 100 });
+    expect(wrapper.vm.cursorVisible).toBe(true);
+  });
+
+  it("skips blocks outside the window and cuts blocks at its edge", async () => {
+    const wrapper = mountView();
+    await wrapper.find('[data-test="flame-graph-zoom-in"]').trigger("click");
+
+    expect(renderAt(wrapper, 0)).toBeNull();
+
+    const edge = renderAt(wrapper, 1);
+    expect(edge.shape.x).toBe(10);
+    expect(edge.shape.width).toBeCloseTo((5 / 80) * 480);
+
+    const middle = renderAt(wrapper, 2);
+    expect(middle.shape.x).toBeCloseTo(10 + (30 / 80) * 480);
+    expect(middle.shape.width).toBeCloseTo((20 / 80) * 480);
+  });
+
+  const zoomInTimes = async (wrapper: any, times: number) => {
+    for (let i = 0; i < times; i++) {
+      await wrapper.find('[data-test="flame-graph-zoom-in"]').trigger("click");
+    }
+  };
+
+  // A 500px scroll area leaves a 480px plot between the 10px grid insets.
+  const scrollArea = (wrapper: any) => {
+    const area = wrapper.find('[data-test="flame-graph-view-chart-scroll"]');
+    Object.defineProperty(area.element, "clientWidth", { configurable: true, value: 500 });
+    return area;
+  };
+
+  it("pans the zoomed window when the chart is dragged, and not on a click-sized move", async () => {
+    const wrapper = mountView();
+    await zoomInTimes(wrapper, 1);
+    const area = scrollArea(wrapper);
+
+    await area.trigger("mousedown", { button: 0, clientX: 200 });
+    window.dispatchEvent(new MouseEvent("mousemove", { clientX: 197 }));
+    expect(xRange(wrapper)).toEqual([10, 90]);
+
+    // Dragging left by 48px moves the window right by 48 / 480 of its 80% width.
+    window.dispatchEvent(new MouseEvent("mousemove", { clientX: 152 }));
+    expect(xRange(wrapper)[0]).toBeCloseTo(18);
+    expect(xRange(wrapper)[1]).toBeCloseTo(98);
+
+    window.dispatchEvent(new MouseEvent("mousemove", { clientX: 0 }));
+    expect(xRange(wrapper)).toEqual([20, 100]);
+
+    window.dispatchEvent(new MouseEvent("mouseup"));
+    window.dispatchEvent(new MouseEvent("mousemove", { clientX: 400 }));
+    expect(xRange(wrapper)).toEqual([20, 100]);
+  });
+
+  it("pans on horizontal and shift wheel but leaves a vertical wheel to scroll", async () => {
+    const wrapper = mountView();
+    await zoomInTimes(wrapper, 1);
+    const area = scrollArea(wrapper);
+
+    const vertical = new WheelEvent("wheel", { deltaY: 48, cancelable: true });
+    area.element.dispatchEvent(vertical);
+    expect(vertical.defaultPrevented).toBe(false);
+    expect(xRange(wrapper)).toEqual([10, 90]);
+
+    const horizontal = new WheelEvent("wheel", { deltaX: 48, cancelable: true });
+    area.element.dispatchEvent(horizontal);
+    expect(horizontal.defaultPrevented).toBe(true);
+    expect(xRange(wrapper)[0]).toBeCloseTo(18);
+
+    const shifted = new WheelEvent("wheel", { deltaY: -48, shiftKey: true, cancelable: true });
+    area.element.dispatchEvent(shifted);
+    expect(shifted.defaultPrevented).toBe(true);
+    expect(xRange(wrapper)[0]).toBeCloseTo(10);
+  });
+
+  it("pans to a span selected from outside the chart when it lies outside the window", async () => {
+    const wrapper = mountView();
+    await zoomInTimes(wrapper, 10);
+    const [min, max] = xRange(wrapper);
+    const width = max - min;
+    expect(min).toBeGreaterThan(5);
+
+    await wrapper.setProps({ selectedSpanId: "left" });
+    expect(xRange(wrapper)[0]).toBeCloseTo(0);
+    expect(xRange(wrapper)[1]).toBeCloseTo(width);
+
+    // "middle" (40-60%) is wider than the window, so the window starts at the span.
+    await wrapper.setProps({ selectedSpanId: "middle" });
+    expect(xRange(wrapper)[0]).toBeCloseTo(40);
+
+    // "edge" (5-15%) no longer overlaps; a span already in view does not move the window.
+    await wrapper.setProps({ selectedSpanId: "edge" });
+    const afterEdge = xRange(wrapper);
+    expect(afterEdge[0]).toBeLessThan(15);
+    await wrapper.setProps({ selectedSpanId: "left" });
+    expect(xRange(wrapper)).toEqual(afterEdge);
+  });
+
+  it("resets to the whole trace when the spans change", async () => {
+    const wrapper = mountView();
+    await zoomInTimes(wrapper, 2);
+    await wrapper.setProps({ spans: [span("other", 0, 50)] });
+    expect(xRange(wrapper)).toEqual([0, 100]);
+
+    await zoomInTimes(wrapper, 2);
+    await wrapper.setProps({ traceDuration: 200 });
+    expect(xRange(wrapper)).toEqual([0, 100]);
+  });
+
+  it("keeps the event flag of a narrow block cut at the window's left edge", async () => {
+    const startNs = 1752490492843000000;
+    const wrapper = mount(FlameGraphView, {
+      props: {
+        spans: [
+          createMockSpan({
+            span_id: "cut",
+            start_time: startNs,
+            startOffsetMs: 8,
+            durationMs: 3,
+            events: [{ name: "a", _timestamp: startNs }],
+          }),
+        ],
+        traceDuration: 100,
+        selectedSpanId: null,
+      },
+    });
+    await zoomInTimes(wrapper, 1);
+
+    const result = renderAt(wrapper, 0);
+    expect(result.type).toBe("group");
+    const [block, flag] = result.children;
+    expect(block.shape.x).toBe(10);
+    expect(flag.shape.x).toBe(10);
+  });
+});
+
 describe("FlameGraphView severity colours", () => {
   // renderItem returns raw ECharts shapes, which cannot take Tailwind classes,
   // so this surface resolves token values at draw time via getComputedStyle.
diff --git a/web/src/components/traces/FlameGraphView.vue b/web/src/components/traces/FlameGraphView.vue
index bd5e008cb0..021ea39943 100644
--- a/web/src/components/traces/FlameGraphView.vue
+++ b/web/src/components/traces/FlameGraphView.vue
@@ -27,7 +27,7 @@
       <!-- Ruler + chart: outer flex column, mousemove for cursor badge on ruler -->
       <div
         data-test="flame-graph-view-chart-wrapper"
-        class="flex min-h-0 flex-1 flex-col"
+        class="relative flex min-h-0 flex-1 flex-col"
         @mousemove="handleChartMouseMove"
         @mouseleave="cursorVisible = false"
       >
@@ -79,7 +79,13 @@
         </div>
 
         <!-- Scrollable chart area: grows to fit all rows, scrolls vertically -->
-        <div ref="chartScrollRef" class="relative min-h-0 flex-1 overflow-x-hidden overflow-y-auto">
+        <div
+          ref="chartScrollRef"
+          data-test="flame-graph-view-chart-scroll"
+          class="relative min-h-0 flex-1 overflow-x-hidden overflow-y-auto"
+          @mousedown="startPan"
+          @wheel="handleWheel"
+        >
           <div
             :style="{
               height: chartContentHeight + 'px',
@@ -102,6 +108,16 @@
             ></div>
           </div>
         </div>
+
+        <ChartZoomControls
+          v-if="hasData"
+          data-test-prefix="flame-graph"
+          @mouseenter="cursorVisible = false"
+          @mousemove.stop
+          @zoom-in="zoomIn"
+          @zoom-out="zoomOut"
+          @fit="fitToScreen"
+        />
       </div>
 
       <!-- Empty State -->
@@ -155,7 +171,7 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed, defineAsyncComponent, nextTick, watch } from "vue";
+import { ref, computed, defineAsyncComponent, nextTick, watch, onBeforeUnmount } from "vue";
 import { useStore } from "vuex";
 import { useI18nTyped } from "@/types/i18n";
 import useResizer from "@/composables/useResizer";
@@ -165,6 +181,13 @@ import { maxOf } from "@/plugins/traces/threadView.utils";
 import { getOrSetServiceColor } from "@/utils/traces/serviceColorRegistry";
 import { getContrastTextColor } from "@/utils/traces/traceColors";
 import { escapeHtml } from "@/utils/html";
+import ChartZoomControls from "@/components/traces/ChartZoomControls.vue";
+import {
+  CHART_ZOOM_STEP,
+  panRange,
+  zoomRange,
+  type ZoomRange,
+} from "@/composables/traces/useChartZoom";
 import {
   normalizeSpanEvents,
   toSpanEventMarkers,
@@ -248,6 +271,11 @@ const { value: bottomPanelHeight, onMouseDown: startResize } = useResizer({
 const chartScrollRef = ref<HTMLElement | null>(null);
 
 // Constants
+const FULL_RANGE: ZoomRange = { min: 0, max: 100 };
+const MIN_VISIBLE_SPAN = 1;
+// Same distance ECharts allows before a press stops counting as a click.
+const DRAG_THRESHOLD_PX = 4;
+const MIN_SPAN_WIDTH_PERCENT = 0.1;
 const BLOCK_PADDING = 2;
 const MIN_BLOCK_WIDTH = 1;
 const BLOCK_HEIGHT = 24;
@@ -371,6 +399,8 @@ defineExpose({ buildSpanEventMarkers, severityColor });
 const GRID_LEFT = 10;
 const GRID_RIGHT = 10;
 
+const viewRange = ref<ZoomRange>({ ...FULL_RANGE });
+
 // Computed
 const totalSpans = computed(() => props.spans.length);
 
@@ -389,12 +419,99 @@ const timelineTicks = computed(() => {
   const duration = props.traceDuration || 0;
   const totalPad = GRID_LEFT + GRID_RIGHT;
   return [0, 0.25, 0.5, 0.75, 1].map((fraction) => ({
-    label: formatDuration(duration * fraction),
+    label: formatDuration(duration * viewFractionToTrace(fraction)),
     left: `calc(${GRID_LEFT}px + ${fraction} * (100% - ${totalPad}px))`,
     transform: fraction === 1 ? "translateX(-100%) translateY(-50%)" : "translateY(-50%)",
   }));
 });
 
+function viewFractionToTrace(fraction: number): number {
+  const { min, max } = viewRange.value;
+  return (min + fraction * (max - min)) / 100;
+}
+
+const zoomIn = () => {
+  viewRange.value = zoomRange(viewRange.value, CHART_ZOOM_STEP, FULL_RANGE, MIN_VISIBLE_SPAN);
+};
+
+const zoomOut = () => {
+  viewRange.value = zoomRange(viewRange.value, 1 / CHART_ZOOM_STEP, FULL_RANGE, MIN_VISIBLE_SPAN);
+};
+
+const fitToScreen = () => {
+  viewRange.value = { ...FULL_RANGE };
+};
+
+const isZoomed = () => viewRange.value.max - viewRange.value.min < FULL_RANGE.max - FULL_RANGE.min;
+
+function pixelsToRange(px: number): number {
+  const plotWidth = (chartScrollRef.value?.clientWidth ?? 0) - GRID_LEFT - GRID_RIGHT;
+  if (plotWidth <= 0) return 0;
+  return (px / plotWidth) * (viewRange.value.max - viewRange.value.min);
+}
+
+let panStart: { clientX: number; range: ZoomRange; dragging: boolean } | null = null;
+
+const onPanMove = (event: MouseEvent) => {
+  if (!panStart) return;
+  const dx = event.clientX - panStart.clientX;
+  if (!panStart.dragging && Math.abs(dx) <= DRAG_THRESHOLD_PX) return;
+  panStart.dragging = true;
+  viewRange.value = panRange(panStart.range, -pixelsToRange(dx), FULL_RANGE);
+};
+
+const stopPan = () => {
+  panStart = null;
+  window.removeEventListener("mousemove", onPanMove);
+  window.removeEventListener("mouseup", stopPan);
+};
+
+const startPan = (event: MouseEvent) => {
+  if (event.button !== 0 || !isZoomed()) return;
+  stopPan();
+  panStart = { clientX: event.clientX, range: { ...viewRange.value }, dragging: false };
+  window.addEventListener("mousemove", onPanMove);
+  window.addEventListener("mouseup", stopPan);
+};
+
+const handleWheel = (event: WheelEvent) => {
+  const horizontal = Math.abs(event.deltaX) > Math.abs(event.deltaY);
+  if (!isZoomed() || (!horizontal && !event.shiftKey)) return;
+  event.preventDefault();
+  const delta = horizontal ? event.deltaX : event.deltaY;
+  viewRange.value = panRange(viewRange.value, pixelsToRange(delta), FULL_RANGE);
+};
+
+const revealSpan = (spanId: string) => {
+  const span = props.spans.find((s) => s.span_id === spanId);
+  const duration = props.traceDuration;
+  if (!span || !duration) return;
+  const start = (span.startOffsetMs / duration) * 100;
+  const end = start + Math.max((span.durationMs / duration) * 100, MIN_SPAN_WIDTH_PERCENT);
+  const { min, max } = viewRange.value;
+  if (end > min && start < max) return;
+  const width = max - min;
+  const target = end - start < width ? (start + end) / 2 - width / 2 : start;
+  viewRange.value = panRange(viewRange.value, target - min, FULL_RANGE);
+};
+
+watch([() => props.spans, () => props.traceDuration], fitToScreen);
+
+onBeforeUnmount(stopPan);
+
+// Clips only at edges the zoom has cut; the unzoomed view keeps blocks that overhang the grid.
+function clipToVisibleRange(
+  x: number,
+  width: number,
+  coordSys?: { x: number; width: number },
+): { x: number; width: number } {
+  const { min, max } = viewRange.value;
+  const left = coordSys && min > FULL_RANGE.min ? Math.max(x, coordSys.x) : x;
+  const right =
+    coordSys && max < FULL_RANGE.max ? Math.min(x + width, coordSys.x + coordSys.width) : x + width;
+  return { x: left, width: right - left };
+}
+
 // Selected span lookup from spanMap
 const selectedSpan = computed(() => {
   if (!props.selectedSpanId) return null;
@@ -483,7 +600,7 @@ const flameGraphDataAndDepth = computed(() => {
 
     // Spans with durationPercent less than 0.1% are invisble in chart
     // Added min 0.1% durationPercent
-    if (durationPercent < 0.1) durationPercent = 0.1;
+    if (durationPercent < MIN_SPAN_WIDTH_PERCENT) durationPercent = MIN_SPAN_WIDTH_PERCENT;
 
     const visualRow = rowMap.get(span.span_id) ?? span.depth;
     const isSelected = span.span_id === props.selectedSpanId;
@@ -572,8 +689,8 @@ const chartOptions = computed(() => {
     },
     xAxis: {
       type: "value",
-      min: 0,
-      max: 100,
+      min: viewRange.value.min,
+      max: viewRange.value.max,
       show: false,
     },
     yAxis: {
@@ -594,9 +711,13 @@ const chartOptions = computed(() => {
           const point1 = api.coord([startX, 0]);
           const point2 = api.coord([startX + width, 0]);
 
-          const x = point1[0];
+          const fullX = point1[0];
           const y = ROW_ORIGIN_Y + depth * (BLOCK_HEIGHT + BLOCK_PADDING);
-          const rectWidth = point2[0] - point1[0];
+          const fullWidth = Math.max(point2[0] - point1[0], MIN_BLOCK_WIDTH);
+
+          // The series is not clipped (markers overhang the grid), so cut blocks at a zoomed-in edge by hand.
+          const { x, width: rectWidth } = clipToVisibleRange(fullX, fullWidth, params.coordSys);
+          if (rectWidth <= 0) return null;
 
           const blockWidth = Math.max(rectWidth, MIN_BLOCK_WIDTH);
           const span = data[params.dataIndex].spanData;
@@ -605,22 +726,27 @@ const chartOptions = computed(() => {
           // coordinate system and cannot drift from it. They are `silent` —
           // hover and click stay on the block, and per-event precision lives in
           // the sidebar mini-timeline.
-          const markerShapes = buildSpanEventMarkers(span, blockWidth).map((marker) => ({
-            type: "rect",
-            shape: {
-              x: x + (marker.isFlag ? 0 : (blockWidth * marker.left) / 100),
-              y: y - MARKER_OVERHANG_PX,
-              // 3px matches the DOM surfaces' `w-0.75` tick. The flag is wider
-              // so it stays distinguishable from a positioned marker.
-              width: marker.isFlag ? MARKER_FLAG_WIDTH_PX : MARKER_WIDTH_PX,
-              height: BLOCK_HEIGHT + 2 * MARKER_OVERHANG_PX,
-              r: 1,
-            },
-            style: {
-              fill: severityColor(marker.severity),
-            },
-            silent: true,
-          }));
+          const markerShapes = buildSpanEventMarkers(span, fullWidth)
+            .map((marker) => ({
+              marker,
+              markerX: marker.isFlag ? x : fullX + (fullWidth * marker.left) / 100,
+            }))
+            .filter(({ markerX }) => markerX >= x && markerX <= x + blockWidth)
+            .map(({ marker, markerX }) => ({
+              type: "rect",
+              shape: {
+                x: markerX,
+                y: y - MARKER_OVERHANG_PX,
+                // 3px matches the DOM surfaces' `w-0.75` tick; the wider flag stays distinct from a positioned marker.
+                width: marker.isFlag ? MARKER_FLAG_WIDTH_PX : MARKER_WIDTH_PX,
+                height: BLOCK_HEIGHT + 2 * MARKER_OVERHANG_PX,
+                r: 1,
+              },
+              style: {
+                fill: severityColor(marker.severity),
+              },
+              silent: true,
+            }));
 
           const spanRect = {
             type: "rect",
@@ -699,7 +825,7 @@ const handleChartMouseMove = (event: any) => {
   const fraction = Math.max(0, Math.min(1, (offsetX - GRID_LEFT) / gridWidth));
 
   cursorX.value = offsetX;
-  cursorTimeLabel.value = formatDuration(fraction * props.traceDuration);
+  cursorTimeLabel.value = formatDuration(viewFractionToTrace(fraction) * props.traceDuration);
   cursorVisible.value = true;
 };
 
@@ -738,7 +864,9 @@ watch(
   (newVal) => {
     if (!newVal) {
       sidebarVisible.value = false;
+      return;
     }
+    revealSpan(newVal);
   },
 );
 
diff --git a/web/src/components/workflows/WorkflowEditor.spec.ts b/web/src/components/workflows/WorkflowEditor.spec.ts
index 155fc1a1f2..f1892b6d6e 100644
--- a/web/src/components/workflows/WorkflowEditor.spec.ts
+++ b/web/src/components/workflows/WorkflowEditor.spec.ts
@@ -65,6 +65,7 @@ vi.mock("@/services/workflows", async (importOriginal) => {
       promoteWorkflow: vi.fn(),
       getWorkflowRun: vi.fn(),
       testWorkflow: vi.fn(),
+      getHttpTrigger: vi.fn(),
     },
   });
 });
@@ -78,7 +79,25 @@ const { stub } = vi.hoisted(() => ({
 vi.mock("@/services/product_analytics", () => ({ default: { track: vi.fn() } }));
 vi.mock("@/plugins/workflows/WorkflowCanvas.vue", () => stub("WorkflowCanvas"));
 vi.mock("./WorkflowNodeDrawer.vue", () => stub("WorkflowNodeDrawer"));
-vi.mock("./WorkflowTestDialog.vue", () => stub("WorkflowTestDialog"));
+vi.mock("./WorkflowTestDialog.vue", () =>
+  stub("WorkflowTestDialog", { props: ["seed", "payloadFrom", "seedRunAt"] }),
+);
+vi.mock("./WorkflowHttpEndpointPanel.vue", () =>
+  stub("WorkflowHttpEndpointPanel", {
+    props: [
+      "open",
+      "workflowId",
+      "workflowName",
+      "kind",
+      "isDraftOnly",
+      "workflowEnabled",
+      "context",
+      "beforeCreate",
+      "triggerNodeId",
+    ],
+    emits: ["update:open", "run-test"],
+  }),
+);
 vi.mock("./WorkflowLinkAlertsDialog.vue", () =>
   stub("WorkflowLinkAlertsDialog", {
     props: ["workflowId", "workflowName"],
@@ -87,7 +106,16 @@ vi.mock("./WorkflowLinkAlertsDialog.vue", () =>
 );
 vi.mock("@/components/flow/StepPickerDialog.vue", () =>
   stub("StepPickerDialog", {
-    props: ["items", "title", "searchPlaceholder", "noMatchText", "testPrefix"],
+    props: [
+      "items",
+      "title",
+      "searchPlaceholder",
+      "noMatchText",
+      "testPrefix",
+      "footnote",
+      "footnoteIcon",
+      "footnoteTestId",
+    ],
     emits: ["pick", "close"],
   }),
 );
@@ -104,6 +132,10 @@ import store from "@/test/unit/helpers/store";
 import WorkflowEditor from "./WorkflowEditor.vue";
 import workflowService from "@/services/workflows";
 import analytics from "@/services/product_analytics";
+import { queryClient } from "@/composables/query/queryClient";
+import { hoverAndWait } from "@/test/unit/helpers/workflowHttp";
+import { enabledTriggers } from "@/plugins/workflows/triggers";
+import { httpEditorState, resetHttpEditorState } from "@/plugins/workflows/httpEndpointUi";
 import useWorkflowCanvas, {
   workflowObj,
   hydrateWorkflow,
@@ -2020,3 +2052,199 @@ describe("WorkflowEditor", () => {
     });
   });
 });
+
+describe("WorkflowEditor HTTP endpoint", () => {
+  let wrapper: any = null;
+  const getHttpTrigger = (workflowService as any).getHttpTrigger;
+  const button = (w: any) => w.find('[data-test="workflow-editor-http-endpoint"]');
+  const chip = (w: any) => w.find('[data-test="workflow-editor-http-endpoint-chip"]');
+  // OTag renders a fragment, so its data-test sits on an inner element, not the component root.
+  const chipVariant = (w: any) =>
+    w
+      .findAllComponents({ name: "OTag" })
+      .find((c: any) => c.find('[data-test="workflow-editor-http-endpoint-chip"]').exists())
+      ?.props("variant");
+  const panel = (w: any) => w.findComponent({ name: "WorkflowHttpEndpointPanel" });
+  const endpoint = (enabled = true) => ({
+    configured: true,
+    enabled,
+    url: "https://o2/h",
+    credentials: [],
+    permissions: { edit: true, test: true, reveal: true },
+  });
+
+  const openSaved = async (overrides: any = {}) => {
+    hydrateWorkflow(savedGraph(overrides));
+    mockRouter.currentRoute.value = { query: { id: "wf-1" } };
+    wrapper = mountEditor();
+    await flushPromises();
+    return wrapper;
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    resetWorkflowData();
+    resetHttpEditorState();
+    queryClient.clear();
+    mockRouter.currentRoute.value = { query: {} };
+    listWorkflows.mockResolvedValue({ data: [] });
+    getHttpTrigger.mockResolvedValue(endpoint());
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: true };
+  });
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+    resetWorkflowData();
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+  });
+
+  it("shows the button on alert and incident workflows and unsaved ones", async () => {
+    wrapper = mountEditor();
+    await flushPromises();
+    expect(button(wrapper).text()).toContain(t("workflow.http.editorButton"));
+    expect(chip(wrapper).exists()).toBe(false);
+    wrapper.unmount();
+    const incident = savedGraph().nodes.map((n: any) =>
+      n.id === "t1" ? { ...n, meta: { trigger_kind: "incident_event" } } : n,
+    );
+    await openSaved({ nodes: incident });
+    expect(button(wrapper).exists()).toBe(true);
+    expect(panel(wrapper).props("kind")).toBe("incident_event");
+  });
+
+  it("opens the button tooltip on hover over the whole button, not only its icon", async () => {
+    hydrateWorkflow(savedGraph());
+    mockRouter.currentRoute.value = { query: { id: "wf-1" } };
+    getHttpTrigger.mockResolvedValue({ configured: false, permissions: endpoint().permissions });
+    wrapper = mount(WorkflowEditor, {
+      global: { plugins: [i18n, store], stubs: { ...globalStubs, OButton: false } },
+      attachTo: document.body,
+    });
+    await flushPromises();
+    await hoverAndWait(button(wrapper).element);
+    expect(document.body.textContent).toContain(t("workflow.http.editorButtonTooltip"));
+  });
+
+  it("sits between History and Test", async () => {
+    await openSaved();
+    const html = wrapper.html();
+    const at = (id: string) => html.indexOf(`data-test="${id}"`);
+    expect(at("workflow-editor-history")).toBeLessThan(at("workflow-editor-http-endpoint"));
+    expect(at("workflow-editor-http-endpoint")).toBeLessThan(at("workflow-editor-test"));
+  });
+
+  it("chip success when live, warning when draft or disabled, neutral Off when switched off", async () => {
+    await openSaved();
+    expect(chipVariant(wrapper)).toBe("success-soft");
+    expect(httpEditorState.endpointOn).toBe(true);
+    wrapper.unmount();
+    queryClient.clear();
+    await openSaved({ is_draft: true });
+    expect(chipVariant(wrapper)).toBe("warning-soft");
+    wrapper.unmount();
+    queryClient.clear();
+    await openSaved({ enabled: false });
+    expect(chipVariant(wrapper)).toBe("warning-soft");
+
+    wrapper.unmount();
+    queryClient.clear();
+    getHttpTrigger.mockResolvedValue(endpoint(false));
+    await openSaved();
+    expect(chipVariant(wrapper)).toBe("default-soft");
+    expect(chip(wrapper).text()).toBe(t("workflow.http.editorButtonOff"));
+    expect(httpEditorState.endpointOn).toBe(false);
+  });
+
+  it("the refused tooltip names the draft or the paused state", async () => {
+    const tooltipOf = (w: any) =>
+      w
+        .findAllComponents({ name: "OTooltip" })
+        .find((c: any) => c.find('[data-test="workflow-editor-http-endpoint"]').exists())
+        ?.props("content");
+    await openSaved({ is_draft: true });
+    expect(tooltipOf(wrapper)).toBe(t("workflow.http.editorButtonRefusedDraft"));
+    wrapper.unmount();
+    queryClient.clear();
+    await openSaved({ enabled: false });
+    expect(tooltipOf(wrapper)).toBe(t("workflow.http.editorButtonRefusedPaused"));
+  });
+
+  it("hides the header button and its overflow item when workflow_hooks_enabled is false", async () => {
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    await openSaved();
+    expect(button(wrapper).exists()).toBe(false);
+    expect(panel(wrapper).exists()).toBe(false);
+    expect(getHttpTrigger).not.toHaveBeenCalled();
+    expect(httpEditorState.endpointOn).toBe(false);
+  });
+
+  it("opens the panel with the workflow, and a badge click opens the same panel", async () => {
+    await openSaved();
+    expect(panel(wrapper).props("open")).toBe(false);
+    await button(wrapper).trigger("click");
+    expect(panel(wrapper).props()).toMatchObject({
+      open: true,
+      workflowId: "wf-1",
+      workflowName: "my workflow",
+      kind: "alert_fired",
+      isDraftOnly: false,
+      workflowEnabled: true,
+      context: "editor",
+    });
+    expect(typeof panel(wrapper).props("beforeCreate")).toBe("function");
+    await panel(wrapper).vm.$emit("update:open", false);
+    expect(panel(wrapper).props("open")).toBe(false);
+    httpEditorState.panelOpen = true;
+    await nextTick();
+    expect(panel(wrapper).props("open")).toBe(true);
+  });
+
+  it("Run test closes the panel and opens the Test dialog preset to HTTP request", async () => {
+    await openSaved();
+    await button(wrapper).trigger("click");
+    const seed = [{ meta: { trigger_source: "http", trigger_id: "test" }, data: [] }];
+    await panel(wrapper).vm.$emit("update:open", false);
+    await panel(wrapper).vm.$emit("run-test", seed, 42);
+    await flushPromises();
+    expect(panel(wrapper).props("open")).toBe(false);
+    expect(panel(wrapper).props("triggerNodeId")).toBe("t1");
+    expect(workflowObj.testRun.show).toBe(true);
+    const dialog = wrapper.findComponent({ name: "WorkflowTestDialog" });
+    expect(dialog.props("seed")).toEqual(seed);
+    expect(dialog.props("payloadFrom")).toBe("http");
+    expect(dialog.props("seedRunAt")).toBe(42);
+  });
+
+  it("a Run test that fails validation leaves no HTTP seed for the next Test", async () => {
+    await openSaved();
+    const edges = workflowObj.currentSelectedWorkflow.edges;
+    workflowObj.currentSelectedWorkflow.edges = [];
+    await panel(wrapper).vm.$emit("run-test", [{ meta: { trigger_source: "http" } }], 42);
+    await flushPromises();
+    expect(workflowObj.testRun.show).toBe(false);
+
+    workflowObj.currentSelectedWorkflow.edges = edges;
+    await wrapper.find('[data-test="workflow-editor-test"]').trigger("click");
+    await flushPromises();
+    expect(workflowObj.testRun.show).toBe(true);
+    const dialog = wrapper.findComponent({ name: "WorkflowTestDialog" });
+    expect(dialog.props("seed")).toBeUndefined();
+    expect(dialog.props("payloadFrom")).toBeUndefined();
+    expect(dialog.props("seedRunAt")).toBeUndefined();
+  });
+
+  it("the picker shows the HTTP cue and only enabled kinds", async () => {
+    wrapper = mountEditor();
+    await flushPromises();
+    workflowObj.stepPicker = { ...workflowObj.stepPicker, show: true, mode: "trigger" };
+    await nextTick();
+    const picker = wrapper.findComponent({ name: "StepPickerDialog" });
+    expect(picker.props("footnote")).toBe(t("workflow.http.pickerCue"));
+    const keys = picker.props("items").map((i: any) => i.key);
+    expect(keys).toEqual(enabledTriggers().map((d) => d.kind));
+    expect(keys).not.toContain("http_request");
+    workflowObj.stepPicker = { ...workflowObj.stepPicker, mode: "next" };
+    await nextTick();
+    expect(wrapper.findComponent({ name: "StepPickerDialog" }).props("footnote")).toBeUndefined();
+  });
+});
diff --git a/web/src/components/workflows/WorkflowEditor.vue b/web/src/components/workflows/WorkflowEditor.vue
index 0deeda7950..d77d8e078c 100644
--- a/web/src/components/workflows/WorkflowEditor.vue
+++ b/web/src/components/workflows/WorkflowEditor.vue
@@ -160,6 +160,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             </button>
           </template>
         </WorkflowRunSwitcher>
+        <WorkflowHttpEndpointButton
+          v-if="showHttpButton"
+          :chip="httpChip"
+          :tooltip-key="httpTooltipKey"
+          size="sm-action"
+          data-test="workflow-editor-http-endpoint"
+          @click="httpEditorState.panelOpen = true"
+        />
         <OButton
           variant="outline"
           size="sm-action"
@@ -254,6 +262,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :search-placeholder="t('workflow.node.stepSearchPlaceholder')"
       :no-match-text="t('workflow.node.stepNoMatch')"
       test-prefix="workflow-step"
+      :footnote="pickerFootnote"
+      footnote-icon="webhook"
+      footnote-test-id="workflow-step-picker-http-cue"
       @pick="onStepPick"
       @close="closeStepPicker"
     />
@@ -267,7 +278,27 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
          current graph (sent whole, no save needed). Results render as ✓ / error
          badges on the canvas nodes, and open in the results dock (T4) — clicking a
          node badge selects that step in the dock rather than opening an overlay. -->
-    <WorkflowTestDialog v-if="workflowObj.testRun.show" />
+    <WorkflowTestDialog
+      v-if="workflowObj.testRun.show"
+      :seed="testSeed"
+      :payload-from="testPayloadFrom"
+      :seed-run-at="testSeedRunAt"
+    />
+
+    <WorkflowHttpEndpointPanel
+      v-if="hooksOn"
+      :open="httpEditorState.panelOpen"
+      :workflow-id="workflowObj.currentSelectedWorkflow.id || null"
+      :workflow-name="workflowObj.currentSelectedWorkflow.name || ''"
+      :kind="httpKind"
+      :is-draft-only="!!workflowObj.currentSelectedWorkflow.isDraft"
+      :workflow-enabled="workflowObj.currentSelectedWorkflow.enabled !== false"
+      context="editor"
+      :before-create="persistDraft"
+      :trigger-node-id="httpTriggerNodeId"
+      @update:open="httpEditorState.panelOpen = $event"
+      @run-test="onHttpRunTest"
+    />
 
     <!-- Link-to-alerts prompt — shown once, right after a workflow is created, so
          the user can attach it to existing alerts without leaving for the alert
@@ -306,7 +337,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
-import { computed, onMounted, onBeforeUnmount, ref } from "vue";
+import { computed, onMounted, onBeforeUnmount, ref, watch } from "vue";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import { useRouter, onBeforeRouteLeave, type RouteLocationRaw } from "vue-router";
 import { useStore } from "vuex";
@@ -319,6 +350,14 @@ import BetaBadge from "@/components/common/BetaBadge.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import WorkflowHttpEndpointPanel from "./WorkflowHttpEndpointPanel.vue";
+import WorkflowHttpEndpointButton from "./WorkflowHttpEndpointButton.vue";
+import { useWorkflowHttpButton } from "@/plugins/workflows/useWorkflowHttpButton";
+import {
+  httpEditorState,
+  resetHttpEditorState,
+  type PayloadFrom,
+} from "@/plugins/workflows/httpEndpointUi";
 
 import WorkflowCanvas from "@/plugins/workflows/WorkflowCanvas.vue";
 import WorkflowNodeDrawer from "./WorkflowNodeDrawer.vue";
@@ -338,6 +377,7 @@ import useWorkflowCanvas, {
   triggerDef,
   triggerTypeForKind,
   currentTriggerKind,
+  currentTriggerNodeId,
   serializeWorkflow,
   markWorkflowDirty,
   reachableFrom,
@@ -501,6 +541,37 @@ const onStepPick = (item: any) => {
 
 const orgId = () => store.state.selectedOrganization.identifier as string;
 
+// ── HTTP endpoint ───────────────────────────────────────────────────────────
+const httpKind = computed(() => currentTriggerKind());
+const httpTriggerNodeId = computed(() => currentTriggerNodeId());
+const {
+  visible: hooksOn,
+  endpointOn: httpEndpointOn,
+  chip: httpChip,
+  tooltipKey: httpTooltipKey,
+} = useWorkflowHttpButton({
+  workflowId: computed(() => workflowObj.currentSelectedWorkflow.id || ""),
+  isDraft: computed(() => !!workflowObj.currentSelectedWorkflow.isDraft),
+  workflowEnabled: computed(() => workflowObj.currentSelectedWorkflow.enabled !== false),
+});
+watch(httpEndpointOn, (on) => (httpEditorState.endpointOn = on), { immediate: true });
+const showHttpButton = computed(() => hooksOn.value && !workflowObj.readOnly);
+const pickerFootnote = computed(() =>
+  isTriggerStep.value && hooksOn.value ? t("workflow.http.pickerCue") : undefined,
+);
+const testSeed = ref<unknown[] | undefined>(undefined);
+const testPayloadFrom = ref<PayloadFrom | undefined>(undefined);
+const testSeedRunAt = ref<number | undefined>(undefined);
+watch(
+  () => workflowObj.testRun.show,
+  (show) => {
+    if (show) return;
+    testSeed.value = undefined;
+    testPayloadFrom.value = undefined;
+    testSeedRunAt.value = undefined;
+  },
+);
+
 // Start a fresh workflow on an EMPTY canvas. It used to pre-place an Alert
 // Trigger node here; the canvas now shows a "Choose a Trigger" start node that
 // opens the trigger picker, the same shape as the pipeline editor's source
@@ -934,6 +1005,16 @@ const onTest = () => {
   workflowObj.testRun.show = true;
 };
 
+// The panel closes first, so the Test drawer is the only overlay (AC-UI-34); the seed is set only once the graph validates.
+const onHttpRunTest = (seed: unknown[], runAt?: number) => {
+  httpEditorState.panelOpen = false;
+  if (!validate({ requireName: false, allowOrphans: true })) return;
+  testSeed.value = seed;
+  testPayloadFrom.value = "http";
+  testSeedRunAt.value = runAt;
+  workflowObj.testRun.show = true;
+};
+
 // History → the dedicated read-only Runs inspection view (separate surface).
 const openRuns = () => {
   router.push({
@@ -1014,5 +1095,6 @@ const switchEditorRun = async (runId: string) => {
 onBeforeUnmount(() => {
   window.removeEventListener("beforeunload", beforeUnloadHandler);
   resetWorkflowData();
+  resetHttpEditorState();
 });
 </script>
diff --git a/web/src/components/workflows/WorkflowHttpAdvanced.schema.spec.ts b/web/src/components/workflows/WorkflowHttpAdvanced.schema.spec.ts
new file mode 100644
index 0000000000..707aa515fa
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpAdvanced.schema.spec.ts
@@ -0,0 +1,56 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import i18n from "@/locales";
+import type { TranslateFn } from "@/types/i18n";
+import {
+  MAX_BODY_KIB,
+  httpLimitsDefaults,
+  makeHttpLimitsSchema,
+} from "./WorkflowHttpAdvanced.schema";
+
+const t = i18n.global.t as unknown as TranslateFn;
+
+describe("WorkflowHttpAdvanced schema", () => {
+  const schema = makeHttpLimitsSchema(t, 600);
+
+  it("accepts whole numbers inside both ranges, from the strings number inputs emit", () => {
+    expect(schema.parse({ maxBodyKib: "512", rateLimit: "600" })).toEqual({
+      maxBodyKib: 512,
+      rateLimit: 600,
+    });
+  });
+
+  it("caps the body at 1024 KiB and the rate at the org budget", () => {
+    expect(MAX_BODY_KIB).toBe(1024);
+    const body = schema.safeParse({ maxBodyKib: 1025, rateLimit: 60 });
+    expect(body.success).toBe(false);
+    expect(body.error?.issues[0].message).toBe(t("workflow.http.maxBodyRange"));
+    const rate = schema.safeParse({ maxBodyKib: 1024, rateLimit: 601 });
+    expect(rate.error?.issues[0].message).toBe(t("workflow.http.rateLimitRange", { org: 600 }));
+  });
+
+  it("refuses zero, fractions and empty values", () => {
+    for (const bad of [0, 1.5, "", "abc"]) {
+      expect(schema.safeParse({ maxBodyKib: bad, rateLimit: 60 }).success, String(bad)).toBe(false);
+      expect(schema.safeParse({ maxBodyKib: 1, rateLimit: bad }).success, String(bad)).toBe(false);
+    }
+  });
+
+  it("defaults read the stored bytes as KiB", () => {
+    expect(httpLimitsDefaults(1_048_576, 60)).toEqual({ maxBodyKib: 1024, rateLimit: 60 });
+  });
+});
diff --git a/web/src/components/workflows/WorkflowHttpAdvanced.schema.ts b/web/src/components/workflows/WorkflowHttpAdvanced.schema.ts
new file mode 100644
index 0000000000..b1547eda07
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpAdvanced.schema.ts
@@ -0,0 +1,37 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { z } from "zod";
+import type { TranslateFn } from "@/types/i18n";
+
+/** 1 MiB is the server's hard cap (spike S2), so the field may only lower it. */
+export const MAX_BODY_KIB = 1024;
+
+const wholeNumberIn = (max: number, message: string) =>
+  z.coerce.number({ message }).int(message).min(1, message).max(max, message);
+
+/** The trigger's own limits; `orgBudget` is the org's per-minute budget, which the server also clamps to. */
+export const makeHttpLimitsSchema = (t: TranslateFn, orgBudget: number) =>
+  z.object({
+    maxBodyKib: wholeNumberIn(MAX_BODY_KIB, t("workflow.http.maxBodyRange")),
+    rateLimit: wholeNumberIn(orgBudget, t("workflow.http.rateLimitRange", { org: orgBudget })),
+  });
+
+export type HttpLimitsForm = z.infer<ReturnType<typeof makeHttpLimitsSchema>>;
+
+export const httpLimitsDefaults = (maxBodyBytes: number, rateLimit: number): HttpLimitsForm => ({
+  maxBodyKib: Math.round(maxBodyBytes / 1024),
+  rateLimit,
+});
diff --git a/web/src/components/workflows/WorkflowHttpAdvanced.vue b/web/src/components/workflows/WorkflowHttpAdvanced.vue
new file mode 100644
index 0000000000..58673a1732
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpAdvanced.vue
@@ -0,0 +1,199 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <OCollapsible
+    v-model="open"
+    variant="sidebar"
+    :label="t('workflow.http.advanced')"
+    :caption="summary"
+    data-test="workflow-http-advanced"
+  >
+    <div ref="body" class="flex flex-col gap-4 px-3 pt-2 pb-1">
+      <OForm
+        :key="formKey"
+        :schema="schema"
+        :default-values="defaults"
+        class="flex flex-col gap-5"
+        @submit="onSave"
+      >
+        <OFormInput
+          name="maxBodyKib"
+          type="number"
+          :label="t('workflow.http.maxBody')"
+          :help-text="t('workflow.http.maxBodyHint')"
+          width="md"
+          data-test="workflow-http-max-body"
+        />
+        <OFormInput
+          name="rateLimit"
+          type="number"
+          :label="t('workflow.http.rateLimit')"
+          :help-text="t('workflow.http.rateLimitHint', { org: orgBudget })"
+          width="md"
+          data-test="workflow-http-rate-limit"
+        />
+        <OBanner
+          v-if="saveError"
+          variant="error-soft"
+          dense
+          data-test="workflow-http-limits-error"
+          :content="saveError"
+        />
+        <div>
+          <OButton
+            type="submit"
+            variant="primary"
+            size="sm-action"
+            data-test="workflow-http-limits-save"
+          >
+            {{ t("common.save") }}
+          </OButton>
+        </div>
+      </OForm>
+
+      <div class="border-border-default flex flex-wrap items-center gap-3 border-t pt-3">
+        <OText variant="meta" class="min-w-0 flex-1">{{ t("workflow.http.deleteMeta") }}</OText>
+        <OPopover
+          v-model:open="deleteOpen"
+          side="bottom"
+          align="end"
+          :aria-label="t('workflow.http.deleteTitle')"
+        >
+          <template #trigger>
+            <OButton variant="outline-destructive" size="xs" data-test="workflow-http-delete">
+              {{ t("workflow.http.deleteButton") }}
+            </OButton>
+          </template>
+          <div
+            data-test="workflow-http-delete-popover"
+            class="flex w-80 max-w-[calc(100vw-1.5rem)] flex-col gap-2 p-3"
+          >
+            <OText variant="body-strong">{{ t("workflow.http.deleteTitle") }}</OText>
+            <OText variant="meta" as="p">{{ t("workflow.http.deleteBody") }}</OText>
+            <OBanner
+              v-if="deleteError"
+              variant="error-soft"
+              dense
+              data-test="workflow-http-delete-error"
+              :content="deleteError"
+            />
+            <div class="flex justify-end gap-2">
+              <OButton
+                variant="outline"
+                size="sm-action"
+                data-test="workflow-http-delete-cancel"
+                @click="deleteOpen = false"
+              >
+                {{ t("common.cancel") }}
+              </OButton>
+              <OButton
+                variant="destructive"
+                size="sm-action"
+                :loading="deleting"
+                data-test="workflow-http-delete-confirm"
+                @click="onDelete"
+              >
+                {{ t("common.delete") }}
+              </OButton>
+            </div>
+          </div>
+        </OPopover>
+      </div>
+    </div>
+  </OCollapsible>
+</template>
+
+<script setup lang="ts">
+import { computed, nextTick, ref, watch } from "vue";
+import { useI18nTyped, type I18nText } from "@/types/i18n";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OCollapsible from "@/lib/core/Collapsible/OCollapsible.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import OForm from "@/lib/forms/Form/OForm.vue";
+import OFormInput from "@/lib/forms/Input/OFormInput.vue";
+import OPopover from "@/lib/overlay/Popover/OPopover.vue";
+import { formatBodySize, httpErrorText, useHttpEndpoint } from "@/plugins/workflows/httpEndpointUi";
+import {
+  MAX_BODY_KIB,
+  httpLimitsDefaults,
+  makeHttpLimitsSchema,
+  type HttpLimitsForm,
+} from "./WorkflowHttpAdvanced.schema";
+
+const open = defineModel<boolean>("open", { default: false });
+
+const { t } = useI18nTyped();
+const { config, deleting, saveLimits, deleteEndpoint } = useHttpEndpoint();
+
+const body = ref<HTMLElement | null>(null);
+const deleteOpen = ref(false);
+const saveError = ref<I18nText | null>(null);
+const deleteError = ref<I18nText | null>(null);
+
+const maxBodyBytes = computed(() => config.value?.max_body_bytes ?? MAX_BODY_KIB * 1024);
+const rateLimit = computed(() => config.value?.rate_limit_per_minute ?? 0);
+const orgBudget = computed(() => config.value?.org_rate_limit_per_minute ?? 0);
+const schema = computed(() => makeHttpLimitsSchema(t, orgBudget.value));
+const defaults = computed(() => httpLimitsDefaults(maxBodyBytes.value, rateLimit.value));
+// The form remounts with the stored limits after each save, so it never shows stale values.
+const formKey = computed(() => `${maxBodyBytes.value}-${rateLimit.value}-${orgBudget.value}`);
+const summary = computed(() =>
+  t(
+    "workflow.http.advancedSummary",
+    { size: formatBodySize(maxBodyBytes.value, t), count: rateLimit.value },
+    rateLimit.value,
+  ),
+);
+
+const onSave = async (value: HttpLimitsForm) => {
+  saveError.value = null;
+  try {
+    await saveLimits({
+      max_body_bytes: Number(value.maxBodyKib) * 1024,
+      rate_limit_per_minute: Number(value.rateLimit),
+    });
+  } catch (err) {
+    saveError.value = t("workflow.http.saveLimitsFailed", { reason: httpErrorText(err, t) });
+  }
+};
+
+const onDelete = async () => {
+  deleteError.value = null;
+  try {
+    await deleteEndpoint();
+    deleteOpen.value = false;
+  } catch (err) {
+    deleteError.value = t("workflow.http.deleteFailed", { reason: httpErrorText(err, t) });
+  }
+};
+
+/** Opens the section and puts the cursor in the rate field ("Raise limit"). */
+const focusRateLimit = async () => {
+  open.value = true;
+  await nextTick();
+  body.value
+    ?.querySelector<HTMLInputElement>('[data-test="workflow-http-rate-limit-field"]')
+    ?.focus();
+};
+
+watch(deleteOpen, (isOpen) => {
+  if (isOpen) deleteError.value = null;
+});
+
+defineExpose({ focusRateLimit });
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpCredentialsTable.spec.ts b/web/src/components/workflows/WorkflowHttpCredentialsTable.spec.ts
new file mode 100644
index 0000000000..f0aba9936a
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpCredentialsTable.spec.ts
@@ -0,0 +1,213 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import {
+  HOUR_US,
+  HTTP_ROW_VALUE,
+  OPopoverStub,
+  httpCredential,
+} from "@/test/unit/helpers/workflowHttp";
+import type { HttpCredential } from "@/services/workflows";
+import WorkflowHttpCredentialsTable from "./WorkflowHttpCredentialsTable.vue";
+
+const t = (k: string, v?: Record<string, unknown>) => i18n.global.t(k, v ?? {});
+
+const mountTable = (props: Record<string, unknown> = {}) =>
+  mount(WorkflowHttpCredentialsTable, {
+    props: {
+      credentials: [httpCredential()] as HttpCredential[],
+      mode: "token",
+      canEdit: true,
+      canReveal: true,
+      revoking: null,
+      revealed: {},
+      revealing: null,
+      revealError: {},
+      ...props,
+    },
+    global: { plugins: [i18n, store], stubs: { OPopover: OPopoverStub } },
+  });
+
+const byTest = (w: ReturnType<typeof mountTable>, id: string) => w.find(`[data-test="${id}"]`);
+
+describe("WorkflowHttpCredentialsTable", () => {
+  it("lists Token, Created, Last used, Status", () => {
+    const w = mountTable();
+    const text = byTest(w, "workflow-http-credentials").text();
+    for (const key of ["colToken", "colCreated", "colLastUsed", "colStatus"]) {
+      expect(text).toContain(t(`workflow.http.${key}`));
+    }
+    expect(text).toContain(t("workflow.http.never"));
+    expect(text).toContain(t("workflow.http.active"));
+    expect(text).toContain("a@example.com");
+  });
+
+  // Measured in the built UI at 1920 px: the xl drawer leaves the table 707 px inside its frame.
+  it("fits every column inside the xl panel, so nothing scrolls sideways", () => {
+    const w = mountTable();
+    const columns = w.findComponent({ name: "OTable" }).props("columns") as {
+      size?: number;
+      minSize?: number;
+      meta?: { flex?: boolean };
+    }[];
+    const needed = columns.reduce(
+      (sum, c) => sum + (c.meta?.flex ? (c.minSize ?? 48) : (c.size ?? 150)),
+      0,
+    );
+    expect(needed).toBeLessThanOrEqual(707);
+  });
+
+  it("shows when and by whom in one Created cell, with times as in the mockups", () => {
+    const w = mountTable({
+      credentials: [httpCredential({ last_used_at: 1_792_575_690_000_000 })],
+    });
+    const columns = w.findComponent({ name: "OTable" }).props("columns") as { id: string }[];
+    expect(columns.map((c) => c.id)).toEqual([
+      "value",
+      "created_at",
+      "last_used_at",
+      "state",
+      "actions",
+    ]);
+    const created = byTest(w, "workflow-http-credential-c1-created");
+    expect(created.text()).toContain("Oct 21, 09:39");
+    expect(created.text()).toContain("a@example.com");
+    const text = byTest(w, "workflow-http-credentials").text();
+    expect(text).toContain("Oct 21, 09:41");
+    expect(text).not.toContain("2026-10-21");
+  });
+
+  it("signed mode names the column Secret", () => {
+    const w = mountTable({ mode: "signature" });
+    expect(byTest(w, "workflow-http-credentials").text()).toContain(t("workflow.http.colSecret"));
+  });
+
+  it("tags creators who left", () => {
+    const w = mountTable({ credentials: [httpCredential({ creator_in_org: false })] });
+    expect(w.text()).toContain(t("workflow.http.creatorGone"));
+  });
+
+  it("a row shows its prefix until Show", () => {
+    const w = mountTable();
+    const cell = byTest(w, "workflow-http-credential-c1-value");
+    expect(cell.attributes("data-o2-privacy")).toBe("mask");
+    expect(cell.text()).toContain("o2wh_4fK9…oI4k");
+    expect(cell.text()).not.toContain(HTTP_ROW_VALUE);
+  });
+
+  it("Show swaps in the value with data-o2-privacy=mask and hides it again", async () => {
+    const w = mountTable();
+    await byTest(w, "workflow-http-credential-c1-show").trigger("click");
+    expect(w.emitted("reveal")?.[0]).toEqual(["c1"]);
+    await w.setProps({ revealed: { c1: HTTP_ROW_VALUE } });
+    const cell = byTest(w, "workflow-http-credential-c1-value");
+    expect(cell.attributes("data-o2-privacy")).toBe("mask");
+    expect(cell.text()).toContain(HTTP_ROW_VALUE);
+    await byTest(w, "workflow-http-credential-c1-show").trigger("click");
+    expect(w.emitted("hide")?.[0]).toEqual(["c1"]);
+  });
+
+  // A cut value cannot be compared with the caller's copy, so the shown value wraps in full.
+  it("a shown value wraps in full instead of cutting with an ellipsis", () => {
+    const w = mountTable({ revealed: { c1: HTTP_ROW_VALUE } });
+    const cell = byTest(w, "workflow-http-credential-c1-value");
+    expect(cell.findComponent({ name: "OTruncatedText" }).exists()).toBe(false);
+    const value = cell.find('[data-test="workflow-http-credential-c1-shown"]');
+    expect(value.text()).toBe(HTTP_ROW_VALUE);
+    expect(value.classes()).toEqual(
+      expect.arrayContaining(["break-all", "whitespace-normal", "font-mono"]),
+    );
+  });
+
+  it("Copy copies the real value without showing it", async () => {
+    const w = mountTable();
+    await byTest(w, "workflow-http-credential-c1-copy").trigger("click");
+    expect(w.emitted("copy")?.[0]).toEqual(["c1"]);
+    expect(byTest(w, "workflow-http-credential-c1-value").text()).not.toContain(HTTP_ROW_VALUE);
+  });
+
+  it("Show/Copy hidden without permissions.reveal", () => {
+    const w = mountTable({ canReveal: false });
+    expect(byTest(w, "workflow-http-credential-c1-show").exists()).toBe(false);
+    expect(byTest(w, "workflow-http-credential-c1-copy").exists()).toBe(false);
+    expect(byTest(w, "workflow-http-credential-reveal-denied").text()).toBe(
+      t("workflow.http.revealDenied"),
+    );
+  });
+
+  // Measured in the built UI: Show 28 + Copy 28 + "Revoke now" 88 + two 4 px gaps + 8 + 12 cell padding.
+  it("sizes the actions column for Show, Copy and Revoke now, so the retiring row's Show is not clipped", () => {
+    const w = mountTable();
+    const columns = w.findComponent({ name: "OTable" }).props("columns") as {
+      id: string;
+      size?: number;
+    }[];
+    expect(columns.find((c) => c.id === "actions")?.size).toBeGreaterThanOrEqual(174);
+  });
+
+  it("a retiring row reveals until it expires", () => {
+    const now = Date.now() * 1000;
+    const w = mountTable({
+      credentials: [
+        httpCredential({ id: "c2" }),
+        httpCredential({ id: "c1", state: "retiring", expires_at: now + 24 * HOUR_US }),
+        httpCredential({ id: "c3", state: "retiring", expires_at: now - HOUR_US }),
+      ],
+    });
+    expect(byTest(w, "workflow-http-credential-retiring").text()).toContain(
+      t("workflow.http.retiring"),
+    );
+    expect(byTest(w, "workflow-http-credential-c1-show").exists()).toBe(true);
+    expect(byTest(w, "workflow-http-credential-c3-show").exists()).toBe(false);
+    expect(byTest(w, "workflow-http-credential-c1-revoke").text()).toBe(
+      t("workflow.http.revokeNow"),
+    );
+  });
+
+  it("revoke confirms in a popover", async () => {
+    const w = mountTable();
+    await byTest(w, "workflow-http-credential-c1-revoke").trigger("click");
+    expect(w.emitted("revoke")).toBeUndefined();
+    expect(byTest(w, "workflow-http-credential-c1-revoke-popover").text()).toContain(
+      t("workflow.http.revokeTitle", { prefix: "o2wh_4fK9…oI4k" }),
+    );
+    await byTest(w, "workflow-http-credential-c1-revoke-confirm").trigger("click");
+    expect(w.emitted("revoke")?.[0]).toEqual(["c1"]);
+  });
+
+  it("drops the empty Actions column when the user can neither show nor revoke", () => {
+    const ids = (w: ReturnType<typeof mountTable>) =>
+      (w.findComponent({ name: "OTable" }).props("columns") as { id: string }[]).map((c) => c.id);
+    expect(ids(mountTable({ canEdit: false, canReveal: false }))).not.toContain("actions");
+    expect(ids(mountTable({ canEdit: false, canReveal: true }))).toContain("actions");
+    expect(ids(mountTable({ canEdit: true, canReveal: false }))).toContain("actions");
+  });
+
+  it("revoke is hidden without edit", () => {
+    const w = mountTable({ canEdit: false });
+    expect(byTest(w, "workflow-http-credential-c1-revoke").exists()).toBe(false);
+  });
+
+  it("a failed reveal shows the row error", () => {
+    const w = mountTable({ revealError: { c1: "gone" } });
+    expect(byTest(w, "workflow-http-credential-c1-reveal-error").text()).toBe(
+      t("workflow.http.revealFailed", { reason: "gone" }),
+    );
+  });
+});
diff --git a/web/src/components/workflows/WorkflowHttpCredentialsTable.vue b/web/src/components/workflows/WorkflowHttpCredentialsTable.vue
new file mode 100644
index 0000000000..725738a33a
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpCredentialsTable.vue
@@ -0,0 +1,326 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex flex-col gap-2">
+    <OText
+      v-if="!canReveal"
+      variant="meta"
+      as="p"
+      data-test="workflow-http-credential-reveal-denied"
+    >
+      {{ t("workflow.http.revealDenied") }}
+    </OText>
+    <div class="border-border-default rounded-default overflow-hidden border">
+      <OTable
+        :data="rows"
+        :columns="columns"
+        row-key="id"
+        pagination="none"
+        :show-global-filter="false"
+        :cell-overflow-tooltip="false"
+        :frame="false"
+        data-test="workflow-http-credentials"
+      >
+        <template #cell-value="{ row }">
+          <div
+            class="flex min-w-0 flex-col gap-0.5"
+            :data-test="`workflow-http-credential-${row.id}-value`"
+            data-o2-privacy="mask"
+          >
+            <span
+              v-if="revealed[row.id]"
+              class="text-compact font-mono break-all whitespace-normal"
+              :data-test="`workflow-http-credential-${row.id}-shown`"
+              >{{ revealed[row.id] }}</span
+            >
+            <span v-else class="text-compact font-mono">{{ row.display_prefix }}</span>
+            <OText
+              v-if="revealError[row.id]"
+              variant="meta"
+              as="p"
+              class="text-status-negative"
+              :data-test="`workflow-http-credential-${row.id}-reveal-error`"
+            >
+              {{ revealErrorText(revealError[row.id]) }}
+            </OText>
+          </div>
+        </template>
+
+        <template #cell-created_at="{ row }">
+          <div
+            class="flex min-w-0 flex-col items-start gap-0.5"
+            :data-test="`workflow-http-credential-${row.id}-created`"
+          >
+            <OTimeCell
+              :value="row.created_at"
+              unit="us"
+              mode="absolute"
+              :format="RUN_TIME_SHORT"
+              :timezone="timezone"
+            />
+            <OUserCell :value="row.created_by" />
+            <OTag
+              v-if="!row.creator_in_org"
+              variant="default-soft"
+              size="sm"
+              :label="t('workflow.http.creatorGone')"
+              :data-test="`workflow-http-credential-${row.id}-creator-gone`"
+            />
+          </div>
+        </template>
+
+        <template #cell-last_used_at="{ row }">
+          <OTimeCell
+            :value="row.last_used_at"
+            unit="us"
+            mode="absolute"
+            :format="RUN_TIME_SHORT"
+            :timezone="timezone"
+            :empty-label="t('workflow.http.never')"
+          />
+        </template>
+
+        <template #cell-state="{ row }">
+          <OTag
+            v-if="row.state === 'active'"
+            variant="success-soft"
+            size="sm"
+            dot
+            :label="t('workflow.http.active')"
+          />
+          <div
+            v-else-if="isLive(row)"
+            class="flex flex-col items-start gap-0.5"
+            data-test="workflow-http-credential-retiring"
+          >
+            <OTag variant="warning-soft" size="sm" dot :label="t('workflow.http.retiring')" />
+            <OText variant="meta" as="span">{{ expiresText(row) }}</OText>
+          </div>
+          <OTag v-else variant="default-soft" size="sm" :label="t('workflow.http.expired')" />
+        </template>
+
+        <template #cell-actions="{ row }">
+          <div class="flex items-center justify-end gap-1">
+            <template v-if="canReveal && isLive(row)">
+              <OButton
+                variant="ghost"
+                size="icon-xs-sq"
+                :loading="revealing === row.id"
+                :aria-label="
+                  revealed[row.id]
+                    ? t('ingestion.setupCard.hideToken')
+                    : t('ingestion.setupCard.revealToken')
+                "
+                :data-test="`workflow-http-credential-${row.id}-show`"
+                @click="toggleShow(row.id)"
+              >
+                <OIcon :name="revealed[row.id] ? 'visibility-off' : 'visibility'" size="sm" />
+                <OTooltip
+                  :content="
+                    revealed[row.id]
+                      ? t('ingestion.setupCard.hideToken')
+                      : t('ingestion.setupCard.revealToken')
+                  "
+                  side="top"
+                />
+              </OButton>
+              <OButton
+                variant="ghost"
+                size="icon-xs-sq"
+                :aria-label="copyLabel"
+                :data-test="`workflow-http-credential-${row.id}-copy`"
+                @click="emit('copy', row.id)"
+              >
+                <OIcon name="content-copy" size="sm" />
+                <OTooltip :content="copyLabel" side="top" />
+              </OButton>
+            </template>
+            <OPopover
+              v-if="canEdit"
+              :open="confirmId === row.id"
+              side="bottom"
+              align="end"
+              :aria-label="t('workflow.http.revoke')"
+              @update:open="(open: boolean) => (confirmId = open ? row.id : null)"
+            >
+              <template #trigger>
+                <OButton
+                  variant="ghost-destructive"
+                  size="xs"
+                  :loading="revoking === row.id"
+                  :data-test="`workflow-http-credential-${row.id}-revoke`"
+                >
+                  {{
+                    row.state === "retiring"
+                      ? t("workflow.http.revokeNow")
+                      : t("workflow.http.revoke")
+                  }}
+                </OButton>
+              </template>
+              <div
+                class="flex w-80 max-w-[calc(100vw-1.5rem)] flex-col gap-3 p-3"
+                :data-test="`workflow-http-credential-${row.id}-revoke-popover`"
+              >
+                <OText as="p">
+                  {{ t("workflow.http.revokeTitle", { prefix: raw(row.display_prefix) }) }}
+                </OText>
+                <div class="flex justify-end gap-2">
+                  <OButton
+                    variant="outline"
+                    size="sm-action"
+                    :data-test="`workflow-http-credential-${row.id}-revoke-cancel`"
+                    @click="confirmId = null"
+                  >
+                    {{ t("common.cancel") }}
+                  </OButton>
+                  <OButton
+                    variant="destructive"
+                    size="sm-action"
+                    :data-test="`workflow-http-credential-${row.id}-revoke-confirm`"
+                    @click="confirmRevoke(row.id)"
+                  >
+                    {{ t("workflow.http.revoke") }}
+                  </OButton>
+                </div>
+              </div>
+            </OPopover>
+          </div>
+        </template>
+      </OTable>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { useStore } from "vuex";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import OUserCell from "@/lib/core/Table/cells/OUserCell.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import OPopover from "@/lib/overlay/Popover/OPopover.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import type { HttpAuthMode, HttpCredential } from "@/services/workflows";
+import { isLiveCredential } from "@/plugins/workflows/useWorkflowHttpEndpoint";
+import { RUN_TIME_SHORT } from "@/plugins/workflows/runStatus";
+
+const HOUR_US = 3_600_000_000;
+
+const props = defineProps<{
+  credentials: HttpCredential[];
+  mode: HttpAuthMode;
+  canEdit: boolean;
+  canReveal: boolean;
+  revoking: string | null;
+  revealed: Readonly<Record<string, string>>;
+  revealing: string | null;
+  revealError: Readonly<Record<string, string>>;
+}>();
+
+const emit = defineEmits<{
+  (e: "reveal", id: string): void;
+  (e: "hide", id: string): void;
+  (e: "copy", id: string): void;
+  (e: "revoke", id: string): void;
+}>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+
+const confirmId = ref<string | null>(null);
+
+const timezone = computed<string>(() => store.state.timezone);
+const isSigned = computed(() => props.mode === "signature");
+const rows = computed(() => props.credentials.filter((c) => c.state !== "revoked"));
+const copyLabel = computed(() =>
+  isSigned.value ? t("workflow.http.copySecret") : t("workflow.http.copyToken"),
+);
+
+const allColumns = computed<OTableColumnDef<HttpCredential>[]>(() => [
+  {
+    id: "value",
+    header: isSigned.value ? t("workflow.http.colSecret") : t("workflow.http.colToken"),
+    accessorKey: "display_prefix",
+    size: 200,
+    minSize: 140,
+    meta: { align: "left", flex: true, cellOverflowTooltip: false },
+  },
+  {
+    id: "created_at",
+    header: t("workflow.http.colCreated"),
+    accessorKey: "created_at",
+    size: 156,
+    meta: { align: "left" },
+  },
+  {
+    id: "last_used_at",
+    header: t("workflow.http.colLastUsed"),
+    accessorKey: "last_used_at",
+    size: 104,
+    meta: { align: "left" },
+  },
+  {
+    id: "state",
+    header: t("workflow.http.colStatus"),
+    accessorKey: "state",
+    size: 112,
+    meta: { align: "left" },
+  },
+  {
+    id: "actions",
+    header: t("workflow.http.colActions"),
+    size: 176,
+    meta: { align: "right" },
+  },
+]);
+// Without Show or Revoke every row has no action, so the column would be an empty header.
+const columns = computed(() =>
+  props.canEdit || props.canReveal
+    ? allColumns.value
+    : allColumns.value.filter((c) => c.id !== "actions"),
+);
+
+const isLive = (c: HttpCredential) => isLiveCredential(c);
+
+// Hour precision, as the run list's reason line; a week reads in days.
+const expiresText = (c: HttpCredential): I18nText => {
+  const hours = Math.max(1, Math.ceil(((c.expires_at ?? 0) - Date.now() * 1000) / HOUR_US));
+  if (hours < 48) return t("workflow.http.expiresInHours", { count: hours }, hours);
+  const days = Math.round(hours / 24);
+  return t("workflow.http.expiresInDays", { count: days }, days);
+};
+
+const revealErrorText = (reason: string): I18nText =>
+  isSigned.value
+    ? t("workflow.http.revealFailedSigned", { reason: raw(reason) })
+    : t("workflow.http.revealFailed", { reason: raw(reason) });
+
+const toggleShow = (id: string) => {
+  if (props.revealed[id]) emit("hide", id);
+  else emit("reveal", id);
+};
+
+const confirmRevoke = (id: string) => {
+  confirmId.value = null;
+  emit("revoke", id);
+};
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpEndpointButton.vue b/web/src/components/workflows/WorkflowHttpEndpointButton.vue
new file mode 100644
index 0000000000..919be40b68
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpEndpointButton.vue
@@ -0,0 +1,60 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <!-- Wrapper mode: a child tooltip after icon-left anchors to the icon alone -->
+  <OTooltip side="bottom" :content="tooltip" :disabled="!tooltip">
+    <OButton
+      variant="outline"
+      :size="size"
+      icon-left="webhook"
+      :data-test="dataTest"
+      @click="emit('click')"
+    >
+      {{ t("workflow.http.editorButton") }}
+      <OTag
+        v-if="chip"
+        :variant="chip.variant"
+        size="sm"
+        :label="t(chip.labelKey)"
+        :data-test="`${dataTest}-chip`"
+      />
+    </OButton>
+  </OTooltip>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { useI18nTyped, type I18nKey } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import type { ButtonSize } from "@/lib/core/Button/OButton.types";
+import type { HttpButtonChip } from "@/plugins/workflows/useWorkflowHttpButton";
+
+const props = defineProps<{
+  chip: HttpButtonChip | null;
+  tooltipKey: I18nKey | null;
+  dataTest: string;
+  size?: ButtonSize;
+}>();
+
+const emit = defineEmits<{ (e: "click"): void }>();
+
+const { t } = useI18nTyped();
+
+const tooltip = computed(() => (props.tooltipKey ? t(props.tooltipKey) : undefined));
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpEndpointPanel.spec.ts b/web/src/components/workflows/WorkflowHttpEndpointPanel.spec.ts
new file mode 100644
index 0000000000..783b5eee4c
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpEndpointPanel.spec.ts
@@ -0,0 +1,244 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import { queryClient } from "@/composables/query/queryClient";
+import workflows from "@/services/workflows";
+import {
+  HTTP_TOKEN,
+  ODrawerStub,
+  OPopoverStub,
+  OSwitchStub,
+  RouterLinkStub,
+  httpAbsent,
+  httpConfig,
+} from "@/test/unit/helpers/workflowHttp";
+import WorkflowHttpEndpointPanel from "./WorkflowHttpEndpointPanel.vue";
+
+vi.mock("@/services/workflows", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: {
+      getHttpTrigger: vi.fn(),
+      putHttpTrigger: vi.fn(),
+      deleteHttpTrigger: vi.fn(),
+      rotateHttpCredential: vi.fn(),
+      revokeHttpCredential: vi.fn(),
+      revealHttpCredentialSecret: vi.fn(),
+    },
+    dryRunHook: vi.fn(),
+  });
+});
+const orgConfig = { is_org_admin: true };
+vi.mock("@/services/config", () => ({
+  default: { get_config: vi.fn(), get_config_full: vi.fn(async () => ({ data: orgConfig })) },
+}));
+
+const api = vi.mocked(workflows);
+const t = (k: string, v?: Record<string, unknown>) => i18n.global.t(k, v ?? {});
+const mounted: VueWrapper[] = [];
+
+const mountPanel = async (props: Record<string, unknown> = {}) => {
+  const wrapper = mount(WorkflowHttpEndpointPanel, {
+    props: {
+      open: true,
+      workflowId: "wf1",
+      workflowName: "Restart failed deploy",
+      kind: "alert_fired",
+      isDraftOnly: false,
+      workflowEnabled: true,
+      context: "editor",
+      ...props,
+    },
+    global: {
+      plugins: [i18n, store],
+      stubs: {
+        ODrawer: ODrawerStub,
+        OPopover: OPopoverStub,
+        OSwitch: OSwitchStub,
+        RouterLink: RouterLinkStub,
+      },
+    },
+  });
+  mounted.push(wrapper);
+  await flushPromises();
+  return wrapper;
+};
+
+const byTest = (w: VueWrapper, id: string) => w.find(`[data-test="${id}"]`);
+const drawer = (w: VueWrapper) => w.findComponent(ODrawerStub);
+
+describe("WorkflowHttpEndpointPanel", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    queryClient.clear();
+    store.state.selectedOrganization = { ...store.state.selectedOrganization, identifier: "acme" };
+    store.state.zoConfig = { ...store.state.zoConfig, rbac_enabled: false };
+    store.state.currentuser = { role: "admin" };
+    orgConfig.is_org_admin = true;
+    api.getHttpTrigger.mockResolvedValue(httpConfig());
+  });
+  afterEach(() => {
+    for (const w of mounted.splice(0)) w.unmount();
+  });
+
+  it("the panel is xl with the kind subtitle, name only without a trigger", async () => {
+    const w = await mountPanel();
+    expect(drawer(w).props("size")).toBe("xl");
+    expect(drawer(w).props("title")).toBe(t("workflow.http.panelTitle"));
+    expect(drawer(w).props("subTitle")).toBe(
+      t("workflow.http.panelSubtitle", { name: "Restart failed deploy", kind: "Alert Fired" }),
+    );
+    expect(drawer(w).attributes("data-test")).toBe("workflow-http-panel");
+    expect(drawer(w).props("persistent")).toBeFalsy();
+    const bare = await mountPanel({ kind: undefined });
+    expect(drawer(bare).props("subTitle")).toBe("Restart failed deploy");
+  });
+
+  it("an unnamed workflow reads Untitled Workflow in the subtitle, never a bare separator", async () => {
+    const w = await mountPanel({ workflowName: "" });
+    expect(drawer(w).props("subTitle")).toBe(
+      t("workflow.http.panelSubtitle", { name: "Untitled Workflow", kind: "Alert Fired" }),
+    );
+    const bare = await mountPanel({ workflowName: "  ", kind: undefined });
+    expect(drawer(bare).props("subTitle")).toBe("Untitled Workflow");
+  });
+
+  it("kind note on alert and incident workflows only", async () => {
+    const alert = await mountPanel();
+    expect(byTest(alert, "workflow-http-kind-note").text()).toContain("Alert Fired");
+    expect(byTest(alert, "workflow-http-kind-note").text()).toContain(
+      'meta.trigger_source = "http"',
+    );
+    await byTest(alert, "workflow-http-kind-note-payload").trigger("click");
+    expect(byTest(alert, "workflow-http-kind-note-sample").text()).toContain("trigger_source");
+    const incident = await mountPanel({ kind: "incident_event" });
+    expect(byTest(incident, "workflow-http-kind-note").text()).toContain("Incident Event");
+    const none = await mountPanel({ kind: undefined });
+    expect(byTest(none, "workflow-http-kind-note").exists()).toBe(false);
+  });
+
+  it("sets the field in monospace and pads the sample payload, as in the mockups", async () => {
+    const w = await mountPanel();
+    const note = byTest(w, "workflow-http-kind-note");
+    expect(note.find(".font-mono").text()).toBe('meta.trigger_source = "http"');
+    expect(note.text()).toContain(
+      'HTTP runs get the request instead (meta.trigger_source = "http"), so add a Condition if a step needs Alert Fired fields.',
+    );
+    await byTest(w, "workflow-http-kind-note-payload").trigger("click");
+    expect(w.findComponent({ name: "OCodeBlock" }).props("padded")).toBe(true);
+    expect(w.findComponent({ name: "OCodeBlock" }).props("wrap")).toBe(true);
+  });
+
+  it("unsaved workflow saves a draft then creates the endpoint", async () => {
+    api.getHttpTrigger.mockResolvedValue(httpAbsent());
+    api.putHttpTrigger.mockResolvedValue({ ...httpConfig(), secret: HTTP_TOKEN });
+    let w!: VueWrapper;
+    const beforeCreate = vi.fn(async () => {
+      await w.setProps({ workflowId: "wf9" });
+      return true;
+    });
+    w = await mountPanel({ workflowId: null, beforeCreate });
+    expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.unsavedBody"));
+    expect(byTest(w, "workflow-http-toggle").exists()).toBe(false);
+    await byTest(w, "workflow-http-save-and-create").trigger("click");
+    await flushPromises();
+    expect(beforeCreate).toHaveBeenCalledTimes(1);
+    expect(api.putHttpTrigger).toHaveBeenCalledWith(
+      expect.objectContaining({ id: "wf9", payload: { enabled: true, auth_mode: "token" } }),
+    );
+    expect(byTest(w, "workflow-http-reveal").exists()).toBe(true);
+  });
+
+  it("a false persistDraft adds no panel message", async () => {
+    const beforeCreate = vi.fn(async () => false);
+    const w = await mountPanel({ workflowId: null, beforeCreate });
+    const before = byTest(w, "workflow-http-section").text();
+    await byTest(w, "workflow-http-save-and-create").trigger("click");
+    await flushPromises();
+    expect(api.putHttpTrigger).not.toHaveBeenCalled();
+    expect(byTest(w, "workflow-http-section").text()).toBe(before);
+    expect(byTest(w, "workflow-http-error").exists()).toBe(false);
+  });
+
+  it("without credential access the unsaved panel shows the admin line and no button", async () => {
+    orgConfig.is_org_admin = false;
+    const beforeCreate = vi.fn(async () => true);
+    const w = await mountPanel({ workflowId: null, beforeCreate });
+    expect(byTest(w, "workflow-http-needs-admin").text()).toBe(t("workflow.http.needsAdmin"));
+    expect(byTest(w, "workflow-http-save-and-create").exists()).toBe(false);
+    expect(beforeCreate).not.toHaveBeenCalled();
+  });
+
+  it("draft shows the 403 banner", async () => {
+    const w = await mountPanel({ isDraftOnly: true });
+    expect(byTest(w, "workflow-http-draft-banner").text()).toBe(t("workflow.http.draftBanner"));
+  });
+
+  it("disabled shows workflow-http-disabled-banner", async () => {
+    const w = await mountPanel({ workflowEnabled: false });
+    expect(byTest(w, "workflow-http-disabled-banner").text()).toBe(
+      t("workflow.http.disabledBanner"),
+    );
+  });
+
+  it("Run test closes the panel and opens the Test dialog preset to HTTP request", async () => {
+    const order: string[] = [];
+    const w = await mountPanel({
+      "onUpdate:open": (v: boolean) => order.push(`open:${v}`),
+      onRunTest: () => order.push("run-test"),
+    });
+    await byTest(w, "workflow-http-run-test").trigger("click");
+    expect(order).toEqual(["open:false", "run-test"]);
+    const seed = w.emitted("run-test")?.[0][0] as { meta: Record<string, unknown> }[];
+    expect(seed[0].meta).toMatchObject({ trigger_source: "http", trigger_id: "test" });
+  });
+
+  it("View run closes the panel and reports the run", async () => {
+    api.getHttpTrigger.mockResolvedValue(
+      httpConfig({ last_call: { run_id: "r-9", status: "succeeded", received_at: 1 } }),
+    );
+    const order: string[] = [];
+    const w = await mountPanel({
+      "onUpdate:open": (v: boolean) => order.push(`open:${v}`),
+      onViewRun: (id: string) => order.push(`view:${id}`),
+    });
+    await byTest(w, "workflow-http-last-call-link").trigger("click");
+    expect(order).toEqual(["open:false", "view:r-9"]);
+  });
+
+  it("list context replaces Run test with Open the workflow", async () => {
+    const w = await mountPanel({ context: "list" });
+    expect(byTest(w, "workflow-http-run-test").exists()).toBe(false);
+    expect(byTest(w, "workflow-http-run-test-list-hint").exists()).toBe(true);
+  });
+
+  it("closing the panel unmounts the section and drops a revealed token", async () => {
+    api.getHttpTrigger.mockResolvedValue(httpAbsent());
+    api.putHttpTrigger.mockResolvedValue({ ...httpConfig(), secret: HTTP_TOKEN });
+    const w = await mountPanel();
+    await byTest(w, "workflow-http-toggle").trigger("click");
+    await flushPromises();
+    expect(byTest(w, "workflow-http-reveal").exists()).toBe(true);
+    await w.setProps({ open: false });
+    expect(byTest(w, "workflow-http-section").exists()).toBe(false);
+    await w.setProps({ open: true });
+    await flushPromises();
+    expect(byTest(w, "workflow-http-reveal").exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/workflows/WorkflowHttpEndpointPanel.vue b/web/src/components/workflows/WorkflowHttpEndpointPanel.vue
new file mode 100644
index 0000000000..f979a1ebc3
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpEndpointPanel.vue
@@ -0,0 +1,132 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <ODrawer
+    :open="open"
+    size="xl"
+    :title="t('workflow.http.panelTitle')"
+    :sub-title="subtitle"
+    data-test="workflow-http-panel"
+    @update:open="emit('update:open', $event)"
+  >
+    <div class="flex flex-col gap-4 p-4 text-left">
+      <template v-if="kind">
+        <OBanner variant="info" dense data-test="workflow-http-kind-note">
+          <i18n-t keypath="workflow.http.kindNote" tag="span" scope="global">
+            <template #kind>{{ kindLabel }}</template>
+            <template #field>
+              <OText variant="mono">{{ TRIGGER_SOURCE_FIELD }}</OText>
+            </template>
+          </i18n-t>
+          <OButton
+            variant="ghost-primary"
+            size="xs"
+            class="ms-1"
+            data-test="workflow-http-kind-note-payload"
+            @click="showPayload = !showPayload"
+          >
+            {{
+              showPayload
+                ? t("workflow.http.kindNotePayloadHide")
+                : t("workflow.http.kindNotePayload")
+            }}
+          </OButton>
+        </OBanner>
+        <OCodeBlock
+          v-if="showPayload"
+          :code="samplePayload"
+          lang="json"
+          padded
+          wrap
+          data-test="workflow-http-kind-note-sample"
+        />
+      </template>
+      <WorkflowHttpEndpointSection
+        :workflow-id="workflowId"
+        :workflow-name="workflowName"
+        :is-draft-only="isDraftOnly"
+        :workflow-enabled="workflowEnabled"
+        :context="context"
+        :before-create="beforeCreate"
+        :trigger-node-id="triggerNodeId"
+        @run-test="onRunTest"
+        @view-run="onViewRun"
+      />
+    </div>
+  </ODrawer>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OCodeBlock from "@/lib/core/Code/OCodeBlock.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import { triggerDef } from "@/plugins/workflows/triggers";
+import { httpPreviewSample } from "@/plugins/workflows/httpEndpointUi";
+import type { EndpointContext } from "@/plugins/workflows/useWorkflowHttpEndpoint";
+import WorkflowHttpEndpointSection from "./WorkflowHttpEndpointSection.vue";
+
+const TRIGGER_SOURCE_FIELD = 'meta.trigger_source = "http"';
+
+const props = defineProps<{
+  open: boolean;
+  workflowId: string | null;
+  workflowName: string;
+  /** Trigger kind; undefined while the workflow has no trigger node. */
+  kind?: string;
+  isDraftOnly: boolean;
+  workflowEnabled: boolean;
+  context: EndpointContext;
+  beforeCreate?: () => Promise<boolean>;
+  triggerNodeId?: string;
+}>();
+
+const emit = defineEmits<{
+  (e: "update:open", open: boolean): void;
+  (e: "run-test", seed: unknown[], runAt?: number): void;
+  (e: "view-run", runId: string): void;
+}>();
+
+const { t } = useI18nTyped();
+const showPayload = ref(false);
+
+const kindLabel = computed(() => (props.kind ? t(triggerDef(props.kind).labelKey) : raw("")));
+const displayName = computed(() =>
+  props.workflowName.trim() ? raw(props.workflowName) : t("workflow.namePlaceholder"),
+);
+const subtitle = computed(() =>
+  props.kind
+    ? t("workflow.http.panelSubtitle", { name: displayName.value, kind: kindLabel.value })
+    : displayName.value,
+);
+const samplePayload = computed(() => JSON.stringify(httpPreviewSample(), null, 2));
+
+// The editor opens Test on the canvas, so this panel must be gone first.
+const onRunTest = (seed: unknown[], runAt?: number) => {
+  emit("update:open", false);
+  emit("run-test", seed, runAt);
+};
+
+// The link may name the run already open, which changes no route, so the panel closes itself.
+const onViewRun = (runId: string) => {
+  emit("update:open", false);
+  emit("view-run", runId);
+};
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpEndpointSection.spec.ts b/web/src/components/workflows/WorkflowHttpEndpointSection.spec.ts
new file mode 100644
index 0000000000..023e267acf
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpEndpointSection.spec.ts
@@ -0,0 +1,1042 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import i18n from "@/locales";
+import enUS from "@/locales/languages/en-US.json";
+import store from "@/test/unit/helpers/store";
+import { queryClient } from "@/composables/query/queryClient";
+import workflows, { dryRunHook } from "@/services/workflows";
+import { copyPendingText, copyToClipboard } from "@/utils/clipboard";
+import {
+  HOUR_US,
+  HTTP_SECRET,
+  HTTP_TOKEN,
+  OPopoverStub,
+  OSwitchStub,
+  OTooltipStub,
+  hoverAndWait,
+  RouterLinkStub,
+  fullPermissions,
+  httpAbsent,
+  httpConfig,
+  httpCredential,
+} from "@/test/unit/helpers/workflowHttp";
+import WorkflowHttpEndpointSection from "./WorkflowHttpEndpointSection.vue";
+
+vi.mock("@/services/workflows", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: {
+      getHttpTrigger: vi.fn(),
+      putHttpTrigger: vi.fn(),
+      deleteHttpTrigger: vi.fn(),
+      rotateHttpCredential: vi.fn(),
+      revokeHttpCredential: vi.fn(),
+      revealHttpCredentialSecret: vi.fn(),
+      getWorkflowRun: vi.fn(),
+    },
+    dryRunHook: vi.fn(),
+  });
+});
+vi.mock("@/utils/clipboard", () => ({ copyToClipboard: vi.fn(), copyPendingText: vi.fn() }));
+vi.mock("@/services/config", () => ({
+  default: {
+    get_config: vi.fn(),
+    get_config_full: vi.fn(async () => ({ data: { is_org_admin: true } })),
+  },
+}));
+const mockToast = vi.fn();
+vi.mock("@/lib/feedback/Toast/useToast", () => ({
+  toast: (...a: unknown[]) => mockToast(...a),
+}));
+
+const api = vi.mocked(workflows);
+const RECENT_US = Date.now() * 1000;
+const t = (k: string, v?: Record<string, unknown>) => i18n.global.t(k, v ?? {});
+const mounted: VueWrapper[] = [];
+
+const mountSection = async (
+  props: Record<string, unknown> = {},
+  stubs: Record<string, unknown> = {},
+) => {
+  const wrapper = mount(WorkflowHttpEndpointSection, {
+    props: {
+      workflowId: "wf1",
+      workflowName: "Restart failed deploy",
+      isDraftOnly: false,
+      workflowEnabled: true,
+      context: "editor",
+      ...props,
+    },
+    global: {
+      plugins: [i18n, store],
+      stubs: {
+        OPopover: OPopoverStub,
+        OSwitch: OSwitchStub,
+        OTooltip: OTooltipStub,
+        RouterLink: RouterLinkStub,
+        ...stubs,
+      },
+    },
+    attachTo: document.body,
+  });
+  mounted.push(wrapper);
+  await flushPromises();
+  return wrapper;
+};
+
+const byTest = (w: VueWrapper, id: string) => w.find(`[data-test="${id}"]`);
+// Awaits the form's own submit chain (as OForm.spec does); the Save button is its submit button.
+const submitLimits = async (w: VueWrapper) => {
+  expect(byTest(w, "workflow-http-limits-save").attributes("type")).toBe("submit");
+  const form = byTest(w, "workflow-http-advanced").findComponent({ name: "OForm" });
+  await (
+    form.vm as unknown as { form: { handleSubmit: () => Promise<unknown> } }
+  ).form.handleSubmit();
+  await flushPromises();
+};
+
+describe("WorkflowHttpEndpointSection", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    queryClient.clear();
+    store.state.selectedOrganization = { ...store.state.selectedOrganization, identifier: "acme" };
+    store.state.zoConfig = { ...store.state.zoConfig, rbac_enabled: false };
+    store.state.currentuser = { role: "admin" };
+    api.getHttpTrigger.mockResolvedValue(httpConfig());
+    vi.mocked(copyToClipboard).mockResolvedValue(true);
+    vi.mocked(copyPendingText).mockImplementation(async (text) => {
+      await text;
+      return true;
+    });
+  });
+  afterEach(() => {
+    for (const w of mounted.splice(0)) w.unmount();
+  });
+
+  describe("off and loading states", () => {
+    it("renders the off state", async () => {
+      api.getHttpTrigger.mockResolvedValue(httpAbsent());
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-section").text()).toContain(
+        t("workflow.http.acceptRequests"),
+      );
+      expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.offBody"));
+      expect(byTest(w, "workflow-http-toggle").attributes("data-value")).toBe("false");
+      expect(byTest(w, "workflow-http-toggle").attributes("disabled")).toBeUndefined();
+    });
+
+    it("shows the load error with Retry and hides the switch", async () => {
+      api.getHttpTrigger.mockRejectedValue({ response: { status: 500, data: { message: "x" } } });
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.loadError"));
+      expect(byTest(w, "workflow-http-toggle").exists()).toBe(false);
+      api.getHttpTrigger.mockResolvedValue(httpAbsent());
+      const calls = api.getHttpTrigger.mock.calls.length;
+      await byTest(w, "workflow-http-retry").trigger("click");
+      await flushPromises();
+      expect(api.getHttpTrigger.mock.calls.length).toBeGreaterThan(calls);
+      expect(byTest(w, "workflow-http-toggle").exists()).toBe(true);
+    });
+
+    it("disables the switch without edit permission", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpAbsent({ permissions: { edit: false, test: false, reveal: false } }),
+      );
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-toggle").attributes("disabled")).toBeDefined();
+      expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.needsEdit"));
+    });
+
+    it("edit without reveal keeps the switch off and names the admin", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpAbsent({ permissions: { edit: true, test: true, reveal: false } }),
+      );
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-toggle").attributes("disabled")).toBeDefined();
+      expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.needsAdmin"));
+    });
+  });
+
+  describe("turning on (1.3)", () => {
+    beforeEach(() => {
+      api.getHttpTrigger.mockResolvedValue(httpAbsent());
+      api.putHttpTrigger.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(httpConfig());
+        return { ...httpConfig(), secret: HTTP_TOKEN };
+      });
+    });
+
+    it("turning on shows the masked reveal with data-o2-privacy=mask", async () => {
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      expect(api.putHttpTrigger).toHaveBeenCalledWith(
+        expect.objectContaining({ payload: { enabled: true, auth_mode: "token" } }),
+      );
+      const reveal = byTest(w, "workflow-http-reveal");
+      expect(reveal.attributes("data-o2-privacy")).toBe("mask");
+      expect(byTest(w, "workflow-http-token").attributes("data-o2-privacy")).toBe("mask");
+      expect(byTest(w, "workflow-http-snippet").attributes("data-o2-privacy")).toBe("mask");
+      expect(byTest(w, "workflow-http-reveal-banner").text()).toContain(
+        t("workflow.http.revealBannerTitle"),
+      );
+      expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.onMeta"));
+      expect(reveal.text()).not.toContain(HTTP_TOKEN);
+    });
+
+    it("sets the header in the token hint in monospace", async () => {
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      const hint = byTest(w, "workflow-http-secret-hint");
+      expect(hint.find(".font-mono").text()).toBe("Authorization: Bearer <token>");
+      expect(hint.text()).toBe(
+        t("workflow.http.tokenHint", { header: "Authorization: Bearer <token>" }),
+      );
+    });
+
+    it("the eye shows the token and copy copies the real token", async () => {
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      await byTest(w, "workflow-http-token-copy-btn").trigger("click");
+      expect(vi.mocked(copyToClipboard).mock.calls[0][0]).toBe(HTTP_TOKEN);
+      await byTest(w, "workflow-http-token-reveal-btn").trigger("click");
+      expect(byTest(w, "workflow-http-token").text()).toContain(HTTP_TOKEN);
+    });
+
+    it("every snippet tab is masked and carries the URL", async () => {
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      for (const lang of ["curl", "js", "python"]) {
+        await byTest(w, `workflow-http-snippet-tab-${lang}`).trigger("click");
+        const snippet = byTest(w, "workflow-http-snippet");
+        expect(snippet.text()).toContain(httpConfig().url);
+        expect(snippet.text()).not.toContain(HTTP_TOKEN);
+      }
+    });
+
+    it("Done ends the reveal and drops the value", async () => {
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      await byTest(w, "workflow-http-reveal-done").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-reveal").exists()).toBe(false);
+      expect(w.html()).not.toContain(HTTP_TOKEN);
+      expect(byTest(w, "workflow-http-credentials").exists()).toBe(true);
+    });
+
+    it("a failed PUT shows the error banner and reverts the switch", async () => {
+      api.putHttpTrigger.mockRejectedValue({
+        response: { status: 500, data: { message: "boom" } },
+      });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-error").text()).toBe(
+        t("workflow.http.turnOnFailed", { reason: "boom" }),
+      );
+      expect(byTest(w, "workflow-http-toggle").attributes("data-value")).toBe("false");
+    });
+
+    it("a 403 on create after the draft save says why and keeps the draft", async () => {
+      api.putHttpTrigger.mockRejectedValue({
+        response: { status: 403, data: { message: "Admin or Root role required to create" } },
+      });
+      const holder: { w?: VueWrapper } = {};
+      const beforeCreate = vi.fn(async () => {
+        await holder.w!.setProps({ workflowId: "wf9" });
+        return true;
+      });
+      holder.w = await mountSection({ workflowId: null, beforeCreate });
+      await byTest(holder.w, "workflow-http-save-and-create").trigger("click");
+      await flushPromises();
+      expect(beforeCreate).toHaveBeenCalledTimes(1);
+      expect(byTest(holder.w, "workflow-http-error").text()).toBe(
+        t("workflow.http.createForbidden"),
+      );
+      expect(t("workflow.http.createForbidden")).toBe(
+        "You can't create endpoint credentials in this organization.",
+      );
+      expect(holder.w.props("workflowId")).toBe("wf9");
+      expect(api.deleteHttpTrigger).not.toHaveBeenCalled();
+    });
+
+    it("a 200 PUT shows the endpoint-exists hint and no reveal", async () => {
+      api.putHttpTrigger.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(httpConfig());
+        return { ...httpConfig(), secret: null };
+      });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-reveal").exists()).toBe(false);
+      expect(byTest(w, "workflow-http-exists-hint").text()).toBe(
+        t("workflow.http.endpointExistsHint"),
+      );
+    });
+
+    it("the signed-mode hint names the Signing secrets table", async () => {
+      api.putHttpTrigger.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(httpConfig({ auth_mode: "signature" }));
+        return { ...httpConfig({ auth_mode: "signature" }), secret: null };
+      });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-exists-hint").text()).toBe(
+        t("workflow.http.endpointExistsHintSigned"),
+      );
+    });
+
+    it("shows the region host in super-cluster mode", async () => {
+      api.putHttpTrigger.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(httpConfig({ region_host: "eu1.o2.example.com" }));
+        return { ...httpConfig({ region_host: "eu1.o2.example.com" }), secret: HTTP_TOKEN };
+      });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-region").text()).toContain("eu1.o2.example.com");
+      expect(byTest(w, "workflow-http-region-banner").exists()).toBe(true);
+    });
+
+    it("single cluster shows no region tag or banner", async () => {
+      const w = await mountSection();
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-region").exists()).toBe(false);
+      expect(byTest(w, "workflow-http-region-banner").exists()).toBe(false);
+    });
+  });
+
+  describe("send test request (dry run)", () => {
+    const reveal = async (props: Record<string, unknown> = {}) => {
+      // Each mount in one test must start from no endpoint, not the previous mount's cached one.
+      queryClient.clear();
+      api.getHttpTrigger.mockResolvedValue(httpAbsent());
+      api.putHttpTrigger.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(httpConfig());
+        return { ...httpConfig(), secret: HTTP_TOKEN };
+      });
+      const w = await mountSection(props);
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      await flushPromises();
+      return w;
+    };
+
+    it("send test request shows Dry run accepted and the input", async () => {
+      vi.mocked(dryRunHook).mockResolvedValue({
+        status: 200,
+        reason: null,
+        input: { meta: { event_type: "webhook", trigger_source: "http" }, data: [{ a: 1 }] },
+        bodyBytes: 68,
+      });
+      const w = await reveal();
+      await byTest(w, "workflow-http-send-test").trigger("click");
+      await flushPromises();
+      const result = byTest(w, "workflow-http-test-result");
+      expect(result.text()).toContain("200");
+      expect(result.text()).toContain(t("workflow.http.dryRunAccepted"));
+      expect(result.text()).toContain(t("workflow.http.dryRunMeta", { size: "68 B" }));
+      expect(byTest(w, "workflow-http-test-input").text()).toContain("trigger_source");
+      const blocks = w.findAllComponents({ name: "OCodeBlock" });
+      expect(blocks).toHaveLength(3);
+      for (const block of blocks) expect(block.props("padded")).toBe(true);
+      // A long header value must wrap, not run past the panel edge.
+      expect(blocks.find((b) => b.props("lang") === "json")?.props("wrap")).toBe(true);
+      expect(vi.mocked(dryRunHook).mock.calls[0][0]).toMatchObject({
+        url: httpConfig().url,
+        token: HTTP_TOKEN,
+      });
+    });
+
+    it("maps 403 to Credentials valid in both auth modes and 429 to its copy", async () => {
+      vi.mocked(dryRunHook).mockResolvedValue({
+        status: 403,
+        reason: "workflow_not_published",
+        input: null,
+        bodyBytes: 68,
+      });
+      const w = await reveal();
+      await byTest(w, "workflow-http-send-test").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-test-result").text()).toContain(
+        t("workflow.http.dryRunRefused"),
+      );
+      expect(byTest(w, "workflow-http-run-test-instead").exists()).toBe(true);
+      await byTest(w, "workflow-http-run-test-instead").trigger("click");
+      expect(w.emitted("run-test")?.[0][0]).toEqual([
+        expect.objectContaining({ meta: expect.objectContaining({ trigger_source: "http" }) }),
+      ]);
+
+      vi.mocked(dryRunHook).mockResolvedValue({
+        status: 429,
+        reason: "rate_limited",
+        input: null,
+        bodyBytes: 68,
+      });
+      await byTest(w, "workflow-http-send-test").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-test-result").text()).toContain(
+        t("workflow.http.dryRunRateLimited"),
+      );
+    });
+
+    it("paused maps 403 to the paused copy", async () => {
+      vi.mocked(dryRunHook).mockResolvedValue({
+        status: 403,
+        reason: "workflow_disabled",
+        input: null,
+        bodyBytes: 2,
+      });
+      const w = await reveal({ workflowEnabled: false });
+      await byTest(w, "workflow-http-send-test").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-test-result").text()).toContain(
+        t("workflow.http.dryRunRefusedPaused"),
+      );
+    });
+
+    it("signed mode offers no Send test request and points to the example request", async () => {
+      api.putHttpTrigger.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(httpConfig({ auth_mode: "signature" }));
+        return { ...httpConfig({ auth_mode: "signature" }), secret: HTTP_SECRET };
+      });
+      const w = await mountSection();
+      await w.findComponent({ name: "OToggleGroup" }).vm.$emit("update:modelValue", "signature");
+      await byTest(w, "workflow-http-auth-switch-confirm").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-reveal").exists()).toBe(true);
+      expect(byTest(w, "workflow-http-send-test").exists()).toBe(false);
+      expect(byTest(w, "workflow-http-send-test-hint").text()).toBe(
+        t("workflow.http.sendTestSigned"),
+      );
+      expect(dryRunHook).not.toHaveBeenCalled();
+    });
+
+    it("the hint depends on the workflow state", async () => {
+      const live = await reveal();
+      expect(byTest(live, "workflow-http-send-test-hint").text()).toBe(
+        t("workflow.http.sendTestHint"),
+      );
+      const paused = await reveal({ workflowEnabled: false });
+      expect(byTest(paused, "workflow-http-send-test-hint").text()).toBe(
+        t("workflow.http.sendTestHintPaused"),
+      );
+      expect(t("workflow.http.sendTestHintPaused")).not.toContain("Draft");
+    });
+
+    it("a draft gets no Send test request, and its notice differs from the paused hint", async () => {
+      const draft = await reveal({ isDraftOnly: true });
+      expect(byTest(draft, "workflow-http-send-test").exists()).toBe(false);
+      expect(byTest(draft, "workflow-http-send-test-hint").exists()).toBe(false);
+      const notice = byTest(draft, "workflow-http-draft-banner").text();
+      expect(notice).toBe(t("workflow.http.draftBanner"));
+      expect(notice).not.toBe(t("workflow.http.sendTestHintPaused"));
+    });
+  });
+
+  describe("steady state (1.4)", () => {
+    it("switch off confirms in workflow-http-disable-popover with the 403 copy and PUTs enabled:false", async () => {
+      api.putHttpTrigger.mockResolvedValue({ ...httpConfig({ enabled: false }), secret: null });
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-toggle").attributes("data-value")).toBe("true");
+      await byTest(w, "workflow-http-toggle").trigger("click");
+      const popover = byTest(w, "workflow-http-disable-popover");
+      expect(popover.text()).toContain(t("workflow.http.disableTitle"));
+      expect(popover.text()).toContain(t("workflow.http.disableBody"));
+      expect(api.putHttpTrigger).not.toHaveBeenCalled();
+      await byTest(w, "workflow-http-disable-confirm").trigger("click");
+      await flushPromises();
+      expect(api.putHttpTrigger).toHaveBeenCalledWith(
+        expect.objectContaining({ payload: { enabled: false, auth_mode: "token" } }),
+      );
+    });
+
+    it("mode switch confirms in a popover and reveals the new secret", async () => {
+      api.putHttpTrigger.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(httpConfig({ auth_mode: "signature" }));
+        return { ...httpConfig({ auth_mode: "signature" }), secret: HTTP_SECRET };
+      });
+      const w = await mountSection();
+      await w.findComponent({ name: "OToggleGroup" }).vm.$emit("update:modelValue", "signature");
+      const popover = byTest(w, "workflow-http-auth-switch-popover");
+      expect(popover.text()).toContain(t("workflow.http.switchToSignedTitle"));
+      expect(popover.text()).toContain(t("workflow.http.switchToSignedBody"));
+      expect(api.putHttpTrigger).not.toHaveBeenCalled();
+      await byTest(w, "workflow-http-auth-switch-confirm").trigger("click");
+      await flushPromises();
+      expect(api.putHttpTrigger).toHaveBeenCalledWith(
+        expect.objectContaining({ payload: { enabled: true, auth_mode: "signature" } }),
+      );
+      expect(byTest(w, "workflow-http-reveal-banner").text()).toContain(
+        t("workflow.http.switchedBannerTitleSigned"),
+      );
+    });
+
+    it("workflow-http-last-call shows a failed status in the negative colour", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ last_call: { run_id: "r-9", status: "failed", received_at: 1 } }),
+      );
+      const w = await mountSection();
+      const status = byTest(w, "workflow-http-last-call-status");
+      expect(status.text()).toBe(t("workflow.http.lastCallStatus.failed"));
+      expect(status.classes()).toContain("text-status-negative");
+    });
+
+    it("dates the last call like the mockups", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({
+          last_call: { run_id: "r-9", status: "failed", received_at: 1_792_575_542_000_000 },
+        }),
+      );
+      const w = await mountSection();
+      const line = byTest(w, "workflow-http-last-call").text();
+      expect(line).toContain("Oct 21, 09:39");
+      expect(line).not.toContain("2026-10-21");
+    });
+
+    it("a succeeded last call reads positive", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ last_call: { run_id: "r-9", status: "succeeded", received_at: 1 } }),
+      );
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-last-call-status").classes()).toContain(
+        "text-status-positive",
+      );
+    });
+
+    it("workflow-http-last-call-link routes to the runs view with run_id", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ last_call: { run_id: "r-9", status: "failed", received_at: 1 } }),
+      );
+      const w = await mountSection();
+      const to = JSON.parse(byTest(w, "workflow-http-last-call-link").attributes("data-to")!);
+      expect(to).toMatchObject({ name: "workflowRuns", query: { id: "wf1", run_id: "r-9" } });
+    });
+
+    it("View run reports the run it opens", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ last_call: { run_id: "r-9", status: "failed", received_at: 1 } }),
+      );
+      const w = await mountSection();
+      await byTest(w, "workflow-http-last-call-link").trigger("click");
+      expect(w.emitted("view-run")).toEqual([["r-9"]]);
+    });
+
+    it("an endpoint that is off says calls are refused, not how to create one", async () => {
+      api.getHttpTrigger.mockResolvedValue(httpConfig({ enabled: false }));
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.offExistingBody"));
+      expect(byTest(w, "workflow-http-meta").text()).not.toBe(t("workflow.http.offBody"));
+    });
+
+    it("an endpoint that is off keeps its URL, tokens, revoke and settings", async () => {
+      api.getHttpTrigger.mockResolvedValue(httpConfig({ enabled: false }));
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-toggle").attributes("data-value")).toBe("false");
+      expect(byTest(w, "workflow-http-url").text()).toContain(httpConfig().url);
+      expect(byTest(w, "workflow-http-credential-c1-revoke").exists()).toBe(true);
+      expect(byTest(w, "workflow-http-rotate").exists()).toBe(true);
+    });
+
+    it("no calls shows No calls yet — send a test request", async () => {
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-last-call").text()).toBe(t("workflow.http.lastCallNone"));
+    });
+
+    it("a draft with no calls drops the send-a-test-request hint", async () => {
+      const w = await mountSection({ isDraftOnly: true });
+      expect(byTest(w, "workflow-http-last-call").text()).toBe(
+        t("workflow.http.lastCallNoneRefused"),
+      );
+    });
+
+    it("a paused workflow with no calls drops the send-a-test-request hint", async () => {
+      const w = await mountSection({ workflowEnabled: false });
+      expect(byTest(w, "workflow-http-disabled-banner").exists()).toBe(true);
+      expect(byTest(w, "workflow-http-last-call").text()).toBe(
+        t("workflow.http.lastCallNoneRefused"),
+      );
+      expect(byTest(w, "workflow-http-last-call").text()).not.toBe(t("workflow.http.lastCallNone"));
+    });
+
+    it("both modes show workflow-http-secret-storage-warning when secrets_encrypted_at_rest is false", async () => {
+      api.getHttpTrigger.mockResolvedValue(httpConfig({ secrets_encrypted_at_rest: false }));
+      const token = await mountSection();
+      expect(byTest(token, "workflow-http-secret-storage-warning").text()).toBe(
+        t("workflow.http.secretStorageWarning"),
+      );
+      queryClient.clear();
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ secrets_encrypted_at_rest: false, auth_mode: "signature" }),
+      );
+      const signed = await mountSection({ workflowId: "wf2" });
+      expect(byTest(signed, "workflow-http-secret-storage-warning").exists()).toBe(true);
+    });
+
+    it("no warning when encrypted", async () => {
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-secret-storage-warning").exists()).toBe(false);
+    });
+
+    it("the draft notice shows with the endpoint on, off or not set up", async () => {
+      const on = await mountSection({ isDraftOnly: true });
+      expect(byTest(on, "workflow-http-draft-banner").text()).toBe(t("workflow.http.draftBanner"));
+      expect(byTest(on, "workflow-http-run-test").exists()).toBe(true);
+      queryClient.clear();
+      api.getHttpTrigger.mockResolvedValue(httpConfig({ enabled: false }));
+      const off = await mountSection({ isDraftOnly: true, workflowId: "wf2" });
+      expect(byTest(off, "workflow-http-draft-banner").text()).toBe(t("workflow.http.draftBanner"));
+      queryClient.clear();
+      api.getHttpTrigger.mockResolvedValue(httpAbsent());
+      const none = await mountSection({ isDraftOnly: true, workflowId: "wf3" });
+      expect(byTest(none, "workflow-http-draft-banner").exists()).toBe(true);
+      queryClient.clear();
+      api.getHttpTrigger.mockResolvedValue(httpConfig({ enabled: false }));
+      const published = await mountSection({ workflowId: "wf4" });
+      expect(byTest(published, "workflow-http-draft-banner").exists()).toBe(false);
+    });
+
+    it("draft shows the 403 banner and a paused workflow the disabled banner", async () => {
+      const draft = await mountSection({ isDraftOnly: true });
+      expect(byTest(draft, "workflow-http-draft-banner").text()).toBe(
+        t("workflow.http.draftBanner"),
+      );
+      const paused = await mountSection({ workflowEnabled: false });
+      expect(byTest(paused, "workflow-http-disabled-banner").text()).toBe(
+        t("workflow.http.disabledBanner"),
+      );
+    });
+
+    it("no edit permission: values readable, Rotate/Revoke/Run test/Advanced hidden", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ permissions: { edit: false, test: false, reveal: false } }),
+      );
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-url").text()).toContain(httpConfig().url);
+      expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.readOnlyOnMeta"));
+      for (const id of [
+        "workflow-http-rotate",
+        "workflow-http-credential-c1-revoke",
+        "workflow-http-run-test",
+        "workflow-http-advanced",
+        "workflow-http-credential-c1-show",
+      ]) {
+        expect(byTest(w, id).exists(), id).toBe(false);
+      }
+      expect(byTest(w, "workflow-http-toggle").attributes("disabled")).toBeDefined();
+    });
+
+    it("without reveal the auth toggle is disabled and Rotate hidden", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ permissions: { edit: true, test: true, reveal: false } }),
+      );
+      const w = await mountSection();
+      expect(w.findComponent({ name: "OToggleGroup" }).props("disabled")).toBe(true);
+      expect(byTest(w, "workflow-http-rotate").exists()).toBe(false);
+      expect(byTest(w, "workflow-http-credential-reveal-denied").exists()).toBe(true);
+    });
+
+    it("Run test seeds the latest HTTP run's trigger input", async () => {
+      const records = [{ meta: { trigger_source: "http" }, data: [{ id: 7 }] }];
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ last_call: { run_id: "r9", status: "succeeded", received_at: 42 } }),
+      );
+      api.getWorkflowRun.mockResolvedValue({
+        data: { data: { output_map: { t1: records } } },
+      } as never);
+      const w = await mountSection({ triggerNodeId: "t1" });
+      await byTest(w, "workflow-http-run-test").trigger("click");
+      await flushPromises();
+      expect(w.emitted("run-test")?.[0]).toEqual([records, 42]);
+    });
+
+    it("Run test closes over the seed and has the editor tooltip", async () => {
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-run-test-tooltip").attributes("data-content")).toBe(
+        t("workflow.http.runTestHint"),
+      );
+      await byTest(w, "workflow-http-run-test").trigger("click");
+      const seed = w.emitted("run-test")?.[0][0] as { meta: { trigger_id: string } }[];
+      expect(seed[0].meta.trigger_id).toBe("test");
+    });
+
+    it("opens the Run test tooltip on hover over the whole button, not only its icon", async () => {
+      const w = await mountSection({}, { OTooltip: false });
+      await hoverAndWait(byTest(w, "workflow-http-run-test").element);
+      expect(document.body.textContent).toContain(t("workflow.http.runTestHint"));
+    });
+
+    it("list context replaces Run test with Open the workflow", async () => {
+      const w = await mountSection({ context: "list" });
+      expect(byTest(w, "workflow-http-run-test").exists()).toBe(false);
+      expect(byTest(w, "workflow-http-run-test-list-hint").text()).toBe(
+        t("workflow.http.runTestHintList"),
+      );
+    });
+
+    it("row Copy copies the live value and toasts", async () => {
+      api.revealHttpCredentialSecret.mockResolvedValue({ ...httpCredential(), secret: HTTP_TOKEN });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-credential-c1-copy").trigger("click");
+      await flushPromises();
+      await expect(vi.mocked(copyPendingText).mock.calls[0][0]).resolves.toBe(HTTP_TOKEN);
+      expect(mockToast).toHaveBeenCalledWith(
+        expect.objectContaining({ message: t("workflow.http.tokenCopied") }),
+      );
+    });
+
+    it("a refused clipboard write shows the copy error toast", async () => {
+      api.revealHttpCredentialSecret.mockResolvedValue({ ...httpCredential(), secret: HTTP_TOKEN });
+      vi.mocked(copyPendingText).mockImplementation(async (text) => {
+        await text;
+        return false;
+      });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-credential-c1-copy").trigger("click");
+      await flushPromises();
+      expect(mockToast).toHaveBeenCalledWith(
+        expect.objectContaining({ variant: "error", message: t("common.copyError") }),
+      );
+    });
+
+    it("rejection actions show only to a user who can perform them", async () => {
+      const rejections = {
+        rate_limited: { count_24h: 4, last_at: 1, last_ip: "1.2.3.4", window_start: RECENT_US },
+        credential_in_url: {
+          count_24h: 1,
+          last_at: 1,
+          last_ip: "1.2.3.4",
+          window_start: RECENT_US,
+        },
+      };
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ rejections, permissions: { edit: true, test: true, reveal: false } }),
+      );
+      const noReveal = await mountSection();
+      await byTest(noReveal, "workflow-http-rejections-show").trigger("click");
+      expect(byTest(noReveal, "workflow-http-rejection-raise-limit").exists()).toBe(true);
+      expect(byTest(noReveal, "workflow-http-rejection-rotate").exists()).toBe(false);
+      queryClient.clear();
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ rejections, permissions: { edit: false, test: false, reveal: false } }),
+      );
+      const viewer = await mountSection({ workflowId: "wf2" });
+      await byTest(viewer, "workflow-http-rejections-show").trigger("click");
+      expect(byTest(viewer, "workflow-http-rejection-rate_limited").exists()).toBe(true);
+      expect(byTest(viewer, "workflow-http-rejection-raise-limit").exists()).toBe(false);
+      expect(byTest(viewer, "workflow-http-rejection-rotate").exists()).toBe(false);
+    });
+
+    it("rotate is disabled with the tooltip while a credential is retiring", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({
+          credentials: [
+            httpCredential({ id: "c2" }),
+            httpCredential({
+              id: "c1",
+              state: "retiring",
+              expires_at: Date.now() * 1000 + 24 * HOUR_US,
+            }),
+          ],
+        }),
+      );
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-rotate").attributes("aria-disabled")).toBe("true");
+      expect(byTest(w, "workflow-http-rotate-blocked-tooltip").attributes("data-content")).toBe(
+        t("workflow.http.rotateBlocked"),
+      );
+    });
+  });
+
+  describe("advanced and delete", () => {
+    // OFormInput drops native min/max on purpose (OFormInput.spec), so the schema owns both caps.
+    // The xs field squeezed its label and help text into three lines.
+    it("the limit fields are wide enough for their label and help text on one line", async () => {
+      const w = await mountSection();
+      await byTest(w, "workflow-http-advanced").find("button").trigger("click");
+      await flushPromises();
+      const inputs = w.findAllComponents({ name: "OFormInput" });
+      expect(inputs.map((c) => c.props("name"))).toEqual(["maxBodyKib", "rateLimit"]);
+      for (const input of inputs) expect(input.props("width")).toBe("md");
+    });
+
+    it("rate field max is the org budget", async () => {
+      api.getHttpTrigger.mockResolvedValue(httpConfig({ org_rate_limit_per_minute: 600 }));
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-advanced").text()).toContain(
+        t("workflow.http.advancedSummary", { size: "1 MiB", count: 60 }, 60),
+      );
+      await byTest(w, "workflow-http-advanced").find("button").trigger("click");
+      await flushPromises();
+      expect(w.text()).toContain(t("workflow.http.rateLimitHint", { org: 600 }));
+      await byTest(w, "workflow-http-rate-limit-field").setValue("601");
+      await byTest(w, "workflow-http-max-body-field").setValue("1025");
+      await submitLimits(w);
+      expect(api.putHttpTrigger).not.toHaveBeenCalled();
+      expect(w.text()).toContain(t("workflow.http.rateLimitRange", { org: 600 }));
+      expect(w.text()).toContain(t("workflow.http.maxBodyRange"));
+      await byTest(w, "workflow-http-rate-limit-field").setValue("600");
+      await byTest(w, "workflow-http-max-body-field").setValue("1024");
+      api.putHttpTrigger.mockResolvedValue({ ...httpConfig(), secret: null });
+      await submitLimits(w);
+      expect(api.putHttpTrigger).toHaveBeenCalledTimes(1);
+    });
+
+    it("Delete endpoint confirms in workflow-http-delete-popover and workflow-http-delete-confirm calls DELETE", async () => {
+      api.deleteHttpTrigger.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(httpAbsent());
+      });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-advanced").find("button").trigger("click");
+      await flushPromises();
+      await byTest(w, "workflow-http-delete").trigger("click");
+      const popover = byTest(w, "workflow-http-delete-popover");
+      expect(popover.text()).toContain(t("workflow.http.deleteTitle"));
+      expect(popover.text()).toContain(t("workflow.http.deleteBody"));
+      await byTest(w, "workflow-http-delete-confirm").trigger("click");
+      await flushPromises();
+      expect(api.deleteHttpTrigger).toHaveBeenCalled();
+      expect(byTest(w, "workflow-http-meta").text()).toBe(t("workflow.http.offBody"));
+      expect(byTest(w, "workflow-http-toggle").attributes("data-value")).toBe("false");
+    });
+
+    it("Delete endpoint is hidden without edit permission", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ permissions: { ...fullPermissions(), edit: false } }),
+      );
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-delete").exists()).toBe(false);
+    });
+  });
+
+  describe("rejections line", () => {
+    it("is hidden at zero and opens the list on Show", async () => {
+      const quiet = await mountSection();
+      expect(byTest(quiet, "workflow-http-rejections-line").exists()).toBe(false);
+      queryClient.clear();
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({
+          rejections: {
+            rate_limited: { count_24h: 2, last_at: 1, last_ip: "1.2.3.4", window_start: RECENT_US },
+          },
+        }),
+      );
+      const w = await mountSection({ workflowId: "wf3" });
+      expect(byTest(w, "workflow-http-rejections-line").text()).toContain("2");
+      await byTest(w, "workflow-http-rejections-show").trigger("click");
+      expect(byTest(w, "workflow-http-rejection-rate_limited").exists()).toBe(true);
+    });
+  });
+
+  describe("rotate, revoke and limits", () => {
+    const NEW_TOKEN = "o2wh_NEWROTATEDTOKENVALUE000000002";
+
+    it("rotating reveals the new token above the tokens table with the retiring row (3.2)", async () => {
+      api.rotateHttpCredential.mockImplementation(async () => {
+        api.getHttpTrigger.mockResolvedValue(
+          httpConfig({
+            credentials: [
+              httpCredential({ id: "c2", display_prefix: "o2wh_NEWR…0002" }),
+              httpCredential({
+                id: "c1",
+                state: "retiring",
+                expires_at: Date.now() * 1000 + 24 * HOUR_US,
+              }),
+            ],
+          }),
+        );
+        return { ...httpCredential({ id: "c2" }), secret: NEW_TOKEN };
+      });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-rotate").trigger("click");
+      await byTest(w, "workflow-http-rotate-confirm").trigger("click");
+      await flushPromises();
+      expect(api.rotateHttpCredential).toHaveBeenCalledWith(
+        expect.objectContaining({ overlap_seconds: 86400 }),
+      );
+      expect(byTest(w, "workflow-http-reveal-banner").text()).toContain(
+        t("workflow.http.rotateBannerTitle"),
+      );
+      expect(byTest(w, "workflow-http-reveal-banner").text()).toContain(
+        t("workflow.http.rotateBannerBody"),
+      );
+      expect(byTest(w, "workflow-http-reveal").text()).toContain(t("workflow.http.newTokenLabel"));
+      expect(byTest(w, "workflow-http-reveal").text()).not.toContain(NEW_TOKEN);
+      expect(byTest(w, "workflow-http-url").exists()).toBe(false);
+      expect(byTest(w, "workflow-http-send-test").exists()).toBe(false);
+      expect(byTest(w, "workflow-http-credential-retiring").exists()).toBe(true);
+      expect(byTest(w, "workflow-http-credential-c1-show").exists()).toBe(true);
+      expect(byTest(w, "workflow-http-rotate").attributes("aria-disabled")).toBe("true");
+      await byTest(w, "workflow-http-reveal-done").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-reveal").exists()).toBe(false);
+      expect(byTest(w, "workflow-http-url").exists()).toBe(true);
+    });
+
+    it("after the active token is revoked, Rotate mints a new one", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({ credentials: [httpCredential({ state: "revoked" })] }),
+      );
+      api.rotateHttpCredential.mockResolvedValue({
+        ...httpCredential({ id: "c2" }),
+        secret: NEW_TOKEN,
+      });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-rotate").trigger("click");
+      expect(byTest(w, "workflow-http-rotate-popover").text()).toContain(
+        t("workflow.http.rotateLeadNone"),
+      );
+      await byTest(w, "workflow-http-rotate-confirm").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-reveal-banner").text()).toContain(
+        t("workflow.http.rotateBannerBodyFresh"),
+      );
+      expect(api.rotateHttpCredential).toHaveBeenCalledWith(
+        expect.objectContaining({ overlap_seconds: 0 }),
+      );
+      expect(byTest(w, "workflow-http-reveal").exists()).toBe(true);
+      expect(byTest(w, "workflow-http-rotate-popover").exists()).toBe(false);
+    });
+
+    it("a failed rotate keeps the popover open with the reason", async () => {
+      api.rotateHttpCredential.mockRejectedValue({ response: { data: { message: "busy" } } });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-rotate").trigger("click");
+      await byTest(w, "workflow-http-rotate-confirm").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-rotate-error").text()).toBe(
+        t("workflow.http.rotateFailed", { reason: "busy" }),
+      );
+    });
+
+    it("a rotate error is gone after the popover closes without Cancel", async () => {
+      api.rotateHttpCredential.mockRejectedValue({ response: { data: { message: "busy" } } });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-rotate").trigger("click");
+      await byTest(w, "workflow-http-rotate-confirm").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-rotate-error").exists()).toBe(true);
+      await byTest(w, "workflow-http-rotate").trigger("click");
+      await byTest(w, "workflow-http-rotate").trigger("click");
+      expect(byTest(w, "workflow-http-rotate-popover").exists()).toBe(true);
+      expect(byTest(w, "workflow-http-rotate-error").exists()).toBe(false);
+    });
+
+    it("row Revoke confirms, then revokes that credential", async () => {
+      api.revokeHttpCredential.mockResolvedValue(undefined);
+      const w = await mountSection();
+      await byTest(w, "workflow-http-credential-c1-revoke").trigger("click");
+      expect(api.revokeHttpCredential).not.toHaveBeenCalled();
+      await byTest(w, "workflow-http-credential-c1-revoke-confirm").trigger("click");
+      await flushPromises();
+      expect(api.revokeHttpCredential).toHaveBeenCalledWith(
+        expect.objectContaining({ credential_id: "c1" }),
+      );
+    });
+
+    it("cancelling the mode switch keeps the mode and sends nothing", async () => {
+      const w = await mountSection();
+      await w.findComponent({ name: "OToggleGroup" }).vm.$emit("update:modelValue", "signature");
+      await byTest(w, "workflow-http-auth-switch-cancel").trigger("click");
+      expect(byTest(w, "workflow-http-auth-switch-popover").exists()).toBe(false);
+      expect(api.putHttpTrigger).not.toHaveBeenCalled();
+      expect(w.findComponent({ name: "OToggleGroup" }).props("modelValue")).toBe("token");
+    });
+
+    it("Save sends the limits in bytes and per minute", async () => {
+      api.putHttpTrigger.mockResolvedValue({ ...httpConfig(), secret: null });
+      const w = await mountSection();
+      await byTest(w, "workflow-http-advanced").find("button").trigger("click");
+      await flushPromises();
+      await byTest(w, "workflow-http-max-body-field").setValue("512");
+      await byTest(w, "workflow-http-rate-limit-field").setValue("120");
+      await submitLimits(w);
+      expect(api.putHttpTrigger).toHaveBeenCalledWith(
+        expect.objectContaining({
+          payload: {
+            enabled: true,
+            auth_mode: "token",
+            max_body_bytes: 512 * 1024,
+            rate_limit_per_minute: 120,
+          },
+        }),
+      );
+    });
+
+    it("a rate above the org budget is refused before any PUT", async () => {
+      const w = await mountSection();
+      await byTest(w, "workflow-http-advanced").find("button").trigger("click");
+      await flushPromises();
+      await byTest(w, "workflow-http-rate-limit-field").setValue("5000");
+      await submitLimits(w);
+      expect(api.putHttpTrigger).not.toHaveBeenCalled();
+      expect(w.text()).toContain(t("workflow.http.rateLimitRange", { org: 1200 }));
+    });
+
+    it("Raise limit opens Advanced at the rate field", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({
+          rejections: {
+            rate_limited: { count_24h: 4, last_at: 1, last_ip: "1.2.3.4", window_start: RECENT_US },
+          },
+        }),
+      );
+      const w = await mountSection();
+      expect(byTest(w, "workflow-http-rate-limit-field").exists()).toBe(false);
+      await byTest(w, "workflow-http-rejections-show").trigger("click");
+      await byTest(w, "workflow-http-rejection-raise-limit").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-rate-limit-field").exists()).toBe(true);
+    });
+
+    it("a failed rejections refresh shows the load error with Retry", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        httpConfig({
+          rejections: {
+            invalid_token: {
+              count_24h: 1,
+              last_at: 1,
+              last_ip: "1.2.3.4",
+              window_start: RECENT_US,
+            },
+          },
+        }),
+      );
+      const w = await mountSection();
+      await byTest(w, "workflow-http-rejections-show").trigger("click");
+      api.getHttpTrigger.mockRejectedValue({ response: { status: 500 } });
+      await byTest(w, "workflow-http-rejections-refresh").trigger("click");
+      await flushPromises();
+      expect(byTest(w, "workflow-http-rejections").text()).toContain(
+        t("workflow.http.rejectionsLoadError"),
+      );
+      expect(byTest(w, "workflow-http-rejections-retry").exists()).toBe(true);
+    });
+  });
+
+  it("no workflow.http string says shown once", () => {
+    const banned = ["shown once", "only once", "can't be shown again", "copy it now"];
+    const values = JSON.stringify(enUS.workflow.http).toLowerCase();
+    for (const phrase of banned) expect(values).not.toContain(phrase);
+  });
+});
diff --git a/web/src/components/workflows/WorkflowHttpEndpointSection.vue b/web/src/components/workflows/WorkflowHttpEndpointSection.vue
new file mode 100644
index 0000000000..93e2c278aa
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpEndpointSection.vue
@@ -0,0 +1,374 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <section
+    data-test="workflow-http-section"
+    class="border-border-default bg-surface-base rounded-surface flex flex-col border"
+  >
+    <div class="flex items-start gap-3 p-4">
+      <div class="flex min-w-0 flex-1 flex-col gap-1">
+        <OText variant="body-strong">{{ t("workflow.http.acceptRequests") }}</OText>
+        <OSkeleton v-if="phase === 'loading'" class="h-3 w-48" data-test="workflow-http-loading" />
+        <OText
+          v-else-if="lastCall !== undefined"
+          variant="meta"
+          as="p"
+          data-test="workflow-http-meta"
+        >
+          <i18n-t
+            v-if="lastCall"
+            keypath="workflow.http.lastCall"
+            tag="span"
+            scope="global"
+            data-test="workflow-http-last-call"
+          >
+            <template #status>
+              <span :class="lastCallClass" data-test="workflow-http-last-call-status">
+                {{ t(LAST_CALL_STATUS_KEYS[lastCall.status]) }}
+              </span>
+            </template>
+            <template #time>
+              <OTimeCell
+                :value="lastCall.received_at"
+                unit="us"
+                mode="absolute"
+                :format="RUN_TIME_SHORT"
+                :timezone="store.state.timezone"
+              />
+            </template>
+            <template #link>
+              <RouterLink
+                :to="runsLink(lastCall.run_id)"
+                class="text-accent hover:underline"
+                data-test="workflow-http-last-call-link"
+                @click="emit('view-run', lastCall.run_id)"
+              >
+                {{ t("workflow.http.viewRun") }}
+              </RouterLink>
+            </template>
+          </i18n-t>
+          <span v-else data-test="workflow-http-last-call">{{
+            t(refusal ? "workflow.http.lastCallNoneRefused" : "workflow.http.lastCallNone")
+          }}</span>
+        </OText>
+        <OText v-else variant="meta" as="p" :data-test="metaTestId">{{ metaText }}</OText>
+      </div>
+      <OButton
+        v-if="phase === 'error'"
+        variant="outline"
+        size="xs"
+        data-test="workflow-http-retry"
+        @click="refresh"
+      >
+        {{ t("common.retry") }}
+      </OButton>
+      <OSkeleton v-else-if="phase === 'loading'" class="h-5 w-9 rounded-full" />
+      <OPopover
+        v-else-if="switchOn"
+        v-model:open="disableOpen"
+        side="bottom"
+        align="end"
+        :aria-label="t('workflow.http.disableTitle')"
+      >
+        <template #trigger>
+          <span class="inline-flex">
+            <span class="inline-flex" @click.stop>
+              <OSwitch
+                :model-value="true"
+                :disabled="!permissions.edit || saving"
+                data-test="workflow-http-toggle"
+                @update:model-value="onToggle"
+              />
+            </span>
+          </span>
+        </template>
+        <div
+          data-test="workflow-http-disable-popover"
+          class="flex w-80 max-w-[calc(100vw-1.5rem)] flex-col gap-2 p-3"
+        >
+          <OText variant="body-strong">{{ t("workflow.http.disableTitle") }}</OText>
+          <OText variant="meta" as="p">{{ t("workflow.http.disableBody") }}</OText>
+          <div class="flex justify-end gap-2">
+            <OButton
+              variant="outline"
+              size="sm-action"
+              data-test="workflow-http-disable-cancel"
+              @click="disableOpen = false"
+            >
+              {{ t("common.cancel") }}
+            </OButton>
+            <OButton
+              variant="primary"
+              size="sm-action"
+              :loading="saving"
+              data-test="workflow-http-disable-confirm"
+              @click="confirmTurnOff"
+            >
+              {{ t("workflow.http.disableConfirm") }}
+            </OButton>
+          </div>
+        </div>
+      </OPopover>
+      <OSwitch
+        v-else-if="phase !== 'unsaved'"
+        :model-value="false"
+        :disabled="!canTurnOn || saving"
+        data-test="workflow-http-toggle"
+        @update:model-value="onToggle"
+      />
+    </div>
+
+    <div v-if="hasBody" class="border-border-default flex flex-col gap-4 border-t p-4">
+      <OBanner
+        v-if="actionError"
+        variant="error-soft"
+        dense
+        data-test="workflow-http-error"
+        :content="actionError"
+      />
+      <OText v-if="endpointExists" variant="meta" as="p" data-test="workflow-http-exists-hint">
+        {{ existsHint }}
+      </OText>
+      <OButton
+        v-if="phase === 'unsaved' && canTurnOn"
+        variant="primary"
+        size="sm-action"
+        class="self-start"
+        :loading="creating"
+        data-test="workflow-http-save-and-create"
+        @click="onSaveAndCreate"
+      >
+        {{ t("workflow.http.saveAndCreate") }}
+      </OButton>
+      <OBanner
+        v-if="showDraftNotice"
+        variant="warning"
+        dense
+        data-test="workflow-http-draft-banner"
+        :content="t('workflow.http.draftBanner')"
+      />
+      <OBanner
+        v-else-if="status === 'paused'"
+        variant="warning"
+        dense
+        data-test="workflow-http-disabled-banner"
+        :content="t('workflow.http.disabledBanner')"
+      />
+      <WorkflowHttpReveal
+        v-if="phase === 'revealing'"
+        :context="context"
+        :refusal="refusal"
+        @run-test="onRunTest"
+      >
+        <WorkflowHttpSteady
+          v-if="revealKind === 'rotated'"
+          :context="context"
+          tokens-only
+          @run-test="onRunTest"
+        />
+      </WorkflowHttpReveal>
+      <WorkflowHttpSteady
+        v-else-if="phase === 'steady' || managesOffEndpoint"
+        :context="context"
+        @run-test="onRunTest"
+      />
+    </div>
+  </section>
+</template>
+
+<script setup lang="ts">
+import { computed, provide, ref, toRef } from "vue";
+import { useStore } from "vuex";
+import { useI18nTyped, type I18nText } from "@/types/i18n";
+import OText from "@/lib/core/Typography/OText.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OSwitch from "@/lib/forms/Switch/OSwitch.vue";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import OPopover from "@/lib/overlay/Popover/OPopover.vue";
+import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import { RUN_TIME_SHORT } from "@/plugins/workflows/runStatus";
+import {
+  useWorkflowHttpEndpoint,
+  type EndpointContext,
+} from "@/plugins/workflows/useWorkflowHttpEndpoint";
+import {
+  HTTP_ENDPOINT_KEY,
+  HttpEndpointError,
+  LAST_CALL_STATUS_KEYS,
+  httpErrorText,
+} from "@/plugins/workflows/httpEndpointUi";
+import WorkflowHttpReveal from "./WorkflowHttpReveal.vue";
+import WorkflowHttpSteady from "./WorkflowHttpSteady.vue";
+
+const props = defineProps<{
+  workflowId: string | null;
+  workflowName: string;
+  isDraftOnly: boolean;
+  workflowEnabled: boolean;
+  context: EndpointContext;
+  beforeCreate?: () => Promise<boolean>;
+  /** Run test reads the latest HTTP run's input from this step. */
+  triggerNodeId?: string;
+}>();
+
+const emit = defineEmits<{
+  (e: "run-test", seed: unknown[], runAt?: number): void;
+  (e: "view-run", runId: string): void;
+}>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+
+const endpoint = useWorkflowHttpEndpoint({
+  workflowId: toRef(props, "workflowId"),
+  isDraftOnly: toRef(props, "isDraftOnly"),
+  workflowEnabled: toRef(props, "workflowEnabled"),
+  context: props.context,
+  beforeCreate: props.beforeCreate,
+});
+provide(HTTP_ENDPOINT_KEY, endpoint);
+const {
+  phase,
+  status,
+  config,
+  permissions,
+  canTurnOn,
+  saving,
+  endpointExists,
+  revealKind,
+  refresh,
+} = endpoint;
+
+const actionError = ref<I18nText | null>(null);
+const disableOpen = ref(false);
+const creating = ref(false);
+
+const switchOn = computed(() => phase.value === "revealing" || !!config.value?.enabled);
+const refusal = computed<"draft" | "paused" | null>(() => {
+  if (props.isDraftOnly) return "draft";
+  return status.value === "paused" ? "paused" : null;
+});
+// Turning off must not hide revoke and delete, or a leaked token could only be revoked by turning it on.
+const managesOffEndpoint = computed(() => phase.value === "off" && !!config.value);
+// A draft refuses calls whether or not the endpoint is on, so the notice does not wait for it.
+const showDraftNotice = computed(() => props.isDraftOnly && phase.value !== "loading");
+const hasBody = computed(
+  () =>
+    phase.value === "unsaved" ||
+    phase.value === "revealing" ||
+    phase.value === "steady" ||
+    managesOffEndpoint.value ||
+    showDraftNotice.value ||
+    !!actionError.value ||
+    endpointExists.value,
+);
+
+// The status line replaces the meta only for an editor looking at a live endpoint.
+const lastCall = computed(() => {
+  if (phase.value !== "steady" || !permissions.value.edit) return undefined;
+  return config.value?.last_call ?? null;
+});
+const lastCallClass = computed(() => {
+  const s = lastCall.value?.status;
+  if (s === "succeeded") return "text-status-positive";
+  if (s === "failed") return "text-status-negative";
+  return "";
+});
+
+const metaText = computed<I18nText>(() => {
+  switch (phase.value) {
+    case "unsaved":
+      return canTurnOn.value ? t("workflow.http.unsavedBody") : t("workflow.http.needsAdmin");
+    case "error":
+      return t("workflow.http.loadError");
+    case "revealing":
+    case "steady":
+      return permissions.value.edit ? t("workflow.http.onMeta") : t("workflow.http.readOnlyOnMeta");
+    default:
+      if (!permissions.value.edit) return t("workflow.http.needsEdit");
+      if (config.value) return t("workflow.http.offExistingBody");
+      return canTurnOn.value ? t("workflow.http.offBody") : t("workflow.http.needsAdmin");
+  }
+});
+const metaTestId = computed(() =>
+  phase.value === "unsaved" && !canTurnOn.value
+    ? "workflow-http-needs-admin"
+    : "workflow-http-meta",
+);
+const existsHint = computed(() =>
+  config.value?.auth_mode === "signature"
+    ? t("workflow.http.endpointExistsHintSigned")
+    : t("workflow.http.endpointExistsHint"),
+);
+
+const runsLink = (runId: string) => ({
+  name: "workflowRuns",
+  query: {
+    id: props.workflowId,
+    name: props.workflowName,
+    org_identifier: store.state.selectedOrganization.identifier,
+    run_id: runId,
+  },
+});
+
+const turnOn = async () => {
+  actionError.value = null;
+  try {
+    await endpoint.turnOn();
+  } catch (err) {
+    actionError.value =
+      err instanceof HttpEndpointError && err.key === "workflow.http.createForbidden"
+        ? t(err.key)
+        : t("workflow.http.turnOnFailed", { reason: httpErrorText(err, t) });
+  }
+};
+
+const onToggle = async (value: unknown) => {
+  if (value !== true) {
+    disableOpen.value = true;
+    return;
+  }
+  await turnOn();
+};
+
+const onSaveAndCreate = async () => {
+  creating.value = true;
+  try {
+    await turnOn();
+  } finally {
+    creating.value = false;
+  }
+};
+
+const confirmTurnOff = async () => {
+  actionError.value = null;
+  try {
+    await endpoint.turnOff();
+    endpoint.endReveal();
+  } catch (err) {
+    actionError.value = t("workflow.http.changeFailed", { reason: httpErrorText(err, t) });
+  } finally {
+    disableOpen.value = false;
+  }
+};
+
+const onRunTest = async () => {
+  const action = await endpoint.runTest(props.triggerNodeId);
+  if (action.kind === "open_test") emit("run-test", action.seed, action.runAt);
+};
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpExample.spec.ts b/web/src/components/workflows/WorkflowHttpExample.spec.ts
new file mode 100644
index 0000000000..8abf03f205
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpExample.spec.ts
@@ -0,0 +1,200 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { computed, ref } from "vue";
+import { mount, flushPromises } from "@vue/test-utils";
+import i18n from "@/locales";
+import {
+  HTTP_ENDPOINT_KEY,
+  HttpEndpointError,
+  type WorkflowHttpEndpoint,
+} from "@/plugins/workflows/httpEndpointUi";
+import type { HttpTriggerConfig, HttpTriggerPermissions } from "@/services/workflows";
+import { httpConfig, httpCredential, OTooltipStub } from "@/test/unit/helpers/workflowHttp";
+import WorkflowHttpExample from "./WorkflowHttpExample.vue";
+
+const { mockToast } = vi.hoisted(() => ({ mockToast: vi.fn() }));
+vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: (...a: unknown[]) => mockToast(...a) }));
+
+const ROW_VALUE = "o2wh_ROWVALUEREVEALEDFROMTHETABLE01";
+
+const CodeBlockStub = {
+  name: "OCodeBlock",
+  props: ["code", "lang", "copyable", "wrap", "padded", "sensitive", "dataTest"],
+  template: `<div class="o-code"><pre class="o-code-text">{{ code }}</pre><slot name="actions" /></div>`,
+};
+const ButtonStub = {
+  name: "OButton",
+  props: ["variant", "size", "loading"],
+  emits: ["click"],
+  template: `<button v-bind="$attrs" @click="$emit('click')"><slot /></button>`,
+};
+
+const mountExample = (over: Partial<HttpTriggerConfig> = {}, perms?: HttpTriggerPermissions) => {
+  const config = ref(
+    httpConfig({
+      credentials: [httpCredential({ display_prefix: "o2wh_4fK9…oI4k" })],
+      ...(perms ? { permissions: perms } : {}),
+      ...over,
+    }),
+  );
+  const revealedCredentials = ref<Record<string, string>>({});
+  const endpoint = {
+    config,
+    permissions: computed(() => config.value.permissions),
+    activeCredential: computed(() => config.value.credentials.find((c) => c.state === "active")),
+    revealedCredentials,
+    revealing: ref<string | null>(null),
+    revealCredential: vi.fn(async (id: string) => {
+      revealedCredentials.value = { ...revealedCredentials.value, [id]: ROW_VALUE };
+    }),
+    hideCredential: vi.fn((id: string) => {
+      const { [id]: _gone, ...rest } = revealedCredentials.value;
+      revealedCredentials.value = rest;
+    }),
+    copyExample: vi.fn().mockResolvedValue(true),
+  };
+  const wrapper = mount(WorkflowHttpExample, {
+    global: {
+      plugins: [i18n],
+      provide: { [HTTP_ENDPOINT_KEY as symbol]: endpoint as unknown as WorkflowHttpEndpoint },
+      stubs: { OCodeBlock: CodeBlockStub, OButton: ButtonStub, OTooltip: OTooltipStub },
+    },
+  });
+  return { wrapper, endpoint };
+};
+
+const codeOf = (w: ReturnType<typeof mount>) => w.find(".o-code-text").text();
+
+describe("WorkflowHttpExample", () => {
+  beforeEach(() => mockToast.mockClear());
+
+  it("shows a bash curl call masked by the active credential's prefix, with its own copy button", () => {
+    const { wrapper } = mountExample();
+    const block = wrapper.findComponent(CodeBlockStub as never);
+    expect(block.props("lang")).toBe("bash");
+    expect(block.props("copyable")).toBe(false);
+    expect(block.props("sensitive")).toBe("");
+    expect(codeOf(wrapper)).toContain("Authorization: Bearer o2wh_4fK9••••");
+    expect(codeOf(wrapper)).toContain("oI4k");
+    expect(wrapper.find('[data-test="workflow-http-example-credential"]').text()).toContain(
+      "o2wh_4fK9…oI4k",
+    );
+    expect(wrapper.find('[data-test="workflow-http-example-copy"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="workflow-http-example-hint"]').text()).toContain(
+      "Postman or Insomnia",
+    );
+  });
+
+  it("the eye reveals and hides through the shared, audited row reveal", async () => {
+    const { wrapper, endpoint } = mountExample();
+    await wrapper.find('[data-test="workflow-http-example-reveal"]').trigger("click");
+    await flushPromises();
+    expect(endpoint.revealCredential).toHaveBeenCalledWith("c1");
+    expect(codeOf(wrapper)).toContain(`Bearer ${ROW_VALUE}`);
+
+    await wrapper.find('[data-test="workflow-http-example-reveal"]').trigger("click");
+    expect(endpoint.hideCredential).toHaveBeenCalledWith("c1");
+    expect(codeOf(wrapper)).not.toContain(ROW_VALUE);
+  });
+
+  it("copy goes through copyExample and toasts that the command was copied", async () => {
+    const { wrapper, endpoint } = mountExample();
+    await wrapper.find('[data-test="workflow-http-example-copy"]').trigger("click");
+    await flushPromises();
+    expect(endpoint.copyExample).toHaveBeenCalledTimes(1);
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({ variant: "success", message: "Command copied" }),
+    );
+  });
+
+  it("still says the command was copied after a mode switch", async () => {
+    const { wrapper, endpoint } = mountExample();
+    let finish!: (value: boolean) => void;
+    endpoint.copyExample.mockImplementationOnce(
+      () =>
+        new Promise<boolean>((resolve) => {
+          finish = resolve;
+        }),
+    );
+    await wrapper.find('[data-test="workflow-http-example-copy"]').trigger("click");
+    endpoint.config.value = { ...endpoint.config.value, auth_mode: "signature" };
+    finish(true);
+    await flushPromises();
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({ variant: "success", message: "Command copied" }),
+    );
+  });
+
+  it("a credential that changed mid-copy says the command was not copied", async () => {
+    const { wrapper, endpoint } = mountExample();
+    endpoint.copyExample.mockRejectedValueOnce(
+      new HttpEndpointError("workflow.http.copyCredentialChanged"),
+    );
+    await wrapper.find('[data-test="workflow-http-example-copy"]').trigger("click");
+    await flushPromises();
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({
+        variant: "error",
+        message: "Couldn't copy the command. Credential changed. Copy again.",
+      }),
+    );
+  });
+
+  it("without reveal permission the placeholder command copies with the same toast", async () => {
+    const { wrapper } = mountExample({}, { edit: false, test: false, reveal: false });
+    await wrapper.find('[data-test="workflow-http-example-copy"]').trigger("click");
+    await flushPromises();
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({ variant: "success", message: "Command copied" }),
+    );
+  });
+
+  it("the hint names a placeholder when the copy carries no credential", () => {
+    const hint = (w: ReturnType<typeof mountExample>["wrapper"]) =>
+      w.find('[data-test="workflow-http-example-hint"]').text();
+    const noReveal = mountExample({}, { edit: false, test: false, reveal: false }).wrapper;
+    expect(hint(noReveal)).toContain("placeholder where the token goes");
+    const noActive = mountExample({ credentials: [httpCredential({ state: "revoked" })] }).wrapper;
+    expect(hint(noActive)).toContain("placeholder where the token goes");
+    const signed = mountExample(
+      { auth_mode: "signature", credentials: [] },
+      { edit: false, test: false, reveal: false },
+    ).wrapper;
+    expect(hint(signed)).toContain("placeholder where the secret goes");
+    expect(hint(mountExample().wrapper)).toContain("Copy includes the token");
+  });
+
+  it("without reveal permission shows placeholders and no eye", () => {
+    const { wrapper } = mountExample({}, { edit: false, test: false, reveal: false });
+    expect(codeOf(wrapper)).toContain("$O2_HOOK_TOKEN");
+    expect(codeOf(wrapper)).not.toContain("••••");
+    expect(wrapper.find('[data-test="workflow-http-example-reveal"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="workflow-http-example-copy"]').exists()).toBe(true);
+  });
+
+  it("signed mode shows the openssl signing script and its own hint", () => {
+    const { wrapper } = mountExample({
+      auth_mode: "signature",
+      credentials: [httpCredential({ kind: "signing_secret", display_prefix: "whsec_Ab12…Yz90" })],
+    });
+    expect(codeOf(wrapper)).toContain("SECRET='whsec_Ab12••••");
+    expect(codeOf(wrapper)).toContain("openssl dgst -sha256");
+    expect(wrapper.find('[data-test="workflow-http-example-hint"]').text()).toContain(
+      "Import tools cannot sign",
+    );
+  });
+});
diff --git a/web/src/components/workflows/WorkflowHttpExample.vue b/web/src/components/workflows/WorkflowHttpExample.vue
new file mode 100644
index 0000000000..80bb20cf2a
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpExample.vue
@@ -0,0 +1,162 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div
+    v-if="config"
+    class="flex flex-col gap-1"
+    data-test="workflow-http-example"
+    data-o2-privacy="mask"
+  >
+    <OText as="label" class="text-xs font-medium">{{ t("workflow.http.exampleRequest") }}</OText>
+    <OCodeBlock
+      :code="code"
+      lang="bash"
+      sensitive
+      padded
+      wrap
+      :copyable="false"
+      class="my-0!"
+      data-test="workflow-http-example-code"
+    >
+      <template #actions>
+        <span
+          v-if="active"
+          class="text-text-secondary inline-flex min-w-0 items-center gap-1 pe-1 text-xs"
+          data-test="workflow-http-example-credential"
+        >
+          <OIcon name="key" size="xs" class="shrink-0" />
+          <OTruncatedText :tooltip="false">{{ credentialLabel }}</OTruncatedText>
+        </span>
+        <OButton
+          v-if="canReveal && active"
+          variant="ghost"
+          size="icon-xs-sq"
+          :loading="revealing === active.id"
+          :aria-label="revealLabel"
+          data-test="workflow-http-example-reveal"
+          @click="toggleReveal"
+        >
+          <OIcon :name="shown !== undefined ? 'visibility-off' : 'visibility'" size="sm" />
+          <OTooltip :content="revealLabel" side="top" />
+        </OButton>
+        <OButton
+          variant="ghost"
+          size="icon-xs-sq"
+          :aria-label="t('common.copy')"
+          data-test="workflow-http-example-copy"
+          @click="onCopy"
+        >
+          <OIcon name="content-copy" size="sm" />
+          <OTooltip :content="t('common.copy')" side="top" />
+        </OButton>
+      </template>
+    </OCodeBlock>
+    <OText variant="meta" as="p" data-test="workflow-http-example-hint">
+      {{ t(hintKey) }}
+    </OText>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { raw, useI18nTyped, type I18nKey } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OCodeBlock from "@/lib/core/Code/OCodeBlock.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import { DEFAULT_SAMPLE_BODY, buildSnippet, maskSecret } from "@/plugins/workflows/httpSnippets";
+import { httpErrorText, useHttpEndpoint } from "@/plugins/workflows/httpEndpointUi";
+
+const { t } = useI18nTyped();
+const {
+  config,
+  permissions,
+  activeCredential: active,
+  revealedCredentials,
+  revealing,
+  revealCredential,
+  hideCredential,
+  copyExample,
+} = useHttpEndpoint();
+
+const isSigned = computed(() => config.value?.auth_mode === "signature");
+const canReveal = computed(() => permissions.value.reveal);
+// Copy only fetches the real credential when the viewer may reveal an active one.
+const hintKey = computed<I18nKey>(() => {
+  const real = canReveal.value && !!active.value;
+  if (isSigned.value)
+    return real ? "workflow.http.exampleHintSigned" : "workflow.http.exampleHintSignedPlaceholder";
+  return real ? "workflow.http.exampleHintToken" : "workflow.http.exampleHintTokenPlaceholder";
+});
+const shown = computed(() =>
+  active.value ? revealedCredentials.value[active.value.id] : undefined,
+);
+
+const secret = computed<string | null>(() => {
+  if (!canReveal.value || !active.value) return null;
+  return shown.value ?? maskSecret(active.value.display_prefix);
+});
+
+const code = computed(() =>
+  config.value
+    ? buildSnippet("curl", {
+        url: config.value.url,
+        mode: config.value.auth_mode,
+        secret: secret.value,
+        sampleBody: DEFAULT_SAMPLE_BODY,
+      })
+    : "",
+);
+
+const credentialLabel = computed(() => {
+  const prefix = raw(active.value?.display_prefix ?? "");
+  return isSigned.value
+    ? t("workflow.http.exampleActiveSecret", { prefix })
+    : t("workflow.http.exampleActiveToken", { prefix });
+});
+
+const revealLabel = computed(() => {
+  if (shown.value !== undefined) return t("ingestion.setupCard.hideToken");
+  return t("ingestion.setupCard.revealToken");
+});
+
+const toggleReveal = () => {
+  const id = active.value?.id;
+  if (!id) return;
+  if (shown.value !== undefined) hideCredential(id);
+  else void revealCredential(id);
+};
+
+const onCopy = async () => {
+  try {
+    const copied = await copyExample();
+    if (!copied) {
+      toast({ variant: "error", message: t("common.copyError") });
+      return;
+    }
+    toast({ variant: "success", message: t("workflow.http.commandCopied") });
+  } catch (err) {
+    toast({
+      variant: "error",
+      message: t("workflow.http.copyCommandFailed", { reason: httpErrorText(err, t) }),
+    });
+  }
+};
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpRejections.spec.ts b/web/src/components/workflows/WorkflowHttpRejections.spec.ts
new file mode 100644
index 0000000000..b0dd33d935
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpRejections.spec.ts
@@ -0,0 +1,148 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import type { HttpRejection } from "@/services/workflows";
+import WorkflowHttpRejections from "./WorkflowHttpRejections.vue";
+
+const t = (k: string, v?: Record<string, unknown>) => i18n.global.t(k, v ?? {});
+const HOUR_US = 3_600_000_000;
+const rej = (
+  count: number,
+  last = 1_792_575_542_000_000,
+  windowStart = Date.now() * 1000 - HOUR_US,
+): HttpRejection => ({
+  count_24h: count,
+  last_at: last,
+  last_ip: "10.0.0.7",
+  window_start: windowStart,
+});
+
+const mountRejections = (props: Record<string, unknown> = {}) =>
+  mount(WorkflowHttpRejections, {
+    props: {
+      rejections: {
+        invalid_token: rej(3),
+        rate_limited: rej(9),
+        credential_in_url: rej(1),
+      },
+      triggerLimit: 60,
+      orgBudget: 1200,
+      maxBodyBytes: 1_048_576,
+      loading: false,
+      error: false,
+      canRaise: true,
+      canRotate: true,
+      ...props,
+    },
+    global: { plugins: [i18n, store] },
+  });
+
+const byTest = (w: ReturnType<typeof mountRejections>, id: string) => w.find(`[data-test="${id}"]`);
+const open = async (w: ReturnType<typeof mountRejections>) =>
+  byTest(w, "workflow-http-rejections-show").trigger("click");
+
+describe("WorkflowHttpRejections", () => {
+  it("summarises the total and the latest reason", () => {
+    const w = mountRejections();
+    const line = byTest(w, "workflow-http-rejections-line").text();
+    expect(line).toContain("13");
+    expect(line).toContain(t("workflow.http.reason.invalid_token.title"));
+  });
+
+  it("renders nothing at zero", () => {
+    const w = mountRejections({ rejections: {} });
+    expect(byTest(w, "workflow-http-rejections-line").exists()).toBe(false);
+  });
+
+  it("rows sort by count", async () => {
+    const w = mountRejections();
+    await open(w);
+    const ids = w
+      .findAll("[data-test^='workflow-http-rejection-']")
+      .map((r) => r.attributes("data-test"))
+      .filter((id) => !id?.endsWith("raise-limit") && !id?.endsWith("rotate"));
+    expect(ids).toEqual([
+      "workflow-http-rejection-rate_limited",
+      "workflow-http-rejection-invalid_token",
+      "workflow-http-rejection-credential_in_url",
+    ]);
+    expect(byTest(w, "workflow-http-rejection-rate_limited").text()).toContain("429");
+    expect(byTest(w, "workflow-http-rejection-rate_limited").text()).toContain("10.0.0.7");
+  });
+
+  it("raise limit is hidden at the org budget", async () => {
+    const below = mountRejections();
+    await open(below);
+    await byTest(below, "workflow-http-rejection-raise-limit").trigger("click");
+    expect(below.emitted("raise-limit")).toHaveLength(1);
+    const at = mountRejections({ triggerLimit: 1200 });
+    await open(at);
+    expect(byTest(at, "workflow-http-rejection-raise-limit").exists()).toBe(false);
+  });
+
+  it("credential_in_url links to rotate", async () => {
+    const w = mountRejections();
+    await open(w);
+    await byTest(w, "workflow-http-rejection-rotate").trigger("click");
+    expect(w.emitted("rotate")).toHaveLength(1);
+  });
+
+  it("a window that started 24 h ago or more counts nothing", async () => {
+    const w = mountRejections({
+      rejections: {
+        invalid_token: rej(30, 1, Date.now() * 1000 - 25 * HOUR_US),
+        rate_limited: rej(2),
+      },
+    });
+    expect(byTest(w, "workflow-http-rejections-line").text()).toContain("2");
+    expect(byTest(w, "workflow-http-rejections-line").text()).not.toContain("30");
+    await open(w);
+    expect(byTest(w, "workflow-http-rejection-invalid_token").exists()).toBe(false);
+    const stale = mountRejections({
+      rejections: { invalid_token: rej(30, 1, Date.now() * 1000 - 25 * HOUR_US) },
+    });
+    expect(byTest(stale, "workflow-http-rejections-line").exists()).toBe(false);
+  });
+
+  it("hides Raise limit and Rotate from a user who cannot do them", async () => {
+    const w = mountRejections({ canRaise: false, canRotate: false });
+    await open(w);
+    expect(byTest(w, "workflow-http-rejection-rate_limited").exists()).toBe(true);
+    expect(byTest(w, "workflow-http-rejection-raise-limit").exists()).toBe(false);
+    expect(byTest(w, "workflow-http-rejection-rotate").exists()).toBe(false);
+  });
+
+  it("refresh refetches", async () => {
+    const w = mountRejections();
+    await open(w);
+    await byTest(w, "workflow-http-rejections-refresh").trigger("click");
+    expect(w.emitted("refresh")).toHaveLength(1);
+  });
+
+  it("loading shows 3 skeleton rows and an error shows Retry", async () => {
+    const loading = mountRejections({ loading: true });
+    await open(loading);
+    expect(loading.findAll("[data-test='workflow-http-rejections-skeleton']")).toHaveLength(3);
+    const failed = mountRejections({ error: true });
+    await open(failed);
+    expect(failed.text()).toContain(t("workflow.http.rejectionsLoadError"));
+    await byTest(failed, "workflow-http-rejections-retry").trigger("click");
+    expect(failed.emitted("refresh")).toHaveLength(1);
+  });
+});
diff --git a/web/src/components/workflows/WorkflowHttpRejections.vue b/web/src/components/workflows/WorkflowHttpRejections.vue
new file mode 100644
index 0000000000..48f32a3895
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpRejections.vue
@@ -0,0 +1,241 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div
+    v-if="total > 0 && !open"
+    data-test="workflow-http-rejections-line"
+    class="flex flex-wrap items-center gap-2"
+  >
+    <OIcon name="warning" size="sm" class="text-status-warning-text shrink-0" />
+    <OText as="span" class="min-w-0">{{ lineText }}</OText>
+    <OButton
+      variant="ghost-primary"
+      size="xs"
+      data-test="workflow-http-rejections-show"
+      @click="open = true"
+    >
+      {{ t("workflow.http.rejectionsShow") }}
+    </OButton>
+  </div>
+  <section
+    v-else-if="total > 0"
+    data-test="workflow-http-rejections"
+    class="border-border-default rounded-default flex flex-col border"
+  >
+    <div class="flex items-center gap-2 px-3 py-2">
+      <OButton
+        variant="ghost"
+        size="icon-xs-sq"
+        :aria-label="t('workflow.http.rejectionsHide')"
+        data-test="workflow-http-rejections-hide"
+        @click="open = false"
+      >
+        <OIcon name="expand-more" size="sm" />
+      </OButton>
+      <OText variant="body-strong">{{ t("workflow.http.rejectionsTitle") }}</OText>
+      <OText variant="meta" class="min-w-0 flex-1">
+        {{ t("workflow.http.rejectionsCaption", { count: total }, total) }}
+      </OText>
+      <ORefreshButton
+        layout="inline"
+        variant="ghost"
+        :loading="loading"
+        data-test="workflow-http-rejections-refresh"
+        @click="emit('refresh')"
+      />
+    </div>
+
+    <div v-if="loading" class="flex flex-col gap-2 px-3 pb-3">
+      <OSkeleton
+        v-for="n in 3"
+        :key="n"
+        class="h-10 w-full"
+        data-test="workflow-http-rejections-skeleton"
+      />
+    </div>
+    <div v-else-if="error" class="flex items-center gap-3 px-3 pb-3">
+      <OText variant="meta" class="text-status-negative min-w-0 flex-1">
+        {{ t("workflow.http.rejectionsLoadError") }}
+      </OText>
+      <OButton
+        variant="outline"
+        size="xs"
+        data-test="workflow-http-rejections-retry"
+        @click="emit('refresh')"
+      >
+        {{ t("common.retry") }}
+      </OButton>
+    </div>
+    <ul v-else class="divide-border-default flex flex-col divide-y px-3">
+      <li
+        v-for="row in rows"
+        :key="row.reason"
+        :data-test="`workflow-http-rejection-${row.reason}`"
+        class="flex items-start gap-3 py-3"
+      >
+        <OTag
+          type="httpStatus"
+          :value="httpStatusBucket(row.status)"
+          :label="raw(row.status)"
+          class="shrink-0"
+        />
+        <div class="flex min-w-0 flex-1 flex-col gap-1">
+          <OText as="p" class="flex flex-wrap items-baseline gap-x-1">
+            <span class="text-text-heading font-medium">
+              {{ t(HOOK_REASON_KEYS[row.reason].title) }}
+            </span>
+            <span class="text-text-secondary">{{ rowMeta(row) }}</span>
+          </OText>
+          <OText variant="meta" as="p">{{ fixText(row.reason) }}</OText>
+        </div>
+        <OButton
+          v-if="canRaise && row.reason === 'rate_limited' && triggerLimit < orgBudget"
+          variant="ghost-primary"
+          size="xs"
+          class="shrink-0"
+          data-test="workflow-http-rejection-raise-limit"
+          @click="emit('raise-limit')"
+        >
+          {{ t("workflow.http.raiseLimit") }}
+        </OButton>
+        <OButton
+          v-else-if="canRotate && row.reason === 'credential_in_url'"
+          variant="ghost-primary"
+          size="xs"
+          class="shrink-0"
+          data-test="workflow-http-rejection-rotate"
+          @click="emit('rotate')"
+        >
+          {{ t("workflow.http.rotateLink") }}
+        </OButton>
+      </li>
+    </ul>
+  </section>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { useStore } from "vuex";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
+import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
+import { httpStatusBucket } from "@/lib/core/Badge/badgeGroups";
+import { formatTimestampInTimezone } from "@/utils/date";
+import type { HookReasonCode, HttpRejection } from "@/services/workflows";
+import {
+  HOOK_REASON_KEYS,
+  HOOK_REASON_STATUS,
+  ORG_QUEUE_MAX,
+  formatBodySize,
+} from "@/plugins/workflows/httpEndpointUi";
+
+interface RejectionRow extends HttpRejection {
+  reason: HookReasonCode;
+  status: number;
+}
+
+const TIME_FORMAT = "MMM D, HH:mm";
+// The server resets a reason's window only when a new rejection merges (REJECTION_WINDOW_US).
+const REJECTION_WINDOW_US = 24 * 3_600_000_000;
+
+const props = defineProps<{
+  rejections: Partial<Record<HookReasonCode, HttpRejection>>;
+  triggerLimit: number;
+  orgBudget: number;
+  maxBodyBytes: number;
+  loading: boolean;
+  error: boolean;
+  canRaise: boolean;
+  canRotate: boolean;
+}>();
+
+const emit = defineEmits<{
+  (e: "rotate"): void;
+  (e: "raise-limit"): void;
+  (e: "refresh"): void;
+}>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+
+const open = ref(false);
+
+const rows = computed<RejectionRow[]>(() => {
+  const windowFloor = Date.now() * 1000 - REJECTION_WINDOW_US;
+  return (Object.entries(props.rejections) as [HookReasonCode, HttpRejection | undefined][])
+    .filter(
+      (entry): entry is [HookReasonCode, HttpRejection] =>
+        !!entry[1]?.count_24h && entry[1].window_start > windowFloor,
+    )
+    .map(([reason, r]) => ({ ...r, reason, status: HOOK_REASON_STATUS[reason] }))
+    .sort((a, b) => b.count_24h - a.count_24h);
+});
+const total = computed(() => rows.value.reduce((sum, r) => sum + r.count_24h, 0));
+// Walks the server's order, not the count order, so a tie names the first reason stored.
+const latest = computed(() => {
+  let best: RejectionRow | undefined;
+  for (const reason of Object.keys(props.rejections) as HookReasonCode[]) {
+    const r = rows.value.find((row) => row.reason === reason);
+    if (r && (!best || r.last_at > best.last_at)) best = r;
+  }
+  return best;
+});
+
+const formatTime = (us: number) =>
+  raw(formatTimestampInTimezone(us, TIME_FORMAT, store.state.timezone));
+
+const lineText = computed<I18nText>(() => {
+  const last = latest.value;
+  if (!last) return raw("");
+  return t(
+    "workflow.http.rejectionsLine",
+    {
+      count: total.value,
+      reason: t(HOOK_REASON_KEYS[last.reason].title),
+      time: formatTime(last.last_at),
+    },
+    total.value,
+  );
+});
+
+const rowMeta = (row: RejectionRow) =>
+  t(
+    "workflow.http.rejectionMeta",
+    { count: row.count_24h, time: formatTime(row.last_at), ip: raw(row.last_ip) },
+    row.count_24h,
+  );
+
+const fixText = (reason: HookReasonCode): I18nText => {
+  const key = HOOK_REASON_KEYS[reason].fix;
+  switch (reason) {
+    case "invalid_signature":
+      return t(key, { format: raw("webhook-id.webhook-timestamp.body") });
+    case "payload_too_large":
+      return t(key, { size: formatBodySize(props.maxBodyBytes, t) });
+    case "rate_limited":
+      return t(key, { count: props.triggerLimit, org: props.orgBudget });
+    case "queue_full":
+      return t(key, { count: ORG_QUEUE_MAX });
+    default:
+      return t(key);
+  }
+};
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpReveal.vue b/web/src/components/workflows/WorkflowHttpReveal.vue
new file mode 100644
index 0000000000..393c5233b9
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpReveal.vue
@@ -0,0 +1,274 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div data-test="workflow-http-reveal" data-o2-privacy="mask" class="flex flex-col gap-4">
+    <OBanner variant="success" icon="check-circle" data-test="workflow-http-reveal-banner">
+      <div class="flex flex-col gap-1">
+        <OText variant="body-strong">{{ bannerTitle }}</OText>
+        <OText variant="meta" as="p" class="leading-snug">{{ bannerBody }}</OText>
+      </div>
+    </OBanner>
+
+    <WorkflowHttpUrl
+      v-if="config && !rotated"
+      :url="config.url"
+      :region-host="config.region_host"
+    />
+
+    <div class="flex flex-col gap-1">
+      <OText as="label" class="text-xs font-medium">{{ secretLabel }}</OText>
+      <OCodeBlock
+        :code="secret"
+        :code-masked="maskedSecret"
+        lang="text"
+        padded
+        :reveal-tooltip="t('ingestion.setupCard.revealToken')"
+        :hide-tooltip="t('ingestion.setupCard.hideToken')"
+        :copy-message="isSigned ? t('workflow.http.secretCopied') : t('workflow.http.tokenCopied')"
+        data-test="workflow-http-token"
+        data-o2-privacy="mask"
+      />
+      <OText variant="meta" as="p" data-test="workflow-http-secret-hint">
+        <i18n-t
+          :keypath="isSigned ? 'workflow.http.secretHint' : 'workflow.http.tokenHint'"
+          tag="span"
+          scope="global"
+        >
+          <template #header>
+            <OText variant="mono">{{ BEARER_HEADER }}</OText>
+          </template>
+          <template #headers>
+            <OText variant="mono">{{ SIGNATURE_HEADERS }}</OText>
+          </template>
+        </i18n-t>
+      </OText>
+    </div>
+
+    <WorkflowHttpSnippets
+      v-if="config && !rotated"
+      :url="config.url"
+      :mode="mode"
+      :secret="secret"
+      :display-prefix="displayPrefix"
+      :sample-body="DEFAULT_SAMPLE_BODY"
+    />
+
+    <!-- A draft's URL can only answer 403, so the dry run has nothing to show -->
+    <div v-if="!rotated && refusal !== 'draft'" class="flex flex-wrap items-center gap-3">
+      <OButton
+        v-if="!isSigned"
+        variant="outline"
+        size="sm-action"
+        icon-left="send"
+        :loading="sending"
+        data-test="workflow-http-send-test"
+        @click="send"
+      >
+        {{ t("workflow.http.sendTest") }}
+      </OButton>
+      <OText variant="meta" class="min-w-0 flex-1" data-test="workflow-http-send-test-hint">
+        {{ sendTestHint }}
+      </OText>
+    </div>
+
+    <div
+      v-if="!rotated && (result || sendError)"
+      data-test="workflow-http-test-result"
+      class="border-border-default rounded-default flex flex-col gap-2 border p-3"
+    >
+      <OText v-if="sendError" variant="meta" as="p" class="text-status-negative">
+        {{ sendError }}
+      </OText>
+      <template v-else-if="result">
+        <div class="flex flex-wrap items-center gap-2">
+          <OTag
+            type="httpStatus"
+            :value="httpStatusBucket(result.status)"
+            :label="raw(result.status)"
+          />
+          <OText variant="body-strong">{{ resultTitle }}</OText>
+          <OText v-if="accepted" variant="meta">{{ resultMeta }}</OText>
+          <OButton
+            v-if="refusedByState && canRunTestHere"
+            variant="ghost-primary"
+            size="xs"
+            data-test="workflow-http-run-test-instead"
+            @click="emit('run-test')"
+          >
+            {{ t("workflow.http.runTestInstead") }}
+          </OButton>
+        </div>
+        <OCollapsible
+          v-if="result.input"
+          :label="t('workflow.http.dryRunInput')"
+          default-open
+          data-test="workflow-http-test-input"
+        >
+          <OCodeBlock :code="inputText" lang="json" padded wrap />
+        </OCollapsible>
+      </template>
+    </div>
+
+    <slot />
+
+    <div class="flex justify-end">
+      <OButton
+        variant="primary"
+        size="sm-action"
+        data-test="workflow-http-reveal-done"
+        @click="endReveal"
+      >
+        {{ t("workflow.http.done") }}
+      </OButton>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { raw, useI18nTyped, type I18nKey, type I18nText } from "@/types/i18n";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OCodeBlock from "@/lib/core/Code/OCodeBlock.vue";
+import OCollapsible from "@/lib/core/Collapsible/OCollapsible.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import { httpStatusBucket } from "@/lib/core/Badge/badgeGroups";
+import type { DryRunResult } from "@/services/workflows";
+import { DEFAULT_SAMPLE_BODY, maskSecret } from "@/plugins/workflows/httpSnippets";
+import {
+  HOOK_REASON_KEYS,
+  formatBodySize,
+  httpErrorText,
+  useHttpEndpoint,
+} from "@/plugins/workflows/httpEndpointUi";
+import type { EndpointContext, RotateReplaced } from "@/plugins/workflows/useWorkflowHttpEndpoint";
+import WorkflowHttpSnippets from "./WorkflowHttpSnippets.vue";
+import WorkflowHttpUrl from "./WorkflowHttpUrl.vue";
+
+const BEARER_HEADER = "Authorization: Bearer <token>";
+const SIGNATURE_HEADERS = "webhook-id, webhook-timestamp, webhook-signature";
+const ROTATE_BODY_KEYS: Record<RotateReplaced, [I18nKey, I18nKey]> = {
+  retiring: ["workflow.http.rotateBannerBody", "workflow.http.rotateBannerBodySigned"],
+  revoked: ["workflow.http.rotateBannerBodyRevoked", "workflow.http.rotateBannerBodyRevokedSigned"],
+  none: ["workflow.http.rotateBannerBodyFresh", "workflow.http.rotateBannerBodyFreshSigned"],
+};
+
+const props = defineProps<{
+  context: EndpointContext;
+  /** Draft or paused: the server refuses the call before any input is built. */
+  refusal: "draft" | "paused" | null;
+}>();
+
+const emit = defineEmits<{ (e: "run-test"): void }>();
+
+const { t } = useI18nTyped();
+const {
+  config,
+  revealedSecret,
+  revealKind,
+  rotateReplaced,
+  activeCredential,
+  canRunTest,
+  sendTest,
+  endReveal,
+} = useHttpEndpoint();
+
+const sending = ref(false);
+const result = ref<DryRunResult | null>(null);
+const sendError = ref<I18nText | null>(null);
+
+const secret = computed(() => revealedSecret.value ?? "");
+// A rotation keeps the URL and the caller's setup, so only the new value and the tokens show.
+const rotated = computed(() => revealKind.value === "rotated");
+const mode = computed(() => config.value?.auth_mode ?? "token");
+const isSigned = computed(() => mode.value === "signature");
+// Until the refetch lands the active row is still the old credential, so its prefix must match the value.
+const displayPrefix = computed(() => {
+  const fromValue = `${secret.value.slice(0, 9)}…${secret.value.slice(-4)}`;
+  const stored = activeCredential.value?.display_prefix;
+  return stored?.startsWith(secret.value.slice(0, 9)) ? stored : fromValue;
+});
+const maskedSecret = computed(() => maskSecret(displayPrefix.value));
+
+const bannerTitle = computed(() => {
+  if (revealKind.value === "rotated")
+    return isSigned.value
+      ? t("workflow.http.rotateBannerTitleSigned")
+      : t("workflow.http.rotateBannerTitle");
+  if (revealKind.value === "switched")
+    return isSigned.value
+      ? t("workflow.http.switchedBannerTitleSigned")
+      : t("workflow.http.switchedBannerTitle");
+  return t("workflow.http.revealBannerTitle");
+});
+const bannerBody = computed(() => {
+  if (revealKind.value === "rotated") {
+    const [token, signed] = ROTATE_BODY_KEYS[rotateReplaced.value ?? "retiring"];
+    return t(isSigned.value ? signed : token);
+  }
+  return isSigned.value
+    ? t("workflow.http.revealBannerBodySigned")
+    : t("workflow.http.revealBannerBody");
+});
+const secretLabel = computed(() => {
+  if (isSigned.value)
+    return rotated.value ? t("workflow.http.newSecretLabel") : t("workflow.http.secretLabel");
+  return rotated.value ? t("workflow.http.newTokenLabel") : t("workflow.http.tokenLabel");
+});
+
+const sendTestHint = computed(() => {
+  if (isSigned.value) return t("workflow.http.sendTestSigned");
+  return props.refusal === "paused"
+    ? t("workflow.http.sendTestHintPaused")
+    : t("workflow.http.sendTestHint");
+});
+const accepted = computed(() => !!result.value && result.value.status < 300);
+const refusedByState = computed(
+  () =>
+    result.value?.reason === "workflow_not_published" ||
+    result.value?.reason === "workflow_disabled",
+);
+const canRunTestHere = computed(() => props.context === "editor" && canRunTest.value);
+const resultTitle = computed<I18nText>(() => {
+  const r = result.value;
+  if (!r) return raw("");
+  if (accepted.value) return t("workflow.http.dryRunAccepted");
+  if (r.reason === "workflow_disabled") return t("workflow.http.dryRunRefusedPaused");
+  if (refusedByState.value) return t("workflow.http.dryRunRefused");
+  if (r.reason === "rate_limited") return t("workflow.http.dryRunRateLimited");
+  if (r.reason && r.reason !== "unauthorized") return t(HOOK_REASON_KEYS[r.reason].title);
+  return t("workflow.http.dryRunStatus", { status: r.status });
+});
+const resultMeta = computed(() =>
+  t("workflow.http.dryRunMeta", { size: formatBodySize(result.value?.bodyBytes ?? 0, t) }),
+);
+const inputText = computed(() => JSON.stringify(result.value?.input ?? {}, null, 2));
+
+const send = async () => {
+  sending.value = true;
+  sendError.value = null;
+  try {
+    result.value = await sendTest();
+  } catch (err) {
+    result.value = null;
+    sendError.value = t("workflow.http.dryRunFailed", { reason: httpErrorText(err, t) });
+  } finally {
+    sending.value = false;
+  }
+};
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpRotatePopover.spec.ts b/web/src/components/workflows/WorkflowHttpRotatePopover.spec.ts
new file mode 100644
index 0000000000..940b6b5ce5
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpRotatePopover.spec.ts
@@ -0,0 +1,162 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import {
+  OPopoverStub,
+  OTooltipStub,
+  hoverAndWait,
+  httpCredential,
+} from "@/test/unit/helpers/workflowHttp";
+import WorkflowHttpRotatePopover from "./WorkflowHttpRotatePopover.vue";
+
+const t = (k: string, v?: Record<string, unknown>) => i18n.global.t(k, v ?? {});
+
+const mountPopover = (props: Record<string, unknown> = {}) =>
+  mount(WorkflowHttpRotatePopover, {
+    props: {
+      mode: "token",
+      current: httpCredential(),
+      disabled: false,
+      pending: false,
+      error: null,
+      ...props,
+    },
+    global: { plugins: [i18n, store], stubs: { OPopover: OPopoverStub, OTooltip: OTooltipStub } },
+  });
+
+const byTest = (w: ReturnType<typeof mountPopover>, id: string) => w.find(`[data-test="${id}"]`);
+
+describe("WorkflowHttpRotatePopover", () => {
+  it("opens the blocked tooltip on hover over the whole Rotate button, not only its icon", async () => {
+    const w = mount(WorkflowHttpRotatePopover, {
+      props: {
+        mode: "token",
+        current: httpCredential(),
+        disabled: true,
+        pending: false,
+        error: null,
+      },
+      global: { plugins: [i18n, store], stubs: { OPopover: OPopoverStub } },
+      attachTo: document.body,
+    });
+    await hoverAndWait(byTest(w, "workflow-http-rotate").element);
+    expect(document.body.textContent).toContain(t("workflow.http.rotateBlocked"));
+    w.unmount();
+  });
+
+  it("defaults to 24 hours", async () => {
+    const w = mountPopover();
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    const popover = byTest(w, "workflow-http-rotate-popover");
+    expect(popover.text()).toContain(t("workflow.http.rotateTitle"));
+    expect(popover.text()).toContain("o2wh_4fK9…oI4k");
+    expect(byTest(w, "workflow-http-rotate-consequence").text()).toContain("keep working until");
+    await byTest(w, "workflow-http-rotate-confirm").trigger("click");
+    expect(w.emitted("confirm")?.[0]).toEqual([86400]);
+  });
+
+  it("immediate shows the 401 consequence", async () => {
+    const w = mountPopover();
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    await w.findComponent({ name: "ORadioGroup" }).vm.$emit("update:modelValue", 0);
+    expect(byTest(w, "workflow-http-rotate-consequence").text()).toBe(
+      t("workflow.http.rotateConsequenceNow"),
+    );
+    await byTest(w, "workflow-http-rotate-confirm").trigger("click");
+    expect(w.emitted("confirm")?.[0]).toEqual([0]);
+  });
+
+  it("offers the four overlap options", async () => {
+    const w = mountPopover();
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    for (const s of [0, 3600, 86400, 604800]) {
+      expect(byTest(w, `workflow-http-rotate-overlap-${s}`).exists()).toBe(true);
+    }
+  });
+
+  it("signed mode words it as a signing secret", async () => {
+    const w = mountPopover({ mode: "signature" });
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    expect(byTest(w, "workflow-http-rotate-popover").text()).toContain(
+      t("workflow.http.rotateTitleSigned"),
+    );
+    expect(byTest(w, "workflow-http-rotate-confirm").text()).toBe(
+      t("workflow.http.rotateConfirmSigned"),
+    );
+  });
+
+  it("a blocked rotate is disabled with the tooltip", async () => {
+    const w = mountPopover({ disabled: true });
+    // focusable-unavailable keeps the reason reachable by keyboard, so the state is aria-disabled.
+    expect(byTest(w, "workflow-http-rotate").attributes("aria-disabled")).toBe("true");
+    expect(byTest(w, "workflow-http-rotate-blocked-tooltip").attributes("data-content")).toBe(
+      t("workflow.http.rotateBlocked"),
+    );
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    expect(byTest(w, "workflow-http-rotate-popover").exists()).toBe(false);
+    const signed = mountPopover({ disabled: true, mode: "signature" });
+    expect(byTest(signed, "workflow-http-rotate-blocked-tooltip").attributes("data-content")).toBe(
+      t("workflow.http.rotateBlockedSigned"),
+    );
+  });
+
+  it("a never-used token says so in the lead", async () => {
+    const w = mountPopover({ current: httpCredential({ last_used_at: null }) });
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    expect(byTest(w, "workflow-http-rotate-popover").text()).toContain(
+      t("workflow.http.rotateLeadUnused", { prefix: "o2wh_4fK9…oI4k" }),
+    );
+  });
+
+  it("with no live credential it says a new one is created and offers no overlap", async () => {
+    const w = mountPopover({ current: undefined });
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    const popover = byTest(w, "workflow-http-rotate-popover");
+    expect(popover.text()).toContain(t("workflow.http.rotateLeadNone"));
+    expect(popover.text()).not.toContain("Keep");
+    expect(byTest(w, "workflow-http-rotate-overlap-0").exists()).toBe(false);
+    expect(byTest(w, "workflow-http-rotate-consequence").exists()).toBe(false);
+    await byTest(w, "workflow-http-rotate-confirm").trigger("click");
+    expect(w.emitted("confirm")?.[0]).toEqual([0]);
+    const signed = mountPopover({ current: undefined, mode: "signature" });
+    await byTest(signed, "workflow-http-rotate").trigger("click");
+    expect(byTest(signed, "workflow-http-rotate-popover").text()).toContain(
+      t("workflow.http.rotateLeadNoneSigned"),
+    );
+  });
+
+  it("a failure opening upward goes first, so the title and options above it do not move", async () => {
+    const w = mountPopover({ error: "nope" });
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    expect(byTest(w, "workflow-http-rotate-error").classes()).toContain(
+      "[[data-side=top]_&]:order-first",
+    );
+  });
+
+  it("a failure shows inside the popover; cancel emits cancel", async () => {
+    const w = mountPopover({ error: "nope" });
+    await byTest(w, "workflow-http-rotate").trigger("click");
+    expect(byTest(w, "workflow-http-rotate-error").text()).toBe(
+      t("workflow.http.rotateFailed", { reason: "nope" }),
+    );
+    await byTest(w, "workflow-http-rotate-cancel").trigger("click");
+    expect(w.emitted("cancel")).toHaveLength(1);
+    expect(byTest(w, "workflow-http-rotate-popover").exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/workflows/WorkflowHttpRotatePopover.vue b/web/src/components/workflows/WorkflowHttpRotatePopover.vue
new file mode 100644
index 0000000000..c2242c9bb2
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpRotatePopover.vue
@@ -0,0 +1,190 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <!-- Wrapper mode: a child tooltip after icon-left anchors to the icon alone -->
+  <OTooltip
+    v-if="disabled"
+    :content="isSigned ? t('workflow.http.rotateBlockedSigned') : t('workflow.http.rotateBlocked')"
+    side="top"
+    data-test="workflow-http-rotate-blocked-tooltip"
+  >
+    <OButton
+      variant="outline"
+      size="sm-action"
+      icon-left="refresh"
+      disabled
+      focusable-unavailable
+      data-test="workflow-http-rotate"
+    >
+      {{ t("workflow.http.rotate") }}
+    </OButton>
+  </OTooltip>
+  <OPopover v-else v-model:open="open" side="bottom" align="end" :aria-label="title">
+    <template #trigger>
+      <OButton
+        variant="outline"
+        size="sm-action"
+        icon-left="refresh"
+        data-test="workflow-http-rotate"
+      >
+        {{ t("workflow.http.rotate") }}
+      </OButton>
+    </template>
+    <div
+      data-test="workflow-http-rotate-popover"
+      class="flex w-[min(23rem,calc(100vw-1.5rem))] flex-col gap-3 p-4"
+    >
+      <div class="flex flex-col gap-1">
+        <OText variant="body-strong">{{ title }}</OText>
+        <OText variant="meta" as="p">{{ lead }}</OText>
+      </div>
+      <template v-if="current">
+        <ORadioGroup v-model="overlap" orientation="vertical" :label="title">
+          <ORadio
+            v-for="option in OVERLAP_OPTIONS"
+            :key="option.value"
+            :value="option.value"
+            :label="t(option.labelKey)"
+            :data-test="`workflow-http-rotate-overlap-${option.value}`"
+          />
+        </ORadioGroup>
+        <OBanner
+          variant="info"
+          dense
+          data-test="workflow-http-rotate-consequence"
+          :content="consequence"
+        />
+      </template>
+      <!-- Opened upward, the popover grows from its top edge, so the error goes first to keep the options in place -->
+      <OBanner
+        v-if="error"
+        variant="error-soft"
+        dense
+        class="[[data-side=top]_&]:order-first"
+        data-test="workflow-http-rotate-error"
+        :content="t('workflow.http.rotateFailed', { reason: raw(error) })"
+      />
+      <div class="flex justify-end gap-2">
+        <OButton
+          variant="outline"
+          size="sm-action"
+          data-test="workflow-http-rotate-cancel"
+          @click="cancel"
+        >
+          {{ t("common.cancel") }}
+        </OButton>
+        <OButton
+          variant="primary"
+          size="sm-action"
+          :loading="pending"
+          data-test="workflow-http-rotate-confirm"
+          @click="emit('confirm', current ? overlap : 0)"
+        >
+          {{ isSigned ? t("workflow.http.rotateConfirmSigned") : t("workflow.http.rotateConfirm") }}
+        </OButton>
+      </div>
+    </div>
+  </OPopover>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { useStore } from "vuex";
+import { raw, useI18nTyped } from "@/types/i18n";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import ORadio from "@/lib/forms/Radio/ORadio.vue";
+import ORadioGroup from "@/lib/forms/Radio/ORadioGroup.vue";
+import OPopover from "@/lib/overlay/Popover/OPopover.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { formatTimestampInTimezone } from "@/utils/date";
+import type { HttpAuthMode, HttpCredential, OverlapSeconds } from "@/services/workflows";
+import { OVERLAP_OPTIONS } from "@/plugins/workflows/httpEndpointUi";
+
+const DEFAULT_OVERLAP: OverlapSeconds = 86400;
+const TIME_FORMAT = "MMM D, HH:mm";
+
+const props = defineProps<{
+  mode: HttpAuthMode;
+  /** The active credential; undefined after it was revoked, when Rotate only mints a new one. */
+  current: HttpCredential | undefined;
+  /** A credential is retiring, so the server refuses a second rotation. */
+  disabled: boolean;
+  pending: boolean;
+  error: string | null;
+}>();
+
+const emit = defineEmits<{
+  (e: "confirm", overlap: OverlapSeconds): void;
+  (e: "cancel"): void;
+}>();
+
+const open = defineModel<boolean>("open", { default: false });
+
+const { t } = useI18nTyped();
+const store = useStore();
+
+const overlap = ref<OverlapSeconds>(DEFAULT_OVERLAP);
+
+const isSigned = computed(() => props.mode === "signature");
+const title = computed(() =>
+  isSigned.value ? t("workflow.http.rotateTitleSigned") : t("workflow.http.rotateTitle"),
+);
+const formatTime = (us: number) =>
+  raw(formatTimestampInTimezone(us, TIME_FORMAT, store.state.timezone));
+
+const lead = computed(() => {
+  if (!props.current) {
+    return isSigned.value
+      ? t("workflow.http.rotateLeadNoneSigned")
+      : t("workflow.http.rotateLeadNone");
+  }
+  const prefix = raw(props.current.display_prefix);
+  const used = props.current.last_used_at;
+  if (!used) {
+    return isSigned.value
+      ? t("workflow.http.rotateLeadUnusedSigned", { prefix })
+      : t("workflow.http.rotateLeadUnused", { prefix });
+  }
+  const params = { prefix, time: formatTime(used) };
+  return isSigned.value
+    ? t("workflow.http.rotateLeadSigned", params)
+    : t("workflow.http.rotateLead", params);
+});
+
+const consequence = computed(() => {
+  if (overlap.value === 0) {
+    return isSigned.value
+      ? t("workflow.http.rotateConsequenceNowSigned")
+      : t("workflow.http.rotateConsequenceNow");
+  }
+  const time = formatTime((Date.now() + overlap.value * 1000) * 1000);
+  return isSigned.value
+    ? t("workflow.http.rotateConsequenceSigned", { time })
+    : t("workflow.http.rotateConsequence", { time });
+});
+
+const cancel = () => {
+  open.value = false;
+  emit("cancel");
+};
+
+watch(open, (isOpen) => {
+  if (isOpen) overlap.value = DEFAULT_OVERLAP;
+});
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpSnippets.vue b/web/src/components/workflows/WorkflowHttpSnippets.vue
new file mode 100644
index 0000000000..c938dd7ff3
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpSnippets.vue
@@ -0,0 +1,86 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex flex-col gap-2">
+    <OTabs v-model="lang" dense>
+      <OTab
+        v-for="tab in TABS"
+        :key="tab.lang"
+        :name="tab.lang"
+        :label="tab.label"
+        :data-test="`workflow-http-snippet-tab-${tab.lang}`"
+      />
+    </OTabs>
+    <OCodeBlock
+      :key="lang"
+      :code="code"
+      :code-masked="masked"
+      :lang="LANG_IDS[lang]"
+      padded
+      :reveal-tooltip="t('ingestion.setupCard.revealToken')"
+      :hide-tooltip="t('ingestion.setupCard.hideToken')"
+      wrap
+      data-test="workflow-http-snippet"
+      data-o2-privacy="mask"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref } from "vue";
+import { raw, useI18nTyped } from "@/types/i18n";
+import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
+import OTab from "@/lib/navigation/Tabs/OTab.vue";
+import OCodeBlock from "@/lib/core/Code/OCodeBlock.vue";
+import type { HttpAuthMode } from "@/services/workflows";
+import {
+  buildMaskedSnippet,
+  buildSnippet,
+  type SnippetLang,
+} from "@/plugins/workflows/httpSnippets";
+
+const props = defineProps<{
+  url: string;
+  mode: HttpAuthMode;
+  /** Null renders an environment-variable placeholder instead of a value. */
+  secret: string | null;
+  displayPrefix: string;
+  sampleBody: string;
+}>();
+
+const { t } = useI18nTyped();
+
+const TABS: { lang: SnippetLang; label: ReturnType<typeof raw> }[] = [
+  { lang: "curl", label: raw("curl") },
+  { lang: "js", label: raw("JavaScript") },
+  { lang: "python", label: raw("Python") },
+];
+const LANG_IDS: Record<SnippetLang, string> = { curl: "bash", js: "javascript", python: "python" };
+
+const lang = ref<SnippetLang>("curl");
+const input = computed(() => ({
+  url: props.url,
+  mode: props.mode,
+  sampleBody: props.sampleBody,
+}));
+const code = computed(() => buildSnippet(lang.value, { ...input.value, secret: props.secret }));
+const masked = computed(() =>
+  props.secret
+    ? buildMaskedSnippet(lang.value, { ...input.value, displayPrefix: props.displayPrefix })
+    : undefined,
+);
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpSteady.vue b/web/src/components/workflows/WorkflowHttpSteady.vue
new file mode 100644
index 0000000000..c704dcbb13
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpSteady.vue
@@ -0,0 +1,346 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div v-if="config" class="flex flex-col gap-4" data-test="workflow-http-steady">
+    <template v-if="!tokensOnly">
+      <WorkflowHttpUrl :url="config.url" :region-host="config.region_host" />
+
+      <div class="flex flex-wrap items-center gap-3">
+        <OText as="span" class="text-text-secondary text-sm">{{
+          t("workflow.http.authLabel")
+        }}</OText>
+        <OPopover v-model:open="switchOpen" side="bottom" align="start" :aria-label="switchTitle">
+          <template #trigger>
+            <span class="inline-flex">
+              <span class="inline-flex" @click.stop>
+                <OToggleGroup
+                  :model-value="config.auth_mode"
+                  :disabled="!permissions.edit || !permissions.reveal || saving"
+                  data-test="workflow-http-auth-mode"
+                  @update:model-value="onModeChange"
+                >
+                  <OToggleGroupItem value="token" size="sm" data-test="workflow-http-auth-token">
+                    {{ t("workflow.http.authToken") }}
+                  </OToggleGroupItem>
+                  <OToggleGroupItem
+                    value="signature"
+                    size="sm"
+                    data-test="workflow-http-auth-signed"
+                  >
+                    {{ t("workflow.http.authSigned") }}
+                  </OToggleGroupItem>
+                </OToggleGroup>
+              </span>
+            </span>
+          </template>
+          <div
+            data-test="workflow-http-auth-switch-popover"
+            class="flex w-80 max-w-[calc(100vw-1.5rem)] flex-col gap-2 p-3"
+          >
+            <OText variant="body-strong">{{ switchTitle }}</OText>
+            <OText variant="meta" as="p">{{ switchBody }}</OText>
+            <div class="flex justify-end gap-2">
+              <OButton
+                variant="outline"
+                size="sm-action"
+                data-test="workflow-http-auth-switch-cancel"
+                @click="switchOpen = false"
+              >
+                {{ t("common.cancel") }}
+              </OButton>
+              <OButton
+                variant="primary"
+                size="sm-action"
+                :loading="saving"
+                data-test="workflow-http-auth-switch-confirm"
+                @click="confirmSwitch"
+              >
+                {{ t("common.confirm") }}
+              </OButton>
+            </div>
+          </div>
+        </OPopover>
+        <OPopover side="bottom" align="start" :aria-label="t('workflow.http.authAbout')">
+          <template #trigger>
+            <OButton
+              variant="ghost"
+              size="icon-xs-sq"
+              :aria-label="t('workflow.http.authAbout')"
+              data-test="workflow-http-auth-info"
+            >
+              <OIcon name="info" size="sm" />
+            </OButton>
+          </template>
+          <OText variant="meta" as="p" class="w-80 max-w-[calc(100vw-1.5rem)] p-3">
+            {{ t("workflow.http.authInfo", { headers: signedHeaders }) }}
+          </OText>
+        </OPopover>
+      </div>
+
+      <WorkflowHttpExample />
+    </template>
+
+    <OBanner
+      v-if="actionError"
+      variant="error-soft"
+      dense
+      data-test="workflow-http-steady-error"
+      :content="actionError"
+    />
+
+    <div class="flex flex-col gap-2">
+      <div class="flex flex-wrap items-center gap-2">
+        <OText as="span" class="text-text-secondary min-w-0 flex-1 text-sm">
+          {{ isSigned ? t("workflow.http.secretsTitle") : t("workflow.http.tokensTitle") }}
+        </OText>
+        <template v-if="canRunTest">
+          <!-- Wrapper mode: a child tooltip after icon-left anchors to the icon alone -->
+          <OTooltip
+            v-if="context === 'editor'"
+            :content="t(runTestHint)"
+            side="top"
+            data-test="workflow-http-run-test-tooltip"
+          >
+            <OButton
+              variant="outline"
+              size="sm-action"
+              icon-left="science"
+              data-test="workflow-http-run-test"
+              @click="emit('run-test')"
+            >
+              {{ t("workflow.http.runTest") }}
+            </OButton>
+          </OTooltip>
+          <OText v-else variant="meta" data-test="workflow-http-run-test-list-hint">
+            {{ t(runTestHint) }}
+          </OText>
+        </template>
+        <WorkflowHttpRotatePopover
+          v-if="permissions.edit && permissions.reveal"
+          v-model:open="rotateOpen"
+          :mode="config.auth_mode"
+          :current="activeCredential"
+          :disabled="rotateBlocked"
+          :pending="rotating"
+          :error="rotateError"
+          @confirm="onRotate"
+          @cancel="rotateError = null"
+        />
+      </div>
+      <WorkflowHttpCredentialsTable
+        :credentials="credentials"
+        :mode="config.auth_mode"
+        :can-edit="permissions.edit"
+        :can-reveal="permissions.reveal"
+        :revoking="revoking"
+        :revealed="revealedCredentials"
+        :revealing="revealing"
+        :reveal-error="revealError"
+        @reveal="revealCredential"
+        @hide="hideCredential"
+        @copy="onCopy"
+        @revoke="onRevoke"
+      />
+      <OBanner
+        v-if="storageWarning"
+        variant="warning"
+        dense
+        data-test="workflow-http-secret-storage-warning"
+        :content="t('workflow.http.secretStorageWarning')"
+      />
+    </div>
+
+    <template v-if="!tokensOnly">
+      <WorkflowHttpAdvanced v-if="permissions.edit" ref="advanced" v-model:open="advancedOpen" />
+      <WorkflowHttpRejections
+        :rejections="config.rejections"
+        :trigger-limit="config.rate_limit_per_minute"
+        :org-budget="config.org_rate_limit_per_minute"
+        :max-body-bytes="config.max_body_bytes"
+        :loading="refreshing"
+        :error="rejectionsError"
+        :can-raise="permissions.edit"
+        :can-rotate="canRotate"
+        @rotate="openRotate"
+        @raise-limit="raiseLimit"
+        @refresh="onRefresh"
+      />
+    </template>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
+import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
+import OPopover from "@/lib/overlay/Popover/OPopover.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import type { HttpAuthMode, OverlapSeconds } from "@/services/workflows";
+import type { EndpointContext } from "@/plugins/workflows/useWorkflowHttpEndpoint";
+import { httpErrorText, useHttpEndpoint } from "@/plugins/workflows/httpEndpointUi";
+import WorkflowHttpAdvanced from "./WorkflowHttpAdvanced.vue";
+import WorkflowHttpCredentialsTable from "./WorkflowHttpCredentialsTable.vue";
+import WorkflowHttpExample from "./WorkflowHttpExample.vue";
+import WorkflowHttpRejections from "./WorkflowHttpRejections.vue";
+import WorkflowHttpRotatePopover from "./WorkflowHttpRotatePopover.vue";
+import WorkflowHttpUrl from "./WorkflowHttpUrl.vue";
+
+defineProps<{
+  context: EndpointContext;
+  /** The rotate reveal shows only the tokens block under the new value. */
+  tokensOnly?: boolean;
+}>();
+
+const emit = defineEmits<{ (e: "run-test"): void }>();
+
+const { t } = useI18nTyped();
+const {
+  config,
+  permissions,
+  credentials,
+  activeCredential,
+  storageWarning,
+  canRunTest,
+  canRotate,
+  runTestHint,
+  rotateBlocked,
+  revealedCredentials,
+  revealing,
+  revealError,
+  revoking,
+  saving,
+  rotating,
+  revealCredential,
+  hideCredential,
+  copyCredential,
+  switchMode,
+  rotate,
+  revoke,
+  refresh,
+} = useHttpEndpoint();
+
+const signedHeaders = raw("webhook-id, webhook-timestamp, webhook-signature");
+
+const switchOpen = ref(false);
+const pendingMode = ref<HttpAuthMode>("token");
+const rotateOpen = ref(false);
+const rotateError = ref<string | null>(null);
+// Escape and outside clicks close the popover without a cancel event.
+watch(rotateOpen, (open) => {
+  if (!open) rotateError.value = null;
+});
+const advancedOpen = ref(false);
+const advanced = ref<InstanceType<typeof WorkflowHttpAdvanced> | null>(null);
+const actionError = ref<I18nText | null>(null);
+const refreshing = ref(false);
+const rejectionsError = ref(false);
+
+const isSigned = computed(() => config.value?.auth_mode === "signature");
+const switchTitle = computed(() =>
+  pendingMode.value === "signature"
+    ? t("workflow.http.switchToSignedTitle")
+    : t("workflow.http.switchToTokenTitle"),
+);
+const switchBody = computed(() =>
+  pendingMode.value === "signature"
+    ? t("workflow.http.switchToSignedBody")
+    : t("workflow.http.switchToTokenBody"),
+);
+
+const onModeChange = (value: unknown) => {
+  if ((value !== "token" && value !== "signature") || value === config.value?.auth_mode) return;
+  pendingMode.value = value;
+  switchOpen.value = true;
+};
+
+const confirmSwitch = async () => {
+  actionError.value = null;
+  try {
+    await switchMode(pendingMode.value);
+  } catch (err) {
+    actionError.value = t("workflow.http.changeFailed", { reason: httpErrorText(err, t) });
+  } finally {
+    switchOpen.value = false;
+  }
+};
+
+const onRotate = async (overlap: OverlapSeconds) => {
+  rotateError.value = null;
+  try {
+    await rotate(overlap);
+    rotateOpen.value = false;
+  } catch (err) {
+    rotateError.value = httpErrorText(err, t);
+  }
+};
+
+const openRotate = () => {
+  if (rotateBlocked.value) return;
+  rotateError.value = null;
+  rotateOpen.value = true;
+};
+
+const raiseLimit = () => {
+  void advanced.value?.focusRateLimit();
+};
+
+const onCopy = async (id: string) => {
+  try {
+    const copied = await copyCredential(id);
+    if (!copied) {
+      toast({ variant: "error", message: t("common.copyError") });
+      return;
+    }
+    toast({
+      variant: "success",
+      message: isSigned.value ? t("workflow.http.secretCopied") : t("workflow.http.tokenCopied"),
+    });
+  } catch (err) {
+    const reason = httpErrorText(err, t);
+    toast({
+      variant: "error",
+      message: isSigned.value
+        ? t("workflow.http.revealFailedSigned", { reason })
+        : t("workflow.http.revealFailed", { reason }),
+    });
+  }
+};
+
+const onRevoke = async (id: string) => {
+  actionError.value = null;
+  try {
+    await revoke(id);
+  } catch (err) {
+    actionError.value = t("workflow.http.revokeFailed", { reason: httpErrorText(err, t) });
+  }
+};
+
+const onRefresh = async () => {
+  refreshing.value = true;
+  try {
+    rejectionsError.value = !(await refresh());
+  } finally {
+    refreshing.value = false;
+  }
+};
+</script>
diff --git a/web/src/components/workflows/WorkflowHttpUrl.vue b/web/src/components/workflows/WorkflowHttpUrl.vue
new file mode 100644
index 0000000000..131e00c5b7
--- /dev/null
+++ b/web/src/components/workflows/WorkflowHttpUrl.vue
@@ -0,0 +1,59 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex flex-col gap-1">
+    <div class="flex items-center gap-2">
+      <OText as="label" class="text-xs font-medium">{{ t("workflow.http.endpointUrl") }}</OText>
+      <OTag
+        v-if="regionHost"
+        variant="primary-soft"
+        size="sm"
+        :label="t('workflow.http.regionTag', { name: raw(regionHost) })"
+        data-test="workflow-http-region"
+      />
+    </div>
+    <div
+      data-test="workflow-http-url"
+      class="border-border-default bg-surface-subtle rounded-default flex min-w-0 items-center border px-3 py-2"
+    >
+      <OCode copyable :tooltip="false" class="min-w-0 flex-1 break-all">{{ url }}</OCode>
+    </div>
+    <OBanner
+      v-if="regionHost"
+      variant="info"
+      dense
+      data-test="workflow-http-region-banner"
+      :content="t('workflow.http.regionBanner', { field: raw('status_url') })"
+    />
+  </div>
+</template>
+
+<script setup lang="ts">
+import { raw, useI18nTyped } from "@/types/i18n";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OCode from "@/lib/core/Code/OCode.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import OText from "@/lib/core/Typography/OText.vue";
+
+defineProps<{
+  url: string;
+  /** Set in super-cluster mode: the host of the region that serves this UI. */
+  regionHost: string | null;
+}>();
+
+const { t } = useI18nTyped();
+</script>
diff --git a/web/src/components/workflows/WorkflowNodeDrawer.spec.ts b/web/src/components/workflows/WorkflowNodeDrawer.spec.ts
index a523958ddb..9dd120d883 100644
--- a/web/src/components/workflows/WorkflowNodeDrawer.spec.ts
+++ b/web/src/components/workflows/WorkflowNodeDrawer.spec.ts
@@ -32,6 +32,7 @@ vi.mock("@vue-flow/core", () => ({
 vi.mock("@/utils/zincutils", () => ({
   getImageURL: (p: string) => `mock-${p}`,
   getUUID: () => "uuid-1",
+  timestampToTimezoneDate: (ms: number) => String(ms),
 }));
 
 vi.mock("@/lib/feedback/Toast/useToast", () => ({ toast: vi.fn() }));
@@ -110,7 +111,7 @@ vi.mock("@/components/CodeQueryEditor.vue", () => ({
 }));
 
 import { mount, flushPromises } from "@vue/test-utils";
-import { nextTick } from "vue";
+import { nextTick, watch } from "vue";
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
 import WorkflowNodeDrawer from "./WorkflowNodeDrawer.vue";
@@ -120,6 +121,7 @@ import useWorkflowCanvas, {
   clearNodeEditedInput,
 } from "@/plugins/workflows/useWorkflowCanvas";
 import workflowService from "@/services/workflows";
+import { httpEditorState, resetHttpEditorState } from "@/plugins/workflows/httpEndpointUi";
 
 const t = (k: string, v?: any) => i18n.global.t(k, v ?? {});
 
@@ -1597,6 +1599,7 @@ describe("WorkflowNodeDrawer", () => {
 
       const chip = wrapper.find('[data-test="workflow-ndv-run-label"]');
       expect(chip.findComponent({ name: "OTimeCell" }).exists()).toBe(true);
+      expect(chip.findComponent({ name: "OTimeCell" }).props("format")).toBe("MMM d, yyyy HH:mm");
     });
 
     // Opening a run without visiting the Runs page first leaves runsHistory empty, so
@@ -1882,7 +1885,7 @@ describe("WorkflowNodeDrawer — retry from this step", () => {
     workflowObj.readOnly = true;
     workflowObj.currentSelectedWorkflow.id = "wf-1";
     workflowObj.runsHistory = {
-      list: [{ run_id: runId, error: "boom", event_type: eventType }],
+      list: [{ run_id: runId, error: "boom", status: "failed", event_type: eventType }],
       fetchedAt: 0,
       params: { start: 0, end: 0 },
       loading: false,
@@ -1950,3 +1953,240 @@ describe("WorkflowNodeDrawer — retry from this step", () => {
     );
   });
 });
+
+// ── HTTP request run on the trigger step (AC-UI-11, ui-spec 2.2) ───────────────
+describe("WorkflowNodeDrawer — HTTP request run on the trigger step", () => {
+  let wrapper: any = null;
+  const { resetWorkflowData } = useWorkflowCanvas(t);
+  const event = {
+    meta: {
+      event_type: "webhook",
+      trigger_source: "http",
+      received_at: 1_792_575_542_418_000,
+      headers: { "content-type": "application/json", "user-agent": "deploy-bot/2.4" },
+    },
+    data: [{ service: "checkout" }],
+  };
+  const facts = {
+    credential_prefix: "o2wh_4fK9…oI4k",
+    caller_ip: "203.0.113.24",
+    idempotency_key: "deploy-d-4821",
+    content_type: "application/json",
+    body_bytes: 68,
+    status: "failed",
+    error: "node_errored",
+  };
+
+  const stage = (row: Record<string, any>, result: Record<string, any>) => {
+    workflowObj.readOnly = true;
+    workflowObj.currentSelectedWorkflow.id = "wf-1";
+    workflowObj.currentSelectedWorkflow.nodes = [
+      {
+        id: "trig",
+        type: "input",
+        position: { x: 0, y: 0 },
+        data: { node_type: "workflow_trigger", trigger_kind: "alert_fired" },
+      },
+      {
+        id: "fn-1",
+        type: "default",
+        position: { x: 0, y: 0 },
+        data: { node_type: "function" },
+        meta: { label: "Build rollback request" },
+      },
+    ] as any;
+    workflowObj.currentSelectedWorkflow.edges = [
+      { id: "e1", source: "trig", target: "fn-1" },
+    ] as any;
+    workflowObj.runsHistory.list = [
+      { run_id: "run-h", start_time: 1, end_time: 2, _timestamp: 1, ...row },
+    ] as any;
+    workflowObj.testRun.result = {
+      errors: {},
+      inputs: {},
+      outputs: {},
+      ranNodeIds: ["trig", "fn-1"],
+      blockedNodeIds: [],
+      mode: "history",
+      runId: "run-h",
+      ...result,
+    } as any;
+    const node = workflowObj.currentSelectedWorkflow.nodes[0];
+    workflowObj.currentSelectedNodeData = node;
+    workflowObj.currentSelectedNodeID = "trig";
+    workflowObj.isEditNode = true;
+    workflowObj.dialog.name = "workflow_trigger";
+    workflowObj.dialog.show = true;
+  };
+  const failedHttpRun = () =>
+    stage(
+      {
+        event_type: "Webhook",
+        status: "failed",
+        error: "FunctionNode JS error",
+        http_request: facts,
+      },
+      {
+        inputs: { trig: [event], "fn-1": [event] },
+        errors: { "fn-1": { error_count: 1, errors: [["FunctionNode JS error: TypeError"]] } },
+      },
+    );
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    resetWorkflowData();
+  });
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+    workflowObj.readOnly = false;
+    workflowObj.testRun.result = null;
+    workflowObj.runsHistory.list = [] as any;
+  });
+
+  it("tags the run as an HTTP request beside the run chip", async () => {
+    failedHttpRun();
+    wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.find('[data-test="workflow-run-source"]').text()).toContain("HTTP request");
+  });
+
+  it("shows the request facts from http_request and the headers the run kept", async () => {
+    failedHttpRun();
+    wrapper = mountDrawer();
+    await flushPromises();
+    const facts = wrapper.findComponent({ name: "WorkflowRunRequestFacts" });
+    expect(facts.exists()).toBe(true);
+    expect(facts.props("facts").credential_prefix).toBe("o2wh_4fK9…oI4k");
+    expect(facts.props("receivedAt")).toBe(1_792_575_542_418_000);
+    expect(Object.keys(facts.props("headers"))).toEqual(["content-type", "user-agent"]);
+  });
+
+  it("shows the run's own event as the trigger output, not the alert sample", async () => {
+    failedHttpRun();
+    wrapper = mountDrawer();
+    await flushPromises();
+    const out = wrapper.find('[data-test="workflow-ndv-output"]').text();
+    expect(out).toContain("trigger_source");
+    expect(out).not.toContain("alert_name");
+  });
+
+  it("names the failing step and Open step walks the drawer to it", async () => {
+    failedHttpRun();
+    wrapper = mountDrawer();
+    await flushPromises();
+    const outcome = wrapper.findComponent({ name: "WorkflowRunHttpOutcome" });
+    expect(outcome.props("failedStep")).toEqual({
+      id: "fn-1",
+      label: "Build rollback request",
+      isFunction: true,
+    });
+    expect(String(outcome.props("error"))).toContain("FunctionNode JS error");
+    outcome.vm.$emit("open-step", "fn-1");
+    await flushPromises();
+    expect(workflowObj.currentSelectedNodeData?.id).toBe("fn-1");
+  });
+
+  it("Use as test input seeds the Test dialog with the run's input and closes the drawer", async () => {
+    failedHttpRun();
+    wrapper = mountDrawer();
+    await flushPromises();
+    await wrapper.find('[data-test="workflow-run-use-as-test-input"]').trigger("click");
+    await flushPromises();
+    expect(workflowObj.testRun.show).toBe(true);
+    expect(JSON.parse(workflowObj.testRun.input)).toEqual([event]);
+    expect(workflowObj.testRun.inputSource).toBe("run");
+    expect(workflowObj.testRun.fromNode).toBe("");
+    expect(workflowObj.dialog.show).toBe(false);
+  });
+
+  it("never-executed run shows the banner and no retry", async () => {
+    stage({ event_type: "Webhook", status: "expired", error: null, http_request: facts }, {});
+    wrapper = mountDrawer();
+    await flushPromises();
+    const outcome = wrapper.findComponent({ name: "WorkflowRunHttpOutcome" });
+    expect(outcome.exists()).toBe(true);
+    expect(outcome.props("reason")).toBe("expired");
+    expect(outcome.props("triggerKind")).toBe("alert_fired");
+    expect(wrapper.find('[data-test="workflow-ndv-no-run-data"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="workflow-node-retry-from"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="workflow-run-use-as-test-input"]').exists()).toBe(false);
+  });
+
+  it("non-HTTP runs keep today's view", async () => {
+    stage(
+      { event_type: "AlertFired", status: "failed", error: "boom" },
+      {
+        inputs: { trig: [event], "fn-1": [event] },
+        errors: { "fn-1": { error_count: 1, errors: [["boom"]] } },
+      },
+    );
+    wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.find('[data-test="workflow-run-source"]').exists()).toBe(false);
+    expect(wrapper.findComponent({ name: "WorkflowRunRequestFacts" }).exists()).toBe(false);
+    expect(wrapper.findComponent({ name: "WorkflowRunHttpOutcome" }).exists()).toBe(false);
+    expect(wrapper.find('[data-test="workflow-run-use-as-test-input"]').exists()).toBe(false);
+  });
+});
+
+describe("WorkflowNodeDrawer HTTP endpoint", () => {
+  let wrapper: any = null;
+  beforeEach(() => {
+    resetHttpEditorState();
+    workflowObj.testRun.result = null as any;
+    seedGraph();
+  });
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+    resetHttpEditorState();
+    workflowObj.dialog.show = false;
+  });
+
+  it("link row closes the step dialog before opening the panel", async () => {
+    triggerSubmit.mockReturnValue({ trigger_kind: "alert_fired" });
+    openNode("trig", false);
+    wrapper = mountDrawer();
+    await flushPromises();
+    const seen: boolean[] = [];
+    const stop = watch(
+      () => httpEditorState.panelOpen,
+      (open) => {
+        if (open) seen.push(workflowObj.dialog.show);
+      },
+      { flush: "sync" },
+    );
+    wrapper.findComponent({ name: "WorkflowTrigger" }).vm.$emit("open-http-endpoint");
+    await flushPromises();
+    stop();
+    // A trigger body is read-only, so its normal close path commits nothing (commitAndClose).
+    expect(triggerSubmit).not.toHaveBeenCalled();
+    expect(workflowObj.dialog.show).toBe(false);
+    expect(seen).toEqual([false]);
+    expect(httpEditorState.panelOpen).toBe(true);
+  });
+
+  it("the trigger dialog keeps the kind title", async () => {
+    httpEditorState.endpointOn = true;
+    openNode("trig", false);
+    wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.find(".drawer-title").text()).not.toContain(t("workflow.http.panelTitle"));
+  });
+
+  it("the Input pane follows Payload from", async () => {
+    openNode("cond", false);
+    wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.text()).not.toContain('"trigger_source": "http"');
+    wrapper.unmount();
+    httpEditorState.endpointOn = true;
+    httpEditorState.payloadFrom = "http";
+    openNode("cond", false);
+    wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.text()).toContain('"trigger_source": "http"');
+  });
+});
diff --git a/web/src/components/workflows/WorkflowNodeDrawer.vue b/web/src/components/workflows/WorkflowNodeDrawer.vue
index c9dbbad445..7d1bc1c5ff 100644
--- a/web/src/components/workflows/WorkflowNodeDrawer.vue
+++ b/web/src/components/workflows/WorkflowNodeDrawer.vue
@@ -98,6 +98,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           >
             {{ t("workflow.ndv.editStep") }}
           </OButton>
+          <OButton
+            v-if="canUseRunAsTestInput"
+            variant="outline"
+            size="sm-action"
+            icon-left="science"
+            data-test="workflow-run-use-as-test-input"
+            @click="useRunAsTestInput"
+          >
+            {{ t("workflow.http.useAsTestInput") }}
+          </OButton>
           <!-- Replays the run from THIS step down (from_node). Only for a run the
                backend stored input for — a Test/Retry run shows nothing here. -->
           <OButton
@@ -194,6 +204,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         :value="loadedRunRow?.start_time"
                         unit="us"
                         mode="absolute"
+                        :format="RUN_TIME_LONG"
                         :timezone="store.state.timezone"
                         :empty-label="raw('—')"
                       />
@@ -207,6 +218,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   </button>
                 </template>
               </WorkflowRunSwitcher>
+              <OTag
+                v-if="loadedRunIsHttp"
+                variant="blue-soft"
+                icon="webhook"
+                size="sm"
+                :label="t('workflow.history.sourceHttp')"
+                data-test="workflow-run-source"
+              />
             </template>
           </div>
         </div>
@@ -380,6 +399,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <span class="text-sm">{{ t("workflow.ndv.notInRun") }}</span>
       </div>
 
+      <!-- A request that never ran has no step data; its stored status is the whole story. -->
+      <div
+        v-else-if="httpRunOutcome && httpNeverRan"
+        data-test="workflow-ndv-http-never-ran"
+        class="flex min-w-0 flex-1 flex-col gap-3"
+      >
+        <WorkflowRunHttpOutcome v-bind="httpRunOutcome" />
+      </div>
+
       <div
         v-else-if="runStoredNoData"
         data-test="workflow-ndv-no-run-data"
@@ -537,7 +565,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             </button>
           </div>
           <WorkflowConfigSummary v-if="canvasReadOnly" :key="nodeId" />
-          <component v-else-if="bodyComponent" :is="bodyComponent" :key="nodeId" ref="bodyRef" />
+          <component
+            v-else-if="bodyComponent"
+            :is="bodyComponent"
+            :key="nodeId"
+            ref="bodyRef"
+            @open-http-endpoint="openHttpEndpoint"
+          />
           <div
             v-else
             data-test="workflow-ndv-config-placeholder"
@@ -578,7 +612,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         v-if="showIo && !nodeMissingFromRun && !runStoredNoData"
         data-test="workflow-ndv-output"
         class="relative flex min-w-0 flex-col gap-2"
-        :class="isReadonlyTrigger ? 'flex-1' : 'w-[var(--io-w,21.25rem)] shrink-0'"
+        :class="outputSectionClass"
         :style="isReadonlyTrigger ? undefined : { '--io-w': outputWidth + 'px' }"
       >
         <!-- Drag handle on Output's LEFT edge (sits in the gap toward Config). Extends
@@ -594,7 +628,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             class="bg-border-default hover:bg-accent h-full w-0.5 rounded-full transition-colors"
           />
         </div>
-        <div class="flex h-8 items-center gap-2 ps-2">
+        <template v-if="httpRunOutcome">
+          <WorkflowRunHttpOutcome v-bind="httpRunOutcome" @open-step="navigateTo" />
+          <WorkflowRunRequestFacts
+            v-if="httpFacts"
+            :facts="httpFacts"
+            :received-at="httpReceivedAt"
+            :headers="httpHeaders"
+          />
+        </template>
+        <div class="flex h-8 shrink-0 items-center gap-2 ps-2">
           <div class="text-text-body text-sm font-bold">{{ t("workflow.ndv.output") }}</div>
           <!-- Run status (Passed / Errored / No Records) — same source as the canvas
                badge and the results dock. -->
@@ -606,6 +649,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           >
             {{ t(`workflow.test.stepResult.status.${outputStatus}`) }}
           </OBadge>
+          <span v-if="httpRunOutcome" class="text-text-secondary text-xs">
+            {{ t("workflow.http.outputCaption") }}
+          </span>
           <div
             v-if="outputCount > 1"
             data-test="workflow-ndv-output-pager"
@@ -635,7 +681,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           </div>
         </div>
         <div
-          class="border-border-default bg-code-bg rounded-default flex min-h-0 flex-1 flex-col overflow-hidden border"
+          class="border-border-default bg-code-bg rounded-default flex flex-1 flex-col overflow-hidden border"
+          :class="httpRunOutcome ? 'min-h-60' : 'min-h-0'"
         >
           <!-- The node errored: show the error message(s), then the records it still
                passed downstream (mirrors the Step Results dock). -->
@@ -789,6 +836,24 @@ import OTextarea from "@/lib/forms/Input/OTextarea.vue";
 import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
 import CodeQueryEditor from "@/components/CodeQueryEditor.vue";
 import WorkflowRunSwitcher from "./WorkflowRunSwitcher.vue";
+import WorkflowRunHttpOutcome from "./WorkflowRunHttpOutcome.vue";
+import { DEFAULT_TRIGGER_KIND } from "@/plugins/workflows/triggers";
+import WorkflowRunRequestFacts from "./WorkflowRunRequestFacts.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import type { HttpRequestFacts, WorkflowHistoryRow } from "@/services/workflows";
+import { isHttpRun } from "@/plugins/workflows/httpEndpoint";
+import {
+  httpPreviewSample,
+  openHttpPanel,
+  usesHttpPayload,
+} from "@/plugins/workflows/httpEndpointUi";
+import {
+  RUN_TIME_LONG,
+  firstFailedStep,
+  hasStoredRunData,
+  runReasonOf,
+} from "@/plugins/workflows/runStatus";
+import { timestampToTimezoneDate } from "@/utils/zincutils";
 import { branchPathCounts, forwardedRunCount, isNoMatchRun } from "./nodeRunOutcome";
 import WorkflowTrigger from "@/plugins/workflows/nodes/WorkflowTrigger.vue";
 import WorkflowCondition from "@/plugins/workflows/nodes/WorkflowCondition.vue";
@@ -819,6 +884,8 @@ import useWorkflowCanvas, {
   setNodeEditedInput,
   getNodeEditedInput,
   clearNodeEditedInput,
+  humanizeNodeIds,
+  persistTestData,
 } from "@/plugins/workflows/useWorkflowCanvas";
 
 const { t } = useI18nTyped();
@@ -934,6 +1001,79 @@ const canRetryFromHere = computed(
   () => canvasReadOnly.value && !!historyRunId.value && isRetryableRun(loadedRunRow.value),
 );
 
+// ── HTTP request run on the read-only trigger (request facts, failure line) ──
+const loadedRunIsHttp = computed(() => !!loadedRunRow.value && isHttpRun(loadedRunRow.value));
+const httpTriggerRecords = computed<
+  { meta?: { headers?: Record<string, string>; received_at?: unknown } }[] | null
+>(() => {
+  if (!loadedRunIsHttp.value) return null;
+  const recs = nodeTestOutput(nodeId.value) || nodeTestInput(nodeId.value);
+  return recs && recs.length ? recs : null;
+});
+const httpFacts = computed<HttpRequestFacts | null>(
+  () => (loadedRunRow.value as WorkflowHistoryRow | null)?.http_request ?? null,
+);
+const httpHeaders = computed<Record<string, string>>(
+  () => httpTriggerRecords.value?.[0]?.meta?.headers ?? {},
+);
+const httpReceivedAt = computed<number>(
+  () =>
+    Number(httpTriggerRecords.value?.[0]?.meta?.received_at) || loadedRunRow.value?._timestamp || 0,
+);
+const httpNeverRan = computed(() => !hasStoredRunData(loadedRunRow.value));
+const httpFailedStep = computed(() => {
+  const row = loadedRunRow.value;
+  const errors = workflowObj.testRun.result?.errors;
+  if (row?.status !== "failed" || !errors) return null;
+  const id = firstFailedStep(
+    errors,
+    stepTree.value.map((s) => s.id),
+  );
+  const step = id ? stepTree.value.find((s) => s.id === id) : null;
+  if (!id || !step) return null;
+  const nodes: { id: string; data?: { node_type?: string } }[] =
+    workflowObj.currentSelectedWorkflow?.nodes || [];
+  const node = nodes.find((n) => n.id === id);
+  const message = errors[id]?.errors?.[0]?.[0];
+  return {
+    step: { id, label: step.label, isFunction: node?.data?.node_type === "function" },
+    error: message ? String(humanizeNodeIds(message, t)) : null,
+  };
+});
+const httpRunOutcome = computed(() => {
+  const row = loadedRunRow.value;
+  if (!isReadonlyTrigger.value || !row || !loadedRunIsHttp.value) return null;
+  return {
+    status: row.status,
+    reason: runReasonOf(row),
+    receivedAt: httpReceivedAt.value,
+    failedStep: httpFailedStep.value?.step ?? null,
+    error: httpFailedStep.value?.error ?? null,
+    triggerKind: currentTriggerKind() ?? DEFAULT_TRIGGER_KIND,
+  };
+});
+// The request block sits above Output, so the pane scrolls rather than squeezing the event to a few lines.
+const outputSectionClass = computed(() => {
+  if (!isReadonlyTrigger.value) return "w-[var(--io-w,21.25rem)] shrink-0";
+  return httpRunOutcome.value ? "flex-1 overflow-y-auto" : "flex-1";
+});
+const canUseRunAsTestInput = computed(() => !!httpRunOutcome.value && !!httpTriggerRecords.value);
+// Seeds the same shared state the Test dialog's run picker writes, then hands over to that dialog.
+const useRunAsTestInput = () => {
+  const records = httpTriggerRecords.value;
+  if (!records) return;
+  workflowObj.testRun.input = JSON.stringify(records, null, 2);
+  workflowObj.testRun.inputSource = "run";
+  workflowObj.testRun.inputRunLabel = timestampToTimezoneDate(
+    Math.floor((loadedRunRow.value?.start_time || 0) / 1000),
+    store.state.timezone,
+  );
+  workflowObj.testRun.fromNode = "";
+  persistTestData();
+  closeNodeDrawer();
+  workflowObj.testRun.show = true;
+};
+
 const retryingFromHere = ref(false);
 const retryFromHere = async () => {
   const workflowId = workflowObj.currentSelectedWorkflow?.id;
@@ -1082,6 +1222,7 @@ const isTriggerNode = (node: any) => node?.data?.node_type === "workflow_trigger
 const defaultTriggerSample = computed<any[]>(() => {
   const kind = currentTriggerKind();
   if (!kind) return [];
+  if (usesHttpPayload()) return httpPreviewSample();
   try {
     return triggerDef(kind).buildSample() || [];
   } catch {
@@ -1189,6 +1330,8 @@ const outputRecords = computed<any[] | null>(() => {
   // The node's OUTPUT is reported directly by the backend `outputs` map.
   const recs = nodeTestOutput(nodeId.value);
   if (recs && recs.length) return recs;
+  // An HTTP run's trigger emitted the request, so the kind's alert sample would misreport it.
+  if (httpRunOutcome.value && httpTriggerRecords.value) return httpTriggerRecords.value;
   // The trigger has no input — its output IS the event. Show its sample even before a
   // run, so the trigger's Output is always populated (it has no Input pane).
   if (isTriggerNode(workflowObj.currentSelectedNodeData) && defaultTriggerSample.value.length)
@@ -1593,4 +1736,10 @@ const onConfirmDelete = () => {
 const onOpenChange = async (open: boolean) => {
   if (!open) await commitAndClose();
 };
+
+// One overlay per flow: the step dialog closes through its normal path before the panel opens.
+const openHttpEndpoint = async () => {
+  await commitAndClose();
+  openHttpPanel();
+};
 </script>
diff --git a/web/src/components/workflows/WorkflowRunHttpOutcome.spec.ts b/web/src/components/workflows/WorkflowRunHttpOutcome.spec.ts
new file mode 100644
index 0000000000..edfd7c2bfc
--- /dev/null
+++ b/web/src/components/workflows/WorkflowRunHttpOutcome.spec.ts
@@ -0,0 +1,119 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import WorkflowRunHttpOutcome from "./WorkflowRunHttpOutcome.vue";
+
+const mountOutcome = (props: Record<string, unknown>) =>
+  mount(WorkflowRunHttpOutcome, {
+    props: {
+      status: "failed",
+      reason: null,
+      receivedAt: 1000,
+      failedStep: null,
+      error: null,
+      ...props,
+    },
+    global: {
+      plugins: [i18n, store],
+      stubs: {
+        OTimeCell: {
+          name: "OTimeCell",
+          props: ["value", "unit", "mode", "format"],
+          template: "<time />",
+        },
+        OButton: {
+          name: "OButton",
+          emits: ["click"],
+          template: `<button v-bind="$attrs" @click="$emit('click')"><slot /></button>`,
+        },
+      },
+    },
+  });
+
+describe("WorkflowRunHttpOutcome", () => {
+  it("names the failing step and its error, and opens that step", async () => {
+    const w = mountOutcome({
+      failedStep: { id: "fn-1", label: "Build rollback request", isFunction: false },
+      error: "boom",
+    });
+    const line = w.find('[data-test="workflow-run-error"]');
+    expect(line.text()).toContain("This run failed at Build rollback request: boom");
+    await w.find('[data-test="workflow-run-error-open-step"]').trigger("click");
+    expect(w.emitted("open-step")?.[0]).toEqual(["fn-1"]);
+    expect(w.find('[data-test="workflow-run-http-guard-hint"]').exists()).toBe(false);
+  });
+
+  it("shows the guard hint when the failing step is a Function", () => {
+    const w = mountOutcome({
+      failedStep: { id: "fn-1", label: "Build rollback request", isFunction: true },
+      error: "FunctionNode JS error: TypeError",
+    });
+    const hint = w.find('[data-test="workflow-run-http-guard-hint"]');
+    expect(hint.text()).toBe(
+      "HTTP runs carry the request, not alert fields. If this step reads meta.alert_*, guard it with a Condition: meta.trigger_source is empty.",
+    );
+  });
+
+  it("an incident workflow's guard hint names meta.event_type", () => {
+    const w = mountOutcome({
+      failedStep: { id: "fn-1", label: "Page", isFunction: true },
+      error: "FunctionNode JS error: TypeError",
+      triggerKind: "incident_event",
+    });
+    expect(w.find('[data-test="workflow-run-http-guard-hint"]').text()).toContain(
+      "If this step reads meta.event_type,",
+    );
+  });
+
+  it("never-executed run shows the expired banner and the stored chip", () => {
+    const w = mountOutcome({ status: "expired", reason: "expired" });
+    const tag = w.findComponent({ name: "OTag" });
+    expect(tag.props("type")).toBe("hookRunStatus");
+    expect(tag.props("value")).toBe("expired");
+    expect(w.find('[data-test="workflow-run-expired-banner"]').text()).toContain(
+      "This request waited more than 1 hour in the queue and was never run.",
+    );
+    expect(w.find('[data-test="workflow-run-error"]').exists()).toBe(false);
+  });
+
+  it("dates the received request like the run chip", () => {
+    const w = mountOutcome({ status: "expired", reason: "expired" });
+    expect(w.findComponent({ name: "OTimeCell" }).props("format")).toBe("MMM d, yyyy HH:mm");
+  });
+
+  it("worker-lost run shows the error banner telling the user to check destinations", () => {
+    const w = mountOutcome({ status: "failed", reason: "worker_lost" });
+    expect(w.find('[data-test="workflow-run-worker-lost-banner"]').text()).toContain(
+      "The worker running this request stopped.",
+    );
+  });
+
+  it("timed-out run shows its reason", () => {
+    const w = mountOutcome({ status: "failed", reason: "run_timeout" });
+    expect(w.find('[data-test="workflow-run-never-ran"]').text()).toContain(
+      "timed out after 15 min",
+    );
+  });
+
+  it("renders nothing for a successful run", () => {
+    const w = mountOutcome({ status: "succeeded" });
+    expect(w.find('[data-test="workflow-run-error"]').exists()).toBe(false);
+    expect(w.find('[data-test="workflow-run-never-ran"]').exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/workflows/WorkflowRunHttpOutcome.vue b/web/src/components/workflows/WorkflowRunHttpOutcome.vue
new file mode 100644
index 0000000000..50ce3c583a
--- /dev/null
+++ b/web/src/components/workflows/WorkflowRunHttpOutcome.vue
@@ -0,0 +1,118 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div v-if="neverRan" data-test="workflow-run-never-ran" class="flex shrink-0 flex-col gap-2">
+    <div class="flex items-center gap-2">
+      <OTag type="hookRunStatus" :value="status" size="sm" />
+      <span class="text-text-secondary inline-flex items-center gap-1 text-xs">
+        {{ t("workflow.http.requestReceived") }}
+        <OTimeCell
+          :value="receivedAt"
+          unit="us"
+          mode="absolute"
+          :format="RUN_TIME_LONG"
+          :timezone="store.state.timezone"
+          :empty-label="dash"
+        />
+      </span>
+    </div>
+    <OBanner
+      v-if="reason === 'expired'"
+      variant="info"
+      dense
+      data-test="workflow-run-expired-banner"
+      :content="t('workflow.http.runExpiredBanner')"
+    />
+    <OBanner
+      v-else-if="reason === 'worker_lost'"
+      variant="error-soft"
+      dense
+      data-test="workflow-run-worker-lost-banner"
+      :content="t('workflow.http.runWorkerLostBanner')"
+    />
+    <span v-else-if="reason" class="text-text-secondary text-xs">
+      {{ t(RUN_REASON_KEYS[reason]) }}
+    </span>
+  </div>
+  <div v-else-if="failedStep" class="flex shrink-0 flex-col gap-1">
+    <OBanner
+      variant="error-soft"
+      dense
+      inline-actions
+      data-test="workflow-run-error"
+      :content="t('workflow.http.runFailedAt', { step: failedStep.label, error: error ?? '' })"
+    >
+      <template #actions>
+        <OButton
+          variant="outline"
+          size="sm"
+          data-test="workflow-run-error-open-step"
+          @click="emit('open-step', failedStep.id)"
+        >
+          {{ t("workflow.http.openStep") }}
+        </OButton>
+      </template>
+    </OBanner>
+    <!-- JS errors rarely name the missing path, so the hint keys off the failing step's type. -->
+    <div
+      v-if="failedStep.isFunction"
+      data-test="workflow-run-http-guard-hint"
+      class="text-text-secondary text-xs"
+    >
+      {{ t("workflow.http.runGuardHint", { fields: guardFields, guard: guardCondition }) }}
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { useStore } from "vuex";
+import { raw, useI18nTyped } from "@/types/i18n";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import type { HookRunStatus } from "@/services/workflows";
+import {
+  RUN_REASON_KEYS,
+  RUN_TIME_LONG,
+  hasStoredRunData,
+  type RunReason,
+} from "@/plugins/workflows/runStatus";
+
+const props = defineProps<{
+  status: HookRunStatus;
+  reason: RunReason | null;
+  receivedAt: number | null;
+  failedStep: { id: string; label: string; isFunction: boolean } | null;
+  error: string | null;
+  /** The workflow's trigger kind; the guard hint names the fields that kind's steps read. */
+  triggerKind?: string;
+}>();
+const emit = defineEmits<{ (e: "open-step", nodeId: string): void }>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+const dash = raw("—");
+const guardFields = computed(() =>
+  raw(props.triggerKind === "incident_event" ? "meta.event_type" : "meta.alert_*"),
+);
+const guardCondition = raw("meta.trigger_source is empty");
+
+// A reason code doubles as the ledger error, so the shared "nothing stored" rule applies as is.
+const neverRan = computed(() => !hasStoredRunData({ status: props.status, error: props.reason }));
+</script>
diff --git a/web/src/components/workflows/WorkflowRunRequestFacts.spec.ts b/web/src/components/workflows/WorkflowRunRequestFacts.spec.ts
new file mode 100644
index 0000000000..d2049e5728
--- /dev/null
+++ b/web/src/components/workflows/WorkflowRunRequestFacts.spec.ts
@@ -0,0 +1,110 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import WorkflowRunRequestFacts from "./WorkflowRunRequestFacts.vue";
+
+const facts = (over: Record<string, unknown> = {}) => ({
+  credential_prefix: "o2wh_4fK9…oI4k",
+  caller_ip: "203.0.113.24",
+  idempotency_key: "deploy-d-4821",
+  content_type: "application/json",
+  body_bytes: 68,
+  status: "failed" as const,
+  error: null,
+  ...over,
+});
+const headers = {
+  "content-type": "application/json",
+  "user-agent": "deploy-bot/2.4",
+  "idempotency-key": "deploy-d-4821",
+  "x-request-id": "5c1e9a0b",
+};
+
+const TableStub = {
+  name: "OTable",
+  props: ["data", "columns", "rowKey", "pagination", "showGlobalFilter", "dense", "frame"],
+  template: `<div class="o-table"><div v-for="r in data" :key="r.name" class="o-row">{{ r.name }}={{ r.value }}</div></div>`,
+};
+
+const mountFacts = (props: Record<string, unknown> = {}) =>
+  mount(WorkflowRunRequestFacts, {
+    props: { facts: facts(), receivedAt: 1_792_575_542_418_000, headers, ...props },
+    global: {
+      plugins: [i18n, store],
+      stubs: {
+        OTable: TableStub,
+        OTimeCell: {
+          name: "OTimeCell",
+          props: ["value", "unit", "mode", "format"],
+          template: "<time />",
+        },
+      },
+    },
+  });
+
+describe("WorkflowRunRequestFacts", () => {
+  it("shows the request facts from http_request", () => {
+    const w = mountFacts();
+    const req = w.find('[data-test="workflow-run-request"]');
+    expect(req.exists()).toBe(true);
+    const text = req.text();
+    for (const label of [
+      "Received",
+      "Token",
+      "Caller IP",
+      "Idempotency key",
+      "Content type",
+      "Body size",
+    ])
+      expect(text).toContain(label);
+    expect(text).toContain("o2wh_4fK9…oI4k");
+    expect(text).toContain("203.0.113.24");
+    expect(text).toContain("deploy-d-4821");
+    expect(text).toContain("application/json");
+    expect(text).toContain("68 B");
+    expect(w.findComponent({ name: "OTimeCell" }).props("value")).toBe(1_792_575_542_418_000);
+    expect(w.findComponent({ name: "OTimeCell" }).props("format")).toBe("MMM d, yyyy HH:mm");
+  });
+
+  it("shows — for a fact the ledger does not hold", () => {
+    const w = mountFacts({ facts: facts({ idempotency_key: null, content_type: null }) });
+    const items = w.findAll('[data-test="o2-description-item"]').map((i) => i.text());
+    expect(items.find((t) => t.startsWith("Idempotency key"))).toContain("—");
+    expect(items.find((t) => t.startsWith("Content type"))).toContain("—");
+  });
+
+  it("lists the kept headers and says what is never stored", () => {
+    const w = mountFacts();
+    const box = w.find('[data-test="workflow-run-headers"]');
+    expect(box.text()).toContain("Headers");
+    expect(box.text()).toContain("4 kept · Authorization, cookies and signatures are never stored");
+    const rows = w.findAll(".o-row").map((r) => r.text());
+    expect(rows).toEqual([
+      "content-type=application/json",
+      "user-agent=deploy-bot/2.4",
+      "idempotency-key=deploy-d-4821",
+      "x-request-id=5c1e9a0b",
+    ]);
+  });
+
+  it("formats a larger body in KiB", () => {
+    const w = mountFacts({ facts: facts({ body_bytes: 1536 }) });
+    expect(w.find('[data-test="workflow-run-request"]').text()).toContain("1.5 KiB");
+  });
+});
diff --git a/web/src/components/workflows/WorkflowRunRequestFacts.vue b/web/src/components/workflows/WorkflowRunRequestFacts.vue
new file mode 100644
index 0000000000..c667aaf581
--- /dev/null
+++ b/web/src/components/workflows/WorkflowRunRequestFacts.vue
@@ -0,0 +1,117 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <section
+    data-test="workflow-run-request"
+    class="border-border-default rounded-default flex shrink-0 flex-col gap-3 border p-3"
+  >
+    <div class="text-text-body text-sm font-semibold">{{ t("workflow.http.request") }}</div>
+    <ODescriptionList :columns="2" dense>
+      <ODescriptionItem :label="t('workflow.http.requestReceived')" stacked>
+        <OTimeCell
+          :value="receivedAt"
+          unit="us"
+          mode="absolute"
+          :format="RUN_TIME_LONG"
+          :timezone="store.state.timezone"
+          :empty-label="dash"
+        />
+      </ODescriptionItem>
+      <ODescriptionItem :label="t('workflow.http.requestToken')" stacked>
+        <span v-if="facts.credential_prefix" class="font-mono">{{ facts.credential_prefix }}</span>
+      </ODescriptionItem>
+      <ODescriptionItem :label="t('workflow.http.requestCallerIp')" stacked>
+        <span v-if="facts.caller_ip" class="font-mono">{{ facts.caller_ip }}</span>
+      </ODescriptionItem>
+      <ODescriptionItem :label="t('workflow.http.requestIdempotencyKey')" stacked>
+        <span v-if="facts.idempotency_key" class="font-mono">{{ facts.idempotency_key }}</span>
+      </ODescriptionItem>
+      <ODescriptionItem :label="t('workflow.http.requestContentType')" stacked>
+        <span v-if="facts.content_type" class="font-mono">{{ facts.content_type }}</span>
+      </ODescriptionItem>
+      <ODescriptionItem :label="t('workflow.http.requestBodySize')" stacked>
+        {{ bodySize }}
+      </ODescriptionItem>
+    </ODescriptionList>
+    <OCollapsible
+      :label="t('workflow.http.headers')"
+      :caption="t('workflow.http.headersKept', { count: headerRows.length }, headerRows.length)"
+      default-open
+      data-test="workflow-run-headers"
+    >
+      <OTable
+        :data="headerRows"
+        :columns="headerColumns"
+        row-key="name"
+        pagination="none"
+        :show-global-filter="false"
+        :show-header="false"
+        :frame="false"
+        dense
+      />
+    </OCollapsible>
+  </section>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { useStore } from "vuex";
+import { raw, useI18nTyped } from "@/types/i18n";
+import ODescriptionList from "@/lib/lists/DescriptionList/ODescriptionList.vue";
+import ODescriptionItem from "@/lib/lists/DescriptionList/ODescriptionItem.vue";
+import OCollapsible from "@/lib/core/Collapsible/OCollapsible.vue";
+import OTable from "@/lib/core/Table/OTable.vue";
+import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
+import type { HttpRequestFacts } from "@/services/workflows";
+import { RUN_TIME_LONG, bodySizeParts } from "@/plugins/workflows/runStatus";
+
+const props = defineProps<{
+  facts: HttpRequestFacts;
+  receivedAt: number;
+  headers: Record<string, string>;
+}>();
+
+const { t } = useI18nTyped();
+const store = useStore();
+const dash = raw("—");
+
+const bodySize = computed(() => {
+  const { key, size } = bodySizeParts(props.facts.body_bytes);
+  return t(key, { size });
+});
+
+const headerRows = computed(() =>
+  Object.entries(props.headers || {}).map(([name, value]) => ({ name, value: String(value) })),
+);
+
+const headerColumns = computed<OTableColumnDef[]>(() => [
+  {
+    id: "name",
+    header: t("workflow.http.headerName"),
+    accessorKey: "name",
+    size: 180,
+    meta: { align: "left", cellClass: "font-mono" },
+  },
+  {
+    id: "value",
+    header: t("workflow.http.headerValue"),
+    accessorKey: "value",
+    meta: { align: "left", flex: true, cellClass: "font-mono" },
+  },
+]);
+</script>
diff --git a/web/src/components/workflows/WorkflowRunSwitcher.spec.ts b/web/src/components/workflows/WorkflowRunSwitcher.spec.ts
index 341e7ae73a..960edced3f 100644
--- a/web/src/components/workflows/WorkflowRunSwitcher.spec.ts
+++ b/web/src/components/workflows/WorkflowRunSwitcher.spec.ts
@@ -63,7 +63,7 @@ const globalCfg = {
     OIcon: stub("OIcon", ["name", "size"]),
     OBadge: stub("OBadge", ["variant", "size"]),
     OTooltip: stub("OTooltip", ["side", "content", "maxWidth"]),
-    OTimeCell: stub("OTimeCell", ["value", "unit", "mode", "timezone", "emptyLabel"]),
+    OTimeCell: stub("OTimeCell", ["value", "unit", "mode", "timezone", "emptyLabel", "format"]),
     ORefreshButton: stub("ORefreshButton", ["lastRunAt", "loading"]),
     OButton: stub("OButton", ["variant", "size", "iconLeft", "loading"]),
   },
@@ -117,6 +117,14 @@ describe("WorkflowRunSwitcher — test runs in the History dropdown", () => {
 
   // The regression risk: a draft's history is almost entirely test runs, and
   // that is exactly what its author wants to see.
+  it("dates each run like the run chip (Oct 21, 2026 09:39)", async () => {
+    workflowObj.currentSelectedWorkflow.isDraft = false;
+    workflowObj.runsHistory.list = [REAL_RUN("r1")] as any;
+    const wrapper = mountSwitcher();
+    await flushPromises();
+    expect(wrapper.findComponent({ name: "OTimeCell" }).props("format")).toBe("MMM d, yyyy HH:mm");
+  });
+
   it("shows test runs on a DRAFT", async () => {
     workflowObj.currentSelectedWorkflow.isDraft = true;
     workflowObj.runsHistory.list = [TEST_RUN("t1"), REAL_RUN("r1")] as any;
@@ -189,3 +197,46 @@ describe("WorkflowRunSwitcher — test runs in the History dropdown", () => {
     expect(wrapper.emitted("select")?.[0]).toEqual(["old"]);
   });
 });
+
+describe("WorkflowRunSwitcher — stored run status", () => {
+  const tags = (wrapper: any) =>
+    wrapper
+      .findAllComponents({ name: "OTag" })
+      .filter((c: any) => c.props("type") === "hookRunStatus")
+      .map((c: any) => c.props("value"));
+
+  beforeEach(() => {
+    workflowObj.runsHistory = {
+      list: [],
+      fetchedAt: 0,
+      params: { start: 0, end: 0 },
+      loading: false,
+    } as any;
+    workflowObj.currentSelectedWorkflow = {
+      id: "wf-1",
+      nodes: [],
+      edges: [],
+      isDraft: true,
+    } as any;
+  });
+
+  it("renders each run's status through the hookRunStatus badge group, never from error", async () => {
+    workflowObj.runsHistory.list = [
+      { ...REAL_RUN("a"), start_time: 3, status: "succeeded", error: "warning text" },
+      { ...REAL_RUN("b"), start_time: 2, status: "failed", error: null },
+      { ...REAL_RUN("c"), start_time: 1, event_type: "Webhook", status: "expired" },
+    ] as any;
+    const wrapper = mount(WorkflowRunSwitcher, {
+      props: { currentRunId: "", orgId: "default", workflowId: "wf-1" },
+      global: {
+        ...globalCfg,
+        stubs: {
+          ...globalCfg.stubs,
+          OTag: { name: "OTag", props: ["type", "value", "size"], template: "<b />" },
+        },
+      },
+    });
+    await flushPromises();
+    expect(tags(wrapper)).toEqual(["succeeded", "failed", "expired"]);
+  });
+});
diff --git a/web/src/components/workflows/WorkflowRunSwitcher.vue b/web/src/components/workflows/WorkflowRunSwitcher.vue
index ec8e6bf420..f79988e84d 100644
--- a/web/src/components/workflows/WorkflowRunSwitcher.vue
+++ b/web/src/components/workflows/WorkflowRunSwitcher.vue
@@ -68,6 +68,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 :value="run.start_time"
                 unit="us"
                 mode="absolute"
+                :format="RUN_TIME_LONG"
                 :timezone="store.state.timezone"
                 :empty-label="raw('—')"
               />
@@ -76,14 +77,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               <OBadge v-if="isTestRun(run)" variant="default-soft" size="xs">
                 {{ t("workflow.history.testRun") }}
               </OBadge>
-              <OBadge :variant="run.error ? 'error-soft' : 'success-soft'" size="xs">
-                {{ run.error ? t("workflow.history.failed") : t("workflow.history.success") }}
-              </OBadge>
+              <OTag type="hookRunStatus" :value="run.status" size="xs" />
             </span>
           </div>
           <!-- Hover a failed run to read WHY it failed without leaving the menu. -->
           <OTooltip
-            v-if="run.error"
+            v-if="run.status === 'failed' && run.error"
             :content="raw(String(run.error))"
             side="left"
             max-width="22rem"
@@ -130,9 +129,11 @@ import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
 import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
+import { RUN_TIME_LONG } from "@/plugins/workflows/runStatus";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
 import { isTestRun, useTestRunVisibility } from "@/plugins/workflows/useWorkflowCanvas";
 import { workflowObj, loadRunsHistory } from "@/plugins/workflows/useWorkflowCanvas";
diff --git a/web/src/components/workflows/WorkflowRuns.spec.ts b/web/src/components/workflows/WorkflowRuns.spec.ts
index cf7d2c35ba..cca07d14cc 100644
--- a/web/src/components/workflows/WorkflowRuns.spec.ts
+++ b/web/src/components/workflows/WorkflowRuns.spec.ts
@@ -19,7 +19,7 @@
 // inspect separate (Edit Workflow -> editor route; back -> list). The canvas /
 // panel / result drawer are stubbed.
 
-import { vi, describe, it, expect, beforeEach } from "vitest";
+import { vi, describe, it, expect, beforeEach, afterEach } from "vitest";
 
 const {
   mockRouter,
@@ -72,12 +72,17 @@ vi.mock("@/plugins/workflows/useWorkflowCanvas", () => ({
   retryWorkflowRun: (...a: any[]) => mockRetry(...a),
   isRetryableRun: (run: any) =>
     !!run && !!run.error && run.event_type !== "Test" && run.event_type !== "Retry",
+  currentTriggerKind: () => "alert_fired",
+  currentTriggerNodeId: () => "t1",
 }));
 
 import { mount, flushPromises } from "@vue/test-utils";
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
 import WorkflowRuns from "./WorkflowRuns.vue";
+import workflowService from "@/services/workflows";
+import { queryClient } from "@/composables/query/queryClient";
+import { httpConfig } from "@/test/unit/helpers/workflowHttp";
 
 const OPageHeaderStub = {
   name: "OPageHeader",
@@ -96,8 +101,8 @@ const OButtonStub = {
 };
 const RunsPanelStub = {
   name: "WorkflowRunsPanel",
-  props: ["orgId", "workflowId", "workflowName", "selectedRunId"],
-  emits: ["select-run"],
+  props: ["orgId", "workflowId", "workflowName", "selectedRunId", "triggerFilter"],
+  emits: ["select-run", "update:triggerFilter"],
   template: `<div class="runs-panel" />`,
 };
 const stub = (name: string) => ({ name, template: `<div class="${name}" />` });
@@ -115,7 +120,27 @@ const globalCfg = {
       template: `<div class="WorkflowResultsDock"><slot /></div>`,
     },
     WorkflowCanvas: stub("WorkflowCanvas"),
-    WorkflowTestDialog: stub("WorkflowTestDialog"),
+    WorkflowTestDialog: {
+      name: "WorkflowTestDialog",
+      props: ["seed", "payloadFrom", "seedRunAt"],
+      template: `<div class="WorkflowTestDialog" />`,
+    },
+    WorkflowHttpEndpointPanel: {
+      name: "WorkflowHttpEndpointPanel",
+      props: [
+        "open",
+        "workflowId",
+        "workflowName",
+        "kind",
+        "isDraftOnly",
+        "workflowEnabled",
+        "context",
+        "beforeCreate",
+        "triggerNodeId",
+      ],
+      emits: ["update:open", "run-test"],
+      template: `<div class="WorkflowHttpEndpointPanel" />`,
+    },
   },
 };
 
@@ -304,6 +329,19 @@ describe("WorkflowRuns", () => {
     expect(mockRouter.push).not.toHaveBeenCalled();
   });
 
+  it("gives the runs panel one static width whatever the filter", async () => {
+    const wrapper = await mountRuns();
+    const box = () => wrapper.find('[data-test="workflow-runs-panel"]').classes();
+    const before = box();
+    expect(before).toEqual(expect.arrayContaining(["w-[50rem]", "max-w-[60%]", "max-lg:w-full"]));
+    panel(wrapper).vm.$emit("update:triggerFilter", "http_request");
+    await flushPromises();
+    expect(box()).toEqual(before);
+    panel(wrapper).vm.$emit("update:triggerFilter", "alert_fired");
+    await flushPromises();
+    expect(box()).toEqual(before);
+  });
+
   it("back returns to the workflows list", async () => {
     const wrapper = await mountRuns();
     await wrapper.find(".back-btn").trigger("click");
@@ -373,3 +411,115 @@ describe("WorkflowRuns — retry the loaded run", () => {
     expect(mockToast).toHaveBeenCalledWith(expect.objectContaining({ variant: "error" }));
   });
 });
+
+describe("WorkflowRuns — HTTP endpoint", () => {
+  const getHttpTrigger = vi.mocked(workflowService.getHttpTrigger);
+  const button = (w: any) => w.find('[data-test="workflow-runs-http-endpoint"]');
+  const chip = (w: any) => w.find('[data-test="workflow-runs-http-endpoint-chip"]');
+  const chipVariant = (w: any) =>
+    w
+      .findAllComponents({ name: "OTag" })
+      .find((c: any) => c.find('[data-test="workflow-runs-http-endpoint-chip"]').exists())
+      ?.props("variant");
+  const httpPanel = (w: any) => w.findComponent({ name: "WorkflowHttpEndpointPanel" });
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    queryClient.clear();
+    listWorkflows.mockResolvedValue({ data: [] });
+    mockLoadRun.mockResolvedValue({ ok: true });
+    getHttpTrigger.mockResolvedValue(httpConfig());
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: true };
+    workflowObj.readOnly = false;
+    workflowObj.testRun = { resultDrawer: { show: false, nodeId: "" }, result: null, show: false };
+    workflowObj.currentSelectedWorkflow = {
+      id: "wf-1",
+      name: "my flow",
+      nodes: [],
+      edges: [],
+      enabled: true,
+    };
+  });
+  afterEach(() => {
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+  });
+
+  it("shows the button on the read-only page, just before Test, with the live chip", async () => {
+    const wrapper = await mountRuns();
+    expect(workflowObj.readOnly).toBe(true);
+    expect(button(wrapper).text()).toContain(i18n.global.t("workflow.http.editorButton"));
+    expect(chipVariant(wrapper)).toBe("success-soft");
+    const html = wrapper.html();
+    const at = (id: string) => html.indexOf(`data-test="${id}"`);
+    expect(at("workflow-runs-http-endpoint")).toBeLessThan(at("workflow-runs-test"));
+    expect(at("workflow-runs-test")).toBeLessThan(at("workflow-runs-edit"));
+    wrapper.unmount();
+  });
+
+  it("shows the neutral Off chip for an endpoint that is switched off", async () => {
+    getHttpTrigger.mockResolvedValue(httpConfig({ enabled: false }));
+    const wrapper = await mountRuns();
+    expect(chipVariant(wrapper)).toBe("default-soft");
+    expect(chip(wrapper).text()).toBe(i18n.global.t("workflow.http.editorButtonOff"));
+    wrapper.unmount();
+  });
+
+  it("shows a paused workflow's live endpoint as a warning", async () => {
+    workflowObj.currentSelectedWorkflow.enabled = false;
+    const wrapper = await mountRuns();
+    expect(chipVariant(wrapper)).toBe("warning-soft");
+    wrapper.unmount();
+  });
+
+  it("has no button or panel while HTTP endpoints are disabled for the org", async () => {
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    // Pages the earlier suites never unmounted fetch when beforeEach turns the flag on.
+    await flushPromises();
+    getHttpTrigger.mockClear();
+    const wrapper = await mountRuns();
+    expect(button(wrapper).exists()).toBe(false);
+    expect(httpPanel(wrapper).exists()).toBe(false);
+    expect(getHttpTrigger).not.toHaveBeenCalled();
+    wrapper.unmount();
+  });
+
+  it("opens the panel with this page's workflow in the editor context", async () => {
+    const wrapper = await mountRuns();
+    expect(httpPanel(wrapper).props("open")).toBe(false);
+    await button(wrapper).trigger("click");
+    expect(httpPanel(wrapper).props()).toMatchObject({
+      open: true,
+      workflowId: "wf-1",
+      workflowName: "my flow",
+      kind: "alert_fired",
+      isDraftOnly: false,
+      workflowEnabled: true,
+      context: "editor",
+      triggerNodeId: "t1",
+    });
+    await httpPanel(wrapper).vm.$emit("update:open", false);
+    expect(httpPanel(wrapper).props("open")).toBe(false);
+    wrapper.unmount();
+  });
+
+  it("Run test closes the panel, clears the selected run and opens a seeded Test dialog", async () => {
+    const wrapper = await mountRuns();
+    panel(wrapper).vm.$emit("select-run", "run-5");
+    await flushPromises();
+    expect(panel(wrapper).props("selectedRunId")).toBe("run-5");
+    await button(wrapper).trigger("click");
+
+    const seed = [{ meta: { trigger_source: "http", trigger_id: "test" }, data: [] }];
+    await httpPanel(wrapper).vm.$emit("run-test", seed, 42);
+    await flushPromises();
+
+    expect(httpPanel(wrapper).props("open")).toBe(false);
+    expect(panel(wrapper).props("selectedRunId")).toBe("");
+    expect(workflowObj.testRun.show).toBe(true);
+    const dialog = wrapper.findComponent({ name: "WorkflowTestDialog" });
+    expect(dialog.props("seed")).toEqual(seed);
+    expect(dialog.props("payloadFrom")).toBe("http");
+    expect(dialog.props("seedRunAt")).toBe(42);
+    wrapper.unmount();
+  });
+});
diff --git a/web/src/components/workflows/WorkflowRuns.vue b/web/src/components/workflows/WorkflowRuns.vue
index 823a142768..05ab236f65 100644
--- a/web/src/components/workflows/WorkflowRuns.vue
+++ b/web/src/components/workflows/WorkflowRuns.vue
@@ -53,6 +53,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </span>
       </template>
       <template #actions-overflow>
+        <WorkflowHttpEndpointButton
+          v-if="hooksOn"
+          :chip="httpChip"
+          :tooltip-key="httpTooltipKey"
+          data-test="workflow-runs-http-endpoint"
+          @click="httpPanelOpen = true"
+        />
         <!-- Test is a read-only dry-run (it never edits the workflow), so it's
              offered here too — no need to switch to the editor just to test. -->
         <OButton variant="outline" data-test="workflow-runs-test" @click="onTest">
@@ -100,8 +107,6 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <WorkflowCanvas />
       </div>
 
-      <!-- Collapsible so a wide graph can be read whole; the panel is a fixed 27.5rem
-           of this master-detail page and there is nowhere else for the canvas to grow. -->
       <OButton
         variant="outline"
         size="icon-sm"
@@ -124,7 +129,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       <div
         v-if="!panelCollapsed"
         data-test="workflow-runs-panel"
-        class="rounded-surface border-border-default bg-surface-base mb-3 flex min-h-0 w-[27.5rem] max-w-[46%] shrink-0 flex-col overflow-hidden border max-lg:h-96 max-lg:w-full max-lg:max-w-full"
+        class="rounded-surface border-border-default bg-surface-base mb-3 flex min-h-0 w-[50rem] max-w-[60%] shrink-0 flex-col overflow-hidden border max-lg:h-96 max-lg:w-full max-lg:max-w-full"
       >
         <WorkflowRunsPanel
           ref="runsPanelRef"
@@ -144,7 +149,27 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     <!-- Test input popup — a fresh dry-run of the current graph, launched from the
          header. Results paint on the read-only canvas (switching it out of the
          selected historical run) and the node NDV shows each step's I/O. -->
-    <WorkflowTestDialog v-if="workflowObj.testRun.show" />
+    <WorkflowTestDialog
+      v-if="workflowObj.testRun.show"
+      :seed="testSeed"
+      :payload-from="testPayloadFrom"
+      :seed-run-at="testSeedRunAt"
+    />
+
+    <WorkflowHttpEndpointPanel
+      v-if="hooksOn"
+      :open="httpPanelOpen"
+      :workflow-id="workflowId || null"
+      :workflow-name="workflowName"
+      :kind="httpKind"
+      :is-draft-only="isDraft"
+      :workflow-enabled="workflowEnabled"
+      context="editor"
+      :trigger-node-id="httpTriggerNodeId"
+      @update:open="httpPanelOpen = $event"
+      @run-test="onHttpRunTest"
+      @view-run="onPanelViewRun"
+    />
   </div>
 </template>
 
@@ -166,13 +191,19 @@ import WorkflowCanvas from "@/plugins/workflows/WorkflowCanvas.vue";
 import WorkflowNodeDrawer from "./WorkflowNodeDrawer.vue";
 import WorkflowTestDialog from "./WorkflowTestDialog.vue";
 import WorkflowRunsPanel from "./WorkflowRunsPanel.vue";
+import WorkflowHttpEndpointButton from "./WorkflowHttpEndpointButton.vue";
+import WorkflowHttpEndpointPanel from "./WorkflowHttpEndpointPanel.vue";
 import useWorkflowCanvas, {
   workflowObj,
   hydrateWorkflow,
   loadWorkflowRun,
   isRetryableRun,
   retryWorkflowRun,
+  currentTriggerKind,
+  currentTriggerNodeId,
 } from "@/plugins/workflows/useWorkflowCanvas";
+import { useWorkflowHttpButton } from "@/plugins/workflows/useWorkflowHttpButton";
+import type { PayloadFrom } from "@/plugins/workflows/httpEndpointUi";
 import { workflowsQuery } from "@/services/workflows.queries";
 import { queryClient } from "@/composables/query/queryClient";
 
@@ -181,6 +212,7 @@ const { t } = useI18nTyped();
 const { resetWorkflowData } = useWorkflowCanvas(t);
 
 const router = useRouter();
+
 const store = useStore();
 
 const orgId = computed(() => store.state.selectedOrganization.identifier as string);
@@ -194,8 +226,31 @@ const activeFolderId = computed(
 );
 const workflowId = computed(() => (router.currentRoute.value.query.id as string) || "");
 const workflowName = computed(() => workflowObj.currentSelectedWorkflow?.name || "");
+const isDraft = computed(() => !!workflowObj.currentSelectedWorkflow?.isDraft);
+const workflowEnabled = computed(() => workflowObj.currentSelectedWorkflow?.enabled !== false);
 const selectedRunId = ref<string>("");
 
+const {
+  visible: hooksOn,
+  chip: httpChip,
+  tooltipKey: httpTooltipKey,
+} = useWorkflowHttpButton({ workflowId, isDraft, workflowEnabled });
+const httpKind = computed(() => currentTriggerKind());
+const httpTriggerNodeId = computed(() => currentTriggerNodeId());
+const httpPanelOpen = ref(false);
+const testSeed = ref<unknown[] | undefined>(undefined);
+const testPayloadFrom = ref<PayloadFrom | undefined>(undefined);
+const testSeedRunAt = ref<number | undefined>(undefined);
+watch(
+  () => workflowObj.testRun.show,
+  (show) => {
+    if (show) return;
+    testSeed.value = undefined;
+    testPayloadFrom.value = undefined;
+    testSeedRunAt.value = undefined;
+  },
+);
+
 // Steps this run executed that no longer exist in the workflow (deleted/edited
 // since). Their badges can't render, so the canvas alone would under-report the
 // run — the banner tells the user the graph has moved on.
@@ -243,6 +298,14 @@ const onTest = () => {
   workflowObj.testRun.show = true;
 };
 
+const onHttpRunTest = (seed: unknown[], runAt?: number) => {
+  httpPanelOpen.value = false;
+  testSeed.value = seed;
+  testPayloadFrom.value = "http";
+  testSeedRunAt.value = runAt;
+  onTest();
+};
+
 // A live test result (from the header Test button, or a step drawer's "Use as Test
 // Input" which drops the user into a fresh test) replaces the historical run on the
 // canvas. Deselect the run so the list stops highlighting a row that no longer
@@ -362,6 +425,23 @@ const onSelectRun = async (runId: string) => {
   });
 };
 
+// The panel's "View run" link lands on this same route, which does not remount.
+watch(
+  () => router.currentRoute.value.query.run_id,
+  (runId) => {
+    if (typeof runId !== "string" || !runId || runId === selectedRunId.value) return;
+    httpPanelOpen.value = false;
+    void onSelectRun(runId);
+  },
+);
+
+// A run already in the URL changes no route, so the watch above never reloads it.
+const onPanelViewRun = (runId: string) => {
+  if (runId === router.currentRoute.value.query.run_id && runId !== selectedRunId.value) {
+    void onSelectRun(runId);
+  }
+};
+
 onMounted(async () => {
   // Read-only inspection surface — no editing on the canvas.
   workflowObj.readOnly = true;
diff --git a/web/src/components/workflows/WorkflowRunsPanel.spec.ts b/web/src/components/workflows/WorkflowRunsPanel.spec.ts
index 6272fab29b..971b07a6f4 100644
--- a/web/src/components/workflows/WorkflowRunsPanel.spec.ts
+++ b/web/src/components/workflows/WorkflowRunsPanel.spec.ts
@@ -21,10 +21,12 @@
 
 import { vi, describe, it, expect, beforeEach, afterEach } from "vitest";
 
-const { mockList, mockToast, mockRetry } = vi.hoisted(() => ({
+const { mockList, mockToast, mockRetry, mockGetHttp, mockAlerts } = vi.hoisted(() => ({
+  mockAlerts: vi.fn().mockResolvedValue({ data: { list: [] } }),
   mockList: vi.fn().mockResolvedValue({ data: [] }),
   mockToast: vi.fn(),
   mockRetry: vi.fn().mockResolvedValue({ data: {} }),
+  mockGetHttp: vi.fn().mockResolvedValue({ configured: false }),
 }));
 
 vi.mock("@/services/workflows", async (importOriginal) => {
@@ -33,9 +35,16 @@ vi.mock("@/services/workflows", async (importOriginal) => {
     default: {
       getWorkflowHistory: (...a: any[]) => mockList(...a),
       retryWorkflow: (...a: any[]) => mockRetry(...a),
+      getHttpTrigger: (...a: any[]) => mockGetHttp(...a),
     },
   });
 });
+vi.mock("@/services/alerts", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: { listByFolderId: (...a: any[]) => mockAlerts(...a) },
+  });
+});
 vi.mock("@/lib/feedback/Toast/useToast", () => ({
   toast: (...a: any[]) => mockToast(...a),
 }));
@@ -103,16 +112,17 @@ const globalCfg = {
   plugins: [i18n, store],
   stubs: {
     OTable: OTableStub,
-    OTimeCell: stub("OTimeCell", ["value", "unit", "mode", "timezone", "emptyLabel"]),
+    OTimeCell: stub("OTimeCell", ["value", "unit", "mode", "timezone", "emptyLabel", "format"]),
     OBadge: stub("OBadge", ["variant", "size"]),
+    OTag: {
+      name: "OTag",
+      props: ["type", "value", "size", "label", "variant", "icon"],
+      template: `<b class="o-tag">{{ label || value }}</b>`,
+    },
     OButton: stub("OButton", ["variant", "size", "iconLeft", "loading"]),
     OTooltip: stub("OTooltip", ["side", "content"]),
     DateTime: DateTimeStub,
-    WorkflowExecutionTimeline: stub("WorkflowExecutionTimeline", [
-      "history",
-      "firingLabel",
-      "okLabel",
-    ]),
+    WorkflowRunsTimeline: stub("WorkflowRunsTimeline", ["runs", "start", "end", "timezone"]),
     NoData: stub("NoData"),
     OEmptyState: stub("OEmptyState", ["preset", "filtered"]),
   },
@@ -284,8 +294,22 @@ describe("test runs are filtered out of run history by default", () => {
   const toggle = (w: any) => w.find('[data-test="workflow-runs-show-test"]');
 
   const mixed = [
-    { run_id: "real", event_type: "AlertFired", start_time: 1, end_time: 2, error: null },
-    { run_id: "test", event_type: "Test", start_time: 3, end_time: 4, error: null },
+    {
+      run_id: "real",
+      event_type: "AlertFired",
+      start_time: 1,
+      end_time: 2,
+      error: null,
+      status: "succeeded",
+    },
+    {
+      run_id: "test",
+      event_type: "Test",
+      start_time: 3,
+      end_time: 4,
+      error: null,
+      status: "succeeded",
+    },
   ];
 
   beforeEach(() => {
@@ -349,6 +373,7 @@ describe("run error text names nodes readably", () => {
     start_time: 1,
     end_time: 2,
     error: "errors in nodes: 2d127ed5-b02a-48ab-8839-10f9d58de3f6",
+    status: "failed",
   };
 
   // The reason renders in the status cell's tooltip, so drive that cell and read
@@ -398,7 +423,7 @@ describe("run error text names nodes readably", () => {
 
   // No error, no tooltip — a successful run must not carry an empty explanation.
   it("renders no reason tooltip on a run that did not fail", async () => {
-    expect(await errorText({ ...errRun, error: null })).toBe("");
+    expect(await errorText({ ...errRun, error: null, status: "succeeded" })).toBe("");
   });
 });
 
@@ -413,6 +438,7 @@ describe("WorkflowRunsPanel — retry row action", () => {
     end_time: 2000,
     error: "errors in nodes: abc",
     event_type: "AlertFired",
+    status: "failed",
     ...over,
   });
 
@@ -452,7 +478,7 @@ describe("WorkflowRunsPanel — retry row action", () => {
   });
 
   it("does NOT offer retry on a successful run", async () => {
-    const w = await rowsFor([run({ error: "" })]);
+    const w = await rowsFor([run({ error: "", status: "succeeded" })]);
     expect(w.find('[data-test="workflow-run-retry-r-1"]').exists()).toBe(false);
   });
 
@@ -642,13 +668,7 @@ describe("WorkflowRunsPanel — test-run visibility defaults by draft state", ()
   });
 });
 
-// The panel is a fixed 27.5rem (440px) master-detail column, so the column widths
-// are a hard budget, not a preference: every pixel over the container pushes a
-// column off-screen where no horizontal scrollbar reaches it.
-describe("WorkflowRunsPanel — column layout fits the 27.5rem panel", () => {
-  const PANEL_WIDTH = 440;
-  const INDEX_COL = 56;
-
+describe("WorkflowRunsPanel — one fixed column set", () => {
   const colsOf = (w: any) => w.findComponent(OTableStub as any).props("columns") as any[];
   const byId = (w: any, id: string) => colsOf(w).find((c) => c.id === id);
 
@@ -669,50 +689,39 @@ describe("WorkflowRunsPanel — column layout fits the 27.5rem panel", () => {
     };
   });
 
-  // Defect 2/3: the declared widths summed to 918px in a 440px panel, so Duration,
-  // Started and Ended were pushed out of view entirely.
-  it("declares a total width that fits the panel", async () => {
+  it("declares Started, Status, Run, Trigger, Source details, Duration and Actions at their sizes", async () => {
     const w = await mountCols();
-    const total = colsOf(w).reduce((sum, c) => sum + (c.size ?? 0), INDEX_COL);
-    expect(total).toBeLessThanOrEqual(PANEL_WIDTH);
+    expect(colsOf(w).map((c) => [c.id, c.size])).toEqual([
+      ["start_time", 112],
+      ["status", 92],
+      ["run_id", 88],
+      ["trigger", 124],
+      ["details", 210],
+      ["duration", 84],
+      ["actions", 68],
+    ]);
   });
 
-  // Defect 3: a run history is scanned as "when did it run, how long, did it pass".
-  it("leads with the columns a run history is scanned by", async () => {
+  it("pins actions last and budgets two icon slots", async () => {
     const w = await mountCols();
-    const order = colsOf(w).map((c) => c.id);
-    expect(order.slice(0, 3)).toEqual(["start_time", "duration", "status"]);
-  });
-
-  // Defect 3: `actions` is pinned right, so declaring it between start_time and
-  // end_time made the source order lie about the rendered order.
-  it("declares the pinned actions column last", async () => {
-    const w = await mountCols();
-    const order = colsOf(w).map((c) => c.id);
-    expect(order[order.length - 1]).toBe("actions");
     expect(byId(w, "actions").pinned).toBe("right");
+    expect(byId(w, "actions").meta.actionCount).toBe(2);
   });
 
-  // Defect 2: the Error column flexed to absorb every leftover pixel, so on a
-  // history with no failures the widest column carried nothing but em-dashes. The
-  // reason now rides on the Failed badge instead of holding a column open.
-  it("spends no column width on the error text", async () => {
+  it("spends no column width on the error text and shows no index column", async () => {
     const w = await mountCols();
     expect(byId(w, "error")).toBeUndefined();
-    expect(colsOf(w).some((c) => c.meta?.flex)).toBe(false);
+    expect(w.findComponent(OTableStub as any).props("showIndex")).toBeFalsy();
   });
 
-  // Defect 1: the status cell rendered the Success badge AND the "Test run" badge
-  // inside a column capped at 100px, clipping the second badge to a stray "T".
-  it("gives the test-run marker its own column instead of crowding status", async () => {
+  it("lets Source details absorb what the pinned actions floor leaves", async () => {
     const w = await mountCols();
-    expect(byId(w, "event_type")).toBeTruthy();
+    expect(byId(w, "details").meta).toMatchObject({ autoWidth: true, fillRemaining: true });
+    for (const c of colsOf(w).filter((c) => !["details", "actions"].includes(c.id)))
+      expect(c.maxSize).toBe(c.size);
   });
 });
 
-// Defect 1 (root cause): two badges cannot fit a 100px cell. The status cell must
-// render the outcome alone; the test/real distinction is load-bearing and moves to
-// its own column rather than being dropped.
 describe("WorkflowRunsPanel — test-run marker is legible", () => {
   const testRun = {
     run_id: "t-1",
@@ -750,12 +759,10 @@ describe("WorkflowRunsPanel — test-run marker is legible", () => {
             template: `<div class="o-table">
               <div v-for="r in data" :key="r.run_id" class="o-row">
                 <span class="c-status"><slot name="cell-status" :row="r" /></span>
-                <span class="c-type"><slot name="cell-event_type" :row="r" /></span>
+                <span class="c-trigger"><slot name="cell-trigger" :row="r" /></span>
               </div>
             </div>`,
           },
-          OBadge: { name: "OBadge", props: ["variant", "size"], template: `<b><slot /></b>` },
-          // The shared stub drops its slot, which would hide the marker it wraps.
           OTooltip: {
             name: "OTooltip",
             props: ["side", "content", "maxWidth"],
@@ -773,9 +780,10 @@ describe("WorkflowRunsPanel — test-run marker is legible", () => {
     expect(w.find(".c-status").text()).not.toContain("Test run");
   });
 
-  it("renders the test-run marker in its own cell", async () => {
+  it("names the test run in its Trigger badge", async () => {
     const w = await mountRows();
-    expect(w.find(".c-type").text()).toContain("Test");
+    expect(w.find(".c-trigger").text()).toContain("Test run");
+    expect(w.find('[data-test="workflow-run-test-marker"]').exists()).toBe(true);
   });
 });
 
@@ -788,6 +796,7 @@ describe("WorkflowRunsPanel — a failure still explains itself", () => {
     end_time: 2000,
     error: "boom in node abc",
     event_type: "AlertFired",
+    status: "failed",
   };
 
   beforeEach(() => {
@@ -832,3 +841,455 @@ describe("WorkflowRunsPanel — a failure still explains itself", () => {
     expect(String(tip.props("content"))).toContain("boom in node");
   });
 });
+
+// ── Stored statuses and HTTP request runs (AC-WEB-06, AC-UI-10) ────────────────
+describe("WorkflowRunsPanel — stored statuses and HTTP request runs", () => {
+  const COLUMN_IDS = [
+    "start_time",
+    "status",
+    "run_id",
+    "trigger",
+    "details",
+    "duration",
+    "actions",
+  ];
+  const facts = (over: Record<string, any> = {}) => ({
+    credential_prefix: "o2wh_4fK9…oI4k",
+    caller_ip: "203.0.113.24",
+    idempotency_key: "deploy-d-4821",
+    content_type: "application/json",
+    body_bytes: 68,
+    status: "failed",
+    error: null,
+    ...over,
+  });
+  const row = (over: Record<string, any>) => ({
+    start_time: 1000,
+    end_time: 2000,
+    _timestamp: 1000,
+    error: null,
+    status: "succeeded",
+    event_type: "AlertFired",
+    ...over,
+  });
+  const httpRows = [
+    row({
+      run_id: "0193f2e8-aaaa",
+      event_type: "Webhook",
+      status: "queued",
+      http_request: facts({ status: "queued", idempotency_key: "deploy-d-4825" }),
+    }),
+    row({
+      run_id: "0193f25e-bbbb",
+      event_type: "Webhook",
+      status: "expired",
+      http_request: facts({ status: "expired", idempotency_key: null, caller_ip: "198.51.100.7" }),
+    }),
+    row({
+      run_id: "0193f1f9-cccc",
+      event_type: "Webhook",
+      status: "failed",
+      error: "worker_lost",
+      http_request: facts({ error: "worker_lost", idempotency_key: "deploy-d-4818" }),
+    }),
+    row({
+      run_id: "0193f2c4-dddd",
+      event_type: "Webhook",
+      status: "failed",
+      error: "FunctionNode JS error",
+      http_request: facts({ error: "node_errored" }),
+    }),
+    row({ run_id: "alert-1", event_type: "AlertFired" }),
+    row({ run_id: "retry-1", event_type: "Retry" }),
+  ];
+
+  // Renders every declared column's cell slot so each cell is assertable.
+  const CellTable = {
+    ...OTableStub,
+    template: `<div class="o-table">
+      <slot name="empty" v-if="!data || data.length === 0" />
+      <div v-for="r in data" :key="r.run_id" class="o-row" :data-run="r.run_id">
+        <span v-for="c in columns" :key="c.id" :class="'c-' + c.id">
+          <slot :name="'cell-' + c.id" :row="r" :value="c.accessorFn ? c.accessorFn(r) : r[c.accessorKey]" />
+        </span>
+      </div>
+    </div>`,
+  };
+  const ToggleGroupStub = {
+    name: "OToggleGroup",
+    props: ["modelValue", "type", "mobileDropdown"],
+    emits: ["update:modelValue"],
+    template: `<div class="o-toggle" v-bind="$attrs"><slot /></div>`,
+  };
+  const ToggleItemStub = {
+    name: "OToggleGroupItem",
+    props: ["value", "size", "iconLeft"],
+    template: `<span class="o-toggle-item" v-bind="$attrs"><slot /></span>`,
+  };
+  const SearchStub = {
+    name: "OSearchInput",
+    props: ["modelValue", "placeholder", "size", "clearable"],
+    emits: ["update:modelValue"],
+    template: `<input class="o-search" v-bind="$attrs" />`,
+  };
+  const EmptyStub = {
+    name: "OEmptyState",
+    props: ["preset", "title", "description", "actionLabel", "icon", "size", "filtered"],
+    emits: ["action"],
+    template: `<div class="o-empty" v-bind="$attrs">{{ title }}</div>`,
+  };
+
+  const mounted: any[] = [];
+  const mountHttp = async (list: any[] = httpRows) => {
+    mockList.mockResolvedValue({ data: list });
+    const w = mount(WorkflowRunsPanel, {
+      props: { orgId: "default", workflowId: "wf-http" },
+      global: {
+        ...globalCfg,
+        stubs: {
+          ...globalCfg.stubs,
+          OTable: CellTable,
+          OToggleGroup: ToggleGroupStub,
+          OToggleGroupItem: ToggleItemStub,
+          OSearchInput: SearchStub,
+          OEmptyState: EmptyStub,
+          OTooltip: {
+            name: "OTooltip",
+            props: ["side", "content", "maxWidth"],
+            template: `<i><slot /></i>`,
+          },
+        },
+      },
+    });
+    mounted.push(w);
+    await flushPromises();
+    return w;
+  };
+  const colIds = (w: any) =>
+    (w.findComponent(CellTable as any).props("columns") as any[]).map((c) => c.id);
+  const rowIds = (w: any) =>
+    (w.findComponent(CellTable as any).props("data") as any[]).map((r) => r.run_id);
+  const setFilter = async (w: any, value: string) => {
+    w.findComponent(ToggleGroupStub as any).vm.$emit("update:modelValue", value);
+    await flushPromises();
+  };
+  const filter = (w: any) => w.find('[data-test="workflow-runs-trigger-filter"]');
+  const timeline = (w: any) => w.findComponent({ name: "WorkflowRunsTimeline" });
+
+  beforeEach(() => {
+    mockList.mockClear();
+    mockRetry.mockClear();
+    mockGetHttp.mockReset();
+    mockGetHttp.mockResolvedValue({ configured: false });
+    mockAlerts.mockReset();
+    mockAlerts.mockResolvedValue({ data: { list: [] } });
+    (store.state as any).zoConfig.workflow_hooks_enabled = true;
+    workflowObj.runsHistory = {
+      list: [],
+      fetchedAt: 0,
+      params: { start: 0, end: 0 },
+      loading: false,
+    };
+    workflowObj.currentSelectedWorkflow = {
+      ...workflowObj.currentSelectedWorkflow,
+      id: "wf-http",
+      isDraft: false,
+      http_endpoint_enabled: false,
+      nodes: [
+        {
+          id: "trig",
+          data: { node_type: "workflow_trigger", trigger_kind: "alert_fired" },
+        },
+      ],
+    };
+  });
+
+  afterEach(() => {
+    while (mounted.length) mounted.pop().unmount();
+    delete (store.state as any).zoConfig.workflow_hooks_enabled;
+  });
+
+  it("status comes from the stored status field", async () => {
+    const w = await mountHttp([row({ run_id: "s-1", status: "succeeded", error: "warning text" })]);
+    expect(w.find('[data-run="s-1"] .c-status .o-tag').text()).toBe("succeeded");
+  });
+
+  it("an errored row stored as succeeded renders Failed (server-normalised fixture)", async () => {
+    const w = await mountHttp([row({ run_id: "s-2", status: "failed", error: "boom" })]);
+    const tag = w.find('[data-run="s-2"] .c-status').findComponent({ name: "OTag" });
+    expect(tag.props("type")).toBe("hookRunStatus");
+    expect(tag.props("value")).toBe("failed");
+  });
+
+  it("feeds the timeline from the stored status", async () => {
+    const w = await mountHttp([
+      row({ run_id: "t-1", status: "failed", error: null }),
+      row({ run_id: "t-2", status: "succeeded", error: "x" }),
+      row({ run_id: "t-3", status: "queued", error: null }),
+      row({ run_id: "t-5", status: "expired", error: null }),
+    ]);
+    const runs = timeline(w).props("runs") as { id: string; status: string }[];
+    expect(runs.map((r) => [r.id, r.status])).toEqual([
+      ["t-1", "failed"],
+      ["t-2", "succeeded"],
+      ["t-3", "queued"],
+      ["t-5", "expired"],
+    ]);
+  });
+
+  it("pins the timeline to the picked range and keeps it when a filter matches nothing", async () => {
+    mockGetHttp.mockResolvedValue({ configured: true, enabled: true });
+    const w = await mountHttp([
+      row({ run_id: "h-1", event_type: "Webhook", http_request: facts() }),
+    ]);
+    expect(timeline(w).props("start")).toBe(1000);
+    expect(timeline(w).props("end")).toBe(2000);
+    await setFilter(w, "alert_fired");
+    expect(rowIds(w)).toEqual([]);
+    expect(timeline(w).exists()).toBe(true);
+    expect(timeline(w).props("runs")).toEqual([
+      expect.objectContaining({ id: "h-1", matched: false }),
+    ]);
+  });
+
+  it("marks only the filtered rows as matched on the timeline", async () => {
+    const w = await mountHttp();
+    await setFilter(w, "http_request");
+    const runs = timeline(w).props("runs") as { id: string; matched: boolean }[];
+    expect(runs.filter((r) => r.matched).map((r) => r.id)).toEqual(rowIds(w));
+    expect(runs.find((r) => r.id === "alert-1")?.matched).toBe(false);
+  });
+
+  it("hides the trigger filter on a workflow that never had an endpoint, same columns", async () => {
+    const w = await mountHttp([row({ run_id: "alert-1" })]);
+    expect(filter(w).exists()).toBe(false);
+    expect(w.find('[data-test="workflow-runs-search"]').exists()).toBe(false);
+    expect(colIds(w)).toEqual(COLUMN_IDS);
+  });
+
+  it("hides the trigger filter while hooks are off on the server", async () => {
+    delete (store.state as any).zoConfig.workflow_hooks_enabled;
+    const w = await mountHttp();
+    expect(filter(w).exists()).toBe(false);
+    expect(mockGetHttp.mock.calls.filter((c) => c[0]?.id === "wf-http")).toHaveLength(0);
+  });
+
+  it("shows All triggers / the kind / HTTP request once the workflow had HTTP runs", async () => {
+    const w = await mountHttp();
+    expect(filter(w).exists()).toBe(true);
+    for (const id of ["all", "alert_fired", "http_request"])
+      expect(w.find(`[data-test="workflow-runs-trigger-filter-${id}"]`).exists()).toBe(true);
+    expect(w.find('[data-test="workflow-runs-trigger-filter-alert_fired"]').text()).toBe(
+      "Alert fired",
+    );
+  });
+
+  it("shows the trigger filter for an endpoint that exists but has no runs in range", async () => {
+    mockGetHttp.mockResolvedValue({ configured: true, enabled: false });
+    const w = await mountHttp([row({ run_id: "alert-1" })]);
+    expect(mockGetHttp.mock.calls.some((c) => c[0]?.id === "wf-http")).toBe(true);
+    expect(filter(w).exists()).toBe(true);
+  });
+
+  it("names each run's trigger in words under All triggers", async () => {
+    const w = await mountHttp();
+    expect(w.find('[data-run="0193f2c4-dddd"] .c-trigger').text()).toBe("HTTP request");
+    expect(w.find('[data-run="alert-1"] .c-trigger').text()).toBe("Alert fired");
+    expect(w.find('[data-run="retry-1"] .c-trigger').text()).toBe("Retry run");
+  });
+
+  it("keeps the identical column set under every filter", async () => {
+    const w = await mountHttp();
+    const sets: unknown[] = [];
+    for (const f of ["all", "alert_fired", "http_request"]) {
+      await setFilter(w, f);
+      sets.push(
+        (w.findComponent(CellTable as any).props("columns") as any[]).map((c) => [
+          c.id,
+          c.size,
+          c.maxSize,
+        ]),
+      );
+    }
+    expect(colIds(w)).toEqual(COLUMN_IDS);
+    expect(sets[1]).toEqual(sets[0]);
+    expect(sets[2]).toEqual(sets[0]);
+    expect(w.emitted("update:triggerFilter")?.at(-1)).toEqual(["http_request"]);
+    expect(rowIds(w)).not.toContain("alert-1");
+    expect(rowIds(w)).not.toContain("retry-1");
+  });
+
+  it("keeps the same table instance across filters", async () => {
+    const w = await mountHttp();
+    const before = w.findComponent(CellTable as any).vm;
+    await setFilter(w, "http_request");
+    expect(w.findComponent(CellTable as any).vm).toBe(before);
+  });
+
+  it("gives every filter option the same fixed width and no icon", async () => {
+    const w = await mountHttp();
+    const items = w.findAllComponents(ToggleItemStub as any);
+    expect(items).toHaveLength(3);
+    for (const item of items) {
+      expect(item.classes()).toEqual(expect.arrayContaining(["w-28", "shrink-0"]));
+      expect(item.props("iconLeft")).toBeUndefined();
+    }
+  });
+
+  it("dates Started like the mockups and shows the received time for a queued HTTP run", async () => {
+    const w = await mountHttp([
+      row({ run_id: "alert-1", start_time: 5000 }),
+      row({
+        run_id: "q-1",
+        event_type: "Webhook",
+        status: "queued",
+        start_time: 0,
+        _timestamp: 7000,
+        http_request: facts({ status: "queued" }),
+      }),
+    ]);
+    const started = (id: string) =>
+      w.find(`[data-run="${id}"] .c-start_time`).findComponent({ name: "OTimeCell" });
+    expect(started("alert-1").props("format")).toBe("MMM d, HH:mm");
+    expect(started("alert-1").props("value")).toBe(5000);
+    expect(started("q-1").props("value")).toBe(7000);
+  });
+
+  it("a reason line wraps under its chip instead of cutting off", async () => {
+    const w = await mountHttp();
+    expect(w.find('[data-test="workflow-run-reason-0193f25e-bbbb"]').classes()).toContain(
+      "whitespace-normal",
+    );
+  });
+
+  it("a run that never started or has not finished shows no duration", async () => {
+    const w = await mountHttp();
+    for (const id of ["0193f2e8-aaaa", "0193f25e-bbbb"])
+      expect(w.find(`[data-run="${id}"] .c-duration`).text()).toBe("—");
+    expect(w.find('[data-run="alert-1"] .c-duration').text()).not.toBe("—");
+  });
+
+  it("a kind filter keeps that kind's runs only", async () => {
+    const w = await mountHttp();
+    await setFilter(w, "alert_fired");
+    expect(rowIds(w)).toEqual(["alert-1"]);
+  });
+
+  it("source details: token prefix over IP and key, the alert name, the retried run, the user", async () => {
+    mockAlerts.mockResolvedValue({
+      data: { list: [{ alert_id: "al-1", name: "checkout_5xx_rate" }] },
+    });
+    const w = await mountHttp([
+      ...httpRows,
+      row({ run_id: "alert-2", source_id: "al-1" }),
+      row({ run_id: "alert-3", source_id: "al-gone" }),
+      row({ run_id: "retry-2", event_type: "Retry", source_id: "3L5y2KdQ-original" }),
+      row({ run_id: "manual-1", event_type: "Manual", source_id: "root@example.com" }),
+    ]);
+    const details = (id: string) => w.find(`[data-test="workflow-run-details-${id}"]`).text();
+    expect(details("0193f25e-bbbb")).toContain("o2wh_4fK9…oI4k");
+    expect(details("0193f25e-bbbb")).toContain("198.51.100.7 · no idempotency key");
+    expect(details("0193f2c4-dddd")).toContain("203.0.113.24 · key deploy-d-4821");
+    expect(details("alert-2")).toBe("checkout_5xx_rate");
+    expect(details("alert-3")).toBe("al-gone");
+    expect(details("retry-2")).toBe("Retry of 3L5y2KdQ");
+    expect(details("manual-1")).toBe("root@example.com");
+    expect(w.find('[data-run="0193f2c4-dddd"] .c-run_id').text()).toContain("0193f2c4");
+    expect(w.find('[data-run="0193f2c4-dddd"] .c-run_id').text()).not.toContain("dddd");
+  });
+
+  it("expired rows show never ran, worker-lost rows say they are not re-run", async () => {
+    const w = await mountHttp();
+    expect(w.find('[data-test="workflow-run-reason-0193f25e-bbbb"]').text()).toBe(
+      "never ran · queued over 1 h",
+    );
+    expect(w.find('[data-test="workflow-run-reason-0193f1f9-cccc"]').text()).toBe(
+      "worker lost · not re-run",
+    );
+    expect(w.find('[data-test="workflow-run-reason-0193f2c4-dddd"]').exists()).toBe(false);
+  });
+
+  it("every row has an open icon and keeps the retry slot reserved when it cannot retry", async () => {
+    const w = await mountHttp();
+    for (const id of rowIds(w)) {
+      const actions = w.find(`[data-run="${id}"] .c-actions`);
+      expect(actions.find(`[data-test="workflow-run-open-${id}"]`).exists()).toBe(true);
+      const slots =
+        actions.findAll(`[data-test="workflow-run-retry-${id}"]`).length +
+        actions.findAll('[data-test="workflow-run-retry-slot"]').length;
+      expect(slots).toBe(1);
+    }
+    await w.find('[data-test="workflow-run-open-alert-1"]').trigger("click");
+    expect(w.emitted("select-run")?.at(-1)).toEqual(["alert-1"]);
+  });
+
+  it("retry is hidden for never-executed runs", async () => {
+    const w = await mountHttp();
+    expect(w.find('[data-test="workflow-run-retry-0193f25e-bbbb"]').exists()).toBe(false);
+    expect(w.find('[data-test="workflow-run-retry-0193f1f9-cccc"]').exists()).toBe(false);
+    expect(w.find('[data-test="workflow-run-retry-0193f2e8-aaaa"]').exists()).toBe(false);
+    expect(w.find('[data-test="workflow-run-retry-0193f2c4-dddd"]').exists()).toBe(true);
+  });
+
+  it("search shows under every filter and matches a run id prefix, key, token prefix or alert", async () => {
+    mockAlerts.mockResolvedValue({
+      data: { list: [{ alert_id: "al-1", name: "checkout_5xx_rate" }] },
+    });
+    const w = await mountHttp([...httpRows, row({ run_id: "alert-2", source_id: "al-1" })]);
+    const search = w.findComponent(SearchStub as any);
+    expect(search.attributes("data-test")).toBe("workflow-runs-search");
+    expect(search.props("placeholder")).toBe("Search run ID, idempotency key or alert");
+    search.vm.$emit("update:modelValue", "5XX");
+    await flushPromises();
+    expect(rowIds(w)).toEqual(["alert-2"]);
+    search.vm.$emit("update:modelValue", "4fK9");
+    await flushPromises();
+    expect(rowIds(w)).toHaveLength(4);
+    await setFilter(w, "http_request");
+    expect(w.findComponent(SearchStub as any).exists()).toBe(true);
+    search.vm.$emit("update:modelValue", "DEPLOY-D-4825");
+    await flushPromises();
+    expect(rowIds(w)).toEqual(["0193f2e8-aaaa"]);
+    search.vm.$emit("update:modelValue", "0193f2c4");
+    await flushPromises();
+    expect(rowIds(w)).toEqual(["0193f2c4-dddd"]);
+  });
+
+  it("prioritizes search empty and clears search without resetting the trigger filter", async () => {
+    const w = await mountHttp(httpRows);
+    await setFilter(w, "http_request");
+    w.findComponent(SearchStub).vm.$emit("update:modelValue", "no-such-run");
+    await flushPromises();
+    const empty = w.findComponent(EmptyStub);
+    expect(empty.attributes("data-test")).toBe("workflow-runs-search-empty");
+    empty.vm.$emit("action");
+    await flushPromises();
+    expect(w.findComponent(SearchStub).props("modelValue")).toBe("");
+    expect(rowIds(w).length).toBeGreaterThan(0);
+    expect(w.emitted("update:triggerFilter")?.at(-1)).toEqual(["http_request"]);
+  });
+
+  it("an empty HTTP filter says so and offers all triggers back", async () => {
+    mockGetHttp.mockResolvedValue({ configured: true, enabled: true });
+    const w = await mountHttp([row({ run_id: "alert-1" })]);
+    await setFilter(w, "http_request");
+    const empty = w.findComponent(EmptyStub as any);
+    expect(empty.attributes("data-test")).toBe("workflow-runs-http-empty");
+    expect(empty.props("title")).toBe("No HTTP requests in this time range");
+    expect(empty.props("actionLabel")).toBe("Show all triggers");
+    empty.vm.$emit("action");
+    await flushPromises();
+    expect(w.emitted("update:triggerFilter")?.at(-1)).toEqual(["all"]);
+    expect(rowIds(w)).toEqual(["alert-1"]);
+  });
+
+  it("an empty alert filter names it, says the rest are dimmed and offers all triggers", async () => {
+    const w = await mountHttp(httpRows.filter((r) => r.event_type === "Webhook"));
+    await setFilter(w, "alert_fired");
+    const empty = w.findComponent(EmptyStub as any);
+    expect(empty.attributes("data-test")).toBe("workflow-runs-filter-empty");
+    expect(empty.props("title")).toBe("No alert-fired runs in this time range");
+    expect(empty.props("description")).toBe("The other runs are still on the timeline, dimmed.");
+    expect(empty.props("actionLabel")).toBe("Show all triggers");
+  });
+});
diff --git a/web/src/components/workflows/WorkflowRunsPanel.vue b/web/src/components/workflows/WorkflowRunsPanel.vue
index 860d84aada..88318fa042 100644
--- a/web/src/components/workflows/WorkflowRunsPanel.vue
+++ b/web/src/components/workflows/WorkflowRunsPanel.vue
@@ -80,13 +80,41 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     </div>
 
     <div class="flex min-h-0 flex-1 flex-col gap-2 p-2">
-      <!-- Run-frequency timeline (reused from AlertHistory for consistency). -->
-      <WorkflowExecutionTimeline
-        v-if="rows.length > 0"
-        :history="timelineHistory"
-        :firing-label="t('workflow.history.failed')"
-        :ok-label="t('workflow.history.success')"
-        class="shrink-0"
+      <!-- Offered only once the workflow has or had an endpoint; every other workflow keeps today's list. -->
+      <div v-if="showTriggerFilter" class="flex shrink-0 flex-wrap items-center gap-2">
+        <OToggleGroup
+          :model-value="activeFilter"
+          mobile-dropdown
+          data-test="workflow-runs-trigger-filter"
+          @update:model-value="onFilterChange"
+        >
+          <OToggleGroupItem
+            v-for="opt in filterOptions"
+            :key="opt.value"
+            :value="opt.value"
+            size="sm"
+            class="w-28 shrink-0"
+            :data-test="`workflow-runs-trigger-filter-${opt.value}`"
+          >
+            {{ opt.label }}
+          </OToggleGroupItem>
+        </OToggleGroup>
+        <div class="min-w-0 flex-1 max-md:min-w-40">
+          <OSearchInput
+            v-model="search"
+            size="sm"
+            clearable
+            :placeholder="t('workflow.history.searchRuns')"
+            data-test="workflow-runs-search"
+          />
+        </div>
+      </div>
+
+      <WorkflowRunsTimeline
+        :runs="timelineRuns"
+        :start="dateTimeValues.startTime"
+        :end="dateTimeValues.endTime"
+        :timezone="store.state.timezone"
       />
 
       <div class="alert-history-table min-h-0 flex-1">
@@ -102,17 +130,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :loading-reset-key="workflowId"
           :show-global-filter="false"
           :default-columns="false"
-          :show-index="true"
           :enable-column-resize="true"
           sort-by="start_time"
           sort-order="desc"
           width="100%"
-          class="h-full w-full"
+          class="h-full w-full [&_[data-test=o2-table-scroll-container]]:[scrollbar-gutter:stable]"
           @row-click="openRun"
         >
-          <!-- A failed fetch used to fall through to <NoData />, so "request
-               failed" and "this workflow has never run" looked identical and the
-               user had no way to retry. -->
           <template #empty>
             <div class="py-10">
               <OEmptyState
@@ -121,6 +145,29 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 data-test="workflow-runs-load-error"
                 @action="fetchHistory(true)"
               />
+              <OEmptyState
+                v-else-if="!search.trim() && activeFilter !== 'all'"
+                size="inline"
+                :icon="filterEmpty.icon"
+                :title="filterEmpty.title"
+                :description="filterEmpty.description"
+                :action-label="t('workflow.http.runsEmptyAction')"
+                :data-test="
+                  activeFilter === 'http_request'
+                    ? 'workflow-runs-http-empty'
+                    : 'workflow-runs-filter-empty'
+                "
+                @action="onFilterChange('all')"
+              />
+              <OEmptyState
+                v-else-if="search.trim()"
+                size="inline"
+                icon="search"
+                :title="t('workflow.history.searchEmptyTitle')"
+                :action-label="t('workflow.history.searchEmptyAction')"
+                data-test="workflow-runs-search-empty"
+                @action="search = ''"
+              />
               <NoData v-else />
             </div>
           </template>
@@ -130,63 +177,112 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :value="value"
               unit="us"
               mode="absolute"
+              :format="RUN_TIME_SHORT"
               :timezone="store.state.timezone"
-              :empty-label="raw('—')"
+              :empty-label="dash"
             />
           </template>
 
           <template #cell-duration="{ row }">
-            {{ formatDuration(row.end_time - row.start_time) }}
+            {{ NO_DURATION.has(row.status) ? dash : formatDuration(row.end_time - row.start_time) }}
           </template>
 
-          <!-- The reason rides on the Failed badge (as in the run switcher) rather
-               than a column: in a 27.5rem panel a dedicated Error column is blank
-               on every healthy run and still too narrow to read a message in. -->
           <template #cell-status="{ row }">
-            <OBadge :variant="getStatusVariant(row.error ? 'failed' : 'success')" size="sm">
-              {{ row.error ? t("workflow.history.failed") : t("workflow.history.success") }}
-              <OTooltip
-                v-if="row.error"
-                side="left"
-                max-width="22rem"
-                :content="raw(String(humanizeNodeIds(row.error, t)))"
-              />
-            </OBadge>
-          </template>
-
-          <!-- A dot, not a badge: at 44px a worded badge is what clipped to "T".
-               The label stays reachable via the tooltip and the screen-reader text. -->
-          <template #cell-event_type="{ row }">
-            <OTooltip
-              v-if="isTestRun(row)"
-              :content="t('workflow.history.testRunTooltip')"
-              class="inline-flex"
-            >
-              <span
-                class="bg-text-secondary inline-block size-2 rounded-full align-middle"
-                data-test="workflow-run-test-marker"
-              >
-                <span class="sr-only">{{ t("workflow.history.testRun") }}</span>
+            <div class="flex min-w-0 flex-col items-start gap-0.5">
+              <span class="inline-flex">
+                <OTag type="hookRunStatus" :value="row.status" size="sm" />
+                <OTooltip
+                  v-if="row.status === 'failed' && row.error && !runReasonOf(row)"
+                  side="left"
+                  max-width="22rem"
+                  :content="raw(String(humanizeNodeIds(row.error, t)))"
+                />
               </span>
-            </OTooltip>
-            <span v-else class="text-text-secondary">—</span>
+              <span
+                v-if="runReasonOf(row)"
+                :data-test="`workflow-run-reason-${row.run_id}`"
+                class="text-text-secondary text-2xs leading-tight whitespace-normal"
+              >
+                {{ reasonText(row) }}
+              </span>
+            </div>
           </template>
 
-          <!-- Retry is offered ONLY where the backend can honour it: a failed run
-               whose errors were persisted. Test and Retry runs record no input, so
-               the row simply has no button rather than a dead one. -->
-          <template #cell-actions="{ row }">
-            <OButton
-              v-if="isRetryableRun(row)"
-              variant="ghost"
-              size="icon-sm"
-              icon-left="refresh"
-              :loading="retryingRunId === row.run_id"
-              :data-test="`workflow-run-retry-${row.run_id}`"
-              @click.stop="askRetry(row)"
+          <template #cell-run_id="{ row }">
+            <span class="font-mono">
+              {{ shortRunId(row.run_id) }}
+              <OTooltip side="left" :content="raw(row.run_id)" />
+            </span>
+          </template>
+
+          <template #cell-trigger="{ row }">
+            <span class="inline-flex max-w-full min-w-0">
+              <OTag
+                variant="default-soft"
+                shape="rounded"
+                size="sm"
+                :icon="sourceIcon(row)"
+                :label="sourceLabel(row)"
+                :data-test="isTestRun(row) ? 'workflow-run-test-marker' : undefined"
+              />
+              <OTooltip
+                v-if="isTestRun(row)"
+                side="left"
+                :content="t('workflow.history.testRunTooltip')"
+              />
+            </span>
+          </template>
+
+          <template #cell-details="{ row }">
+            <div
+              class="flex min-w-0 flex-col leading-tight"
+              :data-test="`workflow-run-details-${row.run_id}`"
             >
-              <OTooltip side="left" :content="t('workflow.history.retryTooltip')" />
-            </OButton>
+              <OTruncatedText
+                class="text-xs"
+                :class="
+                  runSourceOf(row) === 'http' || runSourceOf(row) === 'retry' ? 'font-mono' : ''
+                "
+              >
+                {{ detailsOf(row).primary }}
+              </OTruncatedText>
+              <OTruncatedText v-if="detailsOf(row).secondary" class="text-text-secondary text-2xs">
+                {{ detailsOf(row).secondary }}
+              </OTruncatedText>
+            </div>
+          </template>
+
+          <template #cell-actions="{ row }">
+            <div class="flex items-center gap-1">
+              <OButton
+                variant="ghost"
+                size="icon-sm"
+                icon-left="open-in-new"
+                :aria-label="t('workflow.history.openRun')"
+                :data-test="`workflow-run-open-${row.run_id}`"
+                @click.stop="openRun(row)"
+              >
+                <OTooltip side="left" :content="t('workflow.history.openRun')" />
+              </OButton>
+              <OButton
+                v-if="isRetryableRun(row)"
+                variant="ghost"
+                size="icon-sm"
+                icon-left="refresh"
+                :aria-label="t('workflow.history.retryTooltip')"
+                :loading="retryingRunId === row.run_id"
+                :data-test="`workflow-run-retry-${row.run_id}`"
+                @click.stop="askRetry(row)"
+              >
+                <OTooltip side="left" :content="t('workflow.history.retryTooltip')" />
+              </OButton>
+              <span
+                v-else
+                class="inline-block size-8 shrink-0"
+                aria-hidden="true"
+                data-test="workflow-run-retry-slot"
+              />
+            </div>
           </template>
         </OTable>
       </div>
@@ -205,22 +301,47 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <script setup lang="ts">
 import { ref, computed, watch } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import { useStore } from "vuex";
 import OTable from "@/lib/core/Table/OTable.vue";
 import OTimeCell from "@/lib/core/Table/cells/OTimeCell.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
-import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OTag from "@/lib/core/Badge/OTag.vue";
+import type { IconName } from "@/lib/core/Icon/OIcon.icons";
+import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
+import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
+import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import ORefreshButton from "@/lib/core/RefreshButton/ORefreshButton.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 import DateTime from "@/components/DateTime.vue";
-import WorkflowExecutionTimeline from "@/components/alerts/AlertHistoryTimeline.vue";
 import NoData from "@/components/shared/grid/NoData.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import ConfirmDialog from "@/components/ConfirmDialog.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { useQuery } from "@tanstack/vue-query";
+import { workflowHttpTriggerQuery } from "@/services/workflows.queries";
+import { alertsListQuery } from "@/services/alerts.queries";
+import type { WorkflowHistoryRow } from "@/services/workflows";
+import {
+  RUN_SOURCE_LABEL_KEYS,
+  isHttpRun,
+  runSourceOf,
+  workflowHooksEnabled,
+  type RunSource,
+} from "@/plugins/workflows/httpEndpoint";
+import {
+  RUN_REASON_KEYS,
+  matchesRunSearch,
+  matchesTriggerFilter,
+  runReasonOf,
+  shortRunId,
+  triggerFilterSource,
+  RUN_TIME_SHORT,
+  type RunTriggerFilter,
+} from "@/plugins/workflows/runStatus";
+import { triggerDef } from "@/plugins/workflows/triggers";
 import {
   workflowObj,
   loadRunsHistory,
@@ -229,7 +350,12 @@ import {
   humanizeNodeIds,
   isRetryableRun,
   retryWorkflowRun,
+  currentTriggerKind,
 } from "@/plugins/workflows/useWorkflowCanvas";
+import WorkflowRunsTimeline, { type TimelineRun } from "./WorkflowRunsTimeline.vue";
+
+// Nothing ran yet, or the run never started, so there is no duration to show.
+const NO_DURATION: ReadonlySet<string> = new Set(["queued", "running", "expired"]);
 
 const props = defineProps<{
   orgId: string;
@@ -238,12 +364,12 @@ const props = defineProps<{
   // The run currently loaded on the canvas — highlighted in the list.
   selectedRunId?: string;
 }>();
-const emit = defineEmits<{
-  (e: "select-run", runId: string): void;
-}>();
+const emit = defineEmits<{ (e: "select-run", runId: string): void }>();
+const triggerFilter = defineModel<RunTriggerFilter>("triggerFilter", { default: "all" });
 
 const { t } = useI18nTyped();
 const store = useStore();
+const dash = raw("—");
 
 // Loading + the runs list live in SHARED state (workflowObj.runsHistory) so the
 // NDV run switcher reuses the same fetch instead of re-hitting /history.
@@ -288,24 +414,130 @@ const formatDuration = (microseconds: number) => {
   return t("workflow.history.durationSeconds", { seconds });
 };
 
-// mirrors AlertHistory.getStatusVariant.
-const getStatusVariant = (status: string) => {
-  switch (status?.toLowerCase()) {
-    case "success":
-      return "success-outline";
-    case "failed":
-    case "error":
-      return "error-outline";
-    default:
-      return "default-outline";
-  }
-};
-
 // Shared with the editor's History dropdown so the two run-history surfaces cannot
 // disagree about what a published workflow should show.
 const { showTestRuns, testRunCount, visibleRuns } = useTestRunVisibility();
 
-const rows = computed(() => visibleRuns(workflowObj.runsHistory.list));
+const hooksOn = computed(() => workflowHooksEnabled(store.state.zoConfig));
+const endpoint = useQuery(() => ({
+  ...workflowHttpTriggerQuery(props.orgId, props.workflowId),
+  enabled: hooksOn.value && !!props.orgId && !!props.workflowId,
+}));
+// "Has or had": a configured endpoint (even one turned off) or HTTP runs still in the window.
+const showTriggerFilter = computed(
+  () =>
+    hooksOn.value &&
+    (endpoint.data.value?.configured === true ||
+      workflowObj.currentSelectedWorkflow?.http_endpoint_enabled === true ||
+      workflowObj.runsHistory.list.some(isHttpRun)),
+);
+const activeFilter = computed(() => (showTriggerFilter.value ? triggerFilter.value : "all"));
+const search = ref("");
+
+const onFilterChange = (value: unknown) => {
+  if (typeof value === "string" && value) triggerFilter.value = value;
+};
+
+const filterOptions = computed(() => {
+  const kind = currentTriggerKind();
+  const kindSource = triggerFilterSource(kind);
+  return [
+    { value: "all", label: t("workflow.history.allTriggers") },
+    ...(kind && kindSource ? [{ value: kind, label: t(RUN_SOURCE_LABEL_KEYS[kindSource]) }] : []),
+    { value: "http_request", label: t("workflow.history.sourceHttp") },
+  ];
+});
+
+const SOURCE_ICONS: Record<RunSource, IconName> = {
+  http: "webhook",
+  alert_fired: triggerDef("alert_fired").icon,
+  incident_event: triggerDef("incident_event").icon,
+  test: "science",
+  retry: "replay",
+  manual: "person",
+  other: "bolt",
+};
+const sourceIcon = (row: WorkflowHistoryRow): IconName => SOURCE_ICONS[runSourceOf(row)];
+const sourceLabel = (row: WorkflowHistoryRow) => t(RUN_SOURCE_LABEL_KEYS[runSourceOf(row)]);
+const reasonText = (row: WorkflowHistoryRow) => {
+  const reason = runReasonOf(row);
+  return reason ? t(RUN_REASON_KEYS[reason]) : "";
+};
+
+const visible = computed(() => visibleRuns(workflowObj.runsHistory.list as WorkflowHistoryRow[]));
+
+const alerts = useQuery(() => ({
+  ...alertsListQuery(props.orgId, ""),
+  enabled: !!props.orgId && visible.value.some((r) => runSourceOf(r) === "alert_fired"),
+}));
+const alertNames = computed(
+  () =>
+    new Map<string, string>(
+      (alerts.data.value ?? []).map((a: { alert_id: string; name: string }) => [
+        a.alert_id,
+        a.name,
+      ]),
+    ),
+);
+const alertNameOf = (row: WorkflowHistoryRow): string | null =>
+  runSourceOf(row) === "alert_fired"
+    ? alertNames.value.get(row.source_id) || row.source_id || null
+    : null;
+
+const startedAt = (row: WorkflowHistoryRow): number =>
+  isHttpRun(row) && (row.status === "queued" || !row.start_time) ? row._timestamp : row.start_time;
+
+const detailsOf = (row: WorkflowHistoryRow): { primary: I18nText; secondary: I18nText | null } => {
+  const source = runSourceOf(row);
+  if (source === "http") {
+    const facts = row.http_request;
+    const ip = raw(facts?.caller_ip || "—");
+    return {
+      primary: raw(facts?.credential_prefix || "—"),
+      secondary: facts?.idempotency_key
+        ? t("workflow.history.detailsWithKey", { ip, key: raw(facts.idempotency_key) })
+        : t("workflow.history.detailsNoKey", { ip }),
+    };
+  }
+  if (source === "alert_fired") return { primary: raw(alertNameOf(row) || "—"), secondary: null };
+  if (source === "retry") {
+    return {
+      primary: row.source_id
+        ? t("workflow.history.retryOf", { run: raw(shortRunId(row.source_id)) })
+        : dash,
+      secondary: null,
+    };
+  }
+  return { primary: raw(row.source_id || "—"), secondary: null };
+};
+
+const rows = computed(() =>
+  visible.value.filter(
+    (r) =>
+      matchesTriggerFilter(r, activeFilter.value) &&
+      matchesRunSearch(r, search.value, alertNameOf(r)),
+  ),
+);
+
+const filterEmpty = computed(() => {
+  const filter = activeFilter.value;
+  const source = filter === "http_request" ? "http" : triggerFilterSource(filter);
+  const others = visible.value.length > 0;
+  const titles: Partial<Record<RunSource, I18nText>> = {
+    http: t("workflow.http.runsEmptyTitle"),
+    alert_fired: t("workflow.history.alertFiredEmptyTitle"),
+    incident_event: t("workflow.history.incidentEventEmptyTitle"),
+  };
+  return {
+    icon: source ? SOURCE_ICONS[source] : SOURCE_ICONS.other,
+    title: (source && titles[source]) || t("workflow.history.filterEmptyTitle"),
+    description: others
+      ? t("workflow.history.filterEmptyDimmed")
+      : source === "http"
+        ? t("workflow.http.runsEmptyBody")
+        : undefined,
+  };
+});
 
 // Highlight the run currently loaded on the canvas. `!` (important) so the tint
 // wins over OTable's default/hover row background — keeping the list and canvas
@@ -313,65 +545,54 @@ const rows = computed(() => visibleRuns(workflowObj.runsHistory.list));
 const rowClass = (row: any) =>
   row.run_id && row.run_id === props.selectedRunId ? "bg-select-item-hover-bg!" : "";
 
-// Feed the shared timeline: one bar per run, coloured by success/error.
-const timelineHistory = computed(() =>
-  workflowObj.runsHistory.list.map((r: any) => ({
-    status: r.error ? "error" : "success",
-    timestamp: r.start_time,
-  })),
-);
+const timelineRuns = computed<TimelineRun[]>(() => {
+  const shown = new Set(rows.value.map((r) => r.run_id));
+  return visible.value.map((r) => ({
+    id: r.run_id,
+    at: startedAt(r),
+    status: r.status,
+    matched: shown.has(r.run_id),
+  }));
+});
+
+function fixedColumn(
+  id: string,
+  header: OTableColumnDef["header"],
+  size: number,
+  access: Pick<OTableColumnDef, "accessorKey" | "accessorFn">,
+): OTableColumnDef {
+  return { id, header, ...access, sortable: true, size, maxSize: size, meta: { align: "left" } };
+}
 
-// The panel is a fixed 27.5rem column, so these sizes are a budget: anything over
-// it silently pushes a column out of reach (the panel has no horizontal scroll).
-// Scanning order — when it ran, how long, whether it passed, was it a rehearsal —
-// comes first; Error is the diagnostic you open a row for, so it goes last and no
-// longer flexes, and Ended is derivable from Started + Duration so it is dropped.
 const columns = computed<OTableColumnDef[]>(() => [
+  fixedColumn("start_time", t("workflow.history.started"), 112, { accessorFn: startedAt }),
+  fixedColumn("status", t("workflow.history.status"), 92, {
+    accessorFn: (row: WorkflowHistoryRow) => row.status,
+  }),
+  fixedColumn("run_id", t("workflow.history.run"), 88, { accessorKey: "run_id" }),
+  fixedColumn("trigger", t("workflow.history.triggerFilter"), 124, {
+    accessorFn: (row: WorkflowHistoryRow) => runSourceOf(row),
+  }),
+
   {
-    id: "start_time",
-    header: t("workflow.history.started"),
-    accessorKey: "start_time",
-    sortable: true,
-    size: 132,
-    maxSize: 132,
-    meta: { align: "left" },
-  },
-  {
-    id: "duration",
-    header: t("workflow.history.duration"),
-    accessorFn: (row: any) => row.end_time - row.start_time,
-    sortable: true,
-    size: 72,
-    maxSize: 72,
-    meta: { align: "left" },
-  },
-  {
-    id: "status",
-    header: t("workflow.history.status"),
-    accessorFn: (row: any) => (row.error ? "failed" : "success"),
-    sortable: true,
-    size: 80,
-    maxSize: 80,
-    meta: { align: "left" },
-  },
-  // Its own column: crowded into the status cell it was clipped to a stray "T".
-  {
-    id: "event_type",
-    header: t("workflow.history.runType"),
-    accessorFn: (row: any) => (isTestRun(row) ? "test" : "live"),
-    sortable: true,
-    size: 44,
-    maxSize: 44,
-    meta: { align: "center" },
+    ...fixedColumn("details", t("workflow.history.sourceDetails"), 210, {
+      accessorFn: (row: WorkflowHistoryRow) => String(detailsOf(row).primary),
+    }),
+    minSize: 160,
+    maxSize: undefined,
+    meta: { align: "left", autoWidth: true, fillRemaining: true },
   },
+  fixedColumn("duration", t("workflow.history.duration"), 84, {
+    accessorFn: (row: WorkflowHistoryRow) => row.end_time - row.start_time,
+  }),
   {
     id: "actions",
     header: t("workflow.actions"),
     isAction: true,
     pinned: "right",
-    size: 56,
-    maxSize: 56,
-    meta: { align: "center" },
+    size: 68,
+    maxSize: 68,
+    meta: { align: "center", actionCount: 2 },
   },
 ]);
 
diff --git a/web/src/components/workflows/WorkflowRunsTimeline.spec.ts b/web/src/components/workflows/WorkflowRunsTimeline.spec.ts
new file mode 100644
index 0000000000..369f25640e
--- /dev/null
+++ b/web/src/components/workflows/WorkflowRunsTimeline.spec.ts
@@ -0,0 +1,100 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, afterEach } from "vitest";
+import { mount } from "@vue/test-utils";
+import i18n from "@/locales";
+import WorkflowRunsTimeline, { type TimelineRun } from "./WorkflowRunsTimeline.vue";
+
+const HOUR_US = 3_600_000_000;
+const END = 1_792_600_000_000_000;
+
+const run = (id: string, hoursBeforeEnd: number, over: Partial<TimelineRun> = {}): TimelineRun => ({
+  id,
+  at: END - hoursBeforeEnd * HOUR_US,
+  status: "succeeded",
+  matched: true,
+  ...over,
+});
+
+const mountTimeline = (runs: TimelineRun[], end = END) =>
+  mount(WorkflowRunsTimeline, {
+    props: { runs, start: end - 24 * HOUR_US, end, timezone: "UTC" },
+    global: { plugins: [i18n] },
+  });
+
+const leftOf = (w: ReturnType<typeof mountTimeline>, id: string) =>
+  parseFloat(
+    (w.find(`[data-test="workflow-runs-timeline-bar-${id}"]`).element as HTMLElement).style.left,
+  );
+
+describe("WorkflowRunsTimeline", () => {
+  afterEach(() => vi.useRealTimers());
+
+  it("places each bar by its run time on an axis pinned to the selected range", () => {
+    const w = mountTimeline([run("a", 18), run("b", 12), run("c", 6)]);
+    expect(leftOf(w, "a")).toBeCloseTo(25, 5);
+    expect(leftOf(w, "b")).toBeCloseTo(50, 5);
+    expect(leftOf(w, "c")).toBeCloseTo(75, 5);
+  });
+
+  it("keeps bars at the same place whatever the filter matches", () => {
+    const all = mountTimeline([run("a", 18), run("b", 6)]);
+    const one = mountTimeline([run("a", 18, { matched: false }), run("b", 6)]);
+    expect(leftOf(one, "a")).toBe(leftOf(all, "a"));
+    expect(leftOf(one, "b")).toBe(leftOf(all, "b"));
+  });
+
+  it("dims filtered-out runs instead of dropping them", () => {
+    const w = mountTimeline([run("in", 3), run("out", 9, { matched: false })]);
+    const dimmed = w.find('[data-test="workflow-runs-timeline-bar-out"]').classes();
+    expect(dimmed).toEqual(expect.arrayContaining(["opacity-20", "dark:opacity-30"]));
+    expect(w.find('[data-test="workflow-runs-timeline-bar-in"]').classes()).not.toContain(
+      "opacity-20",
+    );
+  });
+
+  it("always renders the three legend slots, zeros included, counting matched runs only", () => {
+    const w = mountTimeline([
+      run("ok", 2),
+      run("bad", 3, { status: "failed", matched: false }),
+      run("q", 1, { status: "queued" }),
+    ]);
+    const count = (k: string) => w.find(`[data-test="workflow-runs-timeline-count-${k}"]`).text();
+    expect(count("success")).toBe("1");
+    expect(count("failed")).toBe("0");
+    expect(count("running")).toBe("1");
+    expect(w.find('[data-test="workflow-runs-timeline-count-success"]').classes()).toContain(
+      "tabular-nums",
+    );
+  });
+
+  it("renders the axis and legend with no runs at all", () => {
+    const w = mountTimeline([]);
+    expect(w.find('[data-test="workflow-runs-timeline-track"]').exists()).toBe(true);
+    for (const k of ["success", "failed", "running"])
+      expect(w.find(`[data-test="workflow-runs-timeline-count-${k}"]`).text()).toBe("0");
+    expect(w.find('[data-test="workflow-runs-timeline-start"]').text()).toBe("Oct 20, 16:26");
+    expect(w.find('[data-test="workflow-runs-timeline-end"]').text()).toBe("Oct 21, 16:26");
+  });
+
+  it("labels ticks back from the range end, ending in now for a live range", () => {
+    vi.useFakeTimers();
+    vi.setSystemTime(END / 1000);
+    const w = mountTimeline([]);
+    const ticks = w.findAll('[data-test="workflow-runs-timeline-ticks"] span').map((s) => s.text());
+    expect(ticks).toEqual(["−24h", "−18h", "−12h", "−6h", "now"]);
+  });
+});
diff --git a/web/src/components/workflows/WorkflowRunsTimeline.vue b/web/src/components/workflows/WorkflowRunsTimeline.vue
new file mode 100644
index 0000000000..4e631e5bae
--- /dev/null
+++ b/web/src/components/workflows/WorkflowRunsTimeline.vue
@@ -0,0 +1,179 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div class="flex w-full shrink-0 flex-col gap-1.5 px-1 py-2" data-test="workflow-runs-timeline">
+    <div class="flex items-center justify-between gap-2 px-1">
+      <span
+        class="text-2xs text-text-secondary tabular-nums"
+        data-test="workflow-runs-timeline-start"
+      >
+        {{ startLabel }}
+      </span>
+      <div class="flex items-center gap-3" data-test="workflow-runs-timeline-legend">
+        <span
+          v-for="slot in legend"
+          :key="slot.key"
+          class="text-2xs text-text-secondary flex items-center gap-1"
+          :data-test="`workflow-runs-timeline-legend-${slot.key}`"
+        >
+          <span class="rounded-default inline-block size-2" :class="slot.swatch" />
+          <span
+            class="inline-block min-w-[2ch] text-end tabular-nums"
+            :data-test="`workflow-runs-timeline-count-${slot.key}`"
+            >{{ slot.count }}</span
+          >
+          {{ slot.label }}
+        </span>
+      </div>
+      <span
+        class="text-2xs text-text-secondary tabular-nums"
+        data-test="workflow-runs-timeline-end"
+      >
+        {{ endLabel }}
+      </span>
+    </div>
+
+    <div class="flex w-full flex-col gap-0.75 px-1">
+      <div
+        class="bg-surface-subtle rounded-default relative h-6 w-full overflow-hidden"
+        data-test="workflow-runs-timeline-track"
+      >
+        <div
+          v-for="bar in bars"
+          :key="bar.id"
+          class="rounded-default absolute inset-y-0 w-1.5 -translate-x-1/2"
+          :class="[STATUS_BAR[bar.status], bar.matched ? '' : 'opacity-20 dark:opacity-30']"
+          :style="{ left: `${bar.left}%` }"
+          :data-test="`workflow-runs-timeline-bar-${bar.id}`"
+          :data-matched="bar.matched"
+        />
+      </div>
+      <div class="flex w-full justify-between" data-test="workflow-runs-timeline-ticks">
+        <span
+          v-for="(tick, i) in ticks"
+          :key="i"
+          class="text-2xs text-text-secondary whitespace-nowrap tabular-nums"
+        >
+          {{ tick }}
+        </span>
+      </div>
+    </div>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { computed } from "vue";
+import { formatInTimeZone } from "date-fns-tz";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import type { HookRunStatus } from "@/services/workflows";
+import { RUN_TIME_SHORT } from "@/plugins/workflows/runStatus";
+
+export interface TimelineRun {
+  id: string;
+  at: number;
+  status: HookRunStatus;
+  matched: boolean;
+}
+
+const props = defineProps<{
+  runs: TimelineRun[];
+
+  start: number;
+  end: number;
+  timezone?: string;
+}>();
+
+const { t } = useI18nTyped();
+
+const TICK_COUNT = 5;
+const MINUTE_US = 60_000_000;
+const HOUR_US = 60 * MINUTE_US;
+const DAY_US = 24 * HOUR_US;
+
+const LIVE_SLACK_US = 2 * MINUTE_US;
+
+const STATUS_BAR: Record<HookRunStatus, string> = {
+  succeeded: "bg-badge-success-solid-bg",
+  failed: "bg-badge-error-solid-bg",
+  running: "bg-badge-blue-solid-bg",
+  queued: "bg-badge-blue-solid-bg",
+  expired: "bg-border-strong",
+};
+
+const zone = computed(
+  () => props.timezone || Intl.DateTimeFormat().resolvedOptions().timeZone || "UTC",
+);
+const formatAt = (us: number) =>
+  raw(us > 0 ? formatInTimeZone(new Date(us / 1000), zone.value, RUN_TIME_SHORT) : "");
+
+const startLabel = computed(() => formatAt(props.start));
+const endLabel = computed(() => formatAt(props.end));
+
+const span = computed(() => Math.max(props.end - props.start, 1));
+
+const bars = computed(() =>
+  props.runs
+    .filter((r) => r.at >= props.start && r.at <= props.end)
+    .map((r) => ({
+      ...r,
+
+      left: Math.min(99.5, Math.max(0.5, ((r.at - props.start) / span.value) * 100)),
+    })),
+);
+
+const legend = computed(() => {
+  const shown = props.runs.filter((r) => r.matched);
+  const count = (...statuses: HookRunStatus[]) =>
+    shown.filter((r) => statuses.includes(r.status)).length;
+  return [
+    {
+      key: "success",
+      swatch: STATUS_BAR.succeeded,
+      count: count("succeeded"),
+      label: t("workflow.history.success"),
+    },
+    {
+      key: "failed",
+      swatch: STATUS_BAR.failed,
+      count: count("failed"),
+      label: t("workflow.history.failed"),
+    },
+    {
+      key: "running",
+      swatch: STATUS_BAR.running,
+      count: count("running", "queued"),
+      label: t("workflow.history.statusRunning"),
+    },
+  ];
+});
+
+const offsetLabel = (us: number): I18nText => {
+  const trim = (n: number) => Number(n.toFixed(1));
+  if (us >= 2 * DAY_US) return t("workflow.history.timelineAgoDays", { n: trim(us / DAY_US) });
+  if (us >= HOUR_US) return t("workflow.history.timelineAgoHours", { n: trim(us / HOUR_US) });
+  return t("workflow.history.timelineAgoMinutes", { n: Math.round(us / MINUTE_US) });
+};
+
+const ticks = computed<I18nText[]>(() => {
+  const live = Math.abs(Date.now() * 1000 - props.end) <= LIVE_SLACK_US;
+  return Array.from({ length: TICK_COUNT }, (_, i) => {
+    const before = (span.value * (TICK_COUNT - 1 - i)) / (TICK_COUNT - 1);
+    if (before === 0) return live ? t("workflow.history.timelineNow") : endLabel.value;
+    return offsetLabel(before);
+  });
+});
+</script>
diff --git a/web/src/components/workflows/WorkflowTestDialog.spec.ts b/web/src/components/workflows/WorkflowTestDialog.spec.ts
index b1d7e23382..f68aaf9334 100644
--- a/web/src/components/workflows/WorkflowTestDialog.spec.ts
+++ b/web/src/components/workflows/WorkflowTestDialog.spec.ts
@@ -18,7 +18,7 @@
 // the SAVED workflow through executeTestRun (the /test endpoint is a validator:
 // it returns per-node ERRORS only).
 
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
 import { nextTick } from "vue";
 import i18n from "@/locales";
@@ -46,6 +46,7 @@ vi.mock("@/services/workflows", async (importOriginal) => {
 import WorkflowTestDialog from "./WorkflowTestDialog.vue";
 import { workflowObj, LAST_TEST_RUN } from "@/plugins/workflows/useWorkflowCanvas";
 import { buildTestSampleText } from "@/plugins/workflows/testSample";
+import { INCIDENT_EVENT_TYPES } from "@/plugins/workflows/incidentSample";
 
 // ── stubs ────────────────────────────────────────────────────────────────────
 const ODrawerStub = {
@@ -757,3 +758,104 @@ describe("destination suppression (P0 safety)", () => {
     expect(mockTestWorkflow.mock.calls[0][0].suppress_destinations).toBe(false);
   });
 });
+
+describe("WorkflowTestDialog Payload from", () => {
+  const payloadSelect = (w: any) =>
+    w
+      .findAllComponents(OSelectStub as any)
+      .find((s: any) => s.attributes("data-test") === "workflow-test-payload-from");
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    resetState();
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: true };
+  });
+  afterEach(() => {
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+  });
+
+  it("Payload from offers the kind samples and HTTP request", async () => {
+    const w = mountDialog();
+    const select = payloadSelect(w);
+    expect(select.props("options").map((o: any) => o.value)).toEqual(["trigger", "http"]);
+    await select.vm.$emit("update:modelValue", "http");
+    const [{ meta }] = JSON.parse(workflowObj.testRun.input);
+    expect(meta).toMatchObject({ trigger_source: "http", trigger_id: "test" });
+    expect(workflowObj.testRun.inputSource).toBe("sample");
+    await select.vm.$emit("update:modelValue", "trigger");
+    expect(JSON.parse(workflowObj.testRun.input)[0].meta.trigger_source).toBeUndefined();
+  });
+
+  it("HTTP request posts to /workflows/test with the in-memory graph", async () => {
+    mockTestWorkflow.mockResolvedValue({ data: { errors: {} } });
+    const w = mountDialog();
+    await payloadSelect(w).vm.$emit("update:modelValue", "http");
+    await primary(w).trigger("click");
+    await flushPromises();
+    expect(mockTestWorkflow).toHaveBeenCalled();
+    const body = JSON.stringify(mockTestWorkflow.mock.calls[0]);
+    expect(body).toContain("trigger_source");
+    expect(body).toContain("f1");
+  });
+
+  it("seed prefills the input", () => {
+    const seed = [{ meta: { trigger_source: "http", trigger_id: "test" }, data: [{ k: 1 }] }];
+    mount(WorkflowTestDialog, { props: { seed, payloadFrom: "http" }, global: globalConfig });
+    expect(JSON.parse(workflowObj.testRun.input)).toEqual(seed);
+  });
+
+  it("a seed from the latest HTTP run is labelled as that run, not as a sample", () => {
+    const seed = [{ meta: { trigger_source: "http", trigger_id: "t9" }, data: [{ k: 1 }] }];
+    mount(WorkflowTestDialog, {
+      props: { seed, payloadFrom: "http", seedRunAt: 1_700_000_000_000_000 },
+      global: globalConfig,
+    });
+    expect(workflowObj.testRun.inputSource).toBe("run");
+    expect(workflowObj.testRun.inputRunLabel).not.toBe("");
+  });
+
+  it("an Incident Event workflow offers each event's sample and HTTP request", async () => {
+    setWorkflow(
+      [
+        { id: "t1", data: { node_type: "workflow_trigger", trigger_kind: "incident_event" } },
+        destNode,
+      ],
+      [{ source: "t1", target: "d1" }],
+    );
+    const w = mountDialog();
+    const values = payloadSelect(w)
+      .props("options")
+      .map((o: any) => o.value);
+    expect(values).toEqual([...INCIDENT_EVENT_TYPES, "http"]);
+    await payloadSelect(w).vm.$emit("update:modelValue", "resolved");
+    expect(JSON.parse(workflowObj.testRun.input)[0].meta.event_type).toBe("resolved");
+  });
+
+  it("an Incident Event workflow opens on the variant its saved input holds", () => {
+    setWorkflow(
+      [
+        { id: "t1", data: { node_type: "workflow_trigger", trigger_kind: "incident_event" } },
+        destNode,
+      ],
+      [{ source: "t1", target: "d1" }],
+    );
+    workflowObj.testRun.input = JSON.stringify([{ meta: { event_type: "resolved" }, data: [] }]);
+    const w = mountDialog();
+    expect(payloadSelect(w).props("modelValue")).toBe("resolved");
+  });
+
+  it("an HTTP run used as test input selects HTTP request", () => {
+    workflowObj.testRun.input = JSON.stringify([
+      { meta: { trigger_source: "http", trigger_id: "t9" }, data: [] },
+    ]);
+    workflowObj.testRun.inputSource = "run";
+    const w = mountDialog();
+    expect(payloadSelect(w).props("modelValue")).toBe("http");
+  });
+
+  it("offers no HTTP payload when hooks are off", () => {
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    const w = mountDialog();
+    expect(payloadSelect(w)).toBeUndefined();
+  });
+});
diff --git a/web/src/components/workflows/WorkflowTestDialog.vue b/web/src/components/workflows/WorkflowTestDialog.vue
index 0d8377424a..e53d864a94 100644
--- a/web/src/components/workflows/WorkflowTestDialog.vue
+++ b/web/src/components/workflows/WorkflowTestDialog.vue
@@ -75,6 +75,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </OBanner>
       </div>
 
+      <div v-if="hooksOn" class="flex flex-col gap-1">
+        <OSelect
+          v-model="payloadSelection"
+          :label="t('workflow.test.payloadFrom')"
+          :options="payloadFromOptions"
+          data-test="workflow-test-payload-from"
+        />
+        <OText variant="meta" as="p">{{ t("workflow.test.payloadFromHint") }}</OText>
+      </div>
+
       <!-- Sample input editor — fills the remaining drawer height -->
       <div class="flex min-h-0 flex-1 flex-col gap-1">
         <div class="flex items-center justify-between">
@@ -155,9 +165,13 @@ import OTag from "@/lib/core/Badge/OTag.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import CodeQueryEditor from "@/components/CodeQueryEditor.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { workflowHooksEnabled } from "@/plugins/workflows/httpEndpoint";
+import { httpPreviewSample, type PayloadFrom } from "@/plugins/workflows/httpEndpointUi";
+import { isHttpRequestInput } from "@/plugins/workflows/httpRequestSample";
 
 import {
   workflowObj,
+  triggerDef,
   nodeMeta,
   executeTestRun,
   flowOrderedNodeIds,
@@ -173,9 +187,50 @@ import {
   persistTestData,
 } from "@/plugins/workflows/useWorkflowCanvas";
 
+const props = defineProps<{
+  /** Prefills the input (latest HTTP run, or the HTTP sample from the endpoint panel). */
+  seed?: unknown[];
+  payloadFrom?: PayloadFrom;
+  /** Received time (µs) of the HTTP run `seed` came from; unset for a generated sample. */
+  seedRunAt?: number;
+}>();
+
 const { t } = useI18nTyped();
 const store = useStore();
 
+const hooksOn = computed(() => workflowHooksEnabled(store.state.zoConfig));
+// "trigger" stands for a kind without variants; a kind with variants offers each variant key.
+const HTTP_CHOICE: PayloadFrom = "http";
+const KIND_CHOICE: PayloadFrom = "trigger";
+const kindVariants = triggerDef(currentTriggerKind()).sampleVariants ?? [];
+const firstKindChoice = kindVariants[0]?.key ?? KIND_CHOICE;
+const savedVariant = (): string | undefined => {
+  try {
+    const event = JSON.parse(workflowObj.testRun.input || "[]")?.[0]?.meta?.event_type;
+    return kindVariants.find((v) => v.key === event)?.key;
+  } catch {
+    return undefined;
+  }
+};
+const startsAsHttp =
+  props.payloadFrom === HTTP_CHOICE ||
+  (!props.payloadFrom && isHttpRequestInput(workflowObj.testRun.input));
+const payloadChoice = ref<string>(startsAsHttp ? HTTP_CHOICE : (savedVariant() ?? firstKindChoice));
+const payloadFromOptions = computed(() => {
+  const kindOptions = kindVariants.length
+    ? kindVariants.map((v) => ({ label: v.labelKey ? t(v.labelKey) : raw(v.key), value: v.key }))
+    : [{ label: t(triggerDef(currentTriggerKind()).labelKey), value: KIND_CHOICE }];
+  return [...kindOptions, { label: t("workflow.http.payloadHttp"), value: HTTP_CHOICE }];
+});
+// Every Test runs the in-memory graph; only the seeded payload changes.
+const payloadSelection = computed<string>({
+  get: () => payloadChoice.value,
+  set: (v) => {
+    payloadChoice.value = v;
+    seedSample();
+  },
+});
+
 const running = ref(false);
 // v-model:open — closing the dialog (X / overlay) clears the flag.
 const open = computed({
@@ -188,10 +243,14 @@ const edges = computed<any[]>(() => workflowObj.currentSelectedWorkflow?.edges |
 
 // Seed the sample payload the first time the dialog opens (persisted after).
 onMounted(() => {
-  if (!workflowObj.testRun.input) {
-    workflowObj.testRun.input = buildTriggerSampleText(currentTriggerKind());
-    workflowObj.testRun.inputSource = "sample";
-    workflowObj.testRun.inputRunLabel = "";
+  if (props.seed?.length) {
+    workflowObj.testRun.input = JSON.stringify(props.seed, null, 2);
+    workflowObj.testRun.inputSource = props.seedRunAt ? "run" : "sample";
+    workflowObj.testRun.inputRunLabel = props.seedRunAt
+      ? timestampToTimezoneDate(Math.floor(props.seedRunAt / 1000), store.state.timezone)
+      : "";
+  } else if (!workflowObj.testRun.input) {
+    seedSample();
   }
   // State persisted before this flag existed carries no value; pin it ON so the
   // safe default is explicit rather than inferred from undefined.
@@ -337,13 +396,21 @@ const run = async () => {
     });
 };
 
-const seedSample = () => {
-  workflowObj.testRun.input = buildTriggerSampleText(currentTriggerKind());
+function seedSample() {
+  const variant = kindVariants.find((v) => v.key === payloadChoice.value);
+  if (hooksOn.value && payloadChoice.value === HTTP_CHOICE) {
+    workflowObj.testRun.input = JSON.stringify(httpPreviewSample("test"), null, 2);
+  } else if (variant) {
+    workflowObj.testRun.input = JSON.stringify(variant.build(), null, 2);
+  } else {
+    workflowObj.testRun.input = buildTriggerSampleText(currentTriggerKind());
+  }
   workflowObj.testRun.inputSource = "sample";
   workflowObj.testRun.inputRunLabel = "";
-};
+}
 
 const resetSample = () => seedSample();
+
 const revertInput = () => seedSample();
 
 // The editor re-emits its own value on mount/format, so only a real text change
diff --git a/web/src/components/workflows/WorkflowsList.spec.ts b/web/src/components/workflows/WorkflowsList.spec.ts
index 605ce30dd6..0b0b3b5e38 100644
--- a/web/src/components/workflows/WorkflowsList.spec.ts
+++ b/web/src/components/workflows/WorkflowsList.spec.ts
@@ -55,6 +55,7 @@ vi.mock("@/services/workflows", async (importOriginal) => {
       listWorkflows: vi.fn(),
       deleteWorkflow: vi.fn(),
       enableWorkflow: vi.fn(),
+      getHttpTrigger: vi.fn(),
     },
   });
 });
@@ -77,6 +78,31 @@ vi.mock("@/components/workflows/WorkflowView.vue", () => ({
   },
 }));
 
+vi.mock("@/components/workflows/WorkflowHttpEndpointPanel.vue", () => ({
+  default: {
+    name: "WorkflowHttpEndpointPanel",
+    props: [
+      "open",
+      "workflowId",
+      "workflowName",
+      "kind",
+      "isDraftOnly",
+      "workflowEnabled",
+      "context",
+    ],
+    emits: ["update:open"],
+    template: '<div data-test="http-panel-stub" :data-open="String(open)" />',
+  },
+}));
+
+vi.mock("@/utils/clipboard", () => ({
+  copyToClipboard: vi.fn(async () => true),
+  copyPendingText: vi.fn(async (text: Promise<string>) => {
+    await text;
+    return true;
+  }),
+}));
+
 import { mount, flushPromises } from "@vue/test-utils";
 import { nextTick } from "vue";
 import i18n from "@/locales";
@@ -84,6 +110,8 @@ import store from "@/test/unit/helpers/store";
 import WorkflowsList from "./WorkflowsList.vue";
 import ConfirmDialog from "@/components/ConfirmDialog.vue";
 import workflowService from "@/services/workflows";
+import { queryClient } from "@/composables/query/queryClient";
+import { copyPendingText } from "@/utils/clipboard";
 
 const t = (k: string, v?: any) => i18n.global.t(k, v ?? {});
 const listWorkflows = workflowService.listWorkflows as any;
@@ -468,6 +496,14 @@ describe("WorkflowsList", () => {
       ).toEqual(["#", "name", "description", "trigger", "updated_at", "actions"]);
     });
 
+    // Measured in the built UI: the Incident Event tag 94 + gap 4 + HTTP tag 63 + 16 cell padding.
+    it("sizes Trigger for an Incident Event tag and the HTTP tag side by side", async () => {
+      wrapper = mountList();
+      await flushPromises();
+      const trigger = (table(wrapper).props("columns") as any[]).find((c) => c.id === "trigger");
+      expect(trigger.size).toBeGreaterThanOrEqual(177);
+    });
+
     it("marks the actions column as an action column", async () => {
       wrapper = mountList();
       await flushPromises();
@@ -1188,3 +1224,96 @@ describe("WorkflowsList", () => {
     });
   });
 });
+
+describe("WorkflowsList HTTP endpoint", () => {
+  let wrapper: any = null;
+  const getHttpTrigger = (workflowService as any).getHttpTrigger;
+  const panel = (w: any) => w.findComponent({ name: "WorkflowHttpEndpointPanel" });
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    resetListViewState();
+    queryClient.clear();
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: true };
+  });
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+  });
+
+  const load = async (list: any[]) => {
+    listWorkflows.mockResolvedValue({ data: list });
+    wrapper = mountList();
+    await flushPromises();
+    return wrapper;
+  };
+
+  it("shows the HTTP tag on any kind with an endpoint", async () => {
+    const incident = {
+      id: "t1",
+      data: { node_type: "workflow_trigger", trigger_kind: "incident_event" },
+    };
+    const w = await load([
+      makeWorkflow(1, { http_endpoint_enabled: true }),
+      makeWorkflow(2, { http_endpoint_enabled: true, nodes: [incident] }),
+      makeWorkflow(3, { http_endpoint_enabled: true, is_draft: true }),
+      makeWorkflow(4),
+    ]);
+    expect(w.findAll('[data-test="workflow-list-http-tag"]')).toHaveLength(3);
+  });
+
+  it("has no HTTP tab", async () => {
+    const w = await load([makeWorkflow(1, { http_endpoint_enabled: true })]);
+    expect(w.find('[data-test="workflow-list-tab-http_request"]').exists()).toBe(false);
+  });
+
+  it("HTTP endpoint… opens the panel on any row", async () => {
+    const w = await load([makeWorkflow(1), makeWorkflow(2, { is_draft: true, enabled: false })]);
+    await w.find('[data-test="workflow-list-workflow-2-http-endpoint"]').trigger("click");
+    expect(panel(w).props()).toMatchObject({
+      open: true,
+      workflowId: "wf-2",
+      workflowName: "workflow-2",
+      isDraftOnly: true,
+      workflowEnabled: false,
+      context: "list",
+    });
+  });
+
+  it("Copy endpoint URL fetches the http_trigger query and copies its url", async () => {
+    getHttpTrigger.mockResolvedValue({ configured: true, url: "https://o2/h/1" });
+    const w = await load([makeWorkflow(1, { http_endpoint_enabled: true }), makeWorkflow(2)]);
+    expect(w.find('[data-test="workflow-list-workflow-2-copy-endpoint"]').exists()).toBe(false);
+    await w.find('[data-test="workflow-list-workflow-1-copy-endpoint"]').trigger("click");
+    await flushPromises();
+    expect(getHttpTrigger).toHaveBeenCalledWith({ org_identifier: expect.any(String), id: "wf-1" });
+    await expect(vi.mocked(copyPendingText).mock.calls[0][0]).resolves.toBe("https://o2/h/1");
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({ message: t("toastMessages.workflows.endpointUrlCopied") }),
+    );
+  });
+
+  it("Copy endpoint URL toasts an error when the clipboard refuses the write", async () => {
+    getHttpTrigger.mockResolvedValue({ configured: true, url: "https://o2/h/1" });
+    vi.mocked(copyPendingText).mockImplementationOnce(async (text) => {
+      await text;
+      return false;
+    });
+    const w = await load([makeWorkflow(1, { http_endpoint_enabled: true })]);
+    await w.find('[data-test="workflow-list-workflow-1-copy-endpoint"]').trigger("click");
+    await flushPromises();
+    expect(mockToast).toHaveBeenCalledWith(
+      expect.objectContaining({ variant: "error", message: t("common.copyError") }),
+    );
+  });
+
+  it("shows no HTTP tag, HTTP endpoint item or Copy endpoint URL when hooks are off", async () => {
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    const w = await load([makeWorkflow(1, { http_endpoint_enabled: true })]);
+    expect(w.find('[data-test="workflow-list-http-tag"]').exists()).toBe(false);
+    expect(w.find('[data-test="workflow-list-workflow-1-http-endpoint"]').exists()).toBe(false);
+    expect(w.find('[data-test="workflow-list-workflow-1-copy-endpoint"]').exists()).toBe(false);
+    expect(panel(w).exists()).toBe(false);
+  });
+});
diff --git a/web/src/components/workflows/WorkflowsList.vue b/web/src/components/workflows/WorkflowsList.vue
index d48ff35edc..54618f3f7d 100644
--- a/web/src/components/workflows/WorkflowsList.vue
+++ b/web/src/components/workflows/WorkflowsList.vue
@@ -191,12 +191,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             </template>
 
             <template #cell-trigger="{ row }">
-              <OTag
-                v-if="row.trigger && row.trigger !== '—'"
-                :value="row.trigger"
-                variant="amber-soft"
-                data-test="workflow-list-trigger-tag"
-              />
+              <div class="flex min-w-0 items-center gap-1">
+                <OTag
+                  v-if="row.trigger && row.trigger !== '—'"
+                  :value="row.trigger"
+                  variant="amber-soft"
+                  data-test="workflow-list-trigger-tag"
+                />
+                <span v-if="hooksOn && hasHttpEndpoint(row)" class="inline-flex shrink-0">
+                  <OTag
+                    :value="t('workflow.http.listTag')"
+                    variant="blue-soft"
+                    icon="webhook"
+                    data-test="workflow-list-http-tag"
+                  />
+                  <OTooltip side="bottom" :content="t('workflow.http.listTagTooltip')" />
+                </span>
+              </div>
             </template>
 
             <template #cell-actions="{ row }">
@@ -278,6 +289,27 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   >
                     <span>{{ t("workflow.edit") }}</span>
                   </ODropdownItem>
+                  <ODropdownItem
+                    v-if="hooksOn"
+                    icon-left="webhook"
+                    :data-test="`workflow-list-${row.name}-http-endpoint`"
+                    @select="openHttpPanel(row)"
+                  >
+                    <span>{{ t("workflow.http.listMenuItem") }}</span>
+                  </ODropdownItem>
+                  <ODropdownItem
+                    v-if="hooksOn && hasHttpEndpoint(row)"
+                    icon-left="link"
+                    :data-test="`workflow-list-${row.name}-copy-endpoint`"
+                    @select="copyEndpointUrl(row)"
+                  >
+                    <span>{{ t("workflow.http.copyUrl") }}</span>
+                    <OTooltip
+                      v-if="row.is_draft"
+                      side="left"
+                      :content="t('workflow.http.copyUrlDraftHint')"
+                    />
+                  </ODropdownItem>
                   <ODropdownItem
                     :data-test="`workflow-list-${row.name}-delete`"
                     variant="destructive"
@@ -328,11 +360,31 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     @update:cancel="resetConfirmDialog"
     v-model="confirmDialogMeta.show"
   />
+
+  <WorkflowHttpEndpointPanel
+    v-if="hooksOn && httpPanelRow"
+    :open="httpPanelOpen"
+    :workflow-id="httpPanelRow.id"
+    :workflow-name="httpPanelRow.name || ''"
+    :kind="rowTriggerKind(httpPanelRow)"
+    :is-draft-only="!!httpPanelRow.is_draft"
+    :workflow-enabled="httpPanelRow.enabled !== false"
+    context="list"
+    @update:open="httpPanelOpen = $event"
+  />
 </template>
 
 <script setup lang="ts">
 import { workflowKeys } from "@/services/workflows.querykeys";
-import { workflowFolderQuery, workflowSearchQuery } from "@/services/workflows.queries";
+import {
+  workflowFolderQuery,
+  workflowHttpTriggerQuery,
+  workflowSearchQuery,
+} from "@/services/workflows.queries";
+import { copyPendingText } from "@/utils/clipboard";
+import { hasHttpEndpoint, workflowHooksEnabled } from "@/plugins/workflows/httpEndpoint";
+import { HttpEndpointError, httpErrorText } from "@/plugins/workflows/httpEndpointUi";
+import WorkflowHttpEndpointPanel from "@/components/workflows/WorkflowHttpEndpointPanel.vue";
 import { queryClient } from "@/composables/query/queryClient";
 import { ref, computed, defineAsyncComponent, onMounted, watch } from "vue";
 import { raw, useI18nTyped } from "@/types/i18n";
@@ -416,6 +468,7 @@ const onFolderChange = (folderId: string) => {
 const store = useStore();
 
 const currentRouteName = computed(() => router.currentRoute.value.name);
+const hooksOn = computed(() => workflowHooksEnabled(store.state.zoConfig));
 const orgId = computed(() => store.state.selectedOrganization.identifier as string);
 
 const shapeWorkflows = (list: any[]) =>
@@ -531,6 +584,54 @@ const triggerKind = (wf: any): string => {
   return triggerNode?.data?.trigger_kind || triggerNode?.meta?.trigger_kind || DEFAULT_TRIGGER_KIND;
 };
 
+interface WorkflowListRow {
+  id: string;
+  name?: string;
+  is_draft?: boolean;
+  enabled?: boolean;
+  nodes?: {
+    data?: { node_type?: string; trigger_kind?: string };
+    meta?: { trigger_kind?: string };
+  }[];
+}
+
+// No trigger node yet means no kind: the panel then titles the workflow by name alone.
+const rowTriggerKind = (wf: WorkflowListRow): string | undefined => {
+  const triggerNode = (wf.nodes || []).find((n) => n.data?.node_type === "workflow_trigger");
+  if (!triggerNode) return undefined;
+  return triggerNode.data?.trigger_kind || triggerNode.meta?.trigger_kind || DEFAULT_TRIGGER_KIND;
+};
+
+const httpPanelRow = ref<WorkflowListRow | null>(null);
+const httpPanelOpen = ref(false);
+const openHttpPanel = (row: WorkflowListRow) => {
+  httpPanelRow.value = row;
+  httpPanelOpen.value = true;
+};
+
+// The row carries only the flag, so the URL comes from the endpoint; the clipboard write starts inside the click.
+const copyEndpointUrl = async (row: WorkflowListRow) => {
+  const url = queryClient
+    .fetchQuery(workflowHttpTriggerQuery(orgId.value, row.id))
+    .then((state) => {
+      if (!state.configured) throw new HttpEndpointError("workflow.http.errorNotConfigured");
+      return state.url;
+    });
+  try {
+    const copied = await copyPendingText(url);
+    toast(
+      copied
+        ? { message: t("toastMessages.workflows.endpointUrlCopied"), variant: "success" }
+        : { message: t("common.copyError"), variant: "error" },
+    );
+  } catch (e: unknown) {
+    toast({
+      message: t("workflow.http.copyUrlFailed", { reason: httpErrorText(e, t) }),
+      variant: "error",
+    });
+  }
+};
+
 const triggerLabel = (wf: any): string => {
   const triggerNode = (wf.nodes || []).find((n: any) => n.data?.node_type === "workflow_trigger");
   if (!triggerNode) return "—";
@@ -584,6 +685,7 @@ const columns = computed<OTableColumnDef<any>[]>(() => [
     sortable: true,
     resizable: true,
     hideable: true,
+    size: 184,
     meta: { align: "left" },
   },
   {
diff --git a/web/src/composables/dashboard/usePanelDrilldown.spec.ts b/web/src/composables/dashboard/usePanelDrilldown.spec.ts
index 3fd30299a4..c52a09f944 100644
--- a/web/src/composables/dashboard/usePanelDrilldown.spec.ts
+++ b/web/src/composables/dashboard/usePanelDrilldown.spec.ts
@@ -304,6 +304,46 @@ describe("usePanelDrilldown", () => {
     expect(plain.hideChartTooltip).not.toHaveBeenCalled();
   });
 
+  it("formats date variables in a custom Logs drilldown query", async () => {
+    const deps = makeDeps();
+    deps.panelSchema.value.config.drilldown = [
+      {
+        name: "Logs",
+        type: "logs",
+        targetBlank: false,
+        data: {
+          logsMode: "custom",
+          logsQuery: `SELECT * FROM "default" WHERE a = '$d' AND b >= \${d:epochus} AND c = '\${t:epochus}'`,
+        },
+      } as any,
+    ];
+    deps.variablesData.value.values = [
+      { name: "d", type: "date", value: "2026-03-08", dateFormat: "dmy" },
+      { name: "t", type: "textbox", value: "2026-03-08" },
+    ] as any;
+    const api = usePanelDrilldown(deps as any);
+
+    await api.onChartClick({
+      componentType: "series",
+      event: { offsetX: 40, offsetY: 50 },
+      dataIndex: 0,
+      seriesName: "series-a",
+      value: ["x", 1],
+    });
+    await api.openDrilldown(0);
+
+    // the date variable prints in its own format (or the placeholder's); a text variable ignores the date format
+    await vi.waitFor(() =>
+      expect(deps.router.push).toHaveBeenCalledWith(
+        expect.objectContaining({
+          query: expect.objectContaining({
+            query: `b64(SELECT * FROM "default" WHERE a = '08/03/2026' AND b >= 1772928000000000 AND c = '2026-03-08')`,
+          }),
+        }),
+      ),
+    );
+  });
+
   it("resolves variables sharing a name prefix in a custom Logs drilldown query", async () => {
     const deps = makeDeps();
     deps.panelSchema.value.config.drilldown = [
diff --git a/web/src/composables/dashboard/usePanelDrilldown.ts b/web/src/composables/dashboard/usePanelDrilldown.ts
index d7929eb381..2dc7a80b05 100644
--- a/web/src/composables/dashboard/usePanelDrilldown.ts
+++ b/web/src/composables/dashboard/usePanelDrilldown.ts
@@ -21,6 +21,7 @@ import { b64EncodeUnicode, escapeSingleQuotes } from "@/utils/zincutils";
 import { getUTCTimestampFromZonedTimestamp } from "@/utils/dashboard/dateTimeUtils";
 import { getFieldLabel } from "@/utils/dashboard/fieldLabel";
 import {
+  formatDateVariable,
   normalizeVariableSyntax,
   replaceVariablePlaceholders,
 } from "@/utils/dashboard/variables/variablesUtils";
@@ -463,7 +464,12 @@ export function usePanelDrilldown({
       const escape = (value: any) => escapeSingleQuotes(String(value));
 
       if (!Array.isArray(variable.value)) {
-        return variable.value === null ? "" : `${escape(variable.value)}`;
+        const dateText = formatDateVariable(variable, format);
+        return dateText !== undefined
+          ? escape(dateText)
+          : variable.value === null
+            ? ""
+            : `${escape(variable.value)}`;
       }
 
       const singleQuoted = variable.value.map((value: any) => `'${escape(value)}'`).join(",");
diff --git a/web/src/composables/dashboard/usePanelVariableSubstitution.spec.ts b/web/src/composables/dashboard/usePanelVariableSubstitution.spec.ts
index 29c599172b..d571f2e549 100644
--- a/web/src/composables/dashboard/usePanelVariableSubstitution.spec.ts
+++ b/web/src/composables/dashboard/usePanelVariableSubstitution.spec.ts
@@ -1,6 +1,7 @@
 import { describe, it, expect, vi } from "vitest";
 import { ref } from "vue";
 import { usePanelVariableSubstitution } from "./usePanelVariableSubstitution";
+import { SELECT_ALL_VALUE } from "@/utils/dashboard/constants";
 import { computePercentileWindow } from "@/utils/metrics/metricDefaults";
 
 // Mock utilities that have heavy dependencies (vuex, services, async parser)
@@ -465,6 +466,73 @@ describe("replaceQueryValue", () => {
   });
 });
 
+// ─── date variables ───────────────────────────────────────────────────────────
+
+describe("replaceQueryValue with date variables", () => {
+  const dateVar = (extra: Record<string, unknown> = {}) => ({
+    name: "d",
+    type: "date",
+    value: "2026-03-08",
+    isVariablePartialLoaded: true,
+    ...extra,
+  });
+  const run = (q: string, values: any[]) =>
+    usePanelVariableSubstitution({
+      panelSchema: makePanelSchema([{ query: q }]),
+      variablesData: makeVariablesData(values),
+      chartPanelRef: makeChartPanelRef(),
+      store: makeStore(),
+      log,
+    }).replaceQueryValue(q, 0, 300_000_000, "sql").query;
+
+  it("prints the epoch in microseconds for ${d:epochus}", () => {
+    expect(run("WHERE _timestamp >= ${d:epochus}", [dateVar()])).toBe(
+      "WHERE _timestamp >= 1772928000000000",
+    );
+  });
+
+  it("prints 00:00 UTC of the day for ${d:epoch} and ${d:epochms}", () => {
+    expect(run("WHERE a >= ${d:epoch} AND b >= ${d:epochms}", [dateVar()])).toBe(
+      "WHERE a >= 1772928000 AND b >= 1772928000000",
+    );
+  });
+
+  it("uses the variable's dateFormat for a bare $d", () => {
+    expect(run("WHERE day = '$d'", [dateVar({ dateFormat: "dmy" })])).toBe(
+      "WHERE day = '08/03/2026'",
+    );
+    expect(run("WHERE day = '$d'", [dateVar({ dateFormat: "epoch" })])).toBe(
+      "WHERE day = '1772928000'",
+    );
+  });
+
+  it("lets the placeholder override the variable's dateFormat", () => {
+    expect(run("{{d:mdy}} ${d}", [dateVar({ dateFormat: "dmy" })])).toBe("03/08/2026 08/03/2026");
+  });
+
+  it("formats with the default before a list format, which is a no-op on a scalar", () => {
+    expect(run("${d:csv} ${d:singlequote}", [dateVar({ dateFormat: "dmy" })])).toBe(
+      "08/03/2026 08/03/2026",
+    );
+  });
+
+  it("defaults to iso when the variable has no dateFormat", () => {
+    expect(run("$d", [dateVar()])).toBe("2026-03-08");
+  });
+
+  it("ignores a date format on a non-date variable", () => {
+    expect(run("${t:epochus} ${t:dmy}", [{ ...dateVar({ name: "t", type: "textbox" }) }])).toBe(
+      "2026-03-08 2026-03-08",
+    );
+  });
+
+  it("renders an empty or malformed date value as before", () => {
+    expect(run("[${d:epoch}]", [dateVar({ value: "" })])).toBe("[]");
+    expect(run("[${d:epoch}]", [dateVar({ value: "2026-02-30" })])).toBe("[2026-02-30]");
+    expect(run("[${d:epoch}]", [dateVar({ value: null })])).toBe(`[${SELECT_ALL_VALUE}]`);
+  });
+});
+
 // ─── ifPanelVariablesCompletedLoading ─────────────────────────────────────────
 
 describe("ifPanelVariablesCompletedLoading", () => {
diff --git a/web/src/composables/dashboard/usePanelVariableSubstitution.ts b/web/src/composables/dashboard/usePanelVariableSubstitution.ts
index 7bf59d99e1..bdc4320c91 100644
--- a/web/src/composables/dashboard/usePanelVariableSubstitution.ts
+++ b/web/src/composables/dashboard/usePanelVariableSubstitution.ts
@@ -16,6 +16,7 @@
 import { addLabelToPromQlQuery } from "@/utils/query/promQLUtils";
 import { addLabelsToSQlQuery, getStreamFromQuery } from "@/utils/query/sqlUtils";
 import {
+  formatDateVariable,
   formatInterval,
   formatRateInterval,
   getTimeInSecondsBasedOnUnit,
@@ -36,8 +37,9 @@ const formatPanelVariableValue = (
   const escape = (value: any) => escapeSingleQuotes(String(value));
 
   if (!Array.isArray(variable.value)) {
-    // If no data found (null value), use SELECT_ALL_VALUE
-    return `${escape(variable.value === null ? SELECT_ALL_VALUE : variable.value)}`;
+    // a date variable prints in its effective format; a null value is the All sentinel
+    const dateText = formatDateVariable(variable, format);
+    return `${escape(dateText ?? (variable.value === null ? SELECT_ALL_VALUE : variable.value))}`;
   }
 
   // If no data found (empty array), use SELECT_ALL_VALUE
diff --git a/web/src/composables/dashboard/useVariablesManager.spec.ts b/web/src/composables/dashboard/useVariablesManager.spec.ts
index 5c06a5a7b9..16d570a906 100644
--- a/web/src/composables/dashboard/useVariablesManager.spec.ts
+++ b/web/src/composables/dashboard/useVariablesManager.spec.ts
@@ -323,6 +323,18 @@ describe("useVariablesManager", () => {
   });
 
   describe("Variable Loading", () => {
+    it("should treat date variables like textbox (no query, loaded immediately)", async () => {
+      const manager = useVariablesManager(gt);
+      const config: VariableConfig[] = [
+        { name: "from_date", type: "date", scope: "global", value: "2026-01-01" },
+      ];
+
+      await manager.initialize(config, {});
+
+      expect(manager.variablesData.global[0].isVariablePartialLoaded).toBe(true);
+      expect(manager.variablesData.global[0].isVariableLoadingPending).toBe(true);
+    });
+
     it("should load independent global variables in parallel", async () => {
       const manager = useVariablesManager(gt);
       const config: VariableConfig[] = [
diff --git a/web/src/composables/dashboard/useVariablesManager.ts b/web/src/composables/dashboard/useVariablesManager.ts
index c2550217b3..347851661d 100644
--- a/web/src/composables/dashboard/useVariablesManager.ts
+++ b/web/src/composables/dashboard/useVariablesManager.ts
@@ -29,11 +29,13 @@ export const LIVE_COMMIT_DEBOUNCE_MS = 300;
 export interface VariableConfig {
   name: string;
   label?: I18nText;
-  type: "query_values" | "custom" | "constant" | "textbox" | "dynamic_filters";
+  type: "query_values" | "custom" | "constant" | "textbox" | "date" | "dynamic_filters";
   scope: "global" | "tabs" | "panels";
   tabs?: string[];
   panels?: string[];
   value: any;
+  /** Date variables only: the default output format. */
+  dateFormat?: string;
   multiSelect?: boolean;
   query_data?: {
     stream_type?: string;
@@ -547,9 +549,14 @@ export const useVariablesManager = (t: TranslateFn) => {
 
     independentGlobalVars.forEach((v) => {
       // Mark as pending so selector will load them
-      // Non-API types (custom, constant, textbox) need to load to notify manager
+      // Non-API types (custom, constant, textbox, date) need to load to notify manager
       // query_values types without custom/all need API calls
-      if (v.type === "custom" || v.type === "constant" || v.type === "textbox") {
+      if (
+        v.type === "custom" ||
+        v.type === "constant" ||
+        v.type === "textbox" ||
+        v.type === "date"
+      ) {
         // Non-API types still need to load to set values and notify manager
         v.isVariableLoadingPending = true;
       } else if (v.type === "query_values") {
@@ -581,7 +588,7 @@ export const useVariablesManager = (t: TranslateFn) => {
 
         // Check if all parents are non-API types (don't require API calls to load)
         // These variables are treated the same: they load synchronously without API calls
-        // 1. Custom type variables: custom, constant, textbox, dynamic_filters
+        // 1. Custom type variables: custom, constant, textbox, date, dynamic_filters
         // 2. Query_values with custom/all defaults (values set from config, not API)
         const allParentsAreNonAPITypes = parentKeys.every((parentKey) => {
           const parentVar = globalVars.find((gv) => {
@@ -592,7 +599,7 @@ export const useVariablesManager = (t: TranslateFn) => {
           if (!parentVar) return false;
 
           // Parent is non-API type if:
-          // - It's a custom type variable (custom, constant, textbox, dynamic_filters)
+          // - It's a custom type variable (custom, constant, textbox, date, dynamic_filters)
           // - OR it's a query_values with custom/all default (no API call needed)
           // loadOptionsWithAllDefault makes an "all" parent genuinely fetch, so it
           // is NOT synchronous: pre-marking its child races the parent's response
@@ -601,6 +608,7 @@ export const useVariablesManager = (t: TranslateFn) => {
             parentVar.type === "custom" ||
             parentVar.type === "constant" ||
             parentVar.type === "textbox" ||
+            parentVar.type === "date" ||
             parentVar.type === "dynamic_filters" ||
             (parentVar.type === "query_values" &&
               parentVar.loadOptionsWithAllDefault !== true &&
diff --git a/web/src/composables/dbm/dbmScopeFilterSync.spec.ts b/web/src/composables/dbm/dbmScopeFilterSync.spec.ts
index f88d1c308f..6ef38f17df 100644
--- a/web/src/composables/dbm/dbmScopeFilterSync.spec.ts
+++ b/web/src/composables/dbm/dbmScopeFilterSync.spec.ts
@@ -271,7 +271,7 @@ describe("every list page re-reads its scope when the reader returns", () => {
       const source = read(file);
       // Prettier splits the call across lines once the model map grows, so
       // match the call and its live-query argument rather than one spelling.
-      expect(source).toMatch(/useDbmOwnFilterSync\(\s*\(\) => route\.query/);
+      expect(source).toMatch(/useDbmOwnFilterSync\(\s*\(\) =>[^;]*?route\.query/);
       // ...and it must RELOAD, or the chip moves while the rows do not.
       expect(source, `${file} must refetch when it adopts a new scope`).toContain(
         "() => void load()",
diff --git a/web/src/composables/dbm/dbmTabCountsResilience.spec.ts b/web/src/composables/dbm/dbmTabCountsResilience.spec.ts
index 3af8b00319..c1978642d9 100644
--- a/web/src/composables/dbm/dbmTabCountsResilience.spec.ts
+++ b/web/src/composables/dbm/dbmTabCountsResilience.spec.ts
@@ -219,6 +219,58 @@ describe("the databases fallback counts the same refs the fleet union renders",
     // The client vantage answered 1; the fallback must not override it.
     expect(counts.databaseCount).toBe(1);
   });
+
+  it("counts servers, not schemas, and honours the Schema filter", async () => {
+    const databases = {
+      hits: [
+        { db_system: "postgresql", db_instance: "o2dev", db_namespace: "o2dev" },
+        { db_system: "postgresql", db_instance: "o2dev", db_namespace: "postgres" },
+        { db_system: "postgresql", db_instance: "o2dev", db_namespace: "o2alpha" },
+        { db_system: "postgresql", db_instance: "o2-introspection", db_namespace: "postgres" },
+      ],
+    };
+    const data = {
+      databases,
+      queries: { total: 0, hits: [] },
+      activity: null,
+      deadlocks: null,
+      blocking: null,
+      table_health: null,
+    };
+    service.getBadges.mockResolvedValueOnce({ data });
+    expect((await fetchDbmTabCounts("acme", WINDOW)).databaseCount).toBe(2);
+
+    queryClient.clear();
+    service.getBadges.mockResolvedValueOnce({ data });
+    expect((await fetchDbmTabCounts("acme", WINDOW, { namespace: "o2alpha" })).databaseCount).toBe(
+      1,
+    );
+  });
+
+  it("does not badge server-known instances under a Schema filter no traffic matched", async () => {
+    service.getBadges.mockResolvedValueOnce({
+      data: {
+        databases: {
+          hits: [{ db_system: "postgresql", db_instance: "o2dev", db_namespace: "o2dev" }],
+        },
+        queries: { total: 0, hits: [] },
+        activity: {
+          by_state: [],
+          hits: [{ db_system: "postgresql", db_instance: "o2-introspection" }],
+        },
+        deadlocks: null,
+        blocking: null,
+        table_health: null,
+        server_queries: {
+          hits: [{ db_system: "postgresql", db_instance: "o2dev" }],
+          truncated: false,
+        },
+        server_samples: { hits: [], truncated: false },
+      },
+    });
+    const counts = await fetchDbmTabCounts("acme", WINDOW, { namespace: "stale-schema" });
+    expect(counts.databaseCount).toBe(0);
+  });
 });
 
 describe("one dead slice must not blank a badge the last window answered", () => {
@@ -331,6 +383,40 @@ describe("what one page learns is visible from every tab", () => {
     expect(badgeCount(counts.value.databaseCount)).toBe("6");
   });
 
+  it("keeps a count the page publishes once the cached unfiltered scope is back", async () => {
+    const twoTraced = {
+      ...envelope(),
+      databases: {
+        hits: [
+          { db_system: "postgresql", db_instance: "pg-orders", db_namespace: "orders" },
+          { db_system: "postgresql", db_instance: "pg-billing", db_namespace: "billing" },
+        ],
+      },
+    };
+    service.getBadges.mockResolvedValue({ data: twoTraced });
+    const { counts, load, publishOwnCount } = useDbmTabCounts();
+    await load("acme", RANGE, WINDOW, {});
+    await load("acme", RANGE, WINDOW, { namespace: "orders" });
+    publishOwnCount("databaseCount", 1);
+
+    // Schema chip cleared: the URL settles first, so the shell re-keys before the page republishes.
+    await load("acme", RANGE, WINDOW, {});
+    publishOwnCount("databaseCount", 3);
+
+    expect(service.getBadges).toHaveBeenCalledTimes(2);
+    expect(badgeCount(counts.value.databaseCount)).toBe("3");
+  });
+
+  it("still drops a count published under the scope the strip is leaving", async () => {
+    service.getBadges.mockResolvedValue({ data: envelope() });
+    const { counts, load, publishOwnCount } = useDbmTabCounts();
+    await load("acme", RANGE, WINDOW, { namespace: "orders" });
+    publishOwnCount("databaseCount", 6);
+    await load("acme", RANGE, WINDOW, {});
+
+    expect(badgeCount(counts.value.databaseCount)).toBe("1");
+  });
+
   it("treats an empty breakdown beside total:0 as a MEASURED zero, not an unknown", async () => {
     // THE REPORTED BUG, at its source. Scoping Activity to `mssql-prod-1` —
     // an engine with no session sampler at all — returns
diff --git a/web/src/composables/dbm/useDbmTabCounts.ts b/web/src/composables/dbm/useDbmTabCounts.ts
index 3044b3bc96..21a6cc9528 100644
--- a/web/src/composables/dbm/useDbmTabCounts.ts
+++ b/web/src/composables/dbm/useDbmTabCounts.ts
@@ -128,6 +128,7 @@ import { queryClient } from "@/composables/query/queryClient";
 import { activitySampleTotal } from "@/utils/dbm/activity";
 import { dedupeServerInstanceRefs, type DbmServerInstanceRef } from "@/utils/dbm/fleetRows";
 import { countClaim, overlapClaim, type DbmCountClaim } from "@/utils/dbm/format";
+import { inSchema, instanceKey } from "@/utils/dbm/instanceRows";
 
 /**
  * Everything the tab strips need, from one request.
@@ -300,7 +301,14 @@ export const fetchDbmTabCounts = async (
   const { databases, queries, activity, deadlocks, blocking, table_health: tableHealth } = badges;
 
   const counts: DbmTabCounts = {
-    databaseCount: databases ? (databases.hits?.length ?? 0) : null,
+    // The endpoint ignores `namespace`, so the Overview's client-side Schema filter applies here.
+    databaseCount: databases
+      ? new Set(
+          (databases.hits ?? [])
+            .filter((row) => inSchema(row, filters.namespace))
+            .map((row) => instanceKey(row)),
+        ).size
+      : null,
     // The same databases member, summed instead of counted: its rows carry
     // the rollup's EXACT per-instance `calls` totals, and instances partition
     // calls, so the sum is the window's finished-call population. A row without
@@ -414,7 +422,8 @@ export const fetchDbmTabCounts = async (
     // list the fleet union renders, so this badge counts the rows the tile
     // counts. It can undercount an instance known only to the metric streams;
     // the Overview page's own exact union overrides this the moment it loads.
-    if (counts.databaseCount === 0 && counts.serverInstanceRefs.length) {
+    // Server-known refs name no schema, so under a Schema filter they prove nothing.
+    if (counts.databaseCount === 0 && counts.serverInstanceRefs.length && !filters.namespace) {
       counts.databaseCount = counts.serverInstanceRefs.length;
     }
   }
diff --git a/web/src/composables/rum/useRumSpanBuilder.spec.ts b/web/src/composables/rum/useRumSpanBuilder.spec.ts
index 0076b1c28e..29f0f2ab79 100644
--- a/web/src/composables/rum/useRumSpanBuilder.spec.ts
+++ b/web/src/composables/rum/useRumSpanBuilder.spec.ts
@@ -1240,6 +1240,21 @@ describe("useRumSpanBuilder", () => {
       expect(resSpan!.span_status).toBe("OK");
     });
 
+    it("should carry the HTTP status for the span details' Error tab", () => {
+      const traced = makeTracedResource();
+      const resource = makeOwnRequest({
+        resource_status_code: 401,
+        resource_type: "fetch",
+      });
+      const { formatRumEventsAsSpans } = buildComposable();
+
+      const spans = formatRumEventsAsSpans([traced], [], [], [resource]);
+
+      const resSpan = spans.find((s) => s.rum_event_type === "resource");
+      expect(resSpan!.span_status).toBe("ERROR");
+      expect(resSpan!.http_response_status_code).toBe(401);
+    });
+
     it("should fall back to 'Frontend' when service field is absent", () => {
       const traced = makeTracedResource();
       const resource = makeOwnRequest({
@@ -1398,6 +1413,18 @@ describe("useRumSpanBuilder", () => {
       expect(errSpan!.operation_name).toBe("Error: TypeError");
     });
 
+    it("should carry the error type and message for the span details' Error tab", () => {
+      const traced = makeTracedResource();
+      const error = makeErrorEvent();
+      const { formatRumEventsAsSpans } = buildComposable();
+
+      const spans = formatRumEventsAsSpans([traced], [], [], [error]);
+
+      const errSpan = spans.find((s) => s.rum_event_type === "error");
+      expect(errSpan!.error_type).toBe("TypeError");
+      expect(errSpan!.status_message).toBe("TypeError: Cannot read property");
+    });
+
     it("should show first 3 errors individually", () => {
       const traced = makeTracedResource();
       const errors = [1, 2, 3].map((i) =>
diff --git a/web/src/composables/rum/useRumSpanBuilder.ts b/web/src/composables/rum/useRumSpanBuilder.ts
index f451694ff2..1c8ab66a9f 100644
--- a/web/src/composables/rum/useRumSpanBuilder.ts
+++ b/web/src/composables/rum/useRumSpanBuilder.ts
@@ -320,6 +320,13 @@ export default function useRumSpanBuilder(
         event.type === "error" || (event.type === "resource" && event.resource_status_code >= 400)
           ? "ERROR"
           : "OK",
+      // What the span details' Error tab reads: a request's HTTP status, an error's type and message.
+      ...(event.type === "resource"
+        ? { http_response_status_code: event.resource_status_code }
+        : {}),
+      ...(event.type === "error"
+        ? { error_type: event.error_type, status_message: event.error_message }
+        : {}),
       span_kind: event.type === "resource" ? SPAN_KIND_CLIENT : SPAN_KIND_UNSPECIFIED,
       rum_event_type: event.type,
       rum_session_id: event.session_id,
diff --git a/web/src/composables/shared/router.spec.ts b/web/src/composables/shared/router.spec.ts
index 91aea1b0a1..0c66b8e86b 100644
--- a/web/src/composables/shared/router.spec.ts
+++ b/web/src/composables/shared/router.spec.ts
@@ -883,6 +883,12 @@ describe("useRoutes (router.ts)", () => {
       expect(route.path).toBe("traces/trace-details");
     });
 
+    it("turns on Ask AI for the routed trace detail page only", () => {
+      const { homeChildRoutes } = useRoutes();
+      const route = findRoute(homeChildRoutes, "traceDetails");
+      expect(route.props).toEqual({ showAskAi: true });
+    });
+
     it("redirects the standalone Service Graph path to the canonical query tab", () => {
       config.isEnterprise = "true";
       const { homeChildRoutes } = useRoutes();
diff --git a/web/src/composables/shared/router.ts b/web/src/composables/shared/router.ts
index f91e07990f..6e1713d934 100644
--- a/web/src/composables/shared/router.ts
+++ b/web/src/composables/shared/router.ts
@@ -633,6 +633,7 @@ const useRoutes = () => {
       path: "traces/trace-details",
       name: "traceDetails",
       component: TraceDetails,
+      props: { showAskAi: true },
       meta: {
         titleKey: "routeTitles.traceDetails",
       },
diff --git a/web/src/composables/shared/useAIObservabilityRoutes.spec.ts b/web/src/composables/shared/useAIObservabilityRoutes.spec.ts
new file mode 100644
index 0000000000..1340f0c00c
--- /dev/null
+++ b/web/src/composables/shared/useAIObservabilityRoutes.spec.ts
@@ -0,0 +1,61 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import { useAIObservabilityRouteChildren } from "./useAIObservabilityRoutes";
+
+vi.mock("@/utils/zincutils", () => ({ routeGuard: vi.fn() }));
+
+describe("useAIObservabilityRouteChildren — online evaluations gate", () => {
+  const children = useAIObservabilityRouteChildren();
+  const namesWhere = (requiresOnlineEvals: boolean) =>
+    children
+      .filter((r) => r.name && !r.redirect && !!r.meta?.requiresOnlineEvals === requiresOnlineEvals)
+      .map((r) => r.name);
+
+  // Each of these reads an API the server registers only with O2_EVAL_ENABLED.
+  it("marks every evaluation page and its sub-routes", () => {
+    expect(namesWhere(true)).toEqual([
+      "aiDiscovery",
+      "aiQueues",
+      "aiQueueDetail",
+      "aiQueueWorkbench",
+      "aiDatasets",
+      "aiDatasetDetail",
+      "aiPlayground",
+      "aiExperiments",
+      "aiExperimentCreate",
+      "aiExperimentCompare",
+      "aiExperimentDetail",
+      "aiRemoteTasks",
+      "aiRemoteTaskCreate",
+      "aiRemoteTaskEdit",
+      "aiRemoteTaskDetail",
+      "aiEvaluations",
+    ]);
+  });
+
+  it("leaves Monitor and Prompts alone — their APIs do not depend on evaluations", () => {
+    expect(namesWhere(false)).toEqual([
+      "aiLLMInsights",
+      "aiSessions",
+      "aiAgentGraph",
+      "aiAgentBehavior",
+      "aiPrompts",
+      "aiPromptCreate",
+      "aiPromptVersionCreate",
+    ]);
+  });
+});
diff --git a/web/src/composables/shared/useAIObservabilityRoutes.ts b/web/src/composables/shared/useAIObservabilityRoutes.ts
index 6c16624dec..484328cfbb 100644
--- a/web/src/composables/shared/useAIObservabilityRoutes.ts
+++ b/web/src/composables/shared/useAIObservabilityRoutes.ts
@@ -363,6 +363,17 @@ const AI_OBSERVABILITY_SUB_ROUTES: AiObservabilitySubRoute[] = [
   },
 ];
 
+/** Sections whose backend API the server registers only with online evaluations on. */
+export const ONLINE_EVAL_FEATURE_KEYS: Partial<Record<FeatureKey, true>> = {
+  discovery: true,
+  queues: true,
+  datasets: true,
+  playground: true,
+  experiments: true,
+  remoteTasks: true,
+  evaluations: true,
+};
+
 /**
  * Builds the full `/ai` children array — the redirect stub, every primary
  * route (deduped by `routeName`, so the four Evaluate nav entries yield ONE
@@ -391,7 +402,11 @@ export function useAIObservabilityRouteChildren(): RouteRecordRaw[] {
       path: section.path!,
       name: section.routeName,
       component: section.component!,
-      meta: { titleKey: section.metaTitleKey ?? section.labelKey, keepAlive: false },
+      meta: {
+        titleKey: section.metaTitleKey ?? section.labelKey,
+        keepAlive: false,
+        requiresOnlineEvals: !!section.featureKey && !!ONLINE_EVAL_FEATURE_KEYS[section.featureKey],
+      },
       ...(section.routeProps ? { props: section.routeProps } : {}),
       ...(section.featureKey
         ? { beforeEnter: withFeatureGate(section.featureKey, routeGuard) }
@@ -403,7 +418,11 @@ export function useAIObservabilityRouteChildren(): RouteRecordRaw[] {
         path: sub.path,
         name: sub.routeName,
         component: sub.component,
-        meta: { titleKey: sub.metaTitleKey, keepAlive: false },
+        meta: {
+          titleKey: sub.metaTitleKey,
+          keepAlive: false,
+          requiresOnlineEvals: !!ONLINE_EVAL_FEATURE_KEYS[sub.featureKey],
+        },
         beforeEnter: withFeatureGate(sub.featureKey, routeGuard),
       } as RouteRecordRaw);
     }
diff --git a/web/src/composables/shared/useManagementRoutes.spec.ts b/web/src/composables/shared/useManagementRoutes.spec.ts
index a0c8348327..b2e5babcef 100644
--- a/web/src/composables/shared/useManagementRoutes.spec.ts
+++ b/web/src/composables/shared/useManagementRoutes.spec.ts
@@ -210,6 +210,12 @@ describe("useManagementRoutes", () => {
       });
     });
 
+    // `/providers` exists only with online evaluations on, so the shell reads this meta.
+    it("marks llmProviders as needing online evaluations", () => {
+      const llmRoute = routes[0].children.find((child: any) => child.name === "llmProviders");
+      expect(llmRoute.meta.requiresOnlineEvals).toBe(true);
+    });
+
     it("should have genAiAgentMapping route in OSS builds too, and redirect when locked", () => {
       const genAiRoute = routes[0].children.find(
         (child: any) => child.name === "genAiAgentMapping",
@@ -586,9 +592,9 @@ describe("useManagementRoutes", () => {
       });
     });
 
-    it("should have exactly 25 children routes when enterprise is enabled", () => {
+    it("should have exactly 26 children routes when enterprise is enabled", () => {
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(25); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 14 enterprise (incl. passwordPolicy, announcements + editor, telephonySettings)
+      expect(routes[0].children).toHaveLength(26); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 14 enterprise (incl. passwordPolicy, announcements + editor, telephonySettings)
     });
 
     it("should have the announcement banner list and editor routes when enterprise", () => {
@@ -659,9 +665,9 @@ describe("useManagementRoutes", () => {
       expect(orgMgmtRoute.component).toBeDefined();
     });
 
-    it("should have exactly 13 children routes when cloud is enabled", () => {
+    it("should have exactly 14 children routes when cloud is enabled", () => {
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(13); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 2 cloud
+      expect(routes[0].children).toHaveLength(14); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 2 cloud
     });
   });
 
@@ -676,9 +682,9 @@ describe("useManagementRoutes", () => {
       expect(routes[0].children.length).toBeGreaterThan(10);
     });
 
-    it("should have exactly 27 children routes when both enterprise and cloud are enabled", () => {
+    it("should have exactly 28 children routes when both enterprise and cloud are enabled", () => {
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(27); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 14 enterprise (incl. passwordPolicy, announcements + editor, telephonySettings) + 2 cloud
+      expect(routes[0].children).toHaveLength(28); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 14 enterprise (incl. passwordPolicy, announcements + editor, telephonySettings) + 2 cloud
     });
 
     it("should have all enterprise routes when both are enabled", () => {
@@ -869,63 +875,63 @@ describe("useManagementRoutes", () => {
       config.isEnterprise = "false";
       config.isCloud = "false";
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
     });
 
     it("should handle isCloud as string 'false'", () => {
       config.isEnterprise = "false";
       config.isCloud = "false";
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
     });
 
     it("should handle isEnterprise as undefined", () => {
       (config as any).isEnterprise = undefined;
       config.isCloud = "false";
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
     });
 
     it("should handle isCloud as undefined", () => {
       config.isEnterprise = "false";
       (config as any).isCloud = undefined;
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
     });
 
     it("should handle both config values as undefined", () => {
       (config as any).isEnterprise = undefined;
       (config as any).isCloud = undefined;
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
     });
 
     it("should handle isEnterprise as non-string truthy value", () => {
       (config as any).isEnterprise = true;
       config.isCloud = "false";
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud, since config comparison is strict
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud, since config comparison is strict
     });
 
     it("should handle isCloud as non-string truthy value", () => {
       config.isEnterprise = "false";
       (config as any).isCloud = true;
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud, since config comparison is strict
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud, since config comparison is strict
     });
 
     it("should handle empty string for isEnterprise", () => {
       config.isEnterprise = "";
       config.isCloud = "false";
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
     });
 
     it("should handle empty string for isCloud", () => {
       config.isEnterprise = "false";
       config.isCloud = "";
       const routes = useManagementRoutes();
-      expect(routes[0].children).toHaveLength(23); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
+      expect(routes[0].children).toHaveLength(24); // 5 base (incl. alert_sources redirect) + syntheticsLocations + modelPricing (+ editor, gaps) + llmProviders + genAiAgentMapping + slack + 12 enterprise-only-but-locked (incl. passwordPolicy, telephonySettings) — all always registered outside pure cloud
     });
 
     it("should return the same structure on multiple calls", () => {
diff --git a/web/src/composables/shared/useManagementRoutes.ts b/web/src/composables/shared/useManagementRoutes.ts
index 8a4773959f..f09d8b92b7 100644
--- a/web/src/composables/shared/useManagementRoutes.ts
+++ b/web/src/composables/shared/useManagementRoutes.ts
@@ -129,6 +129,16 @@ const useManagementRoutes = () => {
     component: () => import("@/components/settings/ModelPricingList.vue"),
     beforeEnter: withFeatureGate("modelPricing", routeGuard),
   });
+  routes[0].children.push({
+    path: "model_pricing/gaps",
+    name: "modelPricingGaps",
+    meta: {
+      keepAlive: true,
+      titleKey: "modelPricing.unpriced.title",
+    },
+    component: () => import("@/components/settings/ModelPricingGaps.vue"),
+    beforeEnter: withFeatureGate("modelPricing", routeGuard),
+  });
   routes[0].children.push({
     path: "model_pricing/edit",
     name: "modelPricingEditor",
@@ -143,8 +153,10 @@ const useManagementRoutes = () => {
     path: "llm_providers",
     name: "llmProviders",
     component: () => import("@/components/settings/LlmProvidersSettings.vue"),
+    // `/providers` is unregistered when the server reports `online_evals_enabled: false`.
     meta: {
       titleKey: "llmProviders.title",
+      requiresOnlineEvals: true,
     },
     beforeEnter: withFeatureGate("llmProviders", routeGuard),
   });
diff --git a/web/src/composables/shared/useOnlineEvalsGate.spec.ts b/web/src/composables/shared/useOnlineEvalsGate.spec.ts
new file mode 100644
index 0000000000..5e99fb528c
--- /dev/null
+++ b/web/src/composables/shared/useOnlineEvalsGate.spec.ts
@@ -0,0 +1,56 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { hidesOnlineEvalEntries, isOnlineEvalsOff } from "./useOnlineEvalsGate";
+
+const edition = vi.hoisted(() => ({ isEnterprise: "true", isCloud: "false" }));
+vi.mock("@/aws-exports", () => ({ default: edition }));
+
+beforeEach(() => {
+  edition.isEnterprise = "true";
+  edition.isCloud = "false";
+});
+
+describe("hidesOnlineEvalEntries", () => {
+  it("hides evaluation entries on enterprise/cloud unless /config reports them on", () => {
+    expect(hidesOnlineEvalEntries({ version: "v1", online_evals_enabled: false })).toBe(true);
+    expect(hidesOnlineEvalEntries({})).toBe(true);
+    expect(hidesOnlineEvalEntries({ version: "v1", online_evals_enabled: true })).toBe(false);
+    edition.isEnterprise = "false";
+    edition.isCloud = "true";
+    expect(hidesOnlineEvalEntries({ version: "v1", online_evals_enabled: false })).toBe(true);
+  });
+
+  it("never hides them on OSS, whose edition gate shows them locked instead", () => {
+    edition.isEnterprise = "false";
+    expect(hidesOnlineEvalEntries({ version: "v1", online_evals_enabled: false })).toBe(false);
+  });
+});
+
+describe("isOnlineEvalsOff", () => {
+  it("waits for the full /config before reporting evaluations off", () => {
+    expect(isOnlineEvalsOff(undefined)).toBe(false);
+    expect(isOnlineEvalsOff({})).toBe(false);
+    expect(isOnlineEvalsOff({ online_evals_enabled: false })).toBe(false);
+    expect(isOnlineEvalsOff({ version: "", online_evals_enabled: false })).toBe(true);
+    expect(isOnlineEvalsOff({ version: "v1", online_evals_enabled: true })).toBe(false);
+  });
+
+  it("is never off on OSS", () => {
+    edition.isEnterprise = "false";
+    expect(isOnlineEvalsOff({ version: "v1", online_evals_enabled: false })).toBe(false);
+  });
+});
diff --git a/web/src/composables/shared/useOnlineEvalsGate.ts b/web/src/composables/shared/useOnlineEvalsGate.ts
new file mode 100644
index 0000000000..fbf6b7639a
--- /dev/null
+++ b/web/src/composables/shared/useOnlineEvalsGate.ts
@@ -0,0 +1,41 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { computed } from "vue";
+import { useRoute } from "vue-router";
+import { useStore } from "vuex";
+import { buildFeatureGateContext } from "@/utils/enterpriseFeatures";
+import { isFullConfigLoaded } from "@/services/config.queries";
+
+type ZoConfig = Record<string, unknown> | undefined;
+
+/** Hide evaluation entries on enterprise/cloud until `/config` reports them on; OSS locks them. */
+export const hidesOnlineEvalEntries = (zoConfig: ZoConfig): boolean => {
+  const { isEnterprise, isCloud } = buildFeatureGateContext();
+  return (isEnterprise || isCloud) && zoConfig?.online_evals_enabled !== true;
+};
+
+/** Off only once `/config` has loaded, so a load still in flight never replaces the page. */
+export const isOnlineEvalsOff = (zoConfig: ZoConfig): boolean =>
+  isFullConfigLoaded(zoConfig) && hidesOnlineEvalEntries(zoConfig);
+
+/** Whether the route needs online evaluations that `/config` reports off, reactively. */
+export function useOnlineEvalsRouteOff() {
+  const store = useStore();
+  const route = useRoute();
+  return computed(
+    () => route.meta?.requiresOnlineEvals === true && isOnlineEvalsOff(store.state.zoConfig),
+  );
+}
diff --git a/web/src/composables/traces/useChartZoom.spec.ts b/web/src/composables/traces/useChartZoom.spec.ts
new file mode 100644
index 0000000000..3449617cec
--- /dev/null
+++ b/web/src/composables/traces/useChartZoom.spec.ts
@@ -0,0 +1,125 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it, vi } from "vitest";
+import useChartZoom, {
+  CHART_ZOOM_MAX,
+  CHART_ZOOM_MIN,
+  CHART_ZOOM_STEP,
+  panRange,
+  zoomRange,
+} from "@/composables/traces/useChartZoom";
+
+const fakeChart = (initialZoom?: number) => {
+  let zoom = initialZoom;
+  const calls: any[] = [];
+  return {
+    calls,
+    chart: {
+      getOption: () => ({ series: [zoom === undefined ? {} : { zoom }] }),
+      setOption: (opt: any, flags: any) => {
+        calls.push({ opt, flags });
+        zoom = opt.series[0].zoom;
+      },
+    },
+  };
+};
+
+describe("useChartZoom", () => {
+  it("steps the series zoom by 1.25 from the chart's live level", () => {
+    const { chart, calls } = fakeChart(2);
+    const { zoomIn, zoomOut } = useChartZoom(() => chart);
+
+    zoomIn();
+    expect(calls[0].opt.series[0].zoom).toBeCloseTo(2 * CHART_ZOOM_STEP);
+    expect(calls[0].flags).toEqual({ lazyUpdate: true });
+
+    zoomOut();
+    expect(calls[1].opt.series[0].zoom).toBeCloseTo(2);
+  });
+
+  it("treats a missing zoom as 1", () => {
+    const { chart, calls } = fakeChart();
+    useChartZoom(() => chart).zoomIn();
+    expect(calls[0].opt.series[0].zoom).toBeCloseTo(CHART_ZOOM_STEP);
+  });
+
+  it("clamps the zoom to the min and max", () => {
+    const { chart, calls } = fakeChart(1);
+    const { zoomIn, zoomOut } = useChartZoom(() => chart);
+
+    for (let i = 0; i < 30; i++) zoomIn();
+    expect(calls.at(-1).opt.series[0].zoom).toBe(CHART_ZOOM_MAX);
+
+    for (let i = 0; i < 30; i++) zoomOut();
+    expect(calls.at(-1).opt.series[0].zoom).toBe(CHART_ZOOM_MIN);
+  });
+
+  it("does nothing without a chart", () => {
+    const { zoomIn, zoomOut } = useChartZoom(() => undefined);
+    expect(() => {
+      zoomIn();
+      zoomOut();
+    }).not.toThrow();
+  });
+
+  it("fit runs the callback then bumps the chart key", () => {
+    const onBeforeFit = vi.fn();
+    const { chartKey, fitToScreen } = useChartZoom(() => null, onBeforeFit);
+
+    fitToScreen();
+    expect(onBeforeFit).toHaveBeenCalledTimes(1);
+    expect(chartKey.value).toBe(1);
+  });
+});
+
+describe("zoomRange", () => {
+  const bounds = { min: 0, max: 100 };
+
+  it("narrows and widens around the centre", () => {
+    expect(zoomRange({ min: 0, max: 100 }, 1.25, bounds, 1)).toEqual({ min: 10, max: 90 });
+    const widened = zoomRange({ min: 10, max: 90 }, 1 / 1.25, bounds, 1);
+    expect(widened.min).toBeCloseTo(0);
+    expect(widened.max).toBeCloseTo(100);
+  });
+
+  it("never narrows below the minimum span", () => {
+    let range = { min: 0, max: 100 };
+    for (let i = 0; i < 50; i++) range = zoomRange(range, 1.25, bounds, 1);
+    expect(range.max - range.min).toBeCloseTo(1);
+    expect(range.min).toBeCloseTo(49.5);
+  });
+
+  it("never widens past the bounds and shifts back inside them", () => {
+    expect(zoomRange({ min: 0, max: 100 }, 1 / 1.25, bounds, 1)).toEqual({ min: 0, max: 100 });
+    const shifted = zoomRange({ min: 80, max: 100 }, 1 / 1.25, bounds, 1);
+    expect(shifted.max).toBeCloseTo(100);
+    expect(shifted.max - shifted.min).toBeCloseTo(25);
+  });
+});
+
+describe("panRange", () => {
+  const bounds = { min: 0, max: 100 };
+
+  it("shifts the window by the delta and keeps its width", () => {
+    expect(panRange({ min: 10, max: 30 }, 15, bounds)).toEqual({ min: 25, max: 45 });
+    expect(panRange({ min: 10, max: 30 }, -5, bounds)).toEqual({ min: 5, max: 25 });
+  });
+
+  it("stops at the bounds", () => {
+    expect(panRange({ min: 10, max: 30 }, -50, bounds)).toEqual({ min: 0, max: 20 });
+    expect(panRange({ min: 10, max: 30 }, 500, bounds)).toEqual({ min: 80, max: 100 });
+  });
+});
diff --git a/web/src/composables/traces/useChartZoom.ts b/web/src/composables/traces/useChartZoom.ts
new file mode 100644
index 0000000000..fa7069fd60
--- /dev/null
+++ b/web/src/composables/traces/useChartZoom.ts
@@ -0,0 +1,74 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { ref } from "vue";
+
+export const CHART_ZOOM_MIN = 0.4;
+export const CHART_ZOOM_MAX = 3;
+export const CHART_ZOOM_STEP = 1.25;
+
+export interface ZoomRange {
+  min: number;
+  max: number;
+}
+
+/** Narrows (factor > 1) or widens a range around its centre, kept inside `bounds` and no narrower than `minSpan`. */
+export function zoomRange(
+  range: ZoomRange,
+  factor: number,
+  bounds: ZoomRange,
+  minSpan: number,
+): ZoomRange {
+  const fullSpan = bounds.max - bounds.min;
+  const span = Math.min(fullSpan, Math.max(minSpan, (range.max - range.min) / factor));
+  const centre = (range.min + range.max) / 2;
+  const min = Math.min(bounds.max - span, Math.max(bounds.min, centre - span / 2));
+  return { min, max: min + span };
+}
+
+/** Shifts a range by `delta` without changing its width, stopping at `bounds`. */
+export function panRange(range: ZoomRange, delta: number, bounds: ZoomRange): ZoomRange {
+  const span = range.max - range.min;
+  const min = Math.min(bounds.max - span, Math.max(bounds.min, range.min + delta));
+  return { min, max: min + span };
+}
+
+/** Button zoom for roam-enabled ECharts tree/graph series; `fitToScreen` recreates the chart through `chartKey`. */
+export default function useChartZoom(getChart: () => any, onBeforeFit?: () => void) {
+  const chartKey = ref(0);
+
+  // Read the live zoom so a button press continues from the wheel's level.
+  const currentZoom = (chart: any): number => {
+    const z = chart.getOption?.()?.series?.[0]?.zoom;
+    return typeof z === "number" && z > 0 ? z : 1;
+  };
+
+  const zoomBy = (factor: number) => {
+    const chart = getChart();
+    if (!chart) return;
+    const next = Math.min(CHART_ZOOM_MAX, Math.max(CHART_ZOOM_MIN, currentZoom(chart) * factor));
+    chart.setOption({ series: [{ zoom: next }] }, { lazyUpdate: true });
+  };
+
+  const zoomIn = () => zoomBy(CHART_ZOOM_STEP);
+  const zoomOut = () => zoomBy(1 / CHART_ZOOM_STEP);
+
+  const fitToScreen = () => {
+    onBeforeFit?.();
+    chartKey.value++;
+  };
+
+  return { chartKey, zoomIn, zoomOut, fitToScreen };
+}
diff --git a/web/src/composables/useTracePatternTree.spec.ts b/web/src/composables/useTracePatternTree.spec.ts
index 1071a35518..bcd183224b 100644
--- a/web/src/composables/useTracePatternTree.spec.ts
+++ b/web/src/composables/useTracePatternTree.spec.ts
@@ -16,14 +16,13 @@
 import { describe, expect, it } from "vitest";
 import { ref } from "vue";
 import { useTracePatternTree } from "@/composables/useTracePatternTree";
-import { buildPatternConsolidatedTree } from "@/utils/traces/patternDetection";
+import { buildPathPatterns, buildPatternConsolidatedTree } from "@/utils/traces/patternDetection";
 import { patternTraceTrees } from "@/test/unit/mockData/traces";
 
-// Runs the same pipeline TraceDetails uses for the Trace Graph tab:
-// traceTree → buildPatternConsolidatedTree → useTracePatternTree.treeData
+// Runs the same pipeline TraceDetails uses for the Trace Graph tab.
 const getTreeData = (traceTree: any[]) => {
   const patterns = ref(buildPatternConsolidatedTree(traceTree));
-  const { treeData } = useTracePatternTree(patterns, ref(false));
+  const { treeData } = useTracePatternTree(patterns, ref(false), ref(buildPathPatterns(traceTree)));
   return treeData.value;
 };
 
@@ -85,8 +84,61 @@ describe("useTracePatternTree", () => {
       expect(treeData[0].children?.map((c) => c.name)).toEqual(["querier"]);
     });
 
+    it("should give a service called by two parents each parent's own latency and errors", () => {
+      const [root] = getTreeData(patternTraceTrees.sharedChildTwoParents);
+      const databaseUnder = (parent: string) =>
+        root.children?.find((c) => c.name === parent)?.children?.find((c) => c.name === "database");
+
+      const viaOrder = databaseUnder("order-service");
+      expect(viaOrder?.value).toBe(15);
+      expect(viaOrder?.metadata?.avg).toBe(15);
+      expect(viaOrder?.errorRate).toBe(0);
+      expect(viaOrder?.metadata?.errorCount).toBe(0);
+
+      const viaInventory = databaseUnder("inventory-service");
+      expect(viaInventory?.value).toBe(10);
+      expect(viaInventory?.metadata?.avg).toBe(10);
+      expect(viaInventory?.errorRate).toBe(100);
+      expect(viaInventory?.metadata?.errorCount).toBe(1);
+    });
+
+    it("should give a leaf reached along two branches each branch's own metrics", () => {
+      const [root] = getTreeData(patternTraceTrees.sharedLeafTwoBranches);
+      const child = (node: any, name: string) => node?.children?.find((c: any) => c.name === name);
+
+      const leafViaFrontend = child(child(root, "catalog-rpc"), "product-catalog");
+      expect(leafViaFrontend?.value).toBe(3);
+      expect(leafViaFrontend?.metadata?.count).toBe(1);
+      expect(leafViaFrontend?.metadata?.errorCount).toBe(0);
+      expect(leafViaFrontend?.errorRate).toBe(0);
+
+      const leafViaCheckout = child(
+        child(child(root, "checkout"), "catalog-rpc"),
+        "product-catalog",
+      );
+      expect(leafViaCheckout?.value).toBe(1.5);
+      expect(leafViaCheckout?.metadata?.count).toBe(2);
+      expect(leafViaCheckout?.metadata?.errorCount).toBe(1);
+      expect(leafViaCheckout?.errorRate).toBe(50);
+    });
+
+    it("should keep the self-pattern metrics on a root service", () => {
+      const [root] = getTreeData(patternTraceTrees.sharedChildTwoParents);
+      expect(root.name).toBe("frontend");
+      expect(root.value).toBe(100);
+      expect(root.metadata?.errorCount).toBe(0);
+    });
+
+    it("should show a measured average of 0 on a node instead of its children's average", () => {
+      const [root] = getTreeData(patternTraceTrees.zeroDurationRoot);
+
+      expect(root.name).toBe("scheduler");
+      expect(root.value).toBe(0);
+      expect(root.metadata?.avg).toBe(0);
+    });
+
     it("should return an empty tree when the pattern map is empty", () => {
-      const { treeData } = useTracePatternTree(ref(new Map()), ref(false));
+      const { treeData } = useTracePatternTree(ref(new Map()), ref(false), ref(new Map()));
 
       expect(treeData.value).toEqual([]);
     });
diff --git a/web/src/composables/useTracePatternTree.ts b/web/src/composables/useTracePatternTree.ts
index 20b84c7cc8..c49eed4db6 100644
--- a/web/src/composables/useTracePatternTree.ts
+++ b/web/src/composables/useTracePatternTree.ts
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { Ref, ref } from "vue";
+import { Ref } from "vue";
 import { useTreeVisualization, TreeNode } from "@/composables/useTreeVisualization";
 import { CallPattern } from "@/utils/traces/patternDetection";
 
@@ -23,7 +23,8 @@ import { CallPattern } from "@/utils/traces/patternDetection";
  */
 export function useTracePatternTree(
   patterns: Ref<Map<string, CallPattern>>,
-  isDarkMode: Ref<boolean> = ref(false),
+  isDarkMode: Ref<boolean>,
+  pathPatterns: Ref<Map<string, CallPattern>>,
 ) {
   /**
    * Transform simplified service relationships to TreeNode format
@@ -84,6 +85,8 @@ export function useTracePatternTree(
     const buildServiceTree = (
       serviceName: string,
       visited = new Set<string>(),
+      edgePattern?: CallPattern,
+      parentPath = "",
     ): TreeNode | null => {
       if (visited.has(serviceName)) return null; // Prevent cycles
       visited.add(serviceName);
@@ -92,12 +95,13 @@ export function useTracePatternTree(
       if (!serviceInfo) return null;
 
       globalVisited.add(serviceName);
+      const path = parentPath ? `${parentPath}→${serviceName}` : serviceName;
 
       // Create children from outgoing relationships
       const children: TreeNode[] = [];
       serviceInfo.children.forEach((pattern) => {
         const targetService = pattern.pathSignature.split("→")[1];
-        const childNode = buildServiceTree(targetService, new Set(visited));
+        const childNode = buildServiceTree(targetService, new Set(visited), pattern, path);
         if (childNode) {
           // Preserve child's own metrics (already set by its buildServiceTree call).
           // Only add edge-specific info — don't override with pattern.metrics spread.
@@ -111,20 +115,20 @@ export function useTracePatternTree(
         }
       });
 
-      // Use the service's own self-pattern for its metrics (own span durationMs).
-      // Falls back to children aggregation only if no self-pattern exists.
-      const selfPattern = patternMap.get(serviceName);
+      // Metrics come from the spans on this node's own branch; the edge and self patterns cover paths the trace never took.
+      const metricsPattern =
+        pathPatterns.value.get(path) ?? edgePattern ?? patternMap.get(serviceName);
       const totalCalls =
-        selfPattern?.metrics?.count ||
+        metricsPattern?.metrics?.count ||
         serviceInfo.children.reduce((sum, p) => sum + p.metrics.count, 0);
       const avgDuration =
-        selfPattern?.metrics?.avg ||
+        metricsPattern?.metrics?.avg ??
         (serviceInfo.children.length > 0
           ? serviceInfo.children.reduce((sum, p) => sum + p.metrics.avg * p.metrics.count, 0) /
             Math.max(totalCalls, 1)
           : 0);
       const avgErrorRate =
-        selfPattern?.metrics?.errorRate ??
+        metricsPattern?.metrics?.errorRate ??
         (serviceInfo.children.length > 0
           ? serviceInfo.children.reduce(
               (sum, p) => sum + p.metrics.errorRate * p.metrics.count,
@@ -139,7 +143,7 @@ export function useTracePatternTree(
         errorRate: avgErrorRate,
         children: children.length > 0 ? children : undefined,
         metadata: {
-          ...selfPattern?.metrics,
+          ...metricsPattern?.metrics,
           serviceName,
           count: totalCalls,
           avg: Math.round(avgDuration * 100) / 100,
diff --git a/web/src/composables/useTraces.spec.ts b/web/src/composables/useTraces.spec.ts
index 2cf3a17bc4..1eabe1adb2 100644
--- a/web/src/composables/useTraces.spec.ts
+++ b/web/src/composables/useTraces.spec.ts
@@ -244,6 +244,13 @@ describe("useTraces", () => {
       expect(searchObj.meta.lastRunSignature).toBeNull();
     });
 
+    it("clears searchApplied, so a new org does not mount the Rate/Duration panels before a run", () => {
+      const { searchObj, resetSearchObj } = useTraces();
+      searchObj.searchApplied = true;
+      resetSearchObj();
+      expect(searchObj.searchApplied).toBe(false);
+    });
+
     it("clears errorDetail", () => {
       const { searchObj, resetSearchObj } = useTraces();
       searchObj.data.errorDetail = "detail";
diff --git a/web/src/composables/useTraces.ts b/web/src/composables/useTraces.ts
index b0bf718c17..8dcfc450f6 100644
--- a/web/src/composables/useTraces.ts
+++ b/web/src/composables/useTraces.ts
@@ -276,6 +276,8 @@ const useTraces = () => {
     searchObj.meta.lastRunSignature = null;
     urlColumns = null;
     searchObj.runQuery = false;
+    // Only a run sets it again; left true, a new org mounts the Rate/Duration panels and they query without a run.
+    searchObj.searchApplied = false;
     searchObj.data.traceDetails.isLoadingTraceDetails = false;
     searchObj.data.traceDetails.isLoadingTraceMeta = false;
   };
@@ -580,6 +582,9 @@ const useTraces = () => {
         gen_ai_usage_total_tokens: trace.gen_ai_usage_total_tokens,
         gen_ai_usage_cost: trace.gen_ai_usage_cost,
         gen_ai_input_messages: trace.gen_ai_input_messages,
+        // Unpriced tokens/models (AIO-16) — drive the partial-cost badge.
+        gen_ai_unpriced_tokens: trace.gen_ai_unpriced_tokens,
+        gen_ai_unpriced_models: trace.gen_ai_unpriced_models,
       };
 
       // Build per-trace service span count and duration map
diff --git a/web/src/enterprise/components/AIObservability/AgentScopeCascade.vue b/web/src/enterprise/components/AIObservability/AgentScopeCascade.vue
index 0952337a74..c2adf656b3 100644
--- a/web/src/enterprise/components/AIObservability/AgentScopeCascade.vue
+++ b/web/src/enterprise/components/AIObservability/AgentScopeCascade.vue
@@ -51,7 +51,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         @update:model-value="onEnvChange"
       />
     </div>
-    <div class="w-48 flex-shrink-0 max-md:w-auto max-md:min-w-0 max-md:flex-1 max-md:shrink">
+    <!-- The agent shows by name; its registered id(s) on hover. -->
+    <div
+      class="w-48 flex-shrink-0 max-md:w-auto max-md:min-w-0 max-md:flex-1 max-md:shrink"
+      :title="selectedAgentIdHint"
+      :data-test="`${prefix}-cascade-agent-id`"
+    >
       <OSelect
         :model-value="selectedAgentName"
         :label="t('aiObservability.scope.agent')"
@@ -84,11 +89,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
+import { computed } from "vue";
 import { useI18nTyped } from "@/types/i18n";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import type { SelectOption } from "@/lib/forms/Select/OSelect.types";
 
-withDefaults(
+const props = withDefaults(
   defineProps<{
     /** Page prefix — every emitted data-test is `${prefix}-cascade-...`. */
     prefix: string;
@@ -125,6 +131,14 @@ const emit = defineEmits<{
 
 const { t } = useI18nTyped();
 
+// useAgentScope puts the ids behind each name on its option (`agentIds`).
+const selectedAgentIdHint = computed(() => {
+  const ids = props.agentNames.find((o) => o.value === props.selectedAgentName)?.agentIds;
+  return Array.isArray(ids) && ids.length
+    ? t("aiObservability.scope.agentIdHint", { ids: ids.join(", ") })
+    : undefined;
+});
+
 const onEnvChange = (value: unknown) => {
   emit("update:selectedEnv", value as string);
 };
diff --git a/web/src/enterprise/components/AIObservability/AiAgentsLoadError.vue b/web/src/enterprise/components/AIObservability/AiAgentsLoadError.vue
new file mode 100644
index 0000000000..47a7318a07
--- /dev/null
+++ b/web/src/enterprise/components/AIObservability/AiAgentsLoadError.vue
@@ -0,0 +1,56 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+<!--
+  AiAgentsLoadError — what an AI page shows in Agent mode when the agents list
+  failed to load (useAgentScope's `agentsError`): the shared no-access state for
+  a 403, else the shared load-error state with a Retry that emits `retry`. A
+  failed load is not "no agents", so it never shows the no-agents or the
+  "No agent identity found" states.
+-->
+<template>
+  <OEmptyState
+    v-if="error === 'forbidden'"
+    :size="size"
+    preset="no-access"
+    :data-test="`${dataTest}-agents-forbidden`"
+  />
+  <OEmptyState
+    v-else
+    :size="size"
+    preset="load-error"
+    :data-test="`${dataTest}-agents-error`"
+    @action="$emit('retry')"
+  />
+</template>
+
+<script setup lang="ts">
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import type { AgentsLoadError } from "@/enterprise/composables/useAgentScope";
+
+withDefaults(
+  defineProps<{
+    error: AgentsLoadError;
+    /** data-test prefix; each page passes its own. */
+    dataTest: string;
+    size?: "hero" | "block";
+  }>(),
+  { size: "hero" },
+);
+
+defineEmits<{
+  (e: "retry"): void;
+}>();
+</script>
diff --git a/web/src/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue b/web/src/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue
new file mode 100644
index 0000000000..1eaf802221
--- /dev/null
+++ b/web/src/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue
@@ -0,0 +1,70 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!--
+  Shown on the Monitor pages (Insights, Sessions, Agent Graph, Agent Behavior)
+  when they open in Stream mode because the org's LLM spans carry no agent
+  identity: says why there is no agent to pick and links to GenAI Agent Mapping,
+  where the attribute that names the agent is configured.
+-->
+<template>
+  <div class="px-page-edge pt-2">
+    <OBanner
+      variant="info"
+      icon="info-outline"
+      inline-actions
+      dense
+      :data-test="`${dataTest}-no-agent-identity`"
+    >
+      <span class="font-medium">{{ t("aiObservability.scope.noAgentIdentity") }}.</span>
+      {{ t("aiObservability.scope.noAgentIdentityDescription") }}
+      <template #actions>
+        <OButton
+          variant="outline"
+          size="sm"
+          :data-test="`${dataTest}-no-agent-identity-mapping`"
+          @click="openMapping"
+        >
+          {{ t("aiObservability.scope.noAgentIdentityAction") }}
+        </OButton>
+      </template>
+    </OBanner>
+  </div>
+</template>
+
+<script setup lang="ts">
+import { useRouter } from "vue-router";
+import { useStore } from "vuex";
+import { useI18nTyped } from "@/types/i18n";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+
+defineProps<{
+  /** Page prefix; the banner is `${dataTest}-no-agent-identity`. */
+  dataTest: string;
+}>();
+
+const { t } = useI18nTyped();
+const router = useRouter();
+const store = useStore();
+
+function openMapping() {
+  router.push({
+    name: "genAiAgentMapping",
+    query: { org_identifier: store.state.selectedOrganization?.identifier },
+  });
+}
+</script>
diff --git a/web/src/enterprise/components/AIObservability/AiScopeBar.vue b/web/src/enterprise/components/AIObservability/AiScopeBar.vue
index 348fba99ee..7908d2df05 100644
--- a/web/src/enterprise/components/AIObservability/AiScopeBar.vue
+++ b/web/src/enterprise/components/AIObservability/AiScopeBar.vue
@@ -244,6 +244,8 @@ const emit = defineEmits<{
   (e: "update:selectedVersion", value: string): void;
   (e: "filter-mode-change", value: FilterMode): void;
   (e: "stream-change", value: string): void;
+  /** The user picked an env, agent or version: the agent scope is now an explicit choice. */
+  (e: "agent-pick"): void;
 }>();
 
 // v-model bridge for the stream picker — read the prop, write both the model
@@ -276,13 +278,16 @@ const onStreamChange = (value: unknown) => {
 // useAgentScope selection refs and re-derives the lower lists).
 const onSelectedEnvChange = (value: string) => {
   emit("update:selectedEnv", value);
+  emit("agent-pick");
 };
 
 const onSelectedAgentNameChange = (value: string) => {
   emit("update:selectedAgentName", value);
+  emit("agent-pick");
 };
 
 const onSelectedVersionChange = (value: string) => {
   emit("update:selectedVersion", value);
+  emit("agent-pick");
 };
 </script>
diff --git a/web/src/enterprise/components/AIObservability/ExperimentBrowser.vue b/web/src/enterprise/components/AIObservability/ExperimentBrowser.vue
index eda6d58498..91b534e27e 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentBrowser.vue
+++ b/web/src/enterprise/components/AIObservability/ExperimentBrowser.vue
@@ -334,6 +334,7 @@ import { useMutation } from "@tanstack/vue-query";
 import llmExperimentsService, { type LlmExperiment } from "@/services/llm-experiments.service";
 import {
   comparisonEligibility,
+  experimentCostText,
   experimentEvidence,
   groupExperiments,
   type ComparisonIneligibilityReason,
@@ -627,8 +628,8 @@ function translateComparisonReason(reason: ComparisonIneligibilityReason) {
 }
 
 function costLabel(experiment: LlmExperiment) {
-  const cost = evidence(experiment).cost;
-  return cost === null ? raw("—") : raw(`$${cost.toFixed(4)}`);
+  const { cost, costIncomplete } = evidence(experiment);
+  return experimentCostText(cost, costIncomplete, t);
 }
 
 function isBaseline(experiment: LlmExperiment) {
diff --git a/web/src/enterprise/components/AIObservability/ExperimentComparisonRowDrawer.spec.ts b/web/src/enterprise/components/AIObservability/ExperimentComparisonRowDrawer.spec.ts
index 05994f6b2b..911f274494 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentComparisonRowDrawer.spec.ts
+++ b/web/src/enterprise/components/AIObservability/ExperimentComparisonRowDrawer.spec.ts
@@ -23,7 +23,7 @@ import ExperimentComparisonRowDrawer from "./ExperimentComparisonRowDrawer.vue";
 function detail(experimentId: string, output: string, score: number): ExperimentRowDetail {
   return {
     experimentId,
-    snapshot: { datasetId: "dataset", datasetVersion: 1 },
+    snapshot: { datasetId: "dataset", datasetVersion: 1, datasetWriteVersion: 1 },
     navigation: {
       rowIndex: 0,
       totalRows: 1,
diff --git a/web/src/enterprise/components/AIObservability/ExperimentForm.drafts.spec.ts b/web/src/enterprise/components/AIObservability/ExperimentForm.drafts.spec.ts
index 07517676ae..87398f37af 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentForm.drafts.spec.ts
+++ b/web/src/enterprise/components/AIObservability/ExperimentForm.drafts.spec.ts
@@ -49,7 +49,10 @@ vi.mock("@/services/llm-datasets.service", async () => ({
   default: { list: vi.fn(), listItems: vi.fn() },
 }));
 vi.mock("@/services/online-evals.service", () => ({
-  default: { scorers: { list: vi.fn() }, providers: { list: vi.fn() } },
+  default: {
+    scorers: { list: vi.fn() },
+    providers: { list: vi.fn(), testConfig: vi.fn() },
+  },
 }));
 vi.mock("@/services/llm-prompts.service", () => ({
   default: { list: vi.fn(), resolve: vi.fn() },
@@ -176,6 +179,7 @@ describe("ExperimentForm drafts", () => {
     } as never);
     vi.mocked(onlineEvalsService.scorers.list).mockResolvedValue([scorer] as never);
     vi.mocked(onlineEvalsService.providers.list).mockResolvedValue([provider] as never);
+    vi.mocked(onlineEvalsService.providers.testConfig).mockResolvedValue("ok" as never);
     vi.mocked(llmExperimentsService.preview).mockResolvedValue(previewResult as never);
     vi.mocked(llmExperimentsService.create).mockResolvedValue({
       experiment: { id: "exp-1" },
diff --git a/web/src/enterprise/components/AIObservability/ExperimentForm.spec.ts b/web/src/enterprise/components/AIObservability/ExperimentForm.spec.ts
index 2057009487..77314a889e 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentForm.spec.ts
+++ b/web/src/enterprise/components/AIObservability/ExperimentForm.spec.ts
@@ -51,7 +51,10 @@ vi.mock("@/services/llm-datasets.service", async () => ({
   default: { list: vi.fn(), listItems: vi.fn() },
 }));
 vi.mock("@/services/online-evals.service", () => ({
-  default: { scorers: { list: vi.fn() }, providers: { list: vi.fn() } },
+  default: {
+    scorers: { list: vi.fn() },
+    providers: { list: vi.fn(), testConfig: vi.fn().mockResolvedValue("ok") },
+  },
 }));
 vi.mock("@/services/llm-prompts.service", () => ({
   default: { list: vi.fn(), resolve: vi.fn() },
@@ -68,7 +71,10 @@ const dataset = {
   id: "ds-1",
   name: "RAG regression set",
   description: null,
+  // 128 single-item writes and one batch: the row counter and the shown
+  // version differ, and only the row counter is a valid pin.
   globalVersion: 12,
+  writeVersion: 4,
   itemCount: 128,
   tags: [],
   sources: { trace: 0, annotation: 0, manual: 0 },
@@ -225,6 +231,20 @@ describe("ExperimentForm", () => {
     expect(payload).not.toHaveProperty("userPrompt");
   });
 
+  it("pins the dataset's row version but shows its write version", async () => {
+    wrapper = await createWrapper();
+    fillValid(wrapper);
+    await flushPromises();
+
+    const meta = wrapper.find('[data-test="ai-experiment-form-dataset-meta"]').text();
+    expect(meta).toContain("v4");
+    expect(meta).not.toContain("v12");
+
+    await submit(wrapper);
+    const [, payload] = vi.mocked(llmExperimentsService.create).mock.calls[0];
+    expect(payload.datasetVersion).toBe(12);
+  });
+
   it("omits the system message when it is blank", async () => {
     wrapper = await createWrapper();
     fillValid(wrapper);
diff --git a/web/src/enterprise/components/AIObservability/ExperimentForm.vue b/web/src/enterprise/components/AIObservability/ExperimentForm.vue
index d1ff61fad5..22154674c6 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentForm.vue
+++ b/web/src/enterprise/components/AIObservability/ExperimentForm.vue
@@ -113,7 +113,7 @@
               >
                 {{
                   t("aiObservability.experiments.form.datasetPinned", {
-                    version: selectedDatasetVersion,
+                    version: shownDatasetVersion,
                   })
                 }}
                 {{
@@ -533,7 +533,7 @@
                 >
                   {{
                     t("aiObservability.experiments.scorerApplicability", {
-                      scorer: entry.scorerId,
+                      scorer: scorerName(entry.scorerId),
                       version: entry.scorerVersion,
                       eligible: entry.eligibleSlotCount,
                       noReference: entry.noReferenceSlotCount,
@@ -562,6 +562,24 @@
       <footer
         class="bg-surface-base border-border-default sticky bottom-0 z-1 flex shrink-0 items-center justify-end gap-2 border-t px-5.5 py-3"
       >
+        <p
+          v-if="providerFailure"
+          role="alert"
+          class="text-status-error-text m-0 me-auto min-w-0 text-xs"
+          data-test="ai-experiment-form-provider-failure"
+        >
+          {{
+            t(
+              providerFailure.task
+                ? "aiObservability.experiments.form.taskProviderFailed"
+                : "aiObservability.experiments.form.judgeProviderFailed",
+              { provider: providerFailure.providerName },
+            )
+          }}
+          <template v-if="providerFailure.message">
+            {{ raw(`· ${providerFailure.message}`) }}
+          </template>
+        </p>
         <OButton
           type="button"
           variant="outline"
@@ -653,6 +671,11 @@ import {
   withPreviewScorers,
 } from "../../views/AIObservability/experimentPreview";
 import { aiExperimentsRoute } from "../../views/AIObservability/experimentRoutes";
+import {
+  checkRunProviders,
+  runProviderIds,
+  type ProviderCheckFailure,
+} from "../../views/AIObservability/experimentProviderCheck";
 import ExperimentPreviewPanel from "./ExperimentPreviewPanel.vue";
 import {
   EXPERIMENT_ROW_SOURCES,
@@ -904,11 +927,17 @@ const selectedDataset = computed(
 );
 // A clone keeps the version its source pinned. Re-pinning to the dataset's head
 // would compare two runs over different rows and call the difference a result.
+// This is the pin key (a row version); `shownDatasetVersion` is what it reads as.
 const selectedDatasetVersion = computed(() =>
   cloneSource.value
     ? cloneSource.value.datasetVersion
     : (selectedDataset.value?.globalVersion ?? 0),
 );
+const shownDatasetVersion = computed(() =>
+  cloneSource.value
+    ? cloneSource.value.datasetWriteVersion
+    : (selectedDataset.value?.writeVersion ?? 0),
+);
 
 // preview() validates the entire create body, so it can only run once the task
 // section is complete. Short of that the rail says what is missing rather than
@@ -922,7 +951,7 @@ const previewReady = computed(() => {
   return !!providerId.value && !!String(userPrompt.value ?? "").trim();
 });
 const datasetLabel = computed(() =>
-  selectedDataset.value ? `${selectedDataset.value.name} @ v${selectedDatasetVersion.value}` : "",
+  selectedDataset.value ? `${selectedDataset.value.name} @ v${shownDatasetVersion.value}` : "",
 );
 
 const datasetOptions = computed(() =>
@@ -968,6 +997,13 @@ const scorerOptions = computed(() =>
 
 const scorerApplicability = computed(() => preview.value?.applicability?.scorerApplicability ?? []);
 
+/** Coverage lines name the scorer the user picked, not its entity id. A
+ *  scorer missing from the loaded list falls back to the id so the line still
+ *  says which one it is. */
+function scorerName(id: string): string {
+  return scorers.value.find((scorer) => entityId(scorer) === id)?.name ?? id;
+}
+
 /** First page of the selected dataset; source toggles filter it without refetching. */
 const datasetRows = ref<LlmDatasetItem[]>([]);
 /** Fields every selected-source row shares — suggestions; preview validation stays the authority. */
@@ -1160,6 +1196,7 @@ function previewKey(payload: ExperimentCreatePayload): string {
 
 async function onSubmit(values: ExperimentForm) {
   if (sendingConfirmed.value) return;
+  if (!(await providersAnswer(values))) return;
   // The server pins scorer versions itself; reusing the preview's pins when
   // one is in hand just closes the gap if a version ships mid-edit.
   const payload = buildPayload(values);
@@ -1177,6 +1214,41 @@ async function onSubmit(values: ExperimentForm) {
   await send(body);
 }
 
+/** Last provider test before Create & run; the footer shows its failure. */
+const providerFailure = ref<ProviderCheckFailure | null>(null);
+// A different provider or judge set makes the last result about another run.
+watch([providerId, scorerIds, taskType], () => (providerFailure.value = null));
+
+/** Sends Test Connection's request for every provider the run calls. Nothing
+ *  is created when one does not answer, and the form stays open with why. */
+async function providersAnswer(values: ExperimentForm): Promise<boolean> {
+  providerFailure.value = null;
+  const ids = runProviderIds({
+    taskType: values.taskType,
+    providerId: values.providerId,
+    scorerIds: values.scorerIds ?? [],
+    scorers: scorers.value,
+  });
+  if (!ids.length || !orgId.value) return true;
+  let known: Provider[];
+  let listLoaded = true;
+  try {
+    // Unfiltered and fresh: a judge provider need not be in the chat list.
+    known = await onlineEvalsService.providers.list(orgId.value);
+  } catch {
+    known = providers.value;
+    listLoaded = false;
+  }
+  providerFailure.value = await checkRunProviders(
+    ids,
+    known,
+    (payload, id) => onlineEvalsService.providers.testConfig(orgId.value, payload, id),
+    values.taskType === "remote" ? null : values.providerId,
+    listLoaded,
+  );
+  return providerFailure.value === null;
+}
+
 async function send(body: ExperimentCreatePayload) {
   try {
     const createdId = cloning.value
diff --git a/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.spec.ts b/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.spec.ts
index a550e13fae..a2503d08b3 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.spec.ts
+++ b/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.spec.ts
@@ -22,7 +22,7 @@ import ExperimentRowDetailDrawer from "./ExperimentRowDetailDrawer.vue";
 
 const detail: ExperimentRowDetail = {
   experimentId: "experiment-1",
-  snapshot: { datasetId: "dataset-1", datasetVersion: 7 },
+  snapshot: { datasetId: "dataset-1", datasetVersion: 7, datasetWriteVersion: 3 },
   navigation: {
     rowIndex: 1,
     totalRows: 3,
diff --git a/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.vue b/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.vue
index a2cad47a2f..90ee015ea7 100644
--- a/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.vue
+++ b/web/src/enterprise/components/AIObservability/ExperimentRowDetailDrawer.vue
@@ -363,7 +363,7 @@ const activeTrial = computed(() =>
 const snapshotLabel = computed(() =>
   props.detail
     ? t("aiObservability.experiments.rowDetail.snapshot", {
-        version: props.detail.snapshot.datasetVersion,
+        version: props.detail.snapshot.datasetWriteVersion,
       })
     : raw(""),
 );
diff --git a/web/src/enterprise/components/AIObservability/RemoteTaskFormPage.spec.ts b/web/src/enterprise/components/AIObservability/RemoteTaskFormPage.spec.ts
index abd9bd8d64..496a232253 100644
--- a/web/src/enterprise/components/AIObservability/RemoteTaskFormPage.spec.ts
+++ b/web/src/enterprise/components/AIObservability/RemoteTaskFormPage.spec.ts
@@ -588,6 +588,7 @@ describe("RemoteTaskFormPage — test connection", () => {
 
     it.each([
       ["transport", undefined, "Could not reach the endpoint."],
+      ["timeout", undefined, "The endpoint did not answer in time."],
       ["http_status", 503, "The endpoint answered with HTTP 503."],
     ])("says the %s reason code as a sentence", async (code, httpStatus, message) => {
       testRun.mockResolvedValue([
diff --git a/web/src/enterprise/components/AIObservability/RemoteTaskFormPage.vue b/web/src/enterprise/components/AIObservability/RemoteTaskFormPage.vue
index 2c8e5efb38..87c2ddfe42 100644
--- a/web/src/enterprise/components/AIObservability/RemoteTaskFormPage.vue
+++ b/web/src/enterprise/components/AIObservability/RemoteTaskFormPage.vue
@@ -818,6 +818,7 @@ function storedFailureMessage(row?: RemoteTaskTestRunRow): I18nText {
     case "transport":
       return t("aiObservability.remoteTasks.testPanel.failure.transport");
     case "deadline_exceeded":
+    case "timeout":
       return t("aiObservability.remoteTasks.testPanel.failure.deadlineExceeded");
     case "http_status":
       return t("aiObservability.remoteTasks.testPanel.failure.httpStatus", {
diff --git a/web/src/enterprise/components/onlineEvals/EvalJobList.vue b/web/src/enterprise/components/onlineEvals/EvalJobList.vue
index 4e48a7f5e3..870227beef 100644
--- a/web/src/enterprise/components/onlineEvals/EvalJobList.vue
+++ b/web/src/enterprise/components/onlineEvals/EvalJobList.vue
@@ -610,7 +610,14 @@ function lastErrorOf(row: EvalJob): EvalJobLastError | undefined {
 
 function healthLabel(row: EvalJob): I18nText {
   const health = healthOf(row);
-  return health ? t(HEALTH_LABELS[health.state]) : raw("—");
+  if (!health) return raw("—");
+  // Health measures a 15-minute window; a job that scored earlier in the
+  // 24-hour lookback says when it last scored instead of a bare "Healthy".
+  // (One whose newest outcome there is an error is degraded, not healthy.)
+  if (health.state === "healthy" && !health.recentRuns && health.lastSuccessAt) {
+    return t("onlineEvals.job.health.lastScored", { time: microsAgo(health.lastSuccessAt) });
+  }
+  return t(HEALTH_LABELS[health.state]);
 }
 
 function healthSummary(row: EvalJob): I18nText {
diff --git a/web/src/enterprise/components/onlineEvals/ImportScoreConfig.vue b/web/src/enterprise/components/onlineEvals/ImportScoreConfig.vue
index 2184e6ce37..a169d69e53 100644
--- a/web/src/enterprise/components/onlineEvals/ImportScoreConfig.vue
+++ b/web/src/enterprise/components/onlineEvals/ImportScoreConfig.vue
@@ -182,10 +182,9 @@ import type { SelectModelValue } from "@/lib/forms/Select/OSelect.types";
 import OSeparator from "@/lib/core/Separator/OSeparator.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
 
-import onlineEvalsService, {
-  type ScoreConfig,
-  type ScoreDataType,
-} from "@/services/online-evals.service";
+import { type ScoreConfig, type ScoreDataType } from "@/services/online-evals.service";
+import { saveScoreConfigMutation } from "@/services/online-evals.service.queries";
+import { useMutation } from "@tanstack/vue-query";
 import {
   prepareScoreConfigImport,
   type ScoreConfigImportError,
@@ -237,6 +236,7 @@ const editorHeights = computed(() => ({
 }));
 
 const orgId = computed(() => props.orgId);
+const saveScoreConfig = useMutation(() => saveScoreConfigMutation(orgId.value));
 
 function goBack() {
   emit("cancel");
@@ -367,7 +367,7 @@ async function importJson({ jsonStr, jsonArray }: { jsonStr: string; jsonArray:
 
   const results = await Promise.allSettled(
     payloads.map((payload) =>
-      onlineEvalsService.scoreConfigs.create(orgId.value, payload).then(
+      saveScoreConfig.mutateAsync({ payload }).then(
         () => ({ status: "success" as const, name: payload.name }),
         (err: any) => {
           if (err?.response?.status === 409) {
diff --git a/web/src/enterprise/components/onlineEvals/ImportScorer.vue b/web/src/enterprise/components/onlineEvals/ImportScorer.vue
index 80afdb5749..c0103dd218 100644
--- a/web/src/enterprise/components/onlineEvals/ImportScorer.vue
+++ b/web/src/enterprise/components/onlineEvals/ImportScorer.vue
@@ -175,12 +175,14 @@ import type { SelectModelValue } from "@/lib/forms/Select/OSelect.types";
 import OSeparator from "@/lib/core/Separator/OSeparator.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
 
-import onlineEvalsService, {
+import {
   type Provider,
   type ScoreConfig,
   type Scorer,
   type ScorerType,
 } from "@/services/online-evals.service";
+import { saveScorerMutation } from "@/services/online-evals.service.queries";
+import { useMutation } from "@tanstack/vue-query";
 import {
   prepareScorerImport,
   type ScorerImportError,
@@ -246,6 +248,7 @@ const editorHeights = computed(() => ({
 }));
 
 const orgId = computed(() => props.orgId);
+const saveScorer = useMutation(() => saveScorerMutation(orgId.value));
 
 function goBack() {
   emit("cancel");
@@ -382,7 +385,7 @@ async function importJson({ jsonStr, jsonArray }: { jsonStr: string; jsonArray:
 
   const results = await Promise.allSettled(
     payloads.map((payload) =>
-      onlineEvalsService.scorers.create(orgId.value, payload as any).then(
+      saveScorer.mutateAsync({ payload }).then(
         () => ({ status: "success" as const, name: payload.name }),
         (err: any) => {
           if (err?.response?.status === 409) {
diff --git a/web/src/enterprise/components/onlineEvals/ScoreConfigLibrary.vue b/web/src/enterprise/components/onlineEvals/ScoreConfigLibrary.vue
index 8320ede716..754053a077 100644
--- a/web/src/enterprise/components/onlineEvals/ScoreConfigLibrary.vue
+++ b/web/src/enterprise/components/onlineEvals/ScoreConfigLibrary.vue
@@ -109,7 +109,8 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
-import onlineEvalsService from "@/services/online-evals.service";
+import { saveScoreConfigMutation } from "@/services/online-evals.service.queries";
+import { useMutation } from "@tanstack/vue-query";
 import {
   fetchOnlineEvalsCatalog,
   type CatalogScoreConfig,
@@ -128,6 +129,8 @@ const emit = defineEmits<{
   (e: "imported"): void;
 }>();
 
+const saveScoreConfig = useMutation(() => saveScoreConfigMutation(props.orgId));
+
 const isLoadingCatalog = ref(false);
 const loadError = ref("");
 const entries = ref<CatalogScoreConfig[]>([]);
@@ -254,7 +257,7 @@ async function importSelected() {
 
   for (const entry of selected) {
     try {
-      await onlineEvalsService.scoreConfigs.create(props.orgId, payloadFor(entry));
+      await saveScoreConfig.mutateAsync({ payload: payloadFor(entry) });
       successCount++;
     } catch (err: any) {
       // Duplicates are not a hard failure — user explicitly asked for the
diff --git a/web/src/enterprise/components/onlineEvals/ScorerLibrary.vue b/web/src/enterprise/components/onlineEvals/ScorerLibrary.vue
index 41dfe0eb85..274154995d 100644
--- a/web/src/enterprise/components/onlineEvals/ScorerLibrary.vue
+++ b/web/src/enterprise/components/onlineEvals/ScorerLibrary.vue
@@ -123,7 +123,12 @@ the Free Software Foundation, either version 3 of the License, or
 </template>
 
 <script setup lang="ts">
-import { scoreConfigsQuery } from "@/services/online-evals.service.queries";
+import {
+  saveScoreConfigMutation,
+  saveScorerMutation,
+  scoreConfigsQuery,
+} from "@/services/online-evals.service.queries";
+import { useMutation } from "@tanstack/vue-query";
 import { queryClient } from "@/composables/query/queryClient";
 import { computed, onMounted, ref, watch } from "vue";
 import { useI18nTyped, raw } from "@/types/i18n";
@@ -134,10 +139,7 @@ import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
-import onlineEvalsService, {
-  type Provider,
-  type ScoreConfig,
-} from "@/services/online-evals.service";
+import { type Provider, type ScoreConfig } from "@/services/online-evals.service";
 import {
   fetchOnlineEvalsCatalog,
   type CatalogScoreConfig,
@@ -160,6 +162,9 @@ const emit = defineEmits<{
   (e: "imported"): void;
 }>();
 
+const saveScorer = useMutation(() => saveScorerMutation(props.orgId));
+const saveScoreConfig = useMutation(() => saveScoreConfigMutation(props.orgId));
+
 const isLoadingCatalog = ref(false);
 const loadError = ref("");
 const scoreConfigEntries = ref<CatalogScoreConfig[]>([]);
@@ -297,10 +302,7 @@ async function importSelected() {
   for (const entry of selected) {
     try {
       const scoreConfig = await resolveRequiredScoreConfig(entry.requiredScoreConfigName);
-      await onlineEvalsService.scorers.create(
-        props.orgId,
-        scorerPayload(entry, entityId(scoreConfig)),
-      );
+      await saveScorer.mutateAsync({ payload: scorerPayload(entry, entityId(scoreConfig)) });
       successCount++;
     } catch (err: any) {
       if (err?.response?.status === 409) {
@@ -340,10 +342,7 @@ async function resolveRequiredScoreConfig(name: string): Promise<ScoreConfig> {
   if (!catalogEntry) throw new Error(t("onlineEvals.catalogScoreConfigNotFound", { name }));
 
   try {
-    return await onlineEvalsService.scoreConfigs.create(
-      props.orgId,
-      scoreConfigPayload(catalogEntry),
-    );
+    return await saveScoreConfig.mutateAsync({ payload: scoreConfigPayload(catalogEntry) });
   } catch (err: any) {
     if (err?.response?.status === 409) {
       const options = scoreConfigsQuery(props.orgId);
diff --git a/web/src/enterprise/components/onlineEvals/composables/useTraceScoreChips.spec.ts b/web/src/enterprise/components/onlineEvals/composables/useTraceScoreChips.spec.ts
index b49024eba3..734f7c72de 100644
--- a/web/src/enterprise/components/onlineEvals/composables/useTraceScoreChips.spec.ts
+++ b/web/src/enterprise/components/onlineEvals/composables/useTraceScoreChips.spec.ts
@@ -28,9 +28,9 @@ vi.mock("vuex", () => ({
   useStore: () => ({ state: { selectedOrganization: { identifier: "acme" } } }),
 }));
 
-const mockListCached = vi.fn();
+const mockListScoreConfigs = vi.fn();
 vi.mock("@/services/online-evals.service", () => ({
-  default: { scoreConfigs: { listCached: (...args: any[]) => mockListCached(...args) } },
+  default: { scoreConfigs: { list: (...args: any[]) => mockListScoreConfigs(...args) } },
 }));
 
 import { beforeEach, describe, expect, it, vi } from "vitest";
@@ -38,7 +38,7 @@ import { useTraceScoreChips } from "./useTraceScoreChips";
 
 beforeEach(() => {
   mockExecuteQueryOnce.mockReset();
-  mockListCached.mockReset();
+  mockListScoreConfigs.mockReset();
 });
 
 describe("useTraceScoreChips", () => {
@@ -53,7 +53,7 @@ describe("useTraceScoreChips", () => {
       },
       { scorer_id: "scorer-2", score_config_id: "cfg-safety", value_boolean: "true" },
     ]);
-    mockListCached.mockResolvedValue([
+    mockListScoreConfigs.mockResolvedValue([
       {
         id: "v1",
         entityId: "cfg-quality",
@@ -89,7 +89,7 @@ describe("useTraceScoreChips", () => {
   // A non-LLM org has no `_llm_scores` stream, so a rejected search must read as "no chips", never an error.
   it("resolves to no chips, never throws, when the score query fails", async () => {
     mockExecuteQueryOnce.mockRejectedValue(new Error("stream [_llm_scores] not found"));
-    mockListCached.mockResolvedValue([]);
+    mockListScoreConfigs.mockResolvedValue([]);
 
     const { chips, load } = useTraceScoreChips();
     await expect(load("trace", "trace-123", 1_000_000)).resolves.toBeUndefined();
@@ -99,7 +99,7 @@ describe("useTraceScoreChips", () => {
 
   it("resolves to no chips, never throws, when the score-config lookup fails", async () => {
     mockExecuteQueryOnce.mockResolvedValue([{ scorer_id: "s1", value_numeric: 1 }]);
-    mockListCached.mockRejectedValue(new Error("network error"));
+    mockListScoreConfigs.mockRejectedValue(new Error("network error"));
 
     const { chips, load } = useTraceScoreChips();
     await load("span", "span-123", 1_000_000);
@@ -143,7 +143,7 @@ describe("useTraceScoreChips", () => {
         _timestamp: 1_700_003_000_000_000,
       },
     ]);
-    mockListCached.mockResolvedValue([
+    mockListScoreConfigs.mockResolvedValue([
       { id: "v1", entityId: "cfg-correctness", name: "Correctness" },
     ]);
 
diff --git a/web/src/enterprise/components/onlineEvals/composables/useTraceScoreChips.ts b/web/src/enterprise/components/onlineEvals/composables/useTraceScoreChips.ts
index d089324369..82da473437 100644
--- a/web/src/enterprise/components/onlineEvals/composables/useTraceScoreChips.ts
+++ b/web/src/enterprise/components/onlineEvals/composables/useTraceScoreChips.ts
@@ -16,7 +16,9 @@
 import { ref } from "vue";
 import { useStore } from "vuex";
 import { useLLMStreamQuery } from "@/plugins/traces/composables/useLLMStreamQuery";
-import onlineEvalsService, { type ScoreConfig } from "@/services/online-evals.service";
+import { type ScoreConfig } from "@/services/online-evals.service";
+import { scoreConfigsQuery } from "@/services/online-evals.service.queries";
+import { queryClient } from "@/composables/query/queryClient";
 import { buildTargetScoresSql, type TraceScoreScope } from "../utils/traceScoreSql";
 
 export interface TraceScoreChip {
@@ -70,7 +72,7 @@ export function useTraceScoreChips() {
           endTimeUs,
           "logs",
         ),
-        onlineEvalsService.scoreConfigs.listCached(orgId).catch(() => [] as ScoreConfig[]),
+        queryClient.fetchQuery(scoreConfigsQuery(orgId)).catch(() => [] as ScoreConfig[]),
       ]);
 
       const configById = new Map<string, ScoreConfig>();
diff --git a/web/src/enterprise/components/onlineEvals/forms/JobFormPage.vue b/web/src/enterprise/components/onlineEvals/forms/JobFormPage.vue
index a8b76dba08..465541da1c 100644
--- a/web/src/enterprise/components/onlineEvals/forms/JobFormPage.vue
+++ b/web/src/enterprise/components/onlineEvals/forms/JobFormPage.vue
@@ -334,11 +334,9 @@ import OFormSelect from "@/lib/forms/Select/OFormSelect.vue";
 import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import useStreams from "@/composables/useStreams";
-import onlineEvalsService, {
-  type EvalJob,
-  type Scorer,
-  type SpanSelector,
-} from "@/services/online-evals.service";
+import { type EvalJob, type Scorer, type SpanSelector } from "@/services/online-evals.service";
+import { saveEvalJobMutation, setJobActiveMutation } from "@/services/online-evals.service.queries";
+import { useMutation } from "@tanstack/vue-query";
 import {
   entityId,
   samplingModeOf,
@@ -401,6 +399,8 @@ const emit = defineEmits<{
 }>();
 
 const { t } = useI18nTyped();
+const saveJob = useMutation(() => saveEvalJobMutation(props.orgId));
+const setJobActive = useMutation(() => setJobActiveMutation(props.orgId));
 
 // Co-located Zod schema (factory keeps messages i18n-driven). The form is
 // mounted fresh per create/edit action, so building it once is safe.
@@ -900,14 +900,14 @@ async function onSubmit(value: JobForm) {
     };
 
     if (props.mode === "edit" && props.row) {
-      await onlineEvalsService.jobs.update(props.orgId, props.row.id, payload);
+      await saveJob.mutateAsync({ id: props.row.id, payload });
       // Promote a draft to active when the user chose Save & Activate. Only
       // drafts surface that button (showActivateChoice), so activateAfter can
       // only be true for a draft here; the isDraft guard is defensive and
       // matches the template (a missing status is treated as draft).
       if (activateAfter && isDraft.value) {
         try {
-          await onlineEvalsService.jobs.activate(props.orgId, props.row.id);
+          await setJobActive.mutateAsync({ id: props.row.id, active: true });
           toast({
             variant: "success",
             message: t("onlineEvals.job.savedAndActivated"),
@@ -926,10 +926,10 @@ async function onSubmit(value: JobForm) {
         });
       }
     } else {
-      const created = await onlineEvalsService.jobs.create(props.orgId, payload);
+      const created = await saveJob.mutateAsync({ payload });
       if (activateAfter && created?.id) {
         try {
-          await onlineEvalsService.jobs.activate(props.orgId, created.id);
+          await setJobActive.mutateAsync({ id: created.id, active: true });
           toast({
             variant: "success",
             message: t("onlineEvals.job.createdAndActivated"),
diff --git a/web/src/enterprise/components/onlineEvals/forms/ScoreConfigDialog.vue b/web/src/enterprise/components/onlineEvals/forms/ScoreConfigDialog.vue
index ac40df8e18..c9042e4e72 100644
--- a/web/src/enterprise/components/onlineEvals/forms/ScoreConfigDialog.vue
+++ b/web/src/enterprise/components/onlineEvals/forms/ScoreConfigDialog.vue
@@ -399,10 +399,9 @@ import type { RadioValue } from "@/lib/forms/Radio/ORadio.types";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
 import { toast } from "@/lib/feedback/Toast/useToast";
-import onlineEvalsService, {
-  type ScoreConfig,
-  type ScoreDataType,
-} from "@/services/online-evals.service";
+import { type ScoreConfig, type ScoreDataType } from "@/services/online-evals.service";
+import { saveScoreConfigMutation } from "@/services/online-evals.service.queries";
+import { useMutation } from "@tanstack/vue-query";
 import { dataTypeOf, entityId, valueOf } from "../utils/evalEntity";
 import { showError } from "../utils/evalFormat";
 import { makeScoreConfigSchema, type ScoreConfigForm } from "./ScoreConfigDialog.schema";
@@ -419,6 +418,7 @@ const emit = defineEmits<{
 }>();
 
 const { t } = useI18nTyped();
+const saveScoreConfig = useMutation(() => saveScoreConfigMutation(props.orgId));
 
 // Drawer open state — starts open (parent mounts this only when creating/editing
 // a score config). Any dismiss path (× / Escape / overlay) flows through
@@ -608,14 +608,11 @@ async function save(value: ScoreConfigForm) {
       healthyThreshold: buildHealthyThreshold(value),
     };
 
-    if (props.mode === "edit" && props.row) {
-      await onlineEvalsService.scoreConfigs.update(props.orgId, entityId(props.row), basePayload);
-    } else {
-      await onlineEvalsService.scoreConfigs.create(props.orgId, {
-        ...basePayload,
-        dataType: value.dataType,
-      });
-    }
+    await saveScoreConfig.mutateAsync(
+      props.mode === "edit" && props.row
+        ? { id: entityId(props.row), payload: basePayload }
+        : { payload: { ...basePayload, dataType: value.dataType } },
+    );
     toast({
       variant: "success",
       message: t("onlineEvals.saved", { label: t("onlineEvals.singular.scoreConfigs") }),
diff --git a/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.schema.ts b/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.schema.ts
index 2ab6d25e07..7a2183b54e 100644
--- a/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.schema.ts
+++ b/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.schema.ts
@@ -53,6 +53,21 @@ export const makeScorerFormSchema = (t: (_key: string) => string) =>
       // ── LLM judge ───────────────────────────────────────────────────────
       providerId: z.string().optional().default(""),
       model: z.string().optional().default(""),
+      // Blank = not sent (the judge runs at temperature 0). A number <input>
+      // emits strings, so validate the text and convert at save.
+      temperature: z
+        .union([z.string(), z.number()])
+        .optional()
+        .default("")
+        .refine(
+          (val) => {
+            const text = String(val ?? "").trim();
+            if (!text) return true;
+            const num = Number(text);
+            return Number.isFinite(num) && num >= 0 && num <= 2;
+          },
+          { message: t("onlineEvals.scorer.validation.temperatureInvalid") },
+        ),
       // Intentionally NOT required: legacy scorers may exist with an empty
       // template, and requiring it here would block re-saving those on edit
       // (create seeds a default template; edit preserves whatever was stored).
diff --git a/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.spec.ts b/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.spec.ts
index 53b2dd533d..be4e09739f 100644
--- a/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.spec.ts
+++ b/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.spec.ts
@@ -157,6 +157,32 @@ describe("ScorerFormPage", () => {
     expect(wrapper.emitted("saved")).toBeTruthy();
   });
 
+  it("sends the judge temperature as a number and omits it when blank", async () => {
+    wrapper = createWrapper();
+    expect(wrapper.find('[data-test="scorer-form-temperature-input"]').exists()).toBe(true);
+    setField(wrapper, "name", "my-scorer");
+    setField(wrapper, "providerId", "p1");
+    setField(wrapper, "temperature", "0.1");
+    await submit(wrapper);
+    const [, payload] = vi.mocked(onlineEvalsService.scorers.create).mock.calls[0];
+    expect(payload.scorer.params).toMatchObject({ temperature: 0.1 });
+
+    setField(wrapper, "temperature", "");
+    await submit(wrapper);
+    const [, blank] = vi.mocked(onlineEvalsService.scorers.create).mock.calls[1];
+    expect(blank.scorer.params).not.toHaveProperty("temperature");
+  });
+
+  it("rejects a temperature outside 0–2", async () => {
+    wrapper = createWrapper();
+    setField(wrapper, "name", "my-scorer");
+    setField(wrapper, "providerId", "p1");
+    setField(wrapper, "temperature", "3");
+    await submit(wrapper);
+    expect(oform(wrapper).form.state.isValid).toBe(false);
+    expect(onlineEvalsService.scorers.create).not.toHaveBeenCalled();
+  });
+
   // A decision model fills no extra fields; its reasoning is the answer summary, so it stays.
   it("drops extra fields but keeps reasoning for a decision-model provider", async () => {
     wrapper = createWrapper();
diff --git a/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.vue b/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.vue
index d37bfab0af..742cdfc06e 100644
--- a/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.vue
+++ b/web/src/enterprise/components/onlineEvals/forms/ScorerFormPage.vue
@@ -179,7 +179,7 @@
                 </div>
               </div>
 
-              <div>
+              <div class="grid grid-cols-[minmax(0,2fr)_minmax(0,1fr)] gap-3">
                 <OFormInput
                   name="model"
                   :label="t('onlineEvals.scorer.modelLabel')"
@@ -187,6 +187,18 @@
                   size="sm"
                   data-test="scorer-form-model-input"
                 />
+                <OFormInput
+                  name="temperature"
+                  :label="t('onlineEvals.scorer.temperatureLabel')"
+                  :placeholder="t('onlineEvals.scorer.temperaturePlaceholder')"
+                  :help-text="t('onlineEvals.scorer.temperatureHelp')"
+                  type="number"
+                  size="sm"
+                  :min="0"
+                  :max="2"
+                  step="0.1"
+                  data-test="scorer-form-temperature-input"
+                />
               </div>
 
               <div>
@@ -713,6 +725,8 @@ import { makeScorerFormSchema, type ScorerForm } from "./ScorerFormPage.schema";
 import EditorDraftDialogs from "@/components/common/drafts/EditorDraftDialogs.vue";
 import { useEditorDraft } from "@/composables/useEditorDraft";
 import { leavesEvalForm } from "../utils/routeSync";
+import { saveScorerMutation } from "@/services/online-evals.service.queries";
+import { useMutation } from "@tanstack/vue-query";
 
 const props = defineProps<{
   orgId: string;
@@ -735,6 +749,7 @@ const emit = defineEmits<{
 }>();
 
 const { t } = useI18nTyped();
+const saveScorer = useMutation(() => saveScorerMutation(props.orgId));
 
 // Co-located Zod schema (factory keeps messages i18n-driven). The form is
 // mounted fresh for each create/edit action, so building it once is safe.
@@ -802,6 +817,7 @@ function buildScorerTestPayload() {
         params: {
           provider_id: formValues.value.providerId,
           ...(formValues.value.model.trim() ? { model: formValues.value.model.trim() } : {}),
+          ...temperatureParam(formValues.value.temperature),
           include_reasoning: formValues.value.includeReasoning,
           ...(cleanedExtraFields.value.length
             ? { extra_metadata_fields: cleanedExtraFields.value }
@@ -1183,6 +1199,12 @@ function readCustomHeaders(rawHeaders: any): CustomHeader[] {
     .map((h) => ({ key: String(h.key || ""), value: String(h.value || "") }));
 }
 
+/** `{ temperature }` when the field holds a number, else nothing (judge default). */
+function temperatureParam(raw: string | number | undefined): { temperature?: number } {
+  const text = String(raw ?? "").trim();
+  return text ? { temperature: Number(text) } : {};
+}
+
 function initForm(row: Scorer | null, scorerType: ScorerType): ScorerForm {
   if (!row) {
     return {
@@ -1194,6 +1216,7 @@ function initForm(row: Scorer | null, scorerType: ScorerType): ScorerForm {
       pinScoreConfigVersion: false,
       providerId: "",
       model: "",
+      temperature: "",
       remoteEndpoint: "",
       template: "Evaluate {{ input }} and {{ output }}.",
       includeReasoning: true,
@@ -1231,6 +1254,7 @@ function initForm(row: Scorer | null, scorerType: ScorerType): ScorerForm {
     ),
     providerId: String(row.params?.provider_id || ""),
     model: String(row.params?.model || ""),
+    temperature: typeof row.params?.temperature === "number" ? String(row.params.temperature) : "",
     remoteEndpoint: String(row.params?.endpoint || ""),
     template: row.template || "",
     includeReasoning: row.params?.include_reasoning !== false,
@@ -1313,6 +1337,7 @@ async function save(value: ScorerForm) {
           params: {
             provider_id: value.providerId,
             ...(value.model.trim() ? { model: value.model.trim() } : {}),
+            ...temperatureParam(value.temperature),
             include_reasoning: value.includeReasoning,
             ...(extraFields.length ? { extra_metadata_fields: extraFields } : {}),
           },
@@ -1324,19 +1349,14 @@ async function save(value: ScorerForm) {
           params: buildRemoteParams(value),
         };
 
-    if (props.mode === "edit" && props.row) {
-      await onlineEvalsService.scorers.update(props.orgId, entityId(props.row), {
+    await saveScorer.mutateAsync({
+      id: props.mode === "edit" && props.row ? entityId(props.row) : undefined,
+      payload: {
         name: value.name.trim(),
         description: value.description?.trim() || null,
         scorer: scorerPayload,
-      });
-    } else {
-      await onlineEvalsService.scorers.create(props.orgId, {
-        name: value.name.trim(),
-        description: value.description?.trim() || null,
-        scorer: scorerPayload,
-      });
-    }
+      },
+    });
     toast({
       variant: "success",
       message: t("onlineEvals.saved", { label: t("onlineEvals.singular.scorers") }),
diff --git a/web/src/enterprise/composables/useAgentScope.spec.ts b/web/src/enterprise/composables/useAgentScope.spec.ts
index d85451c79c..d910188e07 100644
--- a/web/src/enterprise/composables/useAgentScope.spec.ts
+++ b/web/src/enterprise/composables/useAgentScope.spec.ts
@@ -16,6 +16,7 @@
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { ref } from "vue";
 import type { Ref } from "vue";
+import type { LocationQuery } from "vue-router";
 import type { GenAiAgentListItem } from "@/services/gen-ai-agent-mapping.service";
 import { ALL_AGENTS_VALUE } from "@/enterprise/components/onlineEvals/utils/agentFilterSql";
 import { agentOptionKey } from "@/plugins/traces/llmAgentFilter";
@@ -30,7 +31,14 @@ vi.mock("@/services/gen-ai-agent-mapping.service", async (importOriginal) => {
   };
 });
 
-import { useAgentScope, UNSET } from "./useAgentScope";
+import {
+  useAgentScope,
+  resolveScopeMode,
+  UNSET,
+  scopeUrlQuery,
+  readUrlScope,
+  explicitScopeMode,
+} from "./useAgentScope";
 
 const t = (k: string) => k;
 
@@ -188,6 +196,196 @@ describe("useAgentScope — Shape 1 (allAgents:true, Sessions/LLM)", () => {
     expect(scope.activeAgent.value).toBe(ALL_AGENTS_VALUE);
     expect(scope.agentsLoaded.value).toBe(true);
   });
+
+  it("a failed load is an error, not 'no agents': no empty state, no identity banner", async () => {
+    const filterMode = ref<"stream" | "agent">("stream");
+    const scope = useAgentScope({
+      filterMode,
+      activeStream: ref("stream_a"),
+      availableStreams: ref(["stream_a"]),
+      orgId: () => "org1",
+      getWindow: () => ({ start: 100, end: 200 }),
+      allAgents: true,
+      t,
+    });
+    listAgents.mockRejectedValue(
+      Object.assign(new Error("boom"), { isAxiosError: true, response: { status: 500 } }),
+    );
+    await scope.loadAgents();
+    expect(scope.agentsError.value).toBe("failed");
+    expect(scope.noAgentIdentity.value).toBe(false);
+    filterMode.value = "agent";
+    expect(scope.agentEmpty.value).toBe(false);
+    expect(scope.agentsLoadFailed.value).toBe(true);
+
+    // A load that succeeds clears the error; an empty list is then "no agents".
+    listAgents.mockResolvedValue({ agents: [] });
+    await scope.loadAgents(undefined, undefined, true);
+    expect(scope.agentsError.value).toBeNull();
+    expect(scope.agentsLoadFailed.value).toBe(false);
+    expect(scope.agentEmpty.value).toBe(true);
+    filterMode.value = "stream";
+    expect(scope.noAgentIdentity.value).toBe(true);
+  });
+
+  it("a 403 is reported as forbidden", async () => {
+    const { scope } = makeScope(ref("agent"), ref(""));
+    listAgents.mockRejectedValue(
+      Object.assign(new Error("Forbidden"), { isAxiosError: true, response: { status: 403 } }),
+    );
+    await scope.loadAgents();
+    expect(scope.agentsError.value).toBe("forbidden");
+  });
+
+  it("drops an agents response or failure that lands after the org changed", async () => {
+    const org = ref("org-switch-old");
+    const agents = ref<GenAiAgentListItem[]>([]);
+    const agentsLoaded = ref(false);
+    const scope = useAgentScope({
+      filterMode: ref("agent"),
+      activeStream: ref(""),
+      orgId: () => org.value,
+      getWindow: () => ({ start: 100, end: 200 }),
+      allAgents: true,
+      agents,
+      agentsLoaded,
+      t,
+    });
+    const ok = Promise.withResolvers<unknown>();
+    listAgents.mockReturnValue(ok.promise);
+    const pending = scope.loadAgents();
+    org.value = "org-switch-new";
+    ok.resolve({ agents: [agentA] });
+    await pending;
+    expect(agents.value).toEqual([]);
+    expect(agentsLoaded.value).toBe(false);
+
+    // The error path is dropped the same way.
+    org.value = "org-switch-old-2";
+    const fail = Promise.withResolvers<unknown>();
+    listAgents.mockReturnValue(fail.promise);
+    agents.value = [agentB];
+    const failing = scope.loadAgents();
+    org.value = "org-switch-new";
+    fail.reject(
+      Object.assign(new Error("Forbidden"), { isAxiosError: true, response: { status: 403 } }),
+    );
+    await failing;
+    expect(agents.value).toEqual([agentB]);
+    expect(scope.agentsError.value).toBeNull();
+    expect(agentsLoaded.value).toBe(false);
+  });
+
+  it.each(["success", "failure"])(
+    "keeps the newer window after an older request finishes with %s",
+    async (outcome) => {
+      const scope = useAgentScope({
+        filterMode: ref("agent"),
+        activeStream: ref(""),
+        orgId: () => `window-race-${outcome}`,
+        getWindow: () => ({ start: 60_000_000, end: 120_000_000 }),
+        allAgents: true,
+        t,
+      });
+      const old = Promise.withResolvers<{ agents: GenAiAgentListItem[] }>();
+      const latest = Promise.withResolvers<{ agents: GenAiAgentListItem[] }>();
+      listAgents.mockReturnValueOnce(old.promise).mockReturnValueOnce(latest.promise);
+      const oldLoad = scope.loadAgents();
+      const latestLoad = scope.loadAgents(180_000_000, 240_000_000);
+      await vi.waitFor(() => expect(listAgents).toHaveBeenCalledTimes(2));
+      latest.resolve({ agents: [agentB] });
+      await latestLoad;
+      if (outcome === "success") old.resolve({ agents: [agentA] });
+      else old.reject(new Error("old window failed"));
+      await oldLoad;
+      expect(scope.agents.value).toEqual([agentB]);
+      expect(scope.agentsError.value).toBeNull();
+      expect(scope.agentsLoaded.value).toBe(true);
+    },
+  );
+
+  it("refreshes after an in-flight cached load rather than reusing its response", async () => {
+    const scope = useAgentScope({
+      filterMode: ref("agent"),
+      activeStream: ref(""),
+      orgId: () => "forced-load-after-entry",
+      getWindow: () => ({ start: 60_000_000, end: 120_000_000 }),
+      allAgents: true,
+      t,
+    });
+    const entry = Promise.withResolvers<{ agents: GenAiAgentListItem[] }>();
+    listAgents.mockReturnValueOnce(entry.promise).mockResolvedValueOnce({ agents: [agentB] });
+    const initialLoad = scope.loadAgents();
+    await vi.waitFor(() => expect(listAgents).toHaveBeenCalledTimes(1));
+    const refresh = scope.loadAgents(undefined, undefined, true);
+    entry.resolve({ agents: [agentA] });
+    await Promise.all([initialLoad, refresh]);
+    expect(listAgents).toHaveBeenCalledTimes(2);
+    expect(scope.agents.value).toEqual([agentB]);
+  });
+
+  it("the starter and joiners of a load wait for a forced refresh started after them", async () => {
+    const scope = useAgentScope({
+      filterMode: ref("agent"),
+      activeStream: ref(""),
+      orgId: () => "joiner-waits-for-forced",
+      getWindow: () => ({ start: 60_000_000, end: 120_000_000 }),
+      allAgents: true,
+      t,
+    });
+    const entry = Promise.withResolvers<{ agents: GenAiAgentListItem[] }>();
+    const forced = Promise.withResolvers<{ agents: GenAiAgentListItem[] }>();
+    listAgents.mockReturnValueOnce(entry.promise).mockReturnValueOnce(forced.promise);
+    const seen: Record<string, GenAiAgentListItem[]> = {};
+    const starter = scope.loadAgents().then(() => {
+      seen.starter = scope.agents.value;
+    });
+    await vi.waitFor(() => expect(listAgents).toHaveBeenCalledTimes(1));
+    const joiner = scope.loadAgents().then(() => {
+      seen.joiner = scope.agents.value;
+    });
+    const refresh = scope.loadAgents(undefined, undefined, true);
+    entry.resolve({ agents: [agentA] });
+    await vi.waitFor(() => expect(listAgents).toHaveBeenCalledTimes(2));
+    expect(seen).toEqual({});
+    forced.resolve({ agents: [agentB] });
+    await Promise.all([starter, joiner, refresh]);
+    expect(seen).toEqual({ starter: [agentB], joiner: [agentB] });
+  });
+});
+
+describe("resolveScopeMode", () => {
+  it("an explicit choice wins; else agents decide; a failed load never picks Stream", () => {
+    expect(resolveScopeMode("stream", 3)).toBe("stream");
+    expect(resolveScopeMode(null, 3)).toBe("agent");
+    expect(resolveScopeMode(null, 0)).toBe("stream");
+    expect(resolveScopeMode(null, 0, "failed")).toBe("agent");
+    expect(resolveScopeMode(null, 0, "forbidden")).toBe("agent");
+    expect(resolveScopeMode("stream", 0, "failed")).toBe("stream");
+  });
+});
+
+describe("scopeUrlQuery", () => {
+  const agent = { name: "support-bot", env: "prod", version: "v2" };
+
+  beforeEach(() => localStorage.clear());
+
+  it("leaves an auto-picked agent out of the URL, so a reload with no agents ends in Stream", () => {
+    const query = scopeUrlQuery(
+      { from: "1" },
+      { mode: "agent", explicit: false, stream: "", agent },
+    );
+    expect(query).toEqual({ from: "1" });
+    const reloaded = readUrlScope(query as LocationQuery);
+    expect(resolveScopeMode(explicitScopeMode(reloaded), 0)).toBe("stream");
+  });
+
+  it("writes an explicit agent scope, which a reload keeps", () => {
+    const query = scopeUrlQuery({}, { mode: "agent", explicit: true, stream: "", agent });
+    expect(query).toEqual({ type: "agent", agent: "support-bot", env: "prod", version: "v2" });
+    const reloaded = readUrlScope(query as LocationQuery);
+    expect(resolveScopeMode(explicitScopeMode(reloaded), 0)).toBe("agent");
+  });
 });
 
 describe("useAgentScope — Shape 2 (allAgents:false, Graph/Behavior)", () => {
@@ -541,7 +739,7 @@ describe("useAgentScope — cascade with the All option (Quality)", () => {
 });
 
 describe("useAgentScope — stream options", () => {
-  it("streamSelectOptions + selectedStreamCount reflect availableStreams and agent counts", async () => {
+  it("counts each stream's distinct agent names, as the Agent picker lists them", async () => {
     const activeStream = ref("stream_a");
     const availableStreams = ref<string[]>(["stream_a", "stream_b"]);
     const scope = useAgentScope({
@@ -553,7 +751,10 @@ describe("useAgentScope — stream options", () => {
       allAgents: true,
       t,
     });
-    listAgents.mockResolvedValue({ agents: [agentA, agentA] });
+    // The same agent seen with and without an id, plus a second agent.
+    listAgents.mockResolvedValue({
+      agents: [agentA, { ...agentA, id: null }, { ...agentA, name: "gamma", id: "g1" }],
+    });
     await scope.loadAgents();
     const streamA = scope.streamSelectOptions.value.find((o: any) => o.value === "stream_a");
     expect(streamA?.agentCount).toBe(2);
diff --git a/web/src/enterprise/composables/useAgentScope.ts b/web/src/enterprise/composables/useAgentScope.ts
index a329ad1330..ff24cdf263 100644
--- a/web/src/enterprise/composables/useAgentScope.ts
+++ b/web/src/enterprise/composables/useAgentScope.ts
@@ -26,10 +26,12 @@
 import { raw } from "@/types/i18n";
 
 import { computed, ref, watch } from "vue";
+import { isAxiosError } from "axios";
+import type { LocationQuery, LocationQueryRaw } from "vue-router";
 import type { ComputedRef, Ref } from "vue";
 import type { GenAiAgentListItem } from "@/services/gen-ai-agent-mapping.service";
 import { genAiAgentsQuery } from "@/services/gen-ai-agent-mapping.queries";
-import { queryClient } from "@/composables/query/queryClient";
+import { queryClient, quantizeRange } from "@/composables/query/queryClient";
 import type { SelectOption } from "@/lib/forms/Select/OSelect.types";
 import {
   buildAgentSelectOptions,
@@ -45,6 +47,113 @@ import { agentOptionKey, ALL_AGENTS_VALUE } from "@/plugins/traces/llmAgentFilte
  */
 export const UNSET = "__unset__";
 
+export type ScopeMode = "stream" | "agent";
+
+/**
+ * The Stream/Agent choice a user made with the toggle, shared by the four
+ * Monitor pages (Insights, Sessions, Agent Graph, Agent Behavior). Written only
+ * by the toggle, never by a page load, so an absent key means "never chose" and
+ * the page picks its mode from the agents list instead.
+ */
+export const SCOPE_MODE_CHOICE_LS_KEY = "aiObservability_scopeModeChoice";
+
+/** Scope carried in a Monitor page URL: `?type=&stream=&agent=&env=&version=`. */
+export interface UrlScope {
+  type: ScopeMode | null;
+  stream: string;
+  agent: string;
+  env: string;
+  version: string;
+}
+
+export function readUrlScope(query: LocationQuery): UrlScope {
+  const str = (v: unknown) => (typeof v === "string" ? v : "");
+  const type = str(query.type);
+  return {
+    type: type === "stream" || type === "agent" ? type : null,
+    stream: str(query.stream),
+    agent: str(query.agent),
+    env: str(query.env),
+    version: str(query.version),
+  };
+}
+
+export function rememberModeChoice(mode: ScopeMode): void {
+  localStorage.setItem(SCOPE_MODE_CHOICE_LS_KEY, mode);
+}
+
+/**
+ * The mode the user asked for, or null when the agents list should decide: the
+ * URL `type` (any agent/env/version scope also means Agent), else the remembered
+ * toggle choice.
+ */
+export function explicitScopeMode(url: UrlScope): ScopeMode | null {
+  if (url.type) return url.type;
+  if (url.agent || url.env || url.version) return "agent";
+  const remembered = localStorage.getItem(SCOPE_MODE_CHOICE_LS_KEY);
+  return remembered === "stream" || remembered === "agent" ? remembered : null;
+}
+
+/** Why the last agents load failed: a 403 (`forbidden`) or any other error (`failed`). */
+export type AgentsLoadError = "forbidden" | "failed";
+
+/**
+ * Final mode for a page: an explicit choice wins; otherwise Agent when the
+ * window has agents and Stream when it has none, so LLM data without agent
+ * identity still opens on something to look at. A failed agents load says
+ * nothing about agent identity, so it never picks Stream: the page stays on
+ * Agent, where the load error and its retry show. Pages re-decide after a
+ * load that succeeds.
+ */
+export function resolveScopeMode(
+  explicit: ScopeMode | null,
+  agentCount: number,
+  agentsError: AgentsLoadError | null = null,
+): ScopeMode {
+  if (explicit) return explicit;
+  if (agentsError) return "agent";
+  return agentCount > 0 ? "agent" : "stream";
+}
+
+/**
+ * The page query with the scope written in. `type` and the agent
+ * (`agent`/`env`/`version`) are written only when the scope was explicit (URL,
+ * toggle or agent pick): an auto-picked scope left in the URL would read as a
+ * choice on reload and stop the page from re-deciding once agents change.
+ */
+export function scopeUrlQuery(
+  current: LocationQuery,
+  scope: {
+    mode: ScopeMode;
+    explicit: boolean;
+    stream: string;
+    agent?: { name: string; env: string; version: string } | null;
+  },
+): LocationQueryRaw {
+  const query: LocationQueryRaw = { ...current };
+  if (scope.explicit) query.type = scope.mode;
+  else delete query.type;
+  delete query.agent;
+  delete query.env;
+  delete query.version;
+  delete query.stream;
+  if (scope.mode === "agent") {
+    if (scope.explicit && scope.agent?.name) {
+      query.agent = scope.agent.name;
+      query.env = scope.agent.env;
+      query.version = scope.agent.version;
+    }
+  } else if (scope.stream) {
+    query.stream = scope.stream;
+  }
+  return query;
+}
+
+/** Stream-scoped identity of a resolved agent ("" for none) — what a page reloads on. */
+export function agentIdentityKey(a: GenAiAgentListItem | null): string {
+  return a ? `${a.source_stream}::${a.name}::${a.env ?? ""}::${a.version ?? ""}` : "";
+}
+
 /** Cascade env of an agent: its `env`, or the UNSET sentinel when null/absent. */
 function agentEnv(a: GenAiAgentListItem): string {
   return a.env ?? UNSET;
@@ -93,6 +202,8 @@ export interface UseAgentScopeOptions {
   agents?: Ref<GenAiAgentListItem[]>;
   /** Module-scoped agentsLoaded ref, created locally when omitted. */
   agentsLoaded?: Ref<boolean>;
+  /** Module-scoped agents load error ref, created locally when omitted. */
+  agentsError?: Ref<AgentsLoadError | null>;
   /**
    * The single selection ref. When provided (Sessions injects its
    * localStorage-initialized ref), it is used as-is so the page owns
@@ -108,7 +219,16 @@ export interface UseAgentScopeOptions {
 export interface UseAgentScopeReturn {
   agents: Ref<GenAiAgentListItem[]>;
   agentsLoaded: Ref<boolean>;
-  loadAgents: (start?: number, end?: number) => Promise<void>;
+  /**
+   * Why the last agents load failed, or null after a load that succeeded. A
+   * failed load leaves `agents` empty but is not "no agents": `agentEmpty` and
+   * `noAgentIdentity` stay false and the page shows the error with a retry.
+   */
+  agentsError: Ref<AgentsLoadError | null>;
+  /** Agent mode and the last agents load failed. */
+  agentsLoadFailed: ComputedRef<boolean>;
+  /** Loads the agents for the window; `force` (a user refresh) bypasses the query cache. */
+  loadAgents: (start?: number, end?: number, force?: boolean) => Promise<void>;
   /** The single selection ref. All-Agents shape defaults to ALL_AGENTS_VALUE. */
   activeAgent: Ref<string>;
   agentSelectOptions: ComputedRef<SelectOption[]>;
@@ -119,6 +239,8 @@ export interface UseAgentScopeReturn {
   effectiveAgent: ComputedRef<GenAiAgentListItem | null>;
   agentFilterClause: ComputedRef<string>;
   agentEmpty: ComputedRef<boolean>;
+  /** Stream mode, agents loaded and none found while an LLM stream exists. */
+  noAgentIdentity: ComputedRef<boolean>;
   // ── Env→Agent→Version cascade (Plan 2) ──────────────────────────────────
   /** Distinct env options across all agents (null → UNSET), in first-seen order. */
   envs: ComputedRef<SelectOption[]>;
@@ -141,12 +263,11 @@ export interface UseAgentScopeReturn {
    */
   selectAgentByName: (name: string) => boolean;
   /**
-   * Seed the cascade from an exact (env, name, version) triple — the fuller
-   * restore path when all three dimensions were persisted, so a same-named
-   * agent under a different env/version doesn't get picked by mistake. Falls
-   * back to `selectAgentByName` (first match by name) when no agent matches
-   * the exact triple, e.g. the persisted version no longer exists for this
-   * window. Returns true when either resolved.
+   * Seed the cascade from an (env, name, version) scope — a URL deep-link or a
+   * persisted selection. Any of the three may be "" (not given). Picks the agent
+   * matching every given dimension, else drops version, else matches the name
+   * alone, so a same-named agent under a different env/version is only the
+   * fallback. Returns true when an agent was selected.
    */
   selectAgentByScope: (env: string, name: string, version: string) => boolean;
 }
@@ -160,6 +281,7 @@ export function useAgentScope(opts: UseAgentScopeOptions): UseAgentScopeReturn {
   // whichever pair is in play.
   const agents = opts.agents ?? ref<GenAiAgentListItem[]>([]);
   const agentsLoaded = opts.agentsLoaded ?? ref(false);
+  const agentsError = opts.agentsError ?? ref<AgentsLoadError | null>(null);
   const availableStreams = opts.availableStreams ?? ref<string[]>([]);
 
   // Hazard 1 — sentinel split: the All-Agents shape starts on the sentinel;
@@ -223,18 +345,25 @@ export function useAgentScope(opts: UseAgentScopeOptions): UseAgentScopeReturn {
       : [],
   );
 
-  const agentNames = computed<SelectOption[]>(() =>
-    cascade
-      ? withAll(
-          distinctOptions(
-            agents.value
-              .filter((a) => levelMatches(selectedEnv.value, agentEnv(a)))
-              .map((a) => a.name),
-          ),
-          "traces.allAgents",
-        )
-      : [],
-  );
+  // Each name option carries the agent ids behind it (`agentIds`, shown on hover
+  // by AgentScopeCascade and under the name in the list) so a name never hides
+  // which registered agent it is, and an id typed in the search still finds it.
+  const agentNames = computed<SelectOption[]>(() => {
+    if (!cascade) return [];
+    const inEnv = agents.value.filter((a) => levelMatches(selectedEnv.value, agentEnv(a)));
+    const idsByName = new Map<string, string[]>();
+    for (const a of inEnv) {
+      if (!a.id || a.id === a.name) continue;
+      const ids = idsByName.get(a.name) ?? [];
+      if (!ids.includes(a.id)) ids.push(a.id);
+      idsByName.set(a.name, ids);
+    }
+    const options = distinctOptions(inEnv.map((a) => a.name)).map((o) => {
+      const ids = idsByName.get(o.value as string);
+      return ids ? { ...o, agentIds: ids, subLabel: ids.join(", "), searchText: ids.join(" ") } : o;
+    });
+    return withAll(options, "traces.allAgents");
+  });
 
   const versions = computed<SelectOption[]>(() =>
     cascade
@@ -303,15 +432,24 @@ export function useAgentScope(opts: UseAgentScopeOptions): UseAgentScopeReturn {
     return true;
   }
 
+  // Any of the three may be "" (not given, e.g. an `?env=production` link with no
+  // agent). Tries the exact given dimensions first, then drops version, then
+  // keeps only the name, so a link whose version or env is gone for this window
+  // still lands on the named agent rather than on the first one in the list.
   function selectAgentByScope(env: string, name: string, version: string): boolean {
-    if (!cascade) return false;
-    const exact = agents.value.find(
-      (a) => agentEnv(a) === env && a.name === name && agentVersion(a) === version,
-    );
-    if (!exact) return selectAgentByName(name);
-    selectedEnv.value = env;
-    selectedAgentName.value = name;
-    selectedVersion.value = version;
+    if (!cascade || (!env && !name && !version)) return false;
+    const envOk = (a: GenAiAgentListItem) => !env || agentEnv(a) === env;
+    const nameOk = (a: GenAiAgentListItem) => !name || a.name === name;
+    const match =
+      agents.value.find(
+        (a) => envOk(a) && nameOk(a) && (!version || agentVersion(a) === version),
+      ) ??
+      agents.value.find((a) => envOk(a) && nameOk(a)) ??
+      (name ? agents.value.find((a) => a.name === name) : undefined);
+    if (!match) return false;
+    selectedEnv.value = agentEnv(match);
+    selectedAgentName.value = match.name;
+    selectedVersion.value = agentVersion(match);
     return true;
   }
 
@@ -369,43 +507,105 @@ export function useAgentScope(opts: UseAgentScopeOptions): UseAgentScopeReturn {
   );
 
   const agentEmpty = computed(
-    () => opts.filterMode.value === "agent" && agentsLoaded.value && agents.value.length === 0,
+    () =>
+      opts.filterMode.value === "agent" &&
+      agentsLoaded.value &&
+      !agentsError.value &&
+      agents.value.length === 0,
   );
 
-  async function loadAgents(start?: number, end?: number): Promise<void> {
+  const agentsLoadFailed = computed(
+    () => opts.filterMode.value === "agent" && agentsError.value !== null,
+  );
+
+  // Stream mode on an org whose LLM streams carry no agent identity: the page
+  // shows the "No agent identity found" banner pointing at GenAI Agent Mapping.
+  // A failed agents load proves nothing about identity, so it never shows it.
+  const noAgentIdentity = computed(
+    () =>
+      opts.filterMode.value === "stream" &&
+      agentsLoaded.value &&
+      !agentsError.value &&
+      agents.value.length === 0 &&
+      availableStreams.value.length > 0,
+  );
+
+  // The one agents loader for every Monitor page. Calls for the same org and
+  // minute bucket (the query key's own quantization) while a request is in
+  // flight join it, so the several callers on page entry (date replay, mode
+  // resolution) cost one request. A forced refresh waits for any request for
+  // the same key, then invalidates and fetches again rather than reusing it.
+  // Every caller, including the one that started a request, resolves only once
+  // the latest request for its key settles, so a forced refresh started
+  // meanwhile lands before the caller decides anything from the list.
+  let inFlight: { key: string; promise: Promise<void> } | null = null;
+  let requestSequence = 0;
+  async function joinLatest(key: string): Promise<void> {
+    for (let current = inFlight; current?.key === key; current = inFlight) {
+      await current.promise;
+    }
+  }
+  async function loadAgents(start?: number, end?: number, force = false): Promise<void> {
     const org = opts.orgId();
     const win = opts.getWindow();
     const startTime = start ?? win.start;
     const endTime = end ?? win.end;
     if (!org || !startTime || !endTime) return;
-    agentsLoaded.value = false;
-    try {
-      const res = await queryClient.fetchQuery(genAiAgentsQuery(org, startTime, endTime));
-      agents.value = res.agents ?? [];
-      if (allAgents) {
-        // Sentinel shape: keep All-Agents; only clamp a now-invalid selection.
-        if (
-          activeAgent.value !== ALL_AGENTS_VALUE &&
-          !agents.value.some((a) => agentOptionKey(a) === activeAgent.value)
-        ) {
-          activeAgent.value = ALL_AGENTS_VALUE;
+    const bucket = quantizeRange(startTime, endTime);
+    const key = `${org}::${bucket.start}-${bucket.end}`;
+    const previous = inFlight?.key === key ? inFlight.promise : null;
+    if (!force && previous) return joinLatest(key);
+    const sequence = ++requestSequence;
+    // Only the latest window/org request owns the visible list and load state.
+    const superseded = () => sequence !== requestSequence || opts.orgId() !== org;
+    const promise = (async () => {
+      try {
+        if (force && previous) await previous;
+        const options = genAiAgentsQuery(org, startTime, endTime);
+        if (force) {
+          await queryClient.invalidateQueries({
+            queryKey: options.queryKey,
+            exact: true,
+            refetchType: "none",
+          });
         }
-      } else if (!activeAgent.value && agents.value.length) {
-        // First-agent shape: default to the first agent when nothing selected.
-        activeAgent.value = agentOptionKey(agents.value[0]);
+        const res = await queryClient.fetchQuery(options);
+        if (superseded()) return;
+        agents.value = res.agents ?? [];
+        agentsError.value = null;
+        if (allAgents) {
+          // Sentinel shape: keep All-Agents; only clamp a now-invalid selection.
+          if (
+            activeAgent.value !== ALL_AGENTS_VALUE &&
+            !agents.value.some((a) => agentOptionKey(a) === activeAgent.value)
+          ) {
+            activeAgent.value = ALL_AGENTS_VALUE;
+          }
+        } else if (!activeAgent.value && agents.value.length) {
+          // First-agent shape: default to the first agent when nothing selected.
+          activeAgent.value = agentOptionKey(agents.value[0]);
+        }
+      } catch (e) {
+        if (superseded()) return;
+        console.warn("Failed to load GenAI agents", e);
+        agents.value = [];
+        agentsError.value = isAxiosError(e) && e.response?.status === 403 ? "forbidden" : "failed";
+        if (allAgents) activeAgent.value = ALL_AGENTS_VALUE;
+      } finally {
+        if (!superseded()) agentsLoaded.value = true;
       }
-    } catch (e) {
-      console.warn("Failed to load GenAI agents", e);
-      agents.value = [];
-      if (allAgents) activeAgent.value = ALL_AGENTS_VALUE;
-    } finally {
-      agentsLoaded.value = true;
-    }
+    })().finally(() => {
+      if (inFlight?.promise === promise) inFlight = null;
+    });
+    inFlight = { key, promise };
+    return promise.then(() => joinLatest(key));
   }
 
   return {
     agents,
     agentsLoaded,
+    agentsError,
+    agentsLoadFailed,
     loadAgents,
     activeAgent,
     agentSelectOptions,
@@ -416,6 +616,7 @@ export function useAgentScope(opts: UseAgentScopeOptions): UseAgentScopeReturn {
     effectiveAgent,
     agentFilterClause,
     agentEmpty,
+    noAgentIdentity,
     envs,
     agentNames,
     versions,
diff --git a/web/src/enterprise/views/AIObservability/AgentBehaviorPage.spec.ts b/web/src/enterprise/views/AIObservability/AgentBehaviorPage.spec.ts
new file mode 100644
index 0000000000..e1610a0cb2
--- /dev/null
+++ b/web/src/enterprise/views/AIObservability/AgentBehaviorPage.spec.ts
@@ -0,0 +1,181 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// @vitest-environment jsdom
+//
+// Scope resolution on the Agent Behavior page: the URL's agent/env/version win
+// over the first-agent default, an org with LLM spans but no agent identity
+// opens in Stream mode with the no-agent-identity banner, and a new date window
+// settles the scope again.
+
+import { ref } from "vue";
+
+const mockListAgents = vi.fn();
+const mockGetStreams = vi.fn();
+const mockRouteQuery: Record<string, string> = {};
+const mockRouterReplace = vi.fn(() => Promise.resolve());
+const mockTimeRange = ref({ startTime: 1_700_000_000_000_000, endTime: 1_700_000_900_000_000 });
+
+vi.mock("@/services/gen-ai-agent-mapping.service", () => ({
+  default: { listAgents: (...args: any[]) => mockListAgents(...args) },
+}));
+
+vi.mock("@/composables/useStreams", () => ({
+  default: () => ({ getStreams: (...args: any[]) => mockGetStreams(...args) }),
+}));
+
+vi.mock("vue-router", () => ({
+  useRoute: () => ({ query: mockRouteQuery }),
+  useRouter: () => ({ replace: mockRouterReplace }),
+}));
+
+vi.mock("vuex", () => ({
+  useStore: () => ({ state: { selectedOrganization: { identifier: "test-org" } } }),
+}));
+
+vi.mock("vue-i18n", () => ({
+  useI18n: () => ({ t: (key: string) => key }),
+}));
+
+vi.mock("@/enterprise/composables/useAiDateController", () => ({
+  useAiDateController: () => ({
+    dateState: ref({ valueType: "relative", relativeTimePeriod: "15m" }),
+    timeRange: mockTimeRange,
+    applyRelative: vi.fn(),
+    onDateChange: vi.fn(),
+    mountResolve: vi.fn(),
+    DEFAULT_RELATIVE: "15m",
+  }),
+}));
+
+vi.mock("@/enterprise/composables/useChildRefresh", () => ({
+  useChildRefresh: () => ({ lastRunAt: ref(null), isLoading: ref(false), refresh: vi.fn() }),
+}));
+
+vi.mock("@/enterprise/components/AIObservability/AiPageShell.vue", () => ({
+  default: { name: "AiPageShell", template: `<div><slot name="subnav" /><slot /></div>` },
+}));
+
+vi.mock("@/enterprise/components/AIObservability/AiScopeBar.vue", () => ({
+  default: { name: "AiScopeBar", template: `<div />` },
+}));
+
+vi.mock("@/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue", () => ({
+  default: { name: "AiNoAgentIdentityBanner", template: `<div />` },
+}));
+
+vi.mock("./AgentBehaviorPanel.vue", () => ({
+  default: {
+    name: "AgentBehaviorPanel",
+    props: ["sourceStream", "agentFilter", "agentEnv", "agentVersion", "scopeReady"],
+    template: `<div />`,
+  },
+}));
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { mount, flushPromises, enableAutoUnmount } from "@vue/test-utils";
+import { afterEach } from "vitest";
+import AgentBehaviorPage from "./AgentBehaviorPage.vue";
+import { queryClient } from "@/composables/query/queryClient";
+
+enableAutoUnmount(afterEach);
+
+const at = (name: string, stream: string, env: string, version: string) => ({
+  name,
+  id: `id-${name}-${env}`,
+  source_stream: stream,
+  source_stream_type: "traces",
+  env,
+  version,
+});
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  localStorage.clear();
+  queryClient.clear();
+  for (const k of Object.keys(mockRouteQuery)) delete mockRouteQuery[k];
+  mockTimeRange.value = { startTime: 1_700_000_000_000_000, endTime: 1_700_000_900_000_000 };
+  mockGetStreams.mockResolvedValue({
+    list: [{ name: "llm_traces", settings: { is_llm_stream: true } }],
+  });
+});
+
+describe("AgentBehaviorPage — scope", () => {
+  it("opens on the agent, env and version in the URL, not the first agent", async () => {
+    Object.assign(mockRouteQuery, { agent: "omp", env: "production", version: "2" });
+    mockListAgents.mockResolvedValue({
+      agents: [
+        at("a23ca1dd38a1ff350", "s_hash", "staging", "1"),
+        at("omp", "s_staging", "staging", "2"),
+        at("omp", "s_prod", "production", "2"),
+      ],
+    });
+
+    const wrapper = mount(AgentBehaviorPage);
+    await flushPromises();
+
+    const panel = wrapper.findComponent({ name: "AgentBehaviorPanel" });
+    expect(panel.props("agentFilter")).toBe("omp");
+    expect(panel.props("agentEnv")).toBe("production");
+    expect(panel.props("agentVersion")).toBe("2");
+    expect(panel.props("sourceStream")).toBe("s_prod");
+    expect(mockListAgents).toHaveBeenCalledTimes(1);
+  });
+
+  it("withholds the stream from the panel until the scope is settled", async () => {
+    mockListAgents.mockReturnValue(new Promise(() => {}));
+    const wrapper = mount(AgentBehaviorPage);
+    await flushPromises();
+
+    const panel = wrapper.findComponent({ name: "AgentBehaviorPanel" });
+    expect(panel.props("scopeReady")).toBe(false);
+    expect(panel.props("sourceStream")).toBe("");
+  });
+
+  it("opens in Stream mode with the no-agent-identity banner when the window has no agents", async () => {
+    mockListAgents.mockResolvedValue({ agents: [] });
+
+    const wrapper = mount(AgentBehaviorPage);
+    await flushPromises();
+
+    const panel = wrapper.findComponent({ name: "AgentBehaviorPanel" });
+    expect(panel.props("sourceStream")).toBe("llm_traces");
+    expect(panel.props("agentFilter")).toBe("");
+    expect(wrapper.findComponent({ name: "AiNoAgentIdentityBanner" }).exists()).toBe(true);
+  });
+
+  it("settles the scope again when the user picks a window without agents", async () => {
+    mockListAgents.mockResolvedValueOnce({ agents: [at("omp", "s_prod", "production", "2")] });
+    const wrapper = mount(AgentBehaviorPage);
+    await flushPromises();
+    const panel = () => wrapper.findComponent({ name: "AgentBehaviorPanel" });
+    expect(panel().props("agentFilter")).toBe("omp");
+    expect(panel().props("sourceStream")).toBe("s_prod");
+
+    // A day earlier: no agents there, so the page falls back to Stream mode.
+    mockListAgents.mockResolvedValueOnce({ agents: [] });
+    mockTimeRange.value = {
+      startTime: 1_699_913_600_000_000,
+      endTime: 1_699_914_500_000_000,
+    };
+    wrapper
+      .findComponent({ name: "AiPageShell" })
+      .vm.$emit("date-change", { userChangedValue: true });
+    await flushPromises();
+
+    expect(mockListAgents).toHaveBeenCalledTimes(2);
+    expect(panel().props("agentFilter")).toBe("");
+    expect(panel().props("sourceStream")).toBe("llm_traces");
+    expect(wrapper.findComponent({ name: "AiNoAgentIdentityBanner" }).exists()).toBe(true);
+  });
+
+  it("does not reload on the window replay the date picker fires on mount", async () => {
+    mockListAgents.mockResolvedValue({ agents: [at("omp", "s_prod", "production", "2")] });
+    const wrapper = mount(AgentBehaviorPage);
+    await flushPromises();
+    wrapper
+      .findComponent({ name: "AiPageShell" })
+      .vm.$emit("date-change", { userChangedValue: false });
+    await flushPromises();
+    expect(mockListAgents).toHaveBeenCalledTimes(1);
+  });
+});
diff --git a/web/src/enterprise/views/AIObservability/AgentBehaviorPage.vue b/web/src/enterprise/views/AIObservability/AgentBehaviorPage.vue
index 08956fcf5e..75bdbb5e58 100644
--- a/web/src/enterprise/views/AIObservability/AgentBehaviorPage.vue
+++ b/web/src/enterprise/views/AIObservability/AgentBehaviorPage.vue
@@ -56,18 +56,35 @@
         :streams-loaded="true"
         :agents-loaded="agentsLoaded"
         @filter-mode-change="onFilterModeChange"
+        @agent-pick="modeExplicit = true"
       />
     </template>
 
+    <!-- Stream mode because these LLM spans carry no agent identity: the
+         signals show for every span in the stream (agent "unknown"). -->
+    <AiNoAgentIdentityBanner v-if="noAgentIdentity && scopeReady" data-test="agent-behavior" />
+
+    <!-- Agent mode whose agents list failed to load: not "no agents". -->
+    <div
+      v-if="scopeReady && agentsLoadFailed"
+      class="px-page-edge flex min-h-0 flex-1 items-center justify-center"
+    >
+      <AiAgentsLoadError
+        :error="agentsError ?? 'failed'"
+        data-test="agent-behavior"
+        @retry="settleScope(true)"
+      />
+    </div>
     <!-- Full-height column: the panel splits the available height between its
          two cards, so the page itself never scrolls — each table scrolls
-         internally when its rows overflow. -->
-    <div class="px-page-edge flex min-h-0 flex-1 flex-col py-4">
+         internally when its rows overflow. The stream is withheld until the
+         scope is settled, so the panel fetches once, for the final scope. -->
+    <div v-else class="px-page-edge flex min-h-0 flex-1 flex-col py-4">
       <AgentBehaviorPanel
         ref="panelRef"
         class="min-h-0 flex-1"
         :scope-ready="scopeReady"
-        :source-stream="effectiveStream"
+        :source-stream="scopeReady ? effectiveStream : ''"
         :agent-filter="agentFilter"
         :agent-env="filterMode === 'agent' ? selectedAgent?.env : null"
         :agent-version="filterMode === 'agent' ? selectedAgent?.version : null"
@@ -79,14 +96,25 @@
 </template>
 
 <script setup lang="ts">
-import { ref, computed, onMounted } from "vue";
+import { ref, computed, onMounted, watch } from "vue";
+import { useRoute, useRouter } from "vue-router";
 import { useI18nTyped } from "@/types/i18n";
 import AiPageShell from "@/enterprise/components/AIObservability/AiPageShell.vue";
 import AgentBehaviorPanel from "./AgentBehaviorPanel.vue";
 import AiScopeBar from "@/enterprise/components/AIObservability/AiScopeBar.vue";
+import AiNoAgentIdentityBanner from "@/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue";
+import AiAgentsLoadError from "@/enterprise/components/AIObservability/AiAgentsLoadError.vue";
 import useStreams from "@/composables/useStreams";
 import { useStore } from "vuex";
-import { useAgentScope } from "@/enterprise/composables/useAgentScope";
+import {
+  useAgentScope,
+  readUrlScope,
+  explicitScopeMode,
+  resolveScopeMode,
+  rememberModeChoice,
+  scopeUrlQuery,
+  type ScopeMode,
+} from "@/enterprise/composables/useAgentScope";
 import { useAiDateController } from "@/enterprise/composables/useAiDateController";
 import { useChildRefresh } from "@/enterprise/composables/useChildRefresh";
 
@@ -95,27 +123,50 @@ defineOptions({ name: "AgentBehaviorPage" });
 const { t } = useI18nTyped();
 const { getStreams } = useStreams(t);
 const store = useStore();
+const route = useRoute();
+const router = useRouter();
 
 // Shared with LLM Insights / Sessions / Quality — see useAiDateRange.ts.
 // Agent Behavior has no from/to/period URL sync (urlSync:false), matching its
 // prior behavior of resolving from shared state only.
-const { dateState, timeRange, applyRelative, onDateChange, mountResolve, DEFAULT_RELATIVE } =
-  useAiDateController({ urlSync: false });
+const {
+  dateState,
+  timeRange,
+  applyRelative,
+  onDateChange: onDateStateChange,
+  mountResolve,
+  DEFAULT_RELATIVE,
+} = useAiDateController({ urlSync: false });
 
-// Agent is the default scope: the page is about a specific agent's behaviour,
-// so it opens focused on one agent. Stream mode widens to every agent's signals.
-const filterMode = ref<"stream" | "agent">("agent");
+// The scope in the URL (`type`, `stream`, `agent`, `env`, `version`) wins over
+// the defaults, so a link shared from any Monitor page opens the same agent
+// here. Without an explicit mode (URL or remembered toggle) the agents list
+// decides: Agent (the page is about one agent's behaviour) when the window has
+// agents, Stream (every span's signals) when it has none.
+const urlScope = readUrlScope(route.query);
+// The URL's agent is applied once, on the first settle that has agents; later
+// settles (a new window) keep whatever the user picked since.
+let pendingUrlScope = urlScope.agent || urlScope.env || urlScope.version ? urlScope : null;
+const explicitMode = explicitScopeMode(urlScope);
+const filterMode = ref<ScopeMode>(explicitMode ?? "agent");
+const modeExplicit = ref(explicitMode !== null);
+// False until streams and agents have loaded and the mode and selection are
+// settled; the panel gets its stream only then.
+const scopeReady = ref(false);
 const availableStreams = ref<string[]>([]);
-const activeStream = ref<string>("");
+const activeStream = ref<string>(urlScope.stream);
 const panelRef = ref<any>(null);
-const streamsLoaded = ref(false);
 
 // Agent-mode selection — mirrors Agent Graph. Same stream-scoped identity so
 // same-named agents in different streams don't collide. Owned by the shared
 // useAgentScope composable (allAgents:false → first agent auto-selected).
 const {
   agentsLoaded,
+  agentsError,
+  agentsLoadFailed,
+  agents,
   loadAgents,
+  noAgentIdentity,
   streamSelectOptions,
   selectedStreamCount,
   selectedAgent,
@@ -126,6 +177,7 @@ const {
   selectedEnv,
   selectedAgentName,
   selectedVersion,
+  selectAgentByScope,
 } = useAgentScope({
   filterMode,
   activeStream,
@@ -145,15 +197,33 @@ const agentFilter = computed(() =>
   filterMode.value === "agent" ? (selectedAgent.value?.name ?? "") : "",
 );
 
-const scopeReady = computed(
-  () => streamsLoaded.value && (filterMode.value === "agent" ? agentsLoaded.value : true),
-);
-
-function onFilterModeChange(mode: unknown) {
-  if (mode === "stream" || mode === "agent") filterMode.value = mode;
-  if (mode === "agent" && !agentsLoaded.value) loadAgents();
+function syncScopeUrl() {
+  const agent = selectedAgent.value
+    ? { name: selectedAgent.value.name, env: selectedEnv.value, version: selectedVersion.value }
+    : null;
+  const query = scopeUrlQuery(route.query, {
+    mode: filterMode.value,
+    explicit: modeExplicit.value,
+    stream: activeStream.value,
+    agent,
+  });
+  router.replace({ query }).catch(() => {});
 }
 
+// A toggle click is an explicit choice: kept in the URL and remembered for the
+// other Monitor pages.
+function onFilterModeChange(mode: unknown) {
+  if (mode !== "stream" && mode !== "agent") return;
+  filterMode.value = mode;
+  modeExplicit.value = true;
+  rememberModeChoice(mode);
+  syncScopeUrl();
+}
+
+watch([activeStream, selectedEnv, selectedAgentName, selectedVersion], () => {
+  if (scopeReady.value) syncScopeUrl();
+});
+
 // Last-refresh + loading for the header's ORefreshButton — the panel stamps
 // `lastRunAt` when its fetch settles and exposes its own `loading`. The
 // child-refresh composable derives both off the panel ref and re-anchors a
@@ -170,9 +240,7 @@ const {
   },
 });
 
-onMounted(async () => {
-  mountResolve();
-
+async function loadStreams() {
   try {
     const res = (await getStreams("traces", false, false)) as {
       list?: { name: string; settings?: { is_llm_stream?: boolean } }[];
@@ -184,16 +252,43 @@ onMounted(async () => {
     availableStreams.value = (res?.list ?? [])
       .filter((s) => s.settings?.is_llm_stream !== false)
       .map((s) => s.name);
-    if (availableStreams.value.length && !activeStream.value) {
-      activeStream.value = availableStreams.value[0];
+    if (!availableStreams.value.includes(activeStream.value)) {
+      activeStream.value = availableStreams.value[0] ?? "";
     }
   } catch {
     availableStreams.value = [];
-  } finally {
-    streamsLoaded.value = true;
   }
+}
 
-  // Agent is the default scope, so the agent list must be ready on first paint.
-  await loadAgents();
+// Streams and agents in parallel: together they settle the mode (agents in the
+// window → Agent, none → Stream) and the URL's agent before the panel gets a
+// stream, so it fetches once. A failed agents load settles nothing (the page
+// stays on Agent with the error); its retry (`force`) runs this again, and so
+// does a new date window, whose agents may differ.
+async function settleScope(force = false) {
+  const { startTime, endTime } = timeRange.value;
+  await Promise.all([loadStreams(), loadAgents(startTime, endTime, force)]);
+  if (!modeExplicit.value) {
+    filterMode.value = resolveScopeMode(null, agents.value.length, agentsError.value);
+  }
+  if (pendingUrlScope && agents.value.length) {
+    selectAgentByScope(pendingUrlScope.env, pendingUrlScope.agent, pendingUrlScope.version);
+    pendingUrlScope = null;
+  }
+  scopeReady.value = true;
+  syncScopeUrl();
+}
+
+// Date state is owned by useAiDateController. A user's pick re-settles the
+// scope for the new window, as Agent Graph reloads its agents; the window
+// replay DateTime fires on mount is already covered by the mount settle.
+function onDateChange(value: unknown) {
+  onDateStateChange(value);
+  if ((value as { userChangedValue?: boolean } | null)?.userChangedValue === true) settleScope();
+}
+
+onMounted(() => {
+  mountResolve();
+  settleScope();
 });
 </script>
diff --git a/web/src/enterprise/views/AIObservability/AgentGraphPage.spec.ts b/web/src/enterprise/views/AIObservability/AgentGraphPage.spec.ts
index f74cac5270..ff8f9d6923 100644
--- a/web/src/enterprise/views/AIObservability/AgentGraphPage.spec.ts
+++ b/web/src/enterprise/views/AIObservability/AgentGraphPage.spec.ts
@@ -18,6 +18,9 @@
 import { reactive } from "vue";
 
 const mockListAgents = vi.fn();
+const mockGetStreams = vi.fn();
+const mockRouteQuery: Record<string, string> = {};
+const mockRouterReplace = vi.fn(() => Promise.resolve());
 
 // Module-scoped traces store singleton (mirrors useTraces()).
 const mockSearchObj = reactive({
@@ -52,6 +55,19 @@ vi.mock("vuex", () => ({
   })),
 }));
 
+vi.mock("@/composables/useStreams", () => ({
+  default: () => ({ getStreams: (...args: any[]) => mockGetStreams(...args) }),
+}));
+
+vi.mock("vue-router", () => ({
+  useRoute: () => ({ query: mockRouteQuery }),
+  useRouter: () => ({ replace: mockRouterReplace }),
+}));
+
+vi.mock("@/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue", () => ({
+  default: { name: "AiNoAgentIdentityBanner", template: `<div />` },
+}));
+
 vi.mock("vue-i18n", () => ({
   useI18n: vi.fn(() => ({
     t: (key: string) => key,
@@ -168,6 +184,7 @@ vi.mock("@/components/shared/SkeletonBox.vue", () => ({
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { mount, flushPromises } from "@vue/test-utils";
 import AgentGraphPage from "./AgentGraphPage.vue";
+import { queryClient } from "@/composables/query/queryClient";
 
 const AGENT = {
   name: "sre_agent",
@@ -185,6 +202,12 @@ async function mountPage() {
 beforeEach(() => {
   vi.clearAllMocks();
   localStorage.clear();
+  // The agents query is cached per window bucket; each test brings its own list.
+  queryClient.clear();
+  for (const k of Object.keys(mockRouteQuery)) delete mockRouteQuery[k];
+  mockGetStreams.mockResolvedValue({
+    list: [{ name: "llm_traces", settings: { is_llm_stream: true } }],
+  });
 });
 
 describe("AgentGraphPage — agent-mode stream gating", () => {
@@ -200,18 +223,129 @@ describe("AgentGraphPage — agent-mode stream gating", () => {
     expect(sg.attributes("data-stream")).not.toBe("default");
   });
 
-  it("shows the 'no agents' empty state — NOT the default service graph — when no agents are discovered", async () => {
+  it("opens in Stream mode on the LLM stream with the no-agent-identity banner when no agents are discovered", async () => {
     mockListAgents.mockResolvedValue({ agents: [] });
 
     const wrapper = await mountPage();
 
-    // The regression: ServiceGraph must NOT render (it would have queried the
-    // fallback `default` stream and drawn the wrong graph).
+    // An LLM stream without agent identity is still graphed (never `default`).
+    const sg = wrapper.find('[data-test="service-graph-stub"]');
+    expect(sg.exists()).toBe(true);
+    expect(sg.attributes("data-stream")).toBe("llm_traces");
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+    expect(wrapper.findComponent({ name: "AiNoAgentIdentityBanner" }).exists()).toBe(true);
+  });
+
+  it("shows the 'no agents' empty state — NOT the default service graph — when there are no agents and no LLM stream", async () => {
+    mockListAgents.mockResolvedValue({ agents: [] });
+    mockGetStreams.mockResolvedValue({ list: [] });
+
+    const wrapper = await mountPage();
+
     expect(wrapper.find('[data-test="service-graph-stub"]').exists()).toBe(false);
-    // The empty state is shown instead.
     expect(wrapper.find('[data-test="agent-graph-no-agents"]').exists()).toBe(true);
   });
 
+  it("keeps an explicit Agent choice from the URL even when no agents are discovered", async () => {
+    mockRouteQuery.type = "agent";
+    mockListAgents.mockResolvedValue({ agents: [] });
+
+    const wrapper = await mountPage();
+
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+    expect(wrapper.find('[data-test="service-graph-stub"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="agent-graph-no-agents"]').exists()).toBe(true);
+  });
+
+  async function pickWindow(wrapper: any, userChangedValue: boolean, startTime: number) {
+    wrapper.findComponent({ name: "AiPageShell" }).vm.$emit("date-change", {
+      valueType: "absolute",
+      startTime,
+      endTime: startTime + 1_000_000,
+      userChangedValue,
+    });
+    await flushPromises();
+  }
+
+  it("decides an auto mode again when the user picks a window with no agents", async () => {
+    mockListAgents.mockResolvedValue({ agents: [AGENT] });
+    const wrapper = await mountPage();
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+
+    // A replay (not the user's pick) of a window with no agents decides nothing.
+    mockListAgents.mockResolvedValue({ agents: [] });
+    await pickWindow(wrapper, false, 1_600_000_000_000_000);
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+
+    await pickWindow(wrapper, true, 1_500_000_000_000_000);
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+  });
+
+  it("keeps an explicit Agent choice when the user picks a window with no agents", async () => {
+    mockRouteQuery.type = "agent";
+    mockListAgents.mockResolvedValue({ agents: [AGENT] });
+    const wrapper = await mountPage();
+
+    mockListAgents.mockResolvedValue({ agents: [] });
+    await pickWindow(wrapper, true, 1_500_000_000_000_000);
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+  });
+
+  it("opens on the agent, env and version named in the URL, not the first agent", async () => {
+    mockRouteQuery.agent = "omp";
+    mockRouteQuery.env = "production";
+    mockRouteQuery.version = "2";
+    mockListAgents.mockResolvedValue({
+      agents: [
+        {
+          name: "a23ca1dd38a1ff350",
+          id: "a23ca1dd38a1ff350",
+          source_stream: "s1",
+          source_stream_type: "traces",
+          env: "staging",
+          version: "1",
+        },
+        {
+          name: "omp",
+          id: "agent-omp",
+          source_stream: "s_staging",
+          source_stream_type: "traces",
+          env: "staging",
+          version: "2",
+        },
+        {
+          name: "omp",
+          id: "agent-omp",
+          source_stream: "s_prod",
+          source_stream_type: "traces",
+          env: "production",
+          version: "1",
+        },
+        {
+          name: "omp",
+          id: "agent-omp",
+          source_stream: "s_prod2",
+          source_stream_type: "traces",
+          env: "production",
+          version: "2",
+        },
+      ],
+    });
+
+    const wrapper = await mountPage();
+
+    const vm = wrapper.vm as any;
+    expect(vm.filterMode).toBe("agent");
+    expect([vm.selectedEnv, vm.selectedAgentName, vm.selectedVersion]).toEqual([
+      "production",
+      "omp",
+      "2",
+    ]);
+    expect(wrapper.find('[data-test="service-graph-stub"]').attributes("data-stream")).toBe(
+      "s_prod2",
+    );
+  });
+
   it("does not render ServiceGraph while agents are still loading", async () => {
     // Never-resolving listAgents keeps agentsLoaded=false.
     mockListAgents.mockReturnValue(new Promise(() => {}));
diff --git a/web/src/enterprise/views/AIObservability/AgentGraphPage.vue b/web/src/enterprise/views/AIObservability/AgentGraphPage.vue
index af2c7c1526..6f85640ba8 100644
--- a/web/src/enterprise/views/AIObservability/AgentGraphPage.vue
+++ b/web/src/enterprise/views/AIObservability/AgentGraphPage.vue
@@ -59,6 +59,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :streams-loaded="true"
         :agents-loaded="agentsLoaded"
         @filter-mode-change="onFilterModeChange"
+        @agent-pick="modeExplicit = true"
       >
         <!-- Version-agnostic hint. Agent Graph hides the cascade's Version
              dropdown (topology is the same across versions), so this info
@@ -117,6 +118,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </AiScopeBar>
     </template>
 
+    <!-- Stream mode because these LLM spans carry no agent identity: the graph
+         shows the stream's services; the banner says why there is no agent. -->
+    <AiNoAgentIdentityBanner v-if="noAgentIdentity && scopeReady" data-test="agent-graph" />
+
     <!-- Gate the graph until the effective stream is genuinely resolved.
          ServiceGraph loads unconditionally in its own onMounted, so mounting it
          before loadAgents() resolves would fire an initial query against the
@@ -138,8 +143,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       agent-highlight
       class="min-h-0 flex-1"
     />
-    <!-- No agents discovered in the current org / time window — show an empty
-         state, NOT the fallback `default` service graph (the original bug). -->
+    <!-- Agent mode whose agents list failed to load: not "no agents". -->
+    <div
+      v-else-if="scopeReady && agentsLoadFailed"
+      class="flex min-h-0 flex-1 items-center justify-center"
+    >
+      <AiAgentsLoadError
+        :error="agentsError ?? 'failed'"
+        size="block"
+        data-test="agent-graph"
+        @retry="loadAgents(true)"
+      />
+    </div>
+    <!-- Nothing to graph in the current org / time window: no agents in Agent
+         mode, or no LLM stream at all — an empty state, NOT the fallback
+         `default` service graph (the original bug). -->
     <div
       v-else-if="hasNoAgents"
       data-test="agent-graph-no-agents"
@@ -164,7 +182,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script setup lang="ts">
-import { defineAsyncComponent, ref, computed, onMounted } from "vue";
+import { defineAsyncComponent, ref, computed, onMounted, watch } from "vue";
+import { useRoute, useRouter } from "vue-router";
 import type { AcceptableValue } from "reka-ui";
 import { useI18nTyped } from "@/types/i18n";
 import { useStore } from "vuex";
@@ -179,18 +198,28 @@ import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import { getConsumableRelativeTime } from "@/utils/date";
 import type { GenAiAgentListItem } from "@/services/gen-ai-agent-mapping.service";
-import { genAiAgentsQuery } from "@/services/gen-ai-agent-mapping.queries";
-import { queryClient } from "@/composables/query/queryClient";
-import { agentOptionKey } from "@/plugins/traces/llmAgentFilter";
 import AiScopeBar from "@/enterprise/components/AIObservability/AiScopeBar.vue";
+import AiNoAgentIdentityBanner from "@/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue";
+import AiAgentsLoadError from "@/enterprise/components/AIObservability/AiAgentsLoadError.vue";
 import { useAiDateController } from "@/enterprise/composables/useAiDateController";
 import { useChildRefresh } from "@/enterprise/composables/useChildRefresh";
-import { useAgentScope } from "@/enterprise/composables/useAgentScope";
+import { useLlmTraceStreams } from "@/enterprise/composables/useLlmTraceStreams";
+import {
+  useAgentScope,
+  readUrlScope,
+  explicitScopeMode,
+  resolveScopeMode,
+  rememberModeChoice,
+  scopeUrlQuery,
+  type ScopeMode,
+} from "@/enterprise/composables/useAgentScope";
 
 defineOptions({ name: "AIAgentGraphPage" });
 
 const { t } = useI18nTyped();
 const store = useStore();
+const route = useRoute();
+const router = useRouter();
 
 // Shared AI-module date range — the same singleton LLM Insights / Sessions /
 // Agent Behavior use, so picking a time on any AI tab lands on all of them.
@@ -207,10 +236,27 @@ const {
 
 const ServiceGraph = defineAsyncComponent(() => import("@/plugins/traces/ServiceGraph.vue"));
 
-// Default scope is "agent" — the AI module is agent-centric (agents load on
-// mount, so the default is ready on first paint).
-const filterMode = ref<"stream" | "agent">("agent");
-const activeStream = ref<string>("");
+// The scope in the URL (`type`, `stream`, `agent`, `env`, `version`) wins over
+// the defaults, so a link shared from any Monitor page opens the same agent
+// here. Without an explicit mode (URL or remembered toggle) the agents list
+// decides: Agent when the window has agents, Stream when it has none.
+const urlScope = readUrlScope(route.query);
+const explicitMode = explicitScopeMode(urlScope);
+const filterMode = ref<ScopeMode>(explicitMode ?? "agent");
+const modeExplicit = ref(explicitMode !== null);
+// False until the first agents load has settled the mode and the selection;
+// the graph mounts only after it, exactly once.
+const scopeReady = ref(false);
+// Whether an agents list has decided the mode. A failed agents load decides
+// nothing, so the next load after it decides again; so does a window the user
+// picks, whose agents may differ (unless the user chose the mode).
+let modeSettled = false;
+// Seeded once from the URL after the first agents load, then cleared.
+let pendingUrlScope: { env: string; name: string; version: string } | null =
+  urlScope.agent || urlScope.env || urlScope.version
+    ? { env: urlScope.env, name: urlScope.agent, version: urlScope.version }
+    : null;
+const activeStream = ref<string>(urlScope.stream);
 
 // Agent Graph's OWN visualization + layout selection — deliberately NOT the
 // shared traces store (`searchObj.meta.serviceGraph*Type`) that the Traces
@@ -267,36 +313,33 @@ const {
   },
 });
 
-// Graph owns its `agents`/`agentsLoaded` refs and its from-agents
-// `availableStreams` computed (its Stream picker is derived from agent-bearing
-// streams, not from all trace streams). Its own reconciling `loadAgents`
-// (evict-stale-key + evict-stale-stream + default-both) also stays page-local.
-// These are injected INTO useAgentScope purely to obtain the shared derived
-// computeds (agentSelectOptions/streamSelectOptions/selectedStreamCount/
-// selectedAgent/effectiveStream); Graph does NOT use the composable's loadAgents.
+// Graph owns its `agents`/`agentsLoaded` refs and its `availableStreams`
+// computed, injected INTO useAgentScope for the shared derived computeds and
+// its loader.
 const agents = ref<GenAiAgentListItem[]>([]);
 const agentsLoaded = ref(false);
 
-// Stream-scoped identity, mirroring LLM Insights — same-named agents in
-// different streams (or different env/version) don't collide.
-const agentKey = (a: GenAiAgentListItem) => agentOptionKey(a);
+// LLM trace streams, for Stream mode when no agent identity exists. Loaded into
+// a ref of their own: the loader clamps the ref it is given to its own list.
+const llmStreamPick = ref("");
+const { availableStreams: llmStreams, ensureStreamsLoaded } = useLlmTraceStreams(llmStreamPick, t);
 
-// Streams offered in the Stream picker are ONLY those that actually carry agent
-// data — i.e. the distinct source_streams of discovered agents. A trace stream
-// with services but no agents (e.g. `introspection`) has nothing agent-related
-// to show here, so it must not appear. Derived from the agents list rather than
-// from all trace streams for exactly this reason. Passed into useAgentScope,
-// which only READS it (streamSelectOptions/selectedStreamCount).
-const availableStreams = computed(() => [...new Set(agents.value.map((a) => a.source_stream))]);
+// Streams offered in the Stream picker: the agent-bearing streams (the distinct
+// source_streams of discovered agents) when agents exist — a trace stream with
+// services but no agents (e.g. `introspection`) has nothing agent-related to
+// show. With no agents at all, the LLM streams, so an org whose spans carry no
+// agent identity still sees its LLM services graphed.
+const availableStreams = computed(() =>
+  agents.value.length ? [...new Set(agents.value.map((a) => a.source_stream))] : llmStreams.value,
+);
 
-// Shared derived scope computeds from useAgentScope. `activeAgent` (the
-// composable's single selection ref) replaces Graph's former `activeAgentKey`;
-// Graph's `loadAgents` reconciliation writes into it. `allAgents:false` → no
-// All-Agents entry, matching Graph's first-agent-default behavior. Graph's own
-// `agents`/`agentsLoaded` refs and from-agents `availableStreams` computed are
-// injected, so the composable reads Graph's data and never loads on its own.
+// `allAgents:false` → no All-Agents entry; the cascade defaults to the first
+// agent.
 const {
-  activeAgent,
+  loadAgents: loadAgentList,
+  agentsError,
+  agentsLoadFailed,
+  noAgentIdentity,
   streamSelectOptions,
   selectedStreamCount,
   selectedAgent,
@@ -307,6 +350,7 @@ const {
   selectedEnv,
   selectedAgentName,
   selectedVersion,
+  selectAgentByScope,
 } = useAgentScope({
   filterMode,
   activeStream,
@@ -326,25 +370,53 @@ const {
   t,
 });
 
-// Whether there is simply nothing agent-related to graph in the current org /
-// time window. There are no agents at all → both modes have nothing to show
-// (the Stream picker is itself derived from agent-bearing streams).
-const hasNoAgents = computed(() => agentsLoaded.value && !agents.value.length);
+// Nothing to graph in the current org / time window: no agent to pick in Agent
+// mode, or no stream at all in Stream mode.
+const hasNoAgents = computed(
+  () =>
+    scopeReady.value &&
+    (filterMode.value === "agent" ? !agents.value.length : !availableStreams.value.length),
+);
 
 // The graph may only mount once it has a real stream to query. In agent mode
 // that requires an actually-selected agent (whose source_stream is the stream);
-// in stream mode, a chosen agent-bearing stream. This prevents ServiceGraph's
-// mount-time load from ever firing against a fallback/agentless stream.
-const graphReady = computed(() =>
-  filterMode.value === "agent"
-    ? !!selectedAgent.value && !!effectiveStream.value
-    : !!activeStream.value,
+// in stream mode, a chosen stream. This prevents ServiceGraph's mount-time load
+// from ever firing against a fallback stream, or before the mode is settled.
+const graphReady = computed(
+  () =>
+    scopeReady.value &&
+    (filterMode.value === "agent"
+      ? !!selectedAgent.value && !!effectiveStream.value
+      : !!activeStream.value),
 );
 
-function onFilterModeChange(mode: boolean | AcceptableValue | AcceptableValue[]) {
-  if (mode === "stream" || mode === "agent") filterMode.value = mode;
+function syncScopeUrl() {
+  const agent = selectedAgent.value
+    ? { name: selectedAgent.value.name, env: selectedEnv.value, version: selectedVersion.value }
+    : null;
+  const query = scopeUrlQuery(route.query, {
+    mode: filterMode.value,
+    explicit: modeExplicit.value,
+    stream: activeStream.value,
+    agent,
+  });
+  router.replace({ query }).catch(() => {});
 }
 
+// A toggle click is an explicit choice: kept in the URL and remembered for the
+// other Monitor pages.
+function onFilterModeChange(mode: boolean | AcceptableValue | AcceptableValue[]) {
+  if (mode !== "stream" && mode !== "agent") return;
+  filterMode.value = mode;
+  modeExplicit.value = true;
+  rememberModeChoice(mode);
+  syncScopeUrl();
+}
+
+watch([activeStream, selectedEnv, selectedAgentName], () => {
+  if (scopeReady.value) syncScopeUrl();
+});
+
 function effectiveWindow() {
   if (dateState.value.valueType === "relative" && dateState.value.relativeTimePeriod) {
     const r = getConsumableRelativeTime(dateState.value.relativeTimePeriod);
@@ -356,49 +428,39 @@ function effectiveWindow() {
   };
 }
 
-async function loadAgents() {
-  try {
-    const org = store.state.selectedOrganization.identifier;
-    const { startTime, endTime } = effectiveWindow();
-    const res = await queryClient.fetchQuery(genAiAgentsQuery(org, startTime, endTime));
-    agents.value = res.agents ?? [];
-    // Reconcile the selection against the fresh list. Reloading (e.g. after a
-    // time-range change) can return a different or empty set, which would
-    // otherwise leave `activeAgent` pointing at an agent no longer present —
-    // the dropdown then shows a stale name while the graph has no agent. Clear a
-    // now-invalid key, and auto-select the first agent when none is selected.
-    // `activeAgent` is useAgentScope's selection ref (Graph keeps its OWN richer
-    // reconciliation here rather than the composable's key-only clamp).
-    const keys = new Set(agents.value.map((a) => agentKey(a)));
-    if (activeAgent.value && !keys.has(activeAgent.value)) {
-      activeAgent.value = "";
-    }
-    if (!activeAgent.value && agents.value.length) {
-      activeAgent.value = agentKey(agents.value[0]);
-    }
-    // Same reconciliation for the Stream picker, whose options are the distinct
-    // agent-bearing source_streams (availableStreams). Clear a now-absent
-    // stream, and default to the first agent-bearing stream.
-    if (activeStream.value && !availableStreams.value.includes(activeStream.value)) {
-      activeStream.value = "";
-    }
-    if (!activeStream.value && availableStreams.value.length) {
-      activeStream.value = availableStreams.value[0];
-    }
-  } catch {
-    agents.value = [];
-    activeAgent.value = "";
-    activeStream.value = "";
-  } finally {
-    agentsLoaded.value = true;
+// Loads the agents (and LLM streams) for the window, then settles the scope:
+// on the first load the mode (unless explicit) and the URL's agent; on every
+// load the Stream picker, whose options can change with the list. The cascade
+// itself is reconciled against the fresh list by useAgentScope. `force` (the
+// load-error retry) bypasses the agents cache.
+async function loadAgents(force = false, windowPicked = false) {
+  const { startTime, endTime } = effectiveWindow();
+  await Promise.all([loadAgentList(startTime, endTime, force), ensureStreamsLoaded()]);
+  if ((!modeSettled || windowPicked) && !modeExplicit.value) {
+    filterMode.value = resolveScopeMode(null, agents.value.length, agentsError.value);
   }
+  if (!agentsError.value) modeSettled = true;
+  if (pendingUrlScope && agents.value.length) {
+    selectAgentByScope(pendingUrlScope.env, pendingUrlScope.name, pendingUrlScope.version);
+    pendingUrlScope = null;
+  }
+  if (activeStream.value && !availableStreams.value.includes(activeStream.value)) {
+    activeStream.value = "";
+  }
+  if (!activeStream.value && availableStreams.value.length) {
+    activeStream.value = availableStreams.value[0];
+  }
+  scopeReady.value = true;
+  syncScopeUrl();
 }
 
 // Date-only state update is owned by useAiDateController; the page's extra
-// effect on a date change is to reload the agent list for the new window.
+// effect on a date change is to reload the agent list for the new window. A
+// user's pick also re-decides an auto mode for that window, as Agent Behavior
+// does; the replay DateTime fires on mount does not.
 function onDateChange(value: any) {
   onDateStateChange(value);
-  loadAgents();
+  loadAgents(false, value?.userChangedValue === true);
 }
 
 onMounted(() => {
diff --git a/web/src/enterprise/views/AIObservability/DatasetDetailPage.vue b/web/src/enterprise/views/AIObservability/DatasetDetailPage.vue
index 900ee1f4f0..77b02122a9 100644
--- a/web/src/enterprise/views/AIObservability/DatasetDetailPage.vue
+++ b/web/src/enterprise/views/AIObservability/DatasetDetailPage.vue
@@ -193,7 +193,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             </template>
 
             <template #cell-version="{ row }">
-              <span class="tabular-nums">{{ versionLabel(row.version) }}</span>
+              <span class="tabular-nums">{{ versionLabel(row.writeVersion) }}</span>
             </template>
 
             <template #cell-actions="{ row }">
@@ -536,7 +536,7 @@ const columns = computed(() => [
   {
     id: "version",
     header: t("aiObservability.datasets.detail.columns.version"),
-    accessorKey: "version",
+    accessorKey: "writeVersion",
     hideable: true,
     sortable: false,
     size: 140,
diff --git a/web/src/enterprise/views/AIObservability/DatasetsPage.vue b/web/src/enterprise/views/AIObservability/DatasetsPage.vue
index efeba76da7..4bc1861798 100644
--- a/web/src/enterprise/views/AIObservability/DatasetsPage.vue
+++ b/web/src/enterprise/views/AIObservability/DatasetsPage.vue
@@ -136,7 +136,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </template>
 
         <template #cell-globalVersion="{ row }">
-          <span class="tabular-nums">{{ versionLabel(row.globalVersion) }}</span>
+          <span class="tabular-nums">{{ versionLabel(row.writeVersion) }}</span>
         </template>
 
         <template #cell-updatedAt="{ row }">
@@ -409,9 +409,10 @@ const columns = computed<OTableColumnDef[]>(() => [
     meta: { align: "left" },
   },
   {
+    // The id predates write versions; persisted column preferences key on it.
     id: "globalVersion",
     header: t("aiObservability.datasets.columns.version"),
-    accessorKey: "globalVersion",
+    accessorKey: "writeVersion",
     hideable: true,
     sortable: true,
     size: 100,
diff --git a/web/src/enterprise/views/AIObservability/ExperimentComparePage.spec.ts b/web/src/enterprise/views/AIObservability/ExperimentComparePage.spec.ts
index 1d07b080fc..09e1712fa5 100644
--- a/web/src/enterprise/views/AIObservability/ExperimentComparePage.spec.ts
+++ b/web/src/enterprise/views/AIObservability/ExperimentComparePage.spec.ts
@@ -128,7 +128,7 @@ beforeEach(() => {
   });
   getRow.mockImplementation(async (_org: string, experimentId: string, rowId: string) => ({
     experimentId,
-    snapshot: { datasetId: "dataset-1", datasetVersion: 1 },
+    snapshot: { datasetId: "dataset-1", datasetVersion: 1, datasetWriteVersion: 1 },
     navigation: { rowIndex: 0, totalRows: 1, previousRowId: null, nextRowId: null },
     rowId,
     logicalId: "case-1",
diff --git a/web/src/enterprise/views/AIObservability/ExperimentDetailPage.spec.ts b/web/src/enterprise/views/AIObservability/ExperimentDetailPage.spec.ts
index f0e7168ce5..4e3194f986 100644
--- a/web/src/enterprise/views/AIObservability/ExperimentDetailPage.spec.ts
+++ b/web/src/enterprise/views/AIObservability/ExperimentDetailPage.spec.ts
@@ -332,7 +332,8 @@ describe("ExperimentDetailPage", () => {
 
     const tasks = wrapper.get('[data-test="ai-experiment-detail-progress"]');
     expect(tasks.text()).toContain("Tasks");
-    expect(tasks.text()).toContain("29/30");
+    // Succeeded over total: the 4 failed slots are finished, not done.
+    expect(tasks.text()).toContain("25/30");
     expect(tasks.text()).toContain("25 succeeded · 4 failed · 1 pending · 0 skipped");
 
     const scores = wrapper.get('[data-test="ai-experiment-detail-scoring"]');
@@ -666,7 +667,7 @@ describe("ExperimentDetailPage", () => {
     const state = mounted.$.setupState;
     state.selectedRowDetail = {
       experimentId: "exp-1",
-      snapshot: { datasetId: "ds-1", datasetVersion: 1 },
+      snapshot: { datasetId: "ds-1", datasetVersion: 1, datasetWriteVersion: 1 },
       navigation: {
         rowIndex: 0,
         totalRows: 1,
diff --git a/web/src/enterprise/views/AIObservability/ExperimentDetailPage.vue b/web/src/enterprise/views/AIObservability/ExperimentDetailPage.vue
index 987c7f464e..2f7e07d4a6 100644
--- a/web/src/enterprise/views/AIObservability/ExperimentDetailPage.vue
+++ b/web/src/enterprise/views/AIObservability/ExperimentDetailPage.vue
@@ -80,7 +80,7 @@
         data-test="ai-experiment-detail-meta"
       >
         <div class="flex min-w-0 items-center gap-1.5">
-          <span class="text-2xs text-text-tertiary font-semibold">
+          <span class="text-2xs text-text-secondary font-semibold">
             {{ t("aiObservability.experiments.detail.metaLabels.dataset") }}
           </span>
           <OTruncatedText
@@ -94,7 +94,7 @@
         <OSeparator vertical class="h-4" />
 
         <div class="flex min-w-0 items-center gap-1.5">
-          <span class="text-2xs text-text-tertiary font-semibold">
+          <span class="text-2xs text-text-secondary font-semibold">
             {{ t("aiObservability.experiments.detail.metaLabels.task") }}
           </span>
           <span class="text-text-secondary truncate text-xs">
@@ -105,7 +105,7 @@
         <template v-if="taskModel">
           <OSeparator vertical class="h-4" />
           <div class="flex min-w-0 items-center gap-1.5">
-            <span class="text-2xs text-text-tertiary font-semibold">
+            <span class="text-2xs text-text-secondary font-semibold">
               {{ t("aiObservability.experiments.detail.metaLabels.model") }}
             </span>
             <OTruncatedText class="text-text-secondary text-xs">{{
@@ -117,7 +117,7 @@
         <OSeparator vertical class="h-4" />
 
         <div class="flex min-w-0 items-center gap-1.5">
-          <span class="text-2xs text-text-tertiary font-semibold">
+          <span class="text-2xs text-text-secondary font-semibold">
             {{ t("aiObservability.experiments.detail.metaLabels.run") }}
           </span>
           <span class="text-text-secondary truncate text-xs">{{ runSummary }}</span>
@@ -126,6 +126,51 @@
     </template>
 
     <div class="flex h-full min-h-0 flex-col">
+      <OBanner
+        v-if="failureBanner"
+        variant="error-soft"
+        icon="error-outline"
+        inline-actions
+        class="mx-page-edge mt-2.5 shrink-0"
+        data-test="ai-experiment-detail-failure-banner"
+      >
+        <div class="flex min-w-0 flex-col gap-0.5">
+          <span class="font-semibold" data-test="ai-experiment-detail-failure-title">
+            {{
+              t("aiObservability.experiments.detail.failureBanner.title", {
+                failed: failureBanner.failed,
+                total: failureBanner.total,
+                cause: failureBanner.kindLabel,
+              })
+            }}
+          </span>
+          <span class="text-xs break-words" data-test="ai-experiment-detail-failure-cause">
+            {{
+              t("aiObservability.experiments.detail.failureBanner.cause", {
+                count: failureBanner.count,
+                message: failureBanner.message,
+              })
+            }}
+            <template v-if="failureBanner.moreCauses > 0">
+              {{
+                t("aiObservability.experiments.detail.failureBanner.moreCauses", {
+                  count: failureBanner.moreCauses,
+                })
+              }}
+            </template>
+          </span>
+        </div>
+        <template v-if="failureBanner.providerTask" #actions>
+          <OButton
+            size="sm"
+            variant="outline"
+            data-test="ai-experiment-detail-failure-open-providers"
+            @click="router.push({ name: 'llmProviders' })"
+          >
+            {{ t("aiObservability.experiments.detail.failureBanner.openProviders") }}
+          </OButton>
+        </template>
+      </OBanner>
       <KpiCardRow v-if="metricCards.length" class="px-page-edge shrink-0 py-2.5">
         <KpiCard
           v-for="card in metricCards"
@@ -153,7 +198,7 @@
             </span>
           </template>
           <template v-if="card.footer" #footer>
-            <span class="text-3xs text-text-tertiary font-medium">{{ raw(card.footer) }}</span>
+            <span class="text-3xs text-text-secondary font-medium">{{ raw(card.footer) }}</span>
           </template>
         </KpiCard>
       </KpiCardRow>
@@ -267,6 +312,17 @@
             <span v-else class="text-text-secondary">{{ raw(row.dispersionLabel) }}</span>
           </template>
 
+          <template #cell-errorMessage="{ row }: { row: any }">
+            <OTruncatedText
+              v-if="row.errorMessage"
+              class="text-status-error-text text-xs"
+              :data-test="`ai-experiment-row-error-${row.rowKey}`"
+            >
+              {{ raw(row.errorMessage) }}
+            </OTruncatedText>
+            <span v-else class="text-text-secondary">{{ raw("—") }}</span>
+          </template>
+
           <template #cell-latency="{ row }: { row: any }">
             <span class="text-text-secondary">{{ raw(row.latency) }}</span>
           </template>
@@ -336,6 +392,7 @@ import useSmartBack from "@/composables/useSmartBack";
 import OPageLayout from "@/lib/core/PageLayout/OPageLayout.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import OBanner from "@/lib/feedback/Banner/OBanner.vue";
 import OInput from "@/lib/forms/Input/OInput.vue";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
@@ -349,7 +406,8 @@ import { COL, type OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import { statusVariant } from "@/lib/core/Table/cells/statusVariant";
 import { toast } from "@/lib/feedback/Toast/useToast";
-import onlineEvalsService, { type ScoreConfig } from "@/services/online-evals.service";
+import { type ScoreConfig } from "@/services/online-evals.service";
+import { scoreConfigsQuery } from "@/services/online-evals.service.queries";
 import { healthyBooleanValue } from "@/enterprise/components/onlineEvals/utils/qualitySummary";
 import {
   cancelExperimentMutation,
@@ -385,6 +443,7 @@ import {
   formatDuration,
 } from "@/enterprise/components/AIObservability/experimentRowContent";
 import { experimentScoreSummaryValue, openExperimentTrace } from "./experimentResults";
+import { experimentCostText } from "./experimentDiscovery";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
 
 defineOptions({ name: "AIExperimentDetailPage" });
@@ -441,14 +500,13 @@ const isMultiTrial = computed(() => (detail.value?.experiment.trialCount ?? 1) >
  *  two score columns exactly like the dataset grouping on the list page. */
 const scorerIds = computed(() => (detail.value?.preview.pinnedScorers ?? []).map((s) => s.id));
 
-// Session-cached per org (see `scoreConfigs.listCached`) rather than a plain
-// `list()` — this page mounts fresh every time a different experiment is
-// opened, and Score Configs change far less often than that.
+// The shared per-org entry (`scoreConfigsQuery`): this page mounts fresh for
+// every experiment opened, and every Score Config write invalidates the entry.
 const scoreConfigs = ref<ScoreConfig[]>([]);
 async function loadScoreConfigs() {
   if (!orgId.value) return;
   try {
-    scoreConfigs.value = await onlineEvalsService.scoreConfigs.listCached(orgId.value);
+    scoreConfigs.value = await queryClient.fetchQuery(scoreConfigsQuery(orgId.value));
   } catch {
     // Non-fatal: without configs, boolean cells just render unhighlighted —
     // same as before this feature existed.
@@ -566,6 +624,39 @@ const failedSlotCount = computed(
   () => detail.value?.results.aggregateSummary?.incompleteTaskSlots ?? 0,
 );
 
+const hasRowErrors = computed(() => resultRows.value.some((row) => !!row.errorMessage));
+const FAILURE_KINDS = new Set([
+  "provider_auth",
+  "rate_limited",
+  "timeout",
+  "provider_5xx",
+  "parse_error",
+  "mapping_error",
+  "scorer_missing",
+  "execution_error",
+]);
+
+/** The run's top failure cause, so a failed run says why before any row is
+ *  opened. Causes are grouped server-side by error kind and the first line of
+ *  the message, over every slot rather than this page of rows. */
+const failureBanner = computed(() => {
+  const results = detail.value?.results;
+  const aggregate = results?.aggregateSummary;
+  const top = aggregate?.failureCauses?.[0];
+  if (!results || !aggregate || !top || aggregate.errorTaskSlots <= 0) return null;
+  const kind = top.kind && FAILURE_KINDS.has(top.kind) ? top.kind : "unknown";
+  const task = detail.value?.experiment.task;
+  return {
+    failed: aggregate.errorTaskSlots,
+    total: results.taskOutcomes?.total ?? results.taskProgress?.total ?? aggregate.errorTaskSlots,
+    kindLabel: t(`aiObservability.experiments.detail.failureKinds.${kind}`),
+    message: top.message || t("aiObservability.experiments.detail.failureBanner.noMessage"),
+    count: top.slotCount,
+    moreCauses: Math.max(0, aggregate.failureCauseCount - 1),
+    providerTask: task?.type === "inline_prompt" || task?.type === "prompt_ref",
+  };
+});
+
 function openManagedPrompt() {
   const task = detail.value?.experiment.task;
   if (task?.type !== "prompt_ref") return;
@@ -589,7 +680,7 @@ const datasetLabel = computed(() => {
   if (!experiment) return raw("");
   return t("aiObservability.experiments.detail.datasetVersion", {
     dataset: experiment.datasetName ?? experiment.datasetId,
-    version: experiment.datasetVersion,
+    version: experiment.datasetWriteVersion,
   });
 });
 
@@ -656,14 +747,14 @@ const metricCards = computed<MetricCard[]>(() => {
   cards.push({
     key: "cost",
     label: t("aiObservability.experiments.detail.totalCost"),
-    value: aggregate?.totalCost == null ? "—" : `$${aggregate.totalCost.toFixed(4)}`,
+    value: experimentCostText(aggregate?.totalCost, aggregate?.costIncomplete, t),
     footer: t(
       aggregate?.costIncomplete
         ? "aiObservability.experiments.detail.partialCostBreakdown"
         : "aiObservability.experiments.detail.costBreakdown",
       {
-        task: formatCost(aggregate?.taskCost ?? aggregate?.totalCost),
-        scoring: formatCost(aggregate?.scoringCost),
+        task: formatCost(aggregate?.taskCost ?? aggregate?.totalCost, aggregate?.costIncomplete),
+        scoring: formatCost(aggregate?.scoringCost, aggregate?.costIncomplete),
       },
     ),
     icon: "payments" as IconName,
@@ -678,16 +769,21 @@ const metricCards = computed<MetricCard[]>(() => {
     dataTest: "ai-experiment-detail-dispersion",
   });
   if (task) {
+    // Succeeded over total: a failed slot is finished, not done, so counting
+    // it as completed showed 56/56 with a check on a run where nothing worked.
+    const failed = taskOutcomes?.failed ?? 0;
     cards.push({
       key: "progress",
       label: t("aiObservability.experiments.detail.tasks"),
-      value: `${task.completed}/${task.total}`,
+      value: taskOutcomes
+        ? `${taskOutcomes.succeeded}/${taskOutcomes.total}`
+        : `${task.completed}/${task.total}`,
       footer: taskOutcomes
         ? t("aiObservability.experiments.detail.taskDistribution", taskOutcomes)
         : task.skipped
           ? t("aiObservability.experiments.detail.skippedCount", { count: task.skipped })
           : undefined,
-      icon: "check-circle" as IconName,
+      icon: (failed > 0 ? "error-outline" : "check-circle") as IconName,
       dataTest: "ai-experiment-detail-progress",
     });
   }
@@ -708,8 +804,9 @@ const metricCards = computed<MetricCard[]>(() => {
   return cards;
 });
 
-function formatCost(cost: number | null | undefined): string {
-  return cost == null ? "—" : `$${cost.toFixed(4)}`;
+/** One side of the breakdown. A zero on an incomplete run is not a price. */
+function formatCost(cost: number | null | undefined, incomplete?: boolean): string {
+  return cost == null || (incomplete && cost === 0) ? "—" : `$${cost.toFixed(4)}`;
 }
 
 function isMetricCardActionable(card: MetricCard) {
@@ -788,6 +885,20 @@ const columns = computed<OTableColumnDef[]>(() => [
         },
       ]
     : []),
+  // The cause on every failed row, so filtering to Task Failed shows why
+  // without opening each drawer. Absent when nothing failed.
+  ...(hasRowErrors.value
+    ? [
+        {
+          id: "errorMessage",
+          header: t("aiObservability.experiments.detail.columns.error"),
+          accessorKey: "errorMessage",
+          sortable: true,
+          size: 240,
+          meta: { align: "left" as const, cellOverflowTooltip: false },
+        },
+      ]
+    : []),
   {
     id: "latency",
     header: isMultiTrial.value
diff --git a/web/src/enterprise/views/AIObservability/Index.spec.ts b/web/src/enterprise/views/AIObservability/Index.spec.ts
index 0a83fc0f4a..167663ee7d 100644
--- a/web/src/enterprise/views/AIObservability/Index.spec.ts
+++ b/web/src/enterprise/views/AIObservability/Index.spec.ts
@@ -15,17 +15,11 @@
 //
 // @vitest-environment jsdom
 //
-// AIObservabilityShell's rail shows every section on every build — on a true
-// OSS build, everything beyond Monitor's LLM Insights + Sessions renders
-// LOCKED (lock icon + pitch-card tooltip) rather than being hidden, so OSS
-// users can discover the rest of the module instead of never knowing it
-// exists. All of it is still reachable (not a 404): `web/src/composables/
-// router.ts` registers every one of these routes too, each gated with
-// `withFeatureGate` so OSS actually landing on one redirects to the shared
-// locked-feature page instead of breaking.
+// OSS shows non-Monitor sections locked (feature-gated routes), enterprise/cloud unlocked.
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { mount } from "@vue/test-utils";
+import { nextTick, reactive } from "vue";
 
 let mockIsEnterprise = "false";
 let mockIsCloud = "false";
@@ -40,12 +34,21 @@ vi.mock("@/aws-exports", () => ({
   },
 }));
 
+const mockState = reactive<{
+  selectedOrganization: { identifier: string };
+  zoConfig: Record<string, unknown>;
+}>({ selectedOrganization: { identifier: "test-org" }, zoConfig: {} });
 vi.mock("vuex", () => ({
-  useStore: () => ({ state: { selectedOrganization: { identifier: "test-org" } } }),
+  useStore: () => ({ state: mockState }),
 }));
 
+const mockRoute = reactive<{ name: string; query: Record<string, string>; meta: object }>({
+  name: "aiLLMInsights",
+  query: {},
+  meta: {},
+});
 vi.mock("vue-router", () => ({
-  useRoute: () => ({ name: "aiLLMInsights", query: {} }),
+  useRoute: () => mockRoute,
 }));
 
 vi.mock("@/types/i18n", async (importOriginal) => {
@@ -55,7 +58,9 @@ vi.mock("@/types/i18n", async (importOriginal) => {
 
 const SectionRailStub = {
   props: ["groups", "activeKey", "title", "icon", "collapsible", "collapsed"],
-  template: '<div class="section-rail" />',
+  // Rendered item keys, because findComponent loses this stub once the page swaps out.
+  template:
+    '<div class="section-rail"><template v-for="g in groups" :key="g.label"><i v-for="item in g.items" :key="item.key" :data-rail-item="item.key" /></template></div>',
 };
 
 async function mountShell() {
@@ -65,6 +70,9 @@ async function mountShell() {
       stubs: {
         SectionRail: SectionRailStub,
         OPageLayout: { template: '<div><slot name="sidebar" /><slot /></div>' },
+        OEmptyState: { template: "<div />" },
+        OnlineEvalsDisabled: { template: '<div data-test="online-evals-disabled" />' },
+        RouterView: { template: '<div data-test="router-view" />' },
       },
     },
   });
@@ -99,6 +107,10 @@ beforeEach(() => {
   vi.resetModules();
   mockIsEnterprise = "false";
   mockIsCloud = "false";
+  mockState.zoConfig = {};
+  mockRoute.name = "aiLLMInsights";
+  mockRoute.query = {};
+  mockRoute.meta = {};
 });
 
 describe("AIObservabilityShell — OSS builds (isEnterprise and isCloud both false)", () => {
@@ -177,7 +189,29 @@ describe("AIObservabilityShell — OSS builds (isEnterprise and isCloud both fal
   });
 });
 
-describe("AIObservabilityShell — enterprise/cloud builds", () => {
+const ALL_ITEM_KEYS = [
+  "llmInsights",
+  "sessions",
+  "agentGraph",
+  "agentBehavior",
+  "quality",
+  "jobs",
+  "scorers",
+  "scoreConfigs",
+  "prompts",
+  "playground",
+  "experiments",
+  "remoteTasks",
+  "discovery",
+  "queues",
+  "datasets",
+];
+
+describe("AIObservabilityShell — enterprise/cloud builds with online evaluations on", () => {
+  beforeEach(() => {
+    mockState.zoConfig = { version: "v1", online_evals_enabled: true };
+  });
+
   it("shows every group and every item, all unlocked, when isEnterprise is true", async () => {
     mockIsEnterprise = "true";
     const wrapper = await mountShell();
@@ -185,6 +219,7 @@ describe("AIObservabilityShell — enterprise/cloud builds", () => {
     expect(groups.map((g) => g.label)).toEqual(ALL_GROUP_LABELS);
     const monitorKeys = groups[0].items.map((i) => i.key);
     expect(monitorKeys).toEqual(["llmInsights", "sessions", "agentGraph", "agentBehavior"]);
+    expect(itemsOf(wrapper).map((i) => i.key)).toEqual(ALL_ITEM_KEYS);
     expect(itemsOf(wrapper).every((i) => !i.locked)).toBe(true);
   });
 
@@ -201,4 +236,67 @@ describe("AIObservabilityShell — enterprise/cloud builds", () => {
     ]);
     expect(itemsOf(wrapper).every((i) => !i.locked)).toBe(true);
   });
+
+  it("renders the page on an evaluation route", async () => {
+    mockIsEnterprise = "true";
+    mockRoute.name = "aiDatasets";
+    mockRoute.meta = { requiresOnlineEvals: true };
+    const wrapper = await mountShell();
+    expect(wrapper.find('[data-test="router-view"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="online-evals-disabled"]').exists()).toBe(false);
+  });
+});
+
+// O2_EVAL_ENABLED=false: evaluation sections leave the rail and deep links show the disabled state.
+describe("AIObservabilityShell — enterprise/cloud builds with online evaluations off", () => {
+  beforeEach(() => {
+    mockIsEnterprise = "true";
+    mockState.zoConfig = { version: "v1", online_evals_enabled: false };
+  });
+
+  it("lists only Monitor and Prompts — the sections whose APIs do not need evaluations", async () => {
+    const wrapper = await mountShell();
+    expect(groupsOf(wrapper).map((g) => g.label)).toEqual([
+      "aiObservability.sections.monitor",
+      "aiObservability.sections.experiment",
+    ]);
+    expect(itemsOf(wrapper).map((i) => i.key)).toEqual([
+      "llmInsights",
+      "sessions",
+      "agentGraph",
+      "agentBehavior",
+      "prompts",
+    ]);
+  });
+
+  it("renders the disabled state instead of the page on a deep link to an evaluation route", async () => {
+    mockRoute.name = "aiEvaluations";
+    mockRoute.query = { tab: "scorers" };
+    mockRoute.meta = { requiresOnlineEvals: true };
+    const wrapper = await mountShell();
+    expect(wrapper.find('[data-test="online-evals-disabled"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="router-view"]').exists()).toBe(false);
+  });
+
+  it("swaps the page for the disabled state and drops the sections when /config turns evaluations off", async () => {
+    mockState.zoConfig = { version: "v1", online_evals_enabled: true };
+    mockRoute.name = "aiExperiments";
+    mockRoute.meta = { requiresOnlineEvals: true };
+    const wrapper = await mountShell();
+    expect(wrapper.find('[data-test="router-view"]').exists()).toBe(true);
+    expect(wrapper.find('[data-rail-item="experiments"]').exists()).toBe(true);
+
+    mockState.zoConfig = { version: "v1", online_evals_enabled: false };
+    await nextTick();
+    expect(wrapper.find('[data-test="online-evals-disabled"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="router-view"]').exists()).toBe(false);
+    expect(wrapper.find('[data-rail-item="prompts"]').exists()).toBe(true);
+    expect(wrapper.find('[data-rail-item="experiments"]').exists()).toBe(false);
+  });
+
+  it("keeps every section, locked, on OSS — the edition gate applies there, not the flag", async () => {
+    mockIsEnterprise = "false";
+    const wrapper = await mountShell();
+    expect(itemsOf(wrapper).map((i) => i.key)).toEqual(ALL_ITEM_KEYS);
+  });
 });
diff --git a/web/src/enterprise/views/AIObservability/Index.vue b/web/src/enterprise/views/AIObservability/Index.vue
index 5fffd59d5b..b60d157de8 100644
--- a/web/src/enterprise/views/AIObservability/Index.vue
+++ b/web/src/enterprise/views/AIObservability/Index.vue
@@ -34,7 +34,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
     </template>
 
     <section class="h-full min-h-0 min-w-0 overflow-y-auto">
-      <router-view />
+      <OnlineEvalsDisabled v-if="onlineEvalsRouteOff" />
+      <router-view v-else />
     </section>
   </OPageLayout>
 </template>
@@ -50,7 +51,15 @@ import type { SectionHubGroup, SectionHubItem } from "@/components/common/Sectio
 import { navSection } from "./navSection";
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
 import { buildFeatureGateContext, checkFeatureAccess } from "@/utils/enterpriseFeatures";
-import { AI_OBSERVABILITY_SECTIONS } from "@/composables/shared/useAIObservabilityRoutes";
+import {
+  AI_OBSERVABILITY_SECTIONS,
+  ONLINE_EVAL_FEATURE_KEYS,
+} from "@/composables/shared/useAIObservabilityRoutes";
+import {
+  hidesOnlineEvalEntries,
+  useOnlineEvalsRouteOff,
+} from "@/composables/shared/useOnlineEvalsGate";
+import OnlineEvalsDisabled from "@/components/OnlineEvalsDisabled.vue";
 
 /** The same mark the primary nav uses for this module, so the collapsed rail
  *  still says which module it belongs to. */
@@ -95,6 +104,9 @@ const orgQuery = computed(() => ({
 
 const activeSection = computed<string>(() => navSection(route.name, route.query.tab));
 
+// A deep link to an evaluation page with evaluations off renders the disabled state instead.
+const onlineEvalsRouteOff = useOnlineEvalsRouteOff();
+
 // Single source of truth for the rail items (groups) AND the breadcrumb
 // switcher, derived from AI_OBSERVABILITY_SECTIONS — the SAME list the OSS
 // and enterprise routers build their /ai routes from (see
@@ -106,10 +118,17 @@ const activeSection = computed<string>(() => navSection(route.name, route.query.
 // Settings/IAM rail pattern.
 const sectionItems = computed<(SectionHubItem & { group: string })[]>(() => {
   const featureGateCtx = buildFeatureGateContext(store.state.zoConfig);
+  // With online evaluations off the server serves no evaluation sections, so drop them.
+  const hideEvalSections = hidesOnlineEvalEntries(store.state.zoConfig);
   // Memoized per featureKey, not per nav item — the four Evaluate entries
   // share one key and would otherwise recompute the same access check 4x.
   const accessByFeatureKey = new Map<string, ReturnType<typeof checkFeatureAccess>>();
-  return AI_OBSERVABILITY_SECTIONS.map((section) => {
+  const sections = hideEvalSections
+    ? AI_OBSERVABILITY_SECTIONS.filter(
+        (section) => !section.featureKey || !ONLINE_EVAL_FEATURE_KEYS[section.featureKey],
+      )
+    : AI_OBSERVABILITY_SECTIONS;
+  return sections.map((section) => {
     let locked: boolean | undefined;
     let lockedMessage: I18nText | undefined;
     if (section.featureKey) {
diff --git a/web/src/enterprise/views/AIObservability/LLMInsightsPage.vue b/web/src/enterprise/views/AIObservability/LLMInsightsPage.vue
index fa549d60a3..e9b67e44f3 100644
--- a/web/src/enterprise/views/AIObservability/LLMInsightsPage.vue
+++ b/web/src/enterprise/views/AIObservability/LLMInsightsPage.vue
@@ -105,10 +105,19 @@ const {
 
 async function onDateChange(value: any) {
   // Date state + URL sync is owned by useAiDateController; the page then re-fetches
-  // the dashboard with the resolved window.
+  // the dashboard with the resolved window. Only a user's own date pick forces and
+  // re-decides an auto mode for the new window; the window replay DateTime fires on
+  // mount must not bypass the caches (or the agents list would be fetched again on
+  // every entry).
   onDateStateChange(value);
   await nextTick();
-  dashboardRef.value?.refresh?.(timeRange.value.startTime, timeRange.value.endTime);
+  const userPicked = value?.userChangedValue === true;
+  dashboardRef.value?.refresh?.(
+    timeRange.value.startTime,
+    timeRange.value.endTime,
+    userPicked,
+    userPicked,
+  );
 }
 
 onMounted(() => {
diff --git a/web/src/enterprise/views/AIObservability/PlaygroundPage.spec.ts b/web/src/enterprise/views/AIObservability/PlaygroundPage.spec.ts
index b684a75456..d5c00085a8 100644
--- a/web/src/enterprise/views/AIObservability/PlaygroundPage.spec.ts
+++ b/web/src/enterprise/views/AIObservability/PlaygroundPage.spec.ts
@@ -9,6 +9,7 @@ const scorersList = vi.fn();
 const providersList = vi.fn();
 const datasetsList = vi.fn();
 const push = vi.fn();
+const routeQuery: Record<string, string> = {};
 const toast = vi.fn();
 
 vi.mock("@/services/llm-playground.service", async () => {
@@ -37,7 +38,7 @@ vi.mock("@/services/llm-datasets.service", async () => ({
 }));
 
 vi.mock("vue-router", () => ({
-  useRoute: () => ({ query: {} }),
+  useRoute: () => ({ query: routeQuery }),
   useRouter: () => ({ push }),
 }));
 
@@ -68,6 +69,8 @@ vi.mock("@/types/i18n", async () => {
 import PlaygroundPage from "./PlaygroundPage.vue";
 import { SINGLE_ROW_KEY, type PlaygroundSample } from "./playgroundDraft";
 import type { LlmDatasetItem } from "@/services/llm-datasets.service";
+import type { PromptConfig } from "@/services/llm-prompts.service";
+import { storePromptPlaygroundHandoff } from "@/views/AIObservability/promptPlaygroundHandoff";
 
 // Structural stubs: this spec is about the run engine and draft mutations, not
 // about how the shared components paint.
@@ -97,6 +100,7 @@ const stubs = {
   PlaygroundRowDrawer: true,
   PlaygroundSampleDialog: true,
   PlaygroundAddRowDialog: true,
+  SaveAsPromptDialog: true,
 };
 
 const PROVIDER = {
@@ -136,6 +140,9 @@ function vm(wrapper: Awaited<ReturnType<typeof mountPage>>) {
     totalCells: number;
     applySample: (sample: PlaygroundSample, item: LlmDatasetItem, notify?: boolean) => void;
     clearSample: () => void;
+    openSaveAsPrompt: (variantId: string) => void;
+    savePromptConfig: PromptConfig;
+    restoreDraft: (entry: unknown) => void;
   };
 }
 
@@ -513,6 +520,85 @@ describe("PlaygroundPage", () => {
     expect(scorePlayground).toHaveBeenCalledTimes(2);
     expect(scorePlayground.mock.calls[1][1].expectedOutput).toBe("the golden answer");
   });
+
+  describe("opened from a managed prompt", () => {
+    function openPrompt(config: PromptConfig) {
+      routeQuery.from = "prompt";
+      storePromptPlaygroundHandoff({
+        entityId: "prompt-1",
+        id: "version-row-1",
+        name: "triage",
+        version: 3,
+        payload: [{ role: "user", content: "Triage {{input}}" }],
+        config,
+        provenance: { type: "prompt", label: "triage@v3" },
+      });
+    }
+
+    const tuned: PromptConfig = {
+      model: "gpt-4o",
+      params: { temperature: 0.3, max_tokens: 256, top_p: 0.9, stop: ["###"] },
+      tools: null,
+      responseFormat: null,
+    };
+
+    afterEach(() => {
+      delete routeQuery.from;
+      sessionStorage.clear();
+    });
+
+    it("saves the version's settings back exactly as stored", async () => {
+      openPrompt(tuned);
+      const page = vm(await mountPage());
+
+      page.openSaveAsPrompt(page.draft.variants[0].id);
+
+      expect(page.savePromptConfig).toEqual(tuned);
+    });
+
+    // The bench seeds the provider default to run, but the saved prompt must not gain it.
+    it("saves a version with no settings without a temperature or the seeded model", async () => {
+      const bare: PromptConfig = { model: null, params: null, tools: null, responseFormat: null };
+      openPrompt(bare);
+      const page = vm(await mountPage());
+      expect(page.draft.variants[0].model).toBe("gpt-4o-mini");
+
+      page.openSaveAsPrompt(page.draft.variants[0].id);
+
+      expect(page.savePromptConfig).toEqual(bare);
+    });
+
+    it("keeps the seeded model out of a restored draft after the provider default changed", async () => {
+      const bare: PromptConfig = { model: null, params: null, tools: null, responseFormat: null };
+      openPrompt(bare);
+      const first = await mountPage();
+      const stored = JSON.parse(JSON.stringify(vm(first).draft));
+      first.unmount();
+      delete routeQuery.from;
+      providersList.mockResolvedValue([
+        { ...PROVIDER, availableModels: ["gpt-4o-mini", "gpt-4.1"], defaultModel: "gpt-4.1" },
+      ]);
+      const page = vm(await mountPage());
+
+      page.restoreDraft({ id: "d1", summary: "triage", models: [], savedAt: 0, draft: stored });
+      expect(page.draft.variants[0].model).toBe("gpt-4o-mini");
+      page.openSaveAsPrompt(page.draft.variants[0].id);
+
+      expect(page.savePromptConfig).toEqual(bare);
+    });
+
+    it("runs with every stored param, not just temperature", async () => {
+      openPrompt(tuned);
+      const page = vm(await mountPage());
+
+      page.onRunAll();
+      await flushPromises();
+
+      const request = runPlayground.mock.calls[0][1] as { model: string; params: unknown };
+      expect(request.model).toBe("gpt-4o");
+      expect(request.params).toEqual(tuned.params);
+    });
+  });
 });
 
 // The golden answer is scoring-only: the run never sends it, renderTemplate
diff --git a/web/src/enterprise/views/AIObservability/PlaygroundPage.vue b/web/src/enterprise/views/AIObservability/PlaygroundPage.vue
index 67053a4e87..c71f69e0ba 100644
--- a/web/src/enterprise/views/AIObservability/PlaygroundPage.vue
+++ b/web/src/enterprise/views/AIObservability/PlaygroundPage.vue
@@ -325,7 +325,10 @@ import PlaygroundVariableBar from "@/enterprise/components/AIObservability/Playg
 import PlaygroundVariantColumn from "@/enterprise/components/AIObservability/PlaygroundVariantColumn.vue";
 import SaveAsPromptDialog from "@/views/AIObservability/SaveAsPromptDialog.vue";
 import type { PromptConfig } from "@/services/llm-prompts.service";
-import onlineEvalsService, { type Provider, type Scorer } from "@/services/online-evals.service";
+import { type Provider, type Scorer } from "@/services/online-evals.service";
+import { providersQuery, scorersQuery } from "@/services/online-evals.service.queries";
+import { llmDatasetsQuery } from "@/services/llm-datasets.service.queries";
+import { queryClient } from "@/composables/query/queryClient";
 import { entityId } from "@/enterprise/components/onlineEvals/utils/evalEntity";
 import llmDatasetsService, {
   inputFieldVariables,
@@ -353,13 +356,17 @@ import {
   hasReference as benchHasReference,
   idleCell,
   playgroundId,
+  promptConfigFor,
   requestMessages,
   renderTemplate,
+  runParams,
   scorerEvidence,
+  seedModel,
   settledResults,
   snapshotPayload,
   starterDraft,
   variantLabel,
+  variantSettingsFromPrompt,
   withSampledVars,
   type PlaygroundCell,
   type PlaygroundDraft,
@@ -413,20 +420,8 @@ const savePromptPayload = computed(() =>
 const savePromptConfig = computed<PromptConfig>(() => {
   const variant = savePromptVariant.value;
   if (!variant) return { model: null, params: null, tools: null, responseFormat: null };
-  const temperature = Number(variant.temperature);
-  return {
-    model: variant.model || null,
-    params: Number.isFinite(temperature) ? { temperature } : null,
-    tools: variant.tools.map((tool) => ({
-      type: "function",
-      function: {
-        name: tool.name,
-        description: tool.description,
-        parameters: parsePromptJson(tool.parameters) ?? {},
-      },
-    })),
-    responseFormat: variant.responseSchema ? parsePromptJson(variant.responseSchema) : null,
-  };
+  const provider = providers.value.find((candidate) => candidate.id === variant.providerId);
+  return promptConfigFor(variant, provider ? providerDefaultModel(provider) : "");
 });
 
 /** The snapshot this bench descends from — the link it was opened on, or the
@@ -561,10 +556,12 @@ onBeforeUnmount(() => {
   stopAll();
 });
 
+// The three lists are the org's shared cache entries (Evaluations and Datasets read the same
+// ones), so a revisit inside their stale time costs no request; every write invalidates them.
 async function loadProviders() {
   loadingProviders.value = true;
   try {
-    providers.value = chatProviders(await onlineEvalsService.providers.list(orgId.value));
+    providers.value = chatProviders(await queryClient.fetchQuery(providersQuery(orgId.value)));
     seedDefaultProvider();
   } catch {
     toast({ variant: "error", message: t("aiObservability.playground.providerLoadError") });
@@ -576,7 +573,7 @@ async function loadProviders() {
 /** A failure here costs scoring, not the bench — the menu simply lists none. */
 async function loadScorers() {
   try {
-    scorers.value = await onlineEvalsService.scorers.list(orgId.value);
+    scorers.value = await queryClient.fetchQuery(scorersQuery(orgId.value));
   } catch {
     toast({ variant: "error", message: t("aiObservability.playground.scorerLoadError") });
   }
@@ -584,12 +581,17 @@ async function loadScorers() {
 
 async function loadDatasets() {
   try {
-    datasets.value = await llmDatasetsService.list(orgId.value);
+    datasets.value = await queryClient.fetchQuery(llmDatasetsQuery(orgId.value));
   } catch {
     toast({ variant: "error", message: t("aiObservability.playground.datasetLoadError") });
   }
 }
 
+/** The model a provider runs when none is named — also what the bench seeds. */
+function providerDefaultModel(provider: Provider): string {
+  return provider.defaultModel ?? provider.default_model ?? "";
+}
+
 /** A first variant with no provider cannot run, and picking one for the user is
  *  never wrong when there is exactly one sensible answer. */
 function seedDefaultProvider() {
@@ -606,7 +608,7 @@ function seedDefaultProvider() {
       : null;
     const selected = supporting ?? preferred;
     variant.providerId = selected.id;
-    if (!variant.model) variant.model = selected.defaultModel ?? selected.default_model ?? "";
+    seedModel(variant, providerDefaultModel(selected));
   }
 }
 
@@ -631,25 +633,6 @@ function promptMessages(payload: unknown): PlaygroundMessage[] {
   });
 }
 
-function promptTools(value: unknown): PlaygroundTool[] {
-  if (!Array.isArray(value)) return [];
-  return value.flatMap((entry): PlaygroundTool[] => {
-    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return [];
-    const candidate =
-      "function" in entry &&
-      entry.function &&
-      typeof entry.function === "object" &&
-      !Array.isArray(entry.function)
-        ? entry.function
-        : entry;
-    const name = "name" in candidate ? String(candidate.name ?? "") : "";
-    if (!name) return [];
-    const description = "description" in candidate ? String(candidate.description ?? "") : "";
-    const parameters = "parameters" in candidate ? candidate.parameters : {};
-    return [{ name, description, parameters: JSON.stringify(parameters ?? {}, null, 2) }];
-  });
-}
-
 /**
  * Loads a trace or managed Prompt into a fresh editable fork. Prompt content
  * stays in one-shot session storage and never appears in browser history.
@@ -661,15 +644,7 @@ function applyHandoff() {
     if (!handoff) return;
     const variant = emptyVariant();
     variant.messages = promptMessages(handoff.payload);
-    variant.model = handoff.config.model ?? "";
-    const params = handoff.config.params;
-    variant.temperature =
-      params && typeof params.temperature === "number" ? String(params.temperature) : "";
-    variant.tools = promptTools(handoff.config.tools);
-    variant.responseSchema =
-      handoff.config.responseFormat == null
-        ? null
-        : JSON.stringify(handoff.config.responseFormat, null, 2);
+    Object.assign(variant, variantSettingsFromPrompt(handoff.config));
     Object.assign(draft, starterDraft());
     draft.variants = [variant];
     draft.provenance = { type: "prompt", label: raw(handoff.provenance.label) };
@@ -763,7 +738,7 @@ async function runCell(variant: PlaygroundVariant, rowKey: string): Promise<bool
         providerType: provider?.providerType ?? provider?.provider_type,
         model: variant.model,
         messages,
-        params: { temperature: Number(variant.temperature) || 0 },
+        params: runParams(variant),
         tools: variant.tools.map((tool) => ({
           name: tool.name,
           description: tool.description,
@@ -1240,16 +1215,6 @@ function goToProviders() {
   router.push({ name: "llmProviders" });
 }
 
-/** The one durable exit. Everything the experiment form needs travels in the
- *  query, so the handoff survives a full page load. */
-function parsePromptJson(value: string): unknown | null {
-  try {
-    return JSON.parse(value) as unknown;
-  } catch {
-    return null;
-  }
-}
-
 function openSaveAsPrompt(variantId: string) {
   const variant = draft.variants.find((candidate) => candidate.id === variantId);
   if (!variant) return;
@@ -1257,6 +1222,7 @@ function openSaveAsPrompt(variantId: string) {
   savePromptOpen.value = true;
 }
 
+/** The one durable exit, carrying the experiment form's inputs in the query to survive a reload. */
 function createExperiment(variantId: string) {
   const variant = draft.variants.find((candidate) => candidate.id === variantId);
   if (!variant) return;
diff --git a/web/src/enterprise/views/AIObservability/SessionsPage.vue b/web/src/enterprise/views/AIObservability/SessionsPage.vue
index 1d8d85557a..0736808165 100644
--- a/web/src/enterprise/views/AIObservability/SessionsPage.vue
+++ b/web/src/enterprise/views/AIObservability/SessionsPage.vue
@@ -104,12 +104,15 @@ async function onDateChange(value: any) {
   await nextTick();
   // `userChangedValue` distinguishes a genuine user date pick from the
   // programmatic window replay DateTime fires on every mount. Only the former
-  // forces a re-fetch; the mount replay lets SessionsList restore its cached
-  // list (so returning from a session detail doesn't re-hit the API).
+  // forces a re-fetch and re-decides an auto mode for the new window; the mount
+  // replay lets SessionsList restore its cached list (so returning from a
+  // session detail doesn't re-hit the API).
+  const userPicked = value?.userChangedValue === true;
   sessionsRef.value?.refresh?.(
     timeRange.value.startTime,
     timeRange.value.endTime,
-    value?.userChangedValue === true,
+    userPicked,
+    userPicked,
   );
 }
 
diff --git a/web/src/enterprise/views/AIObservability/experimentDiscovery.spec.ts b/web/src/enterprise/views/AIObservability/experimentDiscovery.spec.ts
index 56fb4089cf..3e935fdd46 100644
--- a/web/src/enterprise/views/AIObservability/experimentDiscovery.spec.ts
+++ b/web/src/enterprise/views/AIObservability/experimentDiscovery.spec.ts
@@ -14,7 +14,13 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { describe, expect, it } from "vitest";
-import { comparisonEligibility, experimentEvidence, groupExperiments } from "./experimentDiscovery";
+import {
+  comparisonEligibility,
+  experimentCostText,
+  experimentEvidence,
+  groupExperiments,
+} from "./experimentDiscovery";
+import type { TranslateFn } from "@/types/i18n";
 import { makeExperiment } from "./experimentTestFixtures";
 
 const experiment = (id: string, datasetId: string, createdAt: number) =>
@@ -124,6 +130,7 @@ describe("experiment discovery", () => {
       completedSlots: 1,
       totalSlots: 2,
       cost: null,
+      costIncomplete: false,
       scores: [
         { name: "quality", kind: "numeric", value: 0.75, sampleCount: 2 },
         { name: "approved", kind: "boolean", trueCount: 1, falseCount: 1, sampleCount: 2 },
@@ -139,4 +146,17 @@ describe("experiment discovery", () => {
       ],
     });
   });
+
+  it("reads an incomplete cost as a floor, and a zero floor as unknown rather than free", () => {
+    const t = ((key: string, named?: { cost?: string }) =>
+      named?.cost ? `${key}:${named.cost}` : key) as unknown as TranslateFn;
+    expect(experimentCostText(null, false, t)).toBe("—");
+    expect(experimentCostText(0, false, t)).toBe("$0.0000");
+    expect(experimentCostText(0.12, false, t)).toBe("$0.1200");
+    expect(experimentCostText(0.12, true, t)).toBe(
+      "aiObservability.experiments.costAtLeast:$0.1200",
+    );
+    expect(experimentCostText(0, true, t)).toBe("aiObservability.experiments.costUnknown");
+    expect(experimentCostText(null, true, t)).toBe("aiObservability.experiments.costUnknown");
+  });
 });
diff --git a/web/src/enterprise/views/AIObservability/experimentDiscovery.ts b/web/src/enterprise/views/AIObservability/experimentDiscovery.ts
index 48ea4d6f49..da67089f64 100644
--- a/web/src/enterprise/views/AIObservability/experimentDiscovery.ts
+++ b/web/src/enterprise/views/AIObservability/experimentDiscovery.ts
@@ -14,6 +14,7 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import type { LlmExperiment } from "@/services/llm-experiments.service";
+import { raw, type I18nText, type TranslateFn } from "@/types/i18n";
 
 export type ExperimentScoreSummary =
   | { name: string; kind: "numeric"; value: number; sampleCount: number }
@@ -35,9 +36,52 @@ export interface ExperimentEvidence {
   completedSlots: number;
   totalSlots: number;
   cost: number | null;
+  /** A task or judge call had no price, so `cost` is a lower bound (or unknown). */
+  costIncomplete: boolean;
   scores: ExperimentScoreSummary[];
 }
 
+/** How a run's cost reads: an unpriced call makes the total a floor, and a
+ *  floor of zero says nothing, so it reads as unknown rather than $0. */
+export type ExperimentCostDisplay =
+  | { kind: "none" }
+  | { kind: "exact"; value: number }
+  | { kind: "atLeast"; value: number }
+  | { kind: "unknown" };
+
+export function experimentCostDisplay(
+  cost: number | null | undefined,
+  incomplete: boolean | null | undefined,
+): ExperimentCostDisplay {
+  if (!incomplete) {
+    return cost === null || cost === undefined ? { kind: "none" } : { kind: "exact", value: cost };
+  }
+  return cost !== null && cost !== undefined && cost > 0
+    ? { kind: "atLeast", value: cost }
+    : { kind: "unknown" };
+}
+
+/** The cost text the experiment list and detail page both show. */
+export function experimentCostText(
+  cost: number | null | undefined,
+  incomplete: boolean | null | undefined,
+  t: TranslateFn,
+): I18nText {
+  const display = experimentCostDisplay(cost, incomplete);
+  switch (display.kind) {
+    case "none":
+      return raw("—");
+    case "exact":
+      return raw(`$${display.value.toFixed(4)}`);
+    case "atLeast":
+      return t("aiObservability.experiments.costAtLeast", {
+        cost: `$${display.value.toFixed(4)}`,
+      });
+    case "unknown":
+      return t("aiObservability.experiments.costUnknown");
+  }
+}
+
 export interface ExperimentDatasetGroup {
   datasetId: string;
   datasetName: string;
@@ -85,6 +129,7 @@ export function experimentEvidence(experiment: LlmExperiment): ExperimentEvidenc
     completedSlots: experiment.executionProgress?.completed ?? 0,
     totalSlots: experiment.executionProgress?.total ?? 0,
     cost: experiment.aggregateSummary?.totalCost ?? null,
+    costIncomplete: experiment.aggregateSummary?.costIncomplete ?? false,
     scores,
   };
 }
diff --git a/web/src/enterprise/views/AIObservability/experimentProviderCheck.spec.ts b/web/src/enterprise/views/AIObservability/experimentProviderCheck.spec.ts
new file mode 100644
index 0000000000..92b2411c96
--- /dev/null
+++ b/web/src/enterprise/views/AIObservability/experimentProviderCheck.spec.ts
@@ -0,0 +1,102 @@
+// Copyright 2026 OpenObserve Inc.
+
+import { describe, expect, it, vi } from "vitest";
+import type { Provider, Scorer } from "@/services/online-evals.service";
+import { checkRunProviders, runProviderIds } from "./experimentProviderCheck";
+import { experimentCostDisplay } from "./experimentDiscovery";
+
+const judge = (entityId: string, providerId: string) =>
+  ({
+    id: entityId,
+    entityId,
+    name: entityId,
+    scorerType: "llm_judge",
+    params: { provider_id: providerId },
+  }) as unknown as Scorer;
+const codeScorer = {
+  id: "code",
+  entityId: "code",
+  name: "code",
+  scorerType: "code",
+} as unknown as Scorer;
+const provider = (id: string, name: string) =>
+  ({ id, name, providerType: "openai", defaultModel: "m" }) as Provider;
+
+describe("runProviderIds", () => {
+  it("tests the task provider first, then each distinct judge provider", () => {
+    expect(
+      runProviderIds({
+        taskType: "inline_prompt",
+        providerId: "task-p",
+        scorerIds: ["a", "b", "code"],
+        scorers: [judge("a", "judge-p"), judge("b", "task-p"), codeScorer],
+      }),
+    ).toEqual(["task-p", "judge-p"]);
+  });
+
+  it("leaves the task provider out of a Remote Task run", () => {
+    expect(
+      runProviderIds({
+        taskType: "remote",
+        providerId: "task-p",
+        scorerIds: ["a"],
+        scorers: [judge("a", "judge-p")],
+      }),
+    ).toEqual(["judge-p"]);
+  });
+});
+
+describe("checkRunProviders", () => {
+  it("reports the first failing provider with the server reason", async () => {
+    const test = vi.fn(async (_payload, id: string) => {
+      if (id === "task-p") {
+        throw { response: { data: { message: "Provider connection test failed" } } };
+      }
+      return "ok";
+    });
+    const failure = await checkRunProviders(
+      ["task-p", "judge-p"],
+      [provider("task-p", "acme-internal"), provider("judge-p", "openai")],
+      test,
+      "task-p",
+    );
+    expect(test).toHaveBeenCalledTimes(2);
+    expect(test.mock.calls[0][0].authConfig).toEqual({ api_key: "" });
+    expect(failure).toEqual({
+      providerId: "task-p",
+      providerName: "acme-internal",
+      task: true,
+      message: "Provider connection test failed",
+    });
+  });
+
+  it("passes when every provider answers and fails on an unknown provider", async () => {
+    const test = vi.fn(async () => "ok");
+    expect(await checkRunProviders(["p"], [provider("p", "p")], test)).toBeNull();
+    const missing = await checkRunProviders(["gone"], [], test);
+    expect(missing?.providerId).toBe("gone");
+    expect(test).toHaveBeenCalledTimes(1);
+  });
+
+  it("does not fail a provider missing from a list that could not be loaded", async () => {
+    const test = vi.fn(async () => "ok");
+    expect(await checkRunProviders(["gone"], [], test, null, false)).toBeNull();
+    expect(test).not.toHaveBeenCalled();
+    // Providers present in the fallback list are still tested, and still fail.
+    const down = vi.fn(async () => {
+      throw new Error("down");
+    });
+    const failure = await checkRunProviders(["p"], [provider("p", "p")], down, "p", false);
+    expect(failure?.providerId).toBe("p");
+  });
+});
+
+describe("experimentCostDisplay", () => {
+  it("never shows an incomplete zero as a price", () => {
+    expect(experimentCostDisplay(0.12, false)).toEqual({ kind: "exact", value: 0.12 });
+    expect(experimentCostDisplay(0.12, true)).toEqual({ kind: "atLeast", value: 0.12 });
+    expect(experimentCostDisplay(0, true)).toEqual({ kind: "unknown" });
+    expect(experimentCostDisplay(null, true)).toEqual({ kind: "unknown" });
+    expect(experimentCostDisplay(null, false)).toEqual({ kind: "none" });
+  });
+});
diff --git a/web/src/enterprise/views/AIObservability/experimentProviderCheck.ts b/web/src/enterprise/views/AIObservability/experimentProviderCheck.ts
new file mode 100644
index 0000000000..1a75074168
--- /dev/null
+++ b/web/src/enterprise/views/AIObservability/experimentProviderCheck.ts
@@ -0,0 +1,119 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Create & run tests every LLM provider the run will call before it creates
+// anything, with the same request Test Connection sends from provider
+// settings. A run against an unreachable provider otherwise fails every slot.
+
+import type { Provider, ProviderPayload, Scorer } from "@/services/online-evals.service";
+import {
+  availableModelsOf,
+  defaultModelOf,
+  entityId,
+  providerTypeOf,
+  scorerTypeOf,
+} from "@/enterprise/components/onlineEvals/utils/evalEntity";
+
+export interface RunProviderInput {
+  taskType: string;
+  providerId?: string | null;
+  scorerIds: string[];
+  scorers: Scorer[];
+}
+
+export interface ProviderCheckFailure {
+  providerId: string;
+  /** Provider name when known; the id otherwise. */
+  providerName: string;
+  /** Whether the provider is the task's own rather than a judge's. */
+  task: boolean;
+  /** Server reason, when it sent one. */
+  message: string;
+}
+
+/** The provider ids the run calls: the task's own (inline or managed prompt;
+ *  a Remote Task has its own connection test) and each selected LLM judge's.
+ *  The task provider comes first so its failure is the one reported. */
+export function runProviderIds(input: RunProviderInput): string[] {
+  const ids: string[] = [];
+  const add = (id: unknown) => {
+    const value = typeof id === "string" ? id.trim() : "";
+    if (value && !ids.includes(value)) ids.push(value);
+  };
+  if (input.taskType !== "remote") add(input.providerId);
+  for (const id of input.scorerIds) {
+    const scorer = input.scorers.find((candidate) => entityId(candidate) === id);
+    if (!scorer || scorerTypeOf(scorer) !== "llm_judge") continue;
+    add(scorer.params?.provider_id ?? scorer.params?.providerId);
+  }
+  return ids;
+}
+
+/** The stored provider as Test Connection would submit it. The blank API key
+ *  makes the server use the stored secret for `providerId`. */
+export function providerTestPayload(provider: Provider): ProviderPayload {
+  return {
+    name: provider.name,
+    providerType: providerTypeOf(provider) ?? "",
+    endpoint: provider.endpoint ?? null,
+    defaultModel: defaultModelOf(provider) ?? "",
+    availableModels: availableModelsOf(provider) ?? [],
+    authConfig: { api_key: "" },
+    isDefault: false,
+  };
+}
+
+/** Tests every provider in `ids` in parallel and returns the first failure in
+ *  `ids` order, or null when all answered. With a fresh list (`listLoaded`), a
+ *  provider missing from `providers` fails the check: the run could not call it
+ *  either. When the list could not be loaded, a provider absent from the
+ *  fallback list is unknown rather than missing, so it is neither tested nor
+ *  failed; the server still checks it when the run starts. */
+export async function checkRunProviders(
+  ids: string[],
+  providers: Provider[],
+  test: (payload: ProviderPayload, providerId: string) => Promise<unknown>,
+  taskProviderId?: string | null,
+  listLoaded = true,
+): Promise<ProviderCheckFailure | null> {
+  const results = await Promise.allSettled(
+    ids.map((id) => {
+      const provider = providers.find((candidate) => candidate.id === id);
+      if (!provider) return listLoaded ? Promise.reject(new Error("")) : Promise.resolve();
+      return test(providerTestPayload(provider), id);
+    }),
+  );
+  for (const [index, result] of results.entries()) {
+    if (result.status === "fulfilled") continue;
+    const id = ids[index];
+    return {
+      providerId: id,
+      providerName: providers.find((candidate) => candidate.id === id)?.name ?? id,
+      task: id === taskProviderId,
+      message: failureMessage(result.reason),
+    };
+  }
+  return null;
+}
+
+/** The server's message from an Axios-style error, else the error's own. */
+function failureMessage(reason: unknown): string {
+  if (!reason || typeof reason !== "object") return "";
+  if ("response" in reason) {
+    const data = (reason.response as { data?: { message?: unknown } } | undefined)?.data;
+    if (typeof data?.message === "string" && data.message) return data.message;
+  }
+  return reason instanceof Error ? reason.message : "";
+}
diff --git a/web/src/enterprise/views/AIObservability/experimentTestFixtures.ts b/web/src/enterprise/views/AIObservability/experimentTestFixtures.ts
index 5f95f1a42a..3b01f4385f 100644
--- a/web/src/enterprise/views/AIObservability/experimentTestFixtures.ts
+++ b/web/src/enterprise/views/AIObservability/experimentTestFixtures.ts
@@ -23,6 +23,7 @@ export function makeExperiment(overrides: Partial<LlmExperiment> = {}): LlmExper
     datasetId: "dataset-a",
     datasetName: "Dataset A",
     datasetVersion: 1,
+    datasetWriteVersion: 1,
     task: { type: "remote", taskRef: "summarizer@1" },
     scorers: [],
     trialCount: 1,
diff --git a/web/src/enterprise/views/AIObservability/playgroundDraft.spec.ts b/web/src/enterprise/views/AIObservability/playgroundDraft.spec.ts
index 39003a38a3..58ef04252f 100644
--- a/web/src/enterprise/views/AIObservability/playgroundDraft.spec.ts
+++ b/web/src/enterprise/views/AIObservability/playgroundDraft.spec.ts
@@ -13,12 +13,16 @@ import {
   moveMessage,
   nextMessageRole,
   playgroundId,
+  promptConfigFor,
   renderTemplate,
   renderedMessages,
+  runParams,
   scorerEvidence,
+  seedModel,
   snapshotPayload,
   starterDraft,
   variantLabel,
+  variantSettingsFromPrompt,
   withFieldInserted,
   withRole,
   withSampledVars,
@@ -26,6 +30,7 @@ import {
   type PlaygroundResults,
   type PlaygroundVariant,
 } from "./playgroundDraft";
+import type { PromptConfig } from "@/services/llm-prompts.service";
 
 function variantWith(contents: string[]): PlaygroundVariant {
   const variant = emptyVariant("provider-1", "gpt-4o-mini");
@@ -277,6 +282,170 @@ describe("snapshots", () => {
   });
 });
 
+describe("prompt config round trip", () => {
+  const tuned: PromptConfig = {
+    model: "gpt-4o",
+    params: { temperature: 0.3, max_tokens: 256, top_p: 0.9, stop: ["###", "END"], seed: 7 },
+    tools: [
+      {
+        type: "function",
+        function: { name: "lookup", description: "Find it", parameters: { type: "object" } },
+        strict: true,
+      },
+    ],
+    responseFormat: { type: "json_object" },
+  };
+  const bare: PromptConfig = { model: null, params: null, tools: null, responseFormat: null };
+
+  function opened(config: PromptConfig): PlaygroundVariant {
+    return { ...emptyVariant(), ...variantSettingsFromPrompt(config) };
+  }
+
+  it("saves an untouched prompt back exactly as stored, unknown keys included", () => {
+    expect(promptConfigFor(opened(tuned), "gpt-4o-mini")).toEqual(tuned);
+  });
+
+  // Session, recent drafts and snapshots all store the draft as JSON.
+  it("still saves it back exactly after the draft is stored and restored", () => {
+    const restored = JSON.parse(JSON.stringify(opened(tuned))) as PlaygroundVariant;
+    expect(promptConfigFor(restored, "gpt-4o-mini")).toEqual(tuned);
+  });
+
+  it("adds no temperature and no seeded default model to a prompt that had neither", () => {
+    const variant = opened(bare);
+    expect(variant.temperature).toBe("");
+    // What seeding the default provider does to the bench.
+    variant.providerId = "p1";
+    seedModel(variant, "gpt-4o-mini");
+
+    expect(variant.model).toBe("gpt-4o-mini");
+    expect(promptConfigFor(variant, "gpt-4o-mini")).toEqual(bare);
+  });
+
+  it("leaves the seeded model out even after the provider's default changes", () => {
+    const variant = opened(bare);
+    seedModel(variant, "gpt-4o-mini");
+
+    expect(promptConfigFor(variant, "gpt-4.1").model).toBeNull();
+    // Providers not loaded yet, or the provider was deleted.
+    expect(promptConfigFor(variant).model).toBeNull();
+  });
+
+  it("leaves the seeded model out of a draft stored and restored as JSON", () => {
+    const variant = opened(bare);
+    seedModel(variant, "gpt-4o-mini");
+    const restored = JSON.parse(JSON.stringify(variant)) as PlaygroundVariant;
+
+    expect(promptConfigFor(restored, "gpt-4.1")).toEqual(bare);
+  });
+
+  it("saves a model the user picked over the seeded one", () => {
+    const variant = opened(bare);
+    seedModel(variant, "gpt-4o-mini");
+    variant.model = "gpt-4.1";
+
+    expect(promptConfigFor(variant, "gpt-4o-mini").model).toBe("gpt-4.1");
+  });
+
+  it("saves the current default picked for a prompt that was never seeded", () => {
+    const variant = opened(bare);
+    variant.model = "gpt-4o-mini";
+
+    expect(promptConfigFor(variant, "gpt-4o-mini").model).toBe("gpt-4o-mini");
+  });
+
+  it("does not seed over a model the prompt names", () => {
+    const variant = opened(tuned);
+    seedModel(variant, "gpt-4o-mini");
+
+    expect(variant.model).toBe("gpt-4o");
+    expect(promptConfigFor(variant, "gpt-4o-mini").model).toBe("gpt-4o");
+  });
+
+  // Drafts stored before the seeded model was recorded carry no `seededModel`.
+  it("treats the current default as seeded in a draft that never recorded one", () => {
+    const legacy = opened(bare);
+    delete legacy.promptBasis?.seededModel;
+    legacy.model = "gpt-4o-mini";
+    const restored = JSON.parse(JSON.stringify(legacy)) as PlaygroundVariant;
+
+    expect(promptConfigFor(restored, "gpt-4o-mini").model).toBeNull();
+    expect(promptConfigFor(restored, "gpt-4.1").model).toBe("gpt-4o-mini");
+  });
+
+  it("writes back what the user edited and nothing else", () => {
+    const variant = opened(tuned);
+    variant.temperature = "0.8";
+    variant.model = "gpt-4.1";
+    variant.tools = [{ name: "search", description: "", parameters: "{}" }];
+
+    expect(promptConfigFor(variant, "gpt-4o-mini")).toEqual({
+      ...tuned,
+      model: "gpt-4.1",
+      params: { ...tuned.params, temperature: 0.8 },
+      tools: [{ type: "function", function: { name: "search", description: "", parameters: {} } }],
+    });
+  });
+
+  it("keeps a model picked for a prompt that named none", () => {
+    const variant = opened(bare);
+    variant.model = "gpt-4.1";
+    expect(promptConfigFor(variant, "gpt-4o-mini").model).toBe("gpt-4.1");
+  });
+
+  it("drops a temperature the user cleared", () => {
+    const variant = opened(tuned);
+    variant.temperature = "";
+    const { temperature: _temperature, ...rest } = tuned.params ?? {};
+    expect(promptConfigFor(variant).params).toEqual(rest);
+  });
+
+  it("saves a non-numeric temperature verbatim but leaves it out of the run", () => {
+    const variant = opened({ ...bare, params: { temperature: "0.3" } });
+    expect(variant.temperature).toBe("");
+    expect(promptConfigFor(variant).params).toEqual({ temperature: "0.3" });
+    expect(runParams(variant)).toEqual({});
+  });
+
+  it("saves null sampling params verbatim but leaves them out of the run", () => {
+    const stored = { temperature: null, max_tokens: null, top_p: 0.9 };
+    const variant = opened({ ...bare, params: stored });
+    expect(promptConfigFor(variant).params).toEqual(stored);
+    expect(runParams(variant)).toEqual({ top_p: 0.9 });
+  });
+
+  it("runs only max tokens the server accepts, preferring max_tokens", () => {
+    const run = (params: Record<string, unknown>) => runParams(opened({ ...bare, params }));
+    expect(run({ max_tokens: "256" })).toEqual({});
+    expect(run({ maxTokens: -1 })).toEqual({});
+    expect(run({ max_tokens: 1.5 })).toEqual({});
+    expect(run({ maxTokens: 128 })).toEqual({ maxTokens: 128 });
+    expect(run({ max_tokens: 256, maxTokens: 128 })).toEqual({ max_tokens: 256 });
+    expect(run({ max_tokens: "x", maxTokens: 128 })).toEqual({ maxTokens: 128 });
+  });
+
+  it("runs with every stored param", () => {
+    expect(runParams(opened(tuned))).toEqual(tuned.params);
+  });
+
+  it("runs without a temperature when none is set, leaving the server's default", () => {
+    expect(runParams(opened(bare))).toEqual({});
+  });
+
+  // Drafts stored before params were carried have only the temperature field.
+  it("runs and saves a variant that carries no params", () => {
+    const variant = emptyVariant("p1", "gpt-4o-mini");
+    variant.temperature = "0.5";
+    expect(runParams(variant)).toEqual({ temperature: 0.5 });
+    expect(promptConfigFor(variant, "gpt-4o-mini")).toEqual({
+      model: "gpt-4o-mini",
+      params: { temperature: 0.5 },
+      tools: [],
+      responseFormat: null,
+    });
+  });
+});
+
 describe("adoptIds", () => {
   it("pushes the counter past ids an earlier page load already spent", () => {
     const restored = JSON.parse(
diff --git a/web/src/enterprise/views/AIObservability/playgroundDraft.ts b/web/src/enterprise/views/AIObservability/playgroundDraft.ts
index 7736607edb..b1af1d2dfd 100644
--- a/web/src/enterprise/views/AIObservability/playgroundDraft.ts
+++ b/web/src/enterprise/views/AIObservability/playgroundDraft.ts
@@ -13,6 +13,7 @@ import type {
   PlaygroundRequestMessage,
   PlaygroundScoreResult,
 } from "@/services/llm-playground.service";
+import type { PromptConfig } from "@/services/llm-prompts.service";
 import { TEMPLATE_VARIABLE_NAME_SOURCE } from "@/services/llm-datasets.service";
 
 /** Golden answers feed scorers only. Binding one into a task prompt would leak
@@ -51,15 +52,31 @@ export interface PlaygroundTool {
   parameters: string;
 }
 
+/** Prompt-stored bench settings, kept so saving back can tell an untouched setting from an edit. */
+interface PlaygroundPromptBasis {
+  /** Null when the prompt names no model and the provider's default runs it. */
+  model: string | null;
+  /** `config.tools` exactly as stored, `null` included. */
+  tools: unknown;
+  /** For a prompt naming no model: the provider default the bench filled in, so
+   *  saving back writes null for it whatever the provider's default is by then.
+   *  Null until seeded; absent on drafts stored before it was recorded. */
+  seededModel?: string | null;
+}
+
 export interface PlaygroundVariant {
   id: string;
   providerId: string;
   model: string;
-  /** Free text: the field accepts anything and is coerced when the run is built. */
+  /** Free text coerced at run time, where blank leaves it to the server's default. */
   temperature: string;
+  /** Sampling params except `temperature`, carried verbatim from the source prompt to every run. */
+  params?: Record<string, unknown> | null;
   messages: PlaygroundMessage[];
   tools: PlaygroundTool[];
   responseSchema: string | null;
+  /** The managed prompt this variant was opened from, if any. */
+  promptBasis?: PlaygroundPromptBasis;
 }
 
 /** Where the loaded `vars` came from, and where it sits in the dataset so the
@@ -301,6 +318,131 @@ export function withFieldInserted(variant: PlaygroundVariant, field: string): Pl
   };
 }
 
+// ── prompt config ─────────────────────────────────────────────────
+
+/** A prompt's tool definitions in editable form, from OpenAI `{ type, function }` or flat shape. */
+function promptTools(value: unknown): PlaygroundTool[] {
+  if (!Array.isArray(value)) return [];
+  return value.flatMap((entry): PlaygroundTool[] => {
+    if (!entry || typeof entry !== "object" || Array.isArray(entry)) return [];
+    const candidate =
+      "function" in entry &&
+      entry.function &&
+      typeof entry.function === "object" &&
+      !Array.isArray(entry.function)
+        ? entry.function
+        : entry;
+    const name = "name" in candidate ? String(candidate.name ?? "") : "";
+    if (!name) return [];
+    const description = "description" in candidate ? String(candidate.description ?? "") : "";
+    const parameters = "parameters" in candidate ? candidate.parameters : {};
+    return [{ name, description, parameters: JSON.stringify(parameters ?? {}, null, 2) }];
+  });
+}
+
+/** Variant settings from a prompt config, moving only a numeric temperature into its own field. */
+export function variantSettingsFromPrompt(
+  config: PromptConfig,
+): Pick<
+  PlaygroundVariant,
+  "model" | "temperature" | "params" | "tools" | "responseSchema" | "promptBasis"
+> {
+  const stored = config.params ?? null;
+  const lifted = typeof stored?.temperature === "number";
+  const params: Record<string, unknown> | null = stored && { ...stored };
+  if (params && lifted) delete params.temperature;
+  return {
+    model: config.model ?? "",
+    temperature: lifted ? String(stored?.temperature) : "",
+    params,
+    tools: promptTools(config.tools),
+    responseSchema:
+      config.responseFormat == null ? null : JSON.stringify(config.responseFormat, null, 2),
+    promptBasis:
+      config.model == null
+        ? { model: null, tools: config.tools ?? null, seededModel: null }
+        : { model: config.model, tools: config.tools ?? null },
+  };
+}
+
+/** Fills a blank model with the provider's default, remembering it when it
+ *  stands in for a prompt that named none. */
+export function seedModel(variant: PlaygroundVariant, model: string): void {
+  if (variant.model || !model) return;
+  variant.model = model;
+  if (variant.promptBasis && variant.promptBasis.model == null) {
+    variant.promptBasis.seededModel = model;
+  }
+}
+
+/** The typed temperature, or undefined when the field is blank or not a number. */
+function temperatureValue(variant: PlaygroundVariant): number | undefined {
+  const text = variant.temperature.trim();
+  if (!text) return undefined;
+  const value = Number(text);
+  return Number.isFinite(value) ? value : undefined;
+}
+
+function isMaxTokens(value: unknown): boolean {
+  return typeof value === "number" && Number.isInteger(value) && value >= 0 && value <= 0xffffffff;
+}
+
+/** The params one run sends, leaving out stored values the server rejects (they stay saved). */
+export function runParams(variant: PlaygroundVariant): Record<string, unknown> {
+  const { temperature: _stored, ...params } = variant.params ?? {};
+  if (!isMaxTokens(params.max_tokens)) delete params.max_tokens;
+  if (!isMaxTokens(params.maxTokens) || "max_tokens" in params) delete params.maxTokens;
+  const temperature = temperatureValue(variant);
+  return temperature === undefined ? params : { ...params, temperature };
+}
+
+function sameTools(left: PlaygroundTool[], right: PlaygroundTool[]): boolean {
+  return (
+    left.length === right.length &&
+    left.every(
+      (tool, index) =>
+        tool.name === right[index].name &&
+        tool.description === right[index].description &&
+        tool.parameters === right[index].parameters,
+    )
+  );
+}
+
+function parseJsonOrNull(value: string): unknown | null {
+  try {
+    return JSON.parse(value) as unknown;
+  } catch {
+    return null;
+  }
+}
+
+/** The prompt config Save as Prompt writes, returning untouched settings as stored.
+ *  `defaultModel` only serves drafts stored before the seeded model was recorded. */
+export function promptConfigFor(variant: PlaygroundVariant, defaultModel = ""): PromptConfig {
+  const basis = variant.promptBasis;
+  const temperature = temperatureValue(variant);
+  const carried = variant.params ?? null;
+  const seeded = basis?.seededModel === undefined ? defaultModel : basis.seededModel;
+  const seededModel = basis !== undefined && basis.model == null && variant.model === seeded;
+  return {
+    model: variant.model && !seededModel ? variant.model : null,
+    params:
+      temperature === undefined ? carried && { ...carried } : { ...(carried ?? {}), temperature },
+    tools:
+      basis && sameTools(promptTools(basis.tools), variant.tools)
+        ? basis.tools
+        : variant.tools.map((tool) => ({
+            type: "function",
+            function: {
+              name: tool.name,
+              description: tool.description,
+              parameters: parseJsonOrNull(tool.parameters) ?? {},
+            },
+          })),
+    responseFormat: variant.responseSchema ? parseJsonOrNull(variant.responseSchema) : null,
+  };
+}
+
 // ── run keys and cells ────────────────────────────────────────────
 
 export function idleCell(): PlaygroundCell {
diff --git a/web/src/lib/core/Badge/badgeGroups.spec.ts b/web/src/lib/core/Badge/badgeGroups.spec.ts
index ce2ef1b7b9..13d1ba703a 100644
--- a/web/src/lib/core/Badge/badgeGroups.spec.ts
+++ b/web/src/lib/core/Badge/badgeGroups.spec.ts
@@ -397,3 +397,22 @@ describe("slackInstallStatus", () => {
     }
   });
 });
+
+describe("hookRunStatus", () => {
+  it("maps every stored run status to a coloured, translated dot pill", () => {
+    const expected = {
+      queued: ["warning-soft", "workflow.history.statusQueued"],
+      running: ["blue-soft", "workflow.history.statusRunning"],
+      succeeded: ["success-soft", "workflow.history.success"],
+      failed: ["error-soft", "workflow.history.failed"],
+      expired: ["default-soft", "workflow.history.statusExpired"],
+    };
+    for (const [status, [variant, labelKey]] of Object.entries(expected)) {
+      const r = resolveBadge("hookRunStatus", status);
+      expect(r.variant).toBe(variant);
+      expect(r.labelKey).toBe(labelKey);
+      expect(r.mode).toBe("dot");
+      expect(r.shape).toBe("pill");
+    }
+  });
+});
diff --git a/web/src/lib/core/Badge/badgeGroups.ts b/web/src/lib/core/Badge/badgeGroups.ts
index e420fade7b..ef9c61ea27 100644
--- a/web/src/lib/core/Badge/badgeGroups.ts
+++ b/web/src/lib/core/Badge/badgeGroups.ts
@@ -2108,6 +2108,19 @@ export const BADGE_GROUPS = {
     },
     fallback: { variant: "default-soft" },
   },
+  // Workflow run status as the history API stores it; rendered as given, never derived from `error`.
+  hookRunStatus: {
+    mode: "dot",
+    shape: "pill",
+    values: {
+      queued: { variant: "warning-soft", labelKey: "workflow.history.statusQueued" },
+      running: { variant: "blue-soft", labelKey: "workflow.history.statusRunning" },
+      succeeded: { variant: "success-soft", labelKey: "workflow.history.success" },
+      failed: { variant: "error-soft", labelKey: "workflow.history.failed" },
+      expired: { variant: "default-soft", labelKey: "workflow.history.statusExpired" },
+    },
+    fallback: { variant: "default-soft" },
+  },
 } satisfies Record<string, BadgeGroupConfig>;
 
 export type BadgeGroupName = keyof typeof BADGE_GROUPS;
diff --git a/web/src/lib/core/Code/OCodeBlock.spec.ts b/web/src/lib/core/Code/OCodeBlock.spec.ts
index 74c491cd87..d134d46ba2 100644
--- a/web/src/lib/core/Code/OCodeBlock.spec.ts
+++ b/web/src/lib/core/Code/OCodeBlock.spec.ts
@@ -14,6 +14,7 @@ vi.mock("@/lib/feedback/Toast/useToast", () => ({
 }));
 
 import OCodeBlock from "./OCodeBlock.vue";
+import hljs from "./highlighter";
 
 const stubs = {
   // Native button so the parent's @click falls through (no extra $emit('click')
@@ -35,6 +36,22 @@ describe("OCodeBlock", () => {
     copyMock.mockResolvedValue(true);
   });
 
+  it("bypasses cache reads and writes for sensitive code", async () => {
+    const highlight = vi.spyOn(hljs, "highlight");
+    const wrapper = mountBlock({ code: "echo cache-probe", lang: "bash" });
+    const initial = highlight.mock.calls.length;
+    await wrapper.setProps({ sensitive: true });
+    expect(highlight).toHaveBeenCalledTimes(initial + 1);
+    await wrapper.setProps({ code: "echo secret-probe" });
+    await wrapper.setProps({ code: "echo cache-probe" });
+    expect(highlight).toHaveBeenCalledTimes(initial + 3);
+    await wrapper.setProps({ sensitive: false, code: "echo secret-probe" });
+    expect(highlight).toHaveBeenCalledTimes(initial + 4);
+    await wrapper.setProps({ code: "echo cache-probe" });
+    expect(highlight).toHaveBeenCalledTimes(initial + 4);
+    highlight.mockRestore();
+  });
+
   it("insets the code only when padded", () => {
     expect(mountBlock({ code: "x" }).find("pre").classes()).not.toContain("px-3");
     expect(mountBlock({ code: "x", padded: true }).find("pre").classes()).toContain("px-3");
diff --git a/web/src/lib/core/Code/OCodeBlock.types.ts b/web/src/lib/core/Code/OCodeBlock.types.ts
index d2a9957f3a..c95f5ede8f 100644
--- a/web/src/lib/core/Code/OCodeBlock.types.ts
+++ b/web/src/lib/core/Code/OCodeBlock.types.ts
@@ -12,6 +12,7 @@ export type CodeBlockChrome = "terminal" | "editor";
 export interface CodeBlockProps {
   /** Raw code to display and copy; the Copy button always copies this. */
   code: string;
+  sensitive?: boolean;
   /** Fence language (e.g. "bash", "python"). Auto-detected when omitted. */
   lang?: string;
   /**
diff --git a/web/src/lib/core/Code/OCodeBlock.vue b/web/src/lib/core/Code/OCodeBlock.vue
index 9e181a2340..8087c5e25a 100644
--- a/web/src/lib/core/Code/OCodeBlock.vue
+++ b/web/src/lib/core/Code/OCodeBlock.vue
@@ -47,6 +47,7 @@ const CODE_INSET = "0.75rem";
 const MASK_CHAR = "\u2022";
 
 const props = withDefaults(defineProps<CodeBlockProps>(), {
+  sensitive: false,
   wrap: false,
   copyable: true,
   lineNumbers: false,
@@ -100,7 +101,7 @@ const displayCode = computed(() =>
 const highlightCache = new Map<string, string>();
 const highlightOne = (code: string, lang?: string): string => {
   const key = `${lang ?? ""}\u0000${code}`;
-  const cached = highlightCache.get(key);
+  const cached = props.sensitive ? undefined : highlightCache.get(key);
   if (cached !== undefined) return cached;
   let out: string;
   try {
@@ -111,7 +112,7 @@ const highlightOne = (code: string, lang?: string): string => {
   } catch {
     out = code.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;");
   }
-  highlightCache.set(key, out);
+  if (!props.sensitive) highlightCache.set(key, out);
   return out;
 };
 // Highlights the DISPLAYED code (masked or real) — copy still uses the real `code`.
diff --git a/web/src/lib/core/EmptyState/OEmptyState.spec.ts b/web/src/lib/core/EmptyState/OEmptyState.spec.ts
index f19f0becd6..eff1cff916 100644
--- a/web/src/lib/core/EmptyState/OEmptyState.spec.ts
+++ b/web/src/lib/core/EmptyState/OEmptyState.spec.ts
@@ -42,13 +42,15 @@ import { emptyStatePresets, presetNouns } from "./presets";
 
 // ── Child component stubs ──────────────────────────────────────────────────────
 // EmptyStateActionCard: renders a button with the translated label, emits click.
+// OEmptyState's `data-test` / `data-empty-state-action` attrs fall through onto
+// the stub's button, so tests select cards by the action attribute.
+const CARD = "[data-empty-state-action]";
 const EmptyStateActionCardStub = {
   name: "EmptyStateActionCard",
   props: ["icon", "label", "sublabel"],
   emits: ["click"],
   template: `
     <button
-      data-test="empty-state-action-card-stub"
       :data-label="label"
       @click="$emit('click')"
     >{{ label }}</button>
@@ -67,7 +69,7 @@ const OButtonStub = {
   name: "OButton",
   props: ["variant", "size", "iconLeft"],
   emits: ["click"],
-  template: '<button data-test="o-button-stub" @click="$emit(\'click\')"><slot /></button>',
+  template: "<button @click=\"$emit('click')\"><slot /></button>",
 };
 
 // ── Mount factory ──────────────────────────────────────────────────────────────
@@ -244,7 +246,7 @@ describe("OEmptyState", () => {
       wrapper = buildWrapper({ filtered: true });
 
       // Assert — exactly one action card with the Clear filters label
-      const cards = wrapper.findAll('[data-test="empty-state-action-card-stub"]');
+      const cards = wrapper.findAll(CARD);
       expect(cards).toHaveLength(1);
       expect(cards[0].attributes("data-label")).toBe("Clear filters");
     });
@@ -273,7 +275,7 @@ describe("OEmptyState", () => {
       wrapper = buildWrapper({ filtered: true });
 
       // Assert
-      const cards = wrapper.findAll('[data-test="empty-state-action-card-stub"]');
+      const cards = wrapper.findAll(CARD);
       expect(cards).toHaveLength(1);
       expect(cards[0].attributes("data-label")).toBe("Clear filters");
     });
@@ -317,7 +319,7 @@ describe("OEmptyState", () => {
       wrapper = buildWrapper();
 
       // Assert
-      const cards = wrapper.findAll('[data-test="empty-state-action-card-stub"]');
+      const cards = wrapper.findAll(CARD);
       expect(cards).toHaveLength(3);
     });
 
@@ -326,7 +328,7 @@ describe("OEmptyState", () => {
       wrapper = buildWrapper();
 
       // Assert — the three "no-dashboards" actions with their English labels
-      const cards = wrapper.findAll('[data-test="empty-state-action-card-stub"]');
+      const cards = wrapper.findAll(CARD);
       const labels = cards.map((c) => c.attributes("data-label"));
       expect(labels).toEqual(["New dashboard", "Import dashboard", "Browse templates"]);
     });
@@ -336,7 +338,7 @@ describe("OEmptyState", () => {
       wrapper = buildWrapper({ hideAction: true });
 
       // Assert — actions are suppressed entirely
-      expect(wrapper.find('[data-test="empty-state-action-card-stub"]').exists()).toBe(false);
+      expect(wrapper.find(CARD).exists()).toBe(false);
     });
 
     it("does not render the actions wrapper when there are no actions", () => {
@@ -357,7 +359,7 @@ describe("OEmptyState", () => {
       // Assert — neither action cards nor the wrapper flex div exists.
       // The wrapper div itself has no data-test, but it is the parent of
       // action card stubs. If no cards render, the wrapper never appears.
-      expect(wrapper.find('[data-test="empty-state-action-card-stub"]').exists()).toBe(false);
+      expect(wrapper.find(CARD).exists()).toBe(false);
       // Additionally, the flex-wrap/flex-nowrap classes should not appear
       // anywhere since the actions wrapper div is not rendered.
       expect(wrapper.find(".flex-nowrap").exists()).toBe(false);
@@ -370,7 +372,7 @@ describe("OEmptyState", () => {
     it('emits "action" with the action id when an action card is clicked', async () => {
       // Arrange
       wrapper = buildWrapper();
-      const firstCard = wrapper.find('[data-test="empty-state-action-card-stub"]');
+      const firstCard = wrapper.find(CARD);
 
       // Act
       await firstCard.trigger("click");
@@ -384,7 +386,7 @@ describe("OEmptyState", () => {
     it('emits "action" with "clear-filters" id when filtered and the card is clicked', async () => {
       // Arrange
       wrapper = buildWrapper({ filtered: true });
-      const card = wrapper.find('[data-test="empty-state-action-card-stub"]');
+      const card = wrapper.find(CARD);
 
       // Act
       await card.trigger("click");
@@ -398,7 +400,7 @@ describe("OEmptyState", () => {
     it('emits "action" once per click', async () => {
       // Arrange
       wrapper = buildWrapper();
-      const card = wrapper.find('[data-test="empty-state-action-card-stub"]');
+      const card = wrapper.find(CARD);
 
       // Act
       await card.trigger("click");
@@ -448,10 +450,61 @@ describe("OEmptyState", () => {
       });
 
       // Assert
-      const buttons = wrapper.findAll('[data-test="o-button-stub"]');
+      const buttons = wrapper.findAll(CARD);
       expect(buttons).toHaveLength(2);
     });
   });
+
+  // ── action data-test (RUM action name) ─────────────────────────────────────
+
+  describe("action data-test", () => {
+    it("gives every preset action card its own data-test from the action id", () => {
+      wrapper = buildWrapper();
+      const cards = wrapper.findAll(CARD);
+      expect(cards.map((c) => c.attributes("data-test"))).toEqual([
+        "o2-empty-state-action-create",
+        "o2-empty-state-action-import",
+        "o2-empty-state-action-templates",
+      ]);
+      expect(cards.map((c) => c.attributes("data-empty-state-action"))).toEqual([
+        "create",
+        "import",
+        "templates",
+      ]);
+      // The root keeps its own marker, distinct from the actions.
+      expect(wrapper.attributes("data-test")).toBe("o2-empty-state");
+    });
+
+    it("names the simple buttons by actionId / secondaryActionId, with stable defaults", () => {
+      const mountButtons = (props: Record<string, unknown>) =>
+        mount(OEmptyState, {
+          props: {
+            preset: "no-data",
+            actionLabel: "Retry",
+            secondaryActionLabel: "Cancel",
+            ...props,
+          },
+          global: {
+            plugins: [store, i18n],
+            stubs: {
+              EmptyStateActionCard: EmptyStateActionCardStub,
+              OIcon: OIconStub,
+              OButton: OButtonStub,
+            },
+          },
+        });
+      const defaults = mountButtons({});
+      expect(defaults.findAll(CARD).map((b) => b.attributes("data-test"))).toEqual([
+        "o2-empty-state-action-primary",
+        "o2-empty-state-action-secondary",
+      ]);
+      const named = mountButtons({ actionId: "retry", secondaryActionId: "dismiss" });
+      expect(named.findAll(CARD).map((b) => b.attributes("data-empty-state-action"))).toEqual([
+        "retry",
+        "dismiss",
+      ]);
+    });
+  });
   it("uses compact spacing above an inline recovery form", () => {
     wrapper = buildWrapper({ size: "compact" });
     expect(wrapper.classes()).toContain("min-h-0");
diff --git a/web/src/lib/core/EmptyState/OEmptyState.vue b/web/src/lib/core/EmptyState/OEmptyState.vue
index 58754760ce..c56fe677f3 100644
--- a/web/src/lib/core/EmptyState/OEmptyState.vue
+++ b/web/src/lib/core/EmptyState/OEmptyState.vue
@@ -107,14 +107,22 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           sizeClass.actions,
         ]"
       >
+        <!-- Every action carries `data-test="o2-empty-state-action-<id>"` (RUM
+             uses data-test as the click's action name, so a CTA click reads
+             apart from a dead click on the illustration) and
+             `data-empty-state-action="<id>"`. -->
         <slot name="actions">
           <template v-if="showCards">
             <EmptyStateActionCard
               v-for="(a, i) in resolvedActions"
               :key="a.id || i"
               :icon="a.icon"
-              :label="t(a.titleKey)"
-              :sublabel="a.descriptionKey ? t(a.descriptionKey) : undefined"
+              :label="t(a.titleKey, a.titleParams ?? {})"
+              :sublabel="
+                a.descriptionKey ? t(a.descriptionKey, a.descriptionParams ?? {}) : undefined
+              "
+              :data-test="`o2-empty-state-action-${a.id}`"
+              :data-empty-state-action="a.id"
               @click="emit('action', a.id)"
             />
           </template>
@@ -124,6 +132,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :variant="actionVariant"
               :size="size === 'inline' ? 'sm' : 'md'"
               :icon-left="resolvedActionIcon"
+              :data-test="`o2-empty-state-action-${actionId}`"
+              :data-empty-state-action="actionId"
               @click="emit('action')"
             >
               {{ resolvedActionLabel }}
@@ -132,6 +142,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               v-if="secondaryActionLabel"
               variant="ghost"
               :size="size === 'inline' ? 'sm' : 'md'"
+              :data-test="`o2-empty-state-action-${secondaryActionId}`"
+              :data-empty-state-action="secondaryActionId"
               @click="emit('secondaryAction')"
             >
               {{ secondaryActionLabel }}
@@ -188,8 +200,12 @@ const props = withDefaults(
     /** Simple primary button (used instead of cards); emits `action` on click. */
     actionLabel?: I18nText;
     actionIcon?: IconName;
+    /** Stable id of the simple primary button, for its `data-test` (see the actions block). */
+    actionId?: string;
     /** Secondary action; emits `secondaryAction` on click. */
     secondaryActionLabel?: I18nText;
+    /** Stable id of the secondary button, for its `data-test`. */
+    secondaryActionId?: string;
     /** Suppress the preset's actions (e.g. table empties with no CTA). */
     hideAction?: boolean;
     /**
@@ -207,7 +223,7 @@ const props = withDefaults(
     /** Force the dot-grid backdrop on/off (default: on for hero/block). */
     backdrop?: boolean;
   }>(),
-  { size: "block" },
+  { size: "block", actionId: "primary", secondaryActionId: "secondary" },
 );
 
 const emit = defineEmits<{
diff --git a/web/src/lib/core/EmptyState/presets.ts b/web/src/lib/core/EmptyState/presets.ts
index 3b2b18524e..3df1b01e84 100644
--- a/web/src/lib/core/EmptyState/presets.ts
+++ b/web/src/lib/core/EmptyState/presets.ts
@@ -37,9 +37,13 @@ export interface EmptyStateAction {
   icon: IconName | (string & {});
   /** i18n key for the card title. */
   titleKey: I18nKey;
+  /** Interpolation values for `titleKey` (e.g. the integration a card opens). */
+  titleParams?: Record<string, string>;
   /** i18n key for the card description (optional). */
   descriptionKey?: I18nKey;
-  /** Identifier emitted with the `action` event so call sites can route. */
+  /** Interpolation values for `descriptionKey`. */
+  descriptionParams?: Record<string, string>;
+  /** Identifier emitted with the `action` event so call sites can route; also the action's `data-test` suffix. */
   id: string;
 }
 
@@ -928,7 +932,9 @@ export const emptyStatePresets = {
   // LLM Insights dashboard — single empty-state shape (used for all three
   // "no data" cases: no LLM streams in the org, the active stream has no
   // gen_ai_* fields, or the window came up empty). Filtered branch is
-  // intentionally not used (the page exposes no filter UI to clear).
+  // intentionally not used (the page exposes no filter UI to clear). The page
+  // puts its integration-specific cards (the guide the user most likely needs)
+  // before this catch-all, plus popular-guide chips under them.
   "no-llm-insights": {
     illustration: "constellation",
     variant: "create",
@@ -936,8 +942,8 @@ export const emptyStatePresets = {
     descriptionKey: "emptyState.noLLMInsights.description",
     actions: [
       {
-        id: "instrument",
-        icon: "auto-awesome",
+        id: "all-integrations",
+        icon: "widgets",
         titleKey: "emptyState.noLLMInsights.action",
         descriptionKey: "emptyState.noLLMInsights.actionDesc",
       },
diff --git a/web/src/lib/core/PageHeader/OPageHeader.spec.ts b/web/src/lib/core/PageHeader/OPageHeader.spec.ts
index 15abd38671..5845f9ed11 100644
--- a/web/src/lib/core/PageHeader/OPageHeader.spec.ts
+++ b/web/src/lib/core/PageHeader/OPageHeader.spec.ts
@@ -155,6 +155,16 @@ describe("OPageHeader with a status", () => {
     expect(statusInTitleRow()).toBe(false);
   });
 
+  /// L2: a header whose trail competes for the row can keep the title readable at every width.
+  it("floors the title at every width when asked", async () => {
+    const header = mount(OPageHeader, {
+      props: { title: raw("A long page title"), titleMinWidth: true },
+      global: { plugins: [i18n, createRouter({ history: createMemoryHistory(), routes: [] })] },
+    });
+    expect(header.find("h1").element.closest(".flex-col")!.className).toContain("min-w-40");
+    header.unmount();
+  });
+
   it("keeps the title's own floor when no status is shown", async () => {
     await mountHeader(false, false);
     expect(wrapper!.html()).toContain("md:max-lg:min-w-32");
diff --git a/web/src/lib/core/PageHeader/OPageHeader.vue b/web/src/lib/core/PageHeader/OPageHeader.vue
index db4a35b987..b1c95f7b14 100644
--- a/web/src/lib/core/PageHeader/OPageHeader.vue
+++ b/web/src/lib/core/PageHeader/OPageHeader.vue
@@ -115,15 +115,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         <!-- The row is sized by its container, not the viewport, so the tab-less title stays shrinkable at every width. -->
         <div
           class="flex min-w-0 flex-col justify-center"
-          :class="
+          :class="[
             titleOverflow === 'visible'
               ? ''
               : hasTabs() && !tabsBelow
                 ? 'shrink-0 max-md:shrink'
                 : statusComponent
                   ? ''
-                  : 'md:max-lg:min-w-32'
-          "
+                  : 'md:max-lg:min-w-32',
+            titleMinWidth ? 'min-w-40' : '',
+          ]"
         >
           <h1
             v-if="titleOverflow === 'visible'"
@@ -274,12 +275,15 @@ const props = withDefaults(
     titleOverflow?: "truncate" | "visible";
     /** Render #actions-overflow BEFORE #actions on desktop, so a trailing primary CTA stays last. */
     overflowFirst?: boolean;
+    /** Keep the title at least 10rem wide at every width, for a #title-trail that competes for the row. */
+    titleMinWidth?: boolean;
   }>(),
   {
     title: raw(""),
     subtitle: raw(""),
     titleOverflow: "truncate",
     overflowFirst: false,
+    titleMinWidth: false,
   },
 );
 
diff --git a/web/src/lib/core/PageLayout/OPageLayout.vue b/web/src/lib/core/PageLayout/OPageLayout.vue
index 7c72245d76..4f680ffdd4 100644
--- a/web/src/lib/core/PageLayout/OPageLayout.vue
+++ b/web/src/lib/core/PageLayout/OPageLayout.vue
@@ -70,6 +70,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :tabs-below="tabsBelow"
           :title-overflow="titleOverflow"
           :overflow-first="overflowFirst"
+          :title-min-width="titleMinWidth"
         >
           <template v-if="!!slots.title" #title><slot name="title" /></template>
           <template v-if="!!slots['title-prefix']" #title-prefix
@@ -245,6 +246,8 @@ const props = withDefaults(
     titleOverflow?: "truncate" | "visible";
     /** Forwarded to OPageHeader: desktop renders #actions-overflow before #actions. */
     overflowFirst?: boolean;
+    /** Forwarded to OPageHeader: the title keeps a 10rem floor at every width. */
+    titleMinWidth?: boolean;
     // Body
     bleed?: boolean;
     padY?: boolean;
@@ -264,6 +267,7 @@ const props = withDefaults(
   {
     tabsBelow: false,
     overflowFirst: false,
+    titleMinWidth: false,
     bleed: false,
     padY: false,
     scroll: false,
diff --git a/web/src/lib/core/Table/cells/OTimeCell.spec.ts b/web/src/lib/core/Table/cells/OTimeCell.spec.ts
index e75621f7c7..002e0b155d 100644
--- a/web/src/lib/core/Table/cells/OTimeCell.spec.ts
+++ b/web/src/lib/core/Table/cells/OTimeCell.spec.ts
@@ -20,6 +20,12 @@ import OTimeCell from "./OTimeCell.vue";
 
 const NOW = Date.UTC(2026, 9, 30, 12, 0, 0);
 const MIN = 60_000;
+const US = 1_792_575_542_000_000;
+
+const TooltipStub = {
+  name: "OTooltip",
+  template: `<i class="tip"><slot name="content" /></i>`,
+};
 
 const relative = (agoMs: number) =>
   mount(OTimeCell, {
@@ -27,6 +33,12 @@ const relative = (agoMs: number) =>
     global: { stubs: { OTooltip: true } },
   }).text();
 
+const mountCell = (props: Record<string, unknown>) =>
+  mount(OTimeCell, {
+    props: { value: US, unit: "us", mode: "absolute", timezone: "UTC", ...props },
+    global: { stubs: { OTooltip: TooltipStub } },
+  });
+
 describe("OTimeCell", () => {
   afterEach(() => {
     i18n.global.locale = "en-us";
@@ -44,4 +56,21 @@ describe("OTimeCell", () => {
     i18n.global.locale = "de";
     expect(relative(24 * MIN)).toBe("vor 24 Minuten");
   });
+
+  it("absolute mode shows the full datetime and no tooltip", () => {
+    const w = mountCell({});
+    expect(w.find("span").text()).toBe("2026-10-21 09:39:02");
+    expect(w.find(".tip").exists()).toBe(false);
+  });
+
+  it("a format pattern shortens the absolute display and offers the full datetime on hover", () => {
+    const w = mountCell({ format: "MMM d, HH:mm" });
+    expect(w.find("span").text()).toBe("Oct 21, 09:39");
+    expect(w.find(".tip").text()).toBe("2026-10-21 09:39:02");
+  });
+
+  it("an empty value still shows the empty label with a format", () => {
+    const w = mountCell({ value: null, format: "MMM d, HH:mm" });
+    expect(w.text()).toBe("—");
+  });
 });
diff --git a/web/src/lib/core/Table/cells/OTimeCell.vue b/web/src/lib/core/Table/cells/OTimeCell.vue
index 40c0390862..e19446fc72 100644
--- a/web/src/lib/core/Table/cells/OTimeCell.vue
+++ b/web/src/lib/core/Table/cells/OTimeCell.vue
@@ -43,6 +43,8 @@ const props = withDefaults(
     relativeCutoffDays?: number;
     /** Current epoch ms for the relative text; pass a ticking clock (useNow) to keep "x ago" current. */
     now?: number;
+    /** date-fns pattern for a shorter "absolute" display; the full datetime then shows on hover. */
+    format?: string;
   }>(),
   { unit: "auto", mode: "relative", emptyLabel: raw("—"), relativeCutoffDays: 30 },
 );
@@ -153,21 +155,34 @@ const dateOnly = computed(() => {
   }
 });
 
+const formatted = computed(() => {
+  if (epochMs.value === null || !props.format) return null;
+  try {
+    return formatInTimeZone(new Date(epochMs.value), zone.value, props.format);
+  } catch {
+    return absolute.value;
+  }
+});
+
 const display = computed(() => {
-  if (props.mode === "absolute") return absolute.value;
+  if (props.mode === "absolute") return props.format ? formatted.value : absolute.value;
   if (props.mode === "date") return dateOnly.value;
   return relative.value;
 });
 
 /**
- * Whether to OFFER the hover tooltip — RELATIVE mode only, revealing the full
- * absolute datetime (absolute/date cells already show it, so they get none).
+ * Whether to OFFER the hover tooltip — relative mode, or absolute mode shortened
+ * by `format`, revealing the full absolute datetime (the others already show it).
  * This decision is deliberately cheap: it does NOT format the absolute string.
  * The string is built lazily in the #content slot below, which the (lazy)
  * OTooltip only renders on hover — so a cell that is merely scrolled past in a
  * long/virtualized table never runs the timezone formatter.
  */
-const showAbsoluteTooltip = computed(() => props.mode === "relative" && epochMs.value !== null);
+const showAbsoluteTooltip = computed(
+  () =>
+    epochMs.value !== null &&
+    (props.mode === "relative" || (props.mode === "absolute" && !!props.format)),
+);
 </script>
 
 <template>
diff --git a/web/src/lib/forms/Date/ODate.spec.ts b/web/src/lib/forms/Date/ODate.spec.ts
index 9163b53898..7186a6f47e 100644
--- a/web/src/lib/forms/Date/ODate.spec.ts
+++ b/web/src/lib/forms/Date/ODate.spec.ts
@@ -21,6 +21,20 @@ describe("ODate", () => {
     expect(wrapper.text()).toContain("Date of birth");
   });
 
+  it("should render the label above the field by default", () => {
+    wrapper = mount(ODate, { props: { label: "From" } });
+    expect(wrapper.find(".o-input-label").text()).toBe("From");
+    expect(wrapper.find('[role="group"] label').exists()).toBe(false);
+  });
+
+  it("should render the label inside the field border when labelPosition is inside", () => {
+    wrapper = mount(ODate, { props: { label: "From", labelPosition: "inside" } });
+    expect(wrapper.find(".o-input-label").exists()).toBe(false);
+    const inside = wrapper.find('[role="group"] label');
+    expect(inside.text()).toBe("From");
+    expect(wrapper.find('[role="group"]').classes()).toContain("relative");
+  });
+
   it("should render label slot content", () => {
     wrapper = mount(ODate, { slots: { label: "Custom label" } });
     expect(wrapper.text()).toContain("Custom label");
diff --git a/web/src/lib/forms/Date/ODate.types.ts b/web/src/lib/forms/Date/ODate.types.ts
index e6b00061a8..abf6828e56 100644
--- a/web/src/lib/forms/Date/ODate.types.ts
+++ b/web/src/lib/forms/Date/ODate.types.ts
@@ -33,6 +33,11 @@ export interface DateProps {
   required?: boolean;
   /** Control size */
   size?: DateSize;
+  /**
+   * Position of the label: 'outside' renders above the field (default),
+   * 'inside' renders as a compact floating mini-label inside the field border (size md).
+   */
+  labelPosition?: "inside" | "outside";
   /** HTML id */
   id?: string;
   /** HTML name */
diff --git a/web/src/lib/forms/Date/ODate.vue b/web/src/lib/forms/Date/ODate.vue
index e829fa161d..157993776d 100644
--- a/web/src/lib/forms/Date/ODate.vue
+++ b/web/src/lib/forms/Date/ODate.vue
@@ -42,6 +42,7 @@ const wrapperAttrs = computed(() => {
 
 const props = withDefaults(defineProps<DateProps>(), {
   size: "md",
+  labelPosition: "outside",
   disabled: false,
   readonly: false,
   clearable: false,
@@ -54,6 +55,9 @@ defineSlots<DateSlots>();
 const _fallbackId = useId();
 const inputId = computed(() => props.id ?? _fallbackId);
 
+// Inside-label mode: the label floats inside the field border, like OInput's
+const isInsideLabel = computed(() => props.labelPosition === "inside" && !!props.label);
+
 const effectiveError = computed(() => props.errorMessage || (props.error ? " " : null) || null);
 const hasError = computed(() => !!effectiveError.value);
 
@@ -138,13 +142,14 @@ const wrapperClasses = computed(() => [
   "focus-within:ring-[0.125rem] focus-within:ring-focus-ring-accent",
   props.disabled ? "bg-datepicker-disabled-bg border-datepicker-disabled-border opacity-60" : "",
   heightClasses[props.size ?? "md"],
+  isInsideLabel.value ? "relative" : "",
 ]);
 </script>
 
 <template>
   <div v-bind="wrapperAttrs" class="flex w-full flex-col gap-1">
     <label
-      v-if="$slots.label || label || $slots.tooltip"
+      v-if="($slots.label || label || $slots.tooltip) && !isInsideLabel"
       :for="inputId"
       :class="[
         'o-input-label text-compact flex items-center gap-1 leading-tight',
@@ -183,6 +188,14 @@ const wrapperClasses = computed(() => [
         @focusin="onFocusIn"
         @focusout="onFocusOut"
       >
+        <!-- Inside label: floating mini-label at the top of the border, above the date text -->
+        <label
+          v-if="isInsideLabel"
+          :for="inputId"
+          class="text-2xs text-text-secondary pointer-events-none absolute start-9 end-3 top-1 overflow-hidden leading-none font-medium text-ellipsis whitespace-nowrap select-none"
+          >{{ label }}<span v-if="required" aria-hidden="true">&nbsp;*</span></label
+        >
+
         <!-- Calendar trigger (calendar icon) -->
         <DatePickerTrigger
           class="text-datepicker-icon flex shrink-0 cursor-pointer items-center ps-3 outline-none disabled:cursor-not-allowed"
@@ -198,7 +211,8 @@ const wrapperClasses = computed(() => [
           :class="[
             'flex min-w-0 flex-1 items-center gap-px ps-2 outline-none',
             clearable ? 'pe-2' : 'pe-3',
-            heightClasses[size ?? 'md'],
+            // Inside-label: push the date down to leave room for the floating mini-label
+            isInsideLabel ? 'h-8.5 pt-3 pb-0.5 text-xs font-semibold' : heightClasses[size ?? 'md'],
           ]"
         >
           <template #default="{ segments }">
diff --git a/web/src/lib/forms/DateTime/OFormDateTimeRange.spec.ts b/web/src/lib/forms/DateTime/OFormDateTimeRange.spec.ts
index f2f2003466..6980a69a0b 100644
--- a/web/src/lib/forms/DateTime/OFormDateTimeRange.spec.ts
+++ b/web/src/lib/forms/DateTime/OFormDateTimeRange.spec.ts
@@ -10,6 +10,7 @@
 import { describe, it, expect, afterEach } from "vitest";
 import { mount, flushPromises, VueWrapper } from "@vue/test-utils";
 import { defineComponent, nextTick } from "vue";
+import { z } from "zod";
 import OForm from "@/lib/forms/Form/OForm.vue";
 import OFormDateTimeRange from "./OFormDateTimeRange.vue";
 
@@ -114,6 +115,37 @@ describe("OFormDateTimeRange", () => {
     expect(wrapper.find('[data-test="dt-stub"]').text()).toBe("relative|30m");
   });
 
+  // C8: opt-in, so the callers that surface the error elsewhere keep their layout.
+  it.each([
+    [true, "Pick a later window"],
+    [false, ""],
+  ])("renders the field's error under the picker when show-error is %s", async (show, text) => {
+    wrapper = mount(OForm, {
+      props: {
+        defaultValues: { timerange: { type: "absolute", from: 0, to: 0 } },
+        // A form-level refine routed to the field by `path`, the shape the cover form's schema uses.
+        schema: z
+          .object({ timerange: z.object({ from: z.number(), to: z.number() }) })
+          .refine((v) => v.timerange.to > v.timerange.from, {
+            message: "Pick a later window",
+            path: ["timerange"],
+          }),
+      },
+      slots: {
+        default: `<OFormDateTimeRange name="timerange" :show-error="${show}" data-test="tr" />`,
+      },
+      global: {
+        components: { OFormDateTimeRange },
+        stubs: { DateTime: DateTimeStub },
+      },
+    });
+    await (wrapper.vm as any).form.handleSubmit();
+    await flushPromises();
+
+    const error = wrapper.find('[data-test="tr-error"]');
+    expect(error.exists() ? error.text() : "").toBe(text);
+  });
+
   // Regression: the wrapper is used with INDEXED/NESTED names
   // (`dashboards[0].timerange`). A flat `values[name]` lookup would read
   // `undefined` and never remount on external prefill; the path resolver fixes it.
diff --git a/web/src/lib/forms/DateTime/OFormDateTimeRange.types.ts b/web/src/lib/forms/DateTime/OFormDateTimeRange.types.ts
index 29647fff0e..d9d7830e9d 100644
--- a/web/src/lib/forms/DateTime/OFormDateTimeRange.types.ts
+++ b/web/src/lib/forms/DateTime/OFormDateTimeRange.types.ts
@@ -20,4 +20,6 @@ export interface FormDateTimeRangeProps {
   required?: boolean;
   /** Optional helper line rendered under the label. */
   description?: I18nText;
+  /** Render the field's validation error under the picker, for a form with no other place that says it. */
+  showError?: boolean;
 }
diff --git a/web/src/lib/forms/DateTime/OFormDateTimeRange.vue b/web/src/lib/forms/DateTime/OFormDateTimeRange.vue
index d8ff4f2eaa..63368087d3 100644
--- a/web/src/lib/forms/DateTime/OFormDateTimeRange.vue
+++ b/web/src/lib/forms/DateTime/OFormDateTimeRange.vue
@@ -13,13 +13,15 @@
 //     the new value — but NOT on the user's own changes (DateTime already
 //     reflects those), which would otherwise cause a remount loop.
 //
-// Errors aren't rendered here: DateTime has no label/required affordance and the
-// timerange is validated cross-field in the form schema (surfaced via the step
-// jump), mirroring how the other documented composite controls behave.
+// Errors are rendered only with `show-error`: DateTime has no label/required
+// affordance and most callers validate the timerange cross-field in the form
+// schema (surfaced via the step jump), mirroring the other composite controls.
 
 import { inject, ref, watch } from "vue";
 import DateTime from "@/components/DateTime.vue";
 import { FORM_CONTEXT_KEY } from "@/lib/forms/Form/OForm.types";
+import { firstFieldError } from "@/lib/forms/Form/fieldError";
+import { raw } from "@/types/i18n";
 import type { FormDateTimeRangeProps, DateTimeRangeValue } from "./OFormDateTimeRange.types";
 
 defineOptions({ inheritAttrs: false });
@@ -104,6 +106,13 @@ const onDateChange = (field: any, dt: any) => {
         :default-relative-time="field.state.value?.period ?? '30m'"
         @on:date-change="(d: any) => onDateChange(field, d)"
       />
+      <p
+        v-if="props.showError && field.state.meta.errors.length > 0"
+        class="text-input-error-text mt-1 text-xs leading-snug"
+        :data-test="$attrs['data-test'] ? `${$attrs['data-test']}-error` : undefined"
+      >
+        {{ raw(firstFieldError(field.state.meta.errors)) }}
+      </p>
     </template>
   </component>
 </template>
diff --git a/web/src/locales/languages/ar-SA.json b/web/src/locales/languages/ar-SA.json
index ddab4aef31..2365cde2b4 100644
--- a/web/src/locales/languages/ar-SA.json
+++ b/web/src/locales/languages/ar-SA.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "لا توجد أنشطة LLM بعد",
       "description": "قم بتجهيز خدماتك باتفاقيات OpenTelemetry التوليدية للذكاء الاصطناعي واستوعب تتبعًا واحدًا على الأقل لملء لوحة المعلومات هذه.",
-      "action": "التجهيز بـ OpenTelemetry",
-      "actionDesc": "التقاط سمات gen_ai_* على تتبعاتك"
+      "action": "كل تكاملات الذكاء الاصطناعي",
+      "actionDesc": "تصفّح جميع أدلة أطر العمل والموفّرين",
+      "suggested": "إعداد تتبع {name}",
+      "suggestedDesc": "مقترح لأنك أتيت من وثائق {name}",
+      "codingAgent": "إضافة التتبع باستخدام وكيل برمجة",
+      "codingAgentDesc": "يضيف وكيل البرمجة لديك التتبع ويتحقق من أول تتبع",
+      "startFrom": "أو ابدأ من"
     },
     "noLLMSessions": {
       "title": "لا توجد جلسات LLM بعد",
@@ -4797,6 +4802,13 @@
       "success": "النجاح",
       "failed": "فشل",
       "testRun": "تشغيل تجريبي",
+      "source": "المصدر",
+      "sourceHttp": "طلب HTTP",
+      "sourceAlertFired": "إطلاق التنبيه",
+      "sourceIncidentEvent": "حدث الحادث",
+      "sourceRetry": "إعادة التشغيل",
+      "sourceManual": "تشغيل يدوي",
+      "sourceOther": "أخرى",
       "runType": "النوع",
       "testRunTooltip": "بدأ من المحرر. خطوات الوجهة ترسل البيانات فعلياً.",
       "showTestRuns": "إظهار عمليات التشغيل التجريبية ({count})",
@@ -4810,7 +4822,33 @@
       "retryTitle": "إعادة محاولة هذا التشغيل؟",
       "retryMessage": "ينشئ هذا تشغيلاً جديداً باستخدام المدخلات التي سجّلها التشغيل الفاشل. خطوات الوجهة ترسل البيانات فعلياً.",
       "retryStarted": "بدأت إعادة المحاولة — ستظهر في القائمة كتشغيل جديد.",
-      "retryError": "تعذّرت إعادة محاولة هذا التشغيل"
+      "retryError": "تعذّرت إعادة محاولة هذا التشغيل",
+      "statusQueued": "قيد الانتظار",
+      "statusRunning": "قيد التشغيل",
+      "statusExpired": "منتهي الصلاحية",
+      "reasonExpired": "لم يُشغَّل قط · في الانتظار لأكثر من ساعة",
+      "reasonWorkerLost": "فُقد العامل · لم يُعَد تشغيله",
+      "reasonWorkflowDisabled": "تم تعطيل سير العمل",
+      "reasonRunTimeout": "انتهت المهلة بعد 15 دقيقة",
+      "allTriggers": "كل المُشغِّلات",
+      "triggerFilter": "المُشغِّل",
+      "run": "التشغيل",
+      "searchRuns": "ابحث عن معرّف التشغيل أو مفتاح عدم التكرار أو التنبيه",
+      "sourceDetails": "تفاصيل المصدر",
+      "detailsWithKey": "{ip} · المفتاح {key}",
+      "detailsNoKey": "{ip} · بدون مفتاح عدم تكرار",
+      "retryOf": "إعادة تشغيل {run}",
+      "openRun": "فتح التشغيل",
+      "alertFiredEmptyTitle": "لا توجد عمليات تشغيل أطلقها التنبيه في هذا النطاق الزمني",
+      "incidentEventEmptyTitle": "لا توجد عمليات تشغيل لأحداث الحوادث في هذا النطاق الزمني",
+      "filterEmptyTitle": "لا توجد عمليات تشغيل مطابقة في هذا النطاق الزمني",
+      "filterEmptyDimmed": "ما زالت عمليات التشغيل الأخرى على المخطط الزمني، باهتة.",
+      "searchEmptyTitle": "لا توجد عمليات تشغيل تطابق هذا البحث",
+      "searchEmptyAction": "مسح البحث",
+      "timelineNow": "الآن",
+      "timelineAgoMinutes": "−{n} د",
+      "timelineAgoHours": "−{n} س",
+      "timelineAgoDays": "−{n} ي"
     },
     "edit": "تعديل",
     "view": "منظر",
@@ -4958,7 +4996,9 @@
           "noMatch": "لا يوجد تطابق"
         },
         "suppressed": "تم منع الإرسال — لم يُرسل إلى الوجهة الفعلية"
-      }
+      },
+      "payloadFrom": "الحمولة من",
+      "payloadFromHint": "بنية HTTP هي ما يرسله مستدعو نقطة النهاية."
     },
     "linkAlerts": {
       "title": "ربط سير العمل بالتنبيهات",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "تنسيق الإخراج",
       "tlsVerifyLabel": "التحقق من TLS",
       "tlsDisabled": "معاق"
+    },
+    "http": {
+      "runTestHint": "يشغّل الخطوات باستخدام حمولة HTTP تجريبية؛ ولا يستدعي عنوان URL",
+      "runTestHintList": "افتح سير العمل لتشغيل اختبار",
+      "runsEmptyTitle": "لا توجد طلبات HTTP في هذا النطاق الزمني",
+      "runsEmptyBody": "وسّع النطاق الزمني، أو أرسل طلب اختبار من لوحة نقطة نهاية HTTP.",
+      "runsEmptyAction": "إظهار كل المُشغِّلات",
+      "runFailedAt": "فشل هذا التشغيل عند {step}: {error}",
+      "openStep": "فتح الخطوة",
+      "runGuardHint": "تحمل عمليات تشغيل HTTP الطلب، وليس حقول التنبيه. إذا قرأت هذه الخطوة {fields}، فاحمِها بشرط: {guard}.",
+      "runExpiredBanner": "انتظر هذا الطلب أكثر من ساعة واحدة في قائمة الانتظار ولم يُشغَّل مطلقًا. لم تُشغَّل أي خطوة ولم يتم استدعاء أي وجهة.",
+      "runWorkerLostBanner": "توقف العامل الذي كان يشغّل هذا الطلب. لا يُعاد تشغيله تلقائيًا، لأن الوجهات ربما تكون قد استُدعيت بالفعل. تحقق منها قبل أن يعيد المتصل الإرسال.",
+      "request": "الطلب",
+      "requestReceived": "تم الاستلام",
+      "requestToken": "الرمز",
+      "requestCallerIp": "عنوان IP للمتصل",
+      "requestIdempotencyKey": "مفتاح Idempotency",
+      "requestContentType": "نوع المحتوى",
+      "requestBodySize": "حجم الجسم",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "الترويسات",
+      "headersKept": "{count} محتفظ به · لا يتم تخزين Authorization أو ملفات تعريف الارتباط أو التواقيع أبدًا | {count} محتفظ به · لا يتم تخزين Authorization أو ملفات تعريف الارتباط أو التواقيع أبدًا",
+      "headerName": "الاسم",
+      "headerValue": "القيمة",
+      "outputCaption": "ما استلمته كل خطوة لاحقة",
+      "useAsTestInput": "استخدام كمدخل اختبار",
+      "editorButton": "نقطة نهاية HTTP",
+      "editorButtonOn": "مفعّل",
+      "editorButtonOff": "متوقف",
+      "editorButtonTooltip": "اسمح لنظام آخر ببدء سير العمل هذا بطلب HTTP",
+      "editorButtonRefusedDraft": "تتلقى الطلبات رمز 403 حتى يتم نشر سير العمل",
+      "editorButtonRefusedPaused": "تتلقى الطلبات رمز 403 ما دام سير العمل متوقفًا مؤقتًا",
+      "panelTitle": "نقطة نهاية HTTP",
+      "panelSubtitle": "{name} · سير عمل {kind}",
+      "acceptRequests": "قبول طلبات HTTP",
+      "kindNote": "بُنيت خطوات سير العمل هذا لتشغيلات {kind}. تتلقى تشغيلات HTTP الطلب بدلًا من ذلك ({field})، لذا أضف شرطًا إذا كانت إحدى الخطوات تحتاج حقول {kind}.",
+      "kindNotePayload": "إظهار حمولة HTTP",
+      "kindNotePayloadHide": "إخفاء حمولة HTTP",
+      "unsavedBody": "لم يتم حفظ سير العمل هذا بعد. احفظه كمسودة لإنشاء عنوان URL والرمز الخاص به. تُرفض الطلبات حتى تنشر.",
+      "saveAndCreate": "حفظ المسودة وإنشاء نقطة النهاية",
+      "needsAdmin": "يتطلب إنشاء نقطة النهاية مسؤول مؤسسة.",
+      "needsEdit": "يتطلب تغييره صلاحية تحرير على سير العمل هذا.",
+      "readOnlyOnMeta": "مفعّل · يمكنك نسخ عنوان URL. يتطلب تغييره صلاحية تحرير على سير العمل هذا.",
+      "offBody": "اسمح لنظام آخر ببدء سير العمل هذا بطلب HTTP. ستحصل على عنوان URL ورمز.",
+      "offExistingBody": "متوقف · تُرفض الطلبات (403) حتى تفعّله.",
+      "onMeta": "مفعّل · لا تبدأ عمليات التشغيل إلا عندما يكون سير العمل ممكّنًا ومنشورًا",
+      "loadError": "تعذّر تحميل إعدادات نقطة النهاية.",
+      "draftBanner": "سير العمل هذا مسودة. تتلقى الاستدعاءات إلى عنوان URL رمز 403 حتى تنشر. يمكنك إعداد نقطة النهاية الآن، ويشغّل «تشغيل الاختبار» خطوات المسودة باستخدام حمولة HTTP تجريبية.",
+      "disabledBanner": "تُرفض الطلبات (403) حتى تمكّن سير العمل.",
+      "turnOnFailed": "تعذّر تفعيل نقطة النهاية. {reason}",
+      "changeFailed": "تعذّر حفظ نقطة النهاية. {reason}",
+      "endpointExistsHint": "نقطة النهاية موجودة بالفعل. اعرض رمزها أو انسخه من جدول الرموز.",
+      "endpointExistsHintSigned": "نقطة النهاية موجودة بالفعل. اعرض سر التوقيع الخاص بها أو انسخه من جدول أسرار التوقيع.",
+      "disableTitle": "هل تريد إيقاف نقطة النهاية؟",
+      "disableBody": "يتلقى المتصلون رمز 403 (نقطة النهاية متوقفة) حتى تعيد تفعيلها. يبقى عنوان URL والرموز دون تغيير.",
+      "disableConfirm": "إيقاف",
+      "lastCall": "مفعّل · آخر استدعاء: {status} · {time} · {link}",
+      "lastCallNone": "مفعّل · لا توجد استدعاءات بعد — أرسل طلب اختبار",
+      "lastCallNoneRefused": "مفعّل · لا توجد استدعاءات بعد",
+      "viewRun": "عرض التشغيل",
+      "lastCallStatus": {
+        "queued": "في الانتظار",
+        "running": "قيد التشغيل",
+        "succeeded": "ناجح",
+        "failed": "فشل",
+        "expired": "منتهي الصلاحية"
+      },
+      "endpointUrl": "عنوان URL لنقطة النهاية",
+      "tokenLabel": "الرمز",
+      "secretLabel": "سر التوقيع",
+      "newTokenLabel": "رمز جديد",
+      "newSecretLabel": "سر توقيع جديد",
+      "tokenHint": "مقنّع على الشاشة؛ ينسخ «نسخ» الرمز الحقيقي. أرسله كـ {header}، وليس في عنوان URL أبدًا.",
+      "secretHint": "مقنّع على الشاشة؛ ينسخ «نسخ» السر الحقيقي. وقّع كل طلب به وأرسل ترويسات {headers}؛ لا ترسل السر نفسه أبدًا.",
+      "revealBannerTitle": "تم إنشاء نقطة النهاية",
+      "revealBannerBody": "أرسل هذا الرمز مع كل طلب. يمكنك إظهاره أو نسخه مجددًا من جدول الرموز.",
+      "revealBannerBodySigned": "وقّع كل طلب بهذا السر. يمكنك إظهاره أو نسخه مجددًا من جدول أسرار التوقيع.",
+      "switchedBannerTitle": "تم إنشاء الرمز",
+      "switchedBannerTitleSigned": "تم إنشاء سر التوقيع",
+      "rotateBannerTitle": "تم إنشاء رمز جديد",
+      "rotateBannerTitleSigned": "تم إنشاء سر توقيع جديد",
+      "rotateBannerBody": "يحتفظ المتصلون بعنوان URL والترويسة نفسيهما؛ يتغير الرمز فقط. يظل الرمز القديم صالحًا حتى تنتهي صلاحيته ويمكن إظهاره حتى ذلك الحين.",
+      "rotateBannerBodySigned": "يحتفظ المتصلون بعنوان URL والترويسات نفسها؛ يتغير السر فقط. يظل السر القديم صالحًا حتى تنتهي صلاحيته ويمكن إظهاره حتى ذلك الحين.",
+      "rotateBannerBodyRevoked": "يحتفظ المتصلون بعنوان URL والترويسة نفسيهما؛ يتغير الرمز فقط. أُبطل الرمز القديم وتوقف عن العمل الآن.",
+      "rotateBannerBodyRevokedSigned": "يحتفظ المتصلون بعنوان URL والترويسات نفسها؛ يتغير السر فقط. أُبطل السر القديم وتوقف عن العمل الآن.",
+      "rotateBannerBodyFresh": "يحتفظ المتصلون بعنوان URL والترويسة نفسيهما ويرسلون هذا الرمز من الآن فصاعدًا.",
+      "rotateBannerBodyFreshSigned": "يحتفظ المتصلون بعنوان URL والترويسات نفسها ويوقّعون بهذا السر من الآن فصاعدًا.",
+      "snippetsLabel": "طلب مثال",
+      "sendTest": "إرسال طلب اختبار",
+      "sendTestHint": "يتحقق من بيانات الاعتماد ويعرض ما ستستقبله خطواتك. لا يبدأ أي تشغيل ولا يُستدعى أي وجهة.",
+      "sendTestHintPaused": "يتحقق من بيانات الاعتماد. سير العمل متوقف مؤقتًا، لذا يُرفض الاستدعاء قبل بناء أي مُدخل؛ يشغّل «تشغيل اختبار» الخطوات.",
+      "sendTestSigned": "لا يمكن للمتصفحات توقيع الطلبات، لذا اختبر باستخدام طلب المثال أعلاه. أضف ?dry_run=true إلى عنوان URL الخاص به للتحقق من التوقيع دون بدء تشغيل.",
+      "dryRunAccepted": "تم قبول التشغيل التجريبي",
+      "dryRunMeta": "بيانات الاعتماد صالحة · جسم بحجم {size}",
+      "dryRunInput": "المُدخل الذي ستستقبله خطواتك",
+      "dryRunRefused": "بيانات الاعتماد صالحة. تُرفض الطلبات حتى يُنشر سير العمل.",
+      "dryRunRefusedPaused": "بيانات الاعتماد صالحة. تُرفض الطلبات ما دام سير العمل متوقفًا مؤقتًا.",
+      "dryRunRateLimited": "تم تقييد المعدل — تُحتسب التشغيلات التجريبية ضمن الحد.",
+      "dryRunStatus": "رُفض الطلب بالحالة {status}.",
+      "dryRunFailed": "تعذر إرسال طلب الاختبار. {reason}",
+      "runTestInstead": "تشغيل اختبار بدلًا من ذلك",
+      "done": "تم",
+      "regionTag": "المنطقة {name}",
+      "regionBanner": "أرسل كل طلب، وكل إعادة محاولة، إلى مضيف هذه المنطقة. تُحفظ مفاتيح Idempotency وحالة التشغيل ({field}) في المنطقة التي قبلت الاستدعاء، لذا قد تبدأ إعادة المحاولة المرسلة إلى منطقة أخرى تشغيلًا ثانيًا.",
+      "authLabel": "يصادق المتصلون باستخدام",
+      "authToken": "الرمز",
+      "authSigned": "الطلبات الموقعة",
+      "authAbout": "حول المصادقة",
+      "authInfo": "الرمز: أرسل الرمز في ترويسة Authorization. الطلبات الموقعة: وقّع كل طلب باستخدام سر مشترك (ترويسات {headers}).",
+      "switchToSignedTitle": "التبديل إلى الطلبات الموقعة؟",
+      "switchToSignedBody": "يؤدي التبديل إلى إبطال الرمز الحالي الآن وإنشاء سر توقيع. يبدأ المتصلون الذين يستخدمون الرمز في تلقي 401.",
+      "switchToTokenTitle": "التبديل إلى الرمز؟",
+      "switchToTokenBody": "يؤدي التبديل إلى إلغاء سر التوقيع الحالي الآن وإنشاء رمز. سيبدأ المتصلون الذين يوقّعون الطلبات في تلقي 401.",
+      "tokensTitle": "الرموز",
+      "secretsTitle": "أسرار التوقيع",
+      "colToken": "الرمز",
+      "colSecret": "السر",
+      "colCreated": "تم الإنشاء",
+      "colLastUsed": "آخر استخدام",
+      "colStatus": "الحالة",
+      "colActions": "الإجراءات",
+      "never": "أبدًا",
+      "active": "نشط",
+      "retiring": "قيد السحب",
+      "creatorGone": "المنشئ لم يعد في هذه المؤسسة",
+      "revoke": "إلغاء",
+      "revokeNow": "ألغِ الآن",
+      "revokeTitle": "هل تريد إلغاء {prefix}؟ سيتلقى المتصلون الذين يستخدمونه 401 فورًا.",
+      "revokeFailed": "تعذر إلغاؤه. {reason}",
+      "copyToken": "نسخ الرمز",
+      "copySecret": "نسخ السر",
+      "tokenCopied": "تم نسخ الرمز",
+      "commandCopied": "تم نسخ الأمر",
+      "secretCopied": "تم نسخ السر",
+      "revealFailed": "تعذر عرض الرمز. {reason}",
+      "revealFailedSigned": "تعذر عرض السر. {reason}",
+      "revealDenied": "يمكن للمسؤولين فقط عرض الرموز أو نسخها لنقطة النهاية هذه.",
+      "runTest": "تشغيل الاختبار",
+      "rotate": "تدوير",
+      "rotateBlocked": "ألغِ الرمز قيد السحب أولًا",
+      "rotateBlockedSigned": "ألغِ السر قيد السحب أولًا",
+      "rotateTitle": "تدوير الرمز",
+      "rotateTitleSigned": "تدوير سر التوقيع",
+      "rotateLead": "يُنشأ رمز جديد الآن. أبقِ {prefix} (آخر استخدام {time}) يعمل لمدة",
+      "rotateLeadSigned": "يُنشأ سر توقيع جديد الآن. أبقِ {prefix} (آخر استخدام {time}) يعمل لمدة",
+      "overlapNow": "إلغاؤه فورًا",
+      "overlapHour": "ساعة واحدة",
+      "overlapDay": "24 ساعة",
+      "overlapWeek": "7 أيام",
+      "rotateConsequence": "يستمر المتصلون الذين يستخدمون الرمز الحالي في العمل حتى {time}. حدّثهم قبل ذلك.",
+      "rotateConsequenceSigned": "يستمر المتصلون الذين يوقّعون باستخدام السر الحالي في العمل حتى {time}. حدّثهم قبل ذلك.",
+      "rotateConsequenceNow": "سيتلقى المتصلون الذين يستخدمون الرمز الحالي 401 من الآن فصاعدًا.",
+      "rotateConsequenceNowSigned": "سيتلقى المتصلون الذين يوقّعون باستخدام السر الحالي 401 من الآن فصاعدًا.",
+      "rotateConfirm": "تدوير الرمز",
+      "rotateConfirmSigned": "تدوير سر التوقيع",
+      "rotateFailed": "تعذر التدوير. {reason}",
+      "advanced": "متقدم",
+      "advancedSummary": "الحد الأقصى لحجم الجسم {size} · {count} طلب في الدقيقة | الحد الأقصى لحجم الجسم {size} · {count} طلبات في الدقيقة",
+      "maxBody": "الحد الأقصى لحجم الجسم (KiB)",
+      "maxBodyHint": "حتى 1024 (1 MiB)؛ يمكنك فقط خفضه",
+      "maxBodyRange": "أدخل عددًا صحيحًا من 1 إلى 1024",
+      "rateLimit": "الطلبات في الدقيقة",
+      "rateLimitHint": "بحد أقصى {org} في الدقيقة لهذه المؤسسة",
+      "rateLimitRange": "أدخل عددًا صحيحًا من 1 إلى {org}",
+      "saveLimitsFailed": "تعذّر حفظ الحدود. {reason}",
+      "deleteMeta": "يزيل عنوان URL وكل رمز أو سر.",
+      "deleteButton": "حذف نقطة النهاية",
+      "deleteTitle": "حذف نقطة النهاية هذه؟",
+      "deleteBody": "يتوقف عنوان URL عن العمل فورًا: يحصل المستدعون على 401. تُحذف كل الرموز وأسرار التوقيع ولا يمكن استعادتها. يُحتفظ بسجل التشغيل.",
+      "deleteFailed": "تعذّر حذف نقطة النهاية. {reason}",
+      "secretStorageWarning": "لا يملك هذا الخادم مفتاح تشفير رئيسيًا، لذا تُخزَّن الرموز وأسرار التوقيع بصيغة يمكن لأي شخص لديه وصول إلى قاعدة البيانات قراءتها. اطلب من مسؤولك إعداده.",
+      "rejectionsLine": "تم رفض نحو {count} طلب خلال آخر 24 ساعة · آخر: {reason}، {time} | تم رفض نحو {count} طلبات خلال آخر 24 ساعة · آخر: {reason}، {time}",
+      "rejectionsShow": "إظهار",
+      "rejectionsHide": "إخفاء",
+      "rejectionsTitle": "عمليات الرفض الأخيرة",
+      "rejectionsCaption": "نحو {count} خلال آخر 24 ساعة · لم يرَ المستدعي سوى رمز الحالة | نحو {count} خلال آخر 24 ساعة · لم يرَ المستدعي سوى رمز الحالة",
+      "rejectionMeta": "نحو {count} · آخر {time} · من {ip} | نحو {count} · آخر {time} · من {ip}",
+      "rejectionsLoadError": "تعذّر تحميل عمليات الرفض.",
+      "raiseLimit": "رفع الحد",
+      "rotateLink": "تدوير",
+      "reason": {
+        "invalid_token": {
+          "title": "رمز غير صالح",
+          "fix": "يرسل المستدعي رمزًا ملغى أو منتهي الصلاحية أو مكتوبًا خطأً. اعرض الرمز الحالي أو انسخه من جدول الرموز."
+        },
+        "invalid_signature": {
+          "title": "توقيع غير صالح",
+          "fix": "يوقّع المستدعي باستخدام سر قديم أو خاطئ. تحقق من أنه يستخدم السر الحالي ويوقّع {format} تمامًا كما أُرسل."
+        },
+        "stale_timestamp": {
+          "title": "الطابع الزمني قديم جدًا",
+          "fix": "ساعة المستدعي تختلف بأكثر من 5 دقائق. زامن ساعته، ووقّع مباشرة قبل الإرسال."
+        },
+        "endpoint_disabled": {
+          "title": "نقطة النهاية معطّلة",
+          "fix": "شغّل نقطة النهاية."
+        },
+        "workflow_disabled": {
+          "title": "سير العمل متوقف مؤقتًا",
+          "fix": "استأنف سير العمل من القائمة."
+        },
+        "workflow_not_published": {
+          "title": "سير العمل غير منشور",
+          "fix": "انشر سير العمل؛ فالمسودات ترفض الطلبات."
+        },
+        "payload_too_large": {
+          "title": "الحمولة كبيرة جدًا",
+          "fix": "أكبر من {size}. أرسل قدرًا أقل، أو قسّم الأحداث على عدة طلبات."
+        },
+        "credential_in_url": {
+          "title": "بيانات اعتماد في URL",
+          "fix": "أُرسل رمز أو سر في URL ورُفض. تظهر عناوين URL في سجلات الوسيط والمتصفح، لذا دوّره الآن، ثم أرسله في ترويسة."
+        },
+        "invalid_idempotency_key": {
+          "title": "مفتاح Idempotency غير صالح",
+          "fix": "ترويسة Idempotency-Key فارغة أو أطول من 255 حرفًا."
+        },
+        "idempotency_key_reused": {
+          "title": "إعادة استخدام مفتاح Idempotency",
+          "fix": "وصل المفتاح نفسه مع جسم مختلف. استخدم مفتاحًا جديدًا لكل حدث مختلف."
+        },
+        "rate_limited": {
+          "title": "تم تقييد المعدل",
+          "fix": "أكثر من {count} طلب في الدقيقة. اجمع الأحداث في طلب واحد (أرسل مصفوفة JSON)، أو ارفع الحد — حتى {org} في الدقيقة لهذه المؤسسة."
+        },
+        "queue_full": {
+          "title": "قائمة الانتظار ممتلئة",
+          "fix": "كان لدى هذه المؤسسة بالفعل {count} من عمليات تشغيل HTTP في الانتظار. ينبغي للمستدعين إعادة المحاولة بعد مهلة Retry-After؛ ابحث عن خطوة بطيئة أو اخفض معدل الإرسال."
+        },
+        "worker_unavailable": {
+          "title": "العامل غير متاح",
+          "fix": "لم يكن أي عامل سير عمل قيد التشغيل في هذه المنطقة، لذا لم يوضع أي شيء في قائمة الانتظار. ينجح المستدعون الذين يعيدون المحاولة بعد مهلة Retry-After بمجرد عودة عامل؛ وإذا استمر ذلك، اطلب من مسؤولك التحقق من عمال سير العمل."
+        }
+      },
+      "nodeBadge": "قابل للاستدعاء عبر HTTP",
+      "triggerLinkOn": "يعمل أيضًا على طلبات HTTP",
+      "triggerLinkOnAction": "إدارة نقطة النهاية",
+      "triggerLinkOff": "شغّله من نظام آخر أيضًا",
+      "triggerLinkOffAction": "إعداد نقطة نهاية HTTP",
+      "pickerCue": "يمكن أيضًا بدء أي سير عمل عبر طلب HTTP. اختر المُشغِّل الخاص به، ثم استخدم نقطة نهاية HTTP في شريط الأدوات.",
+      "listTag": "HTTP",
+      "listTagTooltip": "نقطة نهاية HTTP مفعّلة",
+      "listMenuItem": "نقطة نهاية HTTP…",
+      "copyUrl": "نسخ عنوان URL لنقطة النهاية",
+      "copyUrlDraftHint": "تُرفض الطلبات حتى تنشر",
+      "copyUrlFailed": "تعذّر نسخ عنوان URL لنقطة النهاية. {reason}",
+      "payloadFrom": "الحمولة من",
+      "payloadHttp": "طلب HTTP",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "تنتهي الصلاحية خلال {count} ساعة | تنتهي الصلاحية خلال {count} ساعة",
+      "expiresInDays": "تنتهي الصلاحية خلال {count} يوم | تنتهي الصلاحية خلال {count} أيام",
+      "expired": "منتهي الصلاحية",
+      "rotateLeadUnused": "يتم إنشاء رمز جديد الآن. أبقِ {prefix} (الذي لم يُستخدم قط) صالحًا لمدة",
+      "rotateLeadUnusedSigned": "يتم إنشاء سر توقيع جديد الآن. أبقِ {prefix} (الذي لم يُستخدم قط) صالحًا لمدة",
+      "fieldGroup": "طلب HTTP",
+      "fieldGroupBodyHint": "تحتاج الحقول داخل جسم الطلب إلى خطوة الدالة أولًا",
+      "fieldGroupQueryHint": "معاملات الاستعلام هي meta.query.<key>؛ تصل المفاتيح المتكررة كقائمة ولا تتطابق أبدًا",
+      "rotateLeadNone": "لا يوجد رمز نشط، لذا لا يمكن للمستدعين المصادقة. يتم إنشاء رمز جديد الآن.",
+      "rotateLeadNoneSigned": "لا يوجد سر توقيع نشط، لذا لا يمكن للمستدعين المصادقة. يتم إنشاء سر توقيع جديد الآن.",
+      "createForbidden": "لا يمكنك إنشاء بيانات اعتماد نقطة النهاية في هذه المؤسسة.",
+      "errorNotConfigured": "لا يحتوي سير العمل هذا على نقطة نهاية HTTP.",
+      "errorNoLiveCredential": "لا توجد بيانات اعتماد نشطة. دوّر لإنشاء واحدة.",
+      "errorNotAllowed": "ليس لديك إذن للقيام بذلك.",
+      "copyCredentialChanged": "تغيّرت بيانات الاعتماد. انسخ مرة أخرى.",
+      "copyCommandFailed": "تعذّر نسخ الأمر. {reason}",
+      "exampleRequest": "مثال الطلب",
+      "exampleActiveToken": "رمز نشط · {prefix}",
+      "exampleActiveSecret": "سر نشط · {prefix}",
+      "exampleHintToken": "يتضمن النسخ الرمز. الصقه في طرفية، أو استورده إلى Postman أو Insomnia (استيراد → نص خام).",
+      "exampleHintSigned": "شغّله في bash: يوقّع باستخدام openssl، ثم يستدعي curl. يتضمن النسخ السر. لا يمكن لأدوات الاستيراد التوقيع.",
+      "exampleHintTokenPlaceholder": "يحتوي النسخ على عنصر نائب حيث يوضع الرمز. الصقه في طرفية، أو استورده إلى Postman أو Insomnia (استيراد → نص خام).",
+      "exampleHintSignedPlaceholder": "شغّله في bash: يوقّع باستخدام openssl، ثم يستدعي curl. يحتوي النسخ على عنصر نائب حيث يوضع السر. لا يمكن لأدوات الاستيراد التوقيع."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "اضغط",
       "viewDocsLinkLabel": "هنا",
       "viewDocsSuffix": "للتحقق من المستندات الإضافية.",
-      "selectIntegrationPrompt": "حدد تكاملًا لعرض التفاصيل."
+      "selectIntegrationPrompt": "حدد تكاملًا لعرض التفاصيل.",
+      "codingAgent": {
+        "tabAgent": "مع وكيل برمجة",
+        "tabSteps": "خطوة بخطوة",
+        "streamLabel": "اسم تدفق التتبع",
+        "streamHelp": "يكتب الوكيل التتبعات إلى هذا التدفق ويفحصه.",
+        "envTitle": "نزّل ملف .env الخاص بك",
+        "envHelp": "احفظه في جذر المشروع. تقرأ المهارة الرمز من هذا الملف، لذا لا يظهر في الدردشة أبدًا.",
+        "envButton": "نزّل .env",
+        "promptTitle": "الصق هذا في {client1} أو {client2} أو {client3}",
+        "promptLabel": "المطالبة",
+        "promptCopied": "تم نسخ المطالبة"
+      }
     },
     "header": "مصادر البيانات",
     "resetRUMTokenLabel": "إعادة تعيين رمز RUM",
@@ -7670,6 +7995,15 @@
     "queryValues": "قيم الاستعلام",
     "constant": "ثابت",
     "textbox": "صندوق النص",
+    "date": "التاريخ",
+    "dateFormat": "تنسيق تاريخ الإخراج",
+    "dateFormatHelp": "الإخراج الافتراضي في الاستعلامات. يمكن تجاوزه لكل استخدام عبر ${'{'}name:format{'}'}، على سبيل المثال ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "ثواني الحقبة (epoch)",
+    "dateFormatEpochms": "مللي ثانية من الحقبة (epochms)",
+    "dateFormatEpochus": "ميكروثانية من الحقبة (epochus)",
     "newFolder": "مجلد جديد",
     "updateFolder": "تحديث المجلد",
     "newReport": "تقرير جديد",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "إضافة تعليقات توضيحية",
       "dependentAdhocVariableWarning": "بعض المتغيرات الديناميكية لا تطبق لأن الحقل غير موجود في تدفق الاستعلام. افتح مفتش الاستعلامات لرؤية جميع تفاصيل المتغيرات والاستعلامات التي تم تنفيذها لعرض هذه اللوحة",
       "refreshCacheReload": "تحديث ذاكرة التخزين المؤقت وإعادة التحميل",
+      "exploreCreateAlert": "إنشاء تنبيه",
+      "exploreAddToDashboard": "إضافة إلى لوحة المعلومات",
       "redirectingToLogs": "إعادة التوجيه إلى صفحة السجلات",
       "pleaseWait": "يرجى الانتظار..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "ثابت",
       "textbox": "مربع نص",
       "custom": "مخصص",
+      "date": "التاريخ",
       "list": "{type} · {example}",
       "csv": "فواصل: {example}",
       "pipe": "شرطات عمودية: {example}",
       "doublequote": "اقتباسات مزدوجة: {example}",
-      "singlequote": "اقتباسات فردية: {example}"
+      "singlequote": "اقتباسات فردية: {example}",
+      "dateIso": "التاريخ (YYYY-MM-DD): {example}",
+      "dateDmy": "اليوم أولًا (DD/MM/YYYY): {example}",
+      "dateMdy": "الشهر أولًا (MM/DD/YYYY): {example}",
+      "dateEpoch": "ثوانٍ من الحقبة: {example}",
+      "dateEpochms": "مللي ثانية من الحقبة: {example}",
+      "dateEpochus": "ميكروثانية من الحقبة: {example}"
     },
     "add": "إضافة لوحة",
     "save": "حفظ",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "تم الإقرار",
         "badgeResolved": "تم الحل",
         "badgeReopened": "أعيد فتحه",
+        "badgeAckEnded": "انتهاء الإقرار",
         "badgeDimensionsUpgraded": "الأبعاد المطورة",
         "badgeTitleChanged": "تغيير العنوان",
         "badgeAssignment": "التعيين",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "الذكاء الاصطناعي يحتاج إلى مدخلات",
         "incidentWas": "الحادث كان",
         "theIncident": "الحادث",
+        "ackEndedByPageResolve": "عبر حل إحدى نداءات المناوبة التابعة له",
         "unnamedAlert": "تنبيه",
         "alertTriggered": "أُطلق {alert} | أُطلق {alert} (عدد المرات: {count})",
         "severityUpgraded": "تم رفع الخطورة من {from} إلى {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "نبّهني",
           "toast": "تم الاستيراد من تحليلات المنتج: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "إنشاء تنبيه",
+          "toast": "تم استيراد الاستعلام من بحث التتبع الخاص بك",
+          "noStream": "اختر تدفقًا أولًا",
+          "errorCount": "عدد الأخطاء",
+          "errorRate": "معدل الأخطاء"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "لم يتم نقل فلتر البحث الخاص بك لأنه يحتاج أولاً إلى خيار التشغيل باسم في صفحة السجلات. أضفه إلى استعلام التنبيه إذا كنت بحاجة إليه.",
         "thresholdColumnGuessed": "تم تطبيق العتبة على {column}؛ تحقق من أنها القيمة التي تقصدها.",
         "thresholdNotCarried": "لم يتم تطبيق العتبة {value} من المخطط لأنك اخترت استعلامًا مختلفًا.",
-        "rumFunnelExclusions": "يستخدم عوامل تصفية التطبيق كما هي الآن؛ أعد إنشاءه بعد تغييرها."
+        "rumFunnelExclusions": "يستخدم عوامل تصفية التطبيق كما هي الآن؛ أعد إنشاءه بعد تغييرها.",
+        "tracesSeedMatches": "يُطلق عندما يتجاوز عدد الامتدادات المطابقة خلال {minutes} دقيقة {threshold} (الآن {current}).",
+        "tracesSeedSpans": "يُطلق عندما يتجاوز عدد الامتدادات خلال {minutes} دقيقة {threshold} (الآن {current}).",
+        "tracesSeedTraces": "يُطلق عندما يتجاوز عدد التتبعات خلال {minutes} دقيقة {threshold} (الآن {current}).",
+        "tracesSeedErrorSpans": "يُطلق عندما يتجاوز عدد امتدادات الأخطاء خلال {minutes} دقيقة {threshold} (الآن {current}).",
+        "tracesSeedErrorTraces": "يُطلق عندما يتجاوز عدد التتبعات التي بها أخطاء خلال {minutes} دقيقة {threshold} (الآن {current}).",
+        "tracesSeedErrorRatio": "يُطلق عندما يتجاوز معدل الأخطاء خلال {minutes} دقيقة {threshold}% (الآن {current}%).",
+        "tracesErrorRatioMinSpans": "يفحص فقط النوافذ التي تحتوي على ما لا يقل عن {minimum} من الامتدادات، حتى لا يتسبب عدد قليل من الإخفاقات في فترة هادئة في إطلاق التنبيه.",
+        "tracesErrorRatioMinTraces": "يفحص فقط النوافذ التي تحتوي على ما لا يقل عن {minimum} من التتبعات، حتى لا يتسبب عدد قليل من الإخفاقات في فترة هادئة في إطلاق التنبيه.",
+        "tracesSeedDuration": "يُطلق عندما تكون مدة {percentile} خلال {minutes} دقيقة أعلى من {threshold} مللي ثانية (الآن {current} مللي ثانية).",
+        "tracesSeedUnavailable": "تعذّرت قراءة القيمة الحالية، لذا تبدأ العتبة عند 0. اضبطها قبل الحفظ.",
+        "tracesNoMatches": "لا توجد امتدادات مطابقة بعد، لذا يُطلق التنبيه بمجرد ظهور أحدها.",
+        "tracesStoredSpans": "الأعداد مأخوذة من الامتدادات المخزّنة، لذا تبدو حركة المرور المُعاينة أقل مما هي عليه فعليًا.",
+        "tracesPeriodCapped": "تم تحديد نافذة التنبيه بحد أقصى {minutes} دقيقة للحفاظ على سرعة كل فحص.",
+        "tracesNotRun": "لم يتم تشغيل هذا البحث بعد، لذا يستخدم التنبيه الفلتر الموجود في المحرر."
       }
     },
     "saveFailed": "لم أتمكن من حفظ التنبيه.",
@@ -13906,6 +14272,8 @@
       "noMatch": "لا توجد مقاييس تتطابق مع الفلاتر الحالية",
       "noMatchHint": "حاول إزالة فلتر التسميات، أو مسح اختيارات البادئات/اللواحق، أو التبديل من \"مع البيانات\" إلى \"الكل\".",
       "noMatchHintFavorites": "حاول إزالة فلتر التسميات، أو التبديل من \"مع البيانات\" إلى \"الكل\".",
+      "noMatchYet": "لم يتم العثور على مقاييس تحتوي على بيانات بعد",
+      "noMatchYetHint": "لم تُرجع المقاييس التي تم فحصها حتى الآن أي بيانات. اعرض المزيد لمواصلة البحث.",
       "clearAllFilters": "امسح جميع الفلاتر",
       "emptyActions": {
         "clearSearch": "مسح البحث",
@@ -14122,7 +14490,8 @@
       "panelAdded": "إضافة لوحة إلى لوحة المعلومات",
       "errorAddingPanel": "خطأ أثناء إضافة لوحة",
       "selectDashboard": "يرجى اختيار لوحة معلومات",
-      "selectTab": "يرجى اختيار علامة تبويب"
+      "selectTab": "يرجى اختيار علامة تبويب",
+      "panelsToAdd": "اللوحات المراد إضافتها"
     },
     "groups": {
       "compute": "الحساب",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "آخرون"
   },
   "traces": {
+    "nlNeedsSql": "يتطلب هذا السؤال SQL؛ افتحه في السجلات",
+    "redActions": {
+      "menuGroupDashboards": "لوحات المعلومات",
+      "addRedToDashboard": "إضافة مخططات RED إلى لوحة المعلومات",
+      "durationActions": "إجراءات المدة",
+      "bucketNotice": {
+        "seconds": "تحتفظ هذه المخططات بأعمدة مدتها {count} ثانية كما تراها الآن.",
+        "minutes": "تحتفظ هذه المخططات بأعمدة مدتها {count} دقيقة كما تراها الآن.",
+        "hours": "تحتفظ هذه المخططات بأعمدة مدتها {count} ساعة كما تراها الآن.",
+        "days": "تحتفظ هذه المخططات بأعمدة مدتها {count} يوم كما تراها الآن."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "يحتفظ هذا المخطط بأعمدة مدتها {count} ثانية كما تراها الآن.",
+        "minutes": "يحتفظ هذا المخطط بأعمدة مدتها {count} دقيقة كما تراها الآن.",
+        "hours": "يحتفظ هذا المخطط بأعمدة مدتها {count} ساعة كما تراها الآن.",
+        "days": "يحتفظ هذا المخطط بأعمدة مدتها {count} يوم كما تراها الآن."
+      }
+    },
     "latencyHeatmap": {
       "title": "المدة",
       "tooltipSpans": "{count} Span | {count} Span",
@@ -15396,6 +15783,13 @@
     "nextMatch": "التطابق التالي",
     "searchInSpans": "البحث في الامتدادات",
     "criticalPath": "المسار الحرج",
+    "askAi": {
+      "explainTrace": "اشرح التتبع",
+      "explainTraceHint": "اسأل الذكاء الاصطناعي عن أبطأ الامتدادات على المسار الحرج وكل امتداد به خطأ",
+      "askAboutSpan": "اسأل الذكاء الاصطناعي عن هذا الامتداد",
+      "spanChip": "الامتداد · {operation}",
+      "traceChip": "التتبع · {operation}"
+    },
     "spansTableView": "عرض الامتدادات كجدول",
     "comingSoon": "قريبا...",
     "fetchingTrace": "جارٍ جلب التتبع.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "تصفية الأخطاء",
         "resetFilters": "إعادة تعيين فلاتر",
         "errorsNone": "لا توجد أخطاء · الأدوار: {total}",
-        "latencyLead": "أبطأ {slowest} ·",
+        "latencyLead": "متوسط الدور {avg} · الأبطأ {slowest} ·",
         "costLead": "ذروة {peak} ·",
         "tokens": "{ratio}٪ مخبأ",
         "cacheImpact": "{ratio}٪ إعادة استخدام · التوكنات المقروءة: {tokens}",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "لا توجد بيانات",
       "noErrorsInRange": "لا توجد أخطاء في هذا النطاق الزمني",
+      "loadFailed": "تعذر تحميل الأخطاء الأخيرة",
       "time": "الوقت",
       "service": "الخدمة",
       "operation": "التشغيل",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "دائما نشط (افتراضي)",
     "testAtTimeLabel": "اختبار في توقيت UTC",
     "testAtTimeHint": "اترك فارغا لاستخدام الوقت الحالي. مستويات الذروة / خارج الذروة تحل ضد هذا الوقت.",
-    "localTimeHint": "في منطقتك الزمنية: {range}"
+    "localTimeHint": "في منطقتك الزمنية: {range}",
+    "builtInStatus": {
+      "seed": "الأسعار المضمنة: قائمة أولية مرفقة مع هذا الإصدار، بتاريخ {date}.",
+      "neverSynced": "لم تُجرَ المزامنة عبر الإنترنت منذ بدء الخادم.",
+      "lastSynced": "آخر مزامنة عبر الإنترنت {time}."
+    },
+    "unpriced": {
+      "title": "فجوات التسعير",
+      "subtitle": "النماذج في تتبعات LLM الخاصة بك التي لم يكن لها سعر، أو كان لها سعر تقريبي فقط، عند الاستيعاب",
+      "banner": "لم يكن لـ{count} نموذج سعر أو كان له سعر تقريبي عند الاستيعاب. قد تكون تكلفته المسجلة غير مكتملة. | لم يكن لـ{count} من النماذج سعر أو كان لها سعر تقريبي عند الاستيعاب. قد تكون تكاليفها المسجلة غير مكتملة.",
+      "bannerTruncated": "{total} من النماذج في تتبعاتك لم يكن لها سعر أو كان لها سعر تقريبي عند الاستيعاب. قد تكون تكلفتها غير صحيحة. يتم عرض أعلى {shown} حسب الرموز.",
+      "streamLabel": "التدفق",
+      "window": "آخر 24 ساعة",
+      "windowRange": "{from} – {to}",
+      "colModel": "النموذج الظاهر في التتبعات",
+      "colPricedAs": "مسعّر كـ",
+      "colTokens": "الرموز",
+      "colCost": "التكلفة المسجلة",
+      "colActions": "الإجراءات",
+      "spans": "{count} امتداد | {count} امتدادات",
+      "moreAgents": "+{count} أخرى",
+      "noMatch": "لا يوجد تطابق",
+      "approximate": "تقريبي",
+      "pricedNow": "مسعّر للامتدادات الجديدة",
+      "historicalGap": "تحتفظ هذه النافذة بفجوة التسعير المسجلة فيها. تستخدم الامتدادات الجديدة السعر الحالي.",
+      "noActionNeeded": "لا يلزم أي إجراء",
+      "defaultTierPrices": "إدخال {input} / إخراج {output} لكل 1M",
+      "notPriced": "غير مسعّر",
+      "createPrice": "إنشاء سعر",
+      "keepPrices": "الاحتفاظ بأسعار {name}",
+      "mute": "كتم",
+      "muteConfirmTitle": "كتم هذا النموذج؟",
+      "muteConfirmMessage": "ستُسعّر الامتدادات الجديدة لـ{model} على أنها مجانية. تحتفظ الامتدادات الأقدم بتكلفتها المسجلة. احذف سعر \"{name}\" لإلغاء الكتم.",
+      "mutedNotif": "تم كتم {model}",
+      "keptNotif": "أصبح {model} يستخدم أسعار {name}",
+      "errSave": "تعذر حفظ السعر",
+      "errLoad": "تعذر تحميل النماذج غير المسعّرة",
+      "emptyTitle": "لم يُسجَّل أي استخدام لنماذج غير مسعّرة أو تقريبية في هذا التدفق في هذه النافذة.",
+      "noStreamsTitle": "لا توجد تدفقات تتبع LLM",
+      "noStreamsDesc": "تظهر النماذج هنا بمجرد وصول امتدادات gen_ai إلى تدفق تتبعات.",
+      "recordedCostNote": "تُطبَّق الأسعار الجديدة على الامتدادات المستوعبة بعد الحفظ. تحتفظ الامتدادات الأقدم بتكلفتها المسجلة.",
+      "noModelName": "(لا يوجد اسم نموذج)",
+      "noModelHint": "لا يوجد نموذج لتسعيره: عيّن gen_ai.request.model",
+      "instrumentationDocs": "دليل التجهيز"
+    }
   },
   "aiObservability": {
     "title": "قابلية الرصد بالذكاء الاصطناعي",
@@ -17238,6 +17677,8 @@
       "skipTiers": "الصفوف المتخطية: {full} بالكامل · {partial} جزئيا",
       "scoreEvidence": "{scorer} · v{version}: عينات: {samples}، بدون مرجع: {noReference}، بدون تتبع: {noTrace}",
       "scorerApplicability": "{scorer} · v{version}: خانات مؤهلة: {eligible}، بدون مرجع: {noReference}",
+      "costUnknown": "التكلفة غير معروفة",
+      "costAtLeast": "≥ {cost}",
       "loadError": "فشل في تحميل التجارب",
       "previewError": "فشل معاينة خانات التجربة",
       "createSuccess": "تم إنشاء التجربة",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "يُقدَّر أن تكلفة هذه التجربة تبلغ نحو {cost}، وهو ما يتجاوز حد التحذير {threshold}. هل تريد إنشاءها وتشغيلها على أي حال؟",
         "costConfirmMessageUnpriced": "من المقدر أن تكلّف هذه التجربة أكثر من حد التحذير. هل تريد إنشاءها وتشغيلها على أي حال؟",
         "costConfirmOk": "إنشاء على أي حال",
+        "taskProviderFailed": "لم يتم إنشاء أي شيء. لم يستجب مزوّد المهمة {provider} لنداء الاختبار.",
+        "judgeProviderFailed": "لم يتم إنشاء أي شيء. لم يستجب مزوّد المُقيِّم {provider} لنداء الاختبار.",
         "skippedFully": "صفوف تم تخطيها بالكامل: {count} — كل أداة تقييم محددة تحتاج إلى مخرج متوقع. الصفوف المتخطاة لا تكلّف شيئًا للتشغيل.",
         "skippedPartially": "صفوف تم تخطيها جزئيًا: {count} — لا تزال المهمة تعمل، لكن أدوات التقييم المعتمدة على مرجع لا يمكنها تقييم الصفوف التي ليس لها مخرج متوقع.",
         "skippedNone": "يمكن تسجيل كل صف متطابق على بعد واحد على الأقل.",
@@ -17408,7 +17851,26 @@
           "trials": "المحاولات",
           "dispersion": "التشتّت",
           "latency": "زمن الاستجابة",
-          "p50Latency": "زمن استجابة P50"
+          "p50Latency": "زمن استجابة P50",
+          "error": "الخطأ"
+        },
+        "failureBanner": {
+          "title": "فشلت {failed} من أصل {total} من الخانات: {cause}.",
+          "cause": "أهم سبب، {count} خانات: {message}",
+          "moreCauses": "+ {count} أسباب أخرى",
+          "noMessage": "لم يتم تسجيل رسالة خطأ",
+          "openProviders": "فتح المزوّدين"
+        },
+        "failureKinds": {
+          "provider_auth": "رفض المزوّد بيانات الاعتماد",
+          "rate_limited": "قيّد المزوّد معدل التشغيل",
+          "timeout": "لم يستجب المزوّد في الوقت المحدد",
+          "provider_5xx": "أعاد المزوّد خطأ في الخادم",
+          "parse_error": "تعذّر تحليل المخرجات",
+          "mapping_error": "تعذّر إنشاء مدخلات المهمة",
+          "scorer_missing": "لم تعد أداة التقييم موجودة",
+          "execution_error": "فشل استدعاء المهمة",
+          "unknown": "فشل استدعاء المهمة"
         },
         "saveAsPrompt": "حفظ كموجّه",
         "openPrompt": "فتح الموجّه",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "البيئة",
       "agent": "وكيل",
-      "version": "النسخة"
+      "version": "النسخة",
+      "agentIdHint": "معرّف الوكيل: {ids}",
+      "noAgentIdentity": "لم يتم العثور على هوية وكيل",
+      "noAgentIdentityDescription": "لا تحمل امتدادات LLM هذه اسم وكيل، لذا تُعرض حسب التدفق. عيّن السمة التي تسمّي وكيلك لعرضها حسب الوكيل.",
+      "noAgentIdentityAction": "فتح تعيين وكيل GenAI"
     },
     "agentGraph": {
       "stream": "التدفق",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "التقييمات معطّلة على هذا الخادم",
+      "description": "تحتاج هذه الصفحة إلى التقييمات المباشرة، وهي معطّلة على هذا الخادم. اطلب من المسؤول تمكينها."
+    },
     "traceScoreChip": {
       "reasoning": "لماذا",
       "noReasoning": "لم يُسجَّل أي تعليل لهذه النتيجة.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "تكوين نقطة النهاية"
     },
     "provider": {
-      "backTo": "العودة إلى مقدمي الخدمات",
+      "backTo": "المزوّدون",
       "createTitle": "إنشاء مزود LLM",
       "editTitle": "تعديل مزود LLM",
       "subtitle": "اضبط نقطة نهاية النموذج التي تستخدمها أدوات تقييم LLM judge.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "أداة التقييم {index}: الاسم \"{name}\" مستخدم أكثر من مرة في هذا الاستيراد"
         }
       },
-      "backTo": "العودة إلى أدوات التقييم",
+      "backTo": "أدوات التقييم",
       "badgeRemote": "البعيد",
       "badgeLlm": "حكَم LLM",
       "createTitleRemote": "أداة تقييم بعيدة جديدة",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "اختر مزوّدًا",
       "modelLabel": "النموذج",
       "modelPlaceholder": "GPT-4O",
+      "temperatureLabel": "درجة الحرارة",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 إلى 2. اتركه فارغًا ليكون التقييم عند 0.",
       "promptLabel": "طلب القاضي",
       "includeReasoningLabel": "تضمين المنطق",
       "includeReasoningHint": "يشرح القاضي سبب منح تلك الدرجة، التي تحفظ مع كل نتيجة.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "اسم الرأس مطلوب",
         "apiKeyTokenRequired": "الرمز مطلوب",
         "timeoutInvalid": "يجب أن يكون الوقت المستقطع صفر أو أكثر",
+        "temperatureInvalid": "يجب أن تكون درجة الحرارة بين 0 و2",
         "retriesInvalid": "يجب أن تكون المحاولات المتكررة 0 أو أكثر",
         "duplicateFieldName": "يجب أن تكون أسماء الحقول فريدة"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "متدهورة",
         "waitingForCredentials": "بانتظار بيانات الاعتماد",
         "noRecentRuns": "لا توجد عمليات تشغيل حديثة",
+        "lastScored": "آخر تقييم {time}",
         "summary": "فشل {errors} من {runs} من عمليات التشغيل خلال آخر 15 دقيقة",
         "since": "دخل هذه الحالة {time}",
         "checked": "آخر فحص {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "يقيم {percent}٪ من الأهداف المطابقة.",
       "samplingValueAllHelp": "يتم تقييم كل هدف متطابق.",
       "samplingHelp": "يعمل بعد التصفية، للتحكم في التكلفة.",
-      "backTo": "العودة إلى مهام التقييم",
+      "backTo": "مهام التقييم",
       "createTitle": "مهمة تقييم جديدة",
       "editTitle": "تحديث مهمة التقييم",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "هذا الفرع ينتهي بالفعل بوجهة معينة.",
       "chooseATriggerNodeToStart": "اختر عقدة محفزة لبدء سير العمل الخاص بك",
       "thisConnectionWouldCreateALoop": "هذا الاتصال سيخلق حلقة",
-      "onlyOneIncomingConnectionToA": "يسمح فقط باتصال وارد واحد لكل خطوة"
+      "onlyOneIncomingConnectionToA": "يسمح فقط باتصال وارد واحد لكل خطوة",
+      "endpointUrlCopied": "تم نسخ عنوان URL لنقطة النهاية"
     },
     "views": {
       "youAreNotAuthorizedToManage": "أنت غير مخول بإدارة الرخصة.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "البحث عن قاعدة بيانات أو خدمة…",
       "unnamedInstance": "النسخة غير المسماة",
+      "schemaCount": "{count} مخطط | {count} مخططات",
       "unnamedInstanceHint": "تقارير بيانات قاعدة البيانات تثبت أن هذا المحرك يعمل، لكنها لا تذكر اسم مضيف. سيظهر الصف عنوانا بمجرد إعداد تغذية تحمل عنوانا — مثل أخذ عينات الجلسة أو مقاييس النسخ.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "تم العد حتى {time}؛ النصف دقيقة الأخير لا يزال قيد الوصول.",
       "lineExact": "جميع قواعد البيانات تبلغ. يتم قياس السرعات هنا عبر كل استدعاء، لذا فهي دقيقة.",
       "lineExactEstimated": "جميع قواعد البيانات تبلغ. يتم خلط السرعات هنا من عدة فترات زمنية، لذا فهي قريبة من الدقيقة لكنها ليست دقيقة تمامًا.",
+      "lineExactSlowestSchema": "جميع قواعد البيانات تُبلّغ. السرعات دقيقة لكل مخطط؛ قاعدة البيانات ذات المخططات المتعددة تعرض أبطأها.",
       "lineSubsetUnnamed": "تضيق فلاترك هذا أدنى من المستوى الذي تتجمع عنده هذه الإجماليات، لذا تصف النسب الصفوف المعروضة بدلاً من قاعدة البيانات بأكملها.",
       "lineQuery": "يتم قياس التوقيتات من تطبيقك، لذا فهي تشمل وقت الشبكة وأي انتظار لاتصال متاح.",
       "lineUncodedErrors": "{percent} من الفشل هنا عادت بدون رمز سبب، لذا يمكن عدها ولكن لا يمكن شرحها.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "هذه هي المرة الأولى التي انطلق فيها هذا التنبيه.",
     "escalationNotStarted": "لم يُرسل نداء بعد",
     "escalationPagesNobody": "لا يُرسل نداءً لأحد",
+    "escalationNobodyPaged": "لا أحد قيد الاستدعاء",
     "escalationTo": "يتم التصعيد إلى {who} {when}",
     "escalationDetailCapped": "يتم تحميل تفاصيل التصعيد المباشرة لأقدم النداءات المفتوحة ({count}).",
     "responder": "المستجيب",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "إلى",
     "rotationRestrictionAdd": "أضف نافذة",
     "rotationRestrictionRemove": "إزالة",
-    "rotationRestrictionZeroLength": "إذا تطابقا 'من' و'إلى'، فلن تنطبق هذه النافذة أبدًا ولن تُفعّل الطبقة بصمت أبدًا. ليوم كامل، اضبط 'إلى' على 24:00.",
+    "rotationRestrictionZeroLength": "قيمتا من وإلى متطابقتان، لذا لا تتطابق هذه النافذة أبدًا. يبقى الحفظ معطّلًا حتى تختلف قيمتا من وإلى؛ ليوم كامل، اضبط إلى على 24:00.",
     "rotationRetiredTag": "موقوفة",
     "rotationSectionWhen": "وقت التبديل",
     "rotationName": "اسم التناوب",
@@ -25593,6 +26072,10 @@
     "snoozed": "مؤجَّل",
     "snoozedUntil": "هادئ حتى {time} — لا يزال بدون مسؤول",
     "snoozeFailed": "تعذر إيقاف النداء مؤقتًا",
+    "unsnooze": "إنهاء التأجيل",
+    "unsnoozeHint": "ينهي التأجيل الآن. يستمر الاستدعاء من الخطوة التي توقف عندها.",
+    "unsnoozed": "انتهى التأجيل · يستمر الاستدعاء",
+    "unsnoozeFailed": "تعذّر إنهاء التأجيل",
     "note": "ملاحظة",
     "notePlaceholder": "ماذا وجدت؟ ماذا جربت؟",
     "addNote": "إضافة ملاحظة",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "نفس الأشخاص، متأخرين بوردية واحدة، بحيث لا يكون الشخص الثانوي هو المناوب حاليًا. إنه تناوب عادي — لا شيء يربط بين الاثنين، لذا تعديل جدول أحدهما دون الآخر يؤدي إلى انحرافهما، وستحصل على تحذير بدلاً من إصلاح صامت.",
     "rotationPreviewPairLegend": "الأساسي · الثانوي",
     "rotationPreviewEmpty": "اختر الأشخاص وأول تسليم لمعرفة من في المناوبة ومتى.",
+    "rotationPreviewNow": "الآن – {until}",
     "defaultRotationName": "تناوب",
     "teamCreatedWithoutMembers": "تم إنشاء الفريق، لكن تعذرت إضافة أعضائه. أضفهم في تبويب الأعضاء.",
     "teamCreatedWithoutRotation": "تم إنشاء الفريق وأعضائه، لكن تعذر حفظ التناوب. حدده في تبويب الجدول.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "لم يُقرّ بها أحد — لا تزال تستدعي المناوبين",
     "sectionHint_ringingRouted": "لم يتولَّ أحد المسؤولية — {count} منها لا يزال قيد الاستدعاء | لم يتولَّ أحد المسؤولية — {count} منها لا يزال قيد الاستدعاء",
     "sectionHint_ringingUnrouted": "{count} ليس له فريق، لذا لا يتم استدعاؤه | {count} ليس لها فريق، لذا لا يتم استدعاؤها",
+    "sectionHint_ringingStopped": "{count} لا يتم استدعاؤه | {count} لا يتم استدعاؤهم",
     "sectionHint_snoozed": "تم إيقاف الاستدعاء مؤقتًا — ستعود من تلقاء نفسها",
     "sectionHint_handled": "تم إقرارها — يوجد مسؤول بشري لكل منها",
     "sectionHint_resolved": "أُغلقت — تُحفظ للسجل",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "الفريق الذي يتم استدعاؤه عندما تتطابق إشارة. يحدد سلم التصعيد الخاص به من يُوقظ وبأي ترتيب.",
     "scopeOwns": "يمتلك هذا الفريق",
     "scopeAdvanced": "متقدم",
-    "ruleEditorConflictUnclaimed": "لا شيء يطالب بهذا المسار اليوم — تنبيه مطابق له يصل إلى الفريق العام، أو لا أحد.",
+    "ruleEditorConflictUnclaimed": "لا شيء يغطي هذا المسار اليوم، بناءً على هذه الشروط وحدها — فالنداء المطابق له يصل إلى القاعدة الشاملة، أو لا يصل إلى أحد.",
     "ruleEditorConflictHeldBy": "اليوم، يذهب النداء المطابق لهذا إلى {team} عبر {path}.",
     "ruleEditorConflictTakesOver": "قاعدتك أكثر تحديدًا، لذا ستأخذ هذه من {team}.",
     "ruleEditorConflictKeptBy": "مسار {team} أكثر تحديدًا، لذا يبقى معهم وتلتقط هذه القاعدة ما تبقى فقط.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} يستدعي هذا الفريق في {scope} فقط. في أي مكان آخر، يعود الأمر لمن يملك النطاق المحيط.",
     "scopeNothingDiscovered": "لم يتم اكتشاف أي شيء حتى الآن، لذا لا توجد موارد للاختيار منها. استخدم الوضع المتقدم لكتابة القاعدة حسب الحقل، أو أرسل بعض بيانات القياس أولاً.",
     "scopeAdvancedHint": "طابق أي حقل وقيمة، بما في ذلك تلك التي لا تغطيها المستويات أعلاه.",
+    "scopeValuesSeen": "تعرض هذه القوائم القيم التي رصدها اكتشاف الخدمة. لمطابقة أي قيمة أخرى، استخدم الوضع المتقدم.",
     "escalationHeld": "فرز الذكاء الاصطناعي أولًا · الاستدعاء خلال {n} ث كحد أقصى",
     "escalationPagingStep": "جارٍ الاستدعاء: الخطوة {step} من {total} · {who}",
     "escalationPagingStepOnly": "جارٍ الاستدعاء: الخطوة {step} من {total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "إنشاء فريق ومناوبة",
     "removeMemberHandsOver": "يتولى {name} نوبة {leaving} الحالية في {rotation}.",
     "removeMemberLeavesGap": "لا أحد يتولى نوبة {leaving} الحالية في {rotation}.",
+    "removeMemberReorders": "كما يغادرون {rotations}، لذا قد يتغير من يكون في المناوبة هناك أيضًا.",
     "membersJoinEnd": "ينضم {names} إلى نهاية {rotations}. المناوب الحالي لا يتغير. | ينضم {names} إلى نهاية {rotations}. المناوب الحالي لا يتغير.",
     "membersAdded": "تمت إضافة {names}. | تمت إضافة {names}.",
     "removeMemberConfirm": "إزالة",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "الأسئلة: {contact}",
       "outboundQueue": "رسائل التنبيه: {count} في الانتظار، الأقدم {age} | رسائل التنبيه: {count} في الانتظار، الأقدم {age}",
       "outboundEmpty": "لا توجد رسائل تنبيه في الانتظار",
+      "refusedPosts": "{count} منشور تنبيه فشل خلال آخر 24 ساعة. الأخير: {reason} على {destination}، | فشلت {count} منشورات تنبيه خلال آخر 24 ساعة. الأخير: {reason} على {destination}،",
       "ageSeconds": "{count} ث"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "تعذر إرسال التذكيرات."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(لا يوجد اسم نموذج)",
+    "topModels": "{models} (أعلى {shown} من {total})",
+    "cost": {
+      "partial": "جزئي",
+      "unknown": "التكلفة غير معروفة",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "تكلفة جزئية. لا يوجد سعر لـ {models}: لا تُحتسب {tokens} من الرموز ضمن نطاق {scope} الحالي.",
+      "unknownTooltip": "التكلفة غير معروفة. لا يوجد سعر لـ {models}: لا توجد تكلفة لأي من الرموز {tokens} ضمن نطاق {scope} الحالي.",
+      "scopeSession": "الجلسة",
+      "scopeTrace": "التتبع",
+      "unknownModel": "نموذج بلا اسم",
+      "addPrice": "إضافة سعر"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} رمز بلا سعر",
+      "unpricedTooltip": "التكلفة حد أدنى: {tokens} رمز على {models} بلا سعر. افتح علامة التبويب غير المسعّرة في تسعير نماذج LLM.",
+      "pricedSinceTooltip": "التكلفة حد أدنى: سُجّل {tokens} رمز على {models} قبل إضافة سعر ولا يحتفظ بأي تكلفة."
+    },
+    "chart": {
+      "costMissing": "غير مدرج في هذا المخطط: {models}. {tokens} رمز بلا سعر.",
+      "costMissingPricedSince": "غير مدرج في هذا المخطط: {models}. تم تسجيل {tokens} رمز قبل إضافة سعر.",
+      "unpricedModels": "بلا سعر: {models}",
+      "pricedSinceModels": "سُجّل قبل إضافة سعر: {models}",
+      "addPrice": "إضافة سعر"
+    },
+    "health": {
+      "title": "صحة البيانات",
+      "passing": "{n} ناجحة",
+      "checkedAgo": "فُحص {ago}",
+      "drawerTitle": "صحة بيانات الذكاء الاصطناعي",
+      "drawerSubtitle": "{stream} · النافذة الحالية",
+      "rerun": "إعادة تشغيل الفحوصات",
+      "close": "إغلاق",
+      "loadError": "تعذّر تشغيل فحوصات صحة البيانات.",
+      "samples": "العينات:",
+      "copyLink": "نسخ الرابط لمسؤول",
+      "linkCopied": "تم نسخ الرابط",
+      "status": {
+        "pass": "ناجح",
+        "warning": "تحذير",
+        "error": "خطأ"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "النماذج غير المسعّرة",
+          "detail": "{count} نموذج · {spans} امتداد · {tokens} رمز محسوب كـ $0 | {count} نماذج · {spans} امتدادات · {tokens} رموز محسوبة كـ $0",
+          "pass": "كل نموذج في هذه النافذة له سعر. الامتدادات المسجلة قبل إضافة سعر تحتفظ بتكلفتها المسجلة.",
+          "fix": "أصلح في تسعير نماذج LLM",
+          "truncated": "أعلى {shown} من {total} حسب الرموز"
+        },
+        "missing_agent_identity": {
+          "label": "هوية الوكيل مفقودة",
+          "detail": "{affected} من {total} من امتدادات LLM ({pct}) لا تحتوي على gen_ai.agent.name، لذا لا تظهر في عروض الوكلاء.",
+          "pass": "كل امتداد LLM يحمل اسم وكيل أو معرّفًا.",
+          "fix": "افتح تعيين وكيل GenAI"
+        },
+        "zero_duration_spans": {
+          "label": "امتدادات بمدة صفرية",
+          "detail": "{affected} من امتدادات LLM تُبلغ عن 0 ms، لذا تبدو زمن الاستجابة ومدة الجلسة أقل من اللازم.",
+          "pass": "لا يُبلغ أي امتداد LLM عن 0 ms.",
+          "fix": "كيفية الإصلاح"
+        },
+        "missing_session_id": {
+          "label": "امتدادات بلا معرّف جلسة",
+          "detail": "{affected} من {total} من امتدادات LLM ({pct}) لا تحتوي على gen_ai.conversation.id، لذا لا تظهر في الجلسات.",
+          "pass": "كل امتداد LLM لديه gen_ai.conversation.id.",
+          "fix": "دليل التكامل"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "إدارة الأساطيل",
     "subtitle": "سجّل OpenTelemetry Collectors، وأصدِر نسخًا من تكويناتها، واطرح التغييرات بأمان",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "قيد التنفيذ",
       "scheduled": "مجدول",
+      "waiting": "قيد الانتظار",
       "completed": "مكتمل",
       "halted": "متوقف",
       "superseded": "تم استبداله",
@@ -28696,7 +29257,7 @@
       "version": "الإصدار",
       "pickConfig": "اختر تكوينًا",
       "pickFleet": "اختر أسطولًا",
-      "emptyFleet": "لا يحتوي الأسطول على Collectors، لذا يُضبط الإصدار فورًا",
+      "emptyFleet": "لا يحتوي الأسطول على أي جامعات، لذا ينتظر الطرح حتى تنضم إحداها.",
       "startingShortly": "يبدأ قريبًا",
       "eventGateFailed": "فشلت بوابة الصحة",
       "eventHalted": "توقف",
@@ -28707,7 +29268,10 @@
       "notFound": "عملية الطرح هذه لم تعد موجودة",
       "notFoundDescription": "قد يكون الرابط قديمًا. اختر عملية طرح من القائمة.",
       "noneTargeted": "لم يتم استهداف أي Collector",
-      "outcomeNoneTargeted": "لم يكن في الأسطول أي Collector عند ضبط v{to}.",
+      "outcomeNoneTargeted": "لم يعتمد أي جامع v{to} في هذا الطرح.",
+      "outcomeWaiting": "لا يوجد أي جامع متصل، لذا لم يصل v{to} إلى أي منها بعد. يبدأ الطرح عند اتصال أحدها.",
+      "waitingForCollector": "بانتظار جامع",
+      "notStarted": "لم يبدأ",
       "versionFailedBefore": "v{version} · فشل سابقًا",
       "pickVersion": "اختر إصدارًا",
       "autoRollback": "التراجع تلقائيًا",
@@ -28732,6 +29296,7 @@
       "eventResumed": "تم الاستئناف",
       "eventSkipped": "تم تخطي Collectors الفاشلة",
       "eventStarted": "بدأ",
+      "eventWaiting": "بانتظار اتصال جامع",
       "eventTimedOut": "انتهت مهلة المرحلة",
       "eventSkippedOffline": "تم استبعاد {count} Collector كان غير متصل عند البدء؛ سيتلقى الإصدار عند إعادة اتصاله | تم استبعاد {count} Collectors كانت غير متصلة عند البدء؛ ستتلقى الإصدار عند إعادة اتصالها",
       "excluded": "مستبعد",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "المرحلة التي لا تؤكد ولا ترفض خلال {minutes} د توقف عملية الطرح (إعداد الأسطول)",
       "phaseVerifying": "قيد التحقق",
       "phases": "المراحل",
-      "planEmpty": "لا توجد Collectors للتحديث",
+      "planEmpty": "لا يوجد أي جامع متصل، لذا ينتظر الطرح حتى يتصل أحدها.",
+      "planStable": "لا يوجد أي جامع متصل؛ يُطبَّق الإصدار المستقر على كل جامع عند اتصاله",
       "planOne": "{count} Collector في دفعة واحدة | {count} Collectors في دفعة واحدة",
       "planText": "{steps} ← المتبقي {last}، {count} مراحل",
       "planUnavailable": "معاينة الخطة غير متاحة",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "القيمة 0 تُبقي Collectors غير المتصلة إلى الأبد"
     },
     "audit": {
-      "search": "البحث في سجل التدقيق",
       "editedConfig": "تم تعديل التكوين",
       "revokedToken": "تم إلغاء رمز التسجيل",
       "enrolledCollector": "تم تسجيل Collector",
@@ -28920,7 +29485,6 @@
       "setDesired": "تم تغيير الإصدار",
       "autoRollback": "تم التراجع تلقائيًا",
       "rolloutHalted": "توقفت عملية الطرح",
-      "assignedFleetConfig": "تم تعيين تكوين الأسطول",
       "createdFleet": "تم إنشاء أسطول",
       "renamedFleet": "تمت إعادة تسمية أسطول",
       "deletedFleet": "تم حذف أسطول",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "تم التراجع عن عملية الطرح",
       "movedByToken": "نُقل بواسطة رمز التسجيل",
       "object": "الكائن",
+      "search": "البحث في سجل التدقيق",
       "allObjects": "كل الكائنات",
       "kind": {
         "fleet": "الأسطول",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "طرح v{to}",
       "rolloutHalted": "توقف طرح v{to}",
+      "rolloutWaiting": "v{to} ينتظر اتصال جامع",
       "autoRolledBack": "تم التراجع عن v{to} تلقائيًا",
       "noReason": "لم يُبلَّغ عن سبب للفشل",
       "openRollout": "فتح عملية الطرح",
diff --git a/web/src/locales/languages/de-DE.json b/web/src/locales/languages/de-DE.json
index 2a29823219..3e347e096c 100644
--- a/web/src/locales/languages/de-DE.json
+++ b/web/src/locales/languages/de-DE.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Noch keine LLM-Aktivität",
       "description": "Instrumentieren Sie Ihre Dienste mit den OpenTelemetry Gen-AI-Semantikkonventionen und erfassen Sie mindestens einen Trace, um dieses Dashboard zu füllen.",
-      "action": "Instrument mit OpenTelemetrie",
-      "actionDesc": "Erfassen Sie gen_ai_*-Attribute in Ihren Traces"
+      "action": "Alle KI-Integrationen",
+      "actionDesc": "Alle Framework- und Anbieterleitfäden durchsuchen",
+      "suggested": "Tracing für {name} einrichten",
+      "suggestedDesc": "Empfohlen, weil Sie aus der {name}-Dokumentation kommen",
+      "codingAgent": "Mit einem Coding-Agenten instrumentieren",
+      "codingAgentDesc": "Ihr Coding-Agent fügt Tracing hinzu und prüft den ersten Trace.",
+      "startFrom": "Oder starten mit"
     },
     "noLLMSessions": {
       "title": "Noch keine LLM-Sitzungen",
@@ -4797,6 +4802,13 @@
       "success": "Erfolg",
       "failed": "Fehlgeschlagen",
       "testRun": "Testlauf",
+      "source": "Quelle",
+      "sourceHttp": "HTTP-Anfrage",
+      "sourceAlertFired": "Alarm ausgelöst",
+      "sourceIncidentEvent": "Vorfall-Ereignis",
+      "sourceRetry": "Wiederholungslauf",
+      "sourceManual": "Manueller Lauf",
+      "sourceOther": "Sonstiges",
       "runType": "Typ",
       "testRunTooltip": "Vom Editor aus gestartet. Ziel-Schritte werden tatsächlich ausgeführt.",
       "showTestRuns": "{count} Testlauf/-läufe anzeigen",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Diesen Lauf erneut ausführen?",
       "retryMessage": "Dadurch wird ein neuer Lauf aus den Eingaben erstellt, die der fehlgeschlagene Lauf aufgezeichnet hat. Ziel-Schritte werden tatsächlich ausgeführt.",
       "retryStarted": "Wiederholung gestartet – sie erscheint als neuer Lauf in der Liste.",
-      "retryError": "Dieser Lauf konnte nicht wiederholt werden"
+      "retryError": "Dieser Lauf konnte nicht wiederholt werden",
+      "statusQueued": "In Warteschlange",
+      "statusRunning": "Läuft",
+      "statusExpired": "Abgelaufen",
+      "reasonExpired": "nie ausgeführt · über 1 h in der Warteschlange",
+      "reasonWorkerLost": "Worker verloren · nicht erneut ausgeführt",
+      "reasonWorkflowDisabled": "Workflow war deaktiviert",
+      "reasonRunTimeout": "Timeout nach 15 Min.",
+      "allTriggers": "Alle Auslöser",
+      "triggerFilter": "Auslöser",
+      "run": "Lauf",
+      "searchRuns": "Lauf-ID, Idempotenzschlüssel oder Alarm suchen",
+      "sourceDetails": "Quellendetails",
+      "detailsWithKey": "{ip} · Schlüssel {key}",
+      "detailsNoKey": "{ip} · kein Idempotenzschlüssel",
+      "retryOf": "Wiederholung von {run}",
+      "openRun": "Lauf öffnen",
+      "alertFiredEmptyTitle": "Keine durch Alarm ausgelösten Läufe in diesem Zeitraum",
+      "incidentEventEmptyTitle": "Keine Läufe durch Vorfall-Ereignisse in diesem Zeitraum",
+      "filterEmptyTitle": "Keine passenden Läufe in diesem Zeitraum",
+      "filterEmptyDimmed": "Die anderen Läufe sind weiterhin gedimmt auf der Zeitachse.",
+      "searchEmptyTitle": "Keine Läufe entsprechen dieser Suche",
+      "searchEmptyAction": "Suche löschen",
+      "timelineNow": "jetzt",
+      "timelineAgoMinutes": "−{n} Min.",
+      "timelineAgoHours": "−{n} Std.",
+      "timelineAgoDays": "−{n} T"
     },
     "edit": "Bearbeiten",
     "view": "Anzeigen",
@@ -4958,7 +4996,9 @@
           "noMatch": "Keine Übereinstimmung"
         },
         "suppressed": "Unterdrückt – nicht an das tatsächliche Ziel gesendet"
-      }
+      },
+      "payloadFrom": "Payload von",
+      "payloadFromHint": "Die HTTP-Struktur entspricht dem, was Aufrufer an den Endpunkt senden."
     },
     "linkAlerts": {
       "title": "Workflow mit Alarmen verknüpfen",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Ausgabeformat",
       "tlsVerifyLabel": "TLS-Verifizierung",
       "tlsDisabled": "Deaktiviert"
+    },
+    "http": {
+      "runTestHint": "Führt die Schritte mit einem Beispiel-HTTP-Payload aus; ruft die URL nicht auf",
+      "runTestHintList": "Öffnen Sie den Workflow, um einen Test auszuführen",
+      "runsEmptyTitle": "Keine HTTP-Anfragen in diesem Zeitraum",
+      "runsEmptyBody": "Erweitern Sie den Zeitraum oder senden Sie eine Testanfrage über das HTTP-Endpunkt-Panel.",
+      "runsEmptyAction": "Alle Auslöser anzeigen",
+      "runFailedAt": "Dieser Lauf ist bei {step} fehlgeschlagen: {error}",
+      "openStep": "Schritt öffnen",
+      "runGuardHint": "HTTP-Läufe enthalten die Anfrage, keine Alarmfelder. Wenn dieser Schritt {fields} liest, sichern Sie ihn mit einer Bedingung ab: {guard}.",
+      "runExpiredBanner": "Diese Anfrage wartete mehr als 1 Stunde in der Warteschlange und wurde nie ausgeführt. Es lief kein Schritt und es wurde kein Ziel aufgerufen.",
+      "runWorkerLostBanner": "Der Worker, der diese Anfrage ausführt, wurde beendet. Sie wird nicht automatisch erneut ausgeführt, da Ziele möglicherweise bereits aufgerufen wurden. Prüfen Sie diese, bevor der Aufrufer erneut sendet.",
+      "request": "Anfrage",
+      "requestReceived": "Empfangen",
+      "requestToken": "Token",
+      "requestCallerIp": "IP des Aufrufers",
+      "requestIdempotencyKey": "Idempotenzschlüssel",
+      "requestContentType": "Inhaltstyp",
+      "requestBodySize": "Body-Größe",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Header",
+      "headersKept": "{count} beibehalten · Authorization, Cookies und Signaturen werden nie gespeichert | {count} beibehalten · Authorization, Cookies und Signaturen werden nie gespeichert",
+      "headerName": "Name",
+      "headerValue": "Wert",
+      "outputCaption": "Was jeder nachgelagerte Schritt empfangen hat",
+      "useAsTestInput": "Als Testeingabe verwenden",
+      "editorButton": "HTTP-Endpunkt",
+      "editorButtonOn": "Ein",
+      "editorButtonOff": "Aus",
+      "editorButtonTooltip": "Lassen Sie ein anderes System diesen Workflow mit einer HTTP-Anfrage starten",
+      "editorButtonRefusedDraft": "Anfragen erhalten 403, bis der Workflow veröffentlicht ist",
+      "editorButtonRefusedPaused": "Anfragen erhalten 403, solange der Workflow pausiert ist",
+      "panelTitle": "HTTP-Endpunkt",
+      "panelSubtitle": "{name} · {kind}-Workflow",
+      "acceptRequests": "HTTP-Anfragen akzeptieren",
+      "kindNote": "Die Schritte dieses Workflows wurden für {kind}-Läufe erstellt. HTTP-Läufe erhalten stattdessen die Anfrage ({field}); fügen Sie daher eine Bedingung hinzu, wenn ein Schritt {kind}-Felder benötigt.",
+      "kindNotePayload": "HTTP-Payload anzeigen",
+      "kindNotePayloadHide": "HTTP-Payload ausblenden",
+      "unsavedBody": "Dieser Workflow ist noch nicht gespeichert. Speichern Sie ihn als Entwurf, um seine URL und sein Token zu erstellen. Anfragen werden abgelehnt, bis Sie ihn veröffentlichen.",
+      "saveAndCreate": "Entwurf speichern und Endpunkt erstellen",
+      "needsAdmin": "Das Erstellen des Endpunkts erfordert einen Organisationsadministrator.",
+      "needsEdit": "Das Ändern erfordert Bearbeitungszugriff auf diesen Workflow.",
+      "readOnlyOnMeta": "Ein · Sie können die URL kopieren. Das Ändern erfordert Bearbeitungszugriff auf diesen Workflow.",
+      "offBody": "Lassen Sie ein anderes System diesen Workflow mit einer HTTP-Anfrage starten. Sie erhalten eine URL und ein Token.",
+      "offExistingBody": "Aus · Anfragen werden abgelehnt (403), bis Sie ihn einschalten.",
+      "onMeta": "Ein · Läufe starten nur, solange der Workflow aktiviert und veröffentlicht ist",
+      "loadError": "Die Endpunkt-Einstellungen konnten nicht geladen werden.",
+      "draftBanner": "Dieser Workflow ist ein Entwurf. Aufrufe der URL erhalten 403, bis Sie ihn veröffentlichen. Sie können den Endpunkt jetzt einrichten, und Test ausführen führt die Schritte des Entwurfs mit einem Beispiel-HTTP-Payload aus.",
+      "disabledBanner": "Anfragen werden abgelehnt (403), bis Sie den Workflow aktivieren.",
+      "turnOnFailed": "Der Endpunkt konnte nicht eingeschaltet werden. {reason}",
+      "changeFailed": "Der Endpunkt konnte nicht gespeichert werden. {reason}",
+      "endpointExistsHint": "Der Endpunkt existiert bereits. Zeigen oder kopieren Sie sein Token aus der Token-Tabelle.",
+      "endpointExistsHintSigned": "Der Endpunkt existiert bereits. Zeigen oder kopieren Sie sein Signaturgeheimnis aus der Tabelle der Signaturgeheimnisse.",
+      "disableTitle": "Endpunkt ausschalten?",
+      "disableBody": "Aufrufer erhalten 403 (Endpunkt aus), bis Sie ihn wieder einschalten. Die URL und die Tokens bleiben gleich.",
+      "disableConfirm": "Ausschalten",
+      "lastCall": "Ein · Letzter Aufruf: {status} · {time} · {link}",
+      "lastCallNone": "Ein · Noch keine Aufrufe — senden Sie eine Testanfrage",
+      "lastCallNoneRefused": "Ein · Noch keine Aufrufe",
+      "viewRun": "Lauf ansehen",
+      "lastCallStatus": {
+        "queued": "in der Warteschlange",
+        "running": "läuft",
+        "succeeded": "erfolgreich",
+        "failed": "fehlgeschlagen",
+        "expired": "abgelaufen"
+      },
+      "endpointUrl": "Endpoint-URL",
+      "tokenLabel": "Token",
+      "secretLabel": "Signatur-Secret",
+      "newTokenLabel": "Neues Token",
+      "newSecretLabel": "Neues Signatur-Secret",
+      "tokenHint": "Auf dem Bildschirm maskiert; Kopieren kopiert das echte Token. Senden Sie es als {header}, niemals in der URL.",
+      "secretHint": "Auf dem Bildschirm maskiert; Kopieren kopiert das echte Secret. Signieren Sie jede Anfrage damit und senden Sie die {headers}-Header; senden Sie niemals das Secret selbst.",
+      "revealBannerTitle": "Endpoint erstellt",
+      "revealBannerBody": "Senden Sie dieses Token bei jeder Anfrage. Sie können es in der Tabelle Tokens erneut anzeigen oder kopieren.",
+      "revealBannerBodySigned": "Signieren Sie jede Anfrage mit diesem Secret. Sie können es in der Tabelle Signatur-Secrets erneut anzeigen oder kopieren.",
+      "switchedBannerTitle": "Token erstellt",
+      "switchedBannerTitleSigned": "Signatur-Secret erstellt",
+      "rotateBannerTitle": "Neues Token erstellt",
+      "rotateBannerTitleSigned": "Neues Signatur-Secret erstellt",
+      "rotateBannerBody": "Aufrufer behalten dieselbe URL und denselben Header; nur das Token ändert sich. Das alte Token funktioniert weiter, bis es abläuft, und kann bis dahin angezeigt werden.",
+      "rotateBannerBodySigned": "Aufrufer behalten dieselbe URL und dieselben Header; nur das Secret ändert sich. Das alte Secret funktioniert weiter, bis es abläuft, und kann bis dahin angezeigt werden.",
+      "rotateBannerBodyRevoked": "Aufrufer behalten dieselbe URL und denselben Header; nur das Token ändert sich. Das alte Token wurde widerrufen und funktioniert ab sofort nicht mehr.",
+      "rotateBannerBodyRevokedSigned": "Aufrufer behalten dieselbe URL und dieselben Header; nur das Secret ändert sich. Das alte Secret wurde widerrufen und funktioniert ab sofort nicht mehr.",
+      "rotateBannerBodyFresh": "Aufrufer behalten dieselbe URL und denselben Header und senden ab jetzt dieses Token.",
+      "rotateBannerBodyFreshSigned": "Aufrufer behalten dieselbe URL und dieselben Header und signieren ab jetzt mit diesem Secret.",
+      "snippetsLabel": "Beispielanfrage",
+      "sendTest": "Testanfrage senden",
+      "sendTestHint": "Prüft die Zugangsdaten und zeigt, was Ihre Schritte erhalten würden. Es wird kein Lauf gestartet, kein Ziel aufgerufen.",
+      "sendTestHintPaused": "Prüft die Zugangsdaten. Der Workflow ist pausiert, daher wird der Aufruf abgelehnt, bevor eine Eingabe erstellt wird; Test ausführen führt die Schritte aus.",
+      "sendTestSigned": "Browser können Anfragen nicht signieren, testen Sie daher mit der Beispielanfrage oben. Fügen Sie ?dry_run=true an die URL an, um die Signatur zu prüfen, ohne einen Lauf zu starten.",
+      "dryRunAccepted": "Testlauf akzeptiert",
+      "dryRunMeta": "Zugangsdaten gültig · Body: {size}",
+      "dryRunInput": "Eingabe, die Ihre Schritte erhalten würden",
+      "dryRunRefused": "Zugangsdaten gültig. Anfragen werden abgelehnt, bis der Workflow veröffentlicht ist.",
+      "dryRunRefusedPaused": "Zugangsdaten gültig. Anfragen werden abgelehnt, solange der Workflow pausiert ist.",
+      "dryRunRateLimited": "Limit erreicht — Testläufe zählen gegen das Limit.",
+      "dryRunStatus": "Die Anfrage wurde mit Status {status} abgelehnt.",
+      "dryRunFailed": "Testanfrage konnte nicht gesendet werden. {reason}",
+      "runTestInstead": "Stattdessen Test ausführen",
+      "done": "Fertig",
+      "regionTag": "Region {name}",
+      "regionBanner": "Senden Sie jede Anfrage und jeden erneuten Versuch an den Host dieser Region. Idempotenzschlüssel und Laufstatus ({field}) werden in der Region gespeichert, die den Aufruf angenommen hat, daher kann ein an eine andere Region gesendeter erneuter Versuch einen zweiten Lauf starten.",
+      "authLabel": "Aufrufer authentifizieren sich mit",
+      "authToken": "Token",
+      "authSigned": "Signierten Anfragen",
+      "authAbout": "Über die Authentifizierung",
+      "authInfo": "Token: Senden Sie das Token im Authorization-Header. Signierte Anfragen: Signieren Sie jede Anfrage mit einem gemeinsamen Secret ({headers}-Header).",
+      "switchToSignedTitle": "Zu signierten Anfragen wechseln?",
+      "switchToSignedBody": "Beim Wechsel wird das aktuelle Token sofort widerrufen und ein Signatur-Secret erstellt. Aufrufer, die das Token verwenden, erhalten ab dann 401.",
+      "switchToTokenTitle": "Auf Token umstellen?",
+      "switchToTokenBody": "Beim Wechsel wird das aktuelle Signatur-Secret sofort widerrufen und ein Token erstellt. Aufrufer, die Anfragen signieren, erhalten ab dann 401.",
+      "tokensTitle": "Tokens",
+      "secretsTitle": "Signatur-Secrets",
+      "colToken": "Token",
+      "colSecret": "Secret",
+      "colCreated": "Erstellt",
+      "colLastUsed": "Zuletzt verwendet",
+      "colStatus": "Status",
+      "colActions": "Aktionen",
+      "never": "Nie",
+      "active": "Aktiv",
+      "retiring": "Auslaufend",
+      "creatorGone": "Ersteller ist nicht mehr in dieser Organisation",
+      "revoke": "Widerrufen",
+      "revokeNow": "Jetzt widerrufen",
+      "revokeTitle": "{prefix} widerrufen? Aufrufer, die es verwenden, erhalten sofort 401.",
+      "revokeFailed": "Widerrufen fehlgeschlagen. {reason}",
+      "copyToken": "Token kopieren",
+      "copySecret": "Secret kopieren",
+      "tokenCopied": "Token kopiert",
+      "commandCopied": "Befehl kopiert",
+      "secretCopied": "Secret kopiert",
+      "revealFailed": "Token konnte nicht angezeigt werden. {reason}",
+      "revealFailedSigned": "Secret konnte nicht angezeigt werden. {reason}",
+      "revealDenied": "Nur Admins können Tokens für diesen Endpunkt anzeigen oder kopieren.",
+      "runTest": "Test ausführen",
+      "rotate": "Rotieren",
+      "rotateBlocked": "Zuerst das auslaufende Token widerrufen",
+      "rotateBlockedSigned": "Zuerst das auslaufende Secret widerrufen",
+      "rotateTitle": "Token rotieren",
+      "rotateTitleSigned": "Signatur-Secret rotieren",
+      "rotateLead": "Ein neues Token wird jetzt erstellt. {prefix} (zuletzt verwendet: {time}) bleibt funktionsfähig für",
+      "rotateLeadSigned": "Ein neues Signatur-Secret wird jetzt erstellt. {prefix} (zuletzt verwendet: {time}) bleibt funktionsfähig für",
+      "overlapNow": "Sofort widerrufen",
+      "overlapHour": "1 Stunde",
+      "overlapDay": "24 Stunden",
+      "overlapWeek": "7 Tage",
+      "rotateConsequence": "Aufrufer mit dem aktuellen Token können es bis {time} weiter verwenden. Aktualisieren Sie sie vorher.",
+      "rotateConsequenceSigned": "Aufrufer, die mit dem aktuellen Secret signieren, können es bis {time} weiter verwenden. Aktualisieren Sie sie vorher.",
+      "rotateConsequenceNow": "Aufrufer mit dem aktuellen Token erhalten ab jetzt 401.",
+      "rotateConsequenceNowSigned": "Aufrufer, die mit dem aktuellen Secret signieren, erhalten ab jetzt 401.",
+      "rotateConfirm": "Token rotieren",
+      "rotateConfirmSigned": "Signatur-Secret rotieren",
+      "rotateFailed": "Rotieren fehlgeschlagen. {reason}",
+      "advanced": "Erweitert",
+      "advancedSummary": "Max. Body {size} · {count} Anfrage pro Minute | Max. Body {size} · {count} Anfragen pro Minute",
+      "maxBody": "Max. Body-Größe (KiB)",
+      "maxBodyHint": "Bis zu 1024 (1 MiB); der Wert kann nur verringert werden",
+      "maxBodyRange": "Ganze Zahl von 1 bis 1024 eingeben",
+      "rateLimit": "Anfragen pro Minute",
+      "rateLimitHint": "Bis zu {org} pro Minute für diese Organisation",
+      "rateLimitRange": "Geben Sie eine ganze Zahl von 1 bis {org} ein",
+      "saveLimitsFailed": "Die Limits konnten nicht gespeichert werden. {reason}",
+      "deleteMeta": "Entfernt die URL sowie alle Tokens und Secrets.",
+      "deleteButton": "Endpunkt löschen",
+      "deleteTitle": "Diesen Endpunkt löschen?",
+      "deleteBody": "Die URL funktioniert sofort nicht mehr: Aufrufer erhalten 401. Alle Tokens und Signatur-Secrets werden gelöscht und können nicht wiederhergestellt werden. Der Ausführungsverlauf bleibt erhalten.",
+      "deleteFailed": "Der Endpunkt konnte nicht gelöscht werden. {reason}",
+      "secretStorageWarning": "Auf diesem Server ist kein Master-Schlüssel für die Verschlüsselung konfiguriert, daher werden Tokens und Signatur-Secrets in einer Form gespeichert, die jeder mit Datenbankzugriff lesen kann. Bitten Sie Ihren Administrator, einen festzulegen.",
+      "rejectionsLine": "Etwa {count} Anfrage wurde in den letzten 24 h abgelehnt · zuletzt: {reason}, {time} | Etwa {count} Anfragen wurden in den letzten 24 h abgelehnt · zuletzt: {reason}, {time}",
+      "rejectionsShow": "Anzeigen",
+      "rejectionsHide": "Ausblenden",
+      "rejectionsTitle": "Letzte Ablehnungen",
+      "rejectionsCaption": "etwa {count} in den letzten 24 h · der Aufrufer sah nur den Statuscode | etwa {count} in den letzten 24 h · der Aufrufer sah nur den Statuscode",
+      "rejectionMeta": "etwa {count} · zuletzt {time} · von {ip} | etwa {count} · zuletzt {time} · von {ip}",
+      "rejectionsLoadError": "Die Ablehnungen konnten nicht geladen werden.",
+      "raiseLimit": "Limit erhöhen",
+      "rotateLink": "Rotieren",
+      "reason": {
+        "invalid_token": {
+          "title": "Ungültiges Token",
+          "fix": "Der Aufrufer sendet ein Token, das widerrufen oder abgelaufen ist oder falsch eingegeben wurde. Zeigen oder kopieren Sie das aktuelle Token aus der Tokens-Tabelle."
+        },
+        "invalid_signature": {
+          "title": "Ungültige Signatur",
+          "fix": "Der Aufrufer signiert mit einem alten oder falschen Secret. Prüfen Sie, ob er das aktuelle Secret verwendet und {format} genau wie gesendet signiert."
+        },
+        "stale_timestamp": {
+          "title": "Zeitstempel zu alt",
+          "fix": "Die Uhr des Aufrufers weicht um mehr als 5 Minuten ab. Synchronisieren Sie die Uhr und signieren Sie unmittelbar vor dem Senden."
+        },
+        "endpoint_disabled": {
+          "title": "Endpunkt deaktiviert",
+          "fix": "Aktivieren Sie den Endpunkt."
+        },
+        "workflow_disabled": {
+          "title": "Workflow pausiert",
+          "fix": "Setzen Sie den Workflow in der Liste fort."
+        },
+        "workflow_not_published": {
+          "title": "Workflow nicht veröffentlicht",
+          "fix": "Veröffentlichen Sie den Workflow; Entwürfe lehnen Anfragen ab."
+        },
+        "payload_too_large": {
+          "title": "Payload zu groß",
+          "fix": "Über {size}. Senden Sie weniger oder teilen Sie die Ereignisse auf mehrere Anfragen auf."
+        },
+        "credential_in_url": {
+          "title": "Zugangsdaten in URL",
+          "fix": "Ein Token oder Secret wurde in der URL gesendet und abgelehnt. URLs landen in Proxy- und Browser-Logs; rotieren Sie es jetzt und senden Sie es anschließend in einem Header."
+        },
+        "invalid_idempotency_key": {
+          "title": "Ungültiger Idempotenzschlüssel",
+          "fix": "Der Header Idempotency-Key ist leer oder länger als 255 Zeichen."
+        },
+        "idempotency_key_reused": {
+          "title": "Idempotenzschlüssel wiederverwendet",
+          "fix": "Derselbe Schlüssel kam mit einem anderen Body an. Verwenden Sie einen neuen Schlüssel pro eindeutigem Ereignis."
+        },
+        "rate_limited": {
+          "title": "Ratenlimit erreicht",
+          "fix": "Mehr als {count} Anfragen pro Minute. Fassen Sie Ereignisse in einer Anfrage zusammen (senden Sie ein JSON-Array) oder erhöhen Sie das Limit — bis zu {org} pro Minute für diese Organisation."
+        },
+        "queue_full": {
+          "title": "Warteschlange voll",
+          "fix": "Für diese Organisation warteten bereits {count} HTTP-Ausführungen. Aufrufer sollten es nach der Retry-After-Verzögerung erneut versuchen; suchen Sie nach einem langsamen Schritt oder senken Sie die Senderate."
+        },
+        "worker_unavailable": {
+          "title": "Worker nicht verfügbar",
+          "fix": "In dieser Region lief kein Workflow-Worker, daher wurde nichts in die Warteschlange gestellt. Aufrufer, die nach der Retry-After-Verzögerung erneut versuchen, kommen durch, sobald ein Worker wieder verfügbar ist; wenn das weiterhin auftritt, bitten Sie Ihren Administrator, die Workflow-Worker zu prüfen."
+        }
+      },
+      "nodeBadge": "Über HTTP aufrufbar",
+      "triggerLinkOn": "Wird auch bei HTTP-Anfragen ausgeführt",
+      "triggerLinkOnAction": "Endpunkt verwalten",
+      "triggerLinkOff": "Auch von einem anderen System aus starten",
+      "triggerLinkOffAction": "HTTP-Endpunkt einrichten",
+      "pickerCue": "Jeder Workflow kann auch über eine HTTP-Anfrage gestartet werden. Wählen Sie seinen Trigger aus und verwenden Sie dann den HTTP-Endpunkt in der Symbolleiste.",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP-Endpunkt aktiv",
+      "listMenuItem": "HTTP-Endpunkt…",
+      "copyUrl": "Endpunkt-URL kopieren",
+      "copyUrlDraftHint": "Anfragen werden abgelehnt, bis Sie veröffentlichen",
+      "copyUrlFailed": "Die Endpunkt-URL konnte nicht kopiert werden. {reason}",
+      "payloadFrom": "Payload aus",
+      "payloadHttp": "HTTP-Anfrage",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "läuft in {count} h ab | läuft in {count} h ab",
+      "expiresInDays": "läuft in {count} Tag ab | läuft in {count} Tagen ab",
+      "expired": "Abgelaufen",
+      "rotateLeadUnused": "Ein neues Token wird jetzt erstellt. {prefix} (nie verwendet) bleibt weiterhin gültig für",
+      "rotateLeadUnusedSigned": "Ein neues Signaturgeheimnis wird jetzt erstellt. {prefix} (nie verwendet) bleibt weiterhin gültig für",
+      "fieldGroup": "HTTP-Anfrage",
+      "fieldGroupBodyHint": "Felder im Anfrage-Body erfordern zuerst einen Funktionsschritt",
+      "fieldGroupQueryHint": "Abfrageparameter sind meta.query.<key>; wiederholte Schlüssel kommen als Liste an und stimmen nie überein",
+      "rotateLeadNone": "Kein Token ist aktiv, daher können Aufrufer sich nicht authentifizieren. Ein neues Token wird jetzt erstellt.",
+      "rotateLeadNoneSigned": "Kein Signaturgeheimnis ist aktiv, daher können Aufrufer sich nicht authentifizieren. Ein neues Signaturgeheimnis wird jetzt erstellt.",
+      "createForbidden": "Sie können in dieser Organisation keine Endpunkt-Anmeldedaten erstellen.",
+      "errorNotConfigured": "Dieser Workflow hat keinen HTTP-Endpunkt.",
+      "errorNoLiveCredential": "Keine Anmeldedaten sind aktiv. Rotieren Sie, um welche zu erstellen.",
+      "errorNotAllowed": "Sie haben keine Berechtigung dafür.",
+      "copyCredentialChanged": "Anmeldedaten geändert. Erneut kopieren.",
+      "copyCommandFailed": "Der Befehl konnte nicht kopiert werden. {reason}",
+      "exampleRequest": "Beispielanfrage",
+      "exampleActiveToken": "Aktives Token · {prefix}",
+      "exampleActiveSecret": "Aktives Geheimnis · {prefix}",
+      "exampleHintToken": "Die Kopie enthält das Token. Fügen Sie sie in ein Terminal ein oder importieren Sie sie in Postman oder Insomnia (Importieren → Raw text).",
+      "exampleHintSigned": "In bash ausführen: signiert mit openssl und ruft dann curl auf. Die Kopie enthält das Geheimnis. Import-Tools können nicht signieren.",
+      "exampleHintTokenPlaceholder": "Die Kopie enthält einen Platzhalter für das Token. Fügen Sie sie in ein Terminal ein oder importieren Sie sie in Postman oder Insomnia (Importieren → Raw text).",
+      "exampleHintSignedPlaceholder": "In bash ausführen: signiert mit openssl und ruft dann curl auf. Die Kopie enthält einen Platzhalter für das Geheimnis. Import-Tools können nicht signieren."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Klicken Sie",
       "viewDocsLinkLabel": "hier",
       "viewDocsSuffix": "um weitere Dokumentation einzusehen.",
-      "selectIntegrationPrompt": "Wählen Sie eine Integration aus, um Details anzuzeigen."
+      "selectIntegrationPrompt": "Wählen Sie eine Integration aus, um Details anzuzeigen.",
+      "codingAgent": {
+        "tabAgent": "Mit einem Coding-Agent",
+        "tabSteps": "Schritt für Schritt",
+        "streamLabel": "Name des Trace-Streams",
+        "streamHelp": "Der Agent schreibt Traces in diesen Stream und prüft ihn.",
+        "envTitle": ".env herunterladen",
+        "envHelp": "Speichern Sie sie im Projektstamm. Der Skill liest das Token aus dieser Datei, sodass es nie in den Chat gelangt.",
+        "envButton": ".env herunterladen",
+        "promptTitle": "Fügen Sie dies in {client1}, {client2} oder {client3} ein",
+        "promptLabel": "Prompt",
+        "promptCopied": "Prompt kopiert"
+      }
     },
     "header": "Datenquellen",
     "resetRUMTokenLabel": "RUM-Token zurücksetzen",
@@ -7670,6 +7995,15 @@
     "queryValues": "Werte abfragen",
     "constant": "Konstante",
     "textbox": "Textfeld",
+    "date": "Datum",
+    "dateFormat": "Ausgabe-Datumsformat",
+    "dateFormatHelp": "Standardausgabe in Abfragen. Bei Bedarf überschreiben mit ${'{'}name:format{'}'}, z. B. ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Epochensekunden (epoch)",
+    "dateFormatEpochms": "Epoch-Millisekunden (epochms)",
+    "dateFormatEpochus": "Epoch-Mikrosekunden (epochus)",
     "newFolder": "Neuer Ordner",
     "updateFolder": "Ordner aktualisieren",
     "newReport": "Neuer Bericht",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Anmerkungen hinzufügen",
       "dependentAdhocVariableWarning": "Einige dynamische Variablen wurden nicht angewendet, da das Feld im Stream der Abfrage nicht vorhanden ist. Öffnen Sie den Abfrageinspektor, um alle Details der Variablen und Abfragen zu sehen, die zum Rendern dieses Panels ausgeführt wurden.",
       "refreshCacheReload": "Cache aktualisieren & neu laden",
+      "exploreCreateAlert": "Alarm erstellen",
+      "exploreAddToDashboard": "Zum Dashboard hinzufügen",
       "redirectingToLogs": "Weiterleitung zur Logs-Seite",
       "pleaseWait": "Bitte warten..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Konstante",
       "textbox": "Textfeld",
       "custom": "Benutzerdefiniert",
+      "date": "Datum",
       "list": "{type} · {example}",
       "csv": "Kommas: {example}",
       "pipe": "Pipes: {example}",
       "doublequote": "Doppelte Anführungszeichen: {example}",
-      "singlequote": "Einfache Anführungszeichen: {example}"
+      "singlequote": "Einfache Anführungszeichen: {example}",
+      "dateIso": "Datum (YYYY-MM-DD): {example}",
+      "dateDmy": "Tag zuerst (DD/MM/YYYY): {example}",
+      "dateMdy": "Monat zuerst (MM/DD/YYYY): {example}",
+      "dateEpoch": "Epoch-Sekunden: {example}",
+      "dateEpochms": "Epoch-Millisekunden: {example}",
+      "dateEpochus": "Epoch-Mikrosekunden: {example}"
     },
     "add": "Panel hinzufügen",
     "save": "Speichern",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Bestätigt",
         "badgeResolved": "Behoben",
         "badgeReopened": "Wiedereröffnet",
+        "badgeAckEnded": "Bestätigung beendet",
         "badgeDimensionsUpgraded": "Dimensionen erweitert",
         "badgeTitleChanged": "Titel geändert",
         "badgeAssignment": "Zuweisung",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "KI benötigt Eingaben",
         "incidentWas": "Vorfall war",
         "theIncident": "der Vorfall",
+        "ackEndedByPageResolve": "durch Auflösen einer der zugehörigen Alarmierungen",
         "unnamedAlert": "Alarm",
         "alertTriggered": "{alert} ausgelöst | {alert} {count} Mal ausgelöst",
         "severityUpgraded": "Schweregrad von {from} auf {to} erhöht",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Mich benachrichtigen",
           "toast": "Aus Product Analytics importiert: „{sourceLabel}“"
+        },
+        "traces": {
+          "label": "Alarm erstellen",
+          "toast": "Abfrage aus Ihrer Trace-Suche übernommen",
+          "noStream": "Wählen Sie zuerst einen Stream",
+          "errorCount": "Fehleranzahl",
+          "errorRate": "Fehlerrate"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Ihr Suchfilter wurde nicht übernommen, da dafür zuerst eine Auswahl unter „Ausführen als“ auf der Logs-Seite erforderlich ist. Fügen Sie ihn der Alarmabfrage hinzu, wenn Sie ihn benötigen.",
         "thresholdColumnGuessed": "Der Schwellenwert wurde auf {column} angewendet; prüfen Sie, ob das der gemeinte Wert ist.",
         "thresholdNotCarried": "Der Schwellenwert {value} aus dem Diagramm wurde nicht übernommen, weil Sie eine andere Abfrage gewählt haben.",
-        "rumFunnelExclusions": "Verwendet die App-Filter dieser App zum jetzigen Zeitpunkt; nach deren Änderung neu erstellen."
+        "rumFunnelExclusions": "Verwendet die App-Filter dieser App zum jetzigen Zeitpunkt; nach deren Änderung neu erstellen.",
+        "tracesSeedMatches": "Wird ausgelöst, wenn passende Spans in {minutes} Min. {threshold} überschreiten (aktuell {current}).",
+        "tracesSeedSpans": "Wird ausgelöst, wenn Spans in {minutes} Min. {threshold} überschreiten (aktuell {current}).",
+        "tracesSeedTraces": "Wird ausgelöst, wenn Traces in {minutes} Min. {threshold} überschreiten (aktuell {current}).",
+        "tracesSeedErrorSpans": "Wird ausgelöst, wenn fehlerhafte Spans in {minutes} Min. {threshold} überschreiten (aktuell {current}).",
+        "tracesSeedErrorTraces": "Wird ausgelöst, wenn Traces mit Fehlern in {minutes} Min. {threshold} überschreiten (aktuell {current}).",
+        "tracesSeedErrorRatio": "Wird ausgelöst, wenn die Fehlerrate in {minutes} Min. {threshold}% überschreitet (aktuell {current}%).",
+        "tracesErrorRatioMinSpans": "Prüft nur Zeitfenster mit mindestens {minimum} Spans, damit einzelne Fehler in einer ruhigen Phase keinen Alarm auslösen.",
+        "tracesErrorRatioMinTraces": "Prüft nur Zeitfenster mit mindestens {minimum} Traces, damit einzelne Fehler in einer ruhigen Phase keinen Alarm auslösen.",
+        "tracesSeedDuration": "Wird ausgelöst, wenn die {percentile}-Dauer über {minutes} Min. über {threshold} ms liegt (aktuell {current} ms).",
+        "tracesSeedUnavailable": "Der aktuelle Wert konnte nicht gelesen werden, daher startet der Schwellenwert bei 0. Legen Sie ihn vor dem Speichern fest.",
+        "tracesNoMatches": "Noch keine passenden Spans, daher wird der Alarm ausgelöst, sobald einer erscheint.",
+        "tracesStoredSpans": "Die Zählungen beziehen sich auf gespeicherte Spans; gesampelter Traffic erscheint daher niedriger als er tatsächlich ist.",
+        "tracesPeriodCapped": "Das Alarmfenster wurde auf {minutes} Minuten begrenzt, damit jede Prüfung schnell bleibt.",
+        "tracesNotRun": "Diese Suche wurde noch nicht ausgeführt, daher verwendet der Alarm den Filter im Editor."
       }
     },
     "saveFailed": "Der Alarm konnte nicht gespeichert werden.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Keine Metriken entsprechen den aktuellen Filtern",
       "noMatchHint": "Versuchen Sie, einen Label-Filter zu entfernen, die Präfix-/Suffix-Auswahlen zu löschen oder von „Mit Daten“ auf „Alle“ umzuschalten.",
       "noMatchHintFavorites": "Versuchen Sie, einen Label-Filter zu entfernen oder von „Mit Daten“ zu „Alle“ zu wechseln.",
+      "noMatchYet": "Noch keine Metriken mit Daten gefunden",
+      "noMatchYetHint": "Die bisher geprüften Metriken lieferten keine Daten. Zeigen Sie mehr an, um weiter zu suchen.",
       "clearAllFilters": "Alle Filter löschen",
       "emptyActions": {
         "clearSearch": "Suche löschen",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Panel zum Dashboard hinzugefügt",
       "errorAddingPanel": "Fehler beim Hinzufügen des Panels",
       "selectDashboard": "Bitte wählen Sie ein Dashboard aus",
-      "selectTab": "Bitte wählen Sie einen Tab aus"
+      "selectTab": "Bitte wählen Sie einen Tab aus",
+      "panelsToAdd": "Hinzuzufügende Panels"
     },
     "groups": {
       "compute": "Compute",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Andere"
   },
   "traces": {
+    "nlNeedsSql": "Diese Frage benötigt SQL; öffnen Sie sie in Logs",
+    "redActions": {
+      "menuGroupDashboards": "Dashboards",
+      "addRedToDashboard": "RED-Diagramme zum Dashboard hinzufügen",
+      "durationActions": "Dauer-Aktionen",
+      "bucketNotice": {
+        "seconds": "Diese Diagramme behalten die {count}-Sekunden-Balken, die Sie jetzt sehen.",
+        "minutes": "Diese Diagramme behalten die {count}-Minuten-Balken, die Sie jetzt sehen.",
+        "hours": "Diese Diagramme behalten die {count}-Stunden-Balken, die Sie jetzt sehen.",
+        "days": "Diese Diagramme behalten die {count}-Tage-Balken, die Sie jetzt sehen."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Dieses Diagramm behält die {count}-Sekunden-Balken, die Sie jetzt sehen.",
+        "minutes": "Dieses Diagramm behält die {count}-Minuten-Balken, die Sie jetzt sehen.",
+        "hours": "Dieses Diagramm behält die {count}-Stunden-Balken, die Sie jetzt sehen.",
+        "days": "Dieses Diagramm behält die {count}-Tage-Balken, die Sie jetzt sehen."
+      }
+    },
     "latencyHeatmap": {
       "title": "Dauer",
       "tooltipSpans": "{count} Span | {count} Spans",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Nächstes Spiel",
     "searchInSpans": "In Spans suchen",
     "criticalPath": "Kritischer Pfad",
+    "askAi": {
+      "explainTrace": "Trace erklären",
+      "explainTraceHint": "KI nach den langsamsten Spans auf dem kritischen Pfad und jedem fehlerhaften Span fragen",
+      "askAboutSpan": "KI zu diesem Span fragen",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Trace · {operation}"
+    },
     "spansTableView": "Spans-Tabellenansicht",
     "comingSoon": "Kommt bald...",
     "fetchingTrace": "Ihr Trace wird geladen.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Fehler filtern",
         "resetFilters": "Filter zurücksetzen",
         "errorsNone": "Keine Fehler · {total} Umdrehungen",
-        "latencyLead": "Langsamste {slowest} ·",
+        "latencyLead": "Ø Turn {avg} · Langsamster {slowest} ·",
         "costLead": "Gipfel {peak} ·",
         "tokens": "{ratio}% Zwischengespeichert",
         "cacheImpact": "{ratio}% Wiederverwendet · {tokens} Zu lesen",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Keine Daten",
       "noErrorsInRange": "Keine Fehler in diesem Zeitraum",
+      "loadFailed": "Letzte Fehler konnten nicht geladen werden",
       "time": "Zeit",
       "service": "Dienst",
       "operation": "Vorgang",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Immer aktiv (Standard)",
     "testAtTimeLabel": "Zu UTC-Zeit testen",
     "testAtTimeHint": "Leer lassen, um die aktuelle Zeit zu verwenden. Spitzen- / Nebenzeiten-Stufen werden anhand dieser Zeit aufgelöst.",
-    "localTimeHint": "In Ihrer Zeitzone: {range}"
+    "localTimeHint": "In Ihrer Zeitzone: {range}",
+    "builtInStatus": {
+      "seed": "Integrierte Preise: Startliste aus dieser Version, Stand {date}.",
+      "neverSynced": "Seit dem Serverstart wurde keine Online-Synchronisierung ausgeführt.",
+      "lastSynced": "Zuletzt online synchronisiert: {time}."
+    },
+    "unpriced": {
+      "title": "Preislücken",
+      "subtitle": "Modelle in Ihren LLM-Traces, die bei der Erfassung keinen oder nur einen ungefähren Preis hatten",
+      "banner": "{count} Modell hatte bei der Erfassung keinen oder nur einen ungefähren Preis. Die erfassten Kosten sind möglicherweise unvollständig. | {count} Modelle hatten bei der Erfassung keinen oder nur einen ungefähren Preis. Die erfassten Kosten sind möglicherweise unvollständig.",
+      "bannerTruncated": "{total} Modelle in Ihren Traces hatten bei der Erfassung keinen oder nur einen ungefähren Preis. Deren Kosten sind möglicherweise falsch. Angezeigt werden die Top {shown} nach Tokens.",
+      "streamLabel": "Stream",
+      "window": "Letzte 24 Stunden",
+      "windowRange": "{from} – {to}",
+      "colModel": "In Traces gesehenes Modell",
+      "colPricedAs": "Bepreist als",
+      "colTokens": "Tokens",
+      "colCost": "Erfasste Kosten",
+      "colActions": "Aktionen",
+      "spans": "{count} Span | {count} Spans",
+      "moreAgents": "+{count} weitere",
+      "noMatch": "Keine Übereinstimmung",
+      "approximate": "Ungefähr",
+      "pricedNow": "Für neue Spans bepreist",
+      "historicalGap": "Dieser Zeitraum behält die erfasste Preislücke. Neue Spans verwenden den aktuellen Preis.",
+      "noActionNeeded": "Keine Aktion erforderlich",
+      "defaultTierPrices": "Eingabe {input} / Ausgabe {output} pro 1M",
+      "notPriced": "nicht bepreist",
+      "createPrice": "Preis anlegen",
+      "keepPrices": "Preise von {name} beibehalten",
+      "mute": "Stummschalten",
+      "muteConfirmTitle": "Dieses Modell stummschalten?",
+      "muteConfirmMessage": "Neue Spans von {model} werden als kostenlos bepreist. Ältere Spans behalten ihre erfassten Kosten. Löschen Sie den Preis \"{name}\", um die Stummschaltung aufzuheben.",
+      "mutedNotif": "{model} stummgeschaltet",
+      "keptNotif": "{model} verwendet jetzt die Preise von {name}",
+      "errSave": "Preis konnte nicht gespeichert werden",
+      "errLoad": "Unbepreiste Modelle konnten nicht geladen werden",
+      "emptyTitle": "In diesem Stream wurde in diesem Zeitraum keine unbepreiste oder ungefähre Modellnutzung erfasst.",
+      "noStreamsTitle": "Keine LLM-Trace-Streams",
+      "noStreamsDesc": "Modelle erscheinen hier, sobald gen_ai-Spans einen Trace-Stream erreichen.",
+      "recordedCostNote": "Neue Preise gelten für Spans, die nach dem Speichern erfasst werden. Ältere Spans behalten ihre erfassten Kosten.",
+      "noModelName": "(kein Modellname)",
+      "noModelHint": "Kein Modell zum Bepreisen: gen_ai.request.model setzen",
+      "instrumentationDocs": "Instrumentierungsleitfaden"
+    }
   },
   "aiObservability": {
     "title": "LLM Beobachtbarkeit",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Übersprungene Zeilen: {full} vollständig · {partial} teilweise",
       "scoreEvidence": "{scorer} · v{version}: {samples} Stichproben, {noReference} ohne Referenz, {noTrace} ohne Trace",
       "scorerApplicability": "{scorer} · v{version}: {eligible} gültige Slots, {noReference} ohne Referenz",
+      "costUnknown": "Kosten unbekannt",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Fehler beim Laden der Experimente",
       "previewError": "Fehler bei der Vorschau der Experiment-Slots",
       "createSuccess": "Experiment erstellt",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Für dieses Experiment werden Kosten von etwa {cost} geschätzt, was über dem Warnschwellenwert von {threshold} liegt. Trotzdem erstellen und ausführen?",
         "costConfirmMessageUnpriced": "Für dieses Experiment werden voraussichtlich Kosten über dem Warnschwellenwert anfallen. Trotzdem erstellen und ausführen?",
         "costConfirmOk": "Trotzdem erstellen",
+        "taskProviderFailed": "Es wurde nichts erstellt. Der Task-Provider {provider} hat den Testaufruf nicht beantwortet.",
+        "judgeProviderFailed": "Es wurde nichts erstellt. Der Judge-Provider {provider} hat den Testaufruf nicht beantwortet.",
         "skippedFully": "{count} Zeilen vollständig übersprungen — jeder ausgewählte Scorer benötigt eine erwartete Ausgabe. Übersprungene Zeilen kosten nichts bei der Ausführung.",
         "skippedPartially": "{count} Zeilen teilweise übersprungen — die Aufgabe wird weiterhin ausgeführt, aber referenzbasierte Scorer können Zeilen ohne erwartete Ausgabe nicht bewerten.",
         "skippedNone": "Jede übereinstimmende Zeile kann in mindestens einer Dimension bewertet werden.",
@@ -17408,7 +17851,26 @@
           "trials": "Versuche",
           "dispersion": "Streuung",
           "latency": "Latenz",
-          "p50Latency": "P50-Latenz"
+          "p50Latency": "P50-Latenz",
+          "error": "Fehler"
+        },
+        "failureBanner": {
+          "title": "{failed} von {total} Slots fehlgeschlagen: {cause}.",
+          "cause": "Häufigste Ursache, {count} Einträge: {message}",
+          "moreCauses": "+ {count} weitere Ursachen",
+          "noMessage": "keine Fehlermeldung wurde aufgezeichnet",
+          "openProviders": "Provider öffnen"
+        },
+        "failureKinds": {
+          "provider_auth": "der Anbieter hat die Anmeldedaten abgelehnt",
+          "rate_limited": "der Anbieter hat den Lauf per Rate-Limit begrenzt",
+          "timeout": "der Anbieter hat nicht rechtzeitig geantwortet",
+          "provider_5xx": "der Anbieter hat einen Serverfehler zurückgegeben",
+          "parse_error": "die Ausgabe konnte nicht geparst werden",
+          "mapping_error": "die Aufgabeneingabe konnte nicht erstellt werden",
+          "scorer_missing": "ein Scorer existiert nicht mehr",
+          "execution_error": "der Aufgabenaufruf ist fehlgeschlagen",
+          "unknown": "der Aufgabenaufruf ist fehlgeschlagen"
         },
         "saveAsPrompt": "Als Prompt speichern",
         "openPrompt": "Prompt öffnen",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Umgebung",
       "agent": "Agent",
-      "version": "Version"
+      "version": "Version",
+      "agentIdHint": "Agent-ID: {ids}",
+      "noAgentIdentity": "Keine Agent-Identität gefunden",
+      "noAgentIdentityDescription": "Diese LLM-Spans enthalten keinen Agent-Namen, daher werden sie nach Stream angezeigt. Ordnen Sie das Attribut zu, das Ihren Agent benennt, um sie nach Agent anzuzeigen.",
+      "noAgentIdentityAction": "GenAI-Agent-Zuordnung öffnen"
     },
     "agentGraph": {
       "stream": "Stream",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Evaluierungen sind auf diesem Server deaktiviert",
+      "description": "Diese Seite benötigt Online-Evaluierungen, die auf diesem Server deaktiviert sind. Bitten Sie Ihren Administrator, sie zu aktivieren."
+    },
     "traceScoreChip": {
       "reasoning": "Warum",
       "noReasoning": "Keine Begründung für diesen Score aufgezeichnet.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Endpunkt konfigurieren"
     },
     "provider": {
-      "backTo": "Zurück zu Anbietern",
+      "backTo": "Provider",
       "createTitle": "LLM-Anbieter erstellen",
       "editTitle": "LLM-Anbieter bearbeiten",
       "subtitle": "Konfigurieren Sie den Modellendpunkt, der von LLM-Judge Scorern verwendet wird.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Scorer {index}: Name \"{name}\" wird in diesem Import mehr als einmal verwendet"
         }
       },
-      "backTo": "Zurück zu den Scorern",
+      "backTo": "Scorer",
       "badgeRemote": "Fernbedienung",
       "badgeLlm": "LLM-Judge",
       "createTitleRemote": "Neuer Remote-Scorer",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Anbieter wählen",
       "modelLabel": "Modell",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperatur",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 bis 2. Leer lassen, um mit 0 zu bewerten.",
       "promptLabel": "Aufforderung des Richters",
       "includeReasoningLabel": "Begründung einbeziehen",
       "includeReasoningHint": "Der Judge erklärt, warum er diese Bewertung gegeben hat, gespeichert mit jedem Ergebnis.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Header-Name ist erforderlich",
         "apiKeyTokenRequired": "Token ist erforderlich",
         "timeoutInvalid": "Timeout muss 0 oder größer sein",
+        "temperatureInvalid": "Die Temperatur muss zwischen 0 und 2 liegen",
         "retriesInvalid": "Wiederholungen müssen 0 oder größer sein",
         "duplicateFieldName": "Feldnamen müssen eindeutig sein"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Degradiert",
         "waitingForCredentials": "Warte auf Anmeldedaten",
         "noRecentRuns": "Keine aktuellen Ausführungen",
+        "lastScored": "Zuletzt bewertet {time}",
         "summary": "{errors} von {runs} Ausführungen sind in den letzten 15 Minuten fehlgeschlagen",
         "since": "In diesen Zustand gewechselt: {time}",
         "checked": "Zuletzt geprüft: {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Bewertet {percent}% der übereinstimmenden Ziele.",
       "samplingValueAllHelp": "Jedes übereinstimmende Ziel wird bewertet.",
       "samplingHelp": "Läuft nach dem Filtern, um Kosten zu kontrollieren.",
-      "backTo": "Zurück zu den Eval-Jobs",
+      "backTo": "Eval-Jobs",
       "createTitle": "Neuer Eval-Job",
       "editTitle": "Eval-Job aktualisieren",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Dieser Zweig endet bereits in einem Ziel.",
       "chooseATriggerNodeToStart": "Wählen Sie einen Trigger-Knoten aus, um Ihren Workflow zu starten.",
       "thisConnectionWouldCreateALoop": "Diese Verbindung würde eine Schleife erzeugen.",
-      "onlyOneIncomingConnectionToA": "Es ist nur eine eingehende Verbindung zu einem Schritt zulässig."
+      "onlyOneIncomingConnectionToA": "Es ist nur eine eingehende Verbindung zu einem Schritt zulässig.",
+      "endpointUrlCopied": "Endpunkt-URL kopiert"
     },
     "views": {
       "youAreNotAuthorizedToManage": "Sie sind nicht berechtigt, die Lizenz zu verwalten.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Datenbank oder Dienst suchen…",
       "unnamedInstance": "Instanz nicht benannt",
+      "schemaCount": "{count} Schema | {count} Schemas",
       "unnamedInstanceHint": "Die eigenen Anweisungsberichte der Datenbank beweisen, dass diese Engine läuft, aber sie nennen keinen Host. Die Zeile zeigt eine Adresse, sobald ein Feed eingerichtet ist, der eine solche liefert — Session-Sampling oder Instanzmetriken.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Gezählt bis {time}; die letzte halbe Minute wird noch erfasst.",
       "lineExact": "Alle Datenbanken melden. Die Geschwindigkeiten hier werden über jeden Aufruf gemessen, sind also exakt.",
       "lineExactEstimated": "Alle Datenbanken melden. Die Geschwindigkeiten hier werden aus mehreren Zeitabschnitten gemischt, sind also ungefähr, aber nicht exakt.",
+      "lineExactSlowestSchema": "Alle Datenbanken melden. Die Geschwindigkeiten sind pro Schema exakt; eine Datenbank mit mehreren Schemas zeigt ihr langsamstes.",
       "lineSubsetUnnamed": "Ihre Filter grenzen dies unter die Ebene ein, auf der diese Summen gebildet werden, daher beschreiben die Prozentsätze die angezeigten Zeilen statt der gesamten Datenbank.",
       "lineQuery": "Zeiten werden von Ihrer Anwendung aus gemessen, daher enthalten sie Netzwerkzeit und Wartezeit auf eine freie Verbindung.",
       "lineUncodedErrors": "{percent} der Fehler hier kamen ohne einen Grundcode zurück, daher können sie gezählt, aber nicht erklärt werden.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "Dieser Alarm wurde zum ersten Mal ausgelöst.",
     "escalationNotStarted": "Noch nicht alarmiert",
     "escalationPagesNobody": "Alarmiert niemanden",
+    "escalationNobodyPaged": "Niemand wird alarmiert",
     "escalationTo": "eskaliert an {who} {when}",
     "escalationDetailCapped": "Live-Eskalationsdetails werden für die {count} ältesten offenen Alarmierungen geladen.",
     "responder": "Ansprechpartner",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "Bis",
     "rotationRestrictionAdd": "Zeitfenster hinzufügen",
     "rotationRestrictionRemove": "Entfernen",
-    "rotationRestrictionZeroLength": "Wenn Von und Bis identisch sind, trifft dieses Zeitfenster nie zu und die Ebene kommt nie zum Zug. Für einen ganzen Tag setzen Sie Bis auf 24:00.",
+    "rotationRestrictionZeroLength": "Von und Bis sind identisch, daher trifft dieses Fenster nie zu. Speichern bleibt deaktiviert, bis sich Von und Bis unterscheiden; für einen ganzen Tag setzen Sie Bis auf 24:00.",
     "rotationRetiredTag": "Beendet",
     "rotationSectionWhen": "Wann der Schichtwechsel stattfindet",
     "rotationName": "Name der Rotation",
@@ -25593,6 +26072,10 @@
     "snoozed": "Pausiert",
     "snoozedUntil": "Pausiert bis {time} — noch nicht zugewiesen",
     "snoozeFailed": "Die Alarmierung konnte nicht pausiert werden.",
+    "unsnooze": "Snooze beenden",
+    "unsnoozeHint": "Beendet den Snooze jetzt. Die Alarmierung läuft ab dem pausierten Schritt weiter.",
+    "unsnoozed": "Snooze beendet · Alarmierung läuft weiter",
+    "unsnoozeFailed": "Der Snooze konnte nicht beendet werden",
     "note": "Notiz",
     "notePlaceholder": "Was haben Sie festgestellt? Was haben Sie versucht?",
     "addNote": "Notiz hinzufügen",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Dieselben Personen, eine Schicht dahinter, sodass die Sekundärperson nie die Person ist, die bereits Bereitschaft hat. Es ist eine normale Rotation – nichts verbindet die beiden; wenn Sie also einen Dienstplan bearbeiten und den anderen nicht, können sie auseinanderdriften, und Sie erhalten eine Warnung statt einer stillen Korrektur.",
     "rotationPreviewPairLegend": "Primär · Sekundär",
     "rotationPreviewEmpty": "Wählen Sie Personen und eine erste Übergabe, um zu sehen, wer wann Bereitschaft hat.",
+    "rotationPreviewNow": "Jetzt – {until}",
     "defaultRotationName": "Rotation",
     "teamCreatedWithoutMembers": "Das Team wurde erstellt, aber seine Mitglieder konnten nicht hinzugefügt werden. Fügen Sie sie auf dem Tab „Mitglieder“ hinzu.",
     "teamCreatedWithoutRotation": "Das Team und seine Mitglieder wurden erstellt, aber die Rotation konnte nicht gespeichert werden. Legen Sie sie auf dem Tab „Dienstplan“ fest.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "Niemand hat bestätigt — diese werden weiterhin alarmiert.",
     "sectionHint_ringingRouted": "niemand hat bestätigt — {count} davon alarmiert noch | niemand hat bestätigt — {count} davon alarmieren noch",
     "sectionHint_ringingUnrouted": "{count} hat kein Team, daher wird nicht alarmiert | {count} haben kein Team, daher wird nicht alarmiert",
+    "sectionHint_ringingStopped": "{count} wird nicht alarmiert | {count} werden nicht alarmiert",
     "sectionHint_snoozed": "Alarmierung pausiert — sie kommen von selbst zurück.",
     "sectionHint_handled": "Bestätigt — eine Person ist für jeden Eintrag zuständig.",
     "sectionHint_resolved": "Geschlossen — zur Aufzeichnung aufbewahrt.",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "Das Team, das bei einem passenden Signal alarmiert wird. Seine eigene Eskalationsleiter bestimmt, wer in welcher Reihenfolge geweckt wird.",
     "scopeOwns": "Dieses Team besitzt",
     "scopeAdvanced": "Erweitert",
-    "ruleEditorConflictUnclaimed": "Aktuell beansprucht nichts diesen Pfad — eine passende Alarmierung erreicht das Auffangteam oder niemanden.",
+    "ruleEditorConflictUnclaimed": "Nichts beansprucht diesen Pfad heute, nur anhand dieser Bedingungen beurteilt — eine passende Alarmierung erreicht den Catch-all, oder niemanden.",
     "ruleEditorConflictHeldBy": "Aktuell geht eine passende Alarmierung über {path} an {team}.",
     "ruleEditorConflictTakesOver": "Ihre Regel legt mehr Bedingungen fest und würde diese daher von {team} übernehmen.",
     "ruleEditorConflictKeptBy": "Der von {team} gehaltene Pfad ist spezifischer, daher behält das Team diese, und diese Regel erfasst nur den Rest.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} alarmiert dieses Team nur in {scope}. Andernorts geht es an den Verantwortlichen des umgebenden Bereichs.",
     "scopeNothingDiscovered": "Es wurde noch nichts entdeckt, daher gibt es keine Ressourcen zur Auswahl. Verwenden Sie „Erweitert“, um die Regel nach Feld zu schreiben, oder senden Sie zuerst Telemetriedaten.",
     "scopeAdvancedHint": "Gilt für jedes Feld und jeden Wert, auch für solche, die die obigen Ebenen nicht abdecken.",
+    "scopeValuesSeen": "Diese Listen zeigen die Werte, die die Service Discovery gesehen hat. Um einen anderen Wert zu treffen, verwenden Sie Erweitert.",
     "escalationHeld": "KI-Triage zuerst · Alarmierung spätestens in {n} s",
     "escalationPagingStep": "Alarmiert Stufe {step} von {total} · {who}",
     "escalationPagingStepOnly": "Alarmiert Stufe {step} von {total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Team und Rotation erstellen",
     "removeMemberHandsOver": "{name} übernimmt die aktuelle Schicht von {leaving} in {rotation}.",
     "removeMemberLeavesGap": "Niemand übernimmt die aktuelle Schicht von {leaving} in {rotation}.",
+    "removeMemberReorders": "Sie verlassen auch {rotations}, daher kann sich ändern, wer dort On-Call ist.",
     "membersJoinEnd": "{names} kommt ans Ende von {rotations}. Wer gerade Bereitschaft hat, bleibt gleich. | {names} kommen ans Ende von {rotations}. Wer gerade Bereitschaft hat, bleibt gleich.",
     "membersAdded": "{names} hinzugefügt. | {names} hinzugefügt.",
     "removeMemberConfirm": "Entfernen",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Fragen: {contact}",
       "outboundQueue": "Alarmnachrichten: {count} in der Warteschlange, älteste {age} | Alarmnachrichten: {count} in der Warteschlange, älteste {age}",
       "outboundEmpty": "Keine Alarmnachrichten in der Warteschlange",
+      "refusedPosts": "{count} Alarmbeitrag ist in den letzten 24 h fehlgeschlagen. Letzter: {reason} auf {destination}, | {count} Alarmbeiträge sind in den letzten 24 h fehlgeschlagen. Letzter: {reason} auf {destination},",
       "ageSeconds": "{count} s"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "Die Erinnerungen konnten nicht gesendet werden."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(kein Modellname)",
+    "topModels": "{models} (Top {shown} von {total})",
+    "cost": {
+      "partial": "teilweise",
+      "unknown": "Kosten unbekannt",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Teilweise Kosten. Kein Preis für {models}: {tokens} Tokens in dieser {scope} werden nicht gezählt.",
+      "unknownTooltip": "Kosten unbekannt. Kein Preis für {models}: Keines der {tokens} Tokens in dieser {scope} hat Kosten.",
+      "scopeSession": "Session",
+      "scopeTrace": "Trace",
+      "unknownModel": "ein unbenanntes Modell",
+      "addPrice": "Preis hinzufügen"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} Tokens ohne Preis",
+      "unpricedTooltip": "Die Kosten sind eine Untergrenze: Für {tokens} Tokens auf {models} liegt kein Preis vor. Öffnen Sie den Tab „Ohne Preis“ in den LLM-Modellpreisen.",
+      "pricedSinceTooltip": "Die Kosten sind eine Untergrenze: {tokens} Tokens auf {models} wurden vor dem Hinterlegen eines Preises erfasst und haben keine Kosten."
+    },
+    "chart": {
+      "costMissing": "Nicht in diesem Diagramm: {models}. Für {tokens} Tokens liegt kein Preis vor.",
+      "costMissingPricedSince": "Nicht in diesem Diagramm: {models}. {tokens} Tokens wurden vor dem Hinterlegen eines Preises erfasst.",
+      "unpricedModels": "Ohne Preis: {models}",
+      "pricedSinceModels": "Vor dem Hinterlegen eines Preises erfasst: {models}",
+      "addPrice": "Preis hinzufügen"
+    },
+    "health": {
+      "title": "Datenzustand",
+      "passing": "{n} bestanden",
+      "checkedAgo": "geprüft {ago}",
+      "drawerTitle": "KI-Datenzustand",
+      "drawerSubtitle": "{stream} · aktuelles Zeitfenster",
+      "rerun": "Prüfungen erneut ausführen",
+      "close": "Schließen",
+      "loadError": "Die Datenzustandsprüfungen konnten nicht ausgeführt werden.",
+      "samples": "Beispiele:",
+      "copyLink": "Link für einen Administrator kopieren",
+      "linkCopied": "Link kopiert",
+      "status": {
+        "pass": "Bestanden",
+        "warning": "Warnung",
+        "error": "Fehler"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Modelle ohne Preis",
+          "detail": "{count} Modell · {spans} Spans · {tokens} Tokens mit $0 berechnet | {count} Modelle · {spans} Spans · {tokens} Tokens mit $0 berechnet",
+          "pass": "Jedes Modell in diesem Zeitfenster hat einen Preis. Spans, die vor dem Hinterlegen eines Preises erfasst wurden, behalten ihre erfassten Kosten.",
+          "fix": "In den LLM-Modellpreisen beheben",
+          "truncated": "Top {shown} von {total} nach Tokens"
+        },
+        "missing_agent_identity": {
+          "label": "Fehlende Agent-Identität",
+          "detail": "{affected} von {total} LLM-Spans ({pct}) haben kein gen_ai.agent.name, daher fehlen sie in den Agent-Ansichten.",
+          "pass": "Jeder LLM-Span trägt einen Agent-Namen oder eine Agent-ID.",
+          "fix": "GenAI-Agent-Zuordnung öffnen"
+        },
+        "zero_duration_spans": {
+          "label": "Spans ohne Dauer",
+          "detail": "{affected} LLM-Spans melden 0 ms, daher fallen Latenz und Sitzungsdauer zu niedrig aus.",
+          "pass": "Kein LLM-Span meldet 0 ms.",
+          "fix": "So beheben Sie das"
+        },
+        "missing_session_id": {
+          "label": "Spans ohne Sitzungs-ID",
+          "detail": "{affected} von {total} LLM-Spans ({pct}) haben keine gen_ai.conversation.id, daher fehlen sie in den Sitzungen.",
+          "pass": "Jeder LLM-Span hat gen_ai.conversation.id.",
+          "fix": "Integrationsleitfaden"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Fleet-Verwaltung",
     "subtitle": "OpenTelemetry-Collector registrieren, ihre Konfigurationen versionieren und Änderungen sicher ausrollen",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "In Bearbeitung",
       "scheduled": "Geplant",
+      "waiting": "Wartet",
       "completed": "Abgeschlossen",
       "halted": "Angehalten",
       "superseded": "Abgelöst",
@@ -28696,7 +29257,7 @@
       "version": "Version",
       "pickConfig": "Konfiguration auswählen",
       "pickFleet": "Fleet auswählen",
-      "emptyFleet": "Das Fleet hat keine Collector, daher wird die Version sofort gesetzt",
+      "emptyFleet": "Die Flotte hat keine Collector, daher wartet der Rollout, bis einer beitritt",
       "startingShortly": "Startet in Kürze",
       "eventGateFailed": "Zustandsprüfung fehlgeschlagen",
       "eventHalted": "Angehalten",
@@ -28707,7 +29268,10 @@
       "notFound": "Dieses Rollout existiert nicht mehr",
       "notFoundDescription": "Der Link ist möglicherweise veraltet. Wählen Sie ein Rollout aus der Liste.",
       "noneTargeted": "Keine Collector betroffen",
-      "outcomeNoneTargeted": "Das Fleet hatte keine Collector, als v{to} gesetzt wurde.",
+      "outcomeNoneTargeted": "Kein Collector hat v{to} in diesem Rollout übernommen.",
+      "outcomeWaiting": "Kein Collector ist online, daher ist v{to} noch an keinen gegangen. Der Rollout startet, sobald sich einer verbindet.",
+      "waitingForCollector": "Warten auf einen Collector",
+      "notStarted": "Nicht gestartet",
       "versionFailedBefore": "v{version} · zuvor fehlgeschlagen",
       "pickVersion": "Version auswählen",
       "autoRollback": "Automatisch zurückrollen",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Fortgesetzt",
       "eventSkipped": "Fehlerhafte Collector übersprungen",
       "eventStarted": "Gestartet",
+      "eventWaiting": "Warten, bis ein Collector online geht",
       "eventTimedOut": "Zeitüberschreitung der Phase",
       "eventSkippedOffline": "{count} Collector ausgelassen, der beim Start offline war; er übernimmt die Version, sobald er sich wieder verbindet | {count} Collector ausgelassen, die beim Start offline waren; sie übernehmen die Version, sobald sie sich wieder verbinden",
       "excluded": "Ausgeschlossen",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Eine Phase, die innerhalb von {minutes} Min. weder bestätigt noch ablehnt, hält das Rollout an (Fleet-Einstellung)",
       "phaseVerifying": "Wird überprüft",
       "phases": "Phasen",
-      "planEmpty": "Keine Collector zu aktualisieren",
+      "planEmpty": "Kein Collector ist online, daher wartet der Rollout, bis sich einer verbindet",
+      "planStable": "Kein Collector ist online; die stabile Version wird an jeden verteilt, sobald er sich verbindet",
       "planOne": "{count} Collector in einem Batch | {count} Collector in einem Batch",
       "planText": "{steps} → verbleibend {last}, {count} Phasen",
       "planUnavailable": "Die Planvorschau ist nicht verfügbar",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 behält Offline-Collector für immer"
     },
     "audit": {
-      "search": "Audit-Protokoll durchsuchen",
       "editedConfig": "Konfiguration bearbeitet",
       "revokedToken": "Registrierungs-Token widerrufen",
       "enrolledCollector": "Collector registriert",
@@ -28920,7 +29485,6 @@
       "setDesired": "Version geändert",
       "autoRollback": "Automatisch zurückgerollt",
       "rolloutHalted": "Rollout angehalten",
-      "assignedFleetConfig": "Konfiguration des Fleets zugewiesen",
       "createdFleet": "Fleet erstellt",
       "renamedFleet": "Fleet umbenannt",
       "deletedFleet": "Fleet gelöscht",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Rollout zurückgerollt",
       "movedByToken": "Durch Registrierungs-Token verschoben",
       "object": "Objekt",
+      "search": "Audit-Protokoll durchsuchen",
       "allObjects": "Alle Objekte",
       "kind": {
         "fleet": "Fleet",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "v{to} wird ausgerollt",
       "rolloutHalted": "Rollout von v{to} angehalten",
+      "rolloutWaiting": "v{to} wartet darauf, dass ein Collector online geht",
       "autoRolledBack": "v{to} automatisch zurückgerollt",
       "noReason": "Kein Fehlergrund gemeldet",
       "openRollout": "Rollout öffnen",
diff --git a/web/src/locales/languages/en-US.json b/web/src/locales/languages/en-US.json
index d8b064eabe..bf9d1bd3d5 100644
--- a/web/src/locales/languages/en-US.json
+++ b/web/src/locales/languages/en-US.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "No LLM activity yet",
       "description": "Instrument your services with the OpenTelemetry Gen-AI semantic conventions and ingest at least one trace to populate this dashboard.",
-      "action": "Instrument with OpenTelemetry",
-      "actionDesc": "Capture gen_ai_* attributes on your traces"
+      "action": "All AI integrations",
+      "actionDesc": "Browse every framework and provider guide",
+      "suggested": "Set up {name} tracing",
+      "suggestedDesc": "Suggested because you came from the {name} docs",
+      "codingAgent": "Instrument with a coding agent",
+      "codingAgentDesc": "Your coding agent adds tracing and checks the first trace",
+      "startFrom": "Or start from"
     },
     "noLLMSessions": {
       "title": "No LLM sessions yet",
@@ -4801,6 +4806,13 @@
       "success": "Success",
       "failed": "Failed",
       "testRun": "Test run",
+      "source": "Source",
+      "sourceHttp": "HTTP request",
+      "sourceAlertFired": "Alert fired",
+      "sourceIncidentEvent": "Incident event",
+      "sourceRetry": "Retry run",
+      "sourceManual": "Manual run",
+      "sourceOther": "Other",
       "runType": "Type",
       "testRunTooltip": "Started from the editor. Destination steps dispatch for real.",
       "showTestRuns": "Show {count} test run(s)",
@@ -4814,7 +4826,33 @@
       "retryTitle": "Retry this run?",
       "retryMessage": "This creates a new run from the input the failed run recorded. Destination steps dispatch for real.",
       "retryStarted": "Retry started — it appears in the list as a new run.",
-      "retryError": "Could not retry this run"
+      "retryError": "Could not retry this run",
+      "statusQueued": "Queued",
+      "statusRunning": "Running",
+      "statusExpired": "Expired",
+      "reasonExpired": "never ran · queued over 1 h",
+      "reasonWorkerLost": "worker lost · not re-run",
+      "reasonWorkflowDisabled": "workflow was disabled",
+      "reasonRunTimeout": "timed out after 15 min",
+      "allTriggers": "All triggers",
+      "triggerFilter": "Trigger",
+      "run": "Run",
+      "searchRuns": "Search run ID, idempotency key or alert",
+      "sourceDetails": "Source details",
+      "detailsWithKey": "{ip} · key {key}",
+      "detailsNoKey": "{ip} · no idempotency key",
+      "retryOf": "Retry of {run}",
+      "openRun": "Open run",
+      "alertFiredEmptyTitle": "No alert-fired runs in this time range",
+      "incidentEventEmptyTitle": "No incident-event runs in this time range",
+      "filterEmptyTitle": "No matching runs in this time range",
+      "filterEmptyDimmed": "The other runs are still on the timeline, dimmed.",
+      "searchEmptyTitle": "No runs match this search",
+      "searchEmptyAction": "Clear search",
+      "timelineNow": "now",
+      "timelineAgoMinutes": "−{n}m",
+      "timelineAgoHours": "−{n}h",
+      "timelineAgoDays": "−{n}d"
     },
     "edit": "Edit",
     "view": "View",
@@ -4962,7 +5000,9 @@
           "noMatch": "No Match"
         },
         "suppressed": "Suppressed — not sent to the real destination"
-      }
+      },
+      "payloadFrom": "Payload from",
+      "payloadFromHint": "The HTTP shape is what callers of the endpoint send."
     },
     "linkAlerts": {
       "title": "Link Workflow To Alerts",
@@ -5155,6 +5195,279 @@
       "outputFormatLabel": "Output Format",
       "tlsVerifyLabel": "TLS Verification",
       "tlsDisabled": "Disabled"
+    },
+    "http": {
+      "runTestHint": "Runs the steps with a sample HTTP payload; doesn't call the URL",
+      "runTestHintList": "Open the workflow to run a test",
+      "runsEmptyTitle": "No HTTP requests in this time range",
+      "runsEmptyBody": "Widen the time range, or send a test request from the HTTP endpoint panel.",
+      "runsEmptyAction": "Show all triggers",
+      "runFailedAt": "This run failed at {step}: {error}",
+      "openStep": "Open step",
+      "runGuardHint": "HTTP runs carry the request, not alert fields. If this step reads {fields}, guard it with a Condition: {guard}.",
+      "runExpiredBanner": "This request waited more than 1 hour in the queue and was never run. No step ran and no destination was called.",
+      "runWorkerLostBanner": "The worker running this request stopped. It is not re-run automatically, because destinations may already have been called. Check them before the caller resends.",
+      "request": "Request",
+      "requestReceived": "Received",
+      "requestToken": "Token",
+      "requestCallerIp": "Caller IP",
+      "requestIdempotencyKey": "Idempotency key",
+      "requestContentType": "Content type",
+      "requestBodySize": "Body size",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Headers",
+      "headersKept": "{count} kept · Authorization, cookies and signatures are never stored | {count} kept · Authorization, cookies and signatures are never stored",
+      "headerName": "Name",
+      "headerValue": "Value",
+      "outputCaption": "What every downstream step received",
+      "useAsTestInput": "Use as test input",
+      "editorButton": "HTTP endpoint",
+      "editorButtonOn": "On",
+      "editorButtonOff": "Off",
+      "editorButtonTooltip": "Let another system start this workflow with an HTTP request",
+      "editorButtonRefusedDraft": "Requests get 403 until the workflow is published",
+      "editorButtonRefusedPaused": "Requests get 403 while the workflow is paused",
+      "panelTitle": "HTTP endpoint",
+      "panelSubtitle": "{name} · {kind} workflow",
+      "acceptRequests": "Accept HTTP requests",
+      "kindNote": "Steps of this workflow were built for {kind} runs. HTTP runs get the request instead ({field}), so add a Condition if a step needs {kind} fields.",
+      "kindNotePayload": "Show the HTTP payload",
+      "kindNotePayloadHide": "Hide the HTTP payload",
+      "unsavedBody": "This workflow isn't saved yet. Save it as a draft to create its URL and token. Requests are refused until you publish.",
+      "saveAndCreate": "Save draft and create endpoint",
+      "needsAdmin": "Creating the endpoint needs an organization admin.",
+      "needsEdit": "Changing it needs edit access to this workflow.",
+      "readOnlyOnMeta": "On · you can copy the URL. Changing it needs edit access to this workflow.",
+      "offBody": "Let another system start this workflow with an HTTP request. You get a URL and a token.",
+      "offExistingBody": "Off · requests are refused (403) until you turn it on.",
+      "onMeta": "On · runs start only while the workflow is enabled and published",
+      "loadError": "Couldn't load the endpoint settings.",
+      "draftBanner": "This workflow is a draft. Calls to the URL get 403 until you publish. You can set up the endpoint now, and Run test runs the draft's steps with a sample HTTP payload.",
+      "disabledBanner": "Requests are refused (403) until you enable the workflow.",
+      "turnOnFailed": "Couldn't turn on the endpoint. {reason}",
+      "changeFailed": "Couldn't save the endpoint. {reason}",
+      "endpointExistsHint": "The endpoint already exists. Show or copy its token from the Tokens table.",
+      "endpointExistsHintSigned": "The endpoint already exists. Show or copy its signing secret from the Signing secrets table.",
+      "disableTitle": "Turn off the endpoint?",
+      "disableBody": "Callers get 403 (endpoint off) until you turn it on again. The URL and tokens stay the same.",
+      "disableConfirm": "Turn off",
+      "lastCall": "On · Last call: {status} · {time} · {link}",
+      "lastCallNone": "On · No calls yet — send a test request",
+      "lastCallNoneRefused": "On · No calls yet",
+      "viewRun": "View run",
+      "lastCallStatus": {
+        "queued": "queued",
+        "running": "running",
+        "succeeded": "succeeded",
+        "failed": "failed",
+        "expired": "expired"
+      },
+      "endpointUrl": "Endpoint URL",
+      "tokenLabel": "Token",
+      "secretLabel": "Signing secret",
+      "newTokenLabel": "New token",
+      "newSecretLabel": "New signing secret",
+      "tokenHint": "Masked on screen; Copy copies the real token. Send it as {header}, never in the URL.",
+      "secretHint": "Masked on screen; Copy copies the real secret. Sign each request with it and send the {headers} headers; never send the secret itself.",
+      "revealBannerTitle": "Endpoint created",
+      "revealBannerBody": "Send this token with every request. You can show or copy it again from the Tokens table.",
+      "revealBannerBodySigned": "Sign every request with this secret. You can show or copy it again from the Signing secrets table.",
+      "switchedBannerTitle": "Token created",
+      "switchedBannerTitleSigned": "Signing secret created",
+      "rotateBannerTitle": "New token created",
+      "rotateBannerTitleSigned": "New signing secret created",
+      "rotateBannerBody": "Callers keep the same URL and header; only the token changes. The old token keeps working until it expires and can be shown until then.",
+      "rotateBannerBodySigned": "Callers keep the same URL and headers; only the secret changes. The old secret keeps working until it expires and can be shown until then.",
+      "rotateBannerBodyRevoked": "Callers keep the same URL and header; only the token changes. The old token was revoked and stops working now.",
+      "rotateBannerBodyRevokedSigned": "Callers keep the same URL and headers; only the secret changes. The old secret was revoked and stops working now.",
+      "rotateBannerBodyFresh": "Callers keep the same URL and header and send this token from now on.",
+      "rotateBannerBodyFreshSigned": "Callers keep the same URL and headers and sign with this secret from now on.",
+      "snippetsLabel": "Example request",
+      "sendTest": "Send test request",
+      "sendTestHint": "Checks the credentials and shows what your steps would receive. No run starts, no destination is called.",
+      "sendTestHintPaused": "Checks the credentials. The workflow is paused, so the call is refused before any input is built; Run test runs the steps.",
+      "sendTestSigned": "Browsers can't sign requests, so test with the example request above. Add ?dry_run=true to its URL to check the signature without starting a run.",
+      "dryRunAccepted": "Dry run accepted",
+      "dryRunMeta": "credentials valid · {size} body",
+      "dryRunInput": "Input your steps would receive",
+      "dryRunRefused": "Credentials valid. Requests are refused until the workflow is published.",
+      "dryRunRefusedPaused": "Credentials valid. Requests are refused while the workflow is paused.",
+      "dryRunRateLimited": "Rate limited — dry runs count against the limit.",
+      "dryRunStatus": "The request was refused with status {status}.",
+      "dryRunFailed": "Couldn't send the test request. {reason}",
+      "runTestInstead": "Run test instead",
+      "done": "Done",
+      "regionTag": "Region {name}",
+      "regionBanner": "Send every request, and every retry, to this region's host. Idempotency keys and run status ({field}) are kept in the region that accepted the call, so a retry sent to another region can start a second run.",
+      "authLabel": "Callers authenticate with",
+      "authToken": "Token",
+      "authSigned": "Signed requests",
+      "authAbout": "About authentication",
+      "authInfo": "Token: send the token in the Authorization header. Signed requests: sign each request with a shared secret ({headers} headers).",
+      "switchToSignedTitle": "Switch to signed requests?",
+      "switchToSignedBody": "Switching revokes the current token now and creates a signing secret. Callers using the token start getting 401.",
+      "switchToTokenTitle": "Switch to token?",
+      "switchToTokenBody": "Switching revokes the current signing secret now and creates a token. Callers signing requests start getting 401.",
+      "tokensTitle": "Tokens",
+      "secretsTitle": "Signing secrets",
+      "colToken": "Token",
+      "colSecret": "Secret",
+      "colCreated": "Created",
+      "colLastUsed": "Last used",
+      "colStatus": "Status",
+      "colActions": "Actions",
+      "never": "Never",
+      "active": "Active",
+      "retiring": "Retiring",
+      "creatorGone": "Creator no longer in this organization",
+      "revoke": "Revoke",
+      "revokeNow": "Revoke now",
+      "revokeTitle": "Revoke {prefix}? Callers using it get 401 immediately.",
+      "revokeFailed": "Couldn't revoke it. {reason}",
+      "copyToken": "Copy token",
+      "copySecret": "Copy secret",
+      "tokenCopied": "Token copied",
+      "commandCopied": "Command copied",
+      "secretCopied": "Secret copied",
+      "revealFailed": "Couldn't show the token. {reason}",
+      "revealFailedSigned": "Couldn't show the secret. {reason}",
+      "revealDenied": "Only admins can show or copy tokens for this endpoint.",
+      "runTest": "Run test",
+      "rotate": "Rotate",
+      "rotateBlocked": "Revoke the retiring token first",
+      "rotateBlockedSigned": "Revoke the retiring secret first",
+      "rotateTitle": "Rotate token",
+      "rotateTitleSigned": "Rotate signing secret",
+      "rotateLead": "A new token is created now. Keep {prefix} (last used {time}) working for",
+      "rotateLeadSigned": "A new signing secret is created now. Keep {prefix} (last used {time}) working for",
+      "overlapNow": "Revoke it immediately",
+      "overlapHour": "1 hour",
+      "overlapDay": "24 hours",
+      "overlapWeek": "7 days",
+      "rotateConsequence": "Callers using the current token keep working until {time}. Update them before then.",
+      "rotateConsequenceSigned": "Callers signing with the current secret keep working until {time}. Update them before then.",
+      "rotateConsequenceNow": "Callers using the current token get 401 from now on.",
+      "rotateConsequenceNowSigned": "Callers signing with the current secret get 401 from now on.",
+      "rotateConfirm": "Rotate token",
+      "rotateConfirmSigned": "Rotate signing secret",
+      "rotateFailed": "Couldn't rotate. {reason}",
+      "advanced": "Advanced",
+      "advancedSummary": "Max body {size} · {count} request per minute | Max body {size} · {count} requests per minute",
+      "maxBody": "Max body size (KiB)",
+      "maxBodyHint": "Up to 1024 (1 MiB); you can only lower it",
+      "maxBodyRange": "Enter a whole number from 1 to 1024",
+      "rateLimit": "Requests per minute",
+      "rateLimitHint": "Up to {org} per minute for this organization",
+      "rateLimitRange": "Enter a whole number from 1 to {org}",
+      "saveLimitsFailed": "Couldn't save the limits. {reason}",
+      "deleteMeta": "Removes the URL and every token or secret.",
+      "deleteButton": "Delete endpoint",
+      "deleteTitle": "Delete this endpoint?",
+      "deleteBody": "The URL stops working at once: callers get 401. All tokens and signing secrets are deleted and can't be recovered. Run history is kept.",
+      "deleteFailed": "Couldn't delete the endpoint. {reason}",
+      "secretStorageWarning": "This server has no encryption master key, so tokens and signing secrets are stored in a form anyone with database access can read. Ask your administrator to set one.",
+      "rejectionsLine": "About {count} request rejected in the last 24 h · last: {reason}, {time} | About {count} requests rejected in the last 24 h · last: {reason}, {time}",
+      "rejectionsShow": "Show",
+      "rejectionsHide": "Hide",
+      "rejectionsTitle": "Recent rejections",
+      "rejectionsCaption": "about {count} in the last 24 h · the caller saw only the status code | about {count} in the last 24 h · the caller saw only the status code",
+      "rejectionMeta": "about {count} · last {time} · from {ip} | about {count} · last {time} · from {ip}",
+      "rejectionsLoadError": "Couldn't load the rejections.",
+      "raiseLimit": "Raise limit",
+      "rotateLink": "Rotate",
+      "reason": {
+        "invalid_token": {
+          "title": "Invalid token",
+          "fix": "The caller sends a token that is revoked, expired or mistyped. Show or copy the current token from the Tokens table."
+        },
+        "invalid_signature": {
+          "title": "Invalid signature",
+          "fix": "The caller signs with an old or wrong secret. Check it uses the current secret and signs {format} exactly as sent."
+        },
+        "stale_timestamp": {
+          "title": "Timestamp too old",
+          "fix": "The caller's clock is more than 5 minutes off. Sync its clock, and sign right before sending."
+        },
+        "endpoint_disabled": {
+          "title": "Endpoint off",
+          "fix": "Turn the endpoint on."
+        },
+        "workflow_disabled": {
+          "title": "Workflow paused",
+          "fix": "Resume the workflow from the list."
+        },
+        "workflow_not_published": {
+          "title": "Workflow not published",
+          "fix": "Publish the workflow; drafts refuse requests."
+        },
+        "payload_too_large": {
+          "title": "Payload too large",
+          "fix": "Over {size}. Send less, or split the events across several requests."
+        },
+        "credential_in_url": {
+          "title": "Credential in URL",
+          "fix": "A token or secret was sent in the URL and refused. URLs end up in proxy and browser logs, so rotate it now, then send it in a header."
+        },
+        "invalid_idempotency_key": {
+          "title": "Invalid idempotency key",
+          "fix": "The Idempotency-Key header is empty or longer than 255 characters."
+        },
+        "idempotency_key_reused": {
+          "title": "Idempotency key reused",
+          "fix": "The same key arrived with a different body. Use a new key per distinct event."
+        },
+        "rate_limited": {
+          "title": "Rate limited",
+          "fix": "More than {count} requests a minute. Batch events into one request (send a JSON array), or raise the limit — up to {org} per minute for this organization."
+        },
+        "queue_full": {
+          "title": "Queue full",
+          "fix": "This organization already had {count} HTTP runs waiting. Callers should retry after the Retry-After delay; look for a slow step or lower the sending rate."
+        },
+        "worker_unavailable": {
+          "title": "Worker unavailable",
+          "fix": "No workflow worker was running in this region, so nothing was queued. Callers that retry after the Retry-After delay go through once a worker is back; if it keeps happening, ask your administrator to check the workflow workers."
+        }
+      },
+      "nodeBadge": "Callable over HTTP",
+      "triggerLinkOn": "Also runs on HTTP requests",
+      "triggerLinkOnAction": "Manage endpoint",
+      "triggerLinkOff": "Start it from another system too",
+      "triggerLinkOffAction": "Set up HTTP endpoint",
+      "pickerCue": "Any workflow can also be started by an HTTP request. Pick its trigger, then use HTTP endpoint in the toolbar.",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP endpoint on",
+      "listMenuItem": "HTTP endpoint…",
+      "copyUrl": "Copy endpoint URL",
+      "copyUrlDraftHint": "Requests are refused until you publish",
+      "copyUrlFailed": "Couldn't copy the endpoint URL. {reason}",
+      "payloadFrom": "Payload from",
+      "payloadHttp": "HTTP request",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "expires in {count} h | expires in {count} h",
+      "expiresInDays": "expires in {count} day | expires in {count} days",
+      "expired": "Expired",
+      "rotateLeadUnused": "A new token is created now. Keep {prefix} (never used) working for",
+      "rotateLeadUnusedSigned": "A new signing secret is created now. Keep {prefix} (never used) working for",
+      "fieldGroup": "HTTP request",
+      "fieldGroupBodyHint": "Fields inside the request body need a Function step first",
+      "fieldGroupQueryHint": "Query parameters are meta.query.<key>; repeated keys arrive as a list and never match",
+      "rotateLeadNone": "No token is active, so callers can't authenticate. A new token is created now.",
+      "rotateLeadNoneSigned": "No signing secret is active, so callers can't authenticate. A new signing secret is created now.",
+      "createForbidden": "You can't create endpoint credentials in this organization.",
+      "errorNotConfigured": "This workflow has no HTTP endpoint.",
+      "errorNoLiveCredential": "No credential is active. Rotate to create one.",
+      "errorNotAllowed": "You don't have permission to do this.",
+      "copyCredentialChanged": "Credential changed. Copy again.",
+      "copyCommandFailed": "Couldn't copy the command. {reason}",
+      "exampleRequest": "Example request",
+      "exampleActiveToken": "Active token · {prefix}",
+      "exampleActiveSecret": "Active secret · {prefix}",
+      "exampleHintToken": "Copy includes the token. Paste into a terminal, or import into Postman or Insomnia (Import → Raw text).",
+      "exampleHintSigned": "Run in bash: it signs with openssl, then calls curl. Copy includes the secret. Import tools cannot sign.",
+      "exampleHintTokenPlaceholder": "Copy has a placeholder where the token goes. Paste into a terminal, or import into Postman or Insomnia (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Run in bash: it signs with openssl, then calls curl. Copy has a placeholder where the secret goes. Import tools cannot sign."
     }
   },
   "pipeline": {
@@ -6025,7 +6338,19 @@
       "viewDocsPrefix": "Click",
       "viewDocsLinkLabel": "here",
       "viewDocsSuffix": "to check further documentation.",
-      "selectIntegrationPrompt": "Select an integration to view details."
+      "selectIntegrationPrompt": "Select an integration to view details.",
+      "codingAgent": {
+        "tabAgent": "With a coding agent",
+        "tabSteps": "Step by step",
+        "streamLabel": "Traces Stream Name",
+        "streamHelp": "The agent writes traces to this stream and checks it.",
+        "envTitle": "Download your .env",
+        "envHelp": "Save it in the project root. The skill reads the token from this file, so it never goes into the chat.",
+        "envButton": "Download .env",
+        "promptTitle": "Paste this into {client1}, {client2} or {client3}",
+        "promptLabel": "Prompt",
+        "promptCopied": "Prompt copied"
+      }
     },
     "header": "Data sources",
     "resetRUMTokenLabel": "Reset RUM Token",
@@ -7674,6 +7999,15 @@
     "queryValues": "Query Values",
     "constant": "Constant",
     "textbox": "Textbox",
+    "date": "Date",
+    "dateFormat": "Output date format",
+    "dateFormatHelp": "Default output in queries. Override per use with ${'{'}name:format{'}'}, e.g. ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Epoch seconds (epoch)",
+    "dateFormatEpochms": "Epoch milliseconds (epochms)",
+    "dateFormatEpochus": "Epoch microseconds (epochus)",
     "newFolder": "New Folder",
     "updateFolder": "Update Folder",
     "newReport": "New Report",
@@ -8782,6 +9116,8 @@
       "addAnnotations": "Add Annotations",
       "dependentAdhocVariableWarning": "Some dynamic variables are not applied because the field is not present in the query's stream. Open Query Inspector to see all the details of the variables and queries executed to render this panel",
       "refreshCacheReload": "Refresh Cache & Reload",
+      "exploreCreateAlert": "Create alert",
+      "exploreAddToDashboard": "Add to dashboard",
       "redirectingToLogs": "Redirecting to logs page",
       "pleaseWait": "Please wait..."
     },
@@ -9343,11 +9679,18 @@
       "constant": "Constant",
       "textbox": "Text box",
       "custom": "Custom",
+      "date": "Date",
       "list": "{type} · {example}",
       "csv": "Commas: {example}",
       "pipe": "Pipes: {example}",
       "doublequote": "Double quotes: {example}",
-      "singlequote": "Single quotes: {example}"
+      "singlequote": "Single quotes: {example}",
+      "dateIso": "Date (YYYY-MM-DD): {example}",
+      "dateDmy": "Day first (DD/MM/YYYY): {example}",
+      "dateMdy": "Month first (MM/DD/YYYY): {example}",
+      "dateEpoch": "Epoch seconds: {example}",
+      "dateEpochms": "Epoch milliseconds: {example}",
+      "dateEpochus": "Epoch microseconds: {example}"
     },
     "add": "Add Panel",
     "save": "Save",
@@ -11505,6 +11848,7 @@
         "badgeAcknowledged": "Acknowledged",
         "badgeResolved": "Resolved",
         "badgeReopened": "Reopened",
+        "badgeAckEnded": "Acknowledgement ended",
         "badgeDimensionsUpgraded": "Dimensions Upgraded",
         "badgeTitleChanged": "Title Changed",
         "badgeAssignment": "Assignment",
@@ -11516,6 +11860,7 @@
         "badgeAiNeedsInput": "AI needs input",
         "incidentWas": "Incident was",
         "theIncident": "the incident",
+        "ackEndedByPageResolve": "by resolving one of its pages",
         "unnamedAlert": "alert",
         "alertTriggered": "{alert} triggered | {alert} triggered {count} times",
         "severityUpgraded": "Severity upgraded from {from} to {to}",
@@ -12463,6 +12808,13 @@
         "rumfunnel": {
           "label": "Alert me",
           "toast": "Imported from Product Analytics: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "Create alert",
+          "toast": "Query imported from your traces search",
+          "noStream": "Pick a stream first",
+          "errorCount": "Error count",
+          "errorRate": "Error rate"
         }
       },
       "warnings": {
@@ -12496,7 +12848,21 @@
         "heldFilterDropped": "Your search filter was not carried over because it needs a Run as choice on the logs page first. Add it to the alert query if you need it.",
         "thresholdColumnGuessed": "The threshold was applied to {column}; check it is the value you meant.",
         "thresholdNotCarried": "The {value} threshold from the chart wasn't applied because you picked a different query.",
-        "rumFunnelExclusions": "Uses this app's app filters as of now; re-create it after they change."
+        "rumFunnelExclusions": "Uses this app's app filters as of now; re-create it after they change.",
+        "tracesSeedMatches": "Fires when matching spans in {minutes} min exceed {threshold} (now {current}).",
+        "tracesSeedSpans": "Fires when spans in {minutes} min exceed {threshold} (now {current}).",
+        "tracesSeedTraces": "Fires when traces in {minutes} min exceed {threshold} (now {current}).",
+        "tracesSeedErrorSpans": "Fires when error spans in {minutes} min exceed {threshold} (now {current}).",
+        "tracesSeedErrorTraces": "Fires when traces with errors in {minutes} min exceed {threshold} (now {current}).",
+        "tracesSeedErrorRatio": "Fires when the error rate in {minutes} min exceeds {threshold}% (now {current}%).",
+        "tracesErrorRatioMinSpans": "Checks only windows with at least {minimum} spans, so a few failures in a quiet period do not fire.",
+        "tracesErrorRatioMinTraces": "Checks only windows with at least {minimum} traces, so a few failures in a quiet period do not fire.",
+        "tracesSeedDuration": "Fires when {percentile} duration over {minutes} min is above {threshold} ms (now {current} ms).",
+        "tracesSeedUnavailable": "The current value could not be read, so the threshold starts at 0. Set it before saving.",
+        "tracesNoMatches": "No matching spans yet, so the alert fires as soon as one appears.",
+        "tracesStoredSpans": "Counts are of stored spans, so sampled traffic reads lower than it really is.",
+        "tracesPeriodCapped": "The alert window was capped at {minutes} minutes to keep each check fast.",
+        "tracesNotRun": "This search has not been run yet, so the alert uses the filter in the editor."
       }
     },
     "saveFailed": "Could not save the alert.",
@@ -14126,7 +14492,8 @@
       "panelAdded": "Panel added to dashboard",
       "errorAddingPanel": "Error while adding panel",
       "selectDashboard": "Please select a dashboard",
-      "selectTab": "Please select a tab"
+      "selectTab": "Please select a tab",
+      "panelsToAdd": "Panels to add"
     },
     "groups": {
       "compute": "Compute",
@@ -15174,6 +15541,24 @@
     "searchTypeOthers": "Others"
   },
   "traces": {
+    "nlNeedsSql": "This question needs SQL; open it in Logs",
+    "redActions": {
+      "menuGroupDashboards": "Dashboards",
+      "addRedToDashboard": "Add RED charts to dashboard",
+      "durationActions": "Duration actions",
+      "bucketNotice": {
+        "seconds": "These charts keep the {count}-second bars you see now.",
+        "minutes": "These charts keep the {count}-minute bars you see now.",
+        "hours": "These charts keep the {count}-hour bars you see now.",
+        "days": "These charts keep the {count}-day bars you see now."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "This chart keeps the {count}-second bars you see now.",
+        "minutes": "This chart keeps the {count}-minute bars you see now.",
+        "hours": "This chart keeps the {count}-hour bars you see now.",
+        "days": "This chart keeps the {count}-day bars you see now."
+      }
+    },
     "latencyHeatmap": {
       "title": "Duration",
       "tooltipSpans": "{count} span | {count} spans",
@@ -15400,6 +15785,13 @@
     "nextMatch": "Next match",
     "searchInSpans": "Search in spans",
     "criticalPath": "Critical path",
+    "askAi": {
+      "explainTrace": "Explain trace",
+      "explainTraceHint": "Ask AI about the slowest spans on the critical path and every error span",
+      "askAboutSpan": "Ask AI about this span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Trace · {operation}"
+    },
     "spansTableView": "Spans Table View",
     "comingSoon": "Coming soon...",
     "fetchingTrace": "Fetching your trace.",
@@ -15502,7 +15894,7 @@
         "filterErrors": "Filter Errors",
         "resetFilters": "Reset Filters",
         "errorsNone": "No Errors · {total} Turns",
-        "latencyLead": "Slowest {slowest} ·",
+        "latencyLead": "Avg Turn {avg} · Slowest {slowest} ·",
         "costLead": "Peak {peak} ·",
         "tokens": "{ratio}% Cached",
         "cacheImpact": "{ratio}% Reused · {tokens} Tok Read",
@@ -15678,6 +16070,7 @@
     "lLMErrorTable": {
       "noData": "No data",
       "noErrorsInRange": "No errors in this time range",
+      "loadFailed": "Could not load recent errors",
       "time": "Time",
       "service": "Service",
       "operation": "Operation",
@@ -16649,7 +17042,51 @@
     "tierAlwaysActive": "Always active (default)",
     "testAtTimeLabel": "Test at UTC time",
     "testAtTimeHint": "Leave empty to use the current time. Peak / off-peak tiers resolve against this time.",
-    "localTimeHint": "In your timezone: {range}"
+    "localTimeHint": "In your timezone: {range}",
+    "builtInStatus": {
+      "seed": "Built-in prices: seed list shipped with this release, dated {date}.",
+      "neverSynced": "Online sync has not run since the server started.",
+      "lastSynced": "Last synced online {time}."
+    },
+    "unpriced": {
+      "title": "Pricing gaps",
+      "subtitle": "Models in your LLM traces that had no price, or only an approximate one, at ingest",
+      "banner": "{count} model had no price or an approximate price at ingest. Its recorded cost may be incomplete. | {count} models had no price or an approximate price at ingest. Their recorded costs may be incomplete.",
+      "bannerTruncated": "{total} models in your traces had no price or an approximate one at ingest. Their cost may be wrong. Showing the top {shown} by tokens.",
+      "streamLabel": "Stream",
+      "window": "Last 24 hours",
+      "windowRange": "{from} – {to}",
+      "colModel": "Model seen in traces",
+      "colPricedAs": "Priced as",
+      "colTokens": "Tokens",
+      "colCost": "Cost recorded",
+      "colActions": "Actions",
+      "spans": "{count} span | {count} spans",
+      "moreAgents": "+{count} more",
+      "noMatch": "No match",
+      "approximate": "Approximate",
+      "pricedNow": "Priced for new spans",
+      "historicalGap": "This window keeps its recorded pricing gap. New spans use the current price.",
+      "noActionNeeded": "No action needed",
+      "defaultTierPrices": "in {input} / out {output} per 1M",
+      "notPriced": "not priced",
+      "createPrice": "Create price",
+      "keepPrices": "Keep {name} prices",
+      "mute": "Mute",
+      "muteConfirmTitle": "Mute this model?",
+      "muteConfirmMessage": "New spans of {model} will be priced as free. Older spans keep their recorded cost. Delete the \"{name}\" price to unmute it.",
+      "mutedNotif": "{model} muted",
+      "keptNotif": "{model} now uses {name} prices",
+      "errSave": "Failed to save the price",
+      "errLoad": "Failed to load unpriced models",
+      "emptyTitle": "No unpriced or approximate model usage recorded in this stream in this window.",
+      "noStreamsTitle": "No LLM trace streams",
+      "noStreamsDesc": "Models appear here once gen_ai spans reach a traces stream.",
+      "recordedCostNote": "New prices apply to spans ingested after you save. Older spans keep their recorded cost.",
+      "noModelName": "(no model name)",
+      "noModelHint": "No model to price: set gen_ai.request.model",
+      "instrumentationDocs": "Instrumentation guide"
+    }
   },
   "aiObservability": {
     "title": "AI Observability",
@@ -17242,6 +17679,8 @@
       "skipTiers": "Rows skipped: {full} fully · {partial} partially",
       "scoreEvidence": "{scorer} · v{version}: {samples} samples, {noReference} no reference, {noTrace} no trace",
       "scorerApplicability": "{scorer} · v{version}: {eligible} eligible slots, {noReference} without reference",
+      "costUnknown": "cost unknown",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Failed to load experiments",
       "previewError": "Failed to preview experiment slots",
       "createSuccess": "Experiment created",
@@ -17324,6 +17763,8 @@
         "costConfirmMessage": "This experiment is estimated to cost about {cost}, above the {threshold} warning threshold. Create and run it anyway?",
         "costConfirmMessageUnpriced": "This experiment is estimated to cost more than the warning threshold. Create and run it anyway?",
         "costConfirmOk": "Create Anyway",
+        "taskProviderFailed": "Nothing was created. The task provider {provider} did not answer the test call.",
+        "judgeProviderFailed": "Nothing was created. The judge provider {provider} did not answer the test call.",
         "skippedFully": "{count} rows fully skipped — every selected scorer needs an expected output. Skipped rows cost nothing to run.",
         "skippedPartially": "{count} rows partially skipped — the task still runs, but reference-based scorers cannot score rows without an expected output.",
         "skippedNone": "Every matched row can be scored on at least one dimension.",
@@ -17412,7 +17853,26 @@
           "trials": "Trials",
           "dispersion": "Dispersion",
           "latency": "Latency",
-          "p50Latency": "P50 Latency"
+          "p50Latency": "P50 Latency",
+          "error": "Error"
+        },
+        "failureBanner": {
+          "title": "{failed} of {total} slots failed: {cause}.",
+          "cause": "Top cause, {count} slots: {message}",
+          "moreCauses": "+ {count} more causes",
+          "noMessage": "no error message was recorded",
+          "openProviders": "Open Providers"
+        },
+        "failureKinds": {
+          "provider_auth": "the provider rejected the credentials",
+          "rate_limited": "the provider rate-limited the run",
+          "timeout": "the provider did not answer in time",
+          "provider_5xx": "the provider returned a server error",
+          "parse_error": "the output could not be parsed",
+          "mapping_error": "the task input could not be built",
+          "scorer_missing": "a scorer no longer exists",
+          "execution_error": "the task call failed",
+          "unknown": "the task call failed"
         },
         "saveAsPrompt": "Save as Prompt",
         "openPrompt": "Open Prompt",
@@ -17693,7 +18153,11 @@
     "scope": {
       "env": "Env",
       "agent": "Agent",
-      "version": "Version"
+      "version": "Version",
+      "agentIdHint": "Agent ID: {ids}",
+      "noAgentIdentity": "No agent identity found",
+      "noAgentIdentityDescription": "These LLM spans carry no agent name, so they are shown by stream. Map the attribute that names your agent to view them by agent.",
+      "noAgentIdentityAction": "Open GenAI Agent Mapping"
     },
     "agentGraph": {
       "stream": "Stream",
@@ -18307,6 +18771,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Evaluations are disabled on this server",
+      "description": "This page needs online evaluations, which are turned off on this server. Ask your administrator to enable them."
+    },
     "traceScoreChip": {
       "reasoning": "Why",
       "noReasoning": "No reasoning recorded for this score.",
@@ -18553,7 +19021,7 @@
       "remoteCta": "Configure Endpoint"
     },
     "provider": {
-      "backTo": "Back to Providers",
+      "backTo": "Providers",
       "createTitle": "Create LLM Provider",
       "editTitle": "Edit LLM Provider",
       "subtitle": "Configure the model endpoint used by LLM judge scorers.",
@@ -18798,7 +19266,7 @@
           "duplicateName": "Scorer {index}: name \"{name}\" is used more than once in this import"
         }
       },
-      "backTo": "Back to Scorers",
+      "backTo": "Scorers",
       "badgeRemote": "Remote",
       "badgeLlm": "LLM Judge",
       "createTitleRemote": "New Remote Scorer",
@@ -18829,6 +19297,9 @@
       "providerPlaceholder": "Select provider",
       "modelLabel": "Model",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperature",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 to 2. Leave blank to judge at 0.",
       "promptLabel": "Judge prompt",
       "includeReasoningLabel": "Include Reasoning",
       "includeReasoningHint": "The judge explains why it gave that score, saved with each result.",
@@ -18902,6 +19373,7 @@
         "apiKeyHeaderRequired": "Header name is required",
         "apiKeyTokenRequired": "Token is required",
         "timeoutInvalid": "Timeout must be 0 or greater",
+        "temperatureInvalid": "Temperature must be between 0 and 2",
         "retriesInvalid": "Retries must be 0 or greater",
         "duplicateFieldName": "Field names must be unique"
       },
@@ -19008,6 +19480,7 @@
         "degraded": "Degraded",
         "waitingForCredentials": "Waiting for credentials",
         "noRecentRuns": "No recent runs",
+        "lastScored": "Last scored {time}",
         "summary": "{errors} of {runs} runs failed in the last 15 minutes",
         "since": "Entered this state {time}",
         "checked": "Last checked {time}"
@@ -19030,7 +19503,7 @@
       "samplingValuePreview": "Evaluates {percent}% of matched targets.",
       "samplingValueAllHelp": "Every matched target is evaluated.",
       "samplingHelp": "Runs after filtering, to control cost.",
-      "backTo": "Back to Eval Jobs",
+      "backTo": "Eval Jobs",
       "createTitle": "New Eval Job",
       "editTitle": "Update Eval Job",
       "stepper": {
@@ -22452,7 +22925,8 @@
       "thisBranchAlreadyEndsInA": "This branch already ends in a Destination.",
       "chooseATriggerNodeToStart": "Choose a trigger node to start your workflow",
       "thisConnectionWouldCreateALoop": "This connection would create a loop",
-      "onlyOneIncomingConnectionToA": "Only one incoming connection to a step is allowed"
+      "onlyOneIncomingConnectionToA": "Only one incoming connection to a step is allowed",
+      "endpointUrlCopied": "Endpoint URL copied"
     },
     "views": {
       "youAreNotAuthorizedToManage": "You are not authorized to manage the license.",
@@ -24102,6 +24576,7 @@
     "databases": {
       "searchPlaceholder": "Search database or service…",
       "unnamedInstance": "Instance not named",
+      "schemaCount": "{count} schema | {count} schemas",
       "unnamedInstanceHint": "The database's own statement reports prove this engine is running, but they don't name a host. The row will show an address once a feed that carries one — session sampling or instance metrics — is set up.",
       "moreServices": "+{count}",
       "columns": {
@@ -24289,6 +24764,7 @@
       "lineCountedTo": "Counted up to {time}; the last half-minute is still coming in.",
       "lineExact": "All databases reporting. Speeds here are measured across every call, so they're exact.",
       "lineExactEstimated": "All databases reporting. Speeds here are blended from several stretches of time, so they're close but not exact.",
+      "lineExactSlowestSchema": "All databases reporting. Speeds are exact per schema; a database with several schemas shows its slowest one.",
       "lineSubsetUnnamed": "Your filters narrow this below the level these totals add up at, so the percentages describe the rows shown rather than the whole database.",
       "lineQuery": "Timings are measured from your application, so they include network time and any wait for a free connection.",
       "lineUncodedErrors": "{percent} of the failures here came back without a reason code, so they can be counted but not explained.",
@@ -25379,6 +25855,7 @@
     "contextNoHistory": "First time this alert has fired.",
     "escalationNotStarted": "Not paged yet",
     "escalationPagesNobody": "Pages nobody",
+    "escalationNobodyPaged": "Nobody is being paged",
     "escalationTo": "escalates to {who} {when}",
     "escalationDetailCapped": "Live escalation detail is loaded for the {count} oldest open pages.",
     "responder": "Responder",
@@ -25527,7 +26004,7 @@
     "rotationRestrictionTo": "To",
     "rotationRestrictionAdd": "Add a window",
     "rotationRestrictionRemove": "Remove",
-    "rotationRestrictionZeroLength": "From and To are the same, so this window never matches and the layer silently never wins. For a full day, set To to 24:00.",
+    "rotationRestrictionZeroLength": "From and To are the same, so this window never matches. Save stays off until From and To differ; for a full day, set To to 24:00.",
     "rotationRetiredTag": "Retired",
     "rotationSectionWhen": "When it turns over",
     "rotationName": "Rotation name",
@@ -25680,6 +26157,10 @@
     "snoozed": "Snoozed",
     "snoozedUntil": "Quiet until {time} — still unassigned",
     "snoozeFailed": "Could not snooze the page",
+    "unsnooze": "Unsnooze",
+    "unsnoozeHint": "Ends the snooze now. Paging continues from the step it paused on.",
+    "unsnoozed": "Snooze ended · paging continues",
+    "unsnoozeFailed": "Could not end the snooze",
     "note": "Note",
     "notePlaceholder": "What did you find? What did you try?",
     "addNote": "Add note",
@@ -25913,6 +26394,7 @@
     "teamCreateSecondaryHint": "Same people, one shift behind, so the secondary is never the person already on call. It is an ordinary rotation — nothing links the two, so editing one roster and not the other lets them drift, and you get a warning rather than a silent fix.",
     "rotationPreviewPairLegend": "Primary · Secondary",
     "rotationPreviewEmpty": "Pick people and a first handover to see who is on when.",
+    "rotationPreviewNow": "Now – {until}",
     "defaultRotationName": "Rotation",
     "teamCreatedWithoutMembers": "The team was created, but its members could not be added. Add them on the Members tab.",
     "teamCreatedWithoutRotation": "The team and its members were created, but the rotation could not be saved. Set it on the Schedule tab.",
@@ -26739,6 +27221,7 @@
     "sectionHint_ringing": "nobody has acknowledged — these are still paging",
     "sectionHint_ringingRouted": "nobody has acknowledged — {count} of these is still paging | nobody has acknowledged — {count} of these are still paging",
     "sectionHint_ringingUnrouted": "{count} has no team, so it is not paging | {count} have no team, so they are not paging",
+    "sectionHint_ringingStopped": "{count} is not being paged | {count} are not being paged",
     "sectionHint_snoozed": "paging paused — they come back on their own",
     "sectionHint_handled": "acknowledged — a human owns each of these",
     "sectionHint_resolved": "closed — kept for the record",
@@ -26819,7 +27302,7 @@
     "ruleEditorTeamHelp": "The team paged when a signal matches. Its own escalation ladder decides who is woken and in what order.",
     "scopeOwns": "This team owns",
     "scopeAdvanced": "Advanced",
-    "ruleEditorConflictUnclaimed": "Nothing claims this path today — a page matching it reaches the catch-all, or nobody.",
+    "ruleEditorConflictUnclaimed": "Nothing claims this path today, judged on these conditions alone — a page matching it reaches the catch-all, or nobody.",
     "ruleEditorConflictHeldBy": "Today a page matching this goes to {team}, via {path}.",
     "ruleEditorConflictTakesOver": "Yours pins more, so it would take these from {team}.",
     "ruleEditorConflictKeptBy": "The path held by {team} pins more, so they keep these and this rule catches only what is left.",
@@ -26841,6 +27324,7 @@
     "scopeClaimServiceHere": "{service} pages this team in {scope} only. Elsewhere it falls to whoever owns the scope around it.",
     "scopeNothingDiscovered": "Nothing has been discovered yet, so there is no estate to pick from. Use Advanced to write the rule by field, or send some telemetry first.",
     "scopeAdvancedHint": "Match on any field and value, including ones the levels above do not cover.",
+    "scopeValuesSeen": "These lists show the values service discovery has seen. To match any other value, use Advanced.",
     "escalationHeld": "AI triage first · paging within {n}s",
     "escalationPagingStep": "Paging step {step} of {total} · {who}",
     "escalationPagingStepOnly": "Paging step {step} of {total}",
@@ -26881,6 +27365,7 @@
     "createTeamAndRotation": "Create team and rotation",
     "removeMemberHandsOver": "{name} takes over {leaving}'s current shift in {rotation}.",
     "removeMemberLeavesGap": "Nobody takes over {leaving}'s current shift in {rotation}.",
+    "removeMemberReorders": "They also leave {rotations}, so who is on call there can change too.",
     "membersJoinEnd": "{names} joins the end of {rotations}. Who is on call now is unchanged. | {names} join the end of {rotations}. Who is on call now is unchanged.",
     "membersAdded": "{names} added. | {names} added.",
     "removeMemberConfirm": "Remove",
@@ -28670,6 +29155,78 @@
       "remindFailed": "Could not send reminders"
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(no model name)",
+    "topModels": "{models} (top {shown} of {total})",
+    "cost": {
+      "partial": "partial",
+      "unknown": "cost unknown",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Partial cost. No price for {models}: {tokens} tokens in this {scope} are not counted.",
+      "unknownTooltip": "Cost unknown. No price for {models}: none of the {tokens} tokens in this {scope} has a cost.",
+      "scopeSession": "session",
+      "scopeTrace": "trace",
+      "unknownModel": "an unnamed model",
+      "addPrice": "Add a price"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} tokens unpriced",
+      "unpricedTooltip": "Cost is a lower bound: {tokens} tokens on {models} have no price. Open the Unpriced tab in LLM Model Pricing.",
+      "pricedSinceTooltip": "Cost is a lower bound: {tokens} tokens on {models} were recorded before a price was added and keep no cost."
+    },
+    "chart": {
+      "costMissing": "Not in this chart: {models}. {tokens} tokens have no price.",
+      "costMissingPricedSince": "Not in this chart: {models}. {tokens} tokens were recorded before a price was added.",
+      "unpricedModels": "Unpriced: {models}",
+      "pricedSinceModels": "Recorded before a price was added: {models}",
+      "addPrice": "Add a price"
+    },
+    "health": {
+      "title": "Data health",
+      "passing": "{n} passing",
+      "checkedAgo": "checked {ago}",
+      "drawerTitle": "AI data health",
+      "drawerSubtitle": "{stream} · current window",
+      "rerun": "Re-run checks",
+      "close": "Close",
+      "loadError": "Data health checks could not run.",
+      "samples": "Samples:",
+      "copyLink": "Copy link for an admin",
+      "linkCopied": "Link copied",
+      "status": {
+        "pass": "Passing",
+        "warning": "Warning",
+        "error": "Error"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Unpriced models",
+          "detail": "{count} model · {spans} spans · {tokens} tokens counted as $0 | {count} models · {spans} spans · {tokens} tokens counted as $0",
+          "pass": "Every model in this window has a price. Spans recorded before a price was added keep their recorded cost.",
+          "fix": "Fix in LLM Model Pricing",
+          "truncated": "Top {shown} of {total} by tokens"
+        },
+        "missing_agent_identity": {
+          "label": "Missing agent identity",
+          "detail": "{affected} of {total} LLM spans ({pct}) have no gen_ai.agent.name, so agent views miss them.",
+          "pass": "Every LLM span carries an agent name or id.",
+          "fix": "Open GenAI Agent Mapping"
+        },
+        "zero_duration_spans": {
+          "label": "Zero-duration spans",
+          "detail": "{affected} LLM spans report 0 ms, so latency and session duration read too low.",
+          "pass": "No LLM span reports 0 ms.",
+          "fix": "How to fix"
+        },
+        "missing_session_id": {
+          "label": "Spans without session id",
+          "detail": "{affected} of {total} LLM spans ({pct}) have no gen_ai.conversation.id, so Sessions misses them.",
+          "pass": "Every LLM span has gen_ai.conversation.id.",
+          "fix": "Integration guide"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Fleet management",
     "subtitle": "Enroll OpenTelemetry collectors, version their configurations and roll changes out safely",
@@ -29171,7 +29728,6 @@
       "retentionDaysHelp": "0 keeps offline collectors forever"
     },
     "audit": {
-      "search": "Search the audit trail",
       "editedConfig": "Edited configuration",
       "revokedToken": "Revoked enrollment token",
       "enrolledCollector": "Enrolled collector",
@@ -29183,7 +29739,6 @@
       "setDesired": "Changed version",
       "autoRollback": "Rolled back automatically",
       "rolloutHalted": "Rollout halted",
-      "assignedFleetConfig": "Assigned the fleet's configuration",
       "createdFleet": "Created fleet",
       "renamedFleet": "Renamed fleet",
       "deletedFleet": "Deleted fleet",
@@ -29197,6 +29752,7 @@
       "rolledBackRollout": "Rolled back rollout",
       "movedByToken": "Moved by enrollment token",
       "object": "Object",
+      "search": "Search the audit trail",
       "allObjects": "All objects",
       "kind": {
         "fleet": "Fleet",
diff --git a/web/src/locales/languages/es-ES.json b/web/src/locales/languages/es-ES.json
index 18984a2b24..fcf46c3ed0 100644
--- a/web/src/locales/languages/es-ES.json
+++ b/web/src/locales/languages/es-ES.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Aún no hay actividad de LLM",
       "description": "Instrumente sus servicios con las convenciones semánticas de IA generativa (Gen-AI) de OpenTelemetry e ingiera al menos una traza para rellenar este Dashboard.",
-      "action": "Instrumento con OpenTelemetry",
-      "actionDesc": "Captura atributos gen_ai_* en tus trazas."
+      "action": "Todas las integraciones de IA",
+      "actionDesc": "Explora las guías de todos los frameworks y proveedores",
+      "suggested": "Configura el trazado de {name}",
+      "suggestedDesc": "Sugerido porque vienes de la documentación de {name}",
+      "codingAgent": "Instrumenta con un agente de programación",
+      "codingAgentDesc": "Tu agente de programación añade el trazado y comprueba la primera traza",
+      "startFrom": "O empieza desde"
     },
     "noLLMSessions": {
       "title": "Aún no hay sesiones de LLM",
@@ -4797,6 +4802,13 @@
       "success": "Éxito",
       "failed": "Fallido",
       "testRun": "Ejecución de prueba",
+      "source": "Origen",
+      "sourceHttp": "Solicitud HTTP",
+      "sourceAlertFired": "Alerta disparada",
+      "sourceIncidentEvent": "Evento de incidente",
+      "sourceRetry": "Ejecución de reintento",
+      "sourceManual": "Ejecución manual",
+      "sourceOther": "Otro",
       "runType": "Tipo",
       "testRunTooltip": "Se inició desde el editor. Los pasos de destino envían realmente.",
       "showTestRuns": "Mostrar {count} ejecución(es) de prueba",
@@ -4810,7 +4822,33 @@
       "retryTitle": "¿Reintentar esta ejecución?",
       "retryMessage": "Esto crea una nueva ejecución a partir de la entrada que registró la ejecución fallida. Los pasos de destino envían realmente.",
       "retryStarted": "Reintento iniciado: aparece en la lista como una nueva ejecución.",
-      "retryError": "No se pudo reintentar esta ejecución."
+      "retryError": "No se pudo reintentar esta ejecución.",
+      "statusQueued": "En cola",
+      "statusRunning": "En ejecución",
+      "statusExpired": "Expirada",
+      "reasonExpired": "nunca se ejecutó · en cola durante más de 1 h",
+      "reasonWorkerLost": "se perdió el worker · no se volvió a ejecutar",
+      "reasonWorkflowDisabled": "el flujo de trabajo estaba deshabilitado",
+      "reasonRunTimeout": "tiempo de espera agotado tras 15 min",
+      "allTriggers": "Todos los desencadenantes",
+      "triggerFilter": "Desencadenante",
+      "run": "Ejecución",
+      "searchRuns": "Buscar ID de ejecución, clave de idempotencia o alerta",
+      "sourceDetails": "Detalles del origen",
+      "detailsWithKey": "{ip} · clave {key}",
+      "detailsNoKey": "{ip} · sin clave de idempotencia",
+      "retryOf": "Reintento de {run}",
+      "openRun": "Abrir ejecución",
+      "alertFiredEmptyTitle": "No hay ejecuciones por alertas disparadas en este intervalo de tiempo",
+      "incidentEventEmptyTitle": "No hay ejecuciones por eventos de incidente en este intervalo de tiempo",
+      "filterEmptyTitle": "No hay ejecuciones coincidentes en este intervalo de tiempo",
+      "filterEmptyDimmed": "Las demás ejecuciones siguen en la línea de tiempo, atenuadas.",
+      "searchEmptyTitle": "No hay ejecuciones que coincidan con esta búsqueda",
+      "searchEmptyAction": "Borrar búsqueda",
+      "timelineNow": "ahora",
+      "timelineAgoMinutes": "−{n} min",
+      "timelineAgoHours": "−{n} h",
+      "timelineAgoDays": "−{n} d"
     },
     "edit": "Editar",
     "view": "Ver",
@@ -4958,7 +4996,9 @@
           "noMatch": "Sin coincidencia"
         },
         "suppressed": "Suprimido: no se envió al destino real."
-      }
+      },
+      "payloadFrom": "Payload de",
+      "payloadFromHint": "La estructura HTTP es la que envían quienes llaman al endpoint."
     },
     "linkAlerts": {
       "title": "Vincular flujo de trabajo a alertas",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Formato de salida",
       "tlsVerifyLabel": "Verificación TLS",
       "tlsDisabled": "Deshabilitada"
+    },
+    "http": {
+      "runTestHint": "Ejecuta los pasos con un payload HTTP de ejemplo; no llama a la URL",
+      "runTestHintList": "Abre el flujo de trabajo para ejecutar una prueba",
+      "runsEmptyTitle": "No hay solicitudes HTTP en este intervalo de tiempo",
+      "runsEmptyBody": "Amplía el intervalo de tiempo o envía una solicitud de prueba desde el panel del endpoint HTTP.",
+      "runsEmptyAction": "Mostrar todos los desencadenantes",
+      "runFailedAt": "Esta ejecución falló en {step}: {error}",
+      "openStep": "Abrir paso",
+      "runGuardHint": "Las ejecuciones HTTP incluyen la solicitud, no los campos de alerta. Si este paso lee {fields}, protégelo con una condición: {guard}.",
+      "runExpiredBanner": "Esta solicitud esperó más de 1 hora en la cola y nunca se ejecutó. No se ejecutó ningún paso y no se invocó ningún destino.",
+      "runWorkerLostBanner": "El worker que ejecutaba esta solicitud se detuvo. No se vuelve a ejecutar automáticamente, porque es posible que ya se hayan invocado los destinos. Compruébalos antes de que el solicitante la vuelva a enviar.",
+      "request": "Solicitud",
+      "requestReceived": "Recibida",
+      "requestToken": "Token",
+      "requestCallerIp": "IP del solicitante",
+      "requestIdempotencyKey": "Clave de idempotencia",
+      "requestContentType": "Tipo de contenido",
+      "requestBodySize": "Tamaño del cuerpo",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Encabezados",
+      "headersKept": "{count} conservado · Authorization, cookies y firmas nunca se almacenan | {count} conservados · Authorization, cookies y firmas nunca se almacenan",
+      "headerName": "Nombre",
+      "headerValue": "Valor",
+      "outputCaption": "Lo que recibió cada paso posterior",
+      "useAsTestInput": "Usar como entrada de prueba",
+      "editorButton": "Endpoint HTTP",
+      "editorButtonOn": "Activado",
+      "editorButtonOff": "Desactivado",
+      "editorButtonTooltip": "Permite que otro sistema inicie este flujo de trabajo con una solicitud HTTP",
+      "editorButtonRefusedDraft": "Las solicitudes reciben 403 hasta que se publique el flujo de trabajo",
+      "editorButtonRefusedPaused": "Las solicitudes reciben 403 mientras el flujo de trabajo esté en pausa",
+      "panelTitle": "Endpoint HTTP",
+      "panelSubtitle": "{name} · flujo de trabajo de tipo {kind}",
+      "acceptRequests": "Aceptar solicitudes HTTP",
+      "kindNote": "Los pasos de este flujo de trabajo se crearon para ejecuciones de {kind}. Las ejecuciones HTTP reciben la solicitud en su lugar ({field}), así que añade una condición si un paso necesita campos de {kind}.",
+      "kindNotePayload": "Mostrar el payload HTTP",
+      "kindNotePayloadHide": "Ocultar el payload HTTP",
+      "unsavedBody": "Este flujo de trabajo aún no se ha guardado. Guárdalo como borrador para crear su URL y su token. Las solicitudes se rechazan hasta que lo publiques.",
+      "saveAndCreate": "Guardar borrador y crear endpoint",
+      "needsAdmin": "Para crear el endpoint se necesita un administrador de la organización.",
+      "needsEdit": "Para cambiarlo se necesita permiso de edición en este flujo de trabajo.",
+      "readOnlyOnMeta": "Activado · puedes copiar la URL. Para cambiarlo se necesita permiso de edición en este flujo de trabajo.",
+      "offBody": "Permite que otro sistema inicie este flujo de trabajo con una solicitud HTTP. Obtendrás una URL y un token.",
+      "offExistingBody": "Desactivado · las solicitudes se rechazan (403) hasta que lo actives.",
+      "onMeta": "Activado · las ejecuciones solo se inician mientras el flujo de trabajo esté habilitado y publicado",
+      "loadError": "No se pudo cargar la configuración del endpoint.",
+      "draftBanner": "Este flujo de trabajo es un borrador. Las llamadas a la URL reciben 403 hasta que lo publiques. Puedes configurar el endpoint ahora, y Ejecutar prueba ejecuta los pasos del borrador con un payload HTTP de ejemplo.",
+      "disabledBanner": "Las solicitudes se rechazan (403) hasta que habilites el flujo de trabajo.",
+      "turnOnFailed": "No se pudo activar el endpoint. {reason}",
+      "changeFailed": "No se pudo guardar el endpoint. {reason}",
+      "endpointExistsHint": "El endpoint ya existe. Muestra o copia su token desde la tabla de tokens.",
+      "endpointExistsHintSigned": "El endpoint ya existe. Muestra o copia su secreto de firma desde la tabla de secretos de firma.",
+      "disableTitle": "¿Desactivar el endpoint?",
+      "disableBody": "Los solicitantes reciben 403 (endpoint desactivado) hasta que lo vuelvas a activar. La URL y los tokens no cambian.",
+      "disableConfirm": "Desactivar",
+      "lastCall": "Activado · Última llamada: {status} · {time} · {link}",
+      "lastCallNone": "Activado · Aún no hay llamadas — envía una solicitud de prueba",
+      "lastCallNoneRefused": "Activado · Aún no hay llamadas",
+      "viewRun": "Ver ejecución",
+      "lastCallStatus": {
+        "queued": "en cola",
+        "running": "en ejecución",
+        "succeeded": "correcto",
+        "failed": "fallido",
+        "expired": "caducado"
+      },
+      "endpointUrl": "URL del endpoint",
+      "tokenLabel": "Token",
+      "secretLabel": "Secreto de firma",
+      "newTokenLabel": "Nuevo token",
+      "newSecretLabel": "Nuevo secreto de firma",
+      "tokenHint": "Se muestra enmascarado en pantalla; Copiar copia el token real. Envíalo como {header}, nunca en la URL.",
+      "secretHint": "Se muestra enmascarado en pantalla; Copiar copia el secreto real. Firma cada solicitud con él y envía las cabeceras {headers}; nunca envíes el secreto en sí.",
+      "revealBannerTitle": "Endpoint creado",
+      "revealBannerBody": "Envía este token con cada solicitud. Puedes volver a mostrarlo o copiarlo desde la tabla de tokens.",
+      "revealBannerBodySigned": "Firma cada solicitud con este secreto. Puedes volver a mostrarlo o copiarlo desde la tabla de secretos de firma.",
+      "switchedBannerTitle": "Token creado",
+      "switchedBannerTitleSigned": "Secreto de firma creado",
+      "rotateBannerTitle": "Nuevo token creado",
+      "rotateBannerTitleSigned": "Nuevo secreto de firma creado",
+      "rotateBannerBody": "Quienes llaman conservan la misma URL y cabecera; solo cambia el token. El token anterior sigue funcionando hasta que caduque y se puede mostrar hasta entonces.",
+      "rotateBannerBodySigned": "Quienes llaman conservan la misma URL y las cabeceras; solo cambia el secreto. El secreto anterior sigue funcionando hasta que caduque y se puede mostrar hasta entonces.",
+      "rotateBannerBodyRevoked": "Quienes llaman conservan la misma URL y cabecera; solo cambia el token. El token anterior se ha revocado y deja de funcionar ahora.",
+      "rotateBannerBodyRevokedSigned": "Quienes llaman conservan la misma URL y las cabeceras; solo cambia el secreto. El secreto anterior se ha revocado y deja de funcionar ahora.",
+      "rotateBannerBodyFresh": "Quienes llaman conservan la misma URL y cabecera y envían este token a partir de ahora.",
+      "rotateBannerBodyFreshSigned": "Quienes llaman conservan la misma URL y las cabeceras y firman con este secreto a partir de ahora.",
+      "snippetsLabel": "Solicitud de ejemplo",
+      "sendTest": "Enviar solicitud de prueba",
+      "sendTestHint": "Comprueba las credenciales y muestra lo que recibirían tus pasos. No se inicia ninguna ejecución ni se llama a ningún destino.",
+      "sendTestHintPaused": "Comprueba las credenciales. El flujo de trabajo está en pausa, por lo que la llamada se rechaza antes de crear cualquier entrada; Ejecutar prueba ejecuta los pasos.",
+      "sendTestSigned": "Los navegadores no pueden firmar solicitudes, así que prueba con la solicitud de ejemplo de arriba. Añade ?dry_run=true a su URL para comprobar la firma sin iniciar una ejecución.",
+      "dryRunAccepted": "Ejecución en seco aceptada",
+      "dryRunMeta": "credenciales válidas · cuerpo de {size}",
+      "dryRunInput": "Entrada que recibirían tus pasos",
+      "dryRunRefused": "Credenciales válidas. Las solicitudes se rechazan hasta que se publique el flujo de trabajo.",
+      "dryRunRefusedPaused": "Credenciales válidas. Las solicitudes se rechazan mientras el flujo de trabajo esté en pausa.",
+      "dryRunRateLimited": "Límite de frecuencia alcanzado — las ejecuciones en seco cuentan para el límite.",
+      "dryRunStatus": "La solicitud se rechazó con el estado {status}.",
+      "dryRunFailed": "No se pudo enviar la solicitud de prueba. {reason}",
+      "runTestInstead": "Ejecutar prueba en su lugar",
+      "done": "Listo",
+      "regionTag": "Región {name}",
+      "regionBanner": "Envía cada solicitud, y cada reintento, al host de esta región. Las claves de idempotencia y el estado de la ejecución ({field}) se guardan en la región que aceptó la llamada, por lo que un reintento enviado a otra región puede iniciar una segunda ejecución.",
+      "authLabel": "Quienes llaman se autentican con",
+      "authToken": "Token",
+      "authSigned": "Solicitudes firmadas",
+      "authAbout": "Acerca de la autenticación",
+      "authInfo": "Token: envía el token en la cabecera Authorization. Solicitudes firmadas: firma cada solicitud con un secreto compartido (cabeceras {headers}).",
+      "switchToSignedTitle": "¿Cambiar a solicitudes firmadas?",
+      "switchToSignedBody": "Al cambiar, el token actual se revoca ahora y se crea un secreto de firma. Quienes usan el token empezarán a recibir 401.",
+      "switchToTokenTitle": "¿Cambiar a token?",
+      "switchToTokenBody": "Al cambiar a token se revoca ahora el secreto de firma actual y se crea un token. Los clientes que firman solicitudes empezarán a recibir 401.",
+      "tokensTitle": "Tokens",
+      "secretsTitle": "Secretos de firma",
+      "colToken": "Token",
+      "colSecret": "Secreto",
+      "colCreated": "Creado",
+      "colLastUsed": "Último uso",
+      "colStatus": "Estado",
+      "colActions": "Acciones",
+      "never": "Nunca",
+      "active": "Activo",
+      "retiring": "En retirada",
+      "creatorGone": "El creador ya no está en esta organización",
+      "revoke": "Revocar",
+      "revokeNow": "Revocar ahora",
+      "revokeTitle": "¿Revocar {prefix}? Los clientes que lo usen recibirán 401 inmediatamente.",
+      "revokeFailed": "No se pudo revocar. {reason}",
+      "copyToken": "Copiar token",
+      "copySecret": "Copiar secreto",
+      "tokenCopied": "Token copiado",
+      "commandCopied": "Comando copiado",
+      "secretCopied": "Secreto copiado",
+      "revealFailed": "No se pudo mostrar el token. {reason}",
+      "revealFailedSigned": "No se pudo mostrar el secreto. {reason}",
+      "revealDenied": "Solo los administradores pueden mostrar o copiar tokens de este endpoint.",
+      "runTest": "Ejecutar prueba",
+      "rotate": "Rotar",
+      "rotateBlocked": "Revoca primero el token en retirada",
+      "rotateBlockedSigned": "Revoca primero el secreto en retirada",
+      "rotateTitle": "Rotar token",
+      "rotateTitleSigned": "Rotar secreto de firma",
+      "rotateLead": "Ahora se crea un token nuevo. Mantén {prefix} (último uso: {time}) en funcionamiento durante",
+      "rotateLeadSigned": "Ahora se crea un secreto de firma nuevo. Mantén {prefix} (último uso: {time}) en funcionamiento durante",
+      "overlapNow": "Revocarlo inmediatamente",
+      "overlapHour": "1 hora",
+      "overlapDay": "24 horas",
+      "overlapWeek": "7 días",
+      "rotateConsequence": "Los clientes que usen el token actual podrán seguir funcionando hasta {time}. Actualízalos antes de entonces.",
+      "rotateConsequenceSigned": "Los clientes que firmen con el secreto actual podrán seguir funcionando hasta {time}. Actualízalos antes de entonces.",
+      "rotateConsequenceNow": "Los clientes que usen el token actual recibirán 401 a partir de ahora.",
+      "rotateConsequenceNowSigned": "Los clientes que firmen con el secreto actual recibirán 401 a partir de ahora.",
+      "rotateConfirm": "Rotar token",
+      "rotateConfirmSigned": "Rotar secreto de firma",
+      "rotateFailed": "No se pudo rotar. {reason}",
+      "advanced": "Avanzado",
+      "advancedSummary": "Cuerpo máximo {size} · {count} solicitud por minuto | Cuerpo máximo {size} · {count} solicitudes por minuto",
+      "maxBody": "Tamaño máximo del cuerpo (KiB)",
+      "maxBodyHint": "Hasta 1024 (1 MiB); solo puedes reducirlo",
+      "maxBodyRange": "Introduce un número entero del 1 al 1024",
+      "rateLimit": "Solicitudes por minuto",
+      "rateLimitHint": "Hasta {org} por minuto para esta organización",
+      "rateLimitRange": "Introduce un número entero del 1 al {org}",
+      "saveLimitsFailed": "No se pudieron guardar los límites. {reason}",
+      "deleteMeta": "Elimina la URL y todos los tokens y secretos.",
+      "deleteButton": "Eliminar endpoint",
+      "deleteTitle": "¿Eliminar este endpoint?",
+      "deleteBody": "La URL deja de funcionar de inmediato: quien llama recibe 401. Todos los tokens y secretos de firma se eliminan y no se pueden recuperar. El historial de ejecuciones se conserva.",
+      "deleteFailed": "No se pudo eliminar el endpoint. {reason}",
+      "secretStorageWarning": "Este servidor no tiene clave maestra de cifrado, así que los tokens y secretos de firma se almacenan de una forma que cualquiera con acceso a la base de datos puede leer. Pide a tu administrador que configure una.",
+      "rejectionsLine": "Se rechazó aproximadamente {count} solicitud en las últimas 24 h · última: {reason}, {time} | Se rechazaron aproximadamente {count} solicitudes en las últimas 24 h · última: {reason}, {time}",
+      "rejectionsShow": "Mostrar",
+      "rejectionsHide": "Ocultar",
+      "rejectionsTitle": "Rechazos recientes",
+      "rejectionsCaption": "aproximadamente {count} en las últimas 24 h · quien llamó solo vio el código de estado | aproximadamente {count} en las últimas 24 h · quien llamó solo vio el código de estado",
+      "rejectionMeta": "aproximadamente {count} · última {time} · desde {ip} | aproximadamente {count} · última {time} · desde {ip}",
+      "rejectionsLoadError": "No se pudieron cargar los rechazos.",
+      "raiseLimit": "Aumentar límite",
+      "rotateLink": "Rotar",
+      "reason": {
+        "invalid_token": {
+          "title": "Token no válido",
+          "fix": "Quien llama envía un token revocado, caducado o mal escrito. Muestra o copia el token actual de la tabla de tokens."
+        },
+        "invalid_signature": {
+          "title": "Firma no válida",
+          "fix": "Quien llama firma con un secreto antiguo o incorrecto. Comprueba que usa el secreto actual y que firma {format} exactamente como se envía."
+        },
+        "stale_timestamp": {
+          "title": "Marca de tiempo demasiado antigua",
+          "fix": "El reloj de quien llama tiene más de 5 minutos de desfase. Sincroniza su reloj y firma justo antes de enviar."
+        },
+        "endpoint_disabled": {
+          "title": "Endpoint desactivado",
+          "fix": "Activa el endpoint."
+        },
+        "workflow_disabled": {
+          "title": "Flujo de trabajo en pausa",
+          "fix": "Reanuda el flujo de trabajo desde la lista."
+        },
+        "workflow_not_published": {
+          "title": "Flujo de trabajo no publicado",
+          "fix": "Publica el flujo de trabajo; los borradores rechazan las solicitudes."
+        },
+        "payload_too_large": {
+          "title": "Carga útil demasiado grande",
+          "fix": "Supera {size}. Envía menos o divide los eventos entre varias solicitudes."
+        },
+        "credential_in_url": {
+          "title": "Credencial en la URL",
+          "fix": "Se envió un token o secreto en la URL y se rechazó. Las URL acaban en los logs de los proxies y de los navegadores, así que rótalo ahora y luego envíalo en una cabecera."
+        },
+        "invalid_idempotency_key": {
+          "title": "Clave de idempotencia no válida",
+          "fix": "La cabecera Idempotency-Key está vacía o tiene más de 255 caracteres."
+        },
+        "idempotency_key_reused": {
+          "title": "Clave de idempotencia reutilizada",
+          "fix": "La misma clave llegó con un cuerpo distinto. Usa una clave nueva por cada evento distinto."
+        },
+        "rate_limited": {
+          "title": "Límite de solicitudes alcanzado",
+          "fix": "Más de {count} solicitudes por minuto. Agrupa los eventos en una sola solicitud (envía un array JSON) o aumenta el límite, hasta {org} por minuto para esta organización."
+        },
+        "queue_full": {
+          "title": "Cola llena",
+          "fix": "Esta organización ya tenía {count} ejecuciones HTTP en espera. Quien llama debe reintentar tras el retardo de Retry-After; busca un paso lento o reduce la tasa de envío."
+        },
+        "worker_unavailable": {
+          "title": "Worker no disponible",
+          "fix": "No había ningún worker de flujos de trabajo en ejecución en esta región, así que no se encoló nada. Quienes reintenten tras el retardo de Retry-After lo conseguirán cuando vuelva un worker; si sigue ocurriendo, pide a tu administrador que revise los workers de flujos de trabajo."
+        }
+      },
+      "nodeBadge": "Invocable por HTTP",
+      "triggerLinkOn": "También se ejecuta con solicitudes HTTP",
+      "triggerLinkOnAction": "Gestionar endpoint",
+      "triggerLinkOff": "Inícialo también desde otro sistema",
+      "triggerLinkOffAction": "Configurar endpoint HTTP",
+      "pickerCue": "Cualquier flujo de trabajo también se puede iniciar mediante una solicitud HTTP. Elige su disparador y luego usa el endpoint HTTP de la barra de herramientas.",
+      "listTag": "HTTP",
+      "listTagTooltip": "Endpoint HTTP activado",
+      "listMenuItem": "Endpoint HTTP…",
+      "copyUrl": "Copiar URL del endpoint",
+      "copyUrlDraftHint": "Las solicitudes se rechazan hasta que publiques",
+      "copyUrlFailed": "No se pudo copiar la URL del endpoint. {reason}",
+      "payloadFrom": "Carga útil de",
+      "payloadHttp": "Solicitud HTTP",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "caduca en {count} h | caduca en {count} h",
+      "expiresInDays": "caduca en {count} día | caduca en {count} días",
+      "expired": "Caducado",
+      "rotateLeadUnused": "Ahora se crea un token nuevo. Mantén {prefix} (nunca usado) en funcionamiento durante",
+      "rotateLeadUnusedSigned": "Ahora se crea un secreto de firma nuevo. Mantén {prefix} (nunca usado) en funcionamiento durante",
+      "fieldGroup": "Solicitud HTTP",
+      "fieldGroupBodyHint": "Los campos dentro del cuerpo de la solicitud necesitan primero un paso de función",
+      "fieldGroupQueryHint": "Los parámetros de consulta son meta.query.<key>; las claves repetidas llegan como una lista y nunca coinciden",
+      "rotateLeadNone": "No hay ningún token activo, así que quienes llaman no pueden autenticarse. Ahora se crea un token nuevo.",
+      "rotateLeadNoneSigned": "No hay ningún secreto de firma activo, así que quienes llaman no pueden autenticarse. Ahora se crea un secreto de firma nuevo.",
+      "createForbidden": "No puedes crear credenciales de endpoint en esta organización.",
+      "errorNotConfigured": "Este flujo de trabajo no tiene endpoint HTTP.",
+      "errorNoLiveCredential": "No hay ninguna credencial activa. Rota para crear una.",
+      "errorNotAllowed": "No tienes permiso para hacer esto.",
+      "copyCredentialChanged": "La credencial ha cambiado. Vuelve a copiar.",
+      "copyCommandFailed": "No se pudo copiar el comando. {reason}",
+      "exampleRequest": "Solicitud de ejemplo",
+      "exampleActiveToken": "Token activo · {prefix}",
+      "exampleActiveSecret": "Secreto activo · {prefix}",
+      "exampleHintToken": "La copia incluye el token. Pégala en un terminal o impórtala en Postman o Insomnia (Import → Raw text).",
+      "exampleHintSigned": "Ejecútalo en bash: firma con openssl y luego llama a curl. La copia incluye el secreto. Las herramientas de importación no pueden firmar.",
+      "exampleHintTokenPlaceholder": "La copia tiene un marcador de posición donde va el token. Pégala en un terminal o impórtala en Postman o Insomnia (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Ejecútalo en bash: firma con openssl y luego llama a curl. La copia tiene un marcador de posición donde va el secreto. Las herramientas de importación no pueden firmar."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Haz clic",
       "viewDocsLinkLabel": "aquí",
       "viewDocsSuffix": "para consultar documentación adicional.",
-      "selectIntegrationPrompt": "Selecciona una integración para ver los detalles."
+      "selectIntegrationPrompt": "Selecciona una integración para ver los detalles.",
+      "codingAgent": {
+        "tabAgent": "Con un agente de programación",
+        "tabSteps": "Paso a paso",
+        "streamLabel": "Nombre del stream de trazas",
+        "streamHelp": "El agente escribe trazas en este stream y lo comprueba.",
+        "envTitle": "Descarga tu .env",
+        "envHelp": "Guárdalo en la raíz del proyecto. La skill lee el token de este archivo, así que nunca pasa al chat.",
+        "envButton": "Descargar .env",
+        "promptTitle": "Pega esto en {client1}, {client2} o {client3}",
+        "promptLabel": "Prompt",
+        "promptCopied": "Prompt copiado"
+      }
     },
     "header": "Fuentes de datos",
     "resetRUMTokenLabel": "Restablecer el token RUM",
@@ -7670,6 +7995,15 @@
     "queryValues": "Valores de consulta",
     "constant": "Constante",
     "textbox": "Cuadro de texto",
+    "date": "Fecha",
+    "dateFormat": "Formato de fecha de salida",
+    "dateFormatHelp": "Salida predeterminada en las consultas. Se puede sobrescribir en cada uso con ${'{'}name:format{'}'}, p. ej. ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Segundos epoch (epoch)",
+    "dateFormatEpochms": "Milisegundos epoch (epochms)",
+    "dateFormatEpochus": "Microsegundos epoch (epochus)",
     "newFolder": "Nueva carpeta",
     "updateFolder": "Actualizar carpeta",
     "newReport": "Nuevo informe",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Añadir anotaciones",
       "dependentAdhocVariableWarning": "Algunas variables dinámicas no se aplican porque el campo no está presente en el stream de la consulta. Abra el Inspector de consultas para ver todos los detalles de las variables y consultas ejecutadas para renderizar este panel.",
       "refreshCacheReload": "Actualizar caché y recargar",
+      "exploreCreateAlert": "Crear alerta",
+      "exploreAddToDashboard": "Añadir al dashboard",
       "redirectingToLogs": "Redirigiendo a la página de logs",
       "pleaseWait": "Por favor, espere..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Constante",
       "textbox": "Cuadro de texto",
       "custom": "Personalizado",
+      "date": "Fecha",
       "list": "{type} · {example}",
       "csv": "Comas: {example}",
       "pipe": "Barras verticales: {example}",
       "doublequote": "Comillas dobles: {example}",
-      "singlequote": "Comillas simples: {example}"
+      "singlequote": "Comillas simples: {example}",
+      "dateIso": "Fecha (AAAA-MM-DD): {example}",
+      "dateDmy": "Día primero (DD/MM/AAAA): {example}",
+      "dateMdy": "Mes primero (MM/DD/AAAA): {example}",
+      "dateEpoch": "Segundos epoch: {example}",
+      "dateEpochms": "Milisegundos epoch: {example}",
+      "dateEpochus": "Microsegundos epoch: {example}"
     },
     "add": "Añadir panel",
     "save": "Guardar",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Reconocido",
         "badgeResolved": "Resuelto",
         "badgeReopened": "Reabierto",
+        "badgeAckEnded": "Confirmación finalizada",
         "badgeDimensionsUpgraded": "Dimensiones elevadas",
         "badgeTitleChanged": "Título cambiado",
         "badgeAssignment": "Asignación",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "La IA necesita información",
         "incidentWas": "El incidente fue",
         "theIncident": "el incidente",
+        "ackEndedByPageResolve": "al resolver uno de sus avisos",
         "unnamedAlert": "alerta",
         "alertTriggered": "{alert} se disparó | {alert} se disparó {count} veces",
         "severityUpgraded": "Gravedad elevada de {from} a {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Alertarme",
           "toast": "Importado de Product Analytics: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "Crear alerta",
+          "toast": "Consulta importada de tu búsqueda de trazas",
+          "noStream": "Elige un stream primero",
+          "errorCount": "Recuento de errores",
+          "errorRate": "Tasa de errores"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Tu filtro de búsqueda no se conservó porque primero necesita una opción Ejecutar como en la página de Logs. Añádelo a la consulta de la alerta si lo necesitas.",
         "thresholdColumnGuessed": "El umbral se aplicó a {column}; comprueba que es el valor que querías.",
         "thresholdNotCarried": "El umbral {value} del gráfico no se aplicó porque elegiste una consulta diferente.",
-        "rumFunnelExclusions": "Usa los filtros de la aplicación tal como están ahora; vuelve a crearlo después de que cambien."
+        "rumFunnelExclusions": "Usa los filtros de la aplicación tal como están ahora; vuelve a crearlo después de que cambien.",
+        "tracesSeedMatches": "Se dispara cuando los spans coincidentes en {minutes} min superan {threshold} (ahora {current}).",
+        "tracesSeedSpans": "Se dispara cuando los spans en {minutes} min superan {threshold} (ahora {current}).",
+        "tracesSeedTraces": "Se dispara cuando las trazas en {minutes} min superan {threshold} (ahora {current}).",
+        "tracesSeedErrorSpans": "Se dispara cuando los spans con error en {minutes} min superan {threshold} (ahora {current}).",
+        "tracesSeedErrorTraces": "Se dispara cuando las trazas con errores en {minutes} min superan {threshold} (ahora {current}).",
+        "tracesSeedErrorRatio": "Se dispara cuando la tasa de errores en {minutes} min supera el {threshold}% (ahora {current}%).",
+        "tracesErrorRatioMinSpans": "Solo comprueba ventanas con al menos {minimum} spans, para que unos pocos fallos en un periodo tranquilo no la disparen.",
+        "tracesErrorRatioMinTraces": "Solo comprueba ventanas con al menos {minimum} trazas, para que unos pocos fallos en un periodo tranquilo no la disparen.",
+        "tracesSeedDuration": "Se dispara cuando la duración {percentile} en {minutes} min supera {threshold} ms (ahora {current} ms).",
+        "tracesSeedUnavailable": "No se pudo leer el valor actual, así que el umbral empieza en 0. Configúralo antes de guardar.",
+        "tracesNoMatches": "Aún no hay spans coincidentes, así que la alerta se dispara en cuanto aparezca uno.",
+        "tracesStoredSpans": "Los recuentos son de spans almacenados, así que el tráfico muestreado se lee por debajo de lo que realmente es.",
+        "tracesPeriodCapped": "La ventana de la alerta se limitó a {minutes} minutos para que cada comprobación sea rápida.",
+        "tracesNotRun": "Esta búsqueda aún no se ha ejecutado, así que la alerta usa el filtro del editor."
       }
     },
     "saveFailed": "No se pudo guardar la alerta.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Ninguna métrica coincide con los filtros actuales",
       "noMatchHint": "Intenta eliminar un filtro de etiqueta, limpiar las selecciones de prefijo/sufijo, o cambiar de “Con datos” a “Todas”.",
       "noMatchHintFavorites": "Intenta eliminar un filtro de etiqueta, o cambiar de “Con datos” a “Todos”.",
+      "noMatchYet": "Aún no se han encontrado métricas con datos",
+      "noMatchYetHint": "Las métricas comprobadas hasta ahora no han devuelto datos. Muestra más para seguir buscando.",
       "clearAllFilters": "Limpiar todos los filtros",
       "emptyActions": {
         "clearSearch": "Limpiar búsqueda",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Panel agregado al Dashboard",
       "errorAddingPanel": "Error al agregar el panel",
       "selectDashboard": "Por favor seleccione un Dashboard",
-      "selectTab": "Por favor seleccione una pestaña"
+      "selectTab": "Por favor seleccione una pestaña",
+      "panelsToAdd": "Paneles para añadir"
     },
     "groups": {
       "compute": "Cómputo",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Otros"
   },
   "traces": {
+    "nlNeedsSql": "Esta pregunta necesita SQL; ábrela en Logs",
+    "redActions": {
+      "menuGroupDashboards": "Dashboards",
+      "addRedToDashboard": "Añadir gráficos RED al dashboard",
+      "durationActions": "Acciones de duración",
+      "bucketNotice": {
+        "seconds": "Estos gráficos mantienen las barras de {count} segundos que ves ahora.",
+        "minutes": "Estos gráficos mantienen las barras de {count} minutos que ves ahora.",
+        "hours": "Estos gráficos mantienen las barras de {count} horas que ves ahora.",
+        "days": "Estos gráficos mantienen las barras de {count} días que ves ahora."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Este gráfico mantiene las barras de {count} segundos que ves ahora.",
+        "minutes": "Este gráfico mantiene las barras de {count} minutos que ves ahora.",
+        "hours": "Este gráfico mantiene las barras de {count} horas que ves ahora.",
+        "days": "Este gráfico mantiene las barras de {count} días que ves ahora."
+      }
+    },
     "latencyHeatmap": {
       "title": "Duración",
       "tooltipSpans": "{count} span | {count} spans",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Siguiente coincidencia",
     "searchInSpans": "Buscar en spans",
     "criticalPath": "Ruta crítica",
+    "askAi": {
+      "explainTrace": "Explicar traza",
+      "explainTraceHint": "Pregunta a la IA por los spans más lentos de la ruta crítica y por cada span con error",
+      "askAboutSpan": "Preguntar a la IA sobre este span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Traza · {operation}"
+    },
     "spansTableView": "Vista de tabla de spans",
     "comingSoon": "Próximamente...",
     "fetchingTrace": "Obteniendo tu traza.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Filtrar errores",
         "resetFilters": "Restablecer filtros",
         "errorsNone": "Sin errores · {total} turnos",
-        "latencyLead": "El más lento {slowest} ·",
+        "latencyLead": "Turno medio {avg} · Más lento {slowest} ·",
         "costLead": "Pico {peak} ·",
         "tokens": "{ratio}% en caché",
         "cacheImpact": "{ratio}% reutilizado · {tokens} No leído",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Sin datos",
       "noErrorsInRange": "No hay errores en este rango de tiempo",
+      "loadFailed": "No se pudieron cargar los errores recientes",
       "time": "Tiempo",
       "service": "Servicio",
       "operation": "Operación",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Siempre activo (predeterminado)",
     "testAtTimeLabel": "Probar a la hora UTC",
     "testAtTimeHint": "Déjalo vacío para usar la hora actual. Los niveles pico / valle se resuelven según esta hora.",
-    "localTimeHint": "En tu zona horaria: {range}"
+    "localTimeHint": "En tu zona horaria: {range}",
+    "builtInStatus": {
+      "seed": "Precios integrados: lista inicial incluida en esta versión, con fecha {date}.",
+      "neverSynced": "La sincronización en línea no se ha ejecutado desde que se inició el servidor.",
+      "lastSynced": "Última sincronización en línea: {time}."
+    },
+    "unpriced": {
+      "title": "Huecos de precios",
+      "subtitle": "Modelos de tus trazas de LLM que no tenían precio, o solo uno aproximado, en el momento de la ingesta",
+      "banner": "{count} modelo no tenía precio o tenía un precio aproximado en la ingesta. El coste registrado puede estar incompleto. | {count} modelos no tenían precio o tenían un precio aproximado en la ingesta. Sus costes registrados pueden estar incompletos.",
+      "bannerTruncated": "{total} modelos de tus trazas no tenían precio o tenían uno aproximado en la ingesta. Su coste puede ser incorrecto. Se muestran los {shown} principales por tokens.",
+      "streamLabel": "Stream",
+      "window": "Últimas 24 horas",
+      "windowRange": "{from} – {to}",
+      "colModel": "Modelo visto en las trazas",
+      "colPricedAs": "Tarificado como",
+      "colTokens": "Tokens",
+      "colCost": "Coste registrado",
+      "colActions": "Acciones",
+      "spans": "{count} span | {count} spans",
+      "moreAgents": "+{count} más",
+      "noMatch": "Sin coincidencias",
+      "approximate": "Aproximado",
+      "pricedNow": "Con precio para los nuevos spans",
+      "historicalGap": "Esta ventana conserva su hueco de precios registrado. Los nuevos spans usan el precio actual.",
+      "noActionNeeded": "No se requiere acción",
+      "defaultTierPrices": "entrada {input} / salida {output} por 1 M",
+      "notPriced": "sin precio",
+      "createPrice": "Crear precio",
+      "keepPrices": "Mantener los precios de {name}",
+      "mute": "Silenciar",
+      "muteConfirmTitle": "¿Silenciar este modelo?",
+      "muteConfirmMessage": "Los nuevos spans de {model} se contabilizarán como gratuitos. Los spans anteriores conservan su coste registrado. Elimina el precio \"{name}\" para dejar de silenciarlo.",
+      "mutedNotif": "{model} silenciado",
+      "keptNotif": "{model} ahora usa los precios de {name}",
+      "errSave": "No se pudo guardar el precio",
+      "errLoad": "No se pudieron cargar los modelos sin precio",
+      "emptyTitle": "No se ha registrado uso de modelos sin precio o aproximado en este stream en esta ventana.",
+      "noStreamsTitle": "No hay streams de trazas de LLM",
+      "noStreamsDesc": "Los modelos aparecerán aquí cuando lleguen spans de gen_ai a un stream de trazas.",
+      "recordedCostNote": "Los nuevos precios se aplican a los spans ingeridos después de guardar. Los spans anteriores conservan su coste registrado.",
+      "noModelName": "(sin nombre de modelo)",
+      "noModelHint": "No hay modelo al que asignar precio: define gen_ai.request.model",
+      "instrumentationDocs": "Guía de instrumentación"
+    }
   },
   "aiObservability": {
     "title": "Observabilidad de IA",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Filas omitidas: {full} completamente · {partial} parcialmente",
       "scoreEvidence": "{scorer} · v{version}: {samples} muestras, {noReference} sin referencia, {noTrace} sin traza",
       "scorerApplicability": "{scorer} · v{version}: {eligible} espacios elegibles, {noReference} sin referencia",
+      "costUnknown": "coste desconocido",
+      "costAtLeast": "≥ {cost}",
       "loadError": "No se pudieron cargar los experimentos",
       "previewError": "No se pudo previsualizar los espacios del experimento",
       "createSuccess": "Experimento creado",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Se estima que este experimento cuesta aproximadamente {cost}, por encima del umbral de advertencia de {threshold}. ¿Crearlo y ejecutarlo de todos modos?",
         "costConfirmMessageUnpriced": "Este experimento se estima que costará más que el umbral de advertencia. ¿Crearlo y ejecutarlo de todos modos?",
         "costConfirmOk": "Crear de todos modos",
+        "taskProviderFailed": "No se creó nada. El proveedor de tareas {provider} no respondió a la llamada de prueba.",
+        "judgeProviderFailed": "No se creó nada. El proveedor del juez {provider} no respondió a la llamada de prueba.",
         "skippedFully": "{count} filas omitidas por completo: cada evaluador seleccionado necesita una salida esperada. Las filas omitidas no cuestan nada al ejecutarse.",
         "skippedPartially": "{count} filas omitidas parcialmente: la tarea aún se ejecuta, pero los evaluadores basados en referencia no pueden puntuar filas sin una salida esperada.",
         "skippedNone": "Cada fila coincidente puede puntuarse en al menos una dimensión.",
@@ -17408,7 +17851,26 @@
           "trials": "Pruebas",
           "dispersion": "Dispersión",
           "latency": "Latencia",
-          "p50Latency": "Latencia P50"
+          "p50Latency": "Latencia P50",
+          "error": "Error"
+        },
+        "failureBanner": {
+          "title": "{failed} de {total} ranuras fallaron: {cause}.",
+          "cause": "Causa principal, {count} espacios: {message}",
+          "moreCauses": "+ {count} causas más",
+          "noMessage": "no se registró ningún mensaje de error",
+          "openProviders": "Abrir Proveedores"
+        },
+        "failureKinds": {
+          "provider_auth": "el proveedor rechazó las credenciales",
+          "rate_limited": "el proveedor limitó la frecuencia de la ejecución",
+          "timeout": "el proveedor no respondió a tiempo",
+          "provider_5xx": "el proveedor devolvió un error del servidor",
+          "parse_error": "no se pudo analizar la salida",
+          "mapping_error": "no se pudo construir la entrada de la tarea",
+          "scorer_missing": "un evaluador ya no existe",
+          "execution_error": "la llamada de la tarea falló",
+          "unknown": "la llamada de la tarea falló"
         },
         "saveAsPrompt": "Guardar como Prompt",
         "openPrompt": "Abrir Prompt",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Entorno",
       "agent": "Agente",
-      "version": "Versión"
+      "version": "Versión",
+      "agentIdHint": "ID de agente: {ids}",
+      "noAgentIdentity": "No se encontró ninguna identidad de agente",
+      "noAgentIdentityDescription": "Estos spans de LLM no llevan nombre de agente, por lo que se muestran por stream. Asigna el atributo que da nombre a tu agente para verlos por agente.",
+      "noAgentIdentityAction": "Abrir Asignación de agentes GenAI"
     },
     "agentGraph": {
       "stream": "Stream",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Las evaluaciones están deshabilitadas en este servidor",
+      "description": "Esta página requiere evaluaciones en línea, que están desactivadas en este servidor. Pide a tu administrador que las active."
+    },
     "traceScoreChip": {
       "reasoning": "Por qué",
       "noReasoning": "No se registró razonamiento para esta puntuación.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Configurar endpoint"
     },
     "provider": {
-      "backTo": "Volver a Proveedores",
+      "backTo": "Proveedores",
       "createTitle": "Crear proveedor de LLM",
       "editTitle": "Editar proveedor de LLM",
       "subtitle": "Configure el punto final del modelo utilizado por los evaluadores de jueces de LLM.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Evaluador {index}: el nombre \"{name}\" se usa más de una vez en esta importación"
         }
       },
-      "backTo": "Volver a Evaluadores",
+      "backTo": "Evaluadores",
       "badgeRemote": "Remoto",
       "badgeLlm": "Juez de LLM",
       "createTitleRemote": "Nuevo evaluador remoto",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Seleccione un proveedor",
       "modelLabel": "modelo",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperatura",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 a 2. Déjalo en blanco para evaluar con 0.",
       "promptLabel": "Juez rápido",
       "includeReasoningLabel": "Incluir razonamiento",
       "includeReasoningHint": "El juez explica por qué dio esa puntuación, guardado con cada resultado.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "El nombre del encabezado es obligatorio",
         "apiKeyTokenRequired": "El token es obligatorio",
         "timeoutInvalid": "El tiempo de espera debe ser 0 o mayor",
+        "temperatureInvalid": "La temperatura debe estar entre 0 y 2",
         "retriesInvalid": "Los reintentos deben ser 0 o más",
         "duplicateFieldName": "Los nombres de campo deben ser únicos"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Degradado",
         "waitingForCredentials": "Esperando credenciales",
         "noRecentRuns": "Sin ejecuciones recientes",
+        "lastScored": "Última evaluación: {time}",
         "summary": "{errors} de {runs} ejecuciones fallaron en los últimos 15 minutos",
         "since": "Entró en este estado {time}",
         "checked": "Última comprobación: {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Evalúa el {percent}% de los objetivos coincidentes.",
       "samplingValueAllHelp": "Cada objetivo coincidente es evaluado.",
       "samplingHelp": "Se ejecuta después del filtrado, para controlar el costo.",
-      "backTo": "Volver a Trabajos de evaluación",
+      "backTo": "Trabajos de evaluación",
       "createTitle": "Nuevo trabajo de evaluación",
       "editTitle": "Actualizar trabajo de evaluación",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Esta rama ya termina en un destino.",
       "chooseATriggerNodeToStart": "Elija un nodo de activación para iniciar su flujo de trabajo",
       "thisConnectionWouldCreateALoop": "Esta conexión crearía un bucle",
-      "onlyOneIncomingConnectionToA": "Solo se permite una conexión entrante a un paso"
+      "onlyOneIncomingConnectionToA": "Solo se permite una conexión entrante a un paso",
+      "endpointUrlCopied": "URL del endpoint copiada"
     },
     "views": {
       "youAreNotAuthorizedToManage": "No está autorizado para gestionar la licencia.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Buscar base de datos o servicio…",
       "unnamedInstance": "Instancia sin nombre",
+      "schemaCount": "{count} esquema | {count} esquemas",
       "unnamedInstanceHint": "Los informes de sentencias de la propia base de datos demuestran que este motor está en ejecución, pero no nombran un host. La fila mostrará una dirección una vez que se configure una fuente que la incluya — muestreo de sesión o métricas de instancia —.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Contado hasta {time}; el último medio minuto aún está llegando.",
       "lineExact": "Todas las bases de datos informando. Las velocidades aquí se miden en cada llamada, por lo que son exactas.",
       "lineExactEstimated": "Todas las bases de datos informando. Las velocidades aquí se combinan de varios tramos de tiempo, por lo que son aproximadas pero no exactas.",
+      "lineExactSlowestSchema": "Todas las bases de datos están informando. Las velocidades son exactas por esquema; si una base de datos tiene varios esquemas, se muestra la velocidad del más lento.",
       "lineSubsetUnnamed": "Tus filtros reducen esto por debajo del nivel en que se suman estos totales, por lo que los porcentajes describen las filas mostradas en lugar de toda la base de datos.",
       "lineQuery": "Los tiempos se miden desde tu aplicación, por lo que incluyen el tiempo de red y cualquier espera por una conexión libre.",
       "lineUncodedErrors": "{percent} de los fallos aquí devolvieron sin un código de razón, por lo que pueden contarse pero no explicarse.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "Es la primera vez que esta alerta se ha disparado.",
     "escalationNotStarted": "Sin avisar aún",
     "escalationPagesNobody": "No avisa a nadie",
+    "escalationNobodyPaged": "No se está avisando a nadie",
     "escalationTo": "se escala a {who} {when}",
     "escalationDetailCapped": "El detalle de escalado en tiempo real se carga para los {count} avisos abiertos más antiguos.",
     "responder": "Responsable",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "Hasta",
     "rotationRestrictionAdd": "Añadir una ventana",
     "rotationRestrictionRemove": "Eliminar",
-    "rotationRestrictionZeroLength": "Desde y Hasta son iguales, por lo que esta ventana nunca coincide y la capa nunca gana sin que se note. Para un día completo, establece Hasta en 24:00.",
+    "rotationRestrictionZeroLength": "Desde y Hasta son iguales, así que esta ventana nunca coincide. Guardar sigue desactivado hasta que Desde y Hasta sean distintos; para un día completo, establece Hasta en 24:00.",
     "rotationRetiredTag": "Retirado",
     "rotationSectionWhen": "Cuándo rota",
     "rotationName": "Nombre de la rotación",
@@ -25593,6 +26072,10 @@
     "snoozed": "Silenciado",
     "snoozedUntil": "Silenciada hasta {time} — aún sin asignar",
     "snoozeFailed": "No se pudo posponer el aviso",
+    "unsnooze": "Finalizar silencio",
+    "unsnoozeHint": "Finaliza el silencio ahora. Se sigue avisando desde el paso en el que se pausó.",
+    "unsnoozed": "Silencio finalizado · se sigue avisando",
+    "unsnoozeFailed": "No se pudo finalizar el silencio",
     "note": "Nota",
     "notePlaceholder": "¿Qué encontraste? ¿Qué intentaste?",
     "addNote": "Añadir nota",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Las mismas personas, un turno por detrás, de modo que la persona secundaria nunca sea la que ya está de guardia. Es una rotación normal: nada vincula ambas, así que, si editas una lista y no la otra, pueden desincronizarse, y recibirás un aviso en lugar de una corrección silenciosa.",
     "rotationPreviewPairLegend": "Principal · Secundaria",
     "rotationPreviewEmpty": "Elige personas y un primer relevo para ver quién está de guardia y cuándo.",
+    "rotationPreviewNow": "Ahora – {until}",
     "defaultRotationName": "Rotación",
     "teamCreatedWithoutMembers": "El equipo se creó, pero no se pudieron añadir sus miembros. Añádelos en la pestaña Miembros.",
     "teamCreatedWithoutRotation": "El equipo y sus miembros se crearon, pero no se pudo guardar la rotación. Configúrala en la pestaña Horario.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "nadie ha confirmado — siguen avisando",
     "sectionHint_ringingRouted": "nadie lo ha reconocido — {count} de estos sigue avisando | nadie lo ha reconocido — {count} de estos siguen avisando",
     "sectionHint_ringingUnrouted": "{count} no tiene equipo, por lo que no está avisando | {count} no tienen equipo, por lo que no están avisando",
+    "sectionHint_ringingStopped": "{count} no está siendo avisado | {count} no están siendo avisados",
     "sectionHint_snoozed": "avisos en pausa: volverán a sonar solos",
     "sectionHint_handled": "Confirmadas: una persona se ocupa de cada una",
     "sectionHint_resolved": "Cerradas: se conservan para el registro",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "El equipo al que se avisa cuando una señal coincide. Su propia cadena de escalación decide a quién se despierta y en qué orden.",
     "scopeOwns": "Este equipo es propietario de",
     "scopeAdvanced": "Avanzado",
-    "ruleEditorConflictUnclaimed": "Nada reclama esta ruta hoy — un aviso que coincida llega al equipo de último recurso, o a nadie.",
+    "ruleEditorConflictUnclaimed": "Hoy nada reclama esta ruta, a juzgar solo por estas condiciones — un aviso que coincida con ella llega al comodín, o a nadie.",
     "ruleEditorConflictHeldBy": "Hoy un aviso que coincida con esto va a {team}, a través de {path}.",
     "ruleEditorConflictTakesOver": "Tu regla es más específica, así que les quitaría esa cobertura a {team}.",
     "ruleEditorConflictKeptBy": "La ruta de {team} es más específica, por lo que ellos conservan esa cobertura y esta regla solo capta lo que queda.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} avisa a este equipo solo en {scope}. En cualquier otro lugar, corresponde a quien sea el propietario del ámbito que lo rodea.",
     "scopeNothingDiscovered": "Aún no se ha descubierto nada, por lo que no hay inventario del que elegir. Usa Avanzado para escribir la regla por campo, o envía telemetría primero.",
     "scopeAdvancedHint": "Coincide con cualquier campo y valor, incluidos los que los niveles anteriores no cubren.",
+    "scopeValuesSeen": "Estas listas muestran los valores que ha visto el descubrimiento de servicios. Para hacer coincidir cualquier otro valor, usa Avanzado.",
     "escalationHeld": "Triaje de IA primero · aviso en {n} s como máximo",
     "escalationPagingStep": "Avisando paso {step} de {total} · {who}",
     "escalationPagingStepOnly": "Avisando paso {step} de {total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Crear equipo y rotación",
     "removeMemberHandsOver": "{name} asume el turno actual de {leaving} en {rotation}.",
     "removeMemberLeavesGap": "Nadie asume el turno actual de {leaving} en {rotation}.",
+    "removeMemberReorders": "También salen de {rotations}, así que quién está de guardia allí también puede cambiar.",
     "membersJoinEnd": "{names} se une al final de {rotations}. Quien está de guardia ahora no cambia. | {names} se unen al final de {rotations}. Quien está de guardia ahora no cambia.",
     "membersAdded": "{names} añadido. | {names} añadidos.",
     "removeMemberConfirm": "Quitar",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Preguntas: {contact}",
       "outboundQueue": "Mensaje de alerta: {count} en cola, el más antiguo {age} | Mensajes de alerta: {count} en cola, el más antiguo {age}",
       "outboundEmpty": "No hay mensajes de alerta en cola",
+      "refusedPosts": "{count} publicación de alerta falló en las últimas 24 h. Última: {reason} en {destination}, | {count} publicaciones de alerta fallaron en las últimas 24 h. Última: {reason} en {destination},",
       "ageSeconds": "{count} s"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "No se pudieron enviar los recordatorios."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(sin nombre de modelo)",
+    "topModels": "{models} (los {shown} principales de {total})",
+    "cost": {
+      "partial": "parcial",
+      "unknown": "coste desconocido",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Coste parcial. No hay precio para {models}: los {tokens} tokens de {scope} no se contabilizan.",
+      "unknownTooltip": "Coste desconocido. No hay precio para {models}: ninguno de los {tokens} tokens de {scope} tiene coste.",
+      "scopeSession": "sesión",
+      "scopeTrace": "traza",
+      "unknownModel": "un modelo sin nombre",
+      "addPrice": "Añadir un precio"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} tokens sin precio",
+      "unpricedTooltip": "El coste es un límite inferior: {tokens} tokens de {models} no tienen precio. Abre la pestaña Sin precio en Precios de modelos LLM.",
+      "pricedSinceTooltip": "El coste es un límite inferior: {tokens} tokens de {models} se registraron antes de añadir un precio y se quedan sin coste."
+    },
+    "chart": {
+      "costMissing": "No aparecen en este gráfico: {models}. {tokens} tokens no tienen precio.",
+      "costMissingPricedSince": "No aparecen en este gráfico: {models}. {tokens} tokens se registraron antes de añadir un precio.",
+      "unpricedModels": "Sin precio: {models}",
+      "pricedSinceModels": "Registrados antes de añadir un precio: {models}",
+      "addPrice": "Añadir un precio"
+    },
+    "health": {
+      "title": "Salud de los datos",
+      "passing": "{n} correctas",
+      "checkedAgo": "comprobado {ago}",
+      "drawerTitle": "Salud de los datos de IA",
+      "drawerSubtitle": "{stream} · ventana actual",
+      "rerun": "Volver a ejecutar comprobaciones",
+      "close": "Cerrar",
+      "loadError": "No se pudieron ejecutar las comprobaciones de salud de los datos.",
+      "samples": "Muestras:",
+      "copyLink": "Copiar enlace para un administrador",
+      "linkCopied": "Enlace copiado",
+      "status": {
+        "pass": "Correcto",
+        "warning": "Advertencia",
+        "error": "Error"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Modelos sin precio",
+          "detail": "{count} modelo · {spans} spans · {tokens} tokens contabilizados como $0 | {count} modelos · {spans} spans · {tokens} tokens contabilizados como $0",
+          "pass": "Todos los modelos de esta ventana tienen precio. Los spans registrados antes de añadir un precio conservan el coste registrado.",
+          "fix": "Corregir en Precios de modelos LLM",
+          "truncated": "Los {shown} principales de {total} por tokens"
+        },
+        "missing_agent_identity": {
+          "label": "Identidad de agente ausente",
+          "detail": "{affected} de {total} spans de LLM ({pct}) no tienen gen_ai.agent.name, por lo que las vistas de agentes no los muestran.",
+          "pass": "Todos los spans de LLM incluyen un nombre o id de agente.",
+          "fix": "Abrir Asignación de agentes GenAI"
+        },
+        "zero_duration_spans": {
+          "label": "Spans de duración cero",
+          "detail": "{affected} spans de LLM indican 0 ms, por lo que la latencia y la duración de la sesión resultan demasiado bajas.",
+          "pass": "Ningún span de LLM indica 0 ms.",
+          "fix": "Cómo corregir"
+        },
+        "missing_session_id": {
+          "label": "Spans sin id de sesión",
+          "detail": "{affected} de {total} spans de LLM ({pct}) no tienen gen_ai.conversation.id, por lo que Sesiones no los muestra.",
+          "pass": "Todos los spans de LLM tienen gen_ai.conversation.id.",
+          "fix": "Guía de integración"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Gestión de flota",
     "subtitle": "Registra colectores de OpenTelemetry, versiona sus configuraciones y despliega los cambios con seguridad",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "En curso",
       "scheduled": "Programado",
+      "waiting": "En espera",
       "completed": "Completado",
       "halted": "Detenido",
       "superseded": "Reemplazado",
@@ -28696,7 +29257,7 @@
       "version": "Versión",
       "pickConfig": "Elige una configuración",
       "pickFleet": "Elige una flota",
-      "emptyFleet": "La flota no tiene colectores, por lo que la versión se establece de inmediato",
+      "emptyFleet": "La flota no tiene colectores, así que el despliegue esperará hasta que se una un colector.",
       "startingShortly": "Comenzará en breve",
       "eventGateFailed": "Control de salud fallido",
       "eventHalted": "Detenido",
@@ -28707,7 +29268,10 @@
       "notFound": "Este despliegue ya no existe",
       "notFoundDescription": "Puede que el enlace esté desactualizado. Elige un despliegue de la lista.",
       "noneTargeted": "Ningún colector seleccionado",
-      "outcomeNoneTargeted": "La flota no tenía colectores cuando se estableció v{to}.",
+      "outcomeNoneTargeted": "Ningún colector adoptó la v{to} en este despliegue.",
+      "outcomeWaiting": "No hay ningún colector en línea, así que la v{to} aún no ha llegado a ninguno. El despliegue comenzará cuando se conecte uno.",
+      "waitingForCollector": "En espera de un colector",
+      "notStarted": "No iniciado",
       "versionFailedBefore": "v{version} · falló antes",
       "pickVersion": "Elige una versión",
       "autoRollback": "Revertir automáticamente",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Reanudado",
       "eventSkipped": "Colectores con fallos omitidos",
       "eventStarted": "Iniciado",
+      "eventWaiting": "En espera de que se conecte un colector",
       "eventTimedOut": "Tiempo de espera de la fase agotado",
       "eventSkippedOffline": "Se dejó fuera {count} colector que estaba sin conexión al inicio; recibe la versión cuando se reconecte | Se dejaron fuera {count} colectores que estaban sin conexión al inicio; reciben la versión cuando se reconecten",
       "excluded": "Excluido",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Una fase que no confirma ni rechaza en {minutes} min detiene el despliegue (ajuste de la flota)",
       "phaseVerifying": "Verificando",
       "phases": "Fases",
-      "planEmpty": "No hay colectores que actualizar",
+      "planEmpty": "No hay ningún colector en línea, así que el despliegue esperará hasta que se conecte uno",
+      "planStable": "Ningún colector está en línea; la versión estable se asigna a cada uno cuando se conecta",
       "planOne": "{count} colector en un solo lote | {count} colectores en un solo lote",
       "planText": "{steps} → restantes {last}, {count} fases",
       "planUnavailable": "La vista previa del plan no está disponible",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 conserva los colectores sin conexión para siempre"
     },
     "audit": {
-      "search": "Buscar en el registro de auditoría",
       "editedConfig": "Configuración editada",
       "revokedToken": "Token de registro revocado",
       "enrolledCollector": "Colector registrado",
@@ -28920,7 +29485,6 @@
       "setDesired": "Versión cambiada",
       "autoRollback": "Revertido automáticamente",
       "rolloutHalted": "Despliegue detenido",
-      "assignedFleetConfig": "Configuración de la flota asignada",
       "createdFleet": "Flota creada",
       "renamedFleet": "Flota renombrada",
       "deletedFleet": "Flota eliminada",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Despliegue revertido",
       "movedByToken": "Movido por token de registro",
       "object": "Objeto",
+      "search": "Buscar en el registro de auditoría",
       "allObjects": "Todos los objetos",
       "kind": {
         "fleet": "Flota",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "Desplegando v{to}",
       "rolloutHalted": "Despliegue de v{to} detenido",
+      "rolloutWaiting": "v{to} espera a que un colector se ponga en línea",
       "autoRolledBack": "v{to} revertida automáticamente",
       "noReason": "No se informó ningún motivo del fallo",
       "openRollout": "Abrir despliegue",
diff --git a/web/src/locales/languages/fr-FR.json b/web/src/locales/languages/fr-FR.json
index 4b47360518..e88c27689f 100644
--- a/web/src/locales/languages/fr-FR.json
+++ b/web/src/locales/languages/fr-FR.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Aucune activité LLM pour le moment",
       "description": "Instrumentez vos services avec les conventions sémantiques OpenTelemetry Gen-AI et ingérez au moins une trace pour alimenter ce tableau de bord.",
-      "action": "Instrument avec OpenTelemetry",
-      "actionDesc": "Capturez les attributs gen_ai_* sur vos traces"
+      "action": "Toutes les intégrations IA",
+      "actionDesc": "Parcourir tous les guides de frameworks et de fournisseurs",
+      "suggested": "Configurer le traçage {name}",
+      "suggestedDesc": "Suggéré parce que vous venez de la documentation {name}",
+      "codingAgent": "Instrumenter avec un agent de codage",
+      "codingAgentDesc": "Votre agent de codage ajoute le traçage et vérifie la première trace",
+      "startFrom": "Ou commencez à partir de"
     },
     "noLLMSessions": {
       "title": "Pas encore de sessions de LLM",
@@ -4797,6 +4802,13 @@
       "success": "Succès",
       "failed": "Échoué",
       "testRun": "Exécution de test",
+      "source": "Source",
+      "sourceHttp": "Requête HTTP",
+      "sourceAlertFired": "Alerte déclenchée",
+      "sourceIncidentEvent": "Événement d'incident",
+      "sourceRetry": "Exécution de nouvelle tentative",
+      "sourceManual": "Exécution manuelle",
+      "sourceOther": "Autre",
       "runType": "Type",
       "testRunTooltip": "Démarrée depuis l'éditeur. Les étapes de destination envoient réellement.",
       "showTestRuns": "Afficher {count} exécution(s) de test",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Relancer cette exécution ?",
       "retryMessage": "Cela crée une nouvelle exécution à partir de l'entrée enregistrée par l'exécution échouée. Les étapes de destination envoient réellement.",
       "retryStarted": "Relance démarrée — elle apparaît dans la liste comme une nouvelle exécution.",
-      "retryError": "Impossible de relancer cette exécution"
+      "retryError": "Impossible de relancer cette exécution",
+      "statusQueued": "En file d'attente",
+      "statusRunning": "En cours",
+      "statusExpired": "Expirée",
+      "reasonExpired": "jamais exécutée · en file d'attente depuis plus de 1 h",
+      "reasonWorkerLost": "worker perdu · exécution non relancée",
+      "reasonWorkflowDisabled": "le workflow a été désactivé",
+      "reasonRunTimeout": "délai dépassé après 15 min",
+      "allTriggers": "Tous les déclencheurs",
+      "triggerFilter": "Déclencheur",
+      "run": "Exécution",
+      "searchRuns": "Rechercher un ID d'exécution, une clé d'idempotence ou une alerte",
+      "sourceDetails": "Détails de la source",
+      "detailsWithKey": "{ip} · clé {key}",
+      "detailsNoKey": "{ip} · aucune clé d'idempotence",
+      "retryOf": "Nouvelle tentative de {run}",
+      "openRun": "Ouvrir l'exécution",
+      "alertFiredEmptyTitle": "Aucune exécution déclenchée par une alerte dans cette plage horaire",
+      "incidentEventEmptyTitle": "Aucune exécution déclenchée par un événement d'incident dans cette plage horaire",
+      "filterEmptyTitle": "Aucune exécution correspondante dans cette plage horaire",
+      "filterEmptyDimmed": "Les autres exécutions restent sur la chronologie, atténuées.",
+      "searchEmptyTitle": "Aucune exécution ne correspond à cette recherche",
+      "searchEmptyAction": "Effacer la recherche",
+      "timelineNow": "maintenant",
+      "timelineAgoMinutes": "−{n} min",
+      "timelineAgoHours": "−{n} h",
+      "timelineAgoDays": "−{n} j"
     },
     "edit": "Modifier",
     "view": "Voir",
@@ -4958,7 +4996,9 @@
           "noMatch": "Aucune correspondance"
         },
         "suppressed": "Non envoyé — pas transmis à la destination réelle."
-      }
+      },
+      "payloadFrom": "Charge utile issue de",
+      "payloadFromHint": "La structure HTTP est celle que les appelants du point de terminaison envoient."
     },
     "linkAlerts": {
       "title": "Lier le workflow aux alertes",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Format de sortie",
       "tlsVerifyLabel": "Vérification TLS",
       "tlsDisabled": "Désactivé"
+    },
+    "http": {
+      "runTestHint": "Exécute les étapes avec une charge utile HTTP d'exemple ; n'appelle pas l'URL",
+      "runTestHintList": "Ouvrez le workflow pour exécuter un test",
+      "runsEmptyTitle": "Aucune requête HTTP dans cette plage horaire",
+      "runsEmptyBody": "Élargissez la plage horaire ou envoyez une requête de test depuis le panneau du point de terminaison HTTP.",
+      "runsEmptyAction": "Afficher tous les déclencheurs",
+      "runFailedAt": "Cette exécution a échoué à l'étape {step} : {error}",
+      "openStep": "Ouvrir l'étape",
+      "runGuardHint": "Les exécutions HTTP transportent la requête, pas les champs d'alerte. Si cette étape lit {fields}, protégez-la avec une Condition : {guard}.",
+      "runExpiredBanner": "Cette requête a attendu plus d'une heure dans la file d'attente et n'a jamais été exécutée. Aucune étape n'a été exécutée et aucune destination n'a été appelée.",
+      "runWorkerLostBanner": "Le worker qui exécutait cette requête s'est arrêté. Elle n'est pas relancée automatiquement, car les destinations ont peut-être déjà été appelées. Vérifiez-les avant que l'appelant ne la renvoie.",
+      "request": "Requête",
+      "requestReceived": "Reçue",
+      "requestToken": "Jeton",
+      "requestCallerIp": "IP de l'appelant",
+      "requestIdempotencyKey": "Clé d'idempotence",
+      "requestContentType": "Type de contenu",
+      "requestBodySize": "Taille du corps",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "En-têtes",
+      "headersKept": "{count} conservé · Authorization, cookies et signatures ne sont jamais stockés | {count} conservés · Authorization, cookies et signatures ne sont jamais stockés",
+      "headerName": "Nom",
+      "headerValue": "Valeur",
+      "outputCaption": "Ce que chaque étape en aval a reçu",
+      "useAsTestInput": "Utiliser comme entrée de test",
+      "editorButton": "Point de terminaison HTTP",
+      "editorButtonOn": "Activé",
+      "editorButtonOff": "Désactivé",
+      "editorButtonTooltip": "Permettre à un autre système de démarrer ce workflow avec une requête HTTP",
+      "editorButtonRefusedDraft": "Les requêtes reçoivent 403 tant que le workflow n'est pas publié.",
+      "editorButtonRefusedPaused": "Les requêtes reçoivent 403 tant que le workflow est en pause.",
+      "panelTitle": "Point de terminaison HTTP",
+      "panelSubtitle": "{name} · workflow {kind}",
+      "acceptRequests": "Accepter les requêtes HTTP",
+      "kindNote": "Les étapes de ce workflow ont été conçues pour des exécutions {kind}. Les exécutions HTTP reçoivent plutôt la requête ({field}), alors ajoutez une Condition si une étape a besoin des champs {kind}.",
+      "kindNotePayload": "Afficher la charge utile HTTP",
+      "kindNotePayloadHide": "Masquer la charge utile HTTP",
+      "unsavedBody": "Ce workflow n'est pas encore enregistré. Enregistrez-le comme brouillon pour créer son URL et son jeton. Les requêtes sont refusées jusqu'à sa publication.",
+      "saveAndCreate": "Enregistrer le brouillon et créer le point de terminaison",
+      "needsAdmin": "La création du point de terminaison nécessite un administrateur d'organisation.",
+      "needsEdit": "Sa modification nécessite un accès en édition à ce workflow.",
+      "readOnlyOnMeta": "Activé · vous pouvez copier l'URL. Sa modification nécessite un accès en édition à ce workflow.",
+      "offBody": "Permettez à un autre système de démarrer ce workflow avec une requête HTTP. Vous obtenez une URL et un jeton.",
+      "offExistingBody": "Désactivé · les requêtes sont refusées (403) jusqu'à son activation.",
+      "onMeta": "Activé · les exécutions ne démarrent que lorsque le workflow est activé et publié",
+      "loadError": "Impossible de charger les paramètres du point de terminaison.",
+      "draftBanner": "Ce workflow est un brouillon. Les appels à l'URL reçoivent 403 jusqu'à sa publication. Vous pouvez configurer le point de terminaison dès maintenant, et Exécuter le test lance les étapes du brouillon avec une charge utile HTTP d'exemple.",
+      "disabledBanner": "Les requêtes sont refusées (403) jusqu'à l'activation du workflow.",
+      "turnOnFailed": "Impossible d'activer le point de terminaison. {reason}",
+      "changeFailed": "Impossible d'enregistrer le point de terminaison. {reason}",
+      "endpointExistsHint": "Le point de terminaison existe déjà. Affichez ou copiez son jeton depuis la table des jetons.",
+      "endpointExistsHintSigned": "Le point de terminaison existe déjà. Affichez ou copiez son secret de signature depuis la table des secrets de signature.",
+      "disableTitle": "Désactiver le point de terminaison ?",
+      "disableBody": "Les appelants reçoivent 403 (point de terminaison désactivé) jusqu'à ce que vous le réactiviez. L'URL et les jetons restent inchangés.",
+      "disableConfirm": "Désactiver",
+      "lastCall": "Activé · Dernier appel : {status} · {time} · {link}",
+      "lastCallNone": "Activé · Aucun appel pour l'instant — envoyez une requête de test",
+      "lastCallNoneRefused": "Activé · Aucun appel pour l'instant",
+      "viewRun": "Voir l'exécution",
+      "lastCallStatus": {
+        "queued": "en attente",
+        "running": "en cours",
+        "succeeded": "réussi",
+        "failed": "échoué",
+        "expired": "expiré"
+      },
+      "endpointUrl": "URL du point de terminaison",
+      "tokenLabel": "Jeton",
+      "secretLabel": "Secret de signature",
+      "newTokenLabel": "Nouveau jeton",
+      "newSecretLabel": "Nouveau secret de signature",
+      "tokenHint": "Masqué à l'écran ; Copier copie le vrai jeton. Envoyez-le comme {header}, jamais dans l'URL.",
+      "secretHint": "Masqué à l'écran ; Copier copie le vrai secret. Signez chaque requête avec et envoyez les en-têtes {headers} ; n'envoyez jamais le secret lui-même.",
+      "revealBannerTitle": "Point de terminaison créé",
+      "revealBannerBody": "Envoyez ce jeton avec chaque requête. Vous pouvez l'afficher ou le copier à nouveau depuis le tableau des jetons.",
+      "revealBannerBodySigned": "Signez chaque requête avec ce secret. Vous pouvez l'afficher ou le copier à nouveau depuis le tableau des secrets de signature.",
+      "switchedBannerTitle": "Jeton créé",
+      "switchedBannerTitleSigned": "Secret de signature créé",
+      "rotateBannerTitle": "Nouveau jeton créé",
+      "rotateBannerTitleSigned": "Nouveau secret de signature créé",
+      "rotateBannerBody": "Les appelants conservent la même URL et le même en-tête ; seul le jeton change. L'ancien jeton continue de fonctionner jusqu'à son expiration et peut être affiché jusque-là.",
+      "rotateBannerBodySigned": "Les appelants conservent la même URL et les mêmes en-têtes ; seul le secret change. L'ancien secret continue de fonctionner jusqu'à son expiration et peut être affiché jusque-là.",
+      "rotateBannerBodyRevoked": "Les appelants conservent la même URL et le même en-tête ; seul le jeton change. L'ancien jeton a été révoqué et cesse de fonctionner dès maintenant.",
+      "rotateBannerBodyRevokedSigned": "Les appelants conservent la même URL et les mêmes en-têtes ; seul le secret change. L'ancien secret a été révoqué et cesse de fonctionner dès maintenant.",
+      "rotateBannerBodyFresh": "Les appelants conservent la même URL et le même en-tête et envoient ce jeton désormais.",
+      "rotateBannerBodyFreshSigned": "Les appelants conservent la même URL et les mêmes en-têtes et signent avec ce secret désormais.",
+      "snippetsLabel": "Exemple de requête",
+      "sendTest": "Envoyer une requête de test",
+      "sendTestHint": "Vérifie les identifiants et montre ce que vos étapes recevraient. Aucune exécution ne démarre, aucune destination n'est appelée.",
+      "sendTestHintPaused": "Vérifie les identifiants. Le workflow est en pause, donc l'appel est refusé avant qu'une entrée ne soit construite ; Exécuter le test exécute les étapes.",
+      "sendTestSigned": "Les navigateurs ne peuvent pas signer les requêtes ; testez donc avec l'exemple de requête ci-dessus. Ajoutez ?dry_run=true à son URL pour vérifier la signature sans démarrer d'exécution.",
+      "dryRunAccepted": "Exécution à blanc acceptée",
+      "dryRunMeta": "identifiants valides · corps de {size}",
+      "dryRunInput": "Entrée que vos étapes recevraient",
+      "dryRunRefused": "Identifiants valides. Les requêtes sont refusées jusqu'à ce que le workflow soit publié.",
+      "dryRunRefusedPaused": "Identifiants valides. Les requêtes sont refusées tant que le workflow est en pause.",
+      "dryRunRateLimited": "Limite de débit atteinte — les exécutions à blanc comptent dans la limite.",
+      "dryRunStatus": "La requête a été refusée avec le statut {status}.",
+      "dryRunFailed": "Impossible d'envoyer la requête de test. {reason}",
+      "runTestInstead": "Exécuter le test à la place",
+      "done": "Terminé",
+      "regionTag": "Région {name}",
+      "regionBanner": "Envoyez chaque requête, et chaque nouvelle tentative, à l'hôte de cette région. Les clés d'idempotence et le statut d'exécution ({field}) sont conservés dans la région qui a accepté l'appel ; une nouvelle tentative envoyée vers une autre région peut donc démarrer une seconde exécution.",
+      "authLabel": "Les appelants s'authentifient avec",
+      "authToken": "Jeton",
+      "authSigned": "Requêtes signées",
+      "authAbout": "À propos de l'authentification",
+      "authInfo": "Jeton : envoyez le jeton dans l'en-tête Authorization. Requêtes signées : signez chaque requête avec un secret partagé (en-têtes {headers}).",
+      "switchToSignedTitle": "Passer aux requêtes signées ?",
+      "switchToSignedBody": "Le basculement révoque immédiatement le jeton actuel et crée un secret de signature. Les appelants qui utilisent le jeton commencent à recevoir des 401.",
+      "switchToTokenTitle": "Passer à un jeton ?",
+      "switchToTokenBody": "Le changement révoque immédiatement le secret de signature actuel et crée un jeton. Les appelants qui signent leurs requêtes recevront désormais un 401.",
+      "tokensTitle": "Jetons",
+      "secretsTitle": "Secrets de signature",
+      "colToken": "Jeton",
+      "colSecret": "Secret",
+      "colCreated": "Créé",
+      "colLastUsed": "Dernière utilisation",
+      "colStatus": "Statut",
+      "colActions": "Actions",
+      "never": "Jamais",
+      "active": "Actif",
+      "retiring": "En retrait",
+      "creatorGone": "Le créateur ne fait plus partie de cette organisation",
+      "revoke": "Révoquer",
+      "revokeNow": "Révoquer maintenant",
+      "revokeTitle": "Révoquer {prefix} ? Les appelants qui l'utilisent reçoivent immédiatement un 401.",
+      "revokeFailed": "Impossible de le révoquer. {reason}",
+      "copyToken": "Copier le jeton",
+      "copySecret": "Copier le secret",
+      "tokenCopied": "Jeton copié",
+      "commandCopied": "Commande copiée",
+      "secretCopied": "Secret copié",
+      "revealFailed": "Impossible d'afficher le jeton. {reason}",
+      "revealFailedSigned": "Impossible d'afficher le secret. {reason}",
+      "revealDenied": "Seuls les administrateurs peuvent afficher ou copier les jetons de ce point de terminaison.",
+      "runTest": "Lancer le test",
+      "rotate": "Renouveler",
+      "rotateBlocked": "Révoquez d'abord le jeton en retrait",
+      "rotateBlockedSigned": "Révoquez d'abord le secret en retrait",
+      "rotateTitle": "Renouveler le jeton",
+      "rotateTitleSigned": "Renouveler le secret de signature",
+      "rotateLead": "Un nouveau jeton est créé maintenant. Maintenez {prefix} (dernière utilisation {time}) actif pendant",
+      "rotateLeadSigned": "Un nouveau secret de signature est créé maintenant. Maintenez {prefix} (dernière utilisation {time}) actif pendant",
+      "overlapNow": "Le révoquer immédiatement",
+      "overlapHour": "1 heure",
+      "overlapDay": "24 heures",
+      "overlapWeek": "7 jours",
+      "rotateConsequence": "Les appelants qui utilisent le jeton actuel continuent de fonctionner jusqu'à {time}. Mettez-les à jour d'ici là.",
+      "rotateConsequenceSigned": "Les appelants qui signent avec le secret actuel continuent de fonctionner jusqu'à {time}. Mettez-les à jour d'ici là.",
+      "rotateConsequenceNow": "Les appelants qui utilisent le jeton actuel recevront un 401 désormais.",
+      "rotateConsequenceNowSigned": "Les appelants qui signent avec le secret actuel recevront un 401 désormais.",
+      "rotateConfirm": "Renouveler le jeton",
+      "rotateConfirmSigned": "Renouveler le secret de signature",
+      "rotateFailed": "Impossible de renouveler. {reason}",
+      "advanced": "Avancé",
+      "advancedSummary": "Corps max. {size} · {count} requête par minute | Corps max. {size} · {count} requêtes par minute",
+      "maxBody": "Taille maximale du corps (KiB)",
+      "maxBodyHint": "Jusqu'à 1024 (1 MiB) ; vous ne pouvez que la réduire",
+      "maxBodyRange": "Saisissez un nombre entier de 1 à 1024",
+      "rateLimit": "Requêtes par minute",
+      "rateLimitHint": "Jusqu'à {org} par minute pour cette organisation",
+      "rateLimitRange": "Saisissez un nombre entier de 1 à {org}",
+      "saveLimitsFailed": "Impossible d'enregistrer les limites. {reason}",
+      "deleteMeta": "Supprime l'URL ainsi que chaque jeton et secret.",
+      "deleteButton": "Supprimer le point de terminaison",
+      "deleteTitle": "Supprimer ce point de terminaison ?",
+      "deleteBody": "L'URL cesse de fonctionner immédiatement : les appelants reçoivent un 401. Tous les jetons et secrets de signature sont supprimés et irrécupérables. L'historique des exécutions est conservé.",
+      "deleteFailed": "Impossible de supprimer le point de terminaison. {reason}",
+      "secretStorageWarning": "Ce serveur n'a pas de clé maître de chiffrement : les jetons et les secrets de signature sont donc stockés sous une forme lisible par quiconque a accès à la base de données. Demandez à votre administrateur d'en configurer une.",
+      "rejectionsLine": "Environ {count} requête rejetée au cours des dernières 24 h · dernière : {reason}, {time} | Environ {count} requêtes rejetées au cours des dernières 24 h · dernière : {reason}, {time}",
+      "rejectionsShow": "Afficher",
+      "rejectionsHide": "Masquer",
+      "rejectionsTitle": "Rejets récents",
+      "rejectionsCaption": "environ {count} au cours des dernières 24 h · l'appelant n'a vu que le code de statut | environ {count} au cours des dernières 24 h · l'appelant n'a vu que le code de statut",
+      "rejectionMeta": "environ {count} · dernier {time} · depuis {ip} | environ {count} · dernier {time} · depuis {ip}",
+      "rejectionsLoadError": "Impossible de charger les rejets.",
+      "raiseLimit": "Augmenter la limite",
+      "rotateLink": "Renouveler",
+      "reason": {
+        "invalid_token": {
+          "title": "Jeton invalide",
+          "fix": "L'appelant envoie un jeton révoqué, expiré ou mal saisi. Affichez ou copiez le jeton actuel depuis le tableau Jetons."
+        },
+        "invalid_signature": {
+          "title": "Signature invalide",
+          "fix": "L'appelant signe avec un ancien secret ou un secret erroné. Vérifiez qu'il utilise le secret actuel et qu'il signe {format} exactement tel qu'envoyé."
+        },
+        "stale_timestamp": {
+          "title": "Horodatage trop ancien",
+          "fix": "L'horloge de l'appelant dérive de plus de 5 minutes. Synchronisez son horloge et signez juste avant l'envoi."
+        },
+        "endpoint_disabled": {
+          "title": "Point de terminaison désactivé",
+          "fix": "Activez le point de terminaison."
+        },
+        "workflow_disabled": {
+          "title": "Workflow en pause",
+          "fix": "Reprenez le workflow depuis la liste."
+        },
+        "workflow_not_published": {
+          "title": "Workflow non publié",
+          "fix": "Publiez le workflow ; les brouillons refusent les requêtes."
+        },
+        "payload_too_large": {
+          "title": "Charge utile trop volumineuse",
+          "fix": "Dépasse {size}. Envoyez moins de données ou répartissez les événements sur plusieurs requêtes."
+        },
+        "credential_in_url": {
+          "title": "Identifiant dans l'URL",
+          "fix": "Un jeton ou un secret a été envoyé dans l'URL et refusé. Les URL finissent dans les journaux des proxys et des navigateurs : renouvelez-le maintenant, puis envoyez-le dans un en-tête."
+        },
+        "invalid_idempotency_key": {
+          "title": "Clé d'idempotence invalide",
+          "fix": "L'en-tête Idempotency-Key est vide ou dépasse 255 caractères."
+        },
+        "idempotency_key_reused": {
+          "title": "Clé d'idempotence réutilisée",
+          "fix": "La même clé est arrivée avec un corps différent. Utilisez une nouvelle clé pour chaque événement distinct."
+        },
+        "rate_limited": {
+          "title": "Limite de débit atteinte",
+          "fix": "Plus de {count} requêtes par minute. Regroupez les événements en une seule requête (envoyez un tableau JSON) ou augmentez la limite — jusqu'à {org} par minute pour cette organisation."
+        },
+        "queue_full": {
+          "title": "File d'attente saturée",
+          "fix": "Cette organisation avait déjà {count} exécutions HTTP en attente. Les appelants doivent réessayer après le délai Retry-After ; recherchez une étape lente ou réduisez la cadence d'envoi."
+        },
+        "worker_unavailable": {
+          "title": "Worker indisponible",
+          "fix": "Aucun worker de workflow ne fonctionnait dans cette région, donc rien n'a été mis en file. Les appelants qui réessayent après le délai Retry-After passeront dès qu'un worker sera de retour ; si le problème persiste, demandez à votre administrateur de vérifier les workers de workflow."
+        }
+      },
+      "nodeBadge": "Appelable via HTTP",
+      "triggerLinkOn": "S'exécute aussi sur les requêtes HTTP",
+      "triggerLinkOnAction": "Gérer le point de terminaison",
+      "triggerLinkOff": "Démarrez-le aussi depuis un autre système",
+      "triggerLinkOffAction": "Configurer un point de terminaison HTTP",
+      "pickerCue": "Tout workflow peut aussi être démarré par une requête HTTP. Choisissez son déclencheur, puis utilisez Point de terminaison HTTP dans la barre d'outils.",
+      "listTag": "HTTP",
+      "listTagTooltip": "Point de terminaison HTTP activé",
+      "listMenuItem": "Point de terminaison HTTP…",
+      "copyUrl": "Copier l'URL du point de terminaison",
+      "copyUrlDraftHint": "Les requêtes sont refusées tant que vous n'avez pas publié",
+      "copyUrlFailed": "Impossible de copier l'URL du point de terminaison. {reason}",
+      "payloadFrom": "Charge utile depuis",
+      "payloadHttp": "Requête HTTP",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "expire dans {count} h | expire dans {count} h",
+      "expiresInDays": "expire dans {count} jour | expire dans {count} jours",
+      "expired": "Expiré",
+      "rotateLeadUnused": "Un nouveau jeton est créé maintenant. Gardez {prefix} (jamais utilisé) actif pendant",
+      "rotateLeadUnusedSigned": "Un nouveau secret de signature est créé maintenant. Gardez {prefix} (jamais utilisé) actif pendant",
+      "fieldGroup": "Requête HTTP",
+      "fieldGroupBodyHint": "Les champs du corps de la requête nécessitent d'abord une étape Function",
+      "fieldGroupQueryHint": "Les paramètres de requête sont meta.query.<key> ; les clés répétées arrivent sous forme de liste et ne correspondent jamais",
+      "rotateLeadNone": "Aucun jeton n'est actif, les appelants ne peuvent donc pas s'authentifier. Un nouveau jeton est créé maintenant.",
+      "rotateLeadNoneSigned": "Aucun secret de signature n'est actif, les appelants ne peuvent donc pas s'authentifier. Un nouveau secret de signature est créé maintenant.",
+      "createForbidden": "Vous ne pouvez pas créer d'identifiants de point de terminaison dans cette organisation.",
+      "errorNotConfigured": "Ce workflow n'a pas de point de terminaison HTTP.",
+      "errorNoLiveCredential": "Aucun identifiant n'est actif. Effectuez une rotation pour en créer un.",
+      "errorNotAllowed": "Vous n'avez pas la permission d'effectuer cette action.",
+      "copyCredentialChanged": "L'identifiant a changé. Copiez à nouveau.",
+      "copyCommandFailed": "Impossible de copier la commande. {reason}",
+      "exampleRequest": "Exemple de requête",
+      "exampleActiveToken": "Jeton actif · {prefix}",
+      "exampleActiveSecret": "Secret actif · {prefix}",
+      "exampleHintToken": "La copie inclut le jeton. Collez-la dans un terminal ou importez-la dans Postman ou Insomnia (Import → Raw text).",
+      "exampleHintSigned": "Exécutez dans bash : le script signe avec openssl, puis appelle curl. La copie inclut le secret. Les outils d'import ne peuvent pas signer.",
+      "exampleHintTokenPlaceholder": "La copie contient un espace réservé à l'emplacement du jeton. Collez-la dans un terminal ou importez-la dans Postman ou Insomnia (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Exécutez dans bash : le script signe avec openssl, puis appelle curl. La copie contient un espace réservé à l'emplacement du secret. Les outils d'import ne peuvent pas signer."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Cliquez",
       "viewDocsLinkLabel": "ici",
       "viewDocsSuffix": "pour consulter la documentation complémentaire.",
-      "selectIntegrationPrompt": "Sélectionnez une intégration pour afficher les détails."
+      "selectIntegrationPrompt": "Sélectionnez une intégration pour afficher les détails.",
+      "codingAgent": {
+        "tabAgent": "Avec un agent de codage",
+        "tabSteps": "Étape par étape",
+        "streamLabel": "Nom du flux de traces",
+        "streamHelp": "L'agent écrit les traces dans ce flux et le vérifie.",
+        "envTitle": "Téléchargez votre .env",
+        "envHelp": "Enregistrez-le à la racine du projet. La skill lit le jeton depuis ce fichier, il ne passe donc jamais dans le chat.",
+        "envButton": "Télécharger .env",
+        "promptTitle": "Collez ceci dans {client1}, {client2} ou {client3}",
+        "promptLabel": "Invite",
+        "promptCopied": "Invite copiée"
+      }
     },
     "header": "Sources de données",
     "resetRUMTokenLabel": "Réinitialiser le jeton RUM",
@@ -7670,6 +7995,15 @@
     "queryValues": "Valeurs de requête",
     "constant": "Constante",
     "textbox": "Zone de texte",
+    "date": "Date",
+    "dateFormat": "Format de date de sortie",
+    "dateFormatHelp": "Sortie par défaut dans les requêtes. Remplacez ponctuellement avec ${'{'}name:format{'}'}, par ex. ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Secondes epoch (epoch)",
+    "dateFormatEpochms": "Millisecondes epoch (epochms)",
+    "dateFormatEpochus": "Microsecondes epoch (epochus)",
     "newFolder": "Nouveau dossier",
     "updateFolder": "Mettre à jour le dossier",
     "newReport": "Nouveau rapport",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Ajouter des annotations",
       "dependentAdhocVariableWarning": "Certaines variables dynamiques ne sont pas appliquées car le champ n'est pas présent dans le flux de la requête. Ouvrez l'inspecteur de requêtes pour voir tous les détails des variables et des requêtes exécutées pour afficher ce panneau.",
       "refreshCacheReload": "Actualiser le cache et recharger",
+      "exploreCreateAlert": "Créer une alerte",
+      "exploreAddToDashboard": "Ajouter au tableau de bord",
       "redirectingToLogs": "Redirection vers la page des logs",
       "pleaseWait": "Veuillez patienter..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Constante",
       "textbox": "Zone de texte",
       "custom": "Personnalisé",
+      "date": "Date",
       "list": "{type} · {example}",
       "csv": "Virgules : {example}",
       "pipe": "Barres verticales : {example}",
       "doublequote": "Guillemets doubles : {example}",
-      "singlequote": "Guillemets simples : {example}"
+      "singlequote": "Guillemets simples : {example}",
+      "dateIso": "Date (AAAA-MM-JJ) : {example}",
+      "dateDmy": "Jour en premier (JJ/MM/AAAA) : {example}",
+      "dateMdy": "Mois en premier (MM/JJ/AAAA) : {example}",
+      "dateEpoch": "Secondes epoch : {example}",
+      "dateEpochms": "Millisecondes epoch : {example}",
+      "dateEpochus": "Microsecondes epoch : {example}"
     },
     "add": "Ajouter un panneau",
     "save": "Enregistrer",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Reconnu",
         "badgeResolved": "Résolu",
         "badgeReopened": "Rouvert",
+        "badgeAckEnded": "Prise en charge terminée",
         "badgeDimensionsUpgraded": "Dimensions améliorées",
         "badgeTitleChanged": "Titre modifié",
         "badgeAssignment": "Attribution",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "L'IA attend une saisie",
         "incidentWas": "L'incident a été",
         "theIncident": "l'incident",
+        "ackEndedByPageResolve": "en résolvant l'une de ses notifications",
         "unnamedAlert": "alerte",
         "alertTriggered": "{alert} déclenchée | {alert} déclenchée {count} fois",
         "severityUpgraded": "Gravité augmentée de {from} à {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "M'alerter",
           "toast": "Importé depuis Product Analytics : « {sourceLabel} »"
+        },
+        "traces": {
+          "label": "Créer une alerte",
+          "toast": "Requête importée depuis votre recherche de traces",
+          "noStream": "Sélectionnez d'abord un flux",
+          "errorCount": "Nombre d'erreurs",
+          "errorRate": "Taux d'erreur"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Votre filtre de recherche n'a pas été reporté car il nécessite d'abord un choix « Exécuter en tant que » sur la page des logs. Ajoutez-le à la requête d'alerte si vous en avez besoin.",
         "thresholdColumnGuessed": "Le seuil a été appliqué à {column} ; vérifiez qu'il s'agit bien de la valeur voulue.",
         "thresholdNotCarried": "Le seuil {value} du graphique n'a pas été appliqué car vous avez choisi une autre requête.",
-        "rumFunnelExclusions": "Utilise les filtres d'application actuels de cette app ; recréez-la après leur modification."
+        "rumFunnelExclusions": "Utilise les filtres d'application actuels de cette app ; recréez-la après leur modification.",
+        "tracesSeedMatches": "Se déclenche lorsque les spans correspondants sur {minutes} min dépassent {threshold} (actuellement {current}).",
+        "tracesSeedSpans": "Se déclenche lorsque les spans sur {minutes} min dépassent {threshold} (actuellement {current}).",
+        "tracesSeedTraces": "Se déclenche lorsque les traces sur {minutes} min dépassent {threshold} (actuellement {current}).",
+        "tracesSeedErrorSpans": "Se déclenche lorsque les spans en erreur sur {minutes} min dépassent {threshold} (actuellement {current}).",
+        "tracesSeedErrorTraces": "Se déclenche lorsque les traces avec erreurs sur {minutes} min dépassent {threshold} (actuellement {current}).",
+        "tracesSeedErrorRatio": "Se déclenche lorsque le taux d'erreur sur {minutes} min dépasse {threshold} % (actuellement {current} %).",
+        "tracesErrorRatioMinSpans": "Ne vérifie que les fenêtres comportant au moins {minimum} spans, afin que quelques échecs sur une période calme ne déclenchent pas l'alerte.",
+        "tracesErrorRatioMinTraces": "Ne vérifie que les fenêtres comportant au moins {minimum} traces, afin que quelques échecs sur une période calme ne déclenchent pas l'alerte.",
+        "tracesSeedDuration": "Se déclenche lorsque la durée {percentile} sur {minutes} min est supérieure à {threshold} ms (actuellement {current} ms).",
+        "tracesSeedUnavailable": "La valeur actuelle n'a pas pu être lue ; le seuil démarre donc à 0. Définissez-le avant d'enregistrer.",
+        "tracesNoMatches": "Aucun span correspondant pour l'instant ; l'alerte se déclenche dès qu'un span apparaît.",
+        "tracesStoredSpans": "Les comptes portent sur les spans stockés ; le trafic échantillonné apparaît donc plus faible qu'il ne l'est réellement.",
+        "tracesPeriodCapped": "La fenêtre d'alerte a été limitée à {minutes} minutes pour que chaque vérification reste rapide.",
+        "tracesNotRun": "Cette recherche n'a pas encore été exécutée ; l'alerte utilise donc le filtre présent dans l'éditeur."
       }
     },
     "saveFailed": "Impossible d'enregistrer l'alerte.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Aucune métrique ne correspond aux filtres actuels",
       "noMatchHint": "Essayez de supprimer un filtre d'étiquette, d'effacer les sélections de préfixe/suffixe, ou de passer de « Avec données » à « Toutes ».",
       "noMatchHintFavorites": "Essayez de supprimer un filtre d'étiquette, ou de passer de « Avec données » à « Tous ».",
+      "noMatchYet": "Aucune métrique contenant des données trouvée pour l'instant",
+      "noMatchYetHint": "Les métriques vérifiées jusqu'ici n'ont renvoyé aucune donnée. Affichez-en davantage pour continuer la recherche.",
       "clearAllFilters": "Effacer tous les filtres",
       "emptyActions": {
         "clearSearch": "Effacer la recherche",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Panneau ajouté au tableau de bord",
       "errorAddingPanel": "Erreur lors de l'ajout du panneau",
       "selectDashboard": "Veuillez sélectionner un tableau de bord",
-      "selectTab": "Veuillez sélectionner un onglet"
+      "selectTab": "Veuillez sélectionner un onglet",
+      "panelsToAdd": "Panneaux à ajouter"
     },
     "groups": {
       "compute": "Calcul",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Autres"
   },
   "traces": {
+    "nlNeedsSql": "Cette question nécessite SQL ; ouvrez-la dans Logs",
+    "redActions": {
+      "menuGroupDashboards": "Tableaux de bord",
+      "addRedToDashboard": "Ajouter les graphiques RED au tableau de bord",
+      "durationActions": "Actions sur la durée",
+      "bucketNotice": {
+        "seconds": "Ces graphiques conservent les barres de {count} secondes que vous voyez actuellement.",
+        "minutes": "Ces graphiques conservent les barres de {count} minutes que vous voyez actuellement.",
+        "hours": "Ces graphiques conservent les barres de {count} heures que vous voyez actuellement.",
+        "days": "Ces graphiques conservent les barres de {count} jours que vous voyez actuellement."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Ce graphique conserve les barres de {count} secondes que vous voyez actuellement.",
+        "minutes": "Ce graphique conserve les barres de {count} minutes que vous voyez actuellement.",
+        "hours": "Ce graphique conserve les barres de {count} heures que vous voyez actuellement.",
+        "days": "Ce graphique conserve les barres de {count} jours que vous voyez actuellement."
+      }
+    },
     "latencyHeatmap": {
       "title": "Durée",
       "tooltipSpans": "{count} span | {count} spans",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Prochain match",
     "searchInSpans": "Rechercher dans les spans",
     "criticalPath": "Chemin critique",
+    "askAi": {
+      "explainTrace": "Expliquer la trace",
+      "explainTraceHint": "Interrogez l'IA sur les spans les plus lents du chemin critique et sur chaque span en erreur",
+      "askAboutSpan": "Interroger l'IA à propos de ce span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Trace · {operation}"
+    },
     "spansTableView": "Vue tableau des spans",
     "comingSoon": "Prochainement...",
     "fetchingTrace": "Récupération de votre trace.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Filtrer les erreurs",
         "resetFilters": "Réinitialiser les filtres",
         "errorsNone": "Aucune erreur · {total} tours",
-        "latencyLead": "Le plus lent {slowest} ·",
+        "latencyLead": "Tour moyen {avg} · Le plus lent {slowest} ·",
         "costLead": "Pic {peak} ·",
         "tokens": "{ratio} % mis en cache",
         "cacheImpact": "{ratio} % Réutilisé · {tokens} À lire",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Aucune donnée",
       "noErrorsInRange": "Aucune erreur sur cette période",
+      "loadFailed": "Impossible de charger les erreurs récentes",
       "time": "Temps",
       "service": "Service",
       "operation": "Opération",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Toujours actif (par défaut)",
     "testAtTimeLabel": "Tester à l'heure UTC",
     "testAtTimeHint": "Laissez vide pour utiliser l'heure actuelle. Les paliers de pointe / hors pointe sont résolus en fonction de cette heure.",
-    "localTimeHint": "Dans votre fuseau horaire : {range}"
+    "localTimeHint": "Dans votre fuseau horaire : {range}",
+    "builtInStatus": {
+      "seed": "Prix intégrés : liste initiale fournie avec cette version, datée du {date}.",
+      "neverSynced": "La synchronisation en ligne n'a pas été exécutée depuis le démarrage du serveur.",
+      "lastSynced": "Dernière synchronisation en ligne {time}."
+    },
+    "unpriced": {
+      "title": "Lacunes de tarification",
+      "subtitle": "Modèles de vos traces LLM qui n'avaient pas de prix, ou seulement un prix approximatif, à l'ingestion",
+      "banner": "{count} modèle n'avait pas de prix ou avait un prix approximatif à l'ingestion. Son coût enregistré peut être incomplet. | {count} modèles n'avaient pas de prix ou avaient un prix approximatif à l'ingestion. Leurs coûts enregistrés peuvent être incomplets.",
+      "bannerTruncated": "{total} modèles de vos traces n'avaient pas de prix ou seulement un prix approximatif à l'ingestion. Leur coût peut être erroné. Affichage des {shown} premiers par tokens.",
+      "streamLabel": "Flux",
+      "window": "Dernières 24 heures",
+      "windowRange": "{from} – {to}",
+      "colModel": "Modèle vu dans les traces",
+      "colPricedAs": "Tarifé comme",
+      "colTokens": "Tokens",
+      "colCost": "Coût enregistré",
+      "colActions": "Actions",
+      "spans": "{count} span | {count} spans",
+      "moreAgents": "+{count} de plus",
+      "noMatch": "Aucune correspondance",
+      "approximate": "Approximatif",
+      "pricedNow": "Tarifé pour les nouveaux spans",
+      "historicalGap": "Cette fenêtre conserve son écart de tarification enregistré. Les nouveaux spans utilisent le prix actuel.",
+      "noActionNeeded": "Aucune action nécessaire",
+      "defaultTierPrices": "entrée {input} / sortie {output} par 1M",
+      "notPriced": "non tarifé",
+      "createPrice": "Créer un prix",
+      "keepPrices": "Conserver les prix {name}",
+      "mute": "Mettre en sourdine",
+      "muteConfirmTitle": "Mettre ce modèle en sourdine ?",
+      "muteConfirmMessage": "Les nouveaux spans de {model} seront tarifés comme gratuits. Les spans plus anciens conservent leur coût enregistré. Supprimez le prix \"{name}\" pour le réactiver.",
+      "mutedNotif": "{model} mis en sourdine",
+      "keptNotif": "{model} utilise désormais les prix {name}",
+      "errSave": "Échec de l'enregistrement du prix",
+      "errLoad": "Échec du chargement des modèles non tarifés",
+      "emptyTitle": "Aucune utilisation de modèle non tarifé ou approximatif enregistrée dans ce flux pour cette fenêtre.",
+      "noStreamsTitle": "Aucun flux de traces LLM",
+      "noStreamsDesc": "Les modèles apparaissent ici dès que des spans gen_ai parviennent à un flux de traces.",
+      "recordedCostNote": "Les nouveaux prix s'appliquent aux spans ingérés après l'enregistrement. Les spans plus anciens conservent leur coût enregistré.",
+      "noModelName": "(aucun nom de modèle)",
+      "noModelHint": "Aucun modèle à tarifer : définissez gen_ai.request.model",
+      "instrumentationDocs": "Guide d'instrumentation"
+    }
   },
   "aiObservability": {
     "title": "Observabilité LLM",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Lignes ignorées : {full} entièrement · {partial} partiellement",
       "scoreEvidence": "{scorer} · v{version} : {samples} échantillons, {noReference} sans référence, {noTrace} sans trace",
       "scorerApplicability": "{scorer} · v{version} : {eligible} emplacements éligibles, {noReference} sans référence",
+      "costUnknown": "coût inconnu",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Échec du chargement des expériences",
       "previewError": "Échec de la prévisualisation des emplacements d'expérience",
       "createSuccess": "Expérience créée",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Le coût de cette expérience est estimé à environ {cost}, au-dessus du seuil d'avertissement de {threshold}. La créer et l'exécuter quand même ?",
         "costConfirmMessageUnpriced": "Le coût estimé de cette expérience dépasse le seuil d'avertissement. La créer et l'exécuter quand même ?",
         "costConfirmOk": "Créer quand même",
+        "taskProviderFailed": "Rien n'a été créé. Le fournisseur de tâches {provider} n'a pas répondu à l'appel de test.",
+        "judgeProviderFailed": "Rien n'a été créé. Le fournisseur du juge {provider} n'a pas répondu à l'appel de test.",
         "skippedFully": "{count} lignes entièrement ignorées — chaque évaluateur sélectionné nécessite une sortie attendue. Les lignes ignorées ne coûtent rien à exécuter.",
         "skippedPartially": "{count} lignes partiellement ignorées — la tâche s'exécute toujours, mais les évaluateurs basés sur des références ne peuvent pas noter les lignes sans sortie attendue.",
         "skippedNone": "Chaque ligne correspondante peut être notée sur au moins une dimension.",
@@ -17408,7 +17851,26 @@
           "trials": "Essais",
           "dispersion": "Dispersion",
           "latency": "Latence",
-          "p50Latency": "Latence P50"
+          "p50Latency": "Latence P50",
+          "error": "Erreur"
+        },
+        "failureBanner": {
+          "title": "{failed} emplacements sur {total} ont échoué : {cause}.",
+          "cause": "Cause principale, {count} emplacements : {message}",
+          "moreCauses": "+ {count} autres causes",
+          "noMessage": "aucun message d'erreur n'a été enregistré",
+          "openProviders": "Ouvrir Fournisseurs"
+        },
+        "failureKinds": {
+          "provider_auth": "le fournisseur a rejeté les identifiants",
+          "rate_limited": "le fournisseur a limité le débit de l'exécution",
+          "timeout": "le fournisseur n'a pas répondu à temps",
+          "provider_5xx": "le fournisseur a renvoyé une erreur serveur",
+          "parse_error": "la sortie n'a pas pu être analysée",
+          "mapping_error": "l'entrée de la tâche n'a pas pu être construite",
+          "scorer_missing": "un évaluateur n'existe plus",
+          "execution_error": "l'appel de la tâche a échoué",
+          "unknown": "l'appel de la tâche a échoué"
         },
         "saveAsPrompt": "Enregistrer comme prompt",
         "openPrompt": "Ouvrir le prompt",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Environnement",
       "agent": "Agent",
-      "version": "Version"
+      "version": "Version",
+      "agentIdHint": "ID de l'agent : {ids}",
+      "noAgentIdentity": "Aucune identité d'agent trouvée",
+      "noAgentIdentityDescription": "Ces spans LLM ne portent aucun nom d'agent, ils sont donc affichés par flux. Mappez l'attribut qui nomme votre agent pour les afficher par agent.",
+      "noAgentIdentityAction": "Ouvrir le mappage des agents GenAI"
     },
     "agentGraph": {
       "stream": "Flux",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Les évaluations sont désactivées sur ce serveur",
+      "description": "Cette page nécessite les évaluations en ligne, qui sont désactivées sur ce serveur. Demandez à votre administrateur de les activer."
+    },
     "traceScoreChip": {
       "reasoning": "Pourquoi",
       "noReasoning": "Aucun raisonnement enregistré pour ce score.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Configurer l'endpoint"
     },
     "provider": {
-      "backTo": "Retour aux fournisseurs",
+      "backTo": "Fournisseurs",
       "createTitle": "Créer un fournisseur LLM",
       "editTitle": "Modifier le fournisseur LLM",
       "subtitle": "Configurez le point de terminaison du modèle utilisé par les évaluateurs LLM.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Scorer {index} : le nom \"{name}\" est utilisé plus d'une fois dans cette importation"
         }
       },
-      "backTo": "Retour à Scorers",
+      "backTo": "Évaluateurs",
       "badgeRemote": "télécommande",
       "badgeLlm": "Juge LLM",
       "createTitleRemote": "Nouveau scoreur distant",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Sélectionnez un fournisseur",
       "modelLabel": "modèle",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Température",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 à 2. Laissez vide pour évaluer à 0.",
       "promptLabel": "Juge vite",
       "includeReasoningLabel": "Inclure le raisonnement",
       "includeReasoningHint": "Le juge explique pourquoi il a attribué ce score, enregistré avec chaque résultat.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Le nom de l'en-tête est requis",
         "apiKeyTokenRequired": "Le jeton est requis",
         "timeoutInvalid": "Le délai d'expiration doit être supérieur ou égal à 0",
+        "temperatureInvalid": "La température doit être comprise entre 0 et 2",
         "retriesInvalid": "Le nombre de tentatives doit être supérieur ou égal à 0",
         "duplicateFieldName": "Les noms de champs doivent être uniques"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Dégradé",
         "waitingForCredentials": "En attente d'identifiants",
         "noRecentRuns": "Aucune exécution récente",
+        "lastScored": "Dernière évaluation {time}",
         "summary": "{errors} exécutions sur {runs} ont échoué au cours des 15 dernières minutes",
         "since": "Entré dans cet état {time}",
         "checked": "Dernière vérification : {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Évalue {percent}% des cibles correspondantes.",
       "samplingValueAllHelp": "Chaque cible correspondante est évaluée.",
       "samplingHelp": "S'exécute après le filtrage, pour contrôler les coûts.",
-      "backTo": "Retour aux tâches d'évaluation",
+      "backTo": "Tâches d'évaluation",
       "createTitle": "Nouveau job d'évaluation",
       "editTitle": "Mettre à jour le job d'évaluation",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Cette branche se termine déjà par une destination.",
       "chooseATriggerNodeToStart": "Choisissez un nœud de déclenchement pour démarrer votre workflow",
       "thisConnectionWouldCreateALoop": "Cette connexion créerait une boucle",
-      "onlyOneIncomingConnectionToA": "Une seule connexion entrante par étape est autorisée."
+      "onlyOneIncomingConnectionToA": "Une seule connexion entrante par étape est autorisée.",
+      "endpointUrlCopied": "URL du point de terminaison copiée"
     },
     "views": {
       "youAreNotAuthorizedToManage": "Vous n'êtes pas autorisé à gérer la licence.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Rechercher une base de données ou un service…",
       "unnamedInstance": "Instance non nommée",
+      "schemaCount": "{count} schéma | {count} schémas",
       "unnamedInstanceHint": "Les rapports d'instructions de la base de données prouvent que ce moteur est en cours d'exécution, mais ils ne nomment pas d'hôte. La ligne affichera une adresse dès qu'un flux qui en contient — échantillonnage de session ou métriques d'instance — sera configuré.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Compté jusqu'à {time} ; la dernière demi-minute arrive encore.",
       "lineExact": "Toutes les bases de données rapportent. Les vitesses ici sont mesurées sur chaque appel, donc elles sont exactes.",
       "lineExactEstimated": "Toutes les bases de données rapportent. Les vitesses ici sont mélangées à partir de plusieurs périodes, donc elles sont approximatives mais pas exactes.",
+      "lineExactSlowestSchema": "Toutes les bases de données remontent des données. Les vitesses sont exactes par schéma ; une base de données comportant plusieurs schémas affiche le plus lent.",
       "lineSubsetUnnamed": "Vos filtres réduisent cela en dessous du niveau auquel ces totaux s'additionnent, donc les pourcentages décrivent les lignes affichées plutôt que toute la base de données.",
       "lineQuery": "Les temps sont mesurés depuis votre application, donc ils incluent le temps réseau et toute attente d'une connexion disponible.",
       "lineUncodedErrors": "{percent} des échecs ici sont revenus sans code de raison, donc ils peuvent être comptés mais pas expliqués.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "C'est la première fois que cette alerte s'est déclenchée.",
     "escalationNotStarted": "Pas encore contacté",
     "escalationPagesNobody": "Ne contacte personne",
+    "escalationNobodyPaged": "Personne n'est notifié",
     "escalationTo": "transmis à {who} {when}",
     "escalationDetailCapped": "Le détail d'escalade en direct est chargé pour les {count} plus anciennes notifications ouvertes.",
     "responder": "Intervenant",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "À",
     "rotationRestrictionAdd": "Ajouter une fenêtre",
     "rotationRestrictionRemove": "Supprimer",
-    "rotationRestrictionZeroLength": "De et À étant identiques, cette fenêtre ne correspond jamais et la couche est silencieusement ignorée.",
+    "rotationRestrictionZeroLength": "De et À sont identiques, cette fenêtre ne correspond donc jamais. L'enregistrement reste désactivé tant que De et À sont identiques ; pour une journée complète, définissez À sur 24:00.",
     "rotationRetiredTag": "Retirée",
     "rotationSectionWhen": "Quand la rotation change",
     "rotationName": "Nom de la rotation",
@@ -25593,6 +26072,10 @@
     "snoozed": "En pause",
     "snoozedUntil": "En pause jusqu'à {time} — toujours non attribuée",
     "snoozeFailed": "Impossible de mettre la notification en pause",
+    "unsnooze": "Fin de la sourdine",
+    "unsnoozeHint": "Met fin à la sourdine immédiatement. La notification reprend à l'étape où elle s'était arrêtée.",
+    "unsnoozed": "Sourdine terminée · la notification continue",
+    "unsnoozeFailed": "Impossible de mettre fin à la sourdine",
     "note": "Note",
     "notePlaceholder": "Qu'avez-vous trouvé ? Qu'avez-vous essayé ?",
     "addNote": "Ajouter une note",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Mêmes personnes, décalées d'un tour, de sorte que la rotation secondaire ne soit jamais assurée par la personne déjà en astreinte. C'est une rotation ordinaire : rien ne relie les deux rotations, donc modifier l'une sans l'autre les fait diverger, et vous obtenez un avertissement plutôt qu'une correction silencieuse.",
     "rotationPreviewPairLegend": "Primaire · Secondaire",
     "rotationPreviewEmpty": "Choisissez des personnes et une première passation pour voir qui est en astreinte et quand.",
+    "rotationPreviewNow": "Maintenant – {until}",
     "defaultRotationName": "Rotation",
     "teamCreatedWithoutMembers": "L'équipe a été créée, mais ses membres n'ont pas pu être ajoutés. Ajoutez-les dans l'onglet Membres.",
     "teamCreatedWithoutRotation": "L'équipe et ses membres ont été créés, mais la rotation n'a pas pu être enregistrée. Configurez-la dans l'onglet Planning.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "Personne n'a accusé réception — les notifications continuent",
     "sectionHint_ringingRouted": "personne n'a pris en charge — {count} d'entre elles envoie encore des notifications | personne n'a pris en charge — {count} d'entre elles envoient encore des notifications",
     "sectionHint_ringingUnrouted": "{count} n'a pas d'équipe, donc n'envoie pas de notification | {count} n'ont pas d'équipe, donc n'envoient pas de notification",
+    "sectionHint_ringingStopped": "{count} n'est pas notifié | {count} ne sont pas notifiés",
     "sectionHint_snoozed": "Notifications en pause — elles reprennent automatiquement",
     "sectionHint_handled": "Pris en charge — une personne est responsable de chacun.",
     "sectionHint_resolved": "Clôturés — conservés pour les archives.",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "L'équipe contactée lorsqu'un signal correspond. Sa propre échelle d'escalade décide qui est réveillé et dans quel ordre.",
     "scopeOwns": "Cette équipe possède",
     "scopeAdvanced": "Avancé",
-    "ruleEditorConflictUnclaimed": "Ce chemin n'est revendiqué par aucune règle aujourd'hui — une notification qui y correspond atteint l'équipe de dernier recours, ou personne.",
+    "ruleEditorConflictUnclaimed": "Rien ne revendique ce chemin aujourd'hui, au vu de ces seules conditions — une notification correspondante atteint la règle fourre-tout, ou personne.",
     "ruleEditorConflictHeldBy": "Aujourd'hui, une notification correspondante est envoyée à {team}, via {path}.",
     "ruleEditorConflictTakesOver": "Votre règle définit plus de conditions, elle retirerait donc ces éléments à {team}.",
     "ruleEditorConflictKeptBy": "Le chemin détenu par {team} définit plus de conditions, cette équipe le conserve donc et cette règle ne capte que ce qui reste.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} contacte cette équipe uniquement dans {scope}. Ailleurs, cela revient au propriétaire du périmètre environnant.",
     "scopeNothingDiscovered": "Rien n'a encore été découvert, il n'y a donc aucun parc parmi lequel choisir. Utilisez le mode Avancé pour définir la règle par champ, ou envoyez d'abord de la télémétrie.",
     "scopeAdvancedHint": "Correspond à n'importe quel champ et valeur, y compris ceux que les niveaux ci-dessus ne couvrent pas.",
+    "scopeValuesSeen": "Ces listes affichent les valeurs vues par la découverte de services. Pour correspondre à toute autre valeur, utilisez Avancé.",
     "escalationHeld": "Triage IA d'abord · notification d'ici {n} s au plus",
     "escalationPagingStep": "Notification étape {step} sur {total} · {who}",
     "escalationPagingStepOnly": "Notification étape {step} sur {total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Créer l'équipe et la rotation",
     "removeMemberHandsOver": "{name} reprend le créneau en cours de {leaving} dans {rotation}.",
     "removeMemberLeavesGap": "Personne ne reprend le créneau en cours de {leaving} dans {rotation}.",
+    "removeMemberReorders": "Ils quittent également {rotations}, ce qui peut aussi changer qui est d'astreinte.",
     "membersJoinEnd": "{names} rejoint la fin de {rotations}. La personne d'astreinte actuelle ne change pas. | {names} rejoignent la fin de {rotations}. La personne d'astreinte actuelle ne change pas.",
     "membersAdded": "{names} ajouté. | {names} ajoutés.",
     "removeMemberConfirm": "Retirer",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Questions : {contact}",
       "outboundQueue": "Message d'alerte : {count} en file d'attente, le plus ancien {age} | Messages d'alerte : {count} en file d'attente, le plus ancien {age}",
       "outboundEmpty": "Aucun message d'alerte en file d'attente",
+      "refusedPosts": "{count} publication d'alerte a échoué au cours des dernières 24 h. Dernière : {reason} sur {destination}, | {count} publications d'alerte ont échoué au cours des dernières 24 h. Dernière : {reason} sur {destination},",
       "ageSeconds": "{count} s"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "Les rappels n'ont pas pu être envoyés."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(aucun nom de modèle)",
+    "topModels": "{models} (top {shown} sur {total})",
+    "cost": {
+      "partial": "partiel",
+      "unknown": "coût inconnu",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Coût partiel. Aucun prix pour {models} : les {tokens} tokens de ce {scope} ne sont pas comptés.",
+      "unknownTooltip": "Coût inconnu. Aucun prix pour {models} : aucun des {tokens} tokens de ce {scope} n'a de coût.",
+      "scopeSession": "session",
+      "scopeTrace": "trace",
+      "unknownModel": "un modèle sans nom",
+      "addPrice": "Ajouter un prix"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} tokens sans prix",
+      "unpricedTooltip": "Le coût est une borne inférieure : {tokens} tokens sur {models} n'ont pas de prix. Ouvrez l'onglet Sans prix dans Tarification des modèles LLM.",
+      "pricedSinceTooltip": "Le coût est une borne inférieure : {tokens} tokens sur {models} ont été enregistrés avant l'ajout d'un prix et restent sans coût."
+    },
+    "chart": {
+      "costMissing": "Absents de ce graphique : {models}. {tokens} tokens n'ont pas de prix.",
+      "costMissingPricedSince": "Absents de ce graphique : {models}. {tokens} tokens ont été enregistrés avant l'ajout d'un prix.",
+      "unpricedModels": "Sans prix : {models}",
+      "pricedSinceModels": "Enregistrés avant l'ajout d'un prix : {models}",
+      "addPrice": "Ajouter un prix"
+    },
+    "health": {
+      "title": "Santé des données",
+      "passing": "{n} réussis",
+      "checkedAgo": "vérifié {ago}",
+      "drawerTitle": "Santé des données IA",
+      "drawerSubtitle": "{stream} · fenêtre actuelle",
+      "rerun": "Relancer les vérifications",
+      "close": "Fermer",
+      "loadError": "Les vérifications de santé des données n'ont pas pu s'exécuter.",
+      "samples": "Échantillons :",
+      "copyLink": "Copier le lien pour un administrateur",
+      "linkCopied": "Lien copié",
+      "status": {
+        "pass": "Réussi",
+        "warning": "Avertissement",
+        "error": "Erreur"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Modèles sans prix",
+          "detail": "{count} modèle · {spans} spans · {tokens} tokens comptés à 0 $ | {count} modèles · {spans} spans · {tokens} tokens comptés à 0 $",
+          "pass": "Chaque modèle de cette fenêtre a un prix. Les spans enregistrés avant l'ajout d'un prix conservent leur coût enregistré.",
+          "fix": "Corriger dans Tarification des modèles LLM",
+          "truncated": "{shown} premiers sur {total} par tokens"
+        },
+        "missing_agent_identity": {
+          "label": "Identité d'agent manquante",
+          "detail": "{affected} spans LLM sur {total} ({pct}) n'ont pas de gen_ai.agent.name, ils sont donc absents des vues par agent.",
+          "pass": "Chaque span LLM porte un nom ou un id d'agent.",
+          "fix": "Ouvrir le mappage des agents GenAI"
+        },
+        "zero_duration_spans": {
+          "label": "Spans de durée nulle",
+          "detail": "{affected} spans LLM indiquent 0 ms, les latences et durées de session sont donc sous-estimées.",
+          "pass": "Aucun span LLM n'indique 0 ms.",
+          "fix": "Comment corriger"
+        },
+        "missing_session_id": {
+          "label": "Spans sans id de session",
+          "detail": "{affected} spans LLM sur {total} ({pct}) n'ont pas de gen_ai.conversation.id, ils sont donc absents des Sessions.",
+          "pass": "Chaque span LLM possède un gen_ai.conversation.id.",
+          "fix": "Guide d'intégration"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Gestion de la flotte",
     "subtitle": "Enregistrez des collecteurs OpenTelemetry, versionnez leurs configurations et déployez les changements en toute sécurité",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "En cours",
       "scheduled": "Planifié",
+      "waiting": "En attente",
       "completed": "Terminé",
       "halted": "Interrompu",
       "superseded": "Remplacé",
@@ -28696,7 +29257,7 @@
       "version": "Version",
       "pickConfig": "Choisissez une configuration",
       "pickFleet": "Choisissez une flotte",
-      "emptyFleet": "La flotte n'a aucun collecteur, la version est donc définie immédiatement",
+      "emptyFleet": "La flotte n'a aucun collecteur, le déploiement attend qu'un collecteur la rejoigne",
       "startingShortly": "Démarrage imminent",
       "eventGateFailed": "Échec du contrôle de santé",
       "eventHalted": "Interrompu",
@@ -28707,7 +29268,10 @@
       "notFound": "Ce déploiement n'existe plus",
       "notFoundDescription": "Le lien est peut-être obsolète. Choisissez un déploiement dans la liste.",
       "noneTargeted": "Aucun collecteur ciblé",
-      "outcomeNoneTargeted": "La flotte n'avait aucun collecteur lorsque v{to} a été définie.",
+      "outcomeNoneTargeted": "Aucun collecteur n'a pris v{to} dans ce déploiement.",
+      "outcomeWaiting": "Aucun collecteur n'est en ligne, donc v{to} n'a encore été déployée nulle part. Le déploiement démarre dès qu'un collecteur se connecte.",
+      "waitingForCollector": "En attente d'un collecteur",
+      "notStarted": "Non démarré",
       "versionFailedBefore": "v{version} · a déjà échoué",
       "pickVersion": "Choisissez une version",
       "autoRollback": "Annuler automatiquement",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Repris",
       "eventSkipped": "Collecteurs en échec ignorés",
       "eventStarted": "Démarré",
+      "eventWaiting": "En attente de la connexion d'un collecteur",
       "eventTimedOut": "Délai de la phase dépassé",
       "eventSkippedOffline": "{count} collecteur hors ligne au démarrage a été exclu ; il recevra la version à sa reconnexion | {count} collecteurs hors ligne au démarrage ont été exclus ; ils recevront la version à leur reconnexion",
       "excluded": "Exclu",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Une phase qui ne confirme ni ne rejette en {minutes} min interrompt le déploiement (paramètre de la flotte)",
       "phaseVerifying": "Vérification",
       "phases": "Phases",
-      "planEmpty": "Aucun collecteur à mettre à jour",
+      "planEmpty": "Aucun collecteur n'est en ligne, le déploiement attend qu'un collecteur se connecte",
+      "planStable": "Aucun collecteur n'est en ligne ; la version stable est appliquée à chacun dès qu'il se connecte",
       "planOne": "{count} collecteur en un seul lot | {count} collecteurs en un seul lot",
       "planText": "{steps} → reste {last}, {count} phases",
       "planUnavailable": "L'aperçu du plan est indisponible",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 conserve les collecteurs hors ligne indéfiniment"
     },
     "audit": {
-      "search": "Rechercher dans le journal d'audit",
       "editedConfig": "Configuration modifiée",
       "revokedToken": "Jeton d'enregistrement révoqué",
       "enrolledCollector": "Collecteur enregistré",
@@ -28920,7 +29485,6 @@
       "setDesired": "Version modifiée",
       "autoRollback": "Annulé automatiquement",
       "rolloutHalted": "Déploiement interrompu",
-      "assignedFleetConfig": "Configuration de la flotte attribuée",
       "createdFleet": "Flotte créée",
       "renamedFleet": "Flotte renommée",
       "deletedFleet": "Flotte supprimée",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Déploiement annulé",
       "movedByToken": "Déplacé par jeton d'enregistrement",
       "object": "Objet",
+      "search": "Rechercher dans le journal d'audit",
       "allObjects": "Tous les objets",
       "kind": {
         "fleet": "Flotte",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "Déploiement de v{to}",
       "rolloutHalted": "Déploiement de v{to} interrompu",
+      "rolloutWaiting": "v{to} attend qu'un collecteur passe en ligne",
       "autoRolledBack": "v{to} annulée automatiquement",
       "noReason": "Aucune raison d'échec signalée",
       "openRollout": "Ouvrir le déploiement",
diff --git a/web/src/locales/languages/it-IT.json b/web/src/locales/languages/it-IT.json
index 810822188e..d6d3ee2473 100644
--- a/web/src/locales/languages/it-IT.json
+++ b/web/src/locales/languages/it-IT.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Nessuna attività LLM ancora",
       "description": "Strumenta i tuoi servizi con le convenzioni semantiche Gen-AI di OpenTelemetry e ingerisci almeno una traccia per popolare questa dashboard.",
-      "action": "Strumento con OpenTelemetry",
-      "actionDesc": "Acquisisci gli attributi gen_ai_* sulle tue tracce"
+      "action": "Tutte le integrazioni AI",
+      "actionDesc": "Sfoglia tutte le guide per framework e provider",
+      "suggested": "Configura il tracciamento di {name}",
+      "suggestedDesc": "Suggerito perché arrivi dalla documentazione di {name}",
+      "codingAgent": "Strumenta con un agente di programmazione",
+      "codingAgentDesc": "Il tuo agente di programmazione aggiunge il tracciamento e verifica la prima traccia",
+      "startFrom": "Oppure inizia da"
     },
     "noLLMSessions": {
       "title": "Ancora nessuna sessione LLM",
@@ -4797,6 +4802,13 @@
       "success": "Successo",
       "failed": "Fallito",
       "testRun": "Esecuzione di test",
+      "source": "Origine",
+      "sourceHttp": "Richiesta HTTP",
+      "sourceAlertFired": "Avviso attivato",
+      "sourceIncidentEvent": "Evento incidente",
+      "sourceRetry": "Riesecuzione",
+      "sourceManual": "Esecuzione manuale",
+      "sourceOther": "Altro",
       "runType": "Tipo",
       "testRunTooltip": "Avviata dall'editor. Gli step di destinazione inviano davvero.",
       "showTestRuns": "Mostra {count} esecuzioni di test",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Rieseguire questa esecuzione?",
       "retryMessage": "Questa operazione crea una nuova esecuzione usando l'input registrato dall'esecuzione fallita. Gli step di destinazione inviano davvero.",
       "retryStarted": "Riesecuzione avviata — appare nell'elenco come una nuova esecuzione.",
-      "retryError": "Impossibile riprovare questa esecuzione."
+      "retryError": "Impossibile riprovare questa esecuzione.",
+      "statusQueued": "In coda",
+      "statusRunning": "In esecuzione",
+      "statusExpired": "Scaduta",
+      "reasonExpired": "mai eseguita · in coda da oltre 1 h",
+      "reasonWorkerLost": "worker perso · non rieseguita",
+      "reasonWorkflowDisabled": "workflow disattivato",
+      "reasonRunTimeout": "timeout dopo 15 min",
+      "allTriggers": "Tutti i trigger",
+      "triggerFilter": "Trigger",
+      "run": "Esecuzione",
+      "searchRuns": "Cerca ID esecuzione, chiave di idempotenza o avviso",
+      "sourceDetails": "Dettagli origine",
+      "detailsWithKey": "{ip} · chiave {key}",
+      "detailsNoKey": "{ip} · nessuna chiave di idempotenza",
+      "retryOf": "Riesecuzione di {run}",
+      "openRun": "Apri esecuzione",
+      "alertFiredEmptyTitle": "Nessuna esecuzione attivata da avvisi in questo intervallo di tempo",
+      "incidentEventEmptyTitle": "Nessuna esecuzione da eventi incidente in questo intervallo di tempo",
+      "filterEmptyTitle": "Nessuna esecuzione corrispondente in questo intervallo di tempo",
+      "filterEmptyDimmed": "Le altre esecuzioni sono ancora sulla timeline, attenuate.",
+      "searchEmptyTitle": "Nessuna esecuzione corrisponde a questa ricerca",
+      "searchEmptyAction": "Cancella ricerca",
+      "timelineNow": "ora",
+      "timelineAgoMinutes": "−{n}m",
+      "timelineAgoHours": "−{n}h",
+      "timelineAgoDays": "−{n}d"
     },
     "edit": "Modifica",
     "view": "Visualizza",
@@ -4958,7 +4996,9 @@
           "noMatch": "Nessuna corrispondenza"
         },
         "suppressed": "Soppresso — non inviato alla destinazione reale."
-      }
+      },
+      "payloadFrom": "Payload da",
+      "payloadFromHint": "La struttura HTTP è quella inviata dai chiamanti dell'endpoint."
     },
     "linkAlerts": {
       "title": "Collega Workflow agli Avvisi",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Formato di output",
       "tlsVerifyLabel": "Verifica TLS",
       "tlsDisabled": "Disabilitato"
+    },
+    "http": {
+      "runTestHint": "Esegue i passaggi con un payload HTTP di esempio; non chiama l'URL",
+      "runTestHintList": "Apri il workflow per eseguire un test",
+      "runsEmptyTitle": "Nessuna richiesta HTTP in questo intervallo di tempo",
+      "runsEmptyBody": "Amplia l'intervallo di tempo oppure invia una richiesta di test dal pannello dell'endpoint HTTP.",
+      "runsEmptyAction": "Mostra tutti i trigger",
+      "runFailedAt": "Questa esecuzione non è riuscita al passaggio {step}: {error}",
+      "openStep": "Apri passaggio",
+      "runGuardHint": "Le esecuzioni HTTP trasportano la richiesta, non i campi dell'avviso. Se questo passaggio legge {fields}, proteggilo con una Condizione: {guard}.",
+      "runExpiredBanner": "Questa richiesta ha atteso in coda per più di 1 ora e non è mai stata eseguita. Nessun passaggio è stato eseguito e nessuna destinazione è stata chiamata.",
+      "runWorkerLostBanner": "Il worker che stava eseguendo questa richiesta si è arrestato. Non viene rieseguita automaticamente, perché le destinazioni potrebbero essere già state chiamate. Controllale prima che il chiamante la invii di nuovo.",
+      "request": "Richiesta",
+      "requestReceived": "Ricevuta",
+      "requestToken": "Token",
+      "requestCallerIp": "IP chiamante",
+      "requestIdempotencyKey": "Chiave di idempotenza",
+      "requestContentType": "Tipo di contenuto",
+      "requestBodySize": "Dimensione corpo",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Intestazioni",
+      "headersKept": "Intestazioni mantenute: {count} · Authorization, cookie e firme non vengono mai memorizzati | Intestazioni mantenute: {count} · Authorization, cookie e firme non vengono mai memorizzati",
+      "headerName": "Nome",
+      "headerValue": "Valore",
+      "outputCaption": "Ciò che ha ricevuto ogni passaggio a valle",
+      "useAsTestInput": "Usa come input di test",
+      "editorButton": "Endpoint HTTP",
+      "editorButtonOn": "Attivo",
+      "editorButtonOff": "Disattivo",
+      "editorButtonTooltip": "Consenti a un altro sistema di avviare questo workflow con una richiesta HTTP",
+      "editorButtonRefusedDraft": "Le richieste ricevono 403 finché il workflow non viene pubblicato",
+      "editorButtonRefusedPaused": "Le richieste ricevono 403 mentre il workflow è in pausa",
+      "panelTitle": "Endpoint HTTP",
+      "panelSubtitle": "{name} · workflow di tipo {kind}",
+      "acceptRequests": "Accetta richieste HTTP",
+      "kindNote": "I passaggi di questo workflow sono stati creati per esecuzioni di tipo {kind}. Le esecuzioni HTTP ricevono invece la richiesta ({field}), quindi aggiungi una Condizione se un passaggio richiede campi {kind}.",
+      "kindNotePayload": "Mostra il payload HTTP",
+      "kindNotePayloadHide": "Nascondi il payload HTTP",
+      "unsavedBody": "Questo workflow non è ancora salvato. Salvalo come bozza per creare il relativo URL e token. Le richieste vengono rifiutate finché non lo pubblichi.",
+      "saveAndCreate": "Salva bozza e crea endpoint",
+      "needsAdmin": "La creazione dell'endpoint richiede un amministratore dell'organizzazione.",
+      "needsEdit": "Per modificarlo serve l'accesso in modifica a questo workflow.",
+      "readOnlyOnMeta": "Attivo · puoi copiare l'URL. Per modificarlo serve l'accesso in modifica a questo workflow.",
+      "offBody": "Consenti a un altro sistema di avviare questo workflow con una richiesta HTTP. Ottieni un URL e un token.",
+      "offExistingBody": "Disattivo · le richieste vengono rifiutate (403) finché non lo attivi.",
+      "onMeta": "Attivo · le esecuzioni partono solo mentre il workflow è abilitato e pubblicato",
+      "loadError": "Impossibile caricare le impostazioni dell'endpoint.",
+      "draftBanner": "Questo workflow è una bozza. Le chiamate all'URL ricevono 403 finché non lo pubblichi. Puoi configurare l'endpoint ora e usare Esegui test per eseguire i passaggi della bozza con un payload HTTP di esempio.",
+      "disabledBanner": "Le richieste vengono rifiutate (403) finché non abiliti il workflow.",
+      "turnOnFailed": "Impossibile attivare l'endpoint. {reason}",
+      "changeFailed": "Impossibile salvare l'endpoint. {reason}",
+      "endpointExistsHint": "L'endpoint esiste già. Mostra o copia il suo token dalla tabella Token.",
+      "endpointExistsHintSigned": "L'endpoint esiste già. Mostra o copia il suo segreto di firma dalla tabella Segreti di firma.",
+      "disableTitle": "Disattivare l'endpoint?",
+      "disableBody": "I chiamanti ricevono 403 (endpoint disattivato) finché non lo riattivi. L'URL e i token restano invariati.",
+      "disableConfirm": "Disattiva",
+      "lastCall": "Attivo · Ultima chiamata: {status} · {time} · {link}",
+      "lastCallNone": "Attivo · Nessuna chiamata finora — invia una richiesta di test",
+      "lastCallNoneRefused": "Attivo · Nessuna chiamata finora",
+      "viewRun": "Visualizza esecuzione",
+      "lastCallStatus": {
+        "queued": "in coda",
+        "running": "in esecuzione",
+        "succeeded": "riuscita",
+        "failed": "non riuscita",
+        "expired": "scaduta"
+      },
+      "endpointUrl": "URL dell'endpoint",
+      "tokenLabel": "Token",
+      "secretLabel": "Segreto di firma",
+      "newTokenLabel": "Nuovo token",
+      "newSecretLabel": "Nuovo segreto di firma",
+      "tokenHint": "Mascherato sullo schermo; il pulsante Copia copia il token reale. Invialo come {header}, mai nell'URL.",
+      "secretHint": "Mascherato sullo schermo; il pulsante Copia copia il segreto reale. Firma ogni richiesta con esso e invia le intestazioni {headers}; non inviare mai il segreto stesso.",
+      "revealBannerTitle": "Endpoint creato",
+      "revealBannerBody": "Invia questo token con ogni richiesta. Puoi visualizzarlo o copiarlo di nuovo dalla tabella Token.",
+      "revealBannerBodySigned": "Firma ogni richiesta con questo segreto. Puoi visualizzarlo o copiarlo di nuovo dalla tabella Segreti di firma.",
+      "switchedBannerTitle": "Token creato",
+      "switchedBannerTitleSigned": "Segreto di firma creato",
+      "rotateBannerTitle": "Nuovo token creato",
+      "rotateBannerTitleSigned": "Nuovo segreto di firma creato",
+      "rotateBannerBody": "I chiamanti continuano a usare lo stesso URL e lo stesso header; cambia solo il token. Il vecchio token continua a funzionare fino alla sua scadenza e può essere visualizzato fino a quel momento.",
+      "rotateBannerBodySigned": "I chiamanti continuano a usare lo stesso URL e gli stessi header; cambia solo il segreto. Il vecchio segreto continua a funzionare fino alla sua scadenza e può essere visualizzato fino a quel momento.",
+      "rotateBannerBodyRevoked": "I chiamanti continuano a usare lo stesso URL e lo stesso header; cambia solo il token. Il vecchio token è stato revocato e smette di funzionare ora.",
+      "rotateBannerBodyRevokedSigned": "I chiamanti continuano a usare lo stesso URL e gli stessi header; cambia solo il segreto. Il vecchio segreto è stato revocato e smette di funzionare ora.",
+      "rotateBannerBodyFresh": "I chiamanti continuano a usare lo stesso URL e lo stesso header e da ora inviano questo token.",
+      "rotateBannerBodyFreshSigned": "I chiamanti continuano a usare lo stesso URL e gli stessi header e da ora firmano con questo segreto.",
+      "snippetsLabel": "Richiesta di esempio",
+      "sendTest": "Invia richiesta di test",
+      "sendTestHint": "Verifica le credenziali e mostra ciò che riceverebbero i tuoi passaggi. Non viene avviata alcuna esecuzione e non viene chiamata alcuna destinazione.",
+      "sendTestHintPaused": "Verifica le credenziali. Il workflow è in pausa, quindi la chiamata viene rifiutata prima che venga generato qualsiasi input; per eseguire i passaggi, usa Esegui test.",
+      "sendTestSigned": "I browser non possono firmare le richieste, quindi esegui il test con la richiesta di esempio sopra. Aggiungi ?dry_run=true al suo URL per verificare la firma senza avviare un'esecuzione.",
+      "dryRunAccepted": "Dry run accettato",
+      "dryRunMeta": "credenziali valide · corpo da {size}",
+      "dryRunInput": "Input che riceverebbero i tuoi passaggi",
+      "dryRunRefused": "Credenziali valide. Le richieste vengono rifiutate finché il workflow non viene pubblicato.",
+      "dryRunRefusedPaused": "Credenziali valide. Le richieste vengono rifiutate mentre il workflow è in pausa.",
+      "dryRunRateLimited": "Limite di frequenza raggiunto — i dry run contano ai fini del limite.",
+      "dryRunStatus": "La richiesta è stata rifiutata con stato {status}.",
+      "dryRunFailed": "Impossibile inviare la richiesta di test. {reason}",
+      "runTestInstead": "Esegui invece il test",
+      "done": "Fine",
+      "regionTag": "Regione {name}",
+      "regionBanner": "Invia ogni richiesta, e ogni retry, all'host di questa regione. Le chiavi di idempotenza e lo stato di esecuzione ({field}) vengono conservati nella regione che ha accettato la chiamata, quindi un retry inviato a un'altra regione può avviare una seconda esecuzione.",
+      "authLabel": "I chiamanti si autenticano con",
+      "authToken": "Token",
+      "authSigned": "Richieste firmate",
+      "authAbout": "Informazioni sull'autenticazione",
+      "authInfo": "Token: invia il token nell'header Authorization. Richieste firmate: firma ogni richiesta con un segreto condiviso (intestazioni {headers}).",
+      "switchToSignedTitle": "Passare alle richieste firmate?",
+      "switchToSignedBody": "Il passaggio revoca subito il token corrente e crea un segreto di firma. I chiamanti che usano il token inizieranno a ricevere 401.",
+      "switchToTokenTitle": "Passare al token?",
+      "switchToTokenBody": "Il passaggio revoca subito il segreto di firma corrente e crea un token. I chiamanti che firmano le richieste inizieranno a ricevere 401.",
+      "tokensTitle": "Token",
+      "secretsTitle": "Segreti di firma",
+      "colToken": "Token",
+      "colSecret": "Segreto",
+      "colCreated": "Creato",
+      "colLastUsed": "Ultimo utilizzo",
+      "colStatus": "Stato",
+      "colActions": "Azioni",
+      "never": "Mai",
+      "active": "Attivo",
+      "retiring": "In dismissione",
+      "creatorGone": "Il creatore non fa più parte di questa organizzazione",
+      "revoke": "Revoca",
+      "revokeNow": "Revoca ora",
+      "revokeTitle": "Revocare {prefix}? I chiamanti che lo usano riceveranno subito 401.",
+      "revokeFailed": "Impossibile revocarlo. {reason}",
+      "copyToken": "Copia token",
+      "copySecret": "Copia segreto",
+      "tokenCopied": "Token copiato",
+      "commandCopied": "Comando copiato",
+      "secretCopied": "Segreto copiato",
+      "revealFailed": "Impossibile mostrare il token. {reason}",
+      "revealFailedSigned": "Impossibile mostrare il segreto. {reason}",
+      "revealDenied": "Solo gli amministratori possono mostrare o copiare i token per questo endpoint.",
+      "runTest": "Esegui test",
+      "rotate": "Ruota",
+      "rotateBlocked": "Revoca prima il token in dismissione",
+      "rotateBlockedSigned": "Revoca prima il segreto in dismissione",
+      "rotateTitle": "Ruota token",
+      "rotateTitleSigned": "Ruota segreto di firma",
+      "rotateLead": "Un nuovo token viene creato ora. Mantieni {prefix} (ultimo utilizzo {time}) attivo per",
+      "rotateLeadSigned": "Un nuovo segreto di firma viene creato ora. Mantieni {prefix} (ultimo utilizzo {time}) attivo per",
+      "overlapNow": "Revocalo subito",
+      "overlapHour": "1 ora",
+      "overlapDay": "24 ore",
+      "overlapWeek": "7 giorni",
+      "rotateConsequence": "I chiamanti che usano il token corrente continueranno a funzionare fino a {time}. Aggiornali prima.",
+      "rotateConsequenceSigned": "I chiamanti che firmano con il segreto corrente continueranno a funzionare fino a {time}. Aggiornali prima.",
+      "rotateConsequenceNow": "Da ora in poi, i chiamanti che usano il token corrente riceveranno 401.",
+      "rotateConsequenceNowSigned": "Da ora in poi, i chiamanti che firmano con il segreto corrente riceveranno 401.",
+      "rotateConfirm": "Ruota token",
+      "rotateConfirmSigned": "Ruota segreto di firma",
+      "rotateFailed": "Impossibile ruotare. {reason}",
+      "advanced": "Avanzate",
+      "advancedSummary": "Corpo massimo {size} · {count} richiesta al minuto | Corpo massimo {size} · {count} richieste al minuto",
+      "maxBody": "Dimensione massima del corpo (KiB)",
+      "maxBodyHint": "Fino a 1024 (1 MiB); puoi solo ridurla",
+      "maxBodyRange": "Inserisci un numero intero da 1 a 1024",
+      "rateLimit": "Richieste al minuto",
+      "rateLimitHint": "Fino a {org} al minuto per questa organizzazione",
+      "rateLimitRange": "Inserisci un numero intero da 1 a {org}",
+      "saveLimitsFailed": "Impossibile salvare i limiti. {reason}",
+      "deleteMeta": "Rimuove l'URL e ogni token o secret.",
+      "deleteButton": "Elimina endpoint",
+      "deleteTitle": "Eliminare questo endpoint?",
+      "deleteBody": "L'URL smette di funzionare immediatamente: i chiamanti ricevono 401. Tutti i token e i secret di firma vengono eliminati e non possono essere recuperati. La cronologia delle esecuzioni viene conservata.",
+      "deleteFailed": "Impossibile eliminare l'endpoint. {reason}",
+      "secretStorageWarning": "Questo server non ha una chiave master di crittografia, quindi i token e i secret di firma sono memorizzati in una forma leggibile da chiunque abbia accesso al database. Chiedi all'amministratore di impostarne una.",
+      "rejectionsLine": "Circa {count} richiesta rifiutata nelle ultime 24 h · ultima: {reason}, {time} | Circa {count} richieste rifiutate nelle ultime 24 h · ultima: {reason}, {time}",
+      "rejectionsShow": "Mostra",
+      "rejectionsHide": "Nascondi",
+      "rejectionsTitle": "Rifiuti recenti",
+      "rejectionsCaption": "circa {count} nelle ultime 24 h · il chiamante ha visto solo il codice di stato | circa {count} nelle ultime 24 h · il chiamante ha visto solo il codice di stato",
+      "rejectionMeta": "circa {count} · ultima {time} · da {ip} | circa {count} · ultima {time} · da {ip}",
+      "rejectionsLoadError": "Impossibile caricare i rifiuti.",
+      "raiseLimit": "Aumenta limite",
+      "rotateLink": "Ruota",
+      "reason": {
+        "invalid_token": {
+          "title": "Token non valido",
+          "fix": "Il chiamante invia un token revocato, scaduto o digitato in modo errato. Mostra o copia il token corrente dalla tabella Token."
+        },
+        "invalid_signature": {
+          "title": "Firma non valida",
+          "fix": "Il chiamante firma con un secret vecchio o errato. Verifica che usi il secret corrente e firmi {format} esattamente come inviato."
+        },
+        "stale_timestamp": {
+          "title": "Timestamp troppo vecchio",
+          "fix": "L'orologio del chiamante è sfasato di oltre 5 minuti. Sincronizza il suo orologio e firma subito prima dell'invio."
+        },
+        "endpoint_disabled": {
+          "title": "Endpoint disattivato",
+          "fix": "Attiva l'endpoint."
+        },
+        "workflow_disabled": {
+          "title": "Workflow in pausa",
+          "fix": "Riprendi il workflow dall'elenco."
+        },
+        "workflow_not_published": {
+          "title": "Workflow non pubblicato",
+          "fix": "Pubblica il workflow; le bozze rifiutano le richieste."
+        },
+        "payload_too_large": {
+          "title": "Payload troppo grande",
+          "fix": "Superiore a {size}. Invia meno dati o suddividi gli eventi su più richieste."
+        },
+        "credential_in_url": {
+          "title": "Credenziale nell'URL",
+          "fix": "Un token o secret è stato inviato nell'URL ed è stato rifiutato. Gli URL finiscono nei log dei proxy e del browser, quindi ruotalo subito e poi invialo in un header."
+        },
+        "invalid_idempotency_key": {
+          "title": "Chiave di idempotenza non valida",
+          "fix": "L'header Idempotency-Key è vuoto o più lungo di 255 caratteri."
+        },
+        "idempotency_key_reused": {
+          "title": "Chiave di idempotenza riutilizzata",
+          "fix": "La stessa chiave è arrivata con un corpo diverso. Usa una nuova chiave per ogni evento distinto."
+        },
+        "rate_limited": {
+          "title": "Limite di frequenza raggiunto",
+          "fix": "Più di {count} richieste al minuto. Raggruppa gli eventi in un'unica richiesta (invia un array JSON) o aumenta il limite, fino a {org} al minuto per questa organizzazione."
+        },
+        "queue_full": {
+          "title": "Coda piena",
+          "fix": "Questa organizzazione aveva già {count} esecuzioni HTTP in attesa. I chiamanti dovrebbero riprovare dopo il ritardo indicato da Retry-After; cerca un passaggio lento o riduci la frequenza di invio."
+        },
+        "worker_unavailable": {
+          "title": "Worker non disponibile",
+          "fix": "Nessun worker dei workflow era in esecuzione in questa regione, quindi nulla è stato messo in coda. I chiamanti che riprovano dopo il ritardo indicato da Retry-After passano non appena un worker torna disponibile; se il problema persiste, chiedi all'amministratore di controllare i worker dei workflow."
+        }
+      },
+      "nodeBadge": "Richiamabile via HTTP",
+      "triggerLinkOn": "Viene eseguito anche su richieste HTTP",
+      "triggerLinkOnAction": "Gestisci endpoint",
+      "triggerLinkOff": "Avvialo anche da un altro sistema",
+      "triggerLinkOffAction": "Configura endpoint HTTP",
+      "pickerCue": "Qualsiasi workflow può anche essere avviato da una richiesta HTTP. Seleziona il suo trigger, poi usa Endpoint HTTP nella barra degli strumenti.",
+      "listTag": "HTTP",
+      "listTagTooltip": "Endpoint HTTP attivo",
+      "listMenuItem": "Endpoint HTTP…",
+      "copyUrl": "Copia URL dell'endpoint",
+      "copyUrlDraftHint": "Le richieste vengono rifiutate finché non pubblichi",
+      "copyUrlFailed": "Impossibile copiare l'URL dell'endpoint. {reason}",
+      "payloadFrom": "Payload da",
+      "payloadHttp": "Richiesta HTTP",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "scade tra {count} h | scade tra {count} h",
+      "expiresInDays": "scade tra {count} giorno | scade tra {count} giorni",
+      "expired": "Scaduto",
+      "rotateLeadUnused": "Ora viene creato un nuovo token. Mantieni {prefix} (mai usato) attivo per",
+      "rotateLeadUnusedSigned": "Ora viene creato un nuovo secret di firma. Mantieni {prefix} (mai usato) attivo per",
+      "fieldGroup": "Richiesta HTTP",
+      "fieldGroupBodyHint": "I campi nel corpo della richiesta richiedono prima uno step Function",
+      "fieldGroupQueryHint": "I parametri di query sono meta.query.<key>; le chiavi ripetute arrivano come elenco e non trovano mai corrispondenza",
+      "rotateLeadNone": "Nessun token è attivo, quindi i chiamanti non possono autenticarsi. Ora viene creato un nuovo token.",
+      "rotateLeadNoneSigned": "Nessun secret di firma è attivo, quindi i chiamanti non possono autenticarsi. Ora viene creato un nuovo secret di firma.",
+      "createForbidden": "Non puoi creare credenziali endpoint in questa organizzazione.",
+      "errorNotConfigured": "Questo workflow non ha un endpoint HTTP.",
+      "errorNoLiveCredential": "Nessuna credenziale è attiva. Ruota per crearne una.",
+      "errorNotAllowed": "Non hai l'autorizzazione per eseguire questa operazione.",
+      "copyCredentialChanged": "Credenziale cambiata. Copia di nuovo.",
+      "copyCommandFailed": "Impossibile copiare il comando. {reason}",
+      "exampleRequest": "Richiesta di esempio",
+      "exampleActiveToken": "Token attivo · {prefix}",
+      "exampleActiveSecret": "Secret attivo · {prefix}",
+      "exampleHintToken": "La copia include il token. Incollala in un terminale oppure importala in Postman o Insomnia (Import → Raw text).",
+      "exampleHintSigned": "Esegui in bash: firma con openssl, poi chiama curl. La copia include il secret. Gli strumenti di importazione non possono firmare.",
+      "exampleHintTokenPlaceholder": "La copia contiene un segnaposto al posto del token. Incollala in un terminale oppure importala in Postman o Insomnia (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Esegui in bash: firma con openssl, poi chiama curl. La copia contiene un segnaposto al posto del secret. Gli strumenti di importazione non possono firmare."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Clicca",
       "viewDocsLinkLabel": "qui",
       "viewDocsSuffix": "per consultare ulteriore documentazione.",
-      "selectIntegrationPrompt": "Seleziona un'integrazione per visualizzare i dettagli."
+      "selectIntegrationPrompt": "Seleziona un'integrazione per visualizzare i dettagli.",
+      "codingAgent": {
+        "tabAgent": "Con un agente di coding",
+        "tabSteps": "Passo per passo",
+        "streamLabel": "Nome dello stream delle tracce",
+        "streamHelp": "L'agente scrive le tracce in questo stream e le verifica.",
+        "envTitle": "Scarica il tuo .env",
+        "envHelp": "Salvalo nella root del progetto. La skill legge il token da questo file, così non finisce mai nella chat.",
+        "envButton": "Scarica .env",
+        "promptTitle": "Incolla questo in {client1}, {client2} o {client3}",
+        "promptLabel": "Prompt",
+        "promptCopied": "Prompt copiato"
+      }
     },
     "header": "Origini dei dati",
     "resetRUMTokenLabel": "Reimposta il token RUM",
@@ -7670,6 +7995,15 @@
     "queryValues": "Valori di query",
     "constant": "Costante",
     "textbox": "Casella di testo",
+    "date": "Data",
+    "dateFormat": "Formato data di output",
+    "dateFormatHelp": "Output predefinito nelle query. Sostituisci per singolo utilizzo con ${'{'}name:format{'}'}, ad es. ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Secondi epoch (epoch)",
+    "dateFormatEpochms": "Millisecondi epoch (epochms)",
+    "dateFormatEpochus": "Microsecondi epoch (epochus)",
     "newFolder": "Nuova cartella",
     "updateFolder": "Aggiorna cartella",
     "newReport": "Nuovo report",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Aggiungi annotazioni",
       "dependentAdhocVariableWarning": "Alcune variabili dinamiche non sono state applicate perché il campo non è presente nello stream della query. Apri l'Ispettore delle query per vedere tutti i dettagli delle variabili e delle query eseguite per visualizzare questo pannello.",
       "refreshCacheReload": "Aggiorna cache e ricarica",
+      "exploreCreateAlert": "Crea avviso",
+      "exploreAddToDashboard": "Aggiungi alla dashboard",
       "redirectingToLogs": "Reindirizzamento alla pagina dei log",
       "pleaseWait": "Attendere..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Costante",
       "textbox": "Casella di testo",
       "custom": "Personalizzato",
+      "date": "Data",
       "list": "{type} · {example}",
       "csv": "Virgole: {example}",
       "pipe": "Pipe: {example}",
       "doublequote": "Virgolette doppie: {example}",
-      "singlequote": "Virgolette singole: {example}"
+      "singlequote": "Virgolette singole: {example}",
+      "dateIso": "Data (YYYY-MM-DD): {example}",
+      "dateDmy": "Giorno prima (DD/MM/YYYY): {example}",
+      "dateMdy": "Mese prima (MM/DD/YYYY): {example}",
+      "dateEpoch": "Secondi epoch: {example}",
+      "dateEpochms": "Millisecondi epoch: {example}",
+      "dateEpochus": "Microsecondi epoch: {example}"
     },
     "add": "Aggiungi pannello",
     "save": "Salva",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Preso in carico",
         "badgeResolved": "Risolto",
         "badgeReopened": "Riaperto",
+        "badgeAckEnded": "Presa in carico terminata",
         "badgeDimensionsUpgraded": "Dimensioni Ampliate",
         "badgeTitleChanged": "Titolo Modificato",
         "badgeAssignment": "Assegnazione",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "L'AI richiede input",
         "incidentWas": "L'incidente è stato",
         "theIncident": "l'incidente",
+        "ackEndedByPageResolve": "risolvendo una delle sue notifiche",
         "unnamedAlert": "avviso",
         "alertTriggered": "{alert} attivato | {alert} attivato {count} volte",
         "severityUpgraded": "Gravità aumentata da {from} a {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Avvisami",
           "toast": "Importato da Product Analytics: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "Crea avviso",
+          "toast": "Query importata dalla ricerca delle tracce",
+          "noStream": "Seleziona prima uno stream",
+          "errorCount": "Conteggio errori",
+          "errorRate": "Tasso di errore"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Il filtro di ricerca non è stato trasferito perché richiede prima la scelta \"Esegui come\" nella pagina dei log. Aggiungilo alla query dell'avviso se ti serve.",
         "thresholdColumnGuessed": "La soglia è stata applicata a {column}; controlla che sia il valore che intendevi.",
         "thresholdNotCarried": "La soglia {value} del grafico non è stata applicata perché hai scelto una query diversa.",
-        "rumFunnelExclusions": "Utilizza i filtri app di questa app allo stato attuale; ricrealo dopo che cambiano."
+        "rumFunnelExclusions": "Utilizza i filtri app di questa app allo stato attuale; ricrealo dopo che cambiano.",
+        "tracesSeedMatches": "Si attiva quando gli span corrispondenti in {minutes} min superano {threshold} (ora {current}).",
+        "tracesSeedSpans": "Si attiva quando gli span in {minutes} min superano {threshold} (ora {current}).",
+        "tracesSeedTraces": "Si attiva quando le tracce in {minutes} min superano {threshold} (ora {current}).",
+        "tracesSeedErrorSpans": "Si attiva quando gli span con errori in {minutes} min superano {threshold} (ora {current}).",
+        "tracesSeedErrorTraces": "Si attiva quando le tracce con errori in {minutes} min superano {threshold} (ora {current}).",
+        "tracesSeedErrorRatio": "Si attiva quando il tasso di errore in {minutes} min supera {threshold}% (ora {current}%).",
+        "tracesErrorRatioMinSpans": "Controlla solo le finestre con almeno {minimum} span, così pochi errori in un periodo tranquillo non attivano l'avviso.",
+        "tracesErrorRatioMinTraces": "Controlla solo le finestre con almeno {minimum} tracce, così pochi errori in un periodo tranquillo non attivano l'avviso.",
+        "tracesSeedDuration": "Si attiva quando la durata {percentile} su {minutes} min è superiore a {threshold} ms (ora {current} ms).",
+        "tracesSeedUnavailable": "Non è stato possibile leggere il valore corrente, quindi la soglia parte da 0. Impostala prima di salvare.",
+        "tracesNoMatches": "Nessuno span corrispondente per ora, quindi l'avviso si attiva non appena ne compare uno.",
+        "tracesStoredSpans": "I conteggi riguardano gli span memorizzati, quindi il traffico campionato risulta inferiore a quello reale.",
+        "tracesPeriodCapped": "La finestra dell'avviso è stata limitata a {minutes} minuti per mantenere rapido ogni controllo.",
+        "tracesNotRun": "Questa ricerca non è ancora stata eseguita, quindi l'avviso usa il filtro nell'editor."
       }
     },
     "saveFailed": "Impossibile salvare l'avviso.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Nessuna metrica corrisponde ai filtri correnti",
       "noMatchHint": "Prova a rimuovere un filtro etichetta, cancellare le selezioni di prefisso/suffisso, o passare da “Con dati” a “Tutte”.",
       "noMatchHintFavorites": "Prova a rimuovere un filtro etichetta o a passare da “Con dati” a “Tutti”.",
+      "noMatchYet": "Nessuna metrica con dati trovata finora",
+      "noMatchYetHint": "Le metriche controllate finora non hanno restituito dati. Mostrane altre per continuare a cercare.",
       "clearAllFilters": "Cancella tutti i filtri",
       "emptyActions": {
         "clearSearch": "Cancella ricerca",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Pannello aggiunto alla dashboard",
       "errorAddingPanel": "Errore durante l'aggiunta del pannello",
       "selectDashboard": "Seleziona una dashboard",
-      "selectTab": "Seleziona una scheda"
+      "selectTab": "Seleziona una scheda",
+      "panelsToAdd": "Pannelli da aggiungere"
     },
     "groups": {
       "compute": "Calcolo",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Altri"
   },
   "traces": {
+    "nlNeedsSql": "Questa domanda richiede SQL; aprila in Log",
+    "redActions": {
+      "menuGroupDashboards": "Dashboard",
+      "addRedToDashboard": "Aggiungi i grafici RED alla dashboard",
+      "durationActions": "Azioni sulla durata",
+      "bucketNotice": {
+        "seconds": "Questi grafici mantengono le barre da {count} secondi che vedi ora.",
+        "minutes": "Questi grafici mantengono le barre da {count} minuti che vedi ora.",
+        "hours": "Questi grafici mantengono le barre da {count} ore che vedi ora.",
+        "days": "Questi grafici mantengono le barre da {count} giorni che vedi ora."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Questo grafico mantiene le barre da {count} secondi che vedi ora.",
+        "minutes": "Questo grafico mantiene le barre da {count} minuti che vedi ora.",
+        "hours": "Questo grafico mantiene le barre da {count} ore che vedi ora.",
+        "days": "Questo grafico mantiene le barre da {count} giorni che vedi ora."
+      }
+    },
     "latencyHeatmap": {
       "title": "Durata",
       "tooltipSpans": "{count} span | {count} span",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Corrispondenza successiva",
     "searchInSpans": "Cerca negli span",
     "criticalPath": "Percorso critico",
+    "askAi": {
+      "explainTrace": "Spiega la traccia",
+      "explainTraceHint": "Chiedi all'AI degli span più lenti sul percorso critico e di ogni span con errori",
+      "askAboutSpan": "Chiedi all'AI informazioni su questo span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Traccia · {operation}"
+    },
     "spansTableView": "Vista tabella degli span",
     "comingSoon": "Presto in arrivo...",
     "fetchingTrace": "Recupero della tua traccia.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Filtra errori",
         "resetFilters": "Reimposta filtri",
         "errorsNone": "Nessun errore · {total} Turni",
-        "latencyLead": "Il più lento {slowest} ·",
+        "latencyLead": "Turno medio {avg} · Più lento {slowest} ·",
         "costLead": "Picco {peak} ·",
         "tokens": "{ratio}% Memorizzato nella cache",
         "cacheImpact": "{ratio}% Riutilizzato · {tokens} Tok Letto",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Nessun dato",
       "noErrorsInRange": "Nessun errore in questo intervallo di tempo",
+      "loadFailed": "Impossibile caricare gli errori recenti",
       "time": "Ora",
       "service": "Servizio",
       "operation": "Operazione",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Sempre attivo (predefinito)",
     "testAtTimeLabel": "Prova all'ora UTC",
     "testAtTimeHint": "Lascia vuoto per usare l'ora corrente. I livelli di picco / fuori picco vengono determinati in base a quest'ora.",
-    "localTimeHint": "Nel tuo fuso orario: {range}"
+    "localTimeHint": "Nel tuo fuso orario: {range}",
+    "builtInStatus": {
+      "seed": "Prezzi integrati: elenco seed fornito con questa versione, datato {date}.",
+      "neverSynced": "La sincronizzazione online non è stata eseguita dall'avvio del server.",
+      "lastSynced": "Ultima sincronizzazione online: {time}."
+    },
+    "unpriced": {
+      "title": "Lacune nei prezzi",
+      "subtitle": "Modelli nelle tue tracce LLM che non avevano un prezzo, o ne avevano solo uno approssimativo, al momento dell'ingestione",
+      "banner": "{count} modello non aveva un prezzo o aveva un prezzo approssimativo al momento dell'ingestione. Il costo registrato potrebbe essere incompleto. | {count} modelli non avevano un prezzo o avevano un prezzo approssimativo al momento dell'ingestione. I costi registrati potrebbero essere incompleti.",
+      "bannerTruncated": "{total} modelli nelle tue tracce non avevano un prezzo o ne avevano uno approssimativo al momento dell'ingestione. Il loro costo potrebbe essere errato. Vengono mostrati i primi {shown} per token.",
+      "streamLabel": "Stream",
+      "window": "Ultime 24 ore",
+      "windowRange": "{from} – {to}",
+      "colModel": "Modello rilevato nelle tracce",
+      "colPricedAs": "Prezzato come",
+      "colTokens": "Token",
+      "colCost": "Costo registrato",
+      "colActions": "Azioni",
+      "spans": "{count} span | {count} span",
+      "moreAgents": "+{count} altri",
+      "noMatch": "Nessuna corrispondenza",
+      "approximate": "Approssimativo",
+      "pricedNow": "Prezzato per i nuovi span",
+      "historicalGap": "Questa finestra mantiene la lacuna di prezzo registrata. I nuovi span usano il prezzo corrente.",
+      "noActionNeeded": "Nessuna azione necessaria",
+      "defaultTierPrices": "input {input} / output {output} per 1M",
+      "notPriced": "non prezzato",
+      "createPrice": "Crea prezzo",
+      "keepPrices": "Mantieni i prezzi di {name}",
+      "mute": "Silenzia",
+      "muteConfirmTitle": "Silenziare questo modello?",
+      "muteConfirmMessage": "I nuovi span di {model} saranno prezzati come gratuiti. Gli span precedenti mantengono il costo registrato. Elimina il prezzo \"{name}\" per riattivare.",
+      "mutedNotif": "{model} silenziato",
+      "keptNotif": "{model} ora usa i prezzi di {name}",
+      "errSave": "Impossibile salvare il prezzo",
+      "errLoad": "Impossibile caricare i modelli senza prezzo",
+      "emptyTitle": "Nessun utilizzo di modelli senza prezzo o approssimativo registrato in questo stream in questa finestra.",
+      "noStreamsTitle": "Nessuno stream di tracce LLM",
+      "noStreamsDesc": "I modelli compaiono qui quando gli span gen_ai raggiungono uno stream di tracce.",
+      "recordedCostNote": "I nuovi prezzi si applicano agli span ingeriti dopo il salvataggio. Gli span precedenti mantengono il costo registrato.",
+      "noModelName": "(nessun nome di modello)",
+      "noModelHint": "Nessun modello da prezzare: imposta gen_ai.request.model",
+      "instrumentationDocs": "Guida alla strumentazione"
+    }
   },
   "aiObservability": {
     "title": "Osservabilità LLM",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Righe saltate: {full} completamente · {partial} parzialmente",
       "scoreEvidence": "{scorer} · v{version}: {samples} campioni, {noReference} nessun riferimento, {noTrace} nessuna traccia",
       "scorerApplicability": "{scorer} · v{version}: {eligible} slot idonei, {noReference} senza riferimento",
+      "costUnknown": "costo sconosciuto",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Impossibile caricare gli esperimenti",
       "previewError": "Impossibile visualizzare l'anteprima degli slot",
       "createSuccess": "Esperimento creato",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Questo esperimento è stimato costare circa {cost}, oltre la soglia di avviso di {threshold}. Crearlo ed eseguirlo comunque?",
         "costConfirmMessageUnpriced": "Si stima che questo esperimento costi più della soglia di avviso. Crearlo ed eseguirlo comunque?",
         "costConfirmOk": "Crea comunque",
+        "taskProviderFailed": "Non è stato creato nulla. Il provider del task {provider} non ha risposto alla chiamata di test.",
+        "judgeProviderFailed": "Non è stato creato nulla. Il provider del giudice {provider} non ha risposto alla chiamata di test.",
         "skippedFully": "{count} righe completamente saltate — ogni valutatore selezionato richiede un output atteso. Le righe saltate non costano nulla da eseguire.",
         "skippedPartially": "{count} righe parzialmente saltate — l'attività viene comunque eseguita, ma i valutatori basati su riferimento non possono valutare righe senza un output atteso.",
         "skippedNone": "Ogni riga corrispondente può essere valutata su almeno una dimensione.",
@@ -17408,7 +17851,26 @@
           "trials": "Prove",
           "dispersion": "Dispersione",
           "latency": "Latenza",
-          "p50Latency": "Latenza P50"
+          "p50Latency": "Latenza P50",
+          "error": "Errore"
+        },
+        "failureBanner": {
+          "title": "{failed} di {total} slot non riusciti: {cause}.",
+          "cause": "Causa principale, {count} slot: {message}",
+          "moreCauses": "+ altre {count} cause",
+          "noMessage": "nessun messaggio di errore registrato",
+          "openProviders": "Apri Provider"
+        },
+        "failureKinds": {
+          "provider_auth": "il provider ha rifiutato le credenziali",
+          "rate_limited": "il provider ha limitato la frequenza dell'esecuzione",
+          "timeout": "il provider non ha risposto in tempo",
+          "provider_5xx": "il provider ha restituito un errore del server",
+          "parse_error": "non è stato possibile analizzare l'output",
+          "mapping_error": "non è stato possibile costruire l'input dell'attività",
+          "scorer_missing": "un valutatore non esiste più",
+          "execution_error": "la chiamata dell'attività non è riuscita",
+          "unknown": "la chiamata dell'attività non è riuscita"
         },
         "saveAsPrompt": "Salva come prompt",
         "openPrompt": "Apri prompt",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Ambiente",
       "agent": "Agente",
-      "version": "Versione"
+      "version": "Versione",
+      "agentIdHint": "ID agente: {ids}",
+      "noAgentIdentity": "Nessuna identità agente trovata",
+      "noAgentIdentityDescription": "Questi span LLM non contengono il nome dell'agente, quindi sono mostrati per stream. Mappa l'attributo che identifica il tuo agente per visualizzarli per agente.",
+      "noAgentIdentityAction": "Apri la mappatura degli agenti GenAI"
     },
     "agentGraph": {
       "stream": "Stream",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Le valutazioni sono disattivate su questo server",
+      "description": "Questa pagina richiede le valutazioni online, che sono disattivate su questo server. Chiedi all'amministratore di attivarle."
+    },
     "traceScoreChip": {
       "reasoning": "Perché",
       "noReasoning": "Nessuna motivazione registrata per questo punteggio.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Configura endpoint"
     },
     "provider": {
-      "backTo": "Torna a Providers",
+      "backTo": "Provider",
       "createTitle": "Crea un provider LLM",
       "editTitle": "Modifica provider LLM",
       "subtitle": "Configura l'endpoint del modello utilizzato dai valutatori di tipo giudice LLM.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Valutatore {index}: il nome \"{name}\" viene usato più di una volta in questa importazione"
         }
       },
-      "backTo": "Torna ai valutatori",
+      "backTo": "Valutatori",
       "badgeRemote": "Remoto",
       "badgeLlm": "Giudice LLM",
       "createTitleRemote": "Nuovo valutatore remoto",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Seleziona il provider",
       "modelLabel": "Modello",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperatura",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "Da 0 a 2. Lascia vuoto per valutare a 0.",
       "promptLabel": "Prompt del giudice",
       "includeReasoningLabel": "Includi ragionamento",
       "includeReasoningHint": "Il giudice spiega perché ha assegnato quel punteggio, salvato con ogni risultato.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Il nome dell'intestazione è obbligatorio",
         "apiKeyTokenRequired": "Il token è obbligatorio",
         "timeoutInvalid": "Il timeout deve essere 0 o superiore",
+        "temperatureInvalid": "La temperatura deve essere compresa tra 0 e 2",
         "retriesInvalid": "I tentativi devono essere 0 o più",
         "duplicateFieldName": "I nomi dei campi devono essere univoci"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Degradato",
         "waitingForCredentials": "In attesa di credenziali",
         "noRecentRuns": "Nessuna esecuzione recente",
+        "lastScored": "Ultima valutazione {time}",
         "summary": "{errors} di {runs} esecuzioni non riuscite negli ultimi 15 minuti",
         "since": "Entrato in questo stato {time}",
         "checked": "Ultimo controllo {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Valuta il {percent}% delle destinazioni corrispondenti.",
       "samplingValueAllHelp": "Ogni destinazione corrispondente viene valutata.",
       "samplingHelp": "Viene eseguito dopo il filtraggio, per controllare i costi.",
-      "backTo": "Torna ai job di valutazione",
+      "backTo": "Job di valutazione",
       "createTitle": "Nuovo job di valutazione",
       "editTitle": "Aggiorna job di valutazione",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Questo ramo termina già in una destinazione.",
       "chooseATriggerNodeToStart": "Scegli un nodo trigger per avviare il tuo workflow",
       "thisConnectionWouldCreateALoop": "Questa connessione creerebbe un ciclo",
-      "onlyOneIncomingConnectionToA": "È consentita una sola connessione in ingresso a un passaggio"
+      "onlyOneIncomingConnectionToA": "È consentita una sola connessione in ingresso a un passaggio",
+      "endpointUrlCopied": "URL dell'endpoint copiato"
     },
     "views": {
       "youAreNotAuthorizedToManage": "Non sei autorizzato a gestire la licenza.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Cerca database o servizio…",
       "unnamedInstance": "Istanza senza nome",
+      "schemaCount": "{count} schema | {count} schemi",
       "unnamedInstanceHint": "I report delle istruzioni del database dimostrano che questo motore è in esecuzione, ma non indicano un host. La riga mostrerà un indirizzo quando sarà configurato un feed che lo trasporta — campionamento della sessione o metriche dell'istanza.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Conteggiato fino a {time}; l'ultimo mezzo minuto sta ancora arrivando.",
       "lineExact": "Tutti i database stanno riportando. Le velocità qui sono misurate su ogni chiamata, quindi sono esatte.",
       "lineExactEstimated": "Tutti i database stanno riportando. Le velocità qui sono una combinazione di più intervalli di tempo, quindi sono vicine ma non esatte.",
+      "lineExactSlowestSchema": "Tutti i database stanno riportando dati. Le velocità sono esatte per schema; un database con più schemi mostra quello più lento.",
       "lineSubsetUnnamed": "I tuoi filtri restringono questo al di sotto del livello a cui questi totali vengono sommati, quindi le percentuali descrivono le righe mostrate piuttosto che l'intero database.",
       "lineQuery": "I tempi sono misurati dalla tua applicazione, quindi includono il tempo di rete e l'attesa per una connessione libera.",
       "lineUncodedErrors": "{percent} dei fallimenti qui sono tornati senza un codice di motivo, quindi possono essere contati ma non spiegati.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "È la prima volta che questo avviso è scattato.",
     "escalationNotStarted": "Nessuna notifica ancora inviata",
     "escalationPagesNobody": "Non avvisa nessuno",
+    "escalationNobodyPaged": "Nessuno riceve notifiche",
     "escalationTo": "passa a {who} {when}",
     "escalationDetailCapped": "Il dettaglio dell'escalation in tempo reale viene caricato per le {count} notifiche aperte più vecchie.",
     "responder": "Operatore",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "A",
     "rotationRestrictionAdd": "Aggiungi una finestra",
     "rotationRestrictionRemove": "Rimuovi",
-    "rotationRestrictionZeroLength": "Da e A sono uguali, quindi questa finestra non corrisponde mai e il livello non viene mai attivato. Per un giorno intero, imposta A su 24:00.",
+    "rotationRestrictionZeroLength": "Da e A coincidono, quindi questa finestra non corrisponde mai. Salva resta disattivato finché Da e A non differiscono; per un'intera giornata, imposta A a 24:00.",
     "rotationRetiredTag": "Ritirata",
     "rotationSectionWhen": "Quando cambia il turno",
     "rotationName": "Nome della rotazione",
@@ -25593,6 +26072,10 @@
     "snoozed": "Posticipata",
     "snoozedUntil": "Silenziata fino alle {time} — ancora non assegnata",
     "snoozeFailed": "Impossibile posticipare la notifica",
+    "unsnooze": "Termina snooze",
+    "unsnoozeHint": "Termina subito lo snooze. Le notifiche riprendono dal passaggio in cui si erano fermate.",
+    "unsnoozed": "Snooze terminato · le notifiche continuano",
+    "unsnoozeFailed": "Impossibile terminare lo snooze",
     "note": "Nota",
     "notePlaceholder": "Cosa hai trovato? Cosa hai provato?",
     "addNote": "Aggiungi nota",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Le stesse persone, un turno indietro, così il secondario non è mai chi è già di turno. È una normale rotazione: nulla collega le due rotazioni, quindi se ne modifichi una ma non l'altra, divergono; ricevi un avviso, non una correzione silenziosa.",
     "rotationPreviewPairLegend": "Primario · Secondario",
     "rotationPreviewEmpty": "Scegli le persone e un primo passaggio di consegne per vedere chi è di turno e quando.",
+    "rotationPreviewNow": "Ora – {until}",
     "defaultRotationName": "Rotazione",
     "teamCreatedWithoutMembers": "Il team è stato creato, ma non è stato possibile aggiungere i membri. Aggiungili nella scheda Membri.",
     "teamCreatedWithoutRotation": "Il team e i suoi membri sono stati creati, ma non è stato possibile salvare la rotazione. Configurala nella scheda Pianificazione.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "nessuno le ha prese in carico — stanno ancora inviando notifiche",
     "sectionHint_ringingRouted": "nessuno ha preso in carico — {count} di questi sta ancora generando notifiche | nessuno ha preso in carico — {count} di questi stanno ancora generando notifiche",
     "sectionHint_ringingUnrouted": "{count} non ha un team, quindi non sta generando notifiche | {count} non hanno un team, quindi non stanno generando notifiche",
+    "sectionHint_ringingStopped": "{count} non riceve notifiche | {count} non ricevono notifiche",
     "sectionHint_snoozed": "notifiche in pausa — si riattivano da sole",
     "sectionHint_handled": "presi in carico — una persona è responsabile di ciascuno",
     "sectionHint_resolved": "chiusi — conservati agli atti",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "Il team che viene avvisato quando un segnale corrisponde. La sua scala di escalation decide chi viene contattato e in che ordine.",
     "scopeOwns": "Questo team possiede",
     "scopeAdvanced": "Avanzate",
-    "ruleEditorConflictUnclaimed": "Nessuna regola copre questo percorso oggi — una notifica che vi corrisponde raggiunge il team di ripiego, o nessuno.",
+    "ruleEditorConflictUnclaimed": "Oggi nessuna regola intercetta questo percorso, valutando solo queste condizioni — una notifica che vi corrisponde arriva alla regola catch-all, oppure a nessuno.",
     "ruleEditorConflictHeldBy": "Oggi una notifica che corrisponde a questo va a {team}, tramite {path}.",
     "ruleEditorConflictTakesOver": "La tua regola fissa più valori, quindi toglierebbe questi a {team}.",
     "ruleEditorConflictKeptBy": "Il percorso gestito da {team} fissa più valori, quindi loro mantengono questi e questa regola copre solo ciò che resta.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} avvisa questo team solo in {scope}. Altrove spetta a chi possiede l'ambito circostante.",
     "scopeNothingDiscovered": "Non è stato ancora rilevato nulla, quindi non c'è un insieme di risorse da cui scegliere. Usa Avanzate per scrivere la regola in termini di campi oppure invia prima alcuni dati di telemetria.",
     "scopeAdvancedHint": "Corrisponde a qualsiasi campo e valore, inclusi quelli non coperti dai livelli superiori.",
+    "scopeValuesSeen": "Queste liste mostrano i valori rilevati dal service discovery. Per corrispondere a qualsiasi altro valore, usa Avanzate.",
     "escalationHeld": "Prima il triage AI · notifica entro {n} s",
     "escalationPagingStep": "Notifica al passaggio {step} di {total} · {who}",
     "escalationPagingStepOnly": "Notifica al passaggio {step} di {total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Crea team e rotazione",
     "removeMemberHandsOver": "{name} prende il turno attuale di {leaving} in {rotation}.",
     "removeMemberLeavesGap": "Nessuno prende il turno attuale di {leaving} in {rotation}.",
+    "removeMemberReorders": "Escono anche da {rotations}, quindi può cambiare anche chi è di reperibilità lì.",
     "membersJoinEnd": "{names} si aggiunge in fondo a {rotations}. Chi è di turno ora non cambia. | {names} si aggiungono in fondo a {rotations}. Chi è di turno ora non cambia.",
     "membersAdded": "{names} aggiunto. | {names} aggiunti.",
     "removeMemberConfirm": "Rimuovi",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Domande: {contact}",
       "outboundQueue": "Messaggi di avviso: {count} in coda, il più vecchio {age} | Messaggi di avviso: {count} in coda, il più vecchio {age}",
       "outboundEmpty": "Nessun messaggio di avviso in coda",
+      "refusedPosts": "{count} invio di avviso non è riuscito nelle ultime 24 h. Ultimo: {reason} su {destination}, | {count} invii di avviso non sono riusciti nelle ultime 24 h. Ultimo: {reason} su {destination},",
       "ageSeconds": "{count} s"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "Non è stato possibile inviare i promemoria."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(nessun nome di modello)",
+    "topModels": "{models} (primi {shown} di {total})",
+    "cost": {
+      "partial": "parziale",
+      "unknown": "costo sconosciuto",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Costo parziale. Nessun prezzo per {models}: i {tokens} token in questa {scope} non sono conteggiati.",
+      "unknownTooltip": "Costo sconosciuto. Nessun prezzo per {models}: nessuno dei {tokens} token in questa {scope} ha un costo.",
+      "scopeSession": "sessione",
+      "scopeTrace": "traccia",
+      "unknownModel": "un modello senza nome",
+      "addPrice": "Aggiungi un prezzo"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} token senza prezzo",
+      "unpricedTooltip": "Il costo è un limite inferiore: {tokens} token su {models} non hanno un prezzo. Apri la scheda Senza prezzo in Prezzi dei modelli LLM.",
+      "pricedSinceTooltip": "Il costo è un limite inferiore: {tokens} token su {models} sono stati registrati prima dell'aggiunta di un prezzo e restano senza costo."
+    },
+    "chart": {
+      "costMissing": "Non in questo grafico: {models}. {tokens} token non hanno un prezzo.",
+      "costMissingPricedSince": "Non in questo grafico: {models}. {tokens} token sono stati registrati prima dell'aggiunta di un prezzo.",
+      "unpricedModels": "Senza prezzo: {models}",
+      "pricedSinceModels": "Registrati prima dell'aggiunta di un prezzo: {models}",
+      "addPrice": "Aggiungi un prezzo"
+    },
+    "health": {
+      "title": "Integrità dei dati",
+      "passing": "{n} superati",
+      "checkedAgo": "verificato {ago}",
+      "drawerTitle": "Integrità dei dati AI",
+      "drawerSubtitle": "{stream} · finestra corrente",
+      "rerun": "Riesegui i controlli",
+      "close": "Chiudi",
+      "loadError": "Impossibile eseguire i controlli di integrità dei dati.",
+      "samples": "Campioni:",
+      "copyLink": "Copia link per un amministratore",
+      "linkCopied": "Link copiato",
+      "status": {
+        "pass": "Superato",
+        "warning": "Avviso",
+        "error": "Errore"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Modelli senza prezzo",
+          "detail": "{count} modello · {spans} span · {tokens} token conteggiati come $0 | {count} modelli · {spans} span · {tokens} token conteggiati come $0",
+          "pass": "Ogni modello in questa finestra ha un prezzo. Gli span registrati prima dell'aggiunta di un prezzo mantengono il costo registrato.",
+          "fix": "Risolvi in Prezzi dei modelli LLM",
+          "truncated": "Primi {shown} di {total} per token"
+        },
+        "missing_agent_identity": {
+          "label": "Identità agente mancante",
+          "detail": "{affected} di {total} span LLM ({pct}) non hanno gen_ai.agent.name, quindi le viste degli agenti non li mostrano.",
+          "pass": "Ogni span LLM porta un nome o un id dell'agente.",
+          "fix": "Apri Mappatura agenti GenAI"
+        },
+        "zero_duration_spans": {
+          "label": "Span con durata zero",
+          "detail": "{affected} span LLM riportano 0 ms, quindi latenza e durata della sessione risultano troppo basse.",
+          "pass": "Nessuno span LLM riporta 0 ms.",
+          "fix": "Come risolvere"
+        },
+        "missing_session_id": {
+          "label": "Span senza ID sessione",
+          "detail": "{affected} di {total} span LLM ({pct}) non hanno gen_ai.conversation.id, quindi la sezione Sessioni non li mostra.",
+          "pass": "Ogni span LLM ha gen_ai.conversation.id.",
+          "fix": "Guida all'integrazione"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Gestione fleet",
     "subtitle": "Registra i collector OpenTelemetry, versiona le loro configurazioni e distribuisci le modifiche in sicurezza",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "In corso",
       "scheduled": "Pianificato",
+      "waiting": "In attesa",
       "completed": "Completato",
       "halted": "Interrotto",
       "superseded": "Sostituito",
@@ -28696,7 +29257,7 @@
       "version": "Versione",
       "pickConfig": "Scegli una configurazione",
       "pickFleet": "Scegli un fleet",
-      "emptyFleet": "Il fleet non ha collector, quindi la versione viene impostata subito",
+      "emptyFleet": "La flotta non ha collector, quindi il rollout attende finché uno non si unisce.",
       "startingShortly": "In avvio a breve",
       "eventGateFailed": "Soglia di salute non superata",
       "eventHalted": "Interrotto",
@@ -28707,7 +29268,10 @@
       "notFound": "Questo rollout non esiste più",
       "notFoundDescription": "Il link potrebbe non essere aggiornato. Scegli un rollout dall'elenco.",
       "noneTargeted": "Nessun collector di destinazione",
-      "outcomeNoneTargeted": "Il fleet non aveva collector quando è stata impostata v{to}.",
+      "outcomeNoneTargeted": "Nessun collector ha adottato v{to} in questo rollout.",
+      "outcomeWaiting": "Nessun collector è online, quindi v{to} non è ancora stato distribuito a nessuno. Il rollout inizia quando uno si connette.",
+      "waitingForCollector": "In attesa di un collector",
+      "notStarted": "Non avviato",
       "versionFailedBefore": "v{version} · già non riuscita",
       "pickVersion": "Scegli una versione",
       "autoRollback": "Ripristina automaticamente",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Ripreso",
       "eventSkipped": "Collector in errore saltati",
       "eventStarted": "Avviato",
+      "eventWaiting": "In attesa che un collector si connetta",
       "eventTimedOut": "Fase scaduta",
       "eventSkippedOffline": "Escluso {count} collector che era offline all'avvio; riceverà la versione alla riconnessione | Esclusi {count} collector che erano offline all'avvio; riceveranno la versione alla riconnessione",
       "excluded": "Escluso",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Una fase che non conferma né rifiuta entro {minutes} min interrompe il rollout (impostazione del fleet)",
       "phaseVerifying": "In verifica",
       "phases": "Fasi",
-      "planEmpty": "Nessun collector da aggiornare",
+      "planEmpty": "Nessun collector è online, quindi il rollout attende che uno si connetta",
+      "planStable": "Nessun collector è online; la versione stabile viene assegnata a ciascuno quando si connette",
       "planOne": "{count} collector in un solo batch | {count} collector in un solo batch",
       "planText": "{steps} → restanti {last}, {count} fasi",
       "planUnavailable": "L'anteprima del piano non è disponibile",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 conserva i collector offline per sempre"
     },
     "audit": {
-      "search": "Cerca nel registro di audit",
       "editedConfig": "Configurazione modificata",
       "revokedToken": "Token di registrazione revocato",
       "enrolledCollector": "Collector registrato",
@@ -28920,7 +29485,6 @@
       "setDesired": "Versione modificata",
       "autoRollback": "Ripristinato automaticamente",
       "rolloutHalted": "Rollout interrotto",
-      "assignedFleetConfig": "Configurazione del fleet assegnata",
       "createdFleet": "Fleet creato",
       "renamedFleet": "Fleet rinominato",
       "deletedFleet": "Fleet eliminato",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Rollout ripristinato",
       "movedByToken": "Spostato dal token di registrazione",
       "object": "Oggetto",
+      "search": "Cerca nel registro di audit",
       "allObjects": "Tutti gli oggetti",
       "kind": {
         "fleet": "Fleet",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "Distribuzione di v{to}",
       "rolloutHalted": "Rollout di v{to} interrotto",
+      "rolloutWaiting": "v{to} attende che un collector vada online",
       "autoRolledBack": "v{to} ripristinata automaticamente",
       "noReason": "Nessun motivo di errore segnalato",
       "openRollout": "Apri rollout",
diff --git a/web/src/locales/languages/ja-JP.json b/web/src/locales/languages/ja-JP.json
index cbc64d8a33..fc175e4c00 100644
--- a/web/src/locales/languages/ja-JP.json
+++ b/web/src/locales/languages/ja-JP.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "LLM アクティビティはまだありません",
       "description": "OpenTelemetry Gen-AIセマンティック規約でサービスを計装し、少なくとも1つのトレースを取り込んで、このダッシュボードに表示させます。",
-      "action": "オープンテレメトリー搭載機器",
-      "actionDesc": "トレースでgen_ai_*属性をキャプチャします"
+      "action": "すべての AI 統合",
+      "actionDesc": "すべてのフレームワークとプロバイダーのガイドを見る",
+      "suggested": "{name} のトレースを設定",
+      "suggestedDesc": "{name} のドキュメントから来たため、おすすめです",
+      "codingAgent": "コーディングエージェントで計装する",
+      "codingAgentDesc": "コーディングエージェントがトレースを追加し、最初のトレースを確認します",
+      "startFrom": "または、次から開始"
     },
     "noLLMSessions": {
       "title": "LLM セッションはまだありません",
@@ -4797,6 +4802,13 @@
       "success": "成功",
       "failed": "失敗",
       "testRun": "テスト実行",
+      "source": "ソース",
+      "sourceHttp": "HTTP リクエスト",
+      "sourceAlertFired": "アラート発火",
+      "sourceIncidentEvent": "インシデントイベント",
+      "sourceRetry": "リトライ実行",
+      "sourceManual": "手動実行",
+      "sourceOther": "その他",
       "runType": "タイプ",
       "testRunTooltip": "エディターから開始されました。宛先ステップは実際に配信されます。",
       "showTestRuns": "{count} 件のテスト実行を表示",
@@ -4810,7 +4822,33 @@
       "retryTitle": "この実行を再試行しますか？",
       "retryMessage": "失敗した実行が記録した入力から新しい実行が作成されます。宛先ステップは実際に配信されます。",
       "retryStarted": "再試行を開始しました — 新しい実行としてリストに表示されます。",
-      "retryError": "この実行を再試行できませんでした"
+      "retryError": "この実行を再試行できませんでした",
+      "statusQueued": "待機中",
+      "statusRunning": "実行中",
+      "statusExpired": "期限切れ",
+      "reasonExpired": "未実行 · 1 時間以上キューで待機",
+      "reasonWorkerLost": "ワーカー消失 · 再実行なし",
+      "reasonWorkflowDisabled": "ワークフローが無効化されていました",
+      "reasonRunTimeout": "15 分後にタイムアウト",
+      "allTriggers": "すべてのトリガー",
+      "triggerFilter": "トリガー",
+      "run": "実行",
+      "searchRuns": "実行 ID、冪等キー、またはアラートを検索",
+      "sourceDetails": "ソースの詳細",
+      "detailsWithKey": "{ip} · キー {key}",
+      "detailsNoKey": "{ip} · 冪等キーなし",
+      "retryOf": "{run} のリトライ",
+      "openRun": "実行を開く",
+      "alertFiredEmptyTitle": "この時間範囲にアラート発火による実行はありません",
+      "incidentEventEmptyTitle": "この時間範囲にインシデントイベントによる実行はありません",
+      "filterEmptyTitle": "この時間範囲に一致する実行はありません",
+      "filterEmptyDimmed": "他の実行はタイムライン上に残り、淡色表示されています。",
+      "searchEmptyTitle": "この検索に一致する実行はありません",
+      "searchEmptyAction": "検索をクリア",
+      "timelineNow": "現在",
+      "timelineAgoMinutes": "−{n}分",
+      "timelineAgoHours": "−{n}時間",
+      "timelineAgoDays": "−{n}日"
     },
     "edit": "編集",
     "view": "表示",
@@ -4958,7 +4996,9 @@
           "noMatch": "一致なし"
         },
         "suppressed": "抑制済み — 実際の宛先には送信されません"
-      }
+      },
+      "payloadFrom": "ペイロードの取得元",
+      "payloadFromHint": "HTTP の形式は、エンドポイントの呼び出し元が送信する内容です。"
     },
     "linkAlerts": {
       "title": "アラートにワークフローをリンク",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "出力形式",
       "tlsVerifyLabel": "TLS 検証",
       "tlsDisabled": "無効"
+    },
+    "http": {
+      "runTestHint": "サンプルの HTTP ペイロードでステップを実行します。URL は呼び出しません",
+      "runTestHintList": "テストを実行するにはワークフローを開いてください",
+      "runsEmptyTitle": "この時間範囲に HTTP リクエストはありません",
+      "runsEmptyBody": "時間範囲を広げるか、HTTP エンドポイントパネルからテストリクエストを送信してください。",
+      "runsEmptyAction": "すべてのトリガーを表示",
+      "runFailedAt": "この実行は {step} で失敗しました: {error}",
+      "openStep": "ステップを開く",
+      "runGuardHint": "HTTP 実行にはリクエストが含まれ、アラートのフィールドは含まれません。このステップが {fields} を読み取る場合は、条件でガードしてください: {guard}。",
+      "runExpiredBanner": "このリクエストはキューで 1 時間以上待機し、実行されることはありませんでした。どのステップも実行されず、宛先も呼び出されていません。",
+      "runWorkerLostBanner": "このリクエストを実行していたワーカーが停止しました。宛先がすでに呼び出されている可能性があるため、自動的には再実行されません。呼び出し元が再送する前に、宛先を確認してください。",
+      "request": "リクエスト",
+      "requestReceived": "受信日時",
+      "requestToken": "トークン",
+      "requestCallerIp": "呼び出し元 IP",
+      "requestIdempotencyKey": "冪等性キー",
+      "requestContentType": "コンテンツタイプ",
+      "requestBodySize": "ボディサイズ",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "ヘッダー",
+      "headersKept": "{count} 件を保持 · Authorization、Cookie、署名は保存されません | {count} 件を保持 · Authorization、Cookie、署名は保存されません",
+      "headerName": "名前",
+      "headerValue": "値",
+      "outputCaption": "後続の各ステップが受け取った内容",
+      "useAsTestInput": "テスト入力として使用",
+      "editorButton": "HTTP エンドポイント",
+      "editorButtonOn": "オン",
+      "editorButtonOff": "オフ",
+      "editorButtonTooltip": "他のシステムが HTTP リクエストでこのワークフローを開始できるようにします",
+      "editorButtonRefusedDraft": "ワークフローが公開されるまで、リクエストには 403 が返されます",
+      "editorButtonRefusedPaused": "ワークフローが一時停止している間、リクエストには 403 が返されます",
+      "panelTitle": "HTTP エンドポイント",
+      "panelSubtitle": "{name} · {kind} ワークフロー",
+      "acceptRequests": "HTTP リクエストを受け付ける",
+      "kindNote": "このワークフローのステップは {kind} 実行向けに作成されています。HTTP 実行では代わりにリクエスト（{field}）を受け取るため、ステップで {kind} のフィールドが必要な場合は Condition を追加してください。",
+      "kindNotePayload": "HTTP ペイロードを表示",
+      "kindNotePayloadHide": "HTTP ペイロードを非表示",
+      "unsavedBody": "このワークフローはまだ保存されていません。下書きとして保存して URL とトークンを作成してください。公開するまでリクエストは拒否されます。",
+      "saveAndCreate": "下書きを保存してエンドポイントを作成",
+      "needsAdmin": "エンドポイントの作成には組織管理者が必要です。",
+      "needsEdit": "変更するにはこのワークフローへの編集アクセスが必要です。",
+      "readOnlyOnMeta": "オン · URL はコピーできます。変更するにはこのワークフローへの編集アクセスが必要です。",
+      "offBody": "他のシステムが HTTP リクエストでこのワークフローを開始できるようにします。URL とトークンを取得できます。",
+      "offExistingBody": "オフ · オンにするまでリクエストは拒否されます（403）。",
+      "onMeta": "オン · 実行はワークフローが有効かつ公開されている間のみ開始されます",
+      "loadError": "エンドポイント設定を読み込めませんでした。",
+      "draftBanner": "このワークフローは下書きです。公開するまで URL への呼び出しには 403 が返されます。今すぐエンドポイントを設定できます。また、「テスト実行」ではサンプルの HTTP ペイロードを使用して下書きのステップを実行します。",
+      "disabledBanner": "ワークフローを有効にするまで、リクエストは拒否されます（403）。",
+      "turnOnFailed": "エンドポイントをオンにできませんでした。{reason}",
+      "changeFailed": "エンドポイントを保存できませんでした。{reason}",
+      "endpointExistsHint": "エンドポイントはすでに存在します。トークンは「トークン」テーブルから表示またはコピーしてください。",
+      "endpointExistsHintSigned": "エンドポイントはすでに存在します。署名シークレットは「署名シークレット」テーブルから表示またはコピーしてください。",
+      "disableTitle": "エンドポイントをオフにしますか？",
+      "disableBody": "再度オンにするまで、呼び出し元には 403（エンドポイントはオフ）が返されます。URL とトークンは変わりません。",
+      "disableConfirm": "オフにする",
+      "lastCall": "オン · 最終呼び出し: {status} · {time} · {link}",
+      "lastCallNone": "オン · 呼び出しはまだありません — テストリクエストを送信してください",
+      "lastCallNoneRefused": "オン · 呼び出しはまだありません",
+      "viewRun": "実行を表示",
+      "lastCallStatus": {
+        "queued": "待機中",
+        "running": "実行中",
+        "succeeded": "成功",
+        "failed": "失敗",
+        "expired": "期限切れ"
+      },
+      "endpointUrl": "エンドポイント URL",
+      "tokenLabel": "トークン",
+      "secretLabel": "署名シークレット",
+      "newTokenLabel": "新しいトークン",
+      "newSecretLabel": "新しい署名シークレット",
+      "tokenHint": "画面上ではマスクされます。コピーすると実際のトークンがコピーされます。{header} として送信し、URL には含めないでください。",
+      "secretHint": "画面上ではマスクされます。コピーすると実際のシークレットがコピーされます。各リクエストをこのシークレットで署名し、{headers} ヘッダーを送信してください。シークレット自体は送信しないでください。",
+      "revealBannerTitle": "エンドポイントを作成しました",
+      "revealBannerBody": "すべてのリクエストでこのトークンを送信してください。トークン一覧から再表示またはコピーできます。",
+      "revealBannerBodySigned": "すべてのリクエストをこのシークレットで署名してください。署名シークレット一覧から再表示またはコピーできます。",
+      "switchedBannerTitle": "トークンを作成しました",
+      "switchedBannerTitleSigned": "署名シークレットを作成しました",
+      "rotateBannerTitle": "新しいトークンを作成しました",
+      "rotateBannerTitleSigned": "新しい署名シークレットを作成しました",
+      "rotateBannerBody": "呼び出し元は同じ URL とヘッダーのままで、変わるのはトークンだけです。古いトークンは期限切れまで有効で、それまでは表示できます。",
+      "rotateBannerBodySigned": "呼び出し元は同じ URL とヘッダーのままで、変わるのはシークレットだけです。古いシークレットは期限切れまで有効で、それまでは表示できます。",
+      "rotateBannerBodyRevoked": "呼び出し元は同じ URL とヘッダーのままで、変わるのはトークンだけです。古いトークンは失効したため、現在は動作しません。",
+      "rotateBannerBodyRevokedSigned": "呼び出し元は同じ URL とヘッダーのままで、変わるのはシークレットだけです。古いシークレットは失効したため、現在は動作しません。",
+      "rotateBannerBodyFresh": "呼び出し元は同じ URL とヘッダーのままで、今後はこのトークンを送信します。",
+      "rotateBannerBodyFreshSigned": "呼び出し元は同じ URL とヘッダーのままで、今後はこのシークレットで署名します。",
+      "snippetsLabel": "リクエスト例",
+      "sendTest": "テストリクエストを送信",
+      "sendTestHint": "認証情報を確認し、ステップが受け取る内容を表示します。実行は開始されず、宛先も呼び出されません。",
+      "sendTestHintPaused": "認証情報を確認します。ワークフローは一時停止中のため、入力が構築される前に呼び出しは拒否されます。「テスト実行」ではステップが実行されます。",
+      "sendTestSigned": "ブラウザーはリクエストに署名できないため、上記のリクエスト例でテストしてください。URL に ?dry_run=true を追加すると、実行を開始せずに署名を確認できます。",
+      "dryRunAccepted": "ドライランを受け付けました",
+      "dryRunMeta": "認証情報は有効 · ボディ {size}",
+      "dryRunInput": "ステップが受け取る入力",
+      "dryRunRefused": "認証情報は有効です。ワークフローが公開されるまで、リクエストは拒否されます。",
+      "dryRunRefusedPaused": "認証情報は有効です。ワークフローが一時停止中は、リクエストは拒否されます。",
+      "dryRunRateLimited": "レート制限中 — ドライランも制限にカウントされます。",
+      "dryRunStatus": "リクエストはステータス {status} で拒否されました。",
+      "dryRunFailed": "テストリクエストを送信できませんでした。{reason}",
+      "runTestInstead": "代わりにテストを実行",
+      "done": "完了",
+      "regionTag": "リージョン {name}",
+      "regionBanner": "すべてのリクエストと再試行をこのリージョンのホストに送信してください。冪等性キーと実行ステータス（{field}）は呼び出しを受け付けたリージョンに保持されるため、別のリージョンに送信した再試行は2回目の実行を開始する可能性があります。",
+      "authLabel": "呼び出し元の認証方式",
+      "authToken": "トークン",
+      "authSigned": "署名付きリクエスト",
+      "authAbout": "認証について",
+      "authInfo": "トークン: Authorization ヘッダーでトークンを送信します。署名付きリクエスト: 共有シークレットで各リクエストに署名します（{headers} ヘッダー）。",
+      "switchToSignedTitle": "署名付きリクエストに切り替えますか？",
+      "switchToSignedBody": "切り替えると現在のトークンは直ちに失効し、署名シークレットが作成されます。トークンを使用している呼び出し元は 401 を受け取るようになります。",
+      "switchToTokenTitle": "トークンに切り替えますか？",
+      "switchToTokenBody": "切り替えると、現在の署名シークレットは即座に失効し、トークンが作成されます。リクエストに署名している呼び出し元は 401 を受け取るようになります。",
+      "tokensTitle": "トークン",
+      "secretsTitle": "署名シークレット",
+      "colToken": "トークン",
+      "colSecret": "シークレット",
+      "colCreated": "作成日時",
+      "colLastUsed": "最終使用",
+      "colStatus": "ステータス",
+      "colActions": "アクション",
+      "never": "未使用",
+      "active": "アクティブ",
+      "retiring": "廃止予定",
+      "creatorGone": "作成者はこの組織にはもういません",
+      "revoke": "失効",
+      "revokeNow": "今すぐ失効",
+      "revokeTitle": "{prefix} を失効しますか？使用中の呼び出し元は即座に 401 を受け取ります。",
+      "revokeFailed": "失効できませんでした。{reason}",
+      "copyToken": "トークンをコピー",
+      "copySecret": "シークレットをコピー",
+      "tokenCopied": "トークンをコピーしました",
+      "commandCopied": "コマンドをコピーしました",
+      "secretCopied": "シークレットをコピーしました",
+      "revealFailed": "トークンを表示できませんでした。{reason}",
+      "revealFailedSigned": "シークレットを表示できませんでした。{reason}",
+      "revealDenied": "このエンドポイントのトークンを表示またはコピーできるのは管理者のみです。",
+      "runTest": "テストを実行",
+      "rotate": "ローテーション",
+      "rotateBlocked": "先に廃止予定のトークンを失効してください",
+      "rotateBlockedSigned": "先に廃止予定のシークレットを失効してください",
+      "rotateTitle": "トークンをローテーション",
+      "rotateTitleSigned": "署名シークレットをローテーション",
+      "rotateLead": "新しいトークンが作成されます。{prefix}（最終使用 {time}）を引き続き有効にする期間：",
+      "rotateLeadSigned": "新しい署名シークレットが作成されます。{prefix}（最終使用 {time}）を引き続き有効にする期間：",
+      "overlapNow": "すぐに失効する",
+      "overlapHour": "1時間",
+      "overlapDay": "24時間",
+      "overlapWeek": "7日間",
+      "rotateConsequence": "現在のトークンを使用している呼び出し元は {time} まで引き続き動作します。それまでに更新してください。",
+      "rotateConsequenceSigned": "現在のシークレットで署名している呼び出し元は {time} まで引き続き動作します。それまでに更新してください。",
+      "rotateConsequenceNow": "現在のトークンを使用している呼び出し元は、今後 401 を受け取ります。",
+      "rotateConsequenceNowSigned": "現在のシークレットで署名している呼び出し元は、今後 401 を受け取ります。",
+      "rotateConfirm": "トークンをローテーション",
+      "rotateConfirmSigned": "署名シークレットをローテーション",
+      "rotateFailed": "ローテーションできませんでした。{reason}",
+      "advanced": "詳細設定",
+      "advancedSummary": "最大ボディ {size} · 毎分 {count} リクエスト | 最大ボディ {size} · 毎分 {count} リクエスト",
+      "maxBody": "最大ボディサイズ（KiB）",
+      "maxBodyHint": "最大 1024（1 MiB）。引き下げのみ可能です",
+      "maxBodyRange": "1〜1024 の整数を入力してください",
+      "rateLimit": "1分あたりのリクエスト数",
+      "rateLimitHint": "この組織では1分あたり最大 {org}",
+      "rateLimitRange": "1 から {org} までの整数を入力してください",
+      "saveLimitsFailed": "制限を保存できませんでした。{reason}",
+      "deleteMeta": "URL とすべてのトークンおよびシークレットを削除します。",
+      "deleteButton": "エンドポイントを削除",
+      "deleteTitle": "このエンドポイントを削除しますか？",
+      "deleteBody": "URL は直ちに無効になり、呼び出し元には 401 が返ります。すべてのトークンと署名シークレットは削除され、復元できません。実行履歴は保持されます。",
+      "deleteFailed": "エンドポイントを削除できませんでした。{reason}",
+      "secretStorageWarning": "このサーバーには暗号化マスターキーがないため、トークンと署名シークレットはデータベースにアクセスできる誰でも読める形式で保存されます。管理者に設定を依頼してください。",
+      "rejectionsLine": "過去24時間で約 {count} 件のリクエストが拒否されました · 最新: {reason}、{time} | 過去24時間で約 {count} 件のリクエストが拒否されました · 最新: {reason}、{time}",
+      "rejectionsShow": "表示",
+      "rejectionsHide": "非表示",
+      "rejectionsTitle": "最近の拒否",
+      "rejectionsCaption": "過去24時間で約 {count} 件 · 呼び出し元にはステータスコードのみ表示 | 過去24時間で約 {count} 件 · 呼び出し元にはステータスコードのみ表示",
+      "rejectionMeta": "約 {count} 件 · 最新 {time} · {ip} から | 約 {count} 件 · 最新 {time} · {ip} から",
+      "rejectionsLoadError": "拒否を読み込めませんでした。",
+      "raiseLimit": "制限を引き上げる",
+      "rotateLink": "ローテーション",
+      "reason": {
+        "invalid_token": {
+          "title": "無効なトークン",
+          "fix": "呼び出し元が、失効・期限切れ、または誤入力のトークンを送信しています。トークン表から現在のトークンを表示またはコピーしてください。"
+        },
+        "invalid_signature": {
+          "title": "無効な署名",
+          "fix": "呼び出し元が古い、または誤ったシークレットで署名しています。現在のシークレットを使用し、送信内容どおりに {format} へ署名しているか確認してください。"
+        },
+        "stale_timestamp": {
+          "title": "タイムスタンプが古すぎます",
+          "fix": "呼び出し元の時計が5分以上ずれています。時計を同期し、送信直前に署名してください。"
+        },
+        "endpoint_disabled": {
+          "title": "エンドポイントが無効",
+          "fix": "エンドポイントを有効にしてください。"
+        },
+        "workflow_disabled": {
+          "title": "ワークフローが一時停止中",
+          "fix": "一覧からワークフローを再開してください。"
+        },
+        "workflow_not_published": {
+          "title": "ワークフローが未公開",
+          "fix": "ワークフローを公開してください。下書きはリクエストを拒否します。"
+        },
+        "payload_too_large": {
+          "title": "ペイロードが大きすぎます",
+          "fix": "{size} を超えています。送信量を減らすか、イベントを複数のリクエストに分割してください。"
+        },
+        "credential_in_url": {
+          "title": "URL 内の認証情報",
+          "fix": "トークンまたはシークレットが URL で送信されたため拒否されました。URL はプロキシやブラウザのログに残るため、直ちにローテーションし、以降はヘッダーで送信してください。"
+        },
+        "invalid_idempotency_key": {
+          "title": "無効な冪等キー",
+          "fix": "Idempotency-Key ヘッダーが空か、255 文字を超えています。"
+        },
+        "idempotency_key_reused": {
+          "title": "冪等キーが再利用されました",
+          "fix": "同じキーが異なる本文で送信されました。異なるイベントごとに新しいキーを使用してください。"
+        },
+        "rate_limited": {
+          "title": "レート制限中",
+          "fix": "1分あたり {count} 件を超えるリクエストです。イベントを1つのリクエストにまとめる（JSON 配列を送信）か、制限を引き上げてください — この組織では1分あたり最大 {org} まで。"
+        },
+        "queue_full": {
+          "title": "キューが満杯",
+          "fix": "この組織では既に {count} 件の HTTP 実行が待機中でした。呼び出し元は Retry-After の遅延後に再試行してください。遅いステップを探すか、送信レートを下げてください。"
+        },
+        "worker_unavailable": {
+          "title": "ワーカーが利用不可",
+          "fix": "このリージョンで稼働中のワークフローワーカーがなかったため、キューには何も入りませんでした。Retry-After の遅延後に再試行した呼び出しは、ワーカーが復帰すると通過します。これが続く場合は、管理者にワークフローワーカーの確認を依頼してください。"
+        }
+      },
+      "nodeBadge": "HTTP 経由で呼び出し可能",
+      "triggerLinkOn": "HTTP リクエストでも実行",
+      "triggerLinkOnAction": "エンドポイントを管理",
+      "triggerLinkOff": "他のシステムからも開始可能",
+      "triggerLinkOffAction": "HTTP エンドポイントを設定",
+      "pickerCue": "どのワークフローも HTTP リクエストで開始できます。トリガーを選択し、ツールバーの HTTP エンドポイントを使用します。",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP エンドポイント: オン",
+      "listMenuItem": "HTTP エンドポイント…",
+      "copyUrl": "エンドポイント URL をコピー",
+      "copyUrlDraftHint": "公開するまでリクエストは拒否されます",
+      "copyUrlFailed": "エンドポイント URL をコピーできませんでした。{reason}",
+      "payloadFrom": "ペイロードの取得元",
+      "payloadHttp": "HTTP リクエスト",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "{count} 時間後に期限切れ | {count} 時間後に期限切れ",
+      "expiresInDays": "{count} 日後に期限切れ | {count} 日後に期限切れ",
+      "expired": "期限切れ",
+      "rotateLeadUnused": "新しいトークンが作成されます。{prefix}(未使用)を引き続き有効にする期間:",
+      "rotateLeadUnusedSigned": "新しい署名シークレットが作成されます。{prefix}(未使用)を引き続き有効にする期間:",
+      "fieldGroup": "HTTP リクエスト",
+      "fieldGroupBodyHint": "リクエスト本文内のフィールドには、先に関数ステップが必要です",
+      "fieldGroupQueryHint": "クエリパラメータは meta.query.<key> です。同じキーが繰り返されるとリストとして届き、マッチしません",
+      "rotateLeadNone": "有効なトークンがないため、呼び出し元は認証できません。新しいトークンが作成されます。",
+      "rotateLeadNoneSigned": "有効な署名シークレットがないため、呼び出し元は認証できません。新しい署名シークレットが作成されます。",
+      "createForbidden": "この組織ではエンドポイントの認証情報を作成できません。",
+      "errorNotConfigured": "このワークフローには HTTP エンドポイントがありません。",
+      "errorNoLiveCredential": "有効な認証情報がありません。ローテーションして作成してください。",
+      "errorNotAllowed": "この操作を行う権限がありません。",
+      "copyCredentialChanged": "認証情報が変更されました。もう一度コピーしてください。",
+      "copyCommandFailed": "コマンドをコピーできませんでした。{reason}",
+      "exampleRequest": "リクエスト例",
+      "exampleActiveToken": "有効なトークン · {prefix}",
+      "exampleActiveSecret": "有効なシークレット · {prefix}",
+      "exampleHintToken": "コピーにはトークンが含まれます。ターミナルに貼り付けるか、Postman や Insomnia にインポートします(インポート → Raw text)。",
+      "exampleHintSigned": "bash で実行します:openssl で署名し、curl を呼び出します。コピーにはシークレットが含まれます。インポートツールでは署名できません。",
+      "exampleHintTokenPlaceholder": "コピーのトークン部分はプレースホルダーです。ターミナルに貼り付けるか、Postman や Insomnia にインポートします(インポート → Raw text)。",
+      "exampleHintSignedPlaceholder": "bash で実行します:openssl で署名し、curl を呼び出します。コピーのシークレット部分はプレースホルダーです。インポートツールでは署名できません。"
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "クリック",
       "viewDocsLinkLabel": "こちら",
       "viewDocsSuffix": "詳細なドキュメントを確認する。",
-      "selectIntegrationPrompt": "詳細を表示するには統合を選択してください。"
+      "selectIntegrationPrompt": "詳細を表示するには統合を選択してください。",
+      "codingAgent": {
+        "tabAgent": "コーディングエージェントを使用",
+        "tabSteps": "ステップごとに",
+        "streamLabel": "トレースストリーム名",
+        "streamHelp": "エージェントはこのストリームにトレースを書き込み、確認します。",
+        "envTitle": ".env をダウンロード",
+        "envHelp": "プロジェクトのルートに保存します。スキルはこのファイルからトークンを読み取るため、チャットには含まれません。",
+        "envButton": ".env をダウンロード",
+        "promptTitle": "{client1}、{client2}、{client3} に貼り付けてください",
+        "promptLabel": "プロンプト",
+        "promptCopied": "プロンプトをコピーしました"
+      }
     },
     "header": "データソース",
     "resetRUMTokenLabel": "RUM トークンをリセット",
@@ -7670,6 +7995,15 @@
     "queryValues": "クエリ値",
     "constant": "コンスタント",
     "textbox": "テキストボックス",
+    "date": "日付",
+    "dateFormat": "出力日付フォーマット",
+    "dateFormatHelp": "クエリのデフォルト出力。使用時に ${'{'}name:format{'}'} で上書きできます(例: ${'{'}name:epochus{'}'})。",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "エポック秒 (epoch)",
+    "dateFormatEpochms": "エポックミリ秒 (epochms)",
+    "dateFormatEpochus": "エポックマイクロ秒 (epochus)",
     "newFolder": "新規フォルダー",
     "updateFolder": "フォルダを更新",
     "newReport": "新しいレポート",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "注釈を追加",
       "dependentAdhocVariableWarning": "一部の動的変数が適用されていません。フィールドがクエリのストリームに存在しないためです。このパネルをレンダリングするために実行された変数とクエリの詳細は、クエリインスペクタを開いて確認してください。",
       "refreshCacheReload": "キャッシュを更新して再読み込み",
+      "exploreCreateAlert": "アラートを作成",
+      "exploreAddToDashboard": "ダッシュボードに追加",
       "redirectingToLogs": "ログページにリダイレクト中",
       "pleaseWait": "お待ちください..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "定数",
       "textbox": "テキストボックス",
       "custom": "カスタム",
+      "date": "日付",
       "list": "{type} · {example}",
       "csv": "カンマ区切り: {example}",
       "pipe": "パイプ区切り: {example}",
       "doublequote": "二重引用符: {example}",
-      "singlequote": "単一引用符: {example}"
+      "singlequote": "単一引用符: {example}",
+      "dateIso": "日付 (YYYY-MM-DD): {example}",
+      "dateDmy": "日優先 (DD/MM/YYYY): {example}",
+      "dateMdy": "月優先 (MM/DD/YYYY): {example}",
+      "dateEpoch": "エポック秒: {example}",
+      "dateEpochms": "エポックミリ秒: {example}",
+      "dateEpochus": "エポックマイクロ秒: {example}"
     },
     "add": "パネルを追加",
     "save": "保存",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "確認済み",
         "badgeResolved": "解決済み",
         "badgeReopened": "再オープン",
+        "badgeAckEnded": "確認応答終了",
         "badgeDimensionsUpgraded": "ディメンションアップグレード",
         "badgeTitleChanged": "タイトル変更",
         "badgeAssignment": "割り当て",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "AI が入力を要求",
         "incidentWas": "インシデントが",
         "theIncident": "そのインシデント",
+        "ackEndedByPageResolve": "いずれかの呼び出しを解決したため",
         "unnamedAlert": "アラート",
         "alertTriggered": "{alert}がトリガーされました | {alert}が{count}回トリガーされました",
         "severityUpgraded": "重大度が{from}から{to}にアップグレードされました",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "アラートを受け取る",
           "toast": "プロダクトアナリティクスからインポートしました: 「{sourceLabel}」"
+        },
+        "traces": {
+          "label": "アラートを作成",
+          "toast": "トレース検索からクエリをインポートしました",
+          "noStream": "先にストリームを選択してください",
+          "errorCount": "エラー数",
+          "errorRate": "エラー率"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "ログページで先に「Run as」を選択する必要があるため、検索フィルターは引き継がれませんでした。必要な場合はアラートクエリに追加してください。",
         "thresholdColumnGuessed": "しきい値は {column} に適用されました。意図した値であることを確認してください。",
         "thresholdNotCarried": "別のクエリを選択したため、チャートのしきい値 {value} は適用されませんでした。",
-        "rumFunnelExclusions": "現時点のこのアプリのアプリフィルターを使用します。変更後は再作成してください。"
+        "rumFunnelExclusions": "現時点のこのアプリのアプリフィルターを使用します。変更後は再作成してください。",
+        "tracesSeedMatches": "{minutes}分間の一致スパン数が{threshold}を超えると発火します (現在 {current})。",
+        "tracesSeedSpans": "{minutes}分間のスパン数が{threshold}を超えると発火します (現在 {current})。",
+        "tracesSeedTraces": "{minutes}分間のトレース数が{threshold}を超えると発火します (現在 {current})。",
+        "tracesSeedErrorSpans": "{minutes}分間のエラースパン数が{threshold}を超えると発火します (現在 {current})。",
+        "tracesSeedErrorTraces": "{minutes}分間のエラーを含むトレース数が{threshold}を超えると発火します (現在 {current})。",
+        "tracesSeedErrorRatio": "{minutes}分間のエラー率が{threshold}%を超えると発火します (現在 {current}%)。",
+        "tracesErrorRatioMinSpans": "スパンが{minimum}以上あるウィンドウのみをチェックするため、静かな時間帯の少数の失敗では発火しません。",
+        "tracesErrorRatioMinTraces": "トレースが{minimum}以上あるウィンドウのみをチェックするため、静かな時間帯の少数の失敗では発火しません。",
+        "tracesSeedDuration": "{minutes}分間の{percentile}の所要時間が{threshold} msを超えると発火します (現在 {current} ms)。",
+        "tracesSeedUnavailable": "現在の値を読み取れなかったため、しきい値は0から始まります。保存する前に設定してください。",
+        "tracesNoMatches": "一致するスパンがまだないため、1つでも出現するとすぐにアラートが発火します。",
+        "tracesStoredSpans": "カウントは保存されたスパンに基づくため、サンプリングされたトラフィックは実際より低く表示されます。",
+        "tracesPeriodCapped": "各チェックを高速に保つため、アラートのウィンドウは{minutes}分に制限されました。",
+        "tracesNotRun": "この検索はまだ実行されていないため、アラートはエディター内のフィルターを使用します。"
       }
     },
     "saveFailed": "アラートを保存できませんでした。",
@@ -13906,6 +14272,8 @@
       "noMatch": "現在のフィルターに一致するメトリクスはありません",
       "noMatchHint": "ラベルフィルターを削除するか、プレフィックス/サフィックスの選択をクリアするか、「データあり」から「すべて」に切り替えてみてください。",
       "noMatchHintFavorites": "ラベルフィルターを削除するか、「データあり」から「すべて」に切り替えてみてください。",
+      "noMatchYet": "データのあるメトリクスはまだ見つかりません",
+      "noMatchYetHint": "これまでにチェックしたメトリクスはデータを返しませんでした。さらに表示して探し続けてください。",
       "clearAllFilters": "すべてのフィルターをクリア",
       "emptyActions": {
         "clearSearch": "検索をクリア",
@@ -14122,7 +14490,8 @@
       "panelAdded": "パネルがダッシュボードに追加されました",
       "errorAddingPanel": "パネル追加中にエラーが発生しました",
       "selectDashboard": "ダッシュボードを選択してください",
-      "selectTab": "タブを選択してください"
+      "selectTab": "タブを選択してください",
+      "panelsToAdd": "追加するパネル"
     },
     "groups": {
       "compute": "コンピュート",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "その他"
   },
   "traces": {
+    "nlNeedsSql": "この質問にはSQLが必要です。ログで開いてください",
+    "redActions": {
+      "menuGroupDashboards": "ダッシュボード",
+      "addRedToDashboard": "RED チャートをダッシュボードに追加",
+      "durationActions": "所要時間のアクション",
+      "bucketNotice": {
+        "seconds": "これらのチャートは現在表示されている{count}秒のバーを維持します。",
+        "minutes": "これらのチャートは現在表示されている{count}分のバーを維持します。",
+        "hours": "これらのチャートは現在表示されている{count}時間のバーを維持します。",
+        "days": "これらのチャートは現在表示されている{count}日のバーを維持します。"
+      },
+      "bucketNoticeSingle": {
+        "seconds": "このチャートは現在表示されている{count}秒のバーを維持します。",
+        "minutes": "このチャートは現在表示されている{count}分のバーを維持します。",
+        "hours": "このチャートは現在表示されている{count}時間のバーを維持します。",
+        "days": "このチャートは現在表示されている{count}日のバーを維持します。"
+      }
+    },
     "latencyHeatmap": {
       "title": "所要時間",
       "tooltipSpans": "{count} スパン | {count} スパン",
@@ -15396,6 +15783,13 @@
     "nextMatch": "次の試合",
     "searchInSpans": "スパン内を検索",
     "criticalPath": "クリティカルパス",
+    "askAi": {
+      "explainTrace": "トレースを説明",
+      "explainTraceHint": "クリティカルパス上の最も遅いスパンとすべてのエラースパンについてAIに質問します",
+      "askAboutSpan": "このスパンについてAIに質問",
+      "spanChip": "スパン · {operation}",
+      "traceChip": "トレース · {operation}"
+    },
     "spansTableView": "スパンのテーブル表示",
     "comingSoon": "近日公開予定...",
     "fetchingTrace": "トレースを取得しています。",
@@ -15498,7 +15892,7 @@
         "filterErrors": "エラーで絞り込む",
         "resetFilters": "フィルターをリセット",
         "errorsNone": "エラーなし·{total} ターン",
-        "latencyLead": "最も遅い {slowest} ·",
+        "latencyLead": "平均ターン {avg} · 最遅 {slowest} ·",
         "costLead": "ピーク {peak} ·",
         "tokens": "{ratio}% キャッシュ済み",
         "cacheImpact": "{ratio}% 再利用済み·{tokens} 既読済み",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "データなし",
       "noErrorsInRange": "この時間範囲にエラーはありません",
+      "loadFailed": "最近のエラーを読み込めませんでした",
       "time": "時間",
       "service": "サービス",
       "operation": "操作",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "常にアクティブ（デフォルト）",
     "testAtTimeLabel": "UTC時刻でテスト",
     "testAtTimeHint": "空のままにすると現在の時刻が使用されます。ピーク/オフピークのティアはこの時刻に基づいて解決されます。",
-    "localTimeHint": "お使いのタイムゾーン: {range}"
+    "localTimeHint": "お使いのタイムゾーン: {range}",
+    "builtInStatus": {
+      "seed": "組み込み価格: このリリースに同梱されたシードリスト（{date} 時点）。",
+      "neverSynced": "サーバー起動以降、オンライン同期は実行されていません。",
+      "lastSynced": "最終オンライン同期: {time}。"
+    },
+    "unpriced": {
+      "title": "価格の未設定",
+      "subtitle": "取り込み時に価格がない、または概算価格しかなかった LLM トレース内のモデル",
+      "banner": "{count} 件のモデルが取り込み時に価格または概算価格を持っていませんでした。記録されたコストは不完全な可能性があります。 | {count} 件のモデルが取り込み時に価格または概算価格を持っていませんでした。記録されたコストは不完全な可能性があります。",
+      "bannerTruncated": "トレース内の {total} 件のモデルが取り込み時に価格または概算価格を持っていませんでした。コストが誤っている可能性があります。トークン数上位 {shown} 件を表示しています。",
+      "streamLabel": "ストリーム",
+      "window": "過去 24 時間",
+      "windowRange": "{from} – {to}",
+      "colModel": "トレースで検出されたモデル",
+      "colPricedAs": "適用された価格",
+      "colTokens": "トークン",
+      "colCost": "記録されたコスト",
+      "colActions": "操作",
+      "spans": "{count} スパン | {count} スパン",
+      "moreAgents": "他 {count} 件",
+      "noMatch": "一致なし",
+      "approximate": "概算",
+      "pricedNow": "新しいスパンには適用済み",
+      "historicalGap": "この期間は記録された価格未設定のままです。新しいスパンには現在の価格が適用されます。",
+      "noActionNeeded": "対応は不要",
+      "defaultTierPrices": "入力 {input} / 出力 {output}（100 万トークンあたり）",
+      "notPriced": "価格未設定",
+      "createPrice": "価格を作成",
+      "keepPrices": "{name} の価格を維持",
+      "mute": "ミュート",
+      "muteConfirmTitle": "このモデルをミュートしますか？",
+      "muteConfirmMessage": "{model} の新しいスパンは無料として価格設定されます。古いスパンは記録されたコストのままです。ミュートを解除するには \"{name}\" の価格を削除してください。",
+      "mutedNotif": "{model} をミュートしました",
+      "keptNotif": "{model} は {name} の価格を使用するようになりました",
+      "errSave": "価格の保存に失敗しました",
+      "errLoad": "価格未設定のモデルの読み込みに失敗しました",
+      "emptyTitle": "この期間、このストリームには価格未設定または概算のモデル使用が記録されていません。",
+      "noStreamsTitle": "LLM トレースのストリームがありません",
+      "noStreamsDesc": "gen_ai スパンがトレースストリームに到達すると、モデルがここに表示されます。",
+      "recordedCostNote": "新しい価格は保存後に取り込まれたスパンに適用されます。古いスパンは記録されたコストのままです。",
+      "noModelName": "（モデル名なし）",
+      "noModelHint": "価格設定するモデルがありません: gen_ai.request.model を設定してください",
+      "instrumentationDocs": "計装ガイド"
+    }
   },
   "aiObservability": {
     "title": "LLM オブザーバビリティ",
@@ -17238,6 +17677,8 @@
       "skipTiers": "スキップされた行: {full} 完全スキップ · {partial} 部分スキップ",
       "scoreEvidence": "{scorer} · v{version}: {samples} サンプル、{noReference} 参照なし、{noTrace} トレースなし",
       "scorerApplicability": "{scorer} · v{version}: {eligible} 対象スロット, {noReference} 参照なし",
+      "costUnknown": "コスト不明",
+      "costAtLeast": "≥ {cost}",
       "loadError": "実験の読み込みに失敗しました",
       "previewError": "実験スロットのプレビューに失敗しました",
       "createSuccess": "実験を作成しました",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "この実験のコストは約 {cost} と推定され、警告しきい値 {threshold} を超えています。それでも作成して実行しますか？",
         "costConfirmMessageUnpriced": "この実験は警告しきい値を超えるコストが見込まれます。それでも作成して実行しますか？",
         "costConfirmOk": "それでも作成",
+        "taskProviderFailed": "何も作成されませんでした。タスクプロバイダー {provider} がテスト呼び出しに応答しませんでした。",
+        "judgeProviderFailed": "何も作成されませんでした。ジャッジプロバイダー {provider} がテスト呼び出しに応答しませんでした。",
         "skippedFully": "{count} 行が完全にスキップされました — 選択したすべてのスコアラーには期待される出力が必要です。スキップされた行の実行にはコストはかかりません。",
         "skippedPartially": "{count} 行が部分的にスキップされました — タスクは引き続き実行されますが、参照ベースのスコアラーは期待される出力のない行をスコアリングできません。",
         "skippedNone": "一致するすべての行は、少なくとも1つの次元でスコアリングできます。",
@@ -17408,7 +17851,26 @@
           "trials": "試行",
           "dispersion": "ばらつき",
           "latency": "レイテンシ",
-          "p50Latency": "P50 レイテンシー"
+          "p50Latency": "P50 レイテンシー",
+          "error": "エラー"
+        },
+        "failureBanner": {
+          "title": "{total} 件中 {failed} 件のスロットが失敗しました: {cause}。",
+          "cause": "主な原因、{count} スロット: {message}",
+          "moreCauses": "他 {count} 件の原因",
+          "noMessage": "エラーメッセージは記録されていません",
+          "openProviders": "プロバイダーを開く"
+        },
+        "failureKinds": {
+          "provider_auth": "プロバイダーが認証情報を拒否しました",
+          "rate_limited": "プロバイダーが実行をレート制限しました",
+          "timeout": "プロバイダーが時間内に応答しませんでした",
+          "provider_5xx": "プロバイダーがサーバーエラーを返しました",
+          "parse_error": "出力を解析できませんでした",
+          "mapping_error": "タスク入力を構築できませんでした",
+          "scorer_missing": "スコアラーが存在しなくなりました",
+          "execution_error": "タスク呼び出しが失敗しました",
+          "unknown": "タスク呼び出しが失敗しました"
         },
         "saveAsPrompt": "プロンプトとして保存",
         "openPrompt": "プロンプトを開く",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "環境",
       "agent": "エージェント",
-      "version": "バージョン"
+      "version": "バージョン",
+      "agentIdHint": "エージェント ID: {ids}",
+      "noAgentIdentity": "エージェント ID が見つかりません",
+      "noAgentIdentityDescription": "これらの LLM スパンにはエージェント名がないため、ストリーム別に表示しています。エージェント名を指定する属性をマッピングすると、エージェント別に表示できます。",
+      "noAgentIdentityAction": "GenAI エージェントマッピングを開く"
     },
     "agentGraph": {
       "stream": "ストリーム",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "このサーバーでは評価が無効になっています",
+      "description": "このページにはオンライン評価が必要ですが、このサーバーでは無効になっています。管理者に有効化を依頼してください。"
+    },
     "traceScoreChip": {
       "reasoning": "理由",
       "noReasoning": "このスコアの推論は記録されていません。",
@@ -18549,7 +19019,7 @@
       "remoteCta": "エンドポイントを設定"
     },
     "provider": {
-      "backTo": "プロバイダーに戻る",
+      "backTo": "プロバイダー",
       "createTitle": "LLM プロバイダーの作成",
       "editTitle": "LLM プロバイダーの編集",
       "subtitle": "LLM ジャッジスコアラーが使用するモデルエンドポイントを設定します。",
@@ -18794,7 +19264,7 @@
           "duplicateName": "スコアラー {index}: 名前 \"{name}\" はこのインポートで複数回使用されています"
         }
       },
-      "backTo": "スコアラーに戻る",
+      "backTo": "スコアラー",
       "badgeRemote": "リモート",
       "badgeLlm": "LLMジャッジ",
       "createTitleRemote": "新しいリモートスコアラー",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "プロバイダーを選択",
       "modelLabel": "モデル",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperature",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0〜2。空白の場合は 0 で判定します。",
       "promptLabel": "ジャッジプロンプト",
       "includeReasoningLabel": "推論を含める",
       "includeReasoningHint": "判定者はそのスコアを与えた理由を説明し、各結果とともに保存します。",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "ヘッダー名は必須です",
         "apiKeyTokenRequired": "トークンは必須です",
         "timeoutInvalid": "タイムアウトは 0 以上である必要があります",
+        "temperatureInvalid": "Temperature は 0〜2 の範囲で指定してください",
         "retriesInvalid": "リトライ回数は 0 以上である必要があります",
         "duplicateFieldName": "フィールド名は一意である必要があります"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "劣化しました",
         "waitingForCredentials": "認証情報を待機中",
         "noRecentRuns": "最近の実行なし",
+        "lastScored": "最終スコアリング {time}",
         "summary": "過去 15 分間に {runs} 回の実行のうち {errors} 回が失敗しました",
         "since": "{time}にこの状態になりました",
         "checked": "最終確認: {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "一致したターゲットの {percent}% を評価します。",
       "samplingValueAllHelp": "一致したすべてのターゲットが評価されます。",
       "samplingHelp": "フィルタリング後に実行され、コストを制御します。",
-      "backTo": "評価ジョブに戻る",
+      "backTo": "評価ジョブ",
       "createTitle": "新しい評価ジョブ",
       "editTitle": "評価ジョブを更新",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "このブランチは既に宛先で終了しています。",
       "chooseATriggerNodeToStart": "ワークフローを開始するにはトリガーノードを選択してください",
       "thisConnectionWouldCreateALoop": "この接続はループを作成します",
-      "onlyOneIncomingConnectionToA": "ステップへの受信接続は1つのみ許可されています"
+      "onlyOneIncomingConnectionToA": "ステップへの受信接続は1つのみ許可されています",
+      "endpointUrlCopied": "エンドポイント URL をコピーしました"
     },
     "views": {
       "youAreNotAuthorizedToManage": "ライセンスを管理する権限がありません。",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "データベースまたはサービスを検索…",
       "unnamedInstance": "インスタンス名がありません",
+      "schemaCount": "{count} スキーマ | {count} スキーマ",
       "unnamedInstanceHint": "データベース自身のステートメントレポートはこのエンジンが稼働していることを証明しますが、ホスト名は示されません。ホスト情報を含むフィード — セッションサンプリングやインスタンスメトリクス — が設定されると、行にアドレスが表示されます。",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "{time}まで集計済み。最後の30秒はまだ取り込み中です。",
       "lineExact": "すべてのデータベースが報告中です。速度はすべての呼び出しにわたって測定されているため、正確です。",
       "lineExactEstimated": "すべてのデータベースが報告中です。速度は複数の時間帯からブレンドされているため、近い値ですが正確ではありません。",
+      "lineExactSlowestSchema": "すべてのデータベースが報告中です。速度はスキーマごとの実測値です。複数のスキーマを持つデータベースは、最も遅いスキーマの値が表示されます。",
       "lineSubsetUnnamed": "フィルターが合計が集計されるレベル以下に絞り込んでいるため、パーセンテージはデータベース全体ではなく表示された行を示しています。",
       "lineQuery": "タイミングはアプリケーションから測定されるため、ネットワーク時間や空き接続の待ち時間も含まれます。",
       "lineUncodedErrors": "ここでの失敗の{percent}は理由コードなしで返されたため、カウントはできますが説明はできません。",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "このアラートが発火したのは初めてです。",
     "escalationNotStarted": "まだ呼び出されていません",
     "escalationPagesNobody": "呼び出し対象なし",
+    "escalationNobodyPaged": "誰も呼び出されていません",
     "escalationTo": "{who}にエスカレーション（{when}）",
     "escalationDetailCapped": "ライブのエスカレーション詳細は、最も古い{count}件の未解決呼び出しについて読み込まれます。",
     "responder": "対応者",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "終了",
     "rotationRestrictionAdd": "ウィンドウを追加",
     "rotationRestrictionRemove": "削除",
-    "rotationRestrictionZeroLength": "開始と終了が同じ場合、このウィンドウはどの時間にも一致しないため、レイヤーは適用されません。終日にするには、終了を24:00に設定してください。",
+    "rotationRestrictionZeroLength": "From と To が同じため、このウィンドウは決して一致しません。From と To が異なるまで保存は無効です。終日にするには、To を 24:00 に設定してください。",
     "rotationRetiredTag": "終了済み",
     "rotationSectionWhen": "交代タイミング",
     "rotationName": "ローテーション名",
@@ -25593,6 +26072,10 @@
     "snoozed": "スヌーズ中",
     "snoozedUntil": "{time} まで通知停止 — まだ未割り当て",
     "snoozeFailed": "呼び出しをスヌーズできませんでした",
+    "unsnooze": "スヌーズ解除",
+    "unsnoozeHint": "スヌーズを今すぐ終了します。呼び出しは中断したステップから再開します。",
+    "unsnoozed": "スヌーズ終了 · 呼び出しを再開",
+    "unsnoozeFailed": "スヌーズを解除できませんでした",
     "note": "メモ",
     "notePlaceholder": "何が分かりましたか？何を試しましたか？",
     "addNote": "メモを追加",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "同じメンバーで1シフトずつ後ろにずらすため、セカンダリがすでにオンコール中の人になることはありません。これは通常のローテーションであり、2つの間に特別な関連付けはありません。そのため、片方のローテーションだけを編集してもう片方を編集しないと、両者にずれが生じます。その場合、静かに修正されるのではなく、警告が表示されます。",
     "rotationPreviewPairLegend": "プライマリ · セカンダリ",
     "rotationPreviewEmpty": "担当者と最初の引き継ぎを選ぶと、誰がオンコールかを確認できます。",
+    "rotationPreviewNow": "現在 – {until}",
     "defaultRotationName": "ローテーション",
     "teamCreatedWithoutMembers": "チームは作成されましたが、メンバーを追加できませんでした。メンバータブで追加してください。",
     "teamCreatedWithoutRotation": "チームとメンバーは作成されましたが、ローテーションを保存できませんでした。スケジュールタブで設定してください。",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "誰も対応していません — まだ呼び出し中です",
     "sectionHint_ringingRouted": "誰も確認応答していません — そのうち {count} 件はまだ呼び出し中です | 誰も確認応答していません — そのうち {count} 件はまだ呼び出し中です",
     "sectionHint_ringingUnrouted": "{count} 件はチームがないため、呼び出しされていません | {count} 件はチームがないため、呼び出しされていません",
+    "sectionHint_ringingStopped": "{count} は呼び出されていません | {count} は呼び出されていません",
     "sectionHint_snoozed": "呼び出し一時停止中 — 自動的に再開されます",
     "sectionHint_handled": "対応中 — それぞれに担当者がいます",
     "sectionHint_resolved": "解決済み — 記録用に保持されています",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "シグナルが一致したときに呼び出されるチームです。そのチーム自身のエスカレーションラダーが、誰をどの順番で起こすかを決定します。",
     "scopeOwns": "このチームが所有",
     "scopeAdvanced": "詳細設定",
-    "ruleEditorConflictUnclaimed": "現在、このパスを所有するものはありません — 一致する呼び出しはキャッチオールチームに届くか、誰にも届きません。",
+    "ruleEditorConflictUnclaimed": "現時点でこのパスを引き受けるものはありません（これらの条件のみで判断）。これに一致する呼び出しは catch-all に届くか、誰にも届きません。",
     "ruleEditorConflictHeldBy": "現在、これに一致する呼び出しは {path} 経由で {team} に送信されます。",
     "ruleEditorConflictTakesOver": "あなたのルールの方が具体的に指定している条件が多いため、{team} からこれらを引き継ぎます。",
     "ruleEditorConflictKeptBy": "{team} が保持するパスの方が具体的に指定している条件が多いため、そちらがこれらを保持し、このルールは残りだけに一致します。",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} は {scope} でのみこのチームを呼び出します。それ以外の場所では、周囲のスコープを所有するチームに割り当てられます。",
     "scopeNothingDiscovered": "まだ何も検出されていないため、選択できる対象がありません。詳細設定を使用してフィールドでルールを作成するか、最初にテレメトリを送信してください。",
     "scopeAdvancedHint": "上記のレベルがカバーしないものを含む、任意のフィールドと値に一致します。",
+    "scopeValuesSeen": "これらの一覧には、サービスディスカバリーが確認した値が表示されます。それ以外の値に一致させるには、詳細設定を使用してください。",
     "escalationHeld": "まず AI トリアージ · {n} 秒以内に呼び出し",
     "escalationPagingStep": "段階 {step}/{total} を呼び出し中 · {who}",
     "escalationPagingStepOnly": "段階 {step}/{total} を呼び出し中",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "チームとローテーションを作成",
     "removeMemberHandsOver": "{rotation} の {leaving} の現在のシフトは {name} が引き継ぎます。",
     "removeMemberLeavesGap": "{rotation} の {leaving} の現在のシフトは誰も引き継ぎません。",
+    "removeMemberReorders": "{rotations} からも外れるため、そこのオンコール担当も変わる可能性があります。",
     "membersJoinEnd": "{names} は {rotations} の最後に加わります。現在の当番は変わりません。 | {names} は {rotations} の最後に加わります。現在の当番は変わりません。",
     "membersAdded": "{names} を追加しました。 | {names} を追加しました。",
     "removeMemberConfirm": "削除",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "お問い合わせ: {contact}",
       "outboundQueue": "アラートメッセージ: {count} 件キュー中、最も古いものは {age} | アラートメッセージ: {count} 件キュー中、最も古いものは {age}",
       "outboundEmpty": "キュー内のアラートメッセージはありません",
+      "refusedPosts": "{count} 件のアラート投稿が過去 24 時間に失敗しました。最新: {destination} での {reason}、| {count} 件のアラート投稿が過去 24 時間に失敗しました。最新: {destination} での {reason}、",
       "ageSeconds": "{count} 秒"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "リマインドを送信できませんでした。"
     }
   },
+  "llmDataTrust": {
+    "noModelName": "（モデル名なし）",
+    "topModels": "{models}（{total} 件中上位 {shown} 件）",
+    "cost": {
+      "partial": "一部",
+      "unknown": "コスト不明",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "コストの一部。{models} の価格がないため、この{scope}内の {tokens} トークンは計上されていません。",
+      "unknownTooltip": "コスト不明。{models} の価格がないため、この{scope}内の {tokens} トークンはいずれもコストがありません。",
+      "scopeSession": "セッション",
+      "scopeTrace": "トレース",
+      "unknownModel": "名前のないモデル",
+      "addPrice": "価格を追加"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} トークンが価格未設定",
+      "unpricedTooltip": "コストは下限値です。{models} の {tokens} トークンに価格がありません。LLM モデル価格設定の「価格未設定」タブを開いてください。",
+      "pricedSinceTooltip": "コストは下限値です。{models} の {tokens} トークンは価格追加前に記録されたため、コストがありません。"
+    },
+    "chart": {
+      "costMissing": "このチャートには含まれません: {models}。{tokens} トークンに価格がありません。",
+      "costMissingPricedSince": "このチャートには含まれません: {models}。{tokens} トークンは価格追加前に記録されました。",
+      "unpricedModels": "価格未設定: {models}",
+      "pricedSinceModels": "価格追加前に記録: {models}",
+      "addPrice": "価格を追加"
+    },
+    "health": {
+      "title": "データヘルス",
+      "passing": "{n} 件合格",
+      "checkedAgo": "確認済み（{ago}）",
+      "drawerTitle": "AI データヘルス",
+      "drawerSubtitle": "{stream} · 現在のウィンドウ",
+      "rerun": "チェックを再実行",
+      "close": "閉じる",
+      "loadError": "データヘルスチェックを実行できませんでした。",
+      "samples": "サンプル:",
+      "copyLink": "管理者用のリンクをコピー",
+      "linkCopied": "リンクをコピーしました",
+      "status": {
+        "pass": "合格",
+        "warning": "警告",
+        "error": "エラー"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "価格未設定のモデル",
+          "detail": "{count} モデル · {spans} スパン · {tokens} トークンを $0 として計上 | {count} モデル · {spans} スパン · {tokens} トークンを $0 として計上",
+          "pass": "このウィンドウ内のすべてのモデルに価格があります。価格追加前に記録されたスパンは、記録時のコストを保持します。",
+          "fix": "LLM モデル価格設定で修正",
+          "truncated": "トークン数順で {total} 件中上位 {shown} 件"
+        },
+        "missing_agent_identity": {
+          "label": "エージェント識別子の欠落",
+          "detail": "LLM スパン {total} 件中 {affected} 件（{pct}）に gen_ai.agent.name がないため、エージェントビューに表示されません。",
+          "pass": "すべての LLM スパンにエージェント名または ID があります。",
+          "fix": "GenAI エージェントマッピングを開く"
+        },
+        "zero_duration_spans": {
+          "label": "所要時間ゼロのスパン",
+          "detail": "{affected} 件の LLM スパンが 0 ms を報告しているため、レイテンシとセッション時間が実際より短く表示されます。",
+          "pass": "0 ms を報告する LLM スパンはありません。",
+          "fix": "修正方法"
+        },
+        "missing_session_id": {
+          "label": "セッション ID のないスパン",
+          "detail": "LLM スパン {total} 件中 {affected} 件（{pct}）に gen_ai.conversation.id がないため、セッションに表示されません。",
+          "pass": "すべての LLM スパンに gen_ai.conversation.id があります。",
+          "fix": "統合ガイド"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "フリート管理",
     "subtitle": "OpenTelemetry コレクターを登録し、構成をバージョン管理して、変更を安全にロールアウトします",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "進行中",
       "scheduled": "予定済み",
+      "waiting": "待機中",
       "completed": "完了",
       "halted": "停止",
       "superseded": "置き換え済み",
@@ -28696,7 +29257,7 @@
       "version": "バージョン",
       "pickConfig": "構成を選択",
       "pickFleet": "フリートを選択",
-      "emptyFleet": "このフリートにはコレクターがないため、バージョンはすぐに設定されます",
+      "emptyFleet": "フリートにコレクターがないため、コレクターが参加するまでロールアウトは待機します。",
       "startingShortly": "まもなく開始",
       "eventGateFailed": "ヘルスゲートに失敗",
       "eventHalted": "停止",
@@ -28707,7 +29268,10 @@
       "notFound": "このロールアウトは存在しません",
       "notFoundDescription": "リンクが古い可能性があります。一覧からロールアウトを選択してください。",
       "noneTargeted": "対象のコレクターがありません",
-      "outcomeNoneTargeted": "v{to} が設定された時点で、フリートにコレクターはありませんでした。",
+      "outcomeNoneTargeted": "このロールアウトで v{to} に更新されたコレクターはありません。",
+      "outcomeWaiting": "オンラインのコレクターがないため、v{to} はまだどのコレクターにも配信されていません。コレクターが接続するとロールアウトが開始します。",
+      "waitingForCollector": "コレクターを待機中",
+      "notStarted": "未開始",
       "versionFailedBefore": "v{version} · 以前に失敗",
       "pickVersion": "バージョンを選択",
       "autoRollback": "自動でロールバック",
@@ -28732,6 +29296,7 @@
       "eventResumed": "再開",
       "eventSkipped": "失敗したコレクターをスキップ",
       "eventStarted": "開始",
+      "eventWaiting": "コレクターのオンライン接続を待機中",
       "eventTimedOut": "フェーズがタイムアウト",
       "eventSkippedOffline": "開始時にオフラインだった {count} 台のコレクターを除外しました。再接続時にバージョンが適用されます | 開始時にオフラインだった {count} 台のコレクターを除外しました。再接続時にバージョンが適用されます",
       "excluded": "除外",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "{minutes} 分以内に承認も拒否もされないフェーズがあると、ロールアウトは停止します（フリート設定）",
       "phaseVerifying": "検証中",
       "phases": "フェーズ",
-      "planEmpty": "更新するコレクターがありません",
+      "planEmpty": "オンラインのコレクターがないため、コレクターが接続するまでロールアウトは待機します。",
+      "planStable": "オンラインのコレクターがありません。接続した時点で各コレクターに安定版が配信されます",
       "planOne": "1 バッチで {count} 台のコレクター | 1 バッチで {count} 台のコレクター",
       "planText": "{steps} → 残り {last}、{count} フェーズ",
       "planUnavailable": "プランのプレビューは利用できません",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 の場合、オフラインのコレクターを永久に保持します"
     },
     "audit": {
-      "search": "監査証跡を検索",
       "editedConfig": "構成を編集",
       "revokedToken": "登録トークンを失効",
       "enrolledCollector": "コレクターを登録",
@@ -28920,7 +29485,6 @@
       "setDesired": "バージョンを変更",
       "autoRollback": "自動でロールバック",
       "rolloutHalted": "ロールアウトを停止",
-      "assignedFleetConfig": "フリートの構成を割り当て",
       "createdFleet": "フリートを作成",
       "renamedFleet": "フリート名を変更",
       "deletedFleet": "フリートを削除",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "ロールアウトをロールバック",
       "movedByToken": "登録トークンにより移動",
       "object": "オブジェクト",
+      "search": "監査証跡を検索",
       "allObjects": "すべてのオブジェクト",
       "kind": {
         "fleet": "フリート",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "v{to} をロールアウト中",
       "rolloutHalted": "v{to} のロールアウトが停止",
+      "rolloutWaiting": "v{to} はコレクターがオンラインになるのを待機しています",
       "autoRolledBack": "v{to} が自動でロールバックされました",
       "noReason": "失敗の理由は報告されていません",
       "openRollout": "ロールアウトを開く",
diff --git a/web/src/locales/languages/ko-KR.json b/web/src/locales/languages/ko-KR.json
index 5af06906b9..a5d2324af5 100644
--- a/web/src/locales/languages/ko-KR.json
+++ b/web/src/locales/languages/ko-KR.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "LLM 활동이 아직 없습니다",
       "description": "OpenTelemetry Gen-AI 의미 규칙으로 서비스를 계측하고, 이 대시보드를 채우려면 트레이스를 하나 이상 수집하세요.",
-      "action": "오픈 텔레메트리 기능이 있는 기기",
-      "actionDesc": "트레이스에서 gen_ai_* 속성을 캡처하세요."
+      "action": "모든 AI 통합",
+      "actionDesc": "모든 프레임워크 및 공급자 가이드 살펴보기",
+      "suggested": "{name} 트레이스 설정",
+      "suggestedDesc": "{name} 문서에서 왔기 때문에 추천됨",
+      "codingAgent": "코딩 에이전트로 계측",
+      "codingAgentDesc": "코딩 에이전트가 트레이스를 추가하고 첫 트레이스를 확인합니다",
+      "startFrom": "또는 다음에서 시작"
     },
     "noLLMSessions": {
       "title": "LLM 세션이 아직 없습니다",
@@ -4797,6 +4802,13 @@
       "success": "성공",
       "failed": "실패",
       "testRun": "테스트 실행",
+      "source": "소스",
+      "sourceHttp": "HTTP 요청",
+      "sourceAlertFired": "알림 발생",
+      "sourceIncidentEvent": "인시던트 이벤트",
+      "sourceRetry": "재시도 실행",
+      "sourceManual": "수동 실행",
+      "sourceOther": "기타",
       "runType": "유형",
       "testRunTooltip": "편집기에서 시작되었습니다. 대상 단계는 실제로 전송됩니다.",
       "showTestRuns": "테스트 실행 {count}개 표시",
@@ -4810,7 +4822,33 @@
       "retryTitle": "이 실행을 재시도하시겠습니까?",
       "retryMessage": "실패한 실행이 기록한 입력으로 새 실행을 만듭니다. 대상 단계는 실제로 전송됩니다.",
       "retryStarted": "재시도가 시작되었습니다. 목록에 새 실행으로 표시됩니다.",
-      "retryError": "이 실행을 재시도할 수 없습니다."
+      "retryError": "이 실행을 재시도할 수 없습니다.",
+      "statusQueued": "대기 중",
+      "statusRunning": "실행 중",
+      "statusExpired": "만료됨",
+      "reasonExpired": "실행되지 않음 · 1시간 이상 대기",
+      "reasonWorkerLost": "워커 유실 · 재실행되지 않음",
+      "reasonWorkflowDisabled": "워크플로우가 비활성화됨",
+      "reasonRunTimeout": "15분 후 시간 초과",
+      "allTriggers": "모든 트리거",
+      "triggerFilter": "트리거",
+      "run": "실행",
+      "searchRuns": "실행 ID, 멱등성 키 또는 알림 검색",
+      "sourceDetails": "소스 세부 정보",
+      "detailsWithKey": "{ip} · 키 {key}",
+      "detailsNoKey": "{ip} · 멱등성 키 없음",
+      "retryOf": "{run}의 재시도",
+      "openRun": "실행 열기",
+      "alertFiredEmptyTitle": "이 시간 범위에 알림 발생 실행이 없습니다",
+      "incidentEventEmptyTitle": "이 시간 범위에 인시던트 이벤트 실행이 없습니다",
+      "filterEmptyTitle": "이 시간 범위에 일치하는 실행이 없습니다",
+      "filterEmptyDimmed": "다른 실행은 타임라인에 흐리게 표시됩니다.",
+      "searchEmptyTitle": "이 검색과 일치하는 실행이 없습니다",
+      "searchEmptyAction": "검색 지우기",
+      "timelineNow": "지금",
+      "timelineAgoMinutes": "−{n}분",
+      "timelineAgoHours": "−{n}시간",
+      "timelineAgoDays": "−{n}일"
     },
     "edit": "편집",
     "view": "보기",
@@ -4958,7 +4996,9 @@
           "noMatch": "일치 없음"
         },
         "suppressed": "억제됨 — 실제 대상으로 전송되지 않음"
-      }
+      },
+      "payloadFrom": "페이로드 출처",
+      "payloadFromHint": "HTTP 형태는 엔드포인트 호출자가 전송하는 것입니다."
     },
     "linkAlerts": {
       "title": "워크플로우를 알림에 연결",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "출력 형식",
       "tlsVerifyLabel": "TLS 검증",
       "tlsDisabled": "비활성화"
+    },
+    "http": {
+      "runTestHint": "샘플 HTTP 페이로드로 단계를 실행하며, URL을 호출하지 않습니다",
+      "runTestHintList": "워크플로우를 열어 테스트 실행",
+      "runsEmptyTitle": "이 시간 범위에 HTTP 요청이 없습니다",
+      "runsEmptyBody": "시간 범위를 넓히거나 HTTP 엔드포인트 패널에서 테스트 요청을 보내세요.",
+      "runsEmptyAction": "모든 트리거 표시",
+      "runFailedAt": "이 실행은 {step}에서 실패했습니다: {error}",
+      "openStep": "단계 열기",
+      "runGuardHint": "HTTP 실행은 알림 필드가 아닌 요청을 전달합니다. 이 단계에서 {fields}를 읽는다면 조건으로 보호하세요: {guard}.",
+      "runExpiredBanner": "이 요청은 대기열에서 1시간 넘게 대기했으며 실행되지 않았습니다. 어떤 단계도 실행되지 않았고 어떤 대상도 호출되지 않았습니다.",
+      "runWorkerLostBanner": "이 요청을 실행하던 워커가 중지되었습니다. 대상이 이미 호출되었을 수 있으므로 자동으로 다시 실행되지 않습니다. 호출자가 다시 보내기 전에 해당 대상을 확인하세요.",
+      "request": "요청",
+      "requestReceived": "수신됨",
+      "requestToken": "토큰",
+      "requestCallerIp": "호출자 IP",
+      "requestIdempotencyKey": "멱등성 키",
+      "requestContentType": "콘텐츠 유형",
+      "requestBodySize": "본문 크기",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "헤더",
+      "headersKept": "{count}개 보관됨 · Authorization, 쿠키 및 서명은 절대 저장되지 않습니다 | {count}개 보관됨 · Authorization, 쿠키 및 서명은 절대 저장되지 않습니다",
+      "headerName": "이름",
+      "headerValue": "값",
+      "outputCaption": "모든 다운스트림 단계가 수신한 내용",
+      "useAsTestInput": "테스트 입력으로 사용",
+      "editorButton": "HTTP 엔드포인트",
+      "editorButtonOn": "켜짐",
+      "editorButtonOff": "꺼짐",
+      "editorButtonTooltip": "다른 시스템이 HTTP 요청으로 이 워크플로우를 시작할 수 있도록 허용",
+      "editorButtonRefusedDraft": "워크플로우가 게시될 때까지 요청은 403 응답을 받습니다",
+      "editorButtonRefusedPaused": "워크플로우가 일시 중지된 동안 요청은 403 응답을 받습니다",
+      "panelTitle": "HTTP 엔드포인트",
+      "panelSubtitle": "{name} · {kind} 워크플로우",
+      "acceptRequests": "HTTP 요청 수락",
+      "kindNote": "이 워크플로우의 단계는 {kind} 실행용으로 만들어졌습니다. HTTP 실행은 대신 요청({field})을 받으므로, 단계에서 {kind} 필드가 필요하면 조건을 추가하세요.",
+      "kindNotePayload": "HTTP 페이로드 표시",
+      "kindNotePayloadHide": "HTTP 페이로드 숨기기",
+      "unsavedBody": "이 워크플로우는 아직 저장되지 않았습니다. 초안으로 저장하여 URL과 토큰을 생성하세요. 게시할 때까지 요청은 거부됩니다.",
+      "saveAndCreate": "초안 저장 및 엔드포인트 생성",
+      "needsAdmin": "엔드포인트를 생성하려면 조직 관리자 권한이 필요합니다.",
+      "needsEdit": "변경하려면 이 워크플로우에 대한 편집 권한이 필요합니다.",
+      "readOnlyOnMeta": "켜짐 · URL을 복사할 수 있습니다. 변경하려면 이 워크플로우에 대한 편집 권한이 필요합니다.",
+      "offBody": "다른 시스템이 HTTP 요청으로 이 워크플로우를 시작할 수 있도록 허용합니다. URL과 토큰을 받습니다.",
+      "offExistingBody": "꺼짐 · 켤 때까지 요청은 거부됩니다(403).",
+      "onMeta": "켜짐 · 워크플로우가 활성화되고 게시된 동안에만 실행이 시작됩니다",
+      "loadError": "엔드포인트 설정을 불러오지 못했습니다.",
+      "draftBanner": "이 워크플로우는 초안입니다. 게시할 때까지 URL 호출은 403 응답을 받습니다. 지금 엔드포인트를 설정할 수 있으며, 테스트 실행은 샘플 HTTP 페이로드로 초안의 단계를 실행합니다.",
+      "disabledBanner": "워크플로우를 활성화할 때까지 요청은 거부됩니다(403).",
+      "turnOnFailed": "엔드포인트를 켜지 못했습니다. {reason}",
+      "changeFailed": "엔드포인트를 저장하지 못했습니다. {reason}",
+      "endpointExistsHint": "엔드포인트가 이미 존재합니다. 토큰 테이블에서 해당 토큰을 표시하거나 복사하세요.",
+      "endpointExistsHintSigned": "엔드포인트가 이미 존재합니다. 서명 시크릿 테이블에서 해당 서명 시크릿을 표시하거나 복사하세요.",
+      "disableTitle": "엔드포인트를 끌까요?",
+      "disableBody": "다시 켤 때까지 호출자는 403(엔드포인트 꺼짐)을 받습니다. URL과 토큰은 동일하게 유지됩니다.",
+      "disableConfirm": "끄기",
+      "lastCall": "켜짐 · 마지막 호출: {status} · {time} · {link}",
+      "lastCallNone": "켜짐 · 아직 호출 없음 — 테스트 요청을 보내세요",
+      "lastCallNoneRefused": "켜짐 · 아직 호출 없음",
+      "viewRun": "실행 보기",
+      "lastCallStatus": {
+        "queued": "대기 중",
+        "running": "실행 중",
+        "succeeded": "성공",
+        "failed": "실패",
+        "expired": "만료됨"
+      },
+      "endpointUrl": "엔드포인트 URL",
+      "tokenLabel": "토큰",
+      "secretLabel": "서명 시크릿",
+      "newTokenLabel": "새 토큰",
+      "newSecretLabel": "새 서명 시크릿",
+      "tokenHint": "화면에는 마스킹되어 표시됩니다. 복사하면 실제 토큰이 복사됩니다. {header}로 전송하고 URL에는 절대 넣지 마세요.",
+      "secretHint": "화면에는 마스킹되어 표시됩니다. 복사하면 실제 시크릿이 복사됩니다. 각 요청에 이 시크릿으로 서명하고 {headers} 헤더를 전송하세요. 시크릿 자체는 절대 전송하지 마세요.",
+      "revealBannerTitle": "엔드포인트 생성됨",
+      "revealBannerBody": "모든 요청에 이 토큰을 전송하세요. 토큰 테이블에서 다시 표시하거나 복사할 수 있습니다.",
+      "revealBannerBodySigned": "모든 요청에 이 시크릿으로 서명하세요. 서명 시크릿 테이블에서 다시 표시하거나 복사할 수 있습니다.",
+      "switchedBannerTitle": "토큰 생성됨",
+      "switchedBannerTitleSigned": "서명 시크릿 생성됨",
+      "rotateBannerTitle": "새 토큰 생성됨",
+      "rotateBannerTitleSigned": "새 서명 시크릿 생성됨",
+      "rotateBannerBody": "호출자는 동일한 URL과 헤더를 사용하며 토큰만 변경됩니다. 이전 토큰은 만료될 때까지 계속 유효하며, 그때까지 표시할 수 있습니다.",
+      "rotateBannerBodySigned": "호출자는 동일한 URL과 헤더를 사용하며 시크릿만 변경됩니다. 이전 시크릿은 만료될 때까지 계속 유효하며, 그때까지 표시할 수 있습니다.",
+      "rotateBannerBodyRevoked": "호출자는 동일한 URL과 헤더를 사용하며 토큰만 변경됩니다. 이전 토큰은 폐기되어 지금부터 더 이상 유효하지 않습니다.",
+      "rotateBannerBodyRevokedSigned": "호출자는 동일한 URL과 헤더를 사용하며 시크릿만 변경됩니다. 이전 시크릿은 폐기되어 지금부터 더 이상 유효하지 않습니다.",
+      "rotateBannerBodyFresh": "호출자는 동일한 URL과 헤더를 유지하고 지금부터 이 토큰을 전송합니다.",
+      "rotateBannerBodyFreshSigned": "호출자는 동일한 URL과 헤더를 유지하고 지금부터 이 시크릿으로 서명합니다.",
+      "snippetsLabel": "요청 예시",
+      "sendTest": "테스트 요청 보내기",
+      "sendTestHint": "자격 증명을 확인하고 단계에서 수신할 내용을 표시합니다. 실행은 시작되지 않으며 대상은 호출되지 않습니다.",
+      "sendTestHintPaused": "자격 증명을 확인합니다. 워크플로우가 일시 중지되어 입력이 생성되기 전에 호출이 거부됩니다. 테스트 실행을 사용하면 단계가 실행됩니다.",
+      "sendTestSigned": "브라우저는 요청에 서명할 수 없으므로 위의 요청 예시로 테스트하세요. 실행을 시작하지 않고 서명을 확인하려면 해당 URL에 ?dry_run=true를 추가하세요.",
+      "dryRunAccepted": "드라이 런 수락됨",
+      "dryRunMeta": "자격 증명 유효 · 본문 {size}",
+      "dryRunInput": "단계에서 수신할 입력",
+      "dryRunRefused": "자격 증명이 유효합니다. 워크플로우가 게시될 때까지 요청이 거부됩니다.",
+      "dryRunRefusedPaused": "자격 증명이 유효합니다. 워크플로우가 일시 중지된 동안 요청이 거부됩니다.",
+      "dryRunRateLimited": "속도 제한됨 — 드라이 런도 한도에 포함됩니다.",
+      "dryRunStatus": "요청이 거부되었습니다. 상태: {status}.",
+      "dryRunFailed": "테스트 요청을 보내지 못했습니다. {reason}",
+      "runTestInstead": "대신 테스트 실행",
+      "done": "완료",
+      "regionTag": "리전 {name}",
+      "regionBanner": "모든 요청과 모든 재시도를 이 리전의 호스트로 보내세요. 멱등성 키와 실행 상태({field})는 호출을 수락한 리전에 보관되므로, 다른 리전으로 보낸 재시도는 두 번째 실행을 시작할 수 있습니다.",
+      "authLabel": "호출자 인증 방식",
+      "authToken": "토큰",
+      "authSigned": "서명된 요청",
+      "authAbout": "인증 정보",
+      "authInfo": "토큰: Authorization 헤더에 토큰을 전송하세요. 서명된 요청: 공유 시크릿({headers} 헤더)으로 각 요청에 서명하세요.",
+      "switchToSignedTitle": "서명된 요청으로 전환하시겠습니까?",
+      "switchToSignedBody": "전환하면 현재 토큰이 즉시 폐기되고 서명 시크릿이 생성됩니다. 토큰을 사용하는 호출자는 401을 받기 시작합니다.",
+      "switchToTokenTitle": "토큰으로 전환할까요?",
+      "switchToTokenBody": "전환하면 현재 서명 시크릿이 즉시 폐기되고 토큰이 생성됩니다. 요청에 서명하는 호출자는 401을 받기 시작합니다.",
+      "tokensTitle": "토큰",
+      "secretsTitle": "서명 시크릿",
+      "colToken": "토큰",
+      "colSecret": "시크릿",
+      "colCreated": "생성일",
+      "colLastUsed": "마지막 사용",
+      "colStatus": "상태",
+      "colActions": "작업",
+      "never": "없음",
+      "active": "활성",
+      "retiring": "폐기 예정",
+      "creatorGone": "생성자가 더 이상 이 조직에 없습니다",
+      "revoke": "폐기",
+      "revokeNow": "지금 폐기",
+      "revokeTitle": "{prefix}을(를) 폐기할까요? 사용 중인 호출자는 즉시 401을 받습니다.",
+      "revokeFailed": "폐기하지 못했습니다. {reason}",
+      "copyToken": "토큰 복사",
+      "copySecret": "시크릿 복사",
+      "tokenCopied": "토큰이 복사되었습니다",
+      "commandCopied": "명령이 복사되었습니다",
+      "secretCopied": "시크릿이 복사되었습니다",
+      "revealFailed": "토큰을 표시하지 못했습니다. {reason}",
+      "revealFailedSigned": "시크릿을 표시하지 못했습니다. {reason}",
+      "revealDenied": "이 엔드포인트의 토큰은 관리자만 표시하거나 복사할 수 있습니다.",
+      "runTest": "테스트 실행",
+      "rotate": "교체",
+      "rotateBlocked": "폐기 예정인 토큰을 먼저 폐기하세요",
+      "rotateBlockedSigned": "폐기 예정인 시크릿을 먼저 폐기하세요",
+      "rotateTitle": "토큰 교체",
+      "rotateTitleSigned": "서명 시크릿 교체",
+      "rotateLead": "지금 새 토큰이 생성됩니다. {prefix}(마지막 사용 {time})의 계속 사용 기간:",
+      "rotateLeadSigned": "지금 새 서명 시크릿이 생성됩니다. {prefix}(마지막 사용 {time})의 계속 사용 기간:",
+      "overlapNow": "즉시 폐기",
+      "overlapHour": "1시간",
+      "overlapDay": "24시간",
+      "overlapWeek": "7일",
+      "rotateConsequence": "현재 토큰을 사용하는 호출자는 {time}까지 계속 작동합니다. 그 전에 업데이트하세요.",
+      "rotateConsequenceSigned": "현재 시크릿으로 서명하는 호출자는 {time}까지 계속 작동합니다. 그 전에 업데이트하세요.",
+      "rotateConsequenceNow": "현재 토큰을 사용하는 호출자는 지금부터 401을 받습니다.",
+      "rotateConsequenceNowSigned": "현재 시크릿으로 서명하는 호출자는 지금부터 401을 받습니다.",
+      "rotateConfirm": "토큰 교체",
+      "rotateConfirmSigned": "서명 시크릿 교체",
+      "rotateFailed": "교체하지 못했습니다. {reason}",
+      "advanced": "고급",
+      "advancedSummary": "최대 본문 {size} · 분당 요청 {count}개 | 최대 본문 {size} · 분당 요청 {count}개",
+      "maxBody": "최대 본문 크기(KiB)",
+      "maxBodyHint": "최대 1024(1 MiB)이며, 값은 낮출 수만 있습니다",
+      "maxBodyRange": "1에서 1024 사이의 정수를 입력하세요",
+      "rateLimit": "분당 요청 수",
+      "rateLimitHint": "이 조직의 경우 분당 최대 {org}까지",
+      "rateLimitRange": "1부터 {org}까지의 정수를 입력하세요",
+      "saveLimitsFailed": "제한을 저장하지 못했습니다. {reason}",
+      "deleteMeta": "URL과 모든 토큰 또는 시크릿을 제거합니다.",
+      "deleteButton": "엔드포인트 삭제",
+      "deleteTitle": "이 엔드포인트를 삭제하시겠습니까?",
+      "deleteBody": "URL은 즉시 작동을 멈추고 호출자는 401을 받습니다. 모든 토큰과 서명 시크릿은 삭제되며 복구할 수 없습니다. 실행 기록은 유지됩니다.",
+      "deleteFailed": "엔드포인트를 삭제하지 못했습니다. {reason}",
+      "secretStorageWarning": "이 서버에는 암호화 마스터 키가 없어 토큰과 서명 시크릿이 데이터베이스에 접근할 수 있는 사람이라면 누구나 읽을 수 있는 형태로 저장됩니다. 관리자에게 마스터 키 설정을 요청하세요.",
+      "rejectionsLine": "지난 24시간 동안 약 {count}건의 요청이 거부되었습니다 · 마지막: {reason}, {time} | 지난 24시간 동안 약 {count}건의 요청이 거부되었습니다 · 마지막: {reason}, {time}",
+      "rejectionsShow": "표시",
+      "rejectionsHide": "숨기기",
+      "rejectionsTitle": "최근 거부",
+      "rejectionsCaption": "지난 24시간 동안 약 {count}건 · 호출자는 상태 코드만 확인했습니다 | 지난 24시간 동안 약 {count}건 · 호출자는 상태 코드만 확인했습니다",
+      "rejectionMeta": "약 {count} · 마지막 {time} · {ip}에서 | 약 {count} · 마지막 {time} · {ip}에서",
+      "rejectionsLoadError": "거부 내역을 불러오지 못했습니다.",
+      "raiseLimit": "제한 올리기",
+      "rotateLink": "교체",
+      "reason": {
+        "invalid_token": {
+          "title": "잘못된 토큰",
+          "fix": "호출자가 취소되었거나 만료되었거나 잘못 입력된 토큰을 보냈습니다. 토큰 표에서 현재 토큰을 표시하거나 복사하세요."
+        },
+        "invalid_signature": {
+          "title": "잘못된 서명",
+          "fix": "호출자가 이전 시크릿이나 잘못된 시크릿으로 서명했습니다. 현재 시크릿을 사용하는지, {format}을(를) 전송된 그대로 서명하는지 확인하세요."
+        },
+        "stale_timestamp": {
+          "title": "타임스탬프가 너무 오래됨",
+          "fix": "호출자의 시계가 5분 이상 차이 납니다. 시계를 동기화하고 전송 직전에 서명하세요."
+        },
+        "endpoint_disabled": {
+          "title": "엔드포인트 꺼짐",
+          "fix": "엔드포인트를 켜세요."
+        },
+        "workflow_disabled": {
+          "title": "워크플로우 일시 중지됨",
+          "fix": "목록에서 워크플로우를 재개하세요."
+        },
+        "workflow_not_published": {
+          "title": "워크플로우가 게시되지 않음",
+          "fix": "워크플로우를 게시하세요. 초안은 요청을 거부합니다."
+        },
+        "payload_too_large": {
+          "title": "페이로드가 너무 큼",
+          "fix": "{size}를 초과했습니다. 더 적게 보내거나 이벤트를 여러 요청으로 나누세요."
+        },
+        "credential_in_url": {
+          "title": "URL에 자격 증명 포함",
+          "fix": "토큰 또는 시크릿이 URL에 포함되어 전송되었고 거부되었습니다. URL은 프록시와 브라우저 로그에 남으므로 지금 교체한 뒤 헤더로 전송하세요."
+        },
+        "invalid_idempotency_key": {
+          "title": "잘못된 멱등성 키",
+          "fix": "Idempotency-Key 헤더가 비어 있거나 255자를 초과합니다."
+        },
+        "idempotency_key_reused": {
+          "title": "멱등성 키 재사용됨",
+          "fix": "동일한 키가 다른 본문으로 도착했습니다. 각기 다른 이벤트마다 새 키를 사용하세요."
+        },
+        "rate_limited": {
+          "title": "속도 제한됨",
+          "fix": "분당 {count}건을 초과한 요청입니다. 이벤트를 하나의 요청으로 묶거나(JSON 배열 전송) 제한을 올리세요. 이 조직의 경우 분당 최대 {org}까지 가능합니다."
+        },
+        "queue_full": {
+          "title": "대기열 가득 참",
+          "fix": "이 조직에는 이미 {count}건의 HTTP 실행이 대기 중이었습니다. 호출자는 Retry-After 지연 후 재시도해야 하며, 느린 단계가 있는지 확인하거나 전송 속도를 낮추세요."
+        },
+        "worker_unavailable": {
+          "title": "워커를 사용할 수 없음",
+          "fix": "이 리전에서 실행 중인 워크플로우 워커가 없어 아무것도 대기열에 들어가지 않았습니다. Retry-After 지연 후 재시도하는 호출자는 워커가 복구되면 처리됩니다. 계속 발생하면 관리자에게 워크플로우 워커 점검을 요청하세요."
+        }
+      },
+      "nodeBadge": "HTTP로 호출 가능",
+      "triggerLinkOn": "HTTP 요청으로도 실행됨",
+      "triggerLinkOnAction": "엔드포인트 관리",
+      "triggerLinkOff": "다른 시스템에서도 시작하기",
+      "triggerLinkOffAction": "HTTP 엔드포인트 설정",
+      "pickerCue": "모든 워크플로우는 HTTP 요청으로도 시작할 수 있습니다. 트리거를 선택한 다음 툴바에서 HTTP 엔드포인트를 사용하세요.",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP 엔드포인트 켜짐",
+      "listMenuItem": "HTTP 엔드포인트…",
+      "copyUrl": "엔드포인트 URL 복사",
+      "copyUrlDraftHint": "게시할 때까지 요청이 거부됩니다",
+      "copyUrlFailed": "엔드포인트 URL을 복사하지 못했습니다. {reason}",
+      "payloadFrom": "페이로드 출처",
+      "payloadHttp": "HTTP 요청",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "{count}시간 후 만료 | {count}시간 후 만료",
+      "expiresInDays": "{count}일 후 만료 | {count}일 후 만료",
+      "expired": "만료됨",
+      "rotateLeadUnused": "이제 새 토큰이 생성됩니다. {prefix}(사용된 적 없음)를 계속 작동시키는 기간",
+      "rotateLeadUnusedSigned": "이제 새 서명 시크릿이 생성됩니다. {prefix}(사용된 적 없음)를 계속 작동시키는 기간",
+      "fieldGroup": "HTTP 요청",
+      "fieldGroupBodyHint": "요청 본문 내 필드에는 먼저 함수 단계가 필요합니다",
+      "fieldGroupQueryHint": "쿼리 매개변수는 meta.query.<key>입니다. 반복된 키는 목록으로 도착하며 절대 일치하지 않습니다.",
+      "rotateLeadNone": "활성 토큰이 없어 호출자가 인증할 수 없습니다. 이제 새 토큰이 생성됩니다.",
+      "rotateLeadNoneSigned": "활성 서명 시크릿이 없어 호출자가 인증할 수 없습니다. 이제 새 서명 시크릿이 생성됩니다.",
+      "createForbidden": "이 조직에서는 엔드포인트 자격 증명을 생성할 수 없습니다.",
+      "errorNotConfigured": "이 워크플로우에는 HTTP 엔드포인트가 없습니다.",
+      "errorNoLiveCredential": "활성 자격 증명이 없습니다. 교체하여 새로 생성하세요.",
+      "errorNotAllowed": "이 작업을 수행할 권한이 없습니다.",
+      "copyCredentialChanged": "자격 증명이 변경되었습니다. 다시 복사하세요.",
+      "copyCommandFailed": "명령을 복사하지 못했습니다. {reason}",
+      "exampleRequest": "요청 예시",
+      "exampleActiveToken": "활성 토큰 · {prefix}",
+      "exampleActiveSecret": "활성 시크릿 · {prefix}",
+      "exampleHintToken": "복사 내용에 토큰이 포함됩니다. 터미널에 붙여넣거나 Postman 또는 Insomnia로 가져오세요(가져오기 → Raw text).",
+      "exampleHintSigned": "bash에서 실행하세요. openssl로 서명한 다음 curl을 호출합니다. 복사 내용에 시크릿이 포함됩니다. 가져오기 도구로는 서명할 수 없습니다.",
+      "exampleHintTokenPlaceholder": "복사 내용에는 토큰이 들어갈 자리표시자가 있습니다. 터미널에 붙여넣거나 Postman 또는 Insomnia로 가져오세요(가져오기 → Raw text).",
+      "exampleHintSignedPlaceholder": "bash에서 실행하세요. openssl로 서명한 다음 curl을 호출합니다. 복사 내용에는 시크릿이 들어갈 자리표시자가 있습니다. 가져오기 도구로는 서명할 수 없습니다."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "클릭",
       "viewDocsLinkLabel": "여기",
       "viewDocsSuffix": "추가 문서를 확인하려면.",
-      "selectIntegrationPrompt": "세부 정보를 보려면 통합을 선택하세요."
+      "selectIntegrationPrompt": "세부 정보를 보려면 통합을 선택하세요.",
+      "codingAgent": {
+        "tabAgent": "코딩 에이전트 사용",
+        "tabSteps": "단계별",
+        "streamLabel": "트레이스 스트림 이름",
+        "streamHelp": "에이전트가 이 스트림에 트레이스를 기록하고 확인합니다.",
+        "envTitle": ".env 다운로드",
+        "envHelp": "프로젝트 루트에 저장하세요. 스킬이 이 파일에서 토큰을 읽으므로 토큰이 채팅에 포함되지 않습니다.",
+        "envButton": ".env 다운로드",
+        "promptTitle": "{client1}, {client2} 또는 {client3}에 붙여넣으세요",
+        "promptLabel": "프롬프트",
+        "promptCopied": "프롬프트가 복사되었습니다"
+      }
     },
     "header": "데이터 소스",
     "resetRUMTokenLabel": "RUM 토큰 초기화",
@@ -7670,6 +7995,15 @@
     "queryValues": "쿼리 값",
     "constant": "상수",
     "textbox": "텍스트 박스",
+    "date": "날짜",
+    "dateFormat": "출력 날짜 형식",
+    "dateFormatHelp": "쿼리의 기본 출력입니다. 사용할 때마다 ${'{'}name:format{'}'}로 재정의하세요. 예: ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "에포크 초 (epoch)",
+    "dateFormatEpochms": "에포크 밀리초(epochms)",
+    "dateFormatEpochus": "에포크 마이크로초(epochus)",
     "newFolder": "새 폴더",
     "updateFolder": "폴더 업데이트",
     "newReport": "새 보고서",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "주석 추가",
       "dependentAdhocVariableWarning": "일부 동적 변수가 적용되지 않았습니다. 필드가 쿼리의 스트림에 없기 때문입니다. 이 패널을 렌더링하기 위해 실행된 변수 및 쿼리의 모든 세부 정보를 보려면 쿼리 검사기를 여십시오.",
       "refreshCacheReload": "캐시 새로고침 및 다시 로드",
+      "exploreCreateAlert": "알림 생성",
+      "exploreAddToDashboard": "대시보드에 추가",
       "redirectingToLogs": "로그 페이지로 리디렉션 중",
       "pleaseWait": "잠시 기다려 주세요..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "상수",
       "textbox": "텍스트 상자",
       "custom": "사용자 지정",
+      "date": "날짜",
       "list": "{type} · {example}",
       "csv": "쉼표: {example}",
       "pipe": "파이프: {example}",
       "doublequote": "큰따옴표: {example}",
-      "singlequote": "작은따옴표: {example}"
+      "singlequote": "작은따옴표: {example}",
+      "dateIso": "날짜(YYYY-MM-DD): {example}",
+      "dateDmy": "일 우선(DD/MM/YYYY): {example}",
+      "dateMdy": "월 우선(MM/DD/YYYY): {example}",
+      "dateEpoch": "에포크 초: {example}",
+      "dateEpochms": "에포크 밀리초: {example}",
+      "dateEpochus": "에포크 마이크로초: {example}"
     },
     "add": "패널 추가",
     "save": "저장",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "확인됨",
         "badgeResolved": "해결됨",
         "badgeReopened": "재개됨",
+        "badgeAckEnded": "확인 종료됨",
         "badgeDimensionsUpgraded": "차원 상향",
         "badgeTitleChanged": "제목 변경",
         "badgeAssignment": "할당",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "AI 입력 필요",
         "incidentWas": "인시던트가",
         "theIncident": "해당 인시던트",
+        "ackEndedByPageResolve": "호출 중 하나를 해결하여",
         "unnamedAlert": "알림",
         "alertTriggered": "{alert} 트리거됨 | {alert} {count}회 트리거됨",
         "severityUpgraded": "심각도가 {from}에서 {to}로 상향됨",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "알림 받기",
           "toast": "제품 분석에서 가져옴: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "알림 생성",
+          "toast": "트레이스 검색에서 쿼리를 가져왔습니다",
+          "noStream": "먼저 스트림을 선택하세요",
+          "errorCount": "오류 수",
+          "errorRate": "오류율"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "로그 페이지에서 먼저 Run as를 선택해야 하므로 검색 필터가 반영되지 않았습니다. 필요한 경우 알림 쿼리에 추가하세요.",
         "thresholdColumnGuessed": "임계값이 {column}에 적용되었습니다. 의도한 값인지 확인하십시오.",
         "thresholdNotCarried": "다른 쿼리를 선택했기 때문에 차트의 임계값 {value}이(가) 적용되지 않았습니다.",
-        "rumFunnelExclusions": "현재 시점의 이 앱의 앱 필터를 사용합니다. 필터가 변경되면 다시 생성하세요."
+        "rumFunnelExclusions": "현재 시점의 이 앱의 앱 필터를 사용합니다. 필터가 변경되면 다시 생성하세요.",
+        "tracesSeedMatches": "최근 {minutes}분 동안 일치하는 스팬이 {threshold}개를 초과하면 발생합니다(현재 {current}개).",
+        "tracesSeedSpans": "최근 {minutes}분 동안 스팬이 {threshold}개를 초과하면 발생합니다(현재 {current}개).",
+        "tracesSeedTraces": "최근 {minutes}분 동안 트레이스가 {threshold}개를 초과하면 발생합니다(현재 {current}개).",
+        "tracesSeedErrorSpans": "최근 {minutes}분 동안 오류 스팬이 {threshold}개를 초과하면 발생합니다(현재 {current}개).",
+        "tracesSeedErrorTraces": "최근 {minutes}분 동안 오류가 있는 트레이스가 {threshold}개를 초과하면 발생합니다(현재 {current}개).",
+        "tracesSeedErrorRatio": "최근 {minutes}분 동안 오류율이 {threshold}%를 초과하면 발생합니다(현재 {current}%).",
+        "tracesErrorRatioMinSpans": "최소 {minimum}개의 스팬이 있는 구간만 확인하므로, 한산한 기간의 몇몇 실패로는 발생하지 않습니다.",
+        "tracesErrorRatioMinTraces": "최소 {minimum}개의 트레이스가 있는 구간만 확인하므로, 한산한 기간의 몇몇 실패로는 발생하지 않습니다.",
+        "tracesSeedDuration": "최근 {minutes}분 동안 {percentile} 지속 시간이 {threshold}ms를 초과하면 발생합니다(현재 {current}ms).",
+        "tracesSeedUnavailable": "현재 값을 읽을 수 없어 임계값이 0에서 시작합니다. 저장하기 전에 설정하세요.",
+        "tracesNoMatches": "아직 일치하는 스팬이 없어, 하나라도 나타나면 알림이 즉시 발생합니다.",
+        "tracesStoredSpans": "개수는 저장된 스팬 기준이므로 샘플링된 트래픽은 실제보다 낮게 집계됩니다.",
+        "tracesPeriodCapped": "각 검사를 빠르게 유지하기 위해 알림 기간이 {minutes}분으로 제한되었습니다.",
+        "tracesNotRun": "이 검색은 아직 실행되지 않았으므로 알림은 편집기의 필터를 사용합니다."
       }
     },
     "saveFailed": "알림을 저장할 수 없습니다.",
@@ -13906,6 +14272,8 @@
       "noMatch": "현재 필터와 일치하는 메트릭이 없습니다",
       "noMatchHint": "라벨 필터를 제거하거나, 접두사/접미사 선택을 지우거나, \"데이터 있음\"에서 \"전체\"로 전환해 보세요.",
       "noMatchHintFavorites": "레이블 필터를 제거하거나 “With data”에서 “All”로 전환해 보십시오.",
+      "noMatchYet": "아직 데이터가 있는 메트릭을 찾지 못했습니다",
+      "noMatchYetHint": "지금까지 확인한 메트릭에서 데이터가 반환되지 않았습니다. 계속 찾으려면 더 표시하세요.",
       "clearAllFilters": "모든 필터 지우기",
       "emptyActions": {
         "clearSearch": "검색 지우기",
@@ -14122,7 +14490,8 @@
       "panelAdded": "대시보드에 패널이 추가되었습니다",
       "errorAddingPanel": "패널 추가 중 오류 발생",
       "selectDashboard": "대시보드를 선택하세요",
-      "selectTab": "탭을 선택하세요"
+      "selectTab": "탭을 선택하세요",
+      "panelsToAdd": "추가할 패널"
     },
     "groups": {
       "compute": "컴퓨팅",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "기타"
   },
   "traces": {
+    "nlNeedsSql": "이 질문에는 SQL이 필요합니다. 로그에서 여세요.",
+    "redActions": {
+      "menuGroupDashboards": "대시보드",
+      "addRedToDashboard": "대시보드에 RED 차트 추가",
+      "durationActions": "지속 시간 작업",
+      "bucketNotice": {
+        "seconds": "이 차트들은 현재 표시되는 {count}초 막대를 유지합니다.",
+        "minutes": "이 차트들은 현재 표시되는 {count}분 막대를 유지합니다.",
+        "hours": "이 차트들은 현재 표시되는 {count}시간 막대를 유지합니다.",
+        "days": "이 차트들은 현재 표시되는 {count}일 막대를 유지합니다."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "이 차트는 현재 표시되는 {count}초 막대를 유지합니다.",
+        "minutes": "이 차트는 현재 표시되는 {count}분 막대를 유지합니다.",
+        "hours": "이 차트는 현재 표시되는 {count}시간 막대를 유지합니다.",
+        "days": "이 차트는 현재 표시되는 {count}일 막대를 유지합니다."
+      }
+    },
     "latencyHeatmap": {
       "title": "지속 시간",
       "tooltipSpans": "{count}개 스팬 | {count}개 스팬",
@@ -15396,6 +15783,13 @@
     "nextMatch": "다음 일치 항목",
     "searchInSpans": "스팬에서 검색",
     "criticalPath": "크리티컬 패스",
+    "askAi": {
+      "explainTrace": "트레이스 설명",
+      "explainTraceHint": "크리티컬 패스에서 가장 느린 스팬과 모든 오류 스팬에 대해 AI에게 질문하세요",
+      "askAboutSpan": "이 스팬에 대해 AI에게 질문",
+      "spanChip": "스팬 · {operation}",
+      "traceChip": "트레이스 · {operation}"
+    },
     "spansTableView": "스팬 테이블 보기",
     "comingSoon": "곧 출시됩니다...",
     "fetchingTrace": "트레이스를 가져오는 중입니다.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "오류 필터링",
         "resetFilters": "필터 재설정",
         "errorsNone": "오류 없음 · {total} 턴",
-        "latencyLead": "가장 느린 {slowest} ·",
+        "latencyLead": "평균 턴 {avg} · 최장 {slowest} ·",
         "costLead": "피크 {peak} ·",
         "tokens": "{ratio}% 캐시됨",
         "cacheImpact": "{ratio}% 재사용 · {tokens} 톡 읽기",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "데이터 없음",
       "noErrorsInRange": "이 시간 범위에 오류가 없습니다",
+      "loadFailed": "최근 오류를 불러오지 못했습니다",
       "time": "시간",
       "service": "서비스",
       "operation": "작업",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "항상 활성(기본)",
     "testAtTimeLabel": "테스트할 UTC 시간",
     "testAtTimeHint": "비워두면 현재 시간을 사용합니다. 피크/오프피크 티어는 이 시간을 기준으로 결정됩니다.",
-    "localTimeHint": "내 시간대: {range}"
+    "localTimeHint": "내 시간대: {range}",
+    "builtInStatus": {
+      "seed": "내장 가격: 이 릴리스에 포함된 시드 목록, 기준일 {date}.",
+      "neverSynced": "서버가 시작된 이후 온라인 동기화가 실행되지 않았습니다.",
+      "lastSynced": "마지막 온라인 동기화 {time}."
+    },
+    "unpriced": {
+      "title": "가격 공백",
+      "subtitle": "수집 시점에 가격이 없거나 대략적인 가격만 있었던 LLM 트레이스의 모델",
+      "banner": "수집 시점에 {count}개 모델에 가격이 없거나 대략적인 가격만 있었습니다. 기록된 비용이 불완전할 수 있습니다. | 수집 시점에 {count}개 모델에 가격이 없거나 대략적인 가격만 있었습니다. 기록된 비용이 불완전할 수 있습니다.",
+      "bannerTruncated": "트레이스의 모델 {total}개는 수집 시점에 가격이 없거나 대략적인 가격만 있었습니다. 비용이 잘못되었을 수 있습니다. 토큰 기준 상위 {shown}개를 표시합니다.",
+      "streamLabel": "스트림",
+      "window": "최근 24시간",
+      "windowRange": "{from} – {to}",
+      "colModel": "트레이스에서 확인된 모델",
+      "colPricedAs": "적용 가격",
+      "colTokens": "토큰",
+      "colCost": "기록된 비용",
+      "colActions": "작업",
+      "spans": "{count}개 스팬 | {count}개 스팬",
+      "moreAgents": "+{count}개 더",
+      "noMatch": "일치 항목 없음",
+      "approximate": "대략적",
+      "pricedNow": "새 스팬에 가격 적용됨",
+      "historicalGap": "이 기간에는 기록된 가격 공백이 유지됩니다. 새 스팬에는 현재 가격이 적용됩니다.",
+      "noActionNeeded": "조치 필요 없음",
+      "defaultTierPrices": "1M당 입력 {input} / 출력 {output}",
+      "notPriced": "가격 없음",
+      "createPrice": "가격 생성",
+      "keepPrices": "{name} 가격 유지",
+      "mute": "음소거",
+      "muteConfirmTitle": "이 모델을 음소거할까요?",
+      "muteConfirmMessage": "{model}의 새 스팬은 무료로 가격이 책정됩니다. 이전 스팬은 기록된 비용을 유지합니다. 음소거를 해제하려면 \"{name}\" 가격을 삭제하세요.",
+      "mutedNotif": "{model} 음소거됨",
+      "keptNotif": "{model}이(가) 이제 {name} 가격을 사용합니다",
+      "errSave": "가격을 저장하지 못했습니다",
+      "errLoad": "가격이 없는 모델을 불러오지 못했습니다",
+      "emptyTitle": "이 기간 동안 이 스트림에서 가격이 없거나 대략적인 모델 사용량이 기록되지 않았습니다.",
+      "noStreamsTitle": "LLM 트레이스 스트림 없음",
+      "noStreamsDesc": "gen_ai 스팬이 트레이스 스트림에 도달하면 여기에 모델이 표시됩니다.",
+      "recordedCostNote": "새 가격은 저장한 후 수집된 스팬에 적용됩니다. 이전 스팬은 기록된 비용을 유지합니다.",
+      "noModelName": "(모델 이름 없음)",
+      "noModelHint": "가격을 책정할 모델이 없습니다: gen_ai.request.model을 설정하세요",
+      "instrumentationDocs": "계측 가이드"
+    }
   },
   "aiObservability": {
     "title": "AI 옵저버빌리티",
@@ -17238,6 +17677,8 @@
       "skipTiers": "건너뛴 행: {full} 완전히 · {partial} 부분적으로",
       "scoreEvidence": "{scorer} · v{version}: 샘플 {samples}개, 참조 없음 {noReference}개, 트레이스 없음 {noTrace}개",
       "scorerApplicability": "{scorer} · v{version}: 적격 슬롯 {eligible}개, 참조 없음 {noReference}개",
+      "costUnknown": "비용 알 수 없음",
+      "costAtLeast": "≥ {cost}",
       "loadError": "실험을 불러오지 못했습니다",
       "previewError": "실험 슬롯을 미리보지 못했습니다",
       "createSuccess": "실험 생성됨",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "이 실험은 약 {cost}의 비용이 예상되며, 경고 임계값인 {threshold}를 초과합니다. 그래도 생성하고 실행하시겠습니까?",
         "costConfirmMessageUnpriced": "이 실험은 예상 비용이 경고 임계값을 초과합니다. 그래도 생성하고 실행하시겠습니까?",
         "costConfirmOk": "그래도 생성",
+        "taskProviderFailed": "아무것도 생성되지 않았습니다. 작업 제공자 {provider}이(가) 테스트 호출에 응답하지 않았습니다.",
+        "judgeProviderFailed": "아무것도 생성되지 않았습니다. 심사자 제공자 {provider}이(가) 테스트 호출에 응답하지 않았습니다.",
         "skippedFully": "{count}개 행이 완전히 건너뛰어졌습니다. 선택한 모든 스코어러에는 예상 출력이 필요합니다. 건너뛴 행은 실행 비용이 들지 않습니다.",
         "skippedPartially": "{count}개 행이 부분적으로 건너뛰어졌습니다. 작업은 계속 실행되지만, 참조 기반 스코어러는 예상 출력이 없는 행을 점수화할 수 없습니다.",
         "skippedNone": "일치하는 모든 행은 최소 하나의 차원에서 점수화될 수 있습니다.",
@@ -17408,7 +17851,26 @@
           "trials": "시도",
           "dispersion": "분산도",
           "latency": "지연 시간",
-          "p50Latency": "P50 지연 시간"
+          "p50Latency": "P50 지연 시간",
+          "error": "오류"
+        },
+        "failureBanner": {
+          "title": "{total}개 슬롯 중 {failed}개가 실패했습니다: {cause}.",
+          "cause": "주요 원인, {count}개 슬롯: {message}",
+          "moreCauses": "+ 추가 원인 {count}개",
+          "noMessage": "오류 메시지가 기록되지 않았습니다",
+          "openProviders": "공급자 열기"
+        },
+        "failureKinds": {
+          "provider_auth": "공급자가 자격 증명을 거부했습니다",
+          "rate_limited": "공급자가 실행에 속도 제한을 적용했습니다",
+          "timeout": "공급자가 제시간에 응답하지 않았습니다",
+          "provider_5xx": "공급자가 서버 오류를 반환했습니다",
+          "parse_error": "출력을 파싱할 수 없습니다",
+          "mapping_error": "작업 입력을 구성할 수 없습니다",
+          "scorer_missing": "스코어러가 더 이상 존재하지 않습니다",
+          "execution_error": "작업 호출에 실패했습니다",
+          "unknown": "작업 호출에 실패했습니다"
         },
         "saveAsPrompt": "프롬프트로 저장",
         "openPrompt": "프롬프트 열기",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "환경",
       "agent": "에이전트",
-      "version": "버전"
+      "version": "버전",
+      "agentIdHint": "에이전트 ID: {ids}",
+      "noAgentIdentity": "에이전트 ID를 찾을 수 없습니다",
+      "noAgentIdentityDescription": "이 LLM 스팬에는 에이전트 이름이 없어 스트림별로 표시됩니다. 에이전트별로 보려면 에이전트 이름을 지정하는 속성을 매핑하세요.",
+      "noAgentIdentityAction": "GenAI 에이전트 매핑 열기"
     },
     "agentGraph": {
       "stream": "스트림",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "이 서버에서는 평가가 비활성화되어 있습니다",
+      "description": "이 페이지에는 온라인 평가가 필요하지만 이 서버에서는 사용 중지되어 있습니다. 관리자에게 활성화를 요청하세요."
+    },
     "traceScoreChip": {
       "reasoning": "이유",
       "noReasoning": "이 점수에 대한 추론이 기록되지 않았습니다.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "엔드포인트 구성"
     },
     "provider": {
-      "backTo": "공급자로 돌아가기",
+      "backTo": "공급자",
       "createTitle": "LLM 공급자 생성",
       "editTitle": "LLM 공급자 편집",
       "subtitle": "LLM 심사자 스코어러가 사용하는 모델 엔드포인트를 구성합니다.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "스코어러 {index}: 이름 \"{name}\"이(가) 이 가져오기에서 두 번 이상 사용되었습니다."
         }
       },
-      "backTo": "스코어러로 돌아가기",
+      "backTo": "스코어러",
       "badgeRemote": "리모트",
       "badgeLlm": "LLM 심사자",
       "createTitleRemote": "새 원격 스코어러",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "공급자 선택",
       "modelLabel": "모델",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperature",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0~2. 비워 두면 0으로 심사합니다.",
       "promptLabel": "심사 프롬프트",
       "includeReasoningLabel": "추론 포함",
       "includeReasoningHint": "심사자가 해당 점수를 부여한 이유를 설명하며, 각 결과와 함께 저장됩니다.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "헤더 이름은 필수입니다",
         "apiKeyTokenRequired": "토큰은 필수입니다",
         "timeoutInvalid": "타임아웃은 0 이상이어야 합니다",
+        "temperatureInvalid": "Temperature 값은 0에서 2 사이여야 합니다",
         "retriesInvalid": "재시도 횟수는 0 이상이어야 합니다",
         "duplicateFieldName": "필드 이름은 고유해야 합니다"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "저하됨",
         "waitingForCredentials": "자격 증명 대기 중",
         "noRecentRuns": "최근 실행 없음",
+        "lastScored": "마지막 채점: {time}",
         "summary": "최근 15분 동안 {runs}회 실행 중 {errors}회 실패했습니다",
         "since": "{time}에 이 상태가 되었습니다",
         "checked": "마지막 확인: {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "일치하는 대상의 {percent}%를 평가합니다.",
       "samplingValueAllHelp": "모든 일치하는 대상이 평가됩니다.",
       "samplingHelp": "필터링 후 실행되어 비용을 제어합니다.",
-      "backTo": "평가 작업으로 돌아가기",
+      "backTo": "평가 작업",
       "createTitle": "새 평가 작업",
       "editTitle": "평가 작업 업데이트",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "이 분기는 이미 대상에서 끝납니다.",
       "chooseATriggerNodeToStart": "워크플로우를 시작하려면 트리거 노드를 선택하세요.",
       "thisConnectionWouldCreateALoop": "이 연결은 루프를 만들 수 있습니다.",
-      "onlyOneIncomingConnectionToA": "단계에 들어오는 연결은 하나만 허용됩니다."
+      "onlyOneIncomingConnectionToA": "단계에 들어오는 연결은 하나만 허용됩니다.",
+      "endpointUrlCopied": "엔드포인트 URL이 복사되었습니다"
     },
     "views": {
       "youAreNotAuthorizedToManage": "라이선스를 관리할 권한이 없습니다.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "데이터베이스 또는 서비스 검색…",
       "unnamedInstance": "인스턴스 이름 없음",
+      "schemaCount": "{count}개 스키마 | {count}개 스키마",
       "unnamedInstanceHint": "데이터베이스 자체의 명령문 보고서는 이 엔진이 실행 중임을 증명하지만 호스트 이름을 명명하지 않습니다. 호스트 정보를 전달하는 피드(세션 샘플링 또는 인스턴스 메트릭)가 설정되면 행에 주소가 표시됩니다.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "{time}까지 집계됨; 마지막 30초는 아직 수신 중입니다.",
       "lineExact": "모든 데이터베이스가 보고 중입니다. 여기의 속도는 모든 호출에 걸쳐 측정되므로 정확합니다.",
       "lineExactEstimated": "모든 데이터베이스가 보고 중입니다. 여기의 속도는 여러 시간 구간에서 혼합되었으므로 정확하지는 않지만 근접합니다.",
+      "lineExactSlowestSchema": "모든 데이터베이스가 보고 중입니다. 속도는 스키마별로 정확하며, 스키마가 여러 개인 데이터베이스는 가장 느린 스키마를 표시합니다.",
       "lineSubsetUnnamed": "필터가 이 합계가 집계되는 수준보다 좁혀지므로 백분율은 전체 데이터베이스가 아닌 표시된 행을 설명합니다.",
       "lineQuery": "타이밍은 애플리케이션에서 측정되므로 네트워크 시간과 사용 가능한 연결을 기다리는 시간이 포함됩니다.",
       "lineUncodedErrors": "여기 실패의 {percent}는 이유 코드 없이 반환되어 계산할 수는 있지만 설명할 수는 없습니다.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "이 알림이 처음 발생했습니다.",
     "escalationNotStarted": "아직 호출되지 않음",
     "escalationPagesNobody": "아무도 호출하지 않음",
+    "escalationNobodyPaged": "현재 호출 중인 사람이 없습니다",
     "escalationTo": "{who}에게 {when} 에스컬레이션됩니다",
     "escalationDetailCapped": "실시간 에스컬레이션 상세는 가장 오래된 미해결 호출 {count}개에 대해 로드됩니다.",
     "responder": "응답자",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "종료",
     "rotationRestrictionAdd": "시간 범위 추가",
     "rotationRestrictionRemove": "제거",
-    "rotationRestrictionZeroLength": "시작과 종료가 같으면 이 시간 범위는 일치하지 않으며 해당 레이어는 결코 적용되지 않습니다. 하루 종일 적용하려면 종료를 24:00으로 설정하세요.",
+    "rotationRestrictionZeroLength": "시작과 종료가 같아서 이 시간 범위는 절대 일치하지 않습니다. 시작과 종료가 달라질 때까지 저장은 꺼진 상태로 유지됩니다. 하루 종일 적용하려면 종료를 24:00으로 설정하세요.",
     "rotationRetiredTag": "중지됨",
     "rotationSectionWhen": "교대 시점",
     "rotationName": "로테이션 이름",
@@ -25593,6 +26072,10 @@
     "snoozed": "스누즈됨",
     "snoozedUntil": "{time}까지 일시 중지됨 — 아직 할당되지 않음",
     "snoozeFailed": "호출을 일시 중지하지 못했습니다",
+    "unsnooze": "스누즈 해제",
+    "unsnoozeHint": "지금 스누즈를 종료합니다. 호출은 중단된 단계부터 계속됩니다.",
+    "unsnoozed": "스누즈가 종료되었습니다 · 호출이 계속됩니다",
+    "unsnoozeFailed": "스누즈를 종료할 수 없습니다",
     "note": "메모",
     "notePlaceholder": "무엇을 발견했나요? 무엇을 시도했나요?",
     "addNote": "메모 추가",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "같은 인원이 한 교대 뒤로 배치되므로, 보조 담당자는 이미 당직인 사람이 아닙니다. 이는 일반적인 로테이션이며, 둘 사이에 연결 관계가 없습니다. 따라서 한 명단만 편집하고 다른 명단을 편집하지 않으면 서로 어긋날 수 있으며, 경고가 표시될 뿐 자동으로 고쳐지지 않습니다.",
     "rotationPreviewPairLegend": "1차 · 2차",
     "rotationPreviewEmpty": "인원과 첫 인계를 선택하면 언제 누가 당직인지 확인할 수 있습니다.",
+    "rotationPreviewNow": "지금 – {until}",
     "defaultRotationName": "로테이션",
     "teamCreatedWithoutMembers": "팀이 생성되었지만 구성원을 추가할 수 없었습니다. 구성원 탭에서 추가하십시오.",
     "teamCreatedWithoutRotation": "팀과 구성원이 생성되었지만 로테이션을 저장할 수 없었습니다. 일정 탭에서 설정하십시오.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "아무도 수신 확인하지 않음 — 아직 호출 중",
     "sectionHint_ringingRouted": "아무도 확인하지 않음 — {count}건이 아직 호출 중 | 아무도 확인하지 않음 — {count}건이 아직 호출 중",
     "sectionHint_ringingUnrouted": "{count}건은 팀이 없어 호출되지 않음 | {count}건은 팀이 없어 호출되지 않음",
+    "sectionHint_ringingStopped": "{count}명은 호출되지 않습니다 | {count}명은 호출되지 않습니다",
     "sectionHint_snoozed": "호출 일시 중지 — 자동으로 다시 호출됨",
     "sectionHint_handled": "수신 확인됨 — 각 항목에 담당자가 있음",
     "sectionHint_resolved": "종료됨 — 기록으로 보관됨",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "신호가 일치할 때 호출되는 팀입니다. 이 팀의 에스컬레이션 래더가 호출 대상과 순서를 결정합니다.",
     "scopeOwns": "이 팀이 소유",
     "scopeAdvanced": "고급",
-    "ruleEditorConflictUnclaimed": "현재 이 경로를 소유한 규칙이 없습니다 — 일치하는 호출은 기본 팀 또는 아무에게도 도달하지 않습니다.",
+    "ruleEditorConflictUnclaimed": "현재 이 경로를 처리하는 규칙이 없습니다. 이 조건만으로 판단하면 이 경로와 일치하는 호출은 catch-all로 전달되거나 아무에게도 전달되지 않습니다.",
     "ruleEditorConflictHeldBy": "현재 이 경로와 일치하는 호출은 {team}에게 {path}를 통해 전달됩니다.",
     "ruleEditorConflictTakesOver": "규칙이 더 많은 조건을 지정하므로 {team}으로부터 이 경로를 가져옵니다.",
     "ruleEditorConflictKeptBy": "{team}이 보유한 경로가 더 많은 조건을 지정하므로 해당 팀이 이를 유지하며, 이 규칙은 남은 항목만 처리합니다.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service}는 {scope}에서만 이 팀을 호출합니다. 다른 곳에서는 해당 범위를 소유한 팀에게 전달됩니다.",
     "scopeNothingDiscovered": "아직 발견된 항목이 없어 선택할 수 있는 대상이 없습니다. 고급을 사용해 필드로 규칙을 작성하거나, 먼저 일부 텔레메트리를 보내십시오.",
     "scopeAdvancedHint": "상위 수준에서 다루지 않는 필드와 값을 포함하여 모든 필드와 값에 매칭할 수 있습니다.",
+    "scopeValuesSeen": "이 목록은 서비스 디스커버리에서 확인된 값을 보여줍니다. 다른 값을 일치시키려면 고급을 사용하세요.",
     "escalationHeld": "AI 트리아지 먼저 · {n}초 이내 호출",
     "escalationPagingStep": "{total}단계 중 {step}단계 호출 중 · {who}",
     "escalationPagingStepOnly": "{total}단계 중 {step}단계 호출 중",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "팀 및 로테이션 만들기",
     "removeMemberHandsOver": "{rotation}에서 {leaving}님의 현재 교대를 {name}님이 이어받습니다.",
     "removeMemberLeavesGap": "{rotation}에서 {leaving}님의 현재 교대를 아무도 이어받지 않습니다.",
+    "removeMemberReorders": "이 멤버는 {rotations}에서도 제외되므로 해당 로테이션의 온콜 담당자도 바뀔 수 있습니다.",
     "membersJoinEnd": "{names}님이 {rotations}의 맨 끝에 추가됩니다. 현재 온콜 담당자는 바뀌지 않습니다. | {names}님이 {rotations}의 맨 끝에 추가됩니다. 현재 온콜 담당자는 바뀌지 않습니다.",
     "membersAdded": "{names}님을 추가했습니다. | {names}님을 추가했습니다.",
     "removeMemberConfirm": "제거",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "문의: {contact}",
       "outboundQueue": "알림 메시지: {count}개 대기 중, 가장 오래된 것 {age} | 알림 메시지: {count}개 대기 중, 가장 오래된 것 {age}",
       "outboundEmpty": "대기 중인 알림 메시지 없음",
+      "refusedPosts": "{count}개의 알림 게시물이 지난 24시간 동안 실패했습니다. 마지막: {destination}에서 {reason}, | {count}개의 알림 게시물이 지난 24시간 동안 실패했습니다. 마지막: {destination}에서 {reason},",
       "ageSeconds": "{count}초"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "리마인드를 보낼 수 없습니다."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(모델 이름 없음)",
+    "topModels": "{models} (전체 {total}개 중 상위 {shown}개)",
+    "cost": {
+      "partial": "부분",
+      "unknown": "비용 알 수 없음",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "부분 비용입니다. {models}의 가격 정보가 없어 이 {scope}의 {tokens}개 토큰은 집계되지 않습니다.",
+      "unknownTooltip": "비용을 알 수 없습니다. {models}의 가격 정보가 없어 이 {scope}의 {tokens}개 토큰에는 비용이 없습니다.",
+      "scopeSession": "세션",
+      "scopeTrace": "트레이스",
+      "unknownModel": "이름 없는 모델",
+      "addPrice": "가격 추가"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens}개 토큰 가격 미책정",
+      "unpricedTooltip": "비용은 하한값입니다: {models}의 {tokens}개 토큰에 가격이 없습니다. LLM 모델 가격 책정에서 '가격 미책정' 탭을 여세요.",
+      "pricedSinceTooltip": "비용은 하한값입니다: {models}의 {tokens}개 토큰은 가격이 추가되기 전에 기록되어 비용이 없습니다."
+    },
+    "chart": {
+      "costMissing": "이 차트에 없음: {models}. {tokens}개 토큰에 가격이 없습니다.",
+      "costMissingPricedSince": "이 차트에 없음: {models}. {tokens}개 토큰은 가격이 추가되기 전에 기록되었습니다.",
+      "unpricedModels": "가격 미책정: {models}",
+      "pricedSinceModels": "가격 추가 전에 기록됨: {models}",
+      "addPrice": "가격 추가"
+    },
+    "health": {
+      "title": "데이터 상태",
+      "passing": "{n}개 통과",
+      "checkedAgo": "{ago} 확인됨",
+      "drawerTitle": "AI 데이터 상태",
+      "drawerSubtitle": "{stream} · 현재 기간",
+      "rerun": "검사 다시 실행",
+      "close": "닫기",
+      "loadError": "데이터 상태 검사를 실행할 수 없습니다.",
+      "samples": "샘플:",
+      "copyLink": "관리자용 링크 복사",
+      "linkCopied": "링크 복사됨",
+      "status": {
+        "pass": "통과",
+        "warning": "경고",
+        "error": "오류"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "가격 미책정 모델",
+          "detail": "{count}개 모델 · {spans}개 스팬 · {tokens}개 토큰이 $0로 집계됨 | {count}개 모델 · {spans}개 스팬 · {tokens}개 토큰이 $0로 집계됨",
+          "pass": "이 기간의 모든 모델에 가격이 있습니다. 가격이 추가되기 전에 기록된 스팬은 기록된 비용을 유지합니다.",
+          "fix": "LLM 모델 가격 책정에서 수정",
+          "truncated": "토큰 기준 상위 {shown}/{total}"
+        },
+        "missing_agent_identity": {
+          "label": "에이전트 식별 정보 누락",
+          "detail": "{total}개 LLM 스팬 중 {affected}개({pct})에 gen_ai.agent.name이 없어 에이전트 뷰에서 누락됩니다.",
+          "pass": "모든 LLM 스팬에는 에이전트 이름 또는 ID가 있습니다.",
+          "fix": "GenAI 에이전트 매핑 열기"
+        },
+        "zero_duration_spans": {
+          "label": "지속 시간이 0인 스팬",
+          "detail": "{affected}개 LLM 스팬이 0ms로 보고되어 지연 시간과 세션 기간이 너무 낮게 표시됩니다.",
+          "pass": "0ms로 보고되는 LLM 스팬이 없습니다.",
+          "fix": "해결 방법"
+        },
+        "missing_session_id": {
+          "label": "세션 ID가 없는 스팬",
+          "detail": "{total}개 LLM 스팬 중 {affected}개({pct})에 gen_ai.conversation.id가 없어 세션에서 누락됩니다.",
+          "pass": "모든 LLM 스팬에 gen_ai.conversation.id가 있습니다.",
+          "fix": "통합 가이드"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "플릿 관리",
     "subtitle": "OpenTelemetry 수집기를 등록하고, 구성을 버전으로 관리하며, 변경 사항을 안전하게 롤아웃하세요",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "진행 중",
       "scheduled": "예약됨",
+      "waiting": "대기 중",
       "completed": "완료됨",
       "halted": "중단됨",
       "superseded": "대체됨",
@@ -28696,7 +29257,7 @@
       "version": "버전",
       "pickConfig": "구성 선택",
       "pickFleet": "플릿 선택",
-      "emptyFleet": "플릿에 수집기가 없으므로 버전이 즉시 설정됩니다",
+      "emptyFleet": "플릿에 컬렉터가 없어 하나가 참여할 때까지 롤아웃이 대기합니다",
       "startingShortly": "곧 시작됩니다",
       "eventGateFailed": "상태 게이트 실패",
       "eventHalted": "중단됨",
@@ -28707,7 +29268,10 @@
       "notFound": "이 롤아웃이 더 이상 존재하지 않습니다",
       "notFoundDescription": "링크가 오래되었을 수 있습니다. 목록에서 롤아웃을 선택하세요.",
       "noneTargeted": "대상 수집기 없음",
-      "outcomeNoneTargeted": "v{to}가 설정되었을 때 플릿에 수집기가 없었습니다.",
+      "outcomeNoneTargeted": "이번 롤아웃에서 v{to}를 받은 컬렉터가 없습니다.",
+      "outcomeWaiting": "온라인 상태인 컬렉터가 없어 아직 v{to}가 어떤 컬렉터에도 적용되지 않았습니다. 하나가 연결되면 롤아웃이 시작됩니다.",
+      "waitingForCollector": "컬렉터 대기 중",
+      "notStarted": "시작되지 않음",
       "versionFailedBefore": "v{version} · 이전에 실패함",
       "pickVersion": "버전 선택",
       "autoRollback": "자동으로 롤백",
@@ -28732,6 +29296,7 @@
       "eventResumed": "재개됨",
       "eventSkipped": "실패한 수집기 건너뜀",
       "eventStarted": "시작됨",
+      "eventWaiting": "컬렉터가 온라인 상태가 되기를 기다리는 중",
       "eventTimedOut": "단계 시간 초과",
       "eventSkippedOffline": "시작 시 오프라인이던 수집기 {count}개를 제외했습니다. 다시 연결되면 해당 버전을 받습니다 | 시작 시 오프라인이던 수집기 {count}개를 제외했습니다. 다시 연결되면 해당 버전을 받습니다",
       "excluded": "제외됨",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "{minutes}분 안에 확인도 거부도 하지 않는 단계가 있으면 롤아웃이 중단됩니다 (플릿 설정)",
       "phaseVerifying": "검증 중",
       "phases": "단계",
-      "planEmpty": "업데이트할 수집기 없음",
+      "planEmpty": "온라인 상태인 컬렉터가 없어 하나가 연결될 때까지 롤아웃이 대기합니다",
+      "planStable": "온라인 상태인 수집기가 없습니다. 각 수집기가 연결되면 안정 버전이 적용됩니다",
       "planOne": "단일 배치로 수집기 {count}개 | 단일 배치로 수집기 {count}개",
       "planText": "{steps} → 나머지 {last}, {count}단계",
       "planUnavailable": "계획 미리보기를 사용할 수 없습니다",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0이면 오프라인 수집기를 영구 보관합니다"
     },
     "audit": {
-      "search": "감사 추적 검색",
       "editedConfig": "구성 편집함",
       "revokedToken": "등록 토큰 해지함",
       "enrolledCollector": "수집기 등록함",
@@ -28920,7 +29485,6 @@
       "setDesired": "버전 변경함",
       "autoRollback": "자동 롤백됨",
       "rolloutHalted": "롤아웃 중단됨",
-      "assignedFleetConfig": "플릿의 구성 할당함",
       "createdFleet": "플릿 생성함",
       "renamedFleet": "플릿 이름 변경함",
       "deletedFleet": "플릿 삭제함",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "롤아웃 롤백함",
       "movedByToken": "등록 토큰으로 이동됨",
       "object": "객체",
+      "search": "감사 추적 검색",
       "allObjects": "모든 객체",
       "kind": {
         "fleet": "플릿",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "v{to} 롤아웃 중",
       "rolloutHalted": "v{to} 롤아웃 중단됨",
+      "rolloutWaiting": "v{to}은(는) 수집기가 온라인 상태가 되기를 기다립니다",
       "autoRolledBack": "v{to}이(가) 자동으로 롤백됨",
       "noReason": "보고된 실패 사유 없음",
       "openRollout": "롤아웃 열기",
diff --git a/web/src/locales/languages/nl-NL.json b/web/src/locales/languages/nl-NL.json
index 62d5619003..50d6c5692c 100644
--- a/web/src/locales/languages/nl-NL.json
+++ b/web/src/locales/languages/nl-NL.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Nog geen LLM-activiteit",
       "description": "Instrumenteer uw services met de OpenTelemetry Gen-AI semantische conventies en neem ten minste één trace op om dit dashboard te vullen.",
-      "action": "Instrument met OpenTelemetrie",
-      "actionDesc": "Leg gen_ai_*-attributen vast op uw traces"
+      "action": "Alle AI-integraties",
+      "actionDesc": "Bekijk alle gidsen voor frameworks en providers",
+      "suggested": "Tracing voor {name} instellen",
+      "suggestedDesc": "Aanbevolen omdat je van de {name}-documentatie komt",
+      "codingAgent": "Instrumenteer met een codeeragent",
+      "codingAgentDesc": "Je codeeragent voegt tracing toe en controleert de eerste trace",
+      "startFrom": "Of begin met"
     },
     "noLLMSessions": {
       "title": "Nog geen LLM-sessies",
@@ -4797,6 +4802,13 @@
       "success": "Succes",
       "failed": "Mislukt",
       "testRun": "Testrun",
+      "source": "Bron",
+      "sourceHttp": "HTTP-verzoek",
+      "sourceAlertFired": "Alarm afgegaan",
+      "sourceIncidentEvent": "Incidentgebeurtenis",
+      "sourceRetry": "Herhalingsuitvoering",
+      "sourceManual": "Handmatige uitvoering",
+      "sourceOther": "Overig",
       "runType": "Type",
       "testRunTooltip": "Gestart vanuit de editor. Bestemmingsstappen verzenden daadwerkelijk.",
       "showTestRuns": "Toon {count} testrun(s)",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Deze run opnieuw proberen?",
       "retryMessage": "Dit maakt een nieuwe run van de vastgelegde invoer van de mislukte run. Bestemmingsstappen verzenden daadwerkelijk.",
       "retryStarted": "De nieuwe poging is gestart — deze verschijnt in de lijst als een nieuwe run.",
-      "retryError": "Kan deze run niet opnieuw proberen."
+      "retryError": "Kan deze run niet opnieuw proberen.",
+      "statusQueued": "In wachtrij",
+      "statusRunning": "Wordt uitgevoerd",
+      "statusExpired": "Verlopen",
+      "reasonExpired": "nooit uitgevoerd · meer dan 1 u in wachtrij",
+      "reasonWorkerLost": "worker verloren · niet opnieuw uitgevoerd",
+      "reasonWorkflowDisabled": "workflow was uitgeschakeld",
+      "reasonRunTimeout": "time-out na 15 min",
+      "allTriggers": "Alle triggers",
+      "triggerFilter": "Trigger",
+      "run": "Uitvoering",
+      "searchRuns": "Zoek op uitvoerings-ID, idempotentiesleutel of alarm",
+      "sourceDetails": "Brondetails",
+      "detailsWithKey": "{ip} · sleutel {key}",
+      "detailsNoKey": "{ip} · geen idempotentiesleutel",
+      "retryOf": "Herhaling van {run}",
+      "openRun": "Uitvoering openen",
+      "alertFiredEmptyTitle": "Geen door een alarm gestarte uitvoeringen in dit tijdsbereik",
+      "incidentEventEmptyTitle": "Geen uitvoeringen door incidentgebeurtenissen in dit tijdsbereik",
+      "filterEmptyTitle": "Geen overeenkomende uitvoeringen in dit tijdsbereik",
+      "filterEmptyDimmed": "De andere uitvoeringen staan nog op de tijdlijn, gedimd.",
+      "searchEmptyTitle": "Geen uitvoeringen komen overeen met deze zoekopdracht",
+      "searchEmptyAction": "Zoekopdracht wissen",
+      "timelineNow": "nu",
+      "timelineAgoMinutes": "−{n}m",
+      "timelineAgoHours": "−{n}h",
+      "timelineAgoDays": "−{n}d"
     },
     "edit": "Bewerken",
     "view": "Bekijken",
@@ -4958,7 +4996,9 @@
           "noMatch": "Geen overeenkomst"
         },
         "suppressed": "Onderdrukt — niet naar de echte bestemming verzonden"
-      }
+      },
+      "payloadFrom": "Payload van",
+      "payloadFromHint": "Het HTTP-formaat is wat aanroepers van het endpoint versturen."
     },
     "linkAlerts": {
       "title": "Workflow koppelen aan meldingen",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Uitvoerformaat",
       "tlsVerifyLabel": "TLS-verificatie",
       "tlsDisabled": "Uitgeschakeld"
+    },
+    "http": {
+      "runTestHint": "Voert de stappen uit met een voorbeeld-HTTP-payload; roept de URL niet aan",
+      "runTestHintList": "Open de workflow om een test uit te voeren",
+      "runsEmptyTitle": "Geen HTTP-verzoeken in dit tijdsbereik",
+      "runsEmptyBody": "Vergroot het tijdsbereik of stuur een testverzoek vanuit het paneel HTTP-endpoint.",
+      "runsEmptyAction": "Alle triggers tonen",
+      "runFailedAt": "Deze uitvoering is mislukt bij {step}: {error}",
+      "openStep": "Stap openen",
+      "runGuardHint": "HTTP-uitvoeringen bevatten het verzoek, niet de alarmvelden. Als deze stap {fields} leest, bescherm hem dan met een Voorwaarde: {guard}.",
+      "runExpiredBanner": "Dit verzoek heeft meer dan 1 uur in de wachtrij gestaan en is nooit uitgevoerd. Er is geen stap uitgevoerd en er is geen bestemming aangeroepen.",
+      "runWorkerLostBanner": "De worker die dit verzoek uitvoerde, is gestopt. Het wordt niet automatisch opnieuw uitgevoerd, omdat bestemmingen mogelijk al zijn aangeroepen. Controleer ze voordat de aanroeper opnieuw verzendt.",
+      "request": "Verzoek",
+      "requestReceived": "Ontvangen",
+      "requestToken": "Token",
+      "requestCallerIp": "IP van aanroeper",
+      "requestIdempotencyKey": "Idempotentiesleutel",
+      "requestContentType": "Contenttype",
+      "requestBodySize": "Bodygrootte",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Headers",
+      "headersKept": "{count} behouden · Authorization, cookies en handtekeningen worden nooit opgeslagen | {count} behouden · Authorization, cookies en handtekeningen worden nooit opgeslagen",
+      "headerName": "Naam",
+      "headerValue": "Waarde",
+      "outputCaption": "Wat elke downstreamstap heeft ontvangen",
+      "useAsTestInput": "Als testinvoer gebruiken",
+      "editorButton": "HTTP-endpoint",
+      "editorButtonOn": "Aan",
+      "editorButtonOff": "Uit",
+      "editorButtonTooltip": "Laat een ander systeem deze workflow starten met een HTTP-verzoek",
+      "editorButtonRefusedDraft": "Verzoeken krijgen 403 totdat de workflow is gepubliceerd",
+      "editorButtonRefusedPaused": "Verzoeken krijgen 403 zolang de workflow is gepauzeerd",
+      "panelTitle": "HTTP-endpoint",
+      "panelSubtitle": "{name} · {kind}-workflow",
+      "acceptRequests": "HTTP-verzoeken accepteren",
+      "kindNote": "De stappen van deze workflow zijn gebouwd voor {kind}-uitvoeringen. HTTP-uitvoeringen krijgen in plaats daarvan het verzoek ({field}), dus voeg een Voorwaarde toe als een stap {kind}-velden nodig heeft.",
+      "kindNotePayload": "Toon de HTTP-payload",
+      "kindNotePayloadHide": "Verberg de HTTP-payload",
+      "unsavedBody": "Deze workflow is nog niet opgeslagen. Sla hem op als concept om de URL en het token ervan aan te maken. Verzoeken worden geweigerd totdat je publiceert.",
+      "saveAndCreate": "Concept opslaan en endpoint aanmaken",
+      "needsAdmin": "Voor het aanmaken van het endpoint is een organisatiebeheerder nodig.",
+      "needsEdit": "Om het te wijzigen is bewerktoegang tot deze workflow nodig.",
+      "readOnlyOnMeta": "Aan · je kunt de URL kopiëren. Om het endpoint te wijzigen is bewerktoegang tot deze workflow nodig.",
+      "offBody": "Laat een ander systeem deze workflow starten met een HTTP-verzoek. Je krijgt een URL en een token.",
+      "offExistingBody": "Uit · verzoeken worden geweigerd (403) totdat je het inschakelt.",
+      "onMeta": "Aan · uitvoeringen starten alleen zolang de workflow is ingeschakeld en gepubliceerd",
+      "loadError": "Kon de instellingen van het endpoint niet laden.",
+      "draftBanner": "Deze workflow is een concept. Aanroepen naar de URL krijgen 403 totdat je publiceert. Je kunt het endpoint nu instellen; met Test uitvoeren voer je de stappen van het concept uit met een voorbeeld-HTTP-payload.",
+      "disabledBanner": "Verzoeken worden geweigerd (403) totdat je de workflow inschakelt.",
+      "turnOnFailed": "Kon het endpoint niet inschakelen. {reason}",
+      "changeFailed": "Kon het endpoint niet opslaan. {reason}",
+      "endpointExistsHint": "Het endpoint bestaat al. Toon of kopieer het token uit de tabel Tokens.",
+      "endpointExistsHintSigned": "Het endpoint bestaat al. Toon of kopieer het ondertekeningsgeheim uit de tabel Ondertekeningsgeheimen.",
+      "disableTitle": "Het endpoint uitschakelen?",
+      "disableBody": "Aanroepers krijgen 403 (endpoint uit) totdat je het weer inschakelt. De URL en tokens blijven hetzelfde.",
+      "disableConfirm": "Uitschakelen",
+      "lastCall": "Aan · Laatste aanroep: {status} · {time} · {link}",
+      "lastCallNone": "Aan · Nog geen aanroepen — stuur een testverzoek",
+      "lastCallNoneRefused": "Aan · Nog geen aanroepen",
+      "viewRun": "Uitvoering bekijken",
+      "lastCallStatus": {
+        "queued": "in wachtrij",
+        "running": "in uitvoering",
+        "succeeded": "geslaagd",
+        "failed": "mislukt",
+        "expired": "verlopen"
+      },
+      "endpointUrl": "Endpoint-URL",
+      "tokenLabel": "Token",
+      "secretLabel": "Ondertekeningsgeheim",
+      "newTokenLabel": "Nieuw token",
+      "newSecretLabel": "Nieuw ondertekeningsgeheim",
+      "tokenHint": "Op het scherm gemaskeerd; Kopiëren kopieert het echte token. Verstuur het als {header}, nooit in de URL.",
+      "secretHint": "Op het scherm gemaskeerd; Kopiëren kopieert het echte geheim. Onderteken elk verzoek ermee en verstuur de {headers}-headers; verstuur het geheim zelf nooit.",
+      "revealBannerTitle": "Endpoint aangemaakt",
+      "revealBannerBody": "Verstuur dit token bij elk verzoek. Je kunt het opnieuw tonen of kopiëren vanuit de tabel Tokens.",
+      "revealBannerBodySigned": "Onderteken elk verzoek met dit geheim. Je kunt het opnieuw tonen of kopiëren vanuit de tabel Ondertekeningsgeheimen.",
+      "switchedBannerTitle": "Token aangemaakt",
+      "switchedBannerTitleSigned": "Ondertekeningsgeheim aangemaakt",
+      "rotateBannerTitle": "Nieuw token aangemaakt",
+      "rotateBannerTitleSigned": "Nieuw ondertekeningsgeheim aangemaakt",
+      "rotateBannerBody": "Aanroepers behouden dezelfde URL en header; alleen het token verandert. Het oude token blijft werken totdat het verloopt en kan tot dan worden getoond.",
+      "rotateBannerBodySigned": "Aanroepers behouden dezelfde URL en headers; alleen het geheim verandert. Het oude geheim blijft werken totdat het verloopt en kan tot dan worden getoond.",
+      "rotateBannerBodyRevoked": "Aanroepers behouden dezelfde URL en header; alleen het token verandert. Het oude token is ingetrokken en werkt nu niet meer.",
+      "rotateBannerBodyRevokedSigned": "Aanroepers behouden dezelfde URL en headers; alleen het geheim verandert. Het oude geheim is ingetrokken en werkt nu niet meer.",
+      "rotateBannerBodyFresh": "Aanroepers behouden dezelfde URL en header en versturen vanaf nu dit token.",
+      "rotateBannerBodyFreshSigned": "Aanroepers behouden dezelfde URL en headers en ondertekenen vanaf nu met dit geheim.",
+      "snippetsLabel": "Voorbeeldverzoek",
+      "sendTest": "Testverzoek versturen",
+      "sendTestHint": "Controleert de inloggegevens en toont wat je stappen zouden ontvangen. Er start geen uitvoering en er wordt geen bestemming aangeroepen.",
+      "sendTestHintPaused": "Controleert de inloggegevens. De workflow is gepauzeerd, dus de oproep wordt geweigerd voordat er invoer wordt opgebouwd; Test uitvoeren voert de stappen uit.",
+      "sendTestSigned": "Browsers kunnen verzoeken niet ondertekenen, dus test met het voorbeeldverzoek hierboven. Voeg ?dry_run=true toe aan de URL om de handtekening te controleren zonder een uitvoering te starten.",
+      "dryRunAccepted": "Dry run geaccepteerd",
+      "dryRunMeta": "inloggegevens geldig · {size} body",
+      "dryRunInput": "Invoer die je stappen zouden ontvangen",
+      "dryRunRefused": "Inloggegevens geldig. Verzoeken worden geweigerd totdat de workflow is gepubliceerd.",
+      "dryRunRefusedPaused": "Inloggegevens geldig. Verzoeken worden geweigerd zolang de workflow is gepauzeerd.",
+      "dryRunRateLimited": "Snelheidslimiet bereikt — dry runs tellen mee voor de limiet.",
+      "dryRunStatus": "Het verzoek is geweigerd met status {status}.",
+      "dryRunFailed": "Kon het testverzoek niet versturen. {reason}",
+      "runTestInstead": "Voer in plaats daarvan de test uit",
+      "done": "Gereed",
+      "regionTag": "Regio {name}",
+      "regionBanner": "Stuur elk verzoek, en elke herhaling, naar de host van deze regio. Idempotentiesleutels en uitvoeringsstatus ({field}) worden bewaard in de regio die de oproep heeft geaccepteerd, dus een herhaling naar een andere regio kan een tweede uitvoering starten.",
+      "authLabel": "Aanroepers authenticeren met",
+      "authToken": "Token",
+      "authSigned": "Ondertekende verzoeken",
+      "authAbout": "Over authenticatie",
+      "authInfo": "Token: verstuur het token in de Authorization-header. Ondertekende verzoeken: onderteken elk verzoek met een gedeeld geheim ({headers}-headers).",
+      "switchToSignedTitle": "Overschakelen naar ondertekende verzoeken?",
+      "switchToSignedBody": "Overschakelen trekt het huidige token nu in en maakt een ondertekeningsgeheim aan. Aanroepers die het token gebruiken, krijgen vanaf nu 401.",
+      "switchToTokenTitle": "Overschakelen naar token?",
+      "switchToTokenBody": "Overschakelen trekt het huidige ondertekeningsgeheim nu in en maakt een token aan. Aanroepers die verzoeken ondertekenen, krijgen vanaf dat moment 401.",
+      "tokensTitle": "Tokens",
+      "secretsTitle": "Ondertekeningsgeheimen",
+      "colToken": "Token",
+      "colSecret": "Geheim",
+      "colCreated": "Aangemaakt",
+      "colLastUsed": "Laatst gebruikt",
+      "colStatus": "Status",
+      "colActions": "Acties",
+      "never": "Nooit",
+      "active": "Actief",
+      "retiring": "Wordt uitgefaseerd",
+      "creatorGone": "Aanmaker is niet meer in deze organisatie",
+      "revoke": "Intrekken",
+      "revokeNow": "Nu intrekken",
+      "revokeTitle": "{prefix} intrekken? Aanroepers die het gebruiken, krijgen onmiddellijk 401.",
+      "revokeFailed": "Kon het niet intrekken. {reason}",
+      "copyToken": "Token kopiëren",
+      "copySecret": "Geheim kopiëren",
+      "tokenCopied": "Token gekopieerd",
+      "commandCopied": "Opdracht gekopieerd",
+      "secretCopied": "Geheim gekopieerd",
+      "revealFailed": "Kon het token niet tonen. {reason}",
+      "revealFailedSigned": "Kon het geheim niet tonen. {reason}",
+      "revealDenied": "Alleen beheerders kunnen tokens voor dit eindpunt tonen of kopiëren.",
+      "runTest": "Test uitvoeren",
+      "rotate": "Rouleren",
+      "rotateBlocked": "Trek eerst het uit te faseren token in",
+      "rotateBlockedSigned": "Trek eerst het uit te faseren geheim in",
+      "rotateTitle": "Token rouleren",
+      "rotateTitleSigned": "Ondertekeningsgeheim rouleren",
+      "rotateLead": "Er wordt nu een nieuw token aangemaakt. Laat {prefix} (laatst gebruikt {time}) nog werken gedurende",
+      "rotateLeadSigned": "Er wordt nu een nieuw ondertekeningsgeheim aangemaakt. Laat {prefix} (laatst gebruikt {time}) nog werken gedurende",
+      "overlapNow": "Trek het onmiddellijk in",
+      "overlapHour": "1 uur",
+      "overlapDay": "24 uur",
+      "overlapWeek": "7 dagen",
+      "rotateConsequence": "Aanroepers die het huidige token gebruiken, blijven werken tot {time}. Werk ze daarvoor bij.",
+      "rotateConsequenceSigned": "Aanroepers die met het huidige geheim ondertekenen, blijven werken tot {time}. Werk ze daarvoor bij.",
+      "rotateConsequenceNow": "Aanroepers die het huidige token gebruiken, krijgen vanaf nu 401.",
+      "rotateConsequenceNowSigned": "Aanroepers die met het huidige geheim ondertekenen, krijgen vanaf nu 401.",
+      "rotateConfirm": "Token rouleren",
+      "rotateConfirmSigned": "Ondertekeningsgeheim rouleren",
+      "rotateFailed": "Kon niet rouleren. {reason}",
+      "advanced": "Geavanceerd",
+      "advancedSummary": "Max. body {size} · {count} verzoek per minuut | Max. body {size} · {count} verzoeken per minuut",
+      "maxBody": "Max. bodygrootte (KiB)",
+      "maxBodyHint": "Maximaal 1024 (1 MiB); je kunt de waarde alleen verlagen",
+      "maxBodyRange": "Voer een heel getal van 1 tot 1024 in",
+      "rateLimit": "Verzoeken per minuut",
+      "rateLimitHint": "Tot {org} per minuut voor deze organisatie",
+      "rateLimitRange": "Voer een geheel getal in van 1 tot {org}",
+      "saveLimitsFailed": "Kon de limieten niet opslaan. {reason}",
+      "deleteMeta": "Verwijdert de URL en elk token of geheim.",
+      "deleteButton": "Eindpunt verwijderen",
+      "deleteTitle": "Dit eindpunt verwijderen?",
+      "deleteBody": "De URL werkt onmiddellijk niet meer: aanroepers krijgen 401. Alle tokens en ondertekeningsgeheimen worden verwijderd en kunnen niet worden hersteld. De uitvoeringsgeschiedenis blijft bewaard.",
+      "deleteFailed": "Kon het eindpunt niet verwijderen. {reason}",
+      "secretStorageWarning": "Deze server heeft geen encryptie-hoofdsleutel, dus tokens en ondertekeningsgeheimen worden opgeslagen in een vorm die iedereen met databasetoegang kan lezen. Vraag je beheerder er een in te stellen.",
+      "rejectionsLine": "Ongeveer {count} verzoek geweigerd in de afgelopen 24 u · laatste: {reason}, {time} | Ongeveer {count} verzoeken geweigerd in de afgelopen 24 u · laatste: {reason}, {time}",
+      "rejectionsShow": "Tonen",
+      "rejectionsHide": "Verbergen",
+      "rejectionsTitle": "Recente weigeringen",
+      "rejectionsCaption": "ongeveer {count} in de afgelopen 24 u · de aanroeper zag alleen de statuscode | ongeveer {count} in de afgelopen 24 u · de aanroeper zag alleen de statuscode",
+      "rejectionMeta": "ongeveer {count} · laatste {time} · van {ip} | ongeveer {count} · laatste {time} · van {ip}",
+      "rejectionsLoadError": "Kon de weigeringen niet laden.",
+      "raiseLimit": "Limiet verhogen",
+      "rotateLink": "Rouleren",
+      "reason": {
+        "invalid_token": {
+          "title": "Ongeldig token",
+          "fix": "De aanroeper stuurt een token dat is ingetrokken, verlopen of verkeerd getypt. Toon of kopieer het huidige token uit de tabel Tokens."
+        },
+        "invalid_signature": {
+          "title": "Ongeldige handtekening",
+          "fix": "De aanroeper ondertekent met een oud of verkeerd geheim. Controleer of het het huidige geheim gebruikt en {format} precies ondertekent zoals verzonden."
+        },
+        "stale_timestamp": {
+          "title": "Tijdstempel te oud",
+          "fix": "De klok van de aanroeper loopt meer dan 5 minuten af. Synchroniseer de klok en onderteken vlak voor het verzenden."
+        },
+        "endpoint_disabled": {
+          "title": "Eindpunt uit",
+          "fix": "Schakel het eindpunt in."
+        },
+        "workflow_disabled": {
+          "title": "Workflow gepauzeerd",
+          "fix": "Hervat de workflow vanuit de lijst."
+        },
+        "workflow_not_published": {
+          "title": "Workflow niet gepubliceerd",
+          "fix": "Publiceer de workflow; concepten weigeren verzoeken."
+        },
+        "payload_too_large": {
+          "title": "Payload te groot",
+          "fix": "Meer dan {size}. Verstuur minder, of verdeel de gebeurtenissen over meerdere verzoeken."
+        },
+        "credential_in_url": {
+          "title": "Inloggegevens in URL",
+          "fix": "Een token of geheim is in de URL verzonden en geweigerd. URL's komen in proxy- en browserlogs terecht, dus rouleer het nu en verstuur het daarna in een header."
+        },
+        "invalid_idempotency_key": {
+          "title": "Ongeldige idempotentiesleutel",
+          "fix": "De header Idempotency-Key is leeg of langer dan 255 tekens."
+        },
+        "idempotency_key_reused": {
+          "title": "Idempotentiesleutel hergebruikt",
+          "fix": "Dezelfde sleutel kwam binnen met een andere body. Gebruik een nieuwe sleutel per afzonderlijke gebeurtenis."
+        },
+        "rate_limited": {
+          "title": "Snelheidslimiet bereikt",
+          "fix": "Meer dan {count} verzoeken per minuut. Bundel gebeurtenissen in één verzoek (stuur een JSON-array), of verhoog de limiet — tot {org} per minuut voor deze organisatie."
+        },
+        "queue_full": {
+          "title": "Wachtrij vol",
+          "fix": "Deze organisatie had al {count} HTTP-uitvoeringen in de wachtrij. Aanroepers moeten het opnieuw proberen na de Retry-After-vertraging; zoek een trage stap of verlaag de verzendsnelheid."
+        },
+        "worker_unavailable": {
+          "title": "Worker niet beschikbaar",
+          "fix": "Er was geen workflow-worker actief in deze regio, dus er is niets in de wachtrij gezet. Aanroepers die het opnieuw proberen na de Retry-After-vertraging komen erdoor zodra er weer een worker is; als dit blijft gebeuren, vraag je beheerder de workflow-workers te controleren."
+        }
+      },
+      "nodeBadge": "Aanroepbaar via HTTP",
+      "triggerLinkOn": "Draait ook op HTTP-verzoeken",
+      "triggerLinkOnAction": "Eindpunt beheren",
+      "triggerLinkOff": "Start hem ook vanuit een ander systeem",
+      "triggerLinkOffAction": "HTTP-eindpunt instellen",
+      "pickerCue": "Elke workflow kan ook worden gestart met een HTTP-verzoek. Kies de trigger en gebruik vervolgens HTTP-eindpunt in de werkbalk.",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP-eindpunt aan",
+      "listMenuItem": "HTTP-eindpunt…",
+      "copyUrl": "Eindpunt-URL kopiëren",
+      "copyUrlDraftHint": "Verzoeken worden geweigerd totdat je publiceert",
+      "copyUrlFailed": "Kan de eindpunt-URL niet kopiëren. {reason}",
+      "payloadFrom": "Payload van",
+      "payloadHttp": "HTTP-verzoek",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "verloopt over {count} u | verloopt over {count} u",
+      "expiresInDays": "verloopt over {count} dag | verloopt over {count} dagen",
+      "expired": "Verlopen",
+      "rotateLeadUnused": "Er wordt nu een nieuw token aangemaakt. Houd {prefix} (nooit gebruikt) nog geldig voor",
+      "rotateLeadUnusedSigned": "Er wordt nu een nieuw ondertekeningsgeheim aangemaakt. Houd {prefix} (nooit gebruikt) nog geldig voor",
+      "fieldGroup": "HTTP-verzoek",
+      "fieldGroupBodyHint": "Velden in de body van het verzoek vereisen eerst een Function-stap",
+      "fieldGroupQueryHint": "Queryparameters zijn meta.query.<key>; herhaalde sleutels komen binnen als een lijst en matchen nooit",
+      "rotateLeadNone": "Er is geen actief token, dus aanroepers kunnen niet authenticeren. Er wordt nu een nieuw token aangemaakt.",
+      "rotateLeadNoneSigned": "Er is geen actief ondertekeningsgeheim, dus aanroepers kunnen niet authenticeren. Er wordt nu een nieuw ondertekeningsgeheim aangemaakt.",
+      "createForbidden": "Je kunt geen eindpuntreferenties aanmaken in deze organisatie.",
+      "errorNotConfigured": "Deze workflow heeft geen HTTP-eindpunt.",
+      "errorNoLiveCredential": "Er is geen actieve referentie. Roteer om er een aan te maken.",
+      "errorNotAllowed": "Je hebt geen toestemming om dit te doen.",
+      "copyCredentialChanged": "Referentie gewijzigd. Kopieer opnieuw.",
+      "copyCommandFailed": "Kan de opdracht niet kopiëren. {reason}",
+      "exampleRequest": "Voorbeeldverzoek",
+      "exampleActiveToken": "Actief token · {prefix}",
+      "exampleActiveSecret": "Actief geheim · {prefix}",
+      "exampleHintToken": "De kopie bevat het token. Plak in een terminal of importeer in Postman of Insomnia (Import → Raw text).",
+      "exampleHintSigned": "Voer dit uit in bash: het script ondertekent met openssl en roept daarna curl aan. De kopie bevat het geheim. Importtools kunnen niet ondertekenen.",
+      "exampleHintTokenPlaceholder": "De kopie bevat een plaatsaanduiding waar het token moet komen. Plak in een terminal of importeer in Postman of Insomnia (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Voer dit uit in bash: het script ondertekent met openssl en roept daarna curl aan. De kopie bevat een plaatsaanduiding waar het geheim moet komen. Importtools kunnen niet ondertekenen."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Klik",
       "viewDocsLinkLabel": "hier",
       "viewDocsSuffix": "om de verdere documentatie te bekijken.",
-      "selectIntegrationPrompt": "Selecteer een integratie om details te bekijken."
+      "selectIntegrationPrompt": "Selecteer een integratie om details te bekijken.",
+      "codingAgent": {
+        "tabAgent": "Met een codingagent",
+        "tabSteps": "Stap voor stap",
+        "streamLabel": "Naam van de traces-stream",
+        "streamHelp": "De agent schrijft traces naar deze stream en controleert deze.",
+        "envTitle": "Download je .env",
+        "envHelp": "Sla het op in de hoofdmap van het project. De skill leest het token uit dit bestand, zodat het nooit in de chat terechtkomt.",
+        "envButton": ".env downloaden",
+        "promptTitle": "Plak dit in {client1}, {client2} of {client3}",
+        "promptLabel": "Prompt",
+        "promptCopied": "Prompt gekopieerd"
+      }
     },
     "header": "Gegevensbronnen",
     "resetRUMTokenLabel": "RUM-token opnieuw instellen",
@@ -7670,6 +7995,15 @@
     "queryValues": "Querywaarden",
     "constant": "Constante",
     "textbox": "Tekstvak",
+    "date": "Datum",
+    "dateFormat": "Datumnotatie voor uitvoer",
+    "dateFormatHelp": "Standaarduitvoer in query's. Overschrijf per gebruik met ${'{'}name:format{'}'}, bijv. ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Epochseconden (epoch)",
+    "dateFormatEpochms": "Epoch milliseconden (epochms)",
+    "dateFormatEpochus": "Epoch microseconden (epochus)",
     "newFolder": "Nieuwe map",
     "updateFolder": "Folder bijwerken",
     "newReport": "Nieuw rapport",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Annotaties toevoegen",
       "dependentAdhocVariableWarning": "Sommige dynamische variabelen zijn niet toegepast omdat het veld niet aanwezig is in de stream van de query. Open de Query-inspecteur om alle details van de variabelen en uitgevoerde queries te zien die dit paneel renderen.",
       "refreshCacheReload": "Cache vernieuwen & herladen",
+      "exploreCreateAlert": "Alarm aanmaken",
+      "exploreAddToDashboard": "Toevoegen aan dashboard",
       "redirectingToLogs": "Doorverwijzen naar logpagina",
       "pleaseWait": "Even geduld..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Constante",
       "textbox": "Tekstvak",
       "custom": "Aangepast",
+      "date": "Datum",
       "list": "{type} · {example}",
       "csv": "Komma's: {example}",
       "pipe": "Pipes: {example}",
       "doublequote": "Dubbele aanhalingstekens: {example}",
-      "singlequote": "Enkele aanhalingstekens: {example}"
+      "singlequote": "Enkele aanhalingstekens: {example}",
+      "dateIso": "Datum (YYYY-MM-DD): {example}",
+      "dateDmy": "Eerst de dag (DD/MM/YYYY): {example}",
+      "dateMdy": "Eerst de maand (MM/DD/YYYY): {example}",
+      "dateEpoch": "Epoch seconden: {example}",
+      "dateEpochms": "Epoch milliseconden: {example}",
+      "dateEpochus": "Epoch microseconden: {example}"
     },
     "add": "Paneel toevoegen",
     "save": "Opslaan",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Bevestigd",
         "badgeResolved": "Opgelost",
         "badgeReopened": "Heropend",
+        "badgeAckEnded": "Bevestiging beëindigd",
         "badgeDimensionsUpgraded": "Dimensies opgewaardeerd",
         "badgeTitleChanged": "Titel gewijzigd",
         "badgeAssignment": "Toewijzing",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "AI heeft invoer nodig",
         "incidentWas": "Incident was",
         "theIncident": "het incident",
+        "ackEndedByPageResolve": "door een van de bijbehorende oproepen op te lossen",
         "unnamedAlert": "alarm",
         "alertTriggered": "{alert} is geactiveerd | {alert} is {count} keer geactiveerd",
         "severityUpgraded": "Ernst verhoogd van {from} naar {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Waarschuw mij",
           "toast": "Geïmporteerd uit Product Analytics: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "Alarm aanmaken",
+          "toast": "Query geïmporteerd uit je trace-zoekopdracht",
+          "noStream": "Kies eerst een stream",
+          "errorCount": "Aantal fouten",
+          "errorRate": "Foutpercentage"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Je zoekfilter is niet overgenomen omdat er eerst een keuze voor 'Uitvoeren als' op de logpagina nodig is. Voeg het toe aan de alarmquery als je het nodig hebt.",
         "thresholdColumnGuessed": "De drempelwaarde is toegepast op {column}; controleer of dat de bedoelde waarde is.",
         "thresholdNotCarried": "De drempelwaarde {value} uit de grafiek is niet toegepast omdat je een andere query hebt gekozen.",
-        "rumFunnelExclusions": "Gebruikt de app-filters van deze app zoals ze nu zijn; maak het opnieuw aan nadat ze zijn gewijzigd."
+        "rumFunnelExclusions": "Gebruikt de app-filters van deze app zoals ze nu zijn; maak het opnieuw aan nadat ze zijn gewijzigd.",
+        "tracesSeedMatches": "Gaat af wanneer het aantal overeenkomende spans in {minutes} min boven {threshold} komt (nu {current}).",
+        "tracesSeedSpans": "Gaat af wanneer het aantal spans in {minutes} min boven {threshold} komt (nu {current}).",
+        "tracesSeedTraces": "Gaat af wanneer het aantal traces in {minutes} min boven {threshold} komt (nu {current}).",
+        "tracesSeedErrorSpans": "Gaat af wanneer het aantal foutieve spans in {minutes} min boven {threshold} komt (nu {current}).",
+        "tracesSeedErrorTraces": "Gaat af wanneer het aantal traces met fouten in {minutes} min boven {threshold} komt (nu {current}).",
+        "tracesSeedErrorRatio": "Gaat af wanneer het foutpercentage in {minutes} min boven {threshold}% komt (nu {current}%).",
+        "tracesErrorRatioMinSpans": "Controleert alleen vensters met minstens {minimum} spans, zodat een paar fouten in een rustige periode niet afgaan.",
+        "tracesErrorRatioMinTraces": "Controleert alleen vensters met minstens {minimum} traces, zodat een paar fouten in een rustige periode niet afgaan.",
+        "tracesSeedDuration": "Gaat af wanneer de {percentile}-duur over {minutes} min boven {threshold} ms ligt (nu {current} ms).",
+        "tracesSeedUnavailable": "De huidige waarde kon niet worden gelezen, dus de drempel begint op 0. Stel deze in voordat je opslaat.",
+        "tracesNoMatches": "Nog geen overeenkomende spans, dus het alarm gaat af zodra er één verschijnt.",
+        "tracesStoredSpans": "De tellingen betreffen opgeslagen spans, dus gesampled verkeer komt lager uit dan het in werkelijkheid is.",
+        "tracesPeriodCapped": "Het alarmvenster is beperkt tot {minutes} minuten om elke controle snel te houden.",
+        "tracesNotRun": "Deze zoekopdracht is nog niet uitgevoerd, dus het alarm gebruikt het filter in de editor."
       }
     },
     "saveFailed": "Kon het alarm niet opslaan.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Geen metrieken komen overeen met de huidige filters",
       "noMatchHint": "Probeer een labelfilter te verwijderen, voorvoegsel/achtervoegsel selecties te wissen, of te schakelen van “Met gegevens” naar “Alle”.",
       "noMatchHintFavorites": "Probeer een labelfilter te verwijderen, of schakel van “Met gegevens” naar “Alles”.",
+      "noMatchYet": "Nog geen metrieken met gegevens gevonden",
+      "noMatchYetHint": "De tot nu toe gecontroleerde metrieken leverden geen gegevens op. Toon meer om verder te zoeken.",
       "clearAllFilters": "Alle filters wissen",
       "emptyActions": {
         "clearSearch": "Zoekopdracht wissen",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Paneel toegevoegd aan dashboard",
       "errorAddingPanel": "Fout bij toevoegen paneel",
       "selectDashboard": "Selecteer een dashboard",
-      "selectTab": "Selecteer een tab"
+      "selectTab": "Selecteer een tab",
+      "panelsToAdd": "Toe te voegen panels"
     },
     "groups": {
       "compute": "Compute",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Overige"
   },
   "traces": {
+    "nlNeedsSql": "Deze vraag vereist SQL; open deze in logs",
+    "redActions": {
+      "menuGroupDashboards": "Dashboards",
+      "addRedToDashboard": "RED-grafieken aan dashboard toevoegen",
+      "durationActions": "Duur-acties",
+      "bucketNotice": {
+        "seconds": "Deze grafieken behouden de balken van {count} seconden die je nu ziet.",
+        "minutes": "Deze grafieken behouden de balken van {count} minuten die je nu ziet.",
+        "hours": "Deze grafieken behouden de balken van {count} uur die je nu ziet.",
+        "days": "Deze grafieken behouden de balken van {count} dagen die je nu ziet."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Deze grafiek behoudt de balken van {count} seconden die je nu ziet.",
+        "minutes": "Deze grafiek behoudt de balken van {count} minuten die je nu ziet.",
+        "hours": "Deze grafiek behoudt de balken van {count} uur die je nu ziet.",
+        "days": "Deze grafiek behoudt de balken van {count} dagen die je nu ziet."
+      }
+    },
     "latencyHeatmap": {
       "title": "Duur",
       "tooltipSpans": "{count} span | {count} spans",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Volgende wedstrijd",
     "searchInSpans": "Zoeken in spans",
     "criticalPath": "Kritieke pad",
+    "askAi": {
+      "explainTrace": "Trace uitleggen",
+      "explainTraceHint": "Vraag AI naar de traagste spans op het kritieke pad en elke foutieve span",
+      "askAboutSpan": "Vraag AI naar deze span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Trace · {operation}"
+    },
     "spansTableView": "Spans-tabelweergave",
     "comingSoon": "Binnenkort beschikbaar...",
     "fetchingTrace": "Uw trace wordt opgehaald.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Fouten filteren",
         "resetFilters": "Filters opnieuw instellen",
         "errorsNone": "Geen fouten · {total} Turns",
-        "latencyLead": "Langzaamste {slowest} ·",
+        "latencyLead": "Gem. beurt {avg} · Traagste {slowest} ·",
         "costLead": "Piek {peak} ·",
         "tokens": "{ratio}% in cache opgeslagen",
         "cacheImpact": "{ratio}% Hergebruikt · {tokens} Tok Read",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Geen gegevens",
       "noErrorsInRange": "Geen fouten in dit tijdsbereik",
+      "loadFailed": "Kan recente fouten niet laden",
       "time": "Tijd",
       "service": "Service",
       "operation": "Operatie",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Altijd actief (standaard)",
     "testAtTimeLabel": "Testen op UTC-tijd",
     "testAtTimeHint": "Laat leeg om de huidige tijd te gebruiken. Piek-/dallagen worden op basis van deze tijd bepaald.",
-    "localTimeHint": "In uw tijdzone: {range}"
+    "localTimeHint": "In uw tijdzone: {range}",
+    "builtInStatus": {
+      "seed": "Ingebouwde prijzen: seedlijst meegeleverd met deze release, gedateerd {date}.",
+      "neverSynced": "Online synchronisatie is niet uitgevoerd sinds de server is gestart.",
+      "lastSynced": "Laatst online gesynchroniseerd {time}."
+    },
+    "unpriced": {
+      "title": "Ontbrekende prijzen",
+      "subtitle": "Modellen in je LLM-traces die bij ingestie geen prijs of alleen een benaderende prijs hadden",
+      "banner": "{count} model had bij ingestie geen prijs of een benaderende prijs. De geregistreerde kosten zijn mogelijk onvolledig. | {count} modellen hadden bij ingestie geen prijs of een benaderende prijs. Hun geregistreerde kosten zijn mogelijk onvolledig.",
+      "bannerTruncated": "{total} modellen in je traces hadden bij ingestie geen prijs of een benaderende prijs. Hun kosten zijn mogelijk onjuist. De top {shown} op tokens wordt getoond.",
+      "streamLabel": "Stream",
+      "window": "Laatste 24 uur",
+      "windowRange": "{from} – {to}",
+      "colModel": "Model gezien in traces",
+      "colPricedAs": "Geprijsd als",
+      "colTokens": "Tokens",
+      "colCost": "Geregistreerde kosten",
+      "colActions": "Acties",
+      "spans": "{count} span | {count} spans",
+      "moreAgents": "+{count} meer",
+      "noMatch": "Geen overeenkomst",
+      "approximate": "Benaderend",
+      "pricedNow": "Geprijsd voor nieuwe spans",
+      "historicalGap": "Dit venster behoudt zijn geregistreerde prijsleemte. Nieuwe spans gebruiken de huidige prijs.",
+      "noActionNeeded": "Geen actie nodig",
+      "defaultTierPrices": "in {input} / uit {output} per 1M",
+      "notPriced": "niet geprijsd",
+      "createPrice": "Prijs aanmaken",
+      "keepPrices": "Behoud {name}-prijzen",
+      "mute": "Dempen",
+      "muteConfirmTitle": "Dit model dempen?",
+      "muteConfirmMessage": "Nieuwe spans van {model} worden als gratis geprijsd. Oudere spans behouden hun geregistreerde kosten. Verwijder de prijs \"{name}\" om het dempen ongedaan te maken.",
+      "mutedNotif": "{model} gedempt",
+      "keptNotif": "{model} gebruikt nu {name}-prijzen",
+      "errSave": "Opslaan van de prijs mislukt",
+      "errLoad": "Laden van ongeprijsde modellen mislukt",
+      "emptyTitle": "Geen ongeprijsd of benaderend modelgebruik geregistreerd in deze stream in dit venster.",
+      "noStreamsTitle": "Geen LLM-trace-streams",
+      "noStreamsDesc": "Modellen verschijnen hier zodra gen_ai-spans een traces-stream bereiken.",
+      "recordedCostNote": "Nieuwe prijzen gelden voor spans die na het opslaan worden geïngesteerd. Oudere spans behouden hun geregistreerde kosten.",
+      "noModelName": "(geen modelnaam)",
+      "noModelHint": "Geen model om te prijzen: stel gen_ai.request.model in",
+      "instrumentationDocs": "Instrumentatiegids"
+    }
   },
   "aiObservability": {
     "title": "AI-observability",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Overgeslagen rijen: {full} volledig · {partial} gedeeltelijk",
       "scoreEvidence": "{scorer} · v{version}: {samples} samples, {noReference} geen referentie, {noTrace} geen trace",
       "scorerApplicability": "{scorer} · v{version}: {eligible} geschikte slots, {noReference} zonder referentie",
+      "costUnknown": "kosten onbekend",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Experimenten laden mislukt",
       "previewError": "Voorvertoning van experiment slots mislukt",
       "createSuccess": "Experiment gemaakt",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Dit experiment kost naar schatting ongeveer {cost}, boven de waarschuwingsdrempel van {threshold}. Toch aanmaken en uitvoeren?",
         "costConfirmMessageUnpriced": "De geschatte kosten van dit experiment overschrijden de waarschuwingsdrempel. Toch aanmaken en uitvoeren?",
         "costConfirmOk": "Toch aanmaken",
+        "taskProviderFailed": "Er is niets aangemaakt. De taakprovider {provider} heeft de testoproep niet beantwoord.",
+        "judgeProviderFailed": "Er is niets aangemaakt. De LLM Judge-provider {provider} heeft de testoproep niet beantwoord.",
         "skippedFully": "{count} rijen volledig overgeslagen — elke geselecteerde scorer heeft een verwachte output nodig. Overgeslagen rijen kosten niets om uit te voeren.",
         "skippedPartially": "{count} rijen gedeeltelijk overgeslagen — de taak wordt nog steeds uitgevoerd, maar referentiegebaseerde scorers kunnen geen rijen scoren zonder een verwachte output.",
         "skippedNone": "Elke overeenkomende rij kan op ten minste één dimensie worden gescoord.",
@@ -17408,7 +17851,26 @@
           "trials": "Proeven",
           "dispersion": "Spreiding",
           "latency": "Latentie",
-          "p50Latency": "P50-latentie"
+          "p50Latency": "P50-latentie",
+          "error": "Fout"
+        },
+        "failureBanner": {
+          "title": "{failed} van {total} slots mislukt: {cause}.",
+          "cause": "Belangrijkste oorzaak, {count} slots: {message}",
+          "moreCauses": "+ {count} meer oorzaken",
+          "noMessage": "er is geen foutmelding vastgelegd",
+          "openProviders": "Providers openen"
+        },
+        "failureKinds": {
+          "provider_auth": "de provider heeft de inloggegevens geweigerd",
+          "rate_limited": "de provider heeft de run vanwege rate limiting beperkt",
+          "timeout": "de provider heeft niet op tijd geantwoord",
+          "provider_5xx": "de provider gaf een serverfout terug",
+          "parse_error": "de uitvoer kon niet worden geparseerd",
+          "mapping_error": "de taakinvoer kon niet worden opgebouwd",
+          "scorer_missing": "een scorer bestaat niet meer",
+          "execution_error": "de taakaanroep is mislukt",
+          "unknown": "de taakaanroep is mislukt"
         },
         "saveAsPrompt": "Opslaan als prompt",
         "openPrompt": "Prompt openen",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Omgeving",
       "agent": "Agent",
-      "version": "Versie"
+      "version": "Versie",
+      "agentIdHint": "Agent-ID: {ids}",
+      "noAgentIdentity": "Geen agentidentiteit gevonden",
+      "noAgentIdentityDescription": "Deze LLM-spans bevatten geen agentnaam, dus ze worden per stream getoond. Koppel het attribuut dat de naam van je agent bevat om ze per agent te bekijken.",
+      "noAgentIdentityAction": "GenAI Agent Mapping openen"
     },
     "agentGraph": {
       "stream": "Stream",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Evaluaties zijn uitgeschakeld op deze server",
+      "description": "Deze pagina vereist online evaluaties, die op deze server zijn uitgeschakeld. Vraag je beheerder ze in te schakelen."
+    },
     "traceScoreChip": {
       "reasoning": "Waarom",
       "noReasoning": "Geen redenering geregistreerd voor deze score.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Endpoint configureren"
     },
     "provider": {
-      "backTo": "Terug naar Providers",
+      "backTo": "Providers",
       "createTitle": "LLM-provider aanmaken",
       "editTitle": "LLM-provider bewerken",
       "subtitle": "Configureer het modeleindpunt dat wordt gebruikt door LLM Judge-scorers.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Scorer {index}: naam \"{name}\" wordt meer dan één keer gebruikt in deze import"
         }
       },
-      "backTo": "Terug naar Scorers",
+      "backTo": "Scorers",
       "badgeRemote": "Op afstand",
       "badgeLlm": "LLM Judge",
       "createTitleRemote": "Nieuwe externe scorer",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Selecteer een provider",
       "modelLabel": "Model",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperatuur",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 tot 2. Laat leeg om op 0 te beoordelen.",
       "promptLabel": "Judge-prompt",
       "includeReasoningLabel": "Redenering opnemen",
       "includeReasoningHint": "De judge legt uit waarom hij die score gaf; dit wordt bij elk resultaat opgeslagen.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Headernaam is verplicht",
         "apiKeyTokenRequired": "Token is verplicht",
         "timeoutInvalid": "Time-out moet 0 of groter zijn",
+        "temperatureInvalid": "Temperatuur moet tussen 0 en 2 liggen",
         "retriesInvalid": "Aantal pogingen moet 0 of groter zijn",
         "duplicateFieldName": "Veldnamen moeten uniek zijn"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Gedegradeerd",
         "waitingForCredentials": "Wachten op inloggegevens",
         "noRecentRuns": "Geen recente uitvoeringen",
+        "lastScored": "Laatst gescoord {time}",
         "summary": "{errors} van {runs} uitvoeringen mislukt in de afgelopen 15 minuten",
         "since": "In deze status gekomen {time}",
         "checked": "Laatst gecontroleerd {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Evalueert {percent}% van de overeenkomende doelen.",
       "samplingValueAllHelp": "Elk overeenkomend doel wordt geëvalueerd.",
       "samplingHelp": "Wordt uitgevoerd na filteren, om kosten te beheersen.",
-      "backTo": "Terug naar Eval Jobs",
+      "backTo": "Eval-taken",
       "createTitle": "Nieuwe Eval Job",
       "editTitle": "Eval Job bijwerken",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Deze tak eindigt al in een bestemming.",
       "chooseATriggerNodeToStart": "Kies een triggernode om uw workflow te starten",
       "thisConnectionWouldCreateALoop": "Deze verbinding zou een lus creëren",
-      "onlyOneIncomingConnectionToA": "Er is slechts één inkomende verbinding naar een stap toegestaan"
+      "onlyOneIncomingConnectionToA": "Er is slechts één inkomende verbinding naar een stap toegestaan",
+      "endpointUrlCopied": "Endpoint-URL gekopieerd"
     },
     "views": {
       "youAreNotAuthorizedToManage": "U bent niet gemachtigd om de licentie te beheren.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Zoek database of service…",
       "unnamedInstance": "Instantie niet benoemd",
+      "schemaCount": "{count} schema | {count} schema's",
       "unnamedInstanceHint": "De eigen statement-rapporten van de database bewijzen dat deze engine draait, maar ze geven geen hostnaam. De rij toont een adres zodra een feed die er een bevat — sessiesampling of instantiemetrieken — is ingesteld.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Geteld tot {time}; de laatste halve minuut komt nog binnen.",
       "lineExact": "Alle databases rapporteren. Snelheden hier zijn gemeten over elke aanroep, dus ze zijn exact.",
       "lineExactEstimated": "Alle databases rapporteren. Snelheden hier zijn gemengd over meerdere tijdsperioden, dus ze zijn bij benadering maar niet exact.",
+      "lineExactSlowestSchema": "Alle databases rapporteren. Snelheden zijn exact per schema; een database met meerdere schema's toont het traagste schema.",
       "lineSubsetUnnamed": "Je filters beperken dit tot onder het niveau waarop deze totalen worden opgeteld, dus de percentages beschrijven de getoonde rijen in plaats van de hele database.",
       "lineQuery": "Tijden worden gemeten vanuit je applicatie, dus ze omvatten netwerktijd en eventueel wachten op een vrije verbinding.",
       "lineUncodedErrors": "{percent} van de mislukkingen hier kwam terug zonder een redencode, dus ze kunnen worden geteld maar niet verklaard.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "Eerste keer dat dit alarm is afgegaan.",
     "escalationNotStarted": "Nog niet opgeroepen.",
     "escalationPagesNobody": "Roept niemand op",
+    "escalationNobodyPaged": "Er wordt niemand opgeroepen",
     "escalationTo": "escaleert naar {who} {when}",
     "escalationDetailCapped": "Live-escalatiedetails worden geladen voor de {count} oudste openstaande oproepen.",
     "responder": "Responder",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "Tot",
     "rotationRestrictionAdd": "Venster toevoegen",
     "rotationRestrictionRemove": "Verwijderen",
-    "rotationRestrictionZeroLength": "Van en Tot zijn gelijk, dus dit venster komt nooit overeen en de laag wint daardoor nooit, zonder dat iemand het merkt. Stel voor een volledige dag Tot in op 24:00.",
+    "rotationRestrictionZeroLength": "Van en Tot zijn gelijk, dus dit venster komt nooit overeen. Opslaan blijft uit tot Van en Tot verschillen; stel voor een volledige dag Tot in op 24:00.",
     "rotationRetiredTag": "Stopgezet",
     "rotationSectionWhen": "Wanneer deze wisselt",
     "rotationName": "Rotatienaam",
@@ -25593,6 +26072,10 @@
     "snoozed": "Uitgesteld",
     "snoozedUntil": "Rustig tot {time} — nog niet toegewezen",
     "snoozeFailed": "Kan de oproep niet uitstellen",
+    "unsnooze": "Snooze beëindigen",
+    "unsnoozeHint": "Beëindigt de snooze nu. Oproepen gaan verder vanaf de stap waarop ze zijn gepauzeerd.",
+    "unsnoozed": "Snooze beëindigd · oproepen gaan verder",
+    "unsnoozeFailed": "Kon de snooze niet beëindigen",
     "note": "Notitie",
     "notePlaceholder": "Wat heb je gevonden? Wat heb je geprobeerd?",
     "addNote": "Notitie toevoegen",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Dezelfde personen, één dienst verschoven, zodat de secundaire nooit de persoon is die op dat moment piket heeft. Het is een gewone rotatie — niets verbindt de twee, dus als je het ene rooster bewerkt en het andere niet, lopen ze uit elkaar, en krijg je een waarschuwing in plaats van een stille correctie.",
     "rotationPreviewPairLegend": "Primair · Secundair",
     "rotationPreviewEmpty": "Kies personen en een eerste overdracht om te zien wie wanneer piket heeft.",
+    "rotationPreviewNow": "Nu – {until}",
     "defaultRotationName": "Rotatie",
     "teamCreatedWithoutMembers": "Het team is aangemaakt, maar de leden konden niet worden toegevoegd. Voeg ze toe op het tabblad Leden.",
     "teamCreatedWithoutRotation": "Het team en de leden zijn aangemaakt, maar de rotatie kon niet worden opgeslagen. Stel deze in op het tabblad Planning.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "niemand heeft ze bevestigd — ze worden nog opgeroepen",
     "sectionHint_ringingRouted": "niemand heeft bevestigd — {count} van deze wordt nog steeds opgeroepen | niemand heeft bevestigd — {count} van deze worden nog steeds opgeroepen",
     "sectionHint_ringingUnrouted": "{count} heeft geen team, dus wordt er niet opgeroepen | {count} hebben geen team, dus wordt er niet opgeroepen",
+    "sectionHint_ringingStopped": "{count} wordt niet opgeroepen | {count} worden niet opgeroepen",
     "sectionHint_snoozed": "oproepen gepauzeerd — ze komen vanzelf terug",
     "sectionHint_handled": "overgenomen — er is een persoon verantwoordelijk voor elk",
     "sectionHint_resolved": "gesloten — bewaard voor het archief",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "Het team dat wordt opgeroepen wanneer een signaal overeenkomt. De eigen escalatieladder van het team bepaalt wie er wordt opgeroepen en in welke volgorde.",
     "scopeOwns": "Dit team is eigenaar van",
     "scopeAdvanced": "Geavanceerd",
-    "ruleEditorConflictUnclaimed": "Niets claimt dit pad vandaag — een oproep die hiermee overeenkomt, bereikt het catch-all-team, of niemand.",
+    "ruleEditorConflictUnclaimed": "Niets claimt dit pad vandaag, op basis van alleen deze voorwaarden — een oproep die erop past komt bij de catch-all terecht, of bij niemand.",
     "ruleEditorConflictHeldBy": "Vandaag gaat een oproep die hiermee overeenkomt naar {team}, via {path}.",
     "ruleEditorConflictTakesOver": "Jouw regel heeft meer specifieke voorwaarden, dus zou hij deze overnemen van {team}.",
     "ruleEditorConflictKeptBy": "Het pad dat door {team} wordt vastgehouden is specifieker, dus houdt het team deze claims en vangt deze regel alleen wat overblijft.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} roept dit team alleen in {scope} op. Elders gaat het naar wie de scope eromheen bezit.",
     "scopeNothingDiscovered": "Er is nog niets ontdekt, dus er is geen inventaris om uit te kiezen. Gebruik 'Geavanceerd' om de regel op basis van velden te schrijven, of stuur eerst wat telemetrie.",
     "scopeAdvancedHint": "Komt overeen met elk veld en elke waarde, inclusief combinaties die de bovenstaande niveaus niet dekken.",
+    "scopeValuesSeen": "Deze lijsten tonen de waarden die service discovery heeft gezien. Gebruik Geavanceerd om een andere waarde te matchen.",
     "escalationHeld": "Eerst AI-triage · oproep binnen {n} s",
     "escalationPagingStep": "Roept stap {step} van {total} op · {who}",
     "escalationPagingStepOnly": "Roept stap {step} van {total} op",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Team en rotatie aanmaken",
     "removeMemberHandsOver": "{name} neemt de huidige dienst van {leaving} in {rotation} over.",
     "removeMemberLeavesGap": "Niemand neemt de huidige dienst van {leaving} in {rotation} over.",
+    "removeMemberReorders": "Ze verlaten ook {rotations}, dus ook daar kan veranderen wie piket heeft.",
     "membersJoinEnd": "{names} sluit aan achteraan {rotations}. Wie nu dienst heeft, blijft hetzelfde. | {names} sluiten aan achteraan {rotations}. Wie nu dienst heeft, blijft hetzelfde.",
     "membersAdded": "{names} toegevoegd. | {names} toegevoegd.",
     "removeMemberConfirm": "Verwijderen",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Vragen: {contact}",
       "outboundQueue": "Alarmberichten: {count} in wachtrij, oudste {age} | Alarmberichten: {count} in wachtrij, oudste {age}",
       "outboundEmpty": "Geen alarmberichten in wachtrij",
+      "refusedPosts": "{count} alarmbericht is in de laatste 24 uur mislukt. Laatst: {reason} op {destination}, | {count} alarmberichten zijn in de laatste 24 uur mislukt. Laatst: {reason} op {destination},",
       "ageSeconds": "{count} s"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "De herinneringen konden niet worden verzonden."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(geen modelnaam)",
+    "topModels": "{models} (top {shown} van {total})",
+    "cost": {
+      "partial": "gedeeltelijk",
+      "unknown": "kosten onbekend",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Gedeeltelijke kosten. Geen prijs voor {models}: {tokens} tokens in deze {scope} worden niet meegeteld.",
+      "unknownTooltip": "Kosten onbekend. Geen prijs voor {models}: geen van de {tokens} tokens in deze {scope} heeft kosten.",
+      "scopeSession": "sessie",
+      "scopeTrace": "trace",
+      "unknownModel": "een naamloos model",
+      "addPrice": "Prijs toevoegen"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} tokens zonder prijs",
+      "unpricedTooltip": "Kosten zijn een ondergrens: {tokens} tokens op {models} hebben geen prijs. Open het tabblad Zonder prijs in LLM-modelprijzen.",
+      "pricedSinceTooltip": "Kosten zijn een ondergrens: {tokens} tokens op {models} zijn geregistreerd voordat een prijs werd toegevoegd en houden geen kosten."
+    },
+    "chart": {
+      "costMissing": "Niet in deze grafiek: {models}. {tokens} tokens hebben geen prijs.",
+      "costMissingPricedSince": "Niet in deze grafiek: {models}. {tokens} tokens zijn geregistreerd voordat een prijs werd toegevoegd.",
+      "unpricedModels": "Zonder prijs: {models}",
+      "pricedSinceModels": "Geregistreerd voordat een prijs werd toegevoegd: {models}",
+      "addPrice": "Prijs toevoegen"
+    },
+    "health": {
+      "title": "Gegevensgezondheid",
+      "passing": "{n} geslaagd",
+      "checkedAgo": "gecontroleerd {ago}",
+      "drawerTitle": "AI-gegevensgezondheid",
+      "drawerSubtitle": "{stream} · huidig venster",
+      "rerun": "Controles opnieuw uitvoeren",
+      "close": "Sluiten",
+      "loadError": "De controles op de gegevensgezondheid konden niet worden uitgevoerd.",
+      "samples": "Voorbeelden:",
+      "copyLink": "Link kopiëren voor een beheerder",
+      "linkCopied": "Link gekopieerd",
+      "status": {
+        "pass": "Geslaagd",
+        "warning": "Waarschuwing",
+        "error": "Fout"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Modellen zonder prijs",
+          "detail": "{count} model · {spans} spans · {tokens} tokens geteld als $0 | {count} modellen · {spans} spans · {tokens} tokens geteld als $0",
+          "pass": "Elk model in dit venster heeft een prijs. Spans die zijn geregistreerd voordat een prijs werd toegevoegd, behouden hun geregistreerde kosten.",
+          "fix": "Oplossen in LLM-modelprijzen",
+          "truncated": "Top {shown} van {total} op tokens"
+        },
+        "missing_agent_identity": {
+          "label": "Ontbrekende agentidentiteit",
+          "detail": "{affected} van {total} LLM-spans ({pct}) hebben geen gen_ai.agent.name, waardoor agentweergaven ze missen.",
+          "pass": "Elke LLM-span heeft een agentnaam of -id.",
+          "fix": "GenAI-agentmapping openen"
+        },
+        "zero_duration_spans": {
+          "label": "Spans met duur nul",
+          "detail": "{affected} LLM-spans rapporteren 0 ms, waardoor latency en sessieduur te laag uitvallen.",
+          "pass": "Geen enkele LLM-span rapporteert 0 ms.",
+          "fix": "Hoe op te lossen"
+        },
+        "missing_session_id": {
+          "label": "Spans zonder sessie-id",
+          "detail": "{affected} van {total} LLM-spans ({pct}) hebben geen gen_ai.conversation.id, waardoor Sessies ze missen.",
+          "pass": "Elke LLM-span heeft gen_ai.conversation.id.",
+          "fix": "Integratiehandleiding"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Fleetbeheer",
     "subtitle": "Registreer OpenTelemetry-collectors, beheer versies van hun configuraties en rol wijzigingen veilig uit",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "Bezig",
       "scheduled": "Gepland",
+      "waiting": "Wachtend",
       "completed": "Voltooid",
       "halted": "Gestopt",
       "superseded": "Vervangen",
@@ -28696,7 +29257,7 @@
       "version": "Versie",
       "pickConfig": "Kies een configuratie",
       "pickFleet": "Kies een fleet",
-      "emptyFleet": "De fleet heeft geen collectors, dus de versie wordt direct ingesteld",
+      "emptyFleet": "De fleet heeft geen collectors, dus de uitrol wacht tot er één aansluit",
       "startingShortly": "Start binnenkort",
       "eventGateFailed": "Gezondheidspoort mislukt",
       "eventHalted": "Gestopt",
@@ -28707,7 +29268,10 @@
       "notFound": "Deze uitrol bestaat niet meer",
       "notFoundDescription": "De link is mogelijk verouderd. Kies een uitrol uit de lijst.",
       "noneTargeted": "Geen collectors beoogd",
-      "outcomeNoneTargeted": "De fleet had geen collectors toen v{to} werd ingesteld.",
+      "outcomeNoneTargeted": "Geen enkele collector heeft v{to} in deze uitrol overgenomen.",
+      "outcomeWaiting": "Er is geen collector online, dus v{to} is nog naar niemand gegaan. De uitrol start zodra er één verbinding maakt.",
+      "waitingForCollector": "Wachten op een collector",
+      "notStarted": "Niet gestart",
       "versionFailedBefore": "v{version} · eerder mislukt",
       "pickVersion": "Kies een versie",
       "autoRollback": "Automatisch terugdraaien",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Hervat",
       "eventSkipped": "Falende collectors overgeslagen",
       "eventStarted": "Gestart",
+      "eventWaiting": "Wachten tot een collector online komt",
       "eventTimedOut": "Fase verlopen",
       "eventSkippedOffline": "{count} collector weggelaten die bij de start offline was; deze neemt de versie over zodra hij weer verbinding maakt | {count} collectors weggelaten die bij de start offline waren; ze nemen de versie over zodra ze weer verbinding maken",
       "excluded": "Uitgesloten",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Een fase die binnen {minutes} min niet bevestigt of weigert, stopt de uitrol (fleet-instelling)",
       "phaseVerifying": "Verifiëren",
       "phases": "Fasen",
-      "planEmpty": "Geen collectors om bij te werken",
+      "planEmpty": "Er is geen collector online, dus de uitrol wacht tot er één verbinding maakt",
+      "planStable": "Geen enkele collector is online; de stabiele versie gaat naar elke collector zodra deze verbinding maakt",
       "planOne": "{count} collector in één batch | {count} collectors in één batch",
       "planText": "{steps} → resterend {last}, {count} fasen",
       "planUnavailable": "Het voorbeeld van het plan is niet beschikbaar",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 bewaart offline collectors voor altijd"
     },
     "audit": {
-      "search": "Audittrail doorzoeken",
       "editedConfig": "Configuratie bewerkt",
       "revokedToken": "Registratietoken ingetrokken",
       "enrolledCollector": "Collector geregistreerd",
@@ -28920,7 +29485,6 @@
       "setDesired": "Versie gewijzigd",
       "autoRollback": "Automatisch teruggedraaid",
       "rolloutHalted": "Uitrol gestopt",
-      "assignedFleetConfig": "Configuratie van de fleet toegewezen",
       "createdFleet": "Fleet aangemaakt",
       "renamedFleet": "Fleet hernoemd",
       "deletedFleet": "Fleet verwijderd",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Uitrol teruggedraaid",
       "movedByToken": "Verplaatst via registratietoken",
       "object": "Object",
+      "search": "Audittrail doorzoeken",
       "allObjects": "Alle objecten",
       "kind": {
         "fleet": "Fleet",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "v{to} wordt uitgerold",
       "rolloutHalted": "Uitrol van v{to} gestopt",
+      "rolloutWaiting": "v{to} wacht tot een collector online komt",
       "autoRolledBack": "v{to} automatisch teruggedraaid",
       "noReason": "Geen reden voor falen gerapporteerd",
       "openRollout": "Uitrol openen",
diff --git a/web/src/locales/languages/pl-PL.json b/web/src/locales/languages/pl-PL.json
index b8274d7956..37b16c02b6 100644
--- a/web/src/locales/languages/pl-PL.json
+++ b/web/src/locales/languages/pl-PL.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Brak aktywności LLM",
       "description": "Zainstrumentuj swoje usługi za pomocą konwencji semantycznych OpenTelemetry Gen-AI i pozyskaj co najmniej jeden trace, aby wypełnić ten pulpit.",
-      "action": "Instrumentuj z OpenTelemetry",
-      "actionDesc": "Przechwytuj atrybuty gen_ai_* w swoich trace."
+      "action": "Wszystkie integracje AI",
+      "actionDesc": "Przejrzyj przewodniki po frameworkach i dostawcach",
+      "suggested": "Skonfiguruj trace dla {name}",
+      "suggestedDesc": "Sugerowane, ponieważ trafiłeś tu z Dokumentacji {name}",
+      "codingAgent": "Instrumentuj za pomocą agenta kodującego",
+      "codingAgentDesc": "Twój agent kodujący dodaje trace i sprawdza pierwszy trace",
+      "startFrom": "Albo zacznij od"
     },
     "noLLMSessions": {
       "title": "Brak sesji LLM",
@@ -4797,6 +4802,13 @@
       "success": "Sukces",
       "failed": "Niepowodzenie",
       "testRun": "Uruchomienie testowe",
+      "source": "Źródło",
+      "sourceHttp": "Żądanie HTTP",
+      "sourceAlertFired": "Alert wyzwolony",
+      "sourceIncidentEvent": "Zdarzenie incydentu",
+      "sourceRetry": "Ponowne uruchomienie",
+      "sourceManual": "Uruchomienie ręczne",
+      "sourceOther": "Inne",
       "runType": "Typ",
       "testRunTooltip": "Rozpoczęte z edytora. Kroki docelowe naprawdę przekazują dalej.",
       "showTestRuns": "Pokaż uruchomienia testowe ({count})",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Ponowić to uruchomienie?",
       "retryMessage": "Spowoduje to utworzenie nowego uruchomienia na podstawie danych wejściowych zarejestrowanych przez nieudane uruchomienie. Kroki docelowe naprawdę wyślą dane.",
       "retryStarted": "Rozpoczęto ponawianie — pojawi się na liście jako nowe uruchomienie.",
-      "retryError": "Nie udało się ponowić tego uruchomienia"
+      "retryError": "Nie udało się ponowić tego uruchomienia",
+      "statusQueued": "W kolejce",
+      "statusRunning": "W trakcie",
+      "statusExpired": "Wygasło",
+      "reasonExpired": "nigdy nie uruchomiono · w kolejce ponad 1 h",
+      "reasonWorkerLost": "utracono workera · nie uruchomiono ponownie",
+      "reasonWorkflowDisabled": "przepływ pracy był wyłączony",
+      "reasonRunTimeout": "przekroczono limit czasu po 15 min",
+      "allTriggers": "Wszystkie wyzwalacze",
+      "triggerFilter": "Wyzwalacz",
+      "run": "Uruchomienie",
+      "searchRuns": "Szukaj po ID uruchomienia, kluczu idempotencji lub alercie",
+      "sourceDetails": "Szczegóły źródła",
+      "detailsWithKey": "{ip} · klucz {key}",
+      "detailsNoKey": "{ip} · brak klucza idempotencji",
+      "retryOf": "Ponowienie {run}",
+      "openRun": "Otwórz uruchomienie",
+      "alertFiredEmptyTitle": "Brak uruchomień wyzwolonych alertem w tym zakresie czasu",
+      "incidentEventEmptyTitle": "Brak uruchomień wywołanych zdarzeniem incydentu w tym zakresie czasu",
+      "filterEmptyTitle": "Brak pasujących uruchomień w tym zakresie czasu",
+      "filterEmptyDimmed": "Pozostałe uruchomienia nadal są na osi czasu, przygaszone.",
+      "searchEmptyTitle": "Żadne uruchomienie nie pasuje do tego wyszukiwania",
+      "searchEmptyAction": "Wyczyść wyszukiwanie",
+      "timelineNow": "teraz",
+      "timelineAgoMinutes": "−{n} min",
+      "timelineAgoHours": "−{n} godz",
+      "timelineAgoDays": "−{n} dn"
     },
     "edit": "Edytuj",
     "view": "Podgląd",
@@ -4958,7 +4996,9 @@
           "noMatch": "Brak dopasowania"
         },
         "suppressed": "Pominięte — nie wysłano do rzeczywistego miejsca docelowego"
-      }
+      },
+      "payloadFrom": "Payload z",
+      "payloadFromHint": "Kształt HTTP to to, co wysyłają wywołujący endpoint."
     },
     "linkAlerts": {
       "title": "Połącz przepływ pracy z alertami",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Format wyjściowy",
       "tlsVerifyLabel": "Weryfikacja TLS",
       "tlsDisabled": "Wyłączone"
+    },
+    "http": {
+      "runTestHint": "Uruchamia kroki z przykładowym payloadem HTTP; nie wywołuje adresu URL",
+      "runTestHintList": "Otwórz przepływ pracy, aby uruchomić test",
+      "runsEmptyTitle": "Brak żądań HTTP w tym zakresie czasu",
+      "runsEmptyBody": "Poszerz zakres czasu lub wyślij żądanie testowe z panelu endpointu HTTP.",
+      "runsEmptyAction": "Pokaż wszystkie wyzwalacze",
+      "runFailedAt": "To uruchomienie nie powiodło się na kroku {step}: {error}",
+      "openStep": "Otwórz krok",
+      "runGuardHint": "Uruchomienia HTTP zawierają żądanie, a nie pola alertu. Jeśli ten krok odczytuje {fields}, zabezpiecz go warunkiem: {guard}.",
+      "runExpiredBanner": "To żądanie czekało w kolejce ponad 1 godzinę i nigdy nie zostało uruchomione. Żaden krok nie został wykonany i nie wywołano żadnego miejsca docelowego.",
+      "runWorkerLostBanner": "Proces roboczy wykonujący to żądanie zatrzymał się. Nie zostanie uruchomiony ponownie automatycznie, ponieważ miejsca docelowe mogły już zostać wywołane. Sprawdź je, zanim wywołujący wyśle żądanie ponownie.",
+      "request": "Żądanie",
+      "requestReceived": "Odebrano",
+      "requestToken": "Token",
+      "requestCallerIp": "Adres IP wywołującego",
+      "requestIdempotencyKey": "Klucz idempotencji",
+      "requestContentType": "Typ zawartości",
+      "requestBodySize": "Rozmiar treści",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Nagłówki",
+      "headersKept": "Zachowano {count} · Autoryzacja, pliki cookie i podpisy nigdy nie są przechowywane | Zachowano {count} · Autoryzacja, pliki cookie i podpisy nigdy nie są przechowywane",
+      "headerName": "Nazwa",
+      "headerValue": "Wartość",
+      "outputCaption": "Co otrzymał każdy dalszy krok",
+      "useAsTestInput": "Użyj jako danych wejściowych testu",
+      "editorButton": "Punkt końcowy HTTP",
+      "editorButtonOn": "Włączony",
+      "editorButtonOff": "Wyłączony",
+      "editorButtonTooltip": "Pozwól innemu systemowi uruchomić ten przepływ pracy żądaniem HTTP",
+      "editorButtonRefusedDraft": "Żądania otrzymują 403, dopóki przepływ pracy nie zostanie opublikowany",
+      "editorButtonRefusedPaused": "Żądania otrzymują 403, gdy przepływ pracy jest wstrzymany",
+      "panelTitle": "Punkt końcowy HTTP",
+      "panelSubtitle": "{name} · przepływ pracy typu {kind}",
+      "acceptRequests": "Akceptuj żądania HTTP",
+      "kindNote": "Kroki tego przepływu pracy zostały zbudowane dla uruchomień typu {kind}. Uruchomienia HTTP zamiast tego otrzymują żądanie ({field}), więc dodaj warunek, jeśli krok potrzebuje pól {kind}.",
+      "kindNotePayload": "Pokaż ładunek HTTP",
+      "kindNotePayloadHide": "Ukryj ładunek HTTP",
+      "unsavedBody": "Ten przepływ pracy nie został jeszcze zapisany. Zapisz go jako wersję roboczą, aby utworzyć jego adres URL i token. Żądania są odrzucane, dopóki nie opublikujesz.",
+      "saveAndCreate": "Zapisz wersję roboczą i utwórz punkt końcowy",
+      "needsAdmin": "Utworzenie punktu końcowego wymaga administratora organizacji.",
+      "needsEdit": "Zmiana punktu końcowego wymaga dostępu do edycji tego przepływu pracy.",
+      "readOnlyOnMeta": "Włączony · możesz skopiować adres URL. Zmiana punktu końcowego wymaga dostępu do edycji tego przepływu pracy.",
+      "offBody": "Pozwól innemu systemowi uruchomić ten przepływ pracy żądaniem HTTP. Otrzymasz adres URL i token.",
+      "offExistingBody": "Wyłączony · żądania są odrzucane (403), dopóki go nie włączysz.",
+      "onMeta": "Włączony · uruchomienia rozpoczynają się tylko wtedy, gdy przepływ pracy jest włączony i opublikowany.",
+      "loadError": "Nie udało się wczytać ustawień punktu końcowego.",
+      "draftBanner": "Ten przepływ pracy to wersja robocza. Wywołania pod adres URL otrzymują 403, dopóki nie opublikujesz. Możesz teraz skonfigurować punkt końcowy, a opcja Uruchom test wykonuje kroki wersji roboczej z przykładowym ładunkiem HTTP.",
+      "disabledBanner": "Żądania są odrzucane (403), dopóki nie włączysz przepływu pracy.",
+      "turnOnFailed": "Nie udało się włączyć punktu końcowego. {reason}",
+      "changeFailed": "Nie udało się zapisać punktu końcowego. {reason}",
+      "endpointExistsHint": "Punkt końcowy już istnieje. Pokaż lub skopiuj jego token z tabeli tokenów.",
+      "endpointExistsHintSigned": "Punkt końcowy już istnieje. Pokaż lub skopiuj jego sekret podpisywania z tabeli sekretów podpisywania.",
+      "disableTitle": "Wyłączyć punkt końcowy?",
+      "disableBody": "Wywołujący otrzymują 403 (punkt końcowy wyłączony), dopóki nie włączysz go ponownie. Adres URL i tokeny pozostają bez zmian.",
+      "disableConfirm": "Wyłącz",
+      "lastCall": "Włączony · Ostatnie wywołanie: {status} · {time} · {link}",
+      "lastCallNone": "Włączony · Brak wywołań — wyślij żądanie testowe",
+      "lastCallNoneRefused": "Włączony · Brak wywołań",
+      "viewRun": "Zobacz uruchomienie",
+      "lastCallStatus": {
+        "queued": "w kolejce",
+        "running": "w toku",
+        "succeeded": "powodzenie",
+        "failed": "niepowodzenie",
+        "expired": "wygasło"
+      },
+      "endpointUrl": "URL punktu końcowego",
+      "tokenLabel": "Token",
+      "secretLabel": "Sekret podpisywania",
+      "newTokenLabel": "Nowy token",
+      "newSecretLabel": "Nowy sekret podpisywania",
+      "tokenHint": "Zamaskowany na ekranie; opcja Kopiuj kopiuje prawdziwy token. Przesyłaj go jako {header}, nigdy w adresie URL.",
+      "secretHint": "Zamaskowany na ekranie; opcja Kopiuj kopiuje prawdziwy sekret. Podpisuj nim każde żądanie i przesyłaj nagłówki {headers}; nigdy nie przesyłaj samego sekretu.",
+      "revealBannerTitle": "Utworzono punkt końcowy",
+      "revealBannerBody": "Przesyłaj ten token z każdym żądaniem. Możesz go ponownie wyświetlić lub skopiować z tabeli Tokeny.",
+      "revealBannerBodySigned": "Podpisuj każde żądanie tym sekretem. Możesz go ponownie wyświetlić lub skopiować z tabeli Sekrety podpisywania.",
+      "switchedBannerTitle": "Utworzono token",
+      "switchedBannerTitleSigned": "Utworzono sekret podpisywania",
+      "rotateBannerTitle": "Utworzono nowy token",
+      "rotateBannerTitleSigned": "Utworzono nowy sekret podpisywania",
+      "rotateBannerBody": "Wywołujący zachowują ten sam URL i nagłówek; zmienia się tylko token. Stary token działa do czasu wygaśnięcia i do tego momentu można go wyświetlić.",
+      "rotateBannerBodySigned": "Wywołujący zachowują ten sam URL i nagłówki; zmienia się tylko sekret. Stary sekret działa do czasu wygaśnięcia i do tego momentu można go wyświetlić.",
+      "rotateBannerBodyRevoked": "Wywołujący zachowują ten sam URL i nagłówek; zmienia się tylko token. Stary token został unieważniony i przestaje działać teraz.",
+      "rotateBannerBodyRevokedSigned": "Wywołujący zachowują ten sam URL i nagłówki; zmienia się tylko sekret. Stary sekret został unieważniony i przestaje działać teraz.",
+      "rotateBannerBodyFresh": "Wywołujący zachowują ten sam URL i nagłówek i od teraz przesyłają ten token.",
+      "rotateBannerBodyFreshSigned": "Wywołujący zachowują ten sam URL i nagłówki i od teraz podpisują tym sekretem.",
+      "snippetsLabel": "Przykładowe żądanie",
+      "sendTest": "Wyślij żądanie testowe",
+      "sendTestHint": "Sprawdza dane uwierzytelniające i pokazuje, co otrzymałyby Twoje kroki. Nie uruchamia żadnego wykonania ani nie wywołuje miejsca docelowego.",
+      "sendTestHintPaused": "Sprawdza dane uwierzytelniające. Przepływ pracy jest wstrzymany, więc wywołanie jest odrzucane, zanim powstaną jakiekolwiek dane wejściowe; opcja Uruchom test wykonuje kroki.",
+      "sendTestSigned": "Przeglądarki nie mogą podpisywać żądań, więc przetestuj za pomocą przykładowego żądania powyżej. Dodaj ?dry_run=true do jego adresu URL, aby sprawdzić podpis bez uruchamiania wykonania.",
+      "dryRunAccepted": "Próbne uruchomienie zaakceptowane",
+      "dryRunMeta": "dane uwierzytelniające prawidłowe · treść {size}",
+      "dryRunInput": "Dane wejściowe, które otrzymałyby Twoje kroki",
+      "dryRunRefused": "Dane uwierzytelniające są prawidłowe. Żądania są odrzucane, dopóki przepływ pracy nie zostanie opublikowany.",
+      "dryRunRefusedPaused": "Dane uwierzytelniające są prawidłowe. Żądania są odrzucane, gdy przepływ pracy jest wstrzymany.",
+      "dryRunRateLimited": "Przekroczono limit — próbne uruchomienia wliczają się do limitu.",
+      "dryRunStatus": "Żądanie zostało odrzucone ze statusem {status}.",
+      "dryRunFailed": "Nie udało się wysłać żądania testowego. {reason}",
+      "runTestInstead": "Zamiast tego uruchom test",
+      "done": "Gotowe",
+      "regionTag": "Region {name}",
+      "regionBanner": "Wysyłaj każde żądanie i każdą ponowną próbę do hosta w tym regionie. Klucze idempotentności i status wykonania ({field}) są przechowywane w regionie, który przyjął wywołanie, więc ponowna próba wysłana do innego regionu może rozpocząć drugie wykonanie.",
+      "authLabel": "Wywołujący uwierzytelniają się za pomocą",
+      "authToken": "Token",
+      "authSigned": "Żądania podpisane",
+      "authAbout": "O uwierzytelnianiu",
+      "authInfo": "Token: przesyłaj token w nagłówku Authorization. Żądania podpisane: podpisuj każde żądanie wspólnym sekretem (nagłówki {headers}).",
+      "switchToSignedTitle": "Przełączyć na żądania podpisane?",
+      "switchToSignedBody": "Przełączenie natychmiast unieważnia bieżący token i tworzy sekret podpisywania. Wywołujący używający tokenu zaczną otrzymywać 401.",
+      "switchToTokenTitle": "Przełączyć na token?",
+      "switchToTokenBody": "Przełączenie natychmiast unieważnia bieżący sekret podpisywania i tworzy token. Klienci podpisujący żądania zaczną otrzymywać 401.",
+      "tokensTitle": "Tokeny",
+      "secretsTitle": "Sekrety podpisywania",
+      "colToken": "Token",
+      "colSecret": "Sekret",
+      "colCreated": "Utworzono",
+      "colLastUsed": "Ostatnie użycie",
+      "colStatus": "Status",
+      "colActions": "Akcje",
+      "never": "Nigdy",
+      "active": "Aktywny",
+      "retiring": "Wycofywany",
+      "creatorGone": "Twórca nie należy już do tej organizacji",
+      "revoke": "Unieważnij",
+      "revokeNow": "Unieważnij teraz",
+      "revokeTitle": "Unieważnić {prefix}? Klienci, którzy go używają, natychmiast otrzymają 401.",
+      "revokeFailed": "Nie udało się go unieważnić. {reason}",
+      "copyToken": "Kopiuj token",
+      "copySecret": "Kopiuj sekret",
+      "tokenCopied": "Skopiowano token",
+      "commandCopied": "Skopiowano polecenie",
+      "secretCopied": "Skopiowano sekret",
+      "revealFailed": "Nie udało się wyświetlić tokenu. {reason}",
+      "revealFailedSigned": "Nie udało się wyświetlić sekretu. {reason}",
+      "revealDenied": "Tylko administratorzy mogą wyświetlać lub kopiować tokeny dla tego punktu końcowego.",
+      "runTest": "Uruchom test",
+      "rotate": "Zrotuj",
+      "rotateBlocked": "Najpierw unieważnij wycofywany token",
+      "rotateBlockedSigned": "Najpierw unieważnij wycofywany sekret",
+      "rotateTitle": "Zrotuj token",
+      "rotateTitleSigned": "Zrotuj sekret podpisywania",
+      "rotateLead": "Nowy token zostanie utworzony teraz. Zachowaj działanie {prefix} (ostatnie użycie: {time}) przez",
+      "rotateLeadSigned": "Nowy sekret podpisywania zostanie utworzony teraz. Zachowaj działanie {prefix} (ostatnie użycie: {time}) przez",
+      "overlapNow": "Unieważnij go natychmiast",
+      "overlapHour": "1 godzinę",
+      "overlapDay": "24 godziny",
+      "overlapWeek": "7 dni",
+      "rotateConsequence": "Klienci używający bieżącego tokenu będą nadal działać do {time}. Zaktualizuj ich przed tym terminem.",
+      "rotateConsequenceSigned": "Klienci podpisujący bieżącym sekretem będą nadal działać do {time}. Zaktualizuj ich przed tym terminem.",
+      "rotateConsequenceNow": "Klienci używający bieżącego tokenu będą od teraz otrzymywać 401.",
+      "rotateConsequenceNowSigned": "Klienci podpisujący bieżącym sekretem będą od teraz otrzymywać 401.",
+      "rotateConfirm": "Zrotuj token",
+      "rotateConfirmSigned": "Zrotuj sekret podpisywania",
+      "rotateFailed": "Nie udało się zrotować. {reason}",
+      "advanced": "Zaawansowane",
+      "advancedSummary": "Maks. rozmiar treści {size} · {count} żądanie na minutę | Maks. rozmiar treści {size} · {count} żądań na minutę",
+      "maxBody": "Maks. rozmiar treści (KiB)",
+      "maxBodyHint": "Maksymalnie 1024 (1 MiB); możesz tylko zmniejszyć tę wartość",
+      "maxBodyRange": "Wprowadź liczbę całkowitą od 1 do 1024",
+      "rateLimit": "Żądania na minutę",
+      "rateLimitHint": "Do {org} na minutę dla tej organizacji",
+      "rateLimitRange": "Wprowadź liczbę całkowitą od 1 do {org}",
+      "saveLimitsFailed": "Nie udało się zapisać limitów. {reason}",
+      "deleteMeta": "Usuwa adres URL oraz wszystkie tokeny i sekrety.",
+      "deleteButton": "Usuń punkt końcowy",
+      "deleteTitle": "Usunąć ten punkt końcowy?",
+      "deleteBody": "Adres URL przestaje działać natychmiast: wywołujący otrzymują 401. Wszystkie tokeny i sekrety podpisywania są usuwane i nie można ich odzyskać. Historia uruchomień jest zachowywana.",
+      "deleteFailed": "Nie udało się usunąć punktu końcowego. {reason}",
+      "secretStorageWarning": "Ten serwer nie ma głównego klucza szyfrowania, więc tokeny i sekrety podpisywania są przechowywane w formie czytelnej dla każdego, kto ma dostęp do bazy danych. Poproś administratora o ustawienie go.",
+      "rejectionsLine": "Odrzucono około {count} żądanie w ciągu ostatnich 24 godz. · ostatnie: {reason}, {time} | Odrzucono około {count} żądań w ciągu ostatnich 24 godz. · ostatnie: {reason}, {time}",
+      "rejectionsShow": "Pokaż",
+      "rejectionsHide": "Ukryj",
+      "rejectionsTitle": "Ostatnie odrzucenia",
+      "rejectionsCaption": "około {count} w ciągu ostatnich 24 godz. · wywołujący widział tylko kod statusu | około {count} w ciągu ostatnich 24 godz. · wywołujący widział tylko kod statusu",
+      "rejectionMeta": "około {count} · ostatnio {time} · z {ip} | około {count} · ostatnio {time} · z {ip}",
+      "rejectionsLoadError": "Nie udało się wczytać odrzuceń.",
+      "raiseLimit": "Zwiększ limit",
+      "rotateLink": "Wymień",
+      "reason": {
+        "invalid_token": {
+          "title": "Nieprawidłowy token",
+          "fix": "Wywołujący wysyła token, który został unieważniony, wygasł lub został błędnie wpisany. Pokaż lub skopiuj bieżący token z tabeli tokenów."
+        },
+        "invalid_signature": {
+          "title": "Nieprawidłowy podpis",
+          "fix": "Wywołujący podpisuje starym lub nieprawidłowym sekretem. Sprawdź, czy używa bieżącego sekretu i podpisuje {format} dokładnie w postaci wysłanej."
+        },
+        "stale_timestamp": {
+          "title": "Znacznik czasu jest zbyt stary",
+          "fix": "Zegar wywołującego odbiega o więcej niż 5 minut. Zsynchronizuj jego zegar i podpisuj tuż przed wysłaniem."
+        },
+        "endpoint_disabled": {
+          "title": "Punkt końcowy wyłączony",
+          "fix": "Włącz punkt końcowy."
+        },
+        "workflow_disabled": {
+          "title": "Przepływ pracy wstrzymany",
+          "fix": "Wznów przepływ pracy z listy."
+        },
+        "workflow_not_published": {
+          "title": "Przepływ pracy nie został opublikowany",
+          "fix": "Opublikuj przepływ pracy; wersje robocze odrzucają żądania."
+        },
+        "payload_too_large": {
+          "title": "Ładunek jest zbyt duży",
+          "fix": "Przekracza {size}. Wyślij mniej lub podziel zdarzenia na kilka żądań."
+        },
+        "credential_in_url": {
+          "title": "Dane uwierzytelniające w adresie URL",
+          "fix": "Token lub sekret został wysłany w adresie URL i odrzucony. Adresy URL trafiają do logów proxy i przeglądarki, więc wymień go teraz, a następnie wysyłaj w nagłówku."
+        },
+        "invalid_idempotency_key": {
+          "title": "Nieprawidłowy klucz idempotencji",
+          "fix": "Nagłówek Idempotency-Key jest pusty lub dłuższy niż 255 znaków."
+        },
+        "idempotency_key_reused": {
+          "title": "Klucz idempotencji został użyty ponownie",
+          "fix": "Ten sam klucz dotarł z inną treścią żądania. Używaj nowego klucza dla każdego odrębnego zdarzenia."
+        },
+        "rate_limited": {
+          "title": "Przekroczono limit",
+          "fix": "Więcej niż {count} żądań na minutę. Połącz zdarzenia w jedno żądanie (wyślij tablicę JSON) lub zwiększ limit — do {org} na minutę dla tej organizacji."
+        },
+        "queue_full": {
+          "title": "Kolejka jest pełna",
+          "fix": "Ta organizacja miała już {count} oczekujących uruchomień HTTP. Wywołujący powinni ponowić próbę po opóźnieniu Retry-After; sprawdź, czy nie ma wolnego kroku, lub zmniejsz szybkość wysyłania."
+        },
+        "worker_unavailable": {
+          "title": "Worker niedostępny",
+          "fix": "W tym regionie nie działał żaden worker przepływów pracy, więc nic nie trafiło do kolejki. Wywołujący, którzy ponowią próbę po opóźnieniu Retry-After, zostaną obsłużeni, gdy worker znów będzie dostępny; jeśli będzie się to powtarzać, poproś administratora o sprawdzenie workerów przepływów pracy."
+        }
+      },
+      "nodeBadge": "Wywoływany przez HTTP",
+      "triggerLinkOn": "Uruchamia się także na żądania HTTP",
+      "triggerLinkOnAction": "Zarządzaj punktem końcowym",
+      "triggerLinkOff": "Uruchamiaj go także z innego systemu",
+      "triggerLinkOffAction": "Skonfiguruj punkt końcowy HTTP",
+      "pickerCue": "Każdy przepływ pracy można również uruchomić żądaniem HTTP. Wybierz jego wyzwalacz, a następnie użyj punktu końcowego HTTP na pasku narzędzi.",
+      "listTag": "HTTP",
+      "listTagTooltip": "Punkt końcowy HTTP włączony",
+      "listMenuItem": "Punkt końcowy HTTP…",
+      "copyUrl": "Kopiuj adres URL punktu końcowego",
+      "copyUrlDraftHint": "Żądania są odrzucane, dopóki nie opublikujesz",
+      "copyUrlFailed": "Nie udało się skopiować adresu URL punktu końcowego. {reason}",
+      "payloadFrom": "Ładunek z",
+      "payloadHttp": "Żądanie HTTP",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "wygasa za {count} godz. | wygasa za {count} godz.",
+      "expiresInDays": "wygasa za {count} dzień | wygasa za {count} dni",
+      "expired": "Wygasło",
+      "rotateLeadUnused": "Nowy token jest teraz tworzony. Utrzymaj działanie {prefix} (nigdy nieużywanego) przez",
+      "rotateLeadUnusedSigned": "Nowy sekret podpisujący jest teraz tworzony. Utrzymaj działanie {prefix} (nigdy nieużywanego) przez",
+      "fieldGroup": "Żądanie HTTP",
+      "fieldGroupBodyHint": "Pola w treści żądania wymagają najpierw kroku funkcji",
+      "fieldGroupQueryHint": "Parametry zapytania to meta.query.<key>; powtórzone klucze przychodzą jako lista i nigdy nie pasują",
+      "rotateLeadNone": "Żaden token nie jest aktywny, więc wywołujący nie mogą się uwierzytelnić. Nowy token jest teraz tworzony.",
+      "rotateLeadNoneSigned": "Żaden sekret podpisujący nie jest aktywny, więc wywołujący nie mogą się uwierzytelnić. Nowy sekret podpisujący jest teraz tworzony.",
+      "createForbidden": "Nie możesz tworzyć poświadczeń punktu końcowego w tej organizacji.",
+      "errorNotConfigured": "Ten przepływ pracy nie ma punktu końcowego HTTP.",
+      "errorNoLiveCredential": "Żadne poświadczenie nie jest aktywne. Wykonaj rotację, aby je utworzyć.",
+      "errorNotAllowed": "Nie masz uprawnień, aby to zrobić.",
+      "copyCredentialChanged": "Poświadczenie zostało zmienione. Skopiuj ponownie.",
+      "copyCommandFailed": "Nie udało się skopiować polecenia. {reason}",
+      "exampleRequest": "Przykładowe żądanie",
+      "exampleActiveToken": "Aktywny token · {prefix}",
+      "exampleActiveSecret": "Aktywny sekret · {prefix}",
+      "exampleHintToken": "Skopiowana treść zawiera token. Wklej do terminala lub zaimportuj do Postmana albo Insomnii (Import → Raw text).",
+      "exampleHintSigned": "Uruchom w bashu: podpisuje za pomocą openssl, a następnie wywołuje curl. Skopiowana treść zawiera sekret. Narzędzia importujące nie potrafią podpisywać.",
+      "exampleHintTokenPlaceholder": "Skopiowana treść ma placeholder w miejscu tokenu. Wklej do terminala lub zaimportuj do Postmana albo Insomnii (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Uruchom w bashu: podpisuje za pomocą openssl, a następnie wywołuje curl. Skopiowana treść ma placeholder w miejscu sekretu. Narzędzia importujące nie potrafią podpisywać."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Kliknij",
       "viewDocsLinkLabel": "tutaj",
       "viewDocsSuffix": "aby sprawdzić dalszą dokumentację.",
-      "selectIntegrationPrompt": "Wybierz integrację, aby zobaczyć szczegóły."
+      "selectIntegrationPrompt": "Wybierz integrację, aby zobaczyć szczegóły.",
+      "codingAgent": {
+        "tabAgent": "Z agentem kodującym",
+        "tabSteps": "Krok po kroku",
+        "streamLabel": "Nazwa strumienia trace'ów",
+        "streamHelp": "Agent zapisuje trace'y do tego strumienia i je sprawdza.",
+        "envTitle": "Pobierz plik .env",
+        "envHelp": "Zapisz go w katalogu głównym projektu. Skill odczytuje token z tego pliku, więc nigdy nie trafia on do czatu.",
+        "envButton": "Pobierz .env",
+        "promptTitle": "Wklej to do {client1}, {client2} lub {client3}",
+        "promptLabel": "Prompt",
+        "promptCopied": "Prompt skopiowany"
+      }
     },
     "header": "Źródła danych",
     "resetRUMTokenLabel": "Resetuj token RUM",
@@ -7670,6 +7995,15 @@
     "queryValues": "Wartości zapytania",
     "constant": "Stała",
     "textbox": "Pole tekstowe",
+    "date": "Data",
+    "dateFormat": "Format daty wyjściowej",
+    "dateFormatHelp": "Domyślny format wyjściowy w zapytaniach. Nadpisz w konkretnym użyciu przez ${'{'}name:format{'}'}, np. ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Sekundy epoki (epoch)",
+    "dateFormatEpochms": "Milisekundy epoki (epochms)",
+    "dateFormatEpochus": "Mikrosekundy epoki (epochus)",
     "newFolder": "Nowy folder",
     "updateFolder": "Aktualizuj folder",
     "newReport": "Nowy raport",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Dodaj adnotacje",
       "dependentAdhocVariableWarning": "Niektóre zmienne dynamiczne nie zostały zastosowane, ponieważ pole nie występuje w strumieniu zapytania. Otwórz inspektor zapytań, aby zobaczyć wszystkie szczegóły zmiennych i zapytań wykonanych w celu wyrenderowania tego panelu",
       "refreshCacheReload": "Odśwież pamięć podręczną i przeładuj",
+      "exploreCreateAlert": "Utwórz alert",
+      "exploreAddToDashboard": "Dodaj do pulpitu",
       "redirectingToLogs": "Przekierowywanie do strony logów",
       "pleaseWait": "Proszę czekać..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Stała",
       "textbox": "Pole tekstowe",
       "custom": "Niestandardowy",
+      "date": "Data",
       "list": "{type} · {example}",
       "csv": "Przecinki: {example}",
       "pipe": "Kreski pionowe: {example}",
       "doublequote": "Podwójne cudzysłowy: {example}",
-      "singlequote": "Pojedyncze cudzysłowy: {example}"
+      "singlequote": "Pojedyncze cudzysłowy: {example}",
+      "dateIso": "Data (RRRR-MM-DD): {example}",
+      "dateDmy": "Najpierw dzień (DD/MM/RRRR): {example}",
+      "dateMdy": "Najpierw miesiąc (MM/DD/RRRR): {example}",
+      "dateEpoch": "Sekundy epoki: {example}",
+      "dateEpochms": "Milisekundy epoki: {example}",
+      "dateEpochus": "Mikrosekundy epoki: {example}"
     },
     "add": "Dodaj panel",
     "save": "Zapisz",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Potwierdzono",
         "badgeResolved": "Rozwiązano",
         "badgeReopened": "Ponownie otwarto",
+        "badgeAckEnded": "Potwierdzenie zakończone",
         "badgeDimensionsUpgraded": "Rozszerzono wymiary",
         "badgeTitleChanged": "Zmieniono tytuł",
         "badgeAssignment": "Przypisanie",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "AI potrzebuje danych",
         "incidentWas": "Incydent został",
         "theIncident": "incydent",
+        "ackEndedByPageResolve": "przez rozwiązanie jednego z jego wezwań",
         "unnamedAlert": "alert",
         "alertTriggered": "{alert} wyzwolony | {alert} wyzwolony {count} razy",
         "severityUpgraded": "Podniesiono dotkliwość z {from} na {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Powiadom mnie",
           "toast": "Zaimportowano z Product Analytics: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "Utwórz alert",
+          "toast": "Zapytanie zaimportowane z wyszukiwania trace",
+          "noStream": "Najpierw wybierz strumień",
+          "errorCount": "Liczba błędów",
+          "errorRate": "Wskaźnik błędów"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Twój filtr wyszukiwania nie został przeniesiony, ponieważ najpierw wymaga wyboru „Uruchom jako” na stronie logów. Dodaj go do zapytania alertu, jeśli jest potrzebny.",
         "thresholdColumnGuessed": "Próg zastosowano do {column}; sprawdź, czy to wartość, o którą chodziło.",
         "thresholdNotCarried": "Próg {value} z wykresu nie został zastosowany, ponieważ wybrano inne zapytanie.",
-        "rumFunnelExclusions": "Używa bieżących filtrów aplikacji; po ich zmianie utwórz go ponownie."
+        "rumFunnelExclusions": "Używa bieżących filtrów aplikacji; po ich zmianie utwórz go ponownie.",
+        "tracesSeedMatches": "Wyzwala się, gdy pasujące spany w ciągu {minutes} min przekroczą {threshold} (teraz {current}).",
+        "tracesSeedSpans": "Wyzwala się, gdy liczba spanów w ciągu {minutes} min przekroczy {threshold} (teraz {current}).",
+        "tracesSeedTraces": "Wyzwala się, gdy liczba trace'ów w ciągu {minutes} min przekroczy {threshold} (teraz {current}).",
+        "tracesSeedErrorSpans": "Wyzwala się, gdy spany z błędami w ciągu {minutes} min przekroczą {threshold} (teraz {current}).",
+        "tracesSeedErrorTraces": "Wyzwala się, gdy trace'y z błędami w ciągu {minutes} min przekroczą {threshold} (teraz {current}).",
+        "tracesSeedErrorRatio": "Wyzwala się, gdy wskaźnik błędów w ciągu {minutes} min przekroczy {threshold}% (teraz {current}%).",
+        "tracesErrorRatioMinSpans": "Sprawdza tylko okna z co najmniej {minimum} spanami, dzięki czemu kilka błędów w spokojnym okresie nie wyzwala alertu.",
+        "tracesErrorRatioMinTraces": "Sprawdza tylko okna z co najmniej {minimum} trace'ami, dzięki czemu kilka błędów w spokojnym okresie nie wyzwala alertu.",
+        "tracesSeedDuration": "Wyzwala się, gdy czas trwania {percentile} w ciągu {minutes} min przekracza {threshold} ms (teraz {current} ms).",
+        "tracesSeedUnavailable": "Nie udało się odczytać bieżącej wartości, więc próg zaczyna się od 0. Ustaw go przed zapisaniem.",
+        "tracesNoMatches": "Brak pasujących spanów, więc alert wyzwoli się, gdy tylko pojawi się pierwszy.",
+        "tracesStoredSpans": "Liczby dotyczą zapisanych spanów, więc próbkowany ruch wygląda na niższy niż w rzeczywistości.",
+        "tracesPeriodCapped": "Okno alertu ograniczono do {minutes} minut, aby każde sprawdzenie było szybkie.",
+        "tracesNotRun": "To wyszukiwanie nie zostało jeszcze uruchomione, więc alert używa filtru z edytora."
       }
     },
     "saveFailed": "Nie można zapisać alertu.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Żadne metryki nie pasują do bieżących filtrów",
       "noMatchHint": "Spróbuj usunąć filtr etykiety, wyczyścić wybór prefiksu/sufiksu lub przełączyć z „Z danymi” na „Wszystkie”.",
       "noMatchHintFavorites": "Spróbuj usunąć filtr etykiety lub przełączyć z „Z danymi” na „Wszystkie”.",
+      "noMatchYet": "Nie znaleziono jeszcze metryk z danymi",
+      "noMatchYetHint": "Sprawdzone dotąd metryki nie zwróciły danych. Pokaż więcej, aby szukać dalej.",
       "clearAllFilters": "Wyczyść wszystkie filtry",
       "emptyActions": {
         "clearSearch": "Wyczyść wyszukiwanie",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Panel dodany do pulpitu",
       "errorAddingPanel": "Błąd podczas dodawania panelu",
       "selectDashboard": "Wybierz pulpit",
-      "selectTab": "Wybierz zakładkę"
+      "selectTab": "Wybierz zakładkę",
+      "panelsToAdd": "Panele do dodania"
     },
     "groups": {
       "compute": "Obliczenia",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Inne"
   },
   "traces": {
+    "nlNeedsSql": "To pytanie wymaga SQL; otwórz je w Logach",
+    "redActions": {
+      "menuGroupDashboards": "Pulpity",
+      "addRedToDashboard": "Dodaj wykresy RED do pulpitu",
+      "durationActions": "Akcje czasu trwania",
+      "bucketNotice": {
+        "seconds": "Te wykresy zachowają widoczne teraz słupki {count}-sekundowe.",
+        "minutes": "Te wykresy zachowają widoczne teraz słupki {count}-minutowe.",
+        "hours": "Te wykresy zachowają widoczne teraz słupki {count}-godzinne.",
+        "days": "Te wykresy zachowają widoczne teraz słupki {count}-dniowe."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Ten wykres zachowa widoczne teraz słupki {count}-sekundowe.",
+        "minutes": "Ten wykres zachowa widoczne teraz słupki {count}-minutowe.",
+        "hours": "Ten wykres zachowa widoczne teraz słupki {count}-godzinne.",
+        "days": "Ten wykres zachowa widoczne teraz słupki {count}-dniowe."
+      }
+    },
     "latencyHeatmap": {
       "title": "Czas trwania",
       "tooltipSpans": "{count} span | spany: {count}",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Następne dopasowanie",
     "searchInSpans": "Szukaj w spanach",
     "criticalPath": "Ścieżka krytyczna",
+    "askAi": {
+      "explainTrace": "Wyjaśnij trace",
+      "explainTraceHint": "Zapytaj AI o najwolniejsze spany na ścieżce krytycznej i każdy span z błędem",
+      "askAboutSpan": "Zapytaj AI o ten span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Trace · {operation}"
+    },
     "spansTableView": "Widok tabeli spanów",
     "comingSoon": "Wkrótce...",
     "fetchingTrace": "Pobieranie twojego trace.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Filtruj błędy",
         "resetFilters": "Resetuj filtry",
         "errorsNone": "Brak błędów · tury: {total}",
-        "latencyLead": "Najwolniejsze {slowest} ·",
+        "latencyLead": "Śr. tura {avg} · Najwolniejsza {slowest} ·",
         "costLead": "Szczyt {peak} ·",
         "tokens": "{ratio}% w cache",
         "cacheImpact": "{ratio}% ponownie użyte · {tokens} Tok odczytane",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Brak danych",
       "noErrorsInRange": "Brak błędów w tym zakresie czasowym",
+      "loadFailed": "Nie udało się załadować ostatnich błędów",
       "time": "Czas",
       "service": "Usługa",
       "operation": "Operacja",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Zawsze aktywny (domyślny)",
     "testAtTimeLabel": "Testuj o czasie UTC",
     "testAtTimeHint": "Pozostaw puste, aby użyć bieżącego czasu. Poziomy szczytowe / pozaszczytowe są określane na podstawie tego czasu.",
-    "localTimeHint": "W Twojej strefie czasowej: {range}"
+    "localTimeHint": "W Twojej strefie czasowej: {range}",
+    "builtInStatus": {
+      "seed": "Wbudowane ceny: lista startowa dołączona do tego wydania, z dnia {date}.",
+      "neverSynced": "Synchronizacja online nie została uruchomiona od startu serwera.",
+      "lastSynced": "Ostatnia synchronizacja online: {time}."
+    },
+    "unpriced": {
+      "title": "Luki w cenniku",
+      "subtitle": "Modele w Twoich trace'ach LLM, które w momencie pozyskania nie miały ceny lub miały tylko przybliżoną",
+      "banner": "{count} model nie miał ceny lub miał przybliżoną cenę w momencie pozyskania. Jego zapisany koszt może być niekompletny. | {count} modeli nie miało ceny lub miało przybliżoną cenę w momencie pozyskania. Ich zapisane koszty mogą być niekompletne.",
+      "bannerTruncated": "{total} modeli w Twoich trace'ach nie miało ceny lub miało przybliżoną w momencie pozyskania. Ich koszt może być błędny. Wyświetlono pierwsze {shown} według liczby tokenów.",
+      "streamLabel": "Strumień",
+      "window": "Ostatnie 24 godziny",
+      "windowRange": "{from} – {to}",
+      "colModel": "Model wykryty w trace'ach",
+      "colPricedAs": "Wyceniany jako",
+      "colTokens": "Tokeny",
+      "colCost": "Zapisany koszt",
+      "colActions": "Akcje",
+      "spans": "{count} span | {count} span",
+      "moreAgents": "+{count} więcej",
+      "noMatch": "Brak dopasowania",
+      "approximate": "Przybliżona",
+      "pricedNow": "Wyceniane dla nowych spanów",
+      "historicalGap": "To okno zachowuje zapisaną lukę w cenniku. Nowe spany używają bieżącej ceny.",
+      "noActionNeeded": "Nie wymaga działania",
+      "defaultTierPrices": "wej. {input} / wyj. {output} za 1M",
+      "notPriced": "bez ceny",
+      "createPrice": "Utwórz cenę",
+      "keepPrices": "Zachowaj ceny {name}",
+      "mute": "Wycisz",
+      "muteConfirmTitle": "Wyciszyć ten model?",
+      "muteConfirmMessage": "Nowe spany {model} będą wyceniane jako darmowe. Starsze spany zachowają zapisany koszt. Usuń cenę \"{name}\", aby anulować wyciszenie.",
+      "mutedNotif": "Wyciszono {model}",
+      "keptNotif": "{model} używa teraz cen {name}",
+      "errSave": "Nie udało się zapisać ceny",
+      "errLoad": "Nie udało się załadować modeli bez ceny",
+      "emptyTitle": "W tym strumieniu w tym oknie nie zapisano użycia modeli bez ceny ani z ceną przybliżoną.",
+      "noStreamsTitle": "Brak strumieni trace'ów LLM",
+      "noStreamsDesc": "Modele pojawią się tutaj, gdy spany gen_ai trafią do strumienia trace'ów.",
+      "recordedCostNote": "Nowe ceny dotyczą spanów pozyskanych po zapisaniu. Starsze spany zachowują zapisany koszt.",
+      "noModelName": "(brak nazwy modelu)",
+      "noModelHint": "Brak modelu do wycenienia: ustaw gen_ai.request.model",
+      "instrumentationDocs": "Przewodnik po instrumentacji"
+    }
   },
   "aiObservability": {
     "title": "Obserwowalność AI",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Pominięte wiersze: {full} w pełni · {partial} częściowo",
       "scoreEvidence": "{scorer} · v{version}: próbki: {samples}, bez referencji: {noReference}, bez trace: {noTrace}",
       "scorerApplicability": "{scorer} · v{version}: kwalifikujące się sloty: {eligible}, bez referencji: {noReference}",
+      "costUnknown": "koszt nieznany",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Nie udało się załadować eksperymentów",
       "previewError": "Nie udało się wyświetlić podglądu slotów eksperymentu",
       "createSuccess": "Utworzono eksperyment",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Szacowany koszt tego eksperymentu to około {cost}, powyżej progu ostrzegawczego {threshold}. Utworzyć i uruchomić go mimo to?",
         "costConfirmMessageUnpriced": "Szacowany koszt tego eksperymentu przekracza próg ostrzeżenia. Utworzyć go i uruchomić mimo to?",
         "costConfirmOk": "Utwórz mimo to",
+        "taskProviderFailed": "Nic nie utworzono. Dostawca zadań {provider} nie odpowiedział na wywołanie testowe.",
+        "judgeProviderFailed": "Nic nie utworzono. Dostawca oceniającego LLM {provider} nie odpowiedział na wywołanie testowe.",
         "skippedFully": "Wiersze całkowicie pominięte: {count} — każdy wybrany ewaluator wymaga oczekiwanego wyniku. Pominięte wiersze nie generują kosztów.",
         "skippedPartially": "Wiersze częściowo pominięte: {count} — zadanie nadal działa, ale ewaluatory oparte na referencji nie mogą oceniać wierszy bez oczekiwanego wyniku.",
         "skippedNone": "Każdy dopasowany wiersz może być oceniony w co najmniej jednym wymiarze.",
@@ -17408,7 +17851,26 @@
           "trials": "Próby",
           "dispersion": "Dyspersja",
           "latency": "Latencja",
-          "p50Latency": "Opóźnienie P50"
+          "p50Latency": "Opóźnienie P50",
+          "error": "Błąd"
+        },
+        "failureBanner": {
+          "title": "{failed} z {total} slotów zakończyło się niepowodzeniem: {cause}.",
+          "cause": "Główna przyczyna, {count} wystąpień: {message}",
+          "moreCauses": "+ {count} więcej przyczyn",
+          "noMessage": "nie zapisano komunikatu o błędzie",
+          "openProviders": "Otwórz dostawców"
+        },
+        "failureKinds": {
+          "provider_auth": "dostawca odrzucił poświadczenia",
+          "rate_limited": "dostawca ograniczył szybkość uruchomienia",
+          "timeout": "dostawca nie odpowiedział na czas",
+          "provider_5xx": "dostawca zwrócił błąd serwera",
+          "parse_error": "nie udało się przeanalizować danych wyjściowych",
+          "mapping_error": "nie udało się zbudować danych wejściowych zadania",
+          "scorer_missing": "ewaluator już nie istnieje",
+          "execution_error": "wywołanie zadania nie powiodło się",
+          "unknown": "wywołanie zadania nie powiodło się"
         },
         "saveAsPrompt": "Zapisz jako prompt",
         "openPrompt": "Otwórz prompt",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Środowisko",
       "agent": "Agent",
-      "version": "Wersja"
+      "version": "Wersja",
+      "agentIdHint": "ID agenta: {ids}",
+      "noAgentIdentity": "Nie znaleziono tożsamości agenta",
+      "noAgentIdentityDescription": "Te spany LLM nie zawierają nazwy agenta, więc są wyświetlane według strumienia. Zmapuj atrybut określający nazwę agenta, aby wyświetlać je według agenta.",
+      "noAgentIdentityAction": "Otwórz mapowanie agentów GenAI"
     },
     "agentGraph": {
       "stream": "Strumień",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Ewaluacje są wyłączone na tym serwerze",
+      "description": "Ta strona wymaga ewaluacji online, które są wyłączone na tym serwerze. Poproś administratora o ich włączenie."
+    },
     "traceScoreChip": {
       "reasoning": "Dlaczego",
       "noReasoning": "Brak zarejestrowanego uzasadnienia dla tego wyniku.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Skonfiguruj endpoint"
     },
     "provider": {
-      "backTo": "Powrót do dostawców",
+      "backTo": "Dostawcy",
       "createTitle": "Utwórz dostawcę LLM",
       "editTitle": "Edytuj dostawcę LLM",
       "subtitle": "Skonfiguruj endpoint modelu używany przez ewaluatory typu sędzia LLM.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Ewaluator {index}: nazwa \"{name}\" występuje więcej niż raz w tym imporcie"
         }
       },
-      "backTo": "Powrót do ewaluatorów",
+      "backTo": "Ewaluatory",
       "badgeRemote": "Zdalny",
       "badgeLlm": "LLM Judge",
       "createTitleRemote": "Nowy zdalny ewaluator",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Wybierz dostawcę",
       "modelLabel": "Model",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperatura",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "Od 0 do 2. Pozostaw puste, aby oceniać przy 0.",
       "promptLabel": "Monit oceniający",
       "includeReasoningLabel": "Uwzględnij uzasadnienie",
       "includeReasoningHint": "Oceniający wyjaśnia, dlaczego przyznał tę ocenę, zapisaną z każdym wynikiem.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Nazwa nagłówka jest wymagana",
         "apiKeyTokenRequired": "Token jest wymagany",
         "timeoutInvalid": "Limit czasu musi wynosić 0 lub więcej",
+        "temperatureInvalid": "Temperatura musi mieścić się w zakresie od 0 do 2",
         "retriesInvalid": "Ponowienia muszą wynosić 0 lub więcej",
         "duplicateFieldName": "Nazwy pól muszą być unikalne"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Obniżony",
         "waitingForCredentials": "Oczekiwanie na dane uwierzytelniające",
         "noRecentRuns": "Brak ostatnich uruchomień",
+        "lastScored": "Ostatnio oceniono {time}",
         "summary": "{errors} z {runs} uruchomień nie powiodło się w ciągu ostatnich 15 minut",
         "since": "Przeszedł w ten stan {time}",
         "checked": "Ostatnio sprawdzono {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Ocenia {percent}% dopasowanych celów.",
       "samplingValueAllHelp": "Każdy dopasowany cel jest oceniany.",
       "samplingHelp": "Uruchamiane po filtrowaniu, aby kontrolować koszty.",
-      "backTo": "Powrót do zadań ewaluacji",
+      "backTo": "Zadania ewaluacji",
       "createTitle": "Nowe zadanie ewaluacji",
       "editTitle": "Aktualizuj zadanie ewaluacji",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Ta gałąź kończy się już miejscem docelowym.",
       "chooseATriggerNodeToStart": "Wybierz węzeł wyzwalający, aby uruchomić przepływ pracy.",
       "thisConnectionWouldCreateALoop": "To połączenie utworzyłoby pętlę.",
-      "onlyOneIncomingConnectionToA": "Do kroku może prowadzić tylko jedno połączenie przychodzące."
+      "onlyOneIncomingConnectionToA": "Do kroku może prowadzić tylko jedno połączenie przychodzące.",
+      "endpointUrlCopied": "Skopiowano adres URL punktu końcowego"
     },
     "views": {
       "youAreNotAuthorizedToManage": "Nie masz uprawnień do zarządzania licencją.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Szukaj bazy danych lub usługi…",
       "unnamedInstance": "Instancja bez nazwy",
+      "schemaCount": "{count} schemat | {count} schematów",
       "unnamedInstanceHint": "Raporty o instrukcjach samej bazy danych potwierdzają, że ten silnik działa, ale nie podają nazwy hosta. Wiersz pokaże adres, gdy zostanie skonfigurowane źródło danych, które go przenosi — próbkowanie sesji lub metryki instancji.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Zliczono do {time}; ostatnie pół minuty wciąż napływa.",
       "lineExact": "Wszystkie bazy danych raportują. Czasy są tutaj mierzone dla każdego wywołania, więc są dokładne.",
       "lineExactEstimated": "Wszystkie bazy danych raportują. Czasy są tutaj uśrednione z kilku odcinków czasu, więc są przybliżone, ale nie dokładne.",
+      "lineExactSlowestSchema": "Wszystkie bazy danych raportują. Szybkości są dokładne dla każdego schematu; baza danych z kilkoma schematami pokazuje najwolniejszy z nich.",
       "lineSubsetUnnamed": "Twoje filtry zawężają to poniżej poziomu, na którym sumują się te wartości, więc wartości procentowe opisują wyświetlane wiersze, a nie całą bazę danych.",
       "lineQuery": "Czasy są mierzone z poziomu Twojej aplikacji, więc obejmują czas sieci i oczekiwanie na wolne połączenie.",
       "lineUncodedErrors": "{percent} błędów tutaj nie miało kodu przyczyny, więc można je policzyć, ale nie wyjaśnić.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "Ten alert wyzwolił się po raz pierwszy.",
     "escalationNotStarted": "Jeszcze nie wezwano",
     "escalationPagesNobody": "Nie wzywa nikogo",
+    "escalationNobodyPaged": "Nikt nie jest wzywany",
     "escalationTo": "eskaluje do {who} {when}",
     "escalationDetailCapped": "Bieżące szczegóły eskalacji są ładowane dla najstarszych otwartych wezwań (maks. {count}).",
     "responder": "Reagujący",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "Do",
     "rotationRestrictionAdd": "Dodaj okno",
     "rotationRestrictionRemove": "Usuń",
-    "rotationRestrictionZeroLength": "Od i Do są takie same, więc to okno nigdy nie pasuje, a warstwa po cichu nigdy nie wygrywa. Aby objąć cały dzień, ustaw Do na 24:00.",
+    "rotationRestrictionZeroLength": "Od i Do są takie same, więc to okno nigdy nie będzie dopasowane. Zapis pozostaje wyłączony, dopóki Od i Do nie będą się różnić; aby ustawić pełny dzień, ustaw Do na 24:00.",
     "rotationRetiredTag": "Wycofana",
     "rotationSectionWhen": "Kiedy następuje zmiana",
     "rotationName": "Nazwa rotacji",
@@ -25593,6 +26072,10 @@
     "snoozed": "Wyciszone",
     "snoozedUntil": "Wyciszone do {time} — nadal nieprzypisane",
     "snoozeFailed": "Nie udało się wyciszyć wezwania",
+    "unsnooze": "Zakończ wyciszenie",
+    "unsnoozeHint": "Kończy wyciszenie teraz. Wzywanie jest kontynuowane od kroku, na którym zostało wstrzymane.",
+    "unsnoozed": "Wyciszenie zakończone · wzywanie jest kontynuowane",
+    "unsnoozeFailed": "Nie udało się zakończyć wyciszenia",
     "note": "Notatka",
     "notePlaceholder": "Co znalazłeś? Co próbowałeś?",
     "addNote": "Dodaj notatkę",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Ci sami ludzie, przesunięci o jedną zmianę, dzięki czemu osoba z rotacji zapasowej nigdy nie jest tą, która już pełni dyżur. To zwykła rotacja — nic nie wiąże obu, więc edycja tylko jednego harmonogramu bez drugiego pozwala im się rozjechać, a pojawia się ostrzeżenie, a nie cicha korekta.",
     "rotationPreviewPairLegend": "Podstawowa · Zapasowa",
     "rotationPreviewEmpty": "Wybierz osoby i pierwsze przekazanie dyżuru, aby zobaczyć, kto pełni dyżur i kiedy.",
+    "rotationPreviewNow": "Teraz – {until}",
     "defaultRotationName": "Rotacja",
     "teamCreatedWithoutMembers": "Zespół został utworzony, ale nie udało się dodać jego członków. Dodaj ich na karcie Członkowie.",
     "teamCreatedWithoutRotation": "Zespół i jego członkowie zostali utworzeni, ale nie udało się zapisać rotacji. Ustaw ją na karcie Harmonogram.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "nikt nie potwierdził — te wezwania wciąż trwają",
     "sectionHint_ringingRouted": "nikt nie potwierdził — {count} z nich nadal jest wzywane | nikt nie potwierdził — {count} z nich nadal jest wzywanych",
     "sectionHint_ringingUnrouted": "{count} nie ma zespołu, więc nie jest wzywane | {count} nie mają zespołu, więc nie są wzywane",
+    "sectionHint_ringingStopped": "{count} nie jest wzywany | {count} nie są wzywani",
     "sectionHint_snoozed": "wzywanie wstrzymane — wrócą same",
     "sectionHint_handled": "potwierdzone — każdym zajmuje się człowiek",
     "sectionHint_resolved": "zamknięte — zachowane dla dokumentacji",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "Zespół wzywany, gdy sygnał pasuje. Jego własna drabinka eskalacji decyduje, kto zostanie obudzony i w jakiej kolejności.",
     "scopeOwns": "Ten zespół posiada",
     "scopeAdvanced": "Zaawansowane",
-    "ruleEditorConflictUnclaimed": "Nic nie przejmuje dziś tej ścieżki — pasujące wezwanie trafia do zespołu zbiorczego albo do nikogo.",
+    "ruleEditorConflictUnclaimed": "Żadna reguła nie przejmuje obecnie tej ścieżki — sądząc wyłącznie po tych warunkach, pasujące wezwanie trafi do reguły ogólnej albo do nikogo.",
     "ruleEditorConflictHeldBy": "Dziś pasujące wezwanie trafia do {team}, przez {path}.",
     "ruleEditorConflictTakesOver": "Twoja reguła przypina więcej, więc odbierze je od {team}.",
     "ruleEditorConflictKeptBy": "Ścieżka należąca do {team} przypina więcej, więc zachowują je, a ta reguła przechwytuje tylko resztę.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} wzywa ten zespół tylko w {scope}. Poza tym trafia do tego, kto posiada otaczający zakres.",
     "scopeNothingDiscovered": "Nic nie zostało jeszcze odkryte, więc nie ma zasobów do wyboru. Użyj trybu Zaawansowane, aby zapisać regułę według pola, albo najpierw wyślij dane telemetryczne.",
     "scopeAdvancedHint": "Dopasuj według dowolnego pola i wartości, w tym takich, których nie obejmują poziomy powyżej.",
+    "scopeValuesSeen": "Te listy pokazują wartości, które zaobserwowało wykrywanie usług. Aby dopasować dowolną inną wartość, użyj opcji Zaawansowane.",
     "escalationHeld": "Najpierw triage AI · wezwanie w ciągu {n} s",
     "escalationPagingStep": "Wzywanie, krok {step} z {total} · {who}",
     "escalationPagingStepOnly": "Wzywanie, krok {step} z {total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Utwórz zespół i rotację",
     "removeMemberHandsOver": "{name} przejmuje bieżącą zmianę {leaving} w {rotation}.",
     "removeMemberLeavesGap": "Nikt nie przejmuje bieżącej zmiany {leaving} w {rotation}.",
+    "removeMemberReorders": "Ta osoba opuszcza także {rotations}, więc to, kto tam dyżuruje, również może się zmienić.",
     "membersJoinEnd": "{names} dołącza na koniec {rotations}. Osoba na dyżurze teraz się nie zmienia. | {names} dołączają na koniec {rotations}. Osoba na dyżurze teraz się nie zmienia.",
     "membersAdded": "Dodano: {names}. | Dodano: {names}.",
     "removeMemberConfirm": "Usuń",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Pytania: {contact}",
       "outboundQueue": "Wiadomości alertów: {count} w kolejce, najstarsza {age} | Wiadomości alertów: {count} w kolejce, najstarsza {age}",
       "outboundEmpty": "Brak wiadomości alertów w kolejce",
+      "refusedPosts": "{count} publikacja alertu nie powiodła się w ciągu ostatnich 24 godzin. Ostatnia: {reason} w {destination}, | {count} publikacji alertów nie powiodło się w ciągu ostatnich 24 godzin. Ostatnia: {reason} w {destination},",
       "ageSeconds": "{count} s"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "Nie udało się wysłać przypomnień."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(brak nazwy modelu)",
+    "topModels": "{models} (najpopularniejsze {shown} z {total})",
+    "cost": {
+      "partial": "częściowy",
+      "unknown": "koszt nieznany",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Koszt częściowy. Brak ceny dla {models}: nie uwzględniono {tokens} tokenów w tym zakresie ({scope}).",
+      "unknownTooltip": "Koszt nieznany. Brak ceny dla {models}: żaden z {tokens} tokenów w tym zakresie ({scope}) nie ma kosztu.",
+      "scopeSession": "sesja",
+      "scopeTrace": "trace",
+      "unknownModel": "model bez nazwy",
+      "addPrice": "Dodaj cenę"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} tokenów bez ceny",
+      "unpricedTooltip": "Koszt to dolna granica: {tokens} tokenów w {models} nie ma ceny. Otwórz kartę Unpriced w LLM Model Pricing.",
+      "pricedSinceTooltip": "Koszt to dolna granica: {tokens} tokenów w {models} zarejestrowano przed dodaniem ceny i nie mają one przypisanego kosztu."
+    },
+    "chart": {
+      "costMissing": "Poza tym wykresem: {models}. {tokens} tokenów nie ma ceny.",
+      "costMissingPricedSince": "Poza tym wykresem: {models}. {tokens} tokenów zarejestrowano przed dodaniem ceny.",
+      "unpricedModels": "Bez ceny: {models}",
+      "pricedSinceModels": "Zarejestrowane przed dodaniem ceny: {models}",
+      "addPrice": "Dodaj cenę"
+    },
+    "health": {
+      "title": "Kondycja danych",
+      "passing": "{n} zaliczonych",
+      "checkedAgo": "sprawdzono {ago}",
+      "drawerTitle": "Kondycja danych AI",
+      "drawerSubtitle": "{stream} · bieżące okno",
+      "rerun": "Uruchom kontrole ponownie",
+      "close": "Zamknij",
+      "loadError": "Nie udało się uruchomić kontroli kondycji danych.",
+      "samples": "Próbki:",
+      "copyLink": "Skopiuj link dla administratora",
+      "linkCopied": "Link skopiowany",
+      "status": {
+        "pass": "Zaliczone",
+        "warning": "Ostrzeżenie",
+        "error": "Błąd"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Modele bez ceny",
+          "detail": "{count} model · {spans} spanów · {tokens} tokenów liczonych jako $0 | {count} modeli · {spans} spanów · {tokens} tokenów liczonych jako $0",
+          "pass": "Każdy model w tym oknie ma cenę. Spany zarejestrowane przed dodaniem ceny zachowują zapisany koszt.",
+          "fix": "Popraw w LLM Model Pricing",
+          "truncated": "Pierwsze {shown} z {total} według tokenów"
+        },
+        "missing_agent_identity": {
+          "label": "Brak tożsamości agenta",
+          "detail": "{affected} z {total} spanów LLM ({pct}) nie ma atrybutu gen_ai.agent.name, więc widoki agentów ich nie obejmują.",
+          "pass": "Każdy span LLM ma nazwę lub identyfikator agenta.",
+          "fix": "Otwórz GenAI Agent Mapping"
+        },
+        "zero_duration_spans": {
+          "label": "Spany o zerowym czasie trwania",
+          "detail": "{affected} spanów LLM zgłasza 0 ms, więc opóźnienie i czas trwania sesji są zaniżone.",
+          "pass": "Żaden span LLM nie zgłasza 0 ms.",
+          "fix": "Jak to naprawić"
+        },
+        "missing_session_id": {
+          "label": "Spany bez identyfikatora sesji",
+          "detail": "{affected} z {total} spanów LLM ({pct}) nie ma atrybutu gen_ai.conversation.id, więc Sesje ich nie obejmują.",
+          "pass": "Każdy span LLM ma gen_ai.conversation.id.",
+          "fix": "Przewodnik integracji"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Zarządzanie flotą",
     "subtitle": "Rejestruj kolektory OpenTelemetry, wersjonuj ich konfiguracje i bezpiecznie wdrażaj zmiany",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "W toku",
       "scheduled": "Zaplanowane",
+      "waiting": "Oczekiwanie",
       "completed": "Zakończone",
       "halted": "Wstrzymane",
       "superseded": "Zastąpione",
@@ -28696,7 +29257,7 @@
       "version": "Wersja",
       "pickConfig": "Wybierz konfigurację",
       "pickFleet": "Wybierz flotę",
-      "emptyFleet": "Flota nie ma kolektorów, więc wersja jest ustawiana od razu",
+      "emptyFleet": "W flocie nie ma kolektorów, więc wdrożenie poczeka, aż dołączy pierwszy z nich",
       "startingShortly": "Wkrótce start",
       "eventGateFailed": "Bramka kondycji niezaliczona",
       "eventHalted": "Wstrzymano",
@@ -28707,7 +29268,10 @@
       "notFound": "To wdrożenie już nie istnieje",
       "notFoundDescription": "Link może być nieaktualny. Wybierz wdrożenie z listy.",
       "noneTargeted": "Nie wskazano kolektorów",
-      "outcomeNoneTargeted": "Flota nie miała kolektorów w chwili ustawienia v{to}.",
+      "outcomeNoneTargeted": "Żaden kolektor nie przyjął wersji v{to} w tym wdrożeniu.",
+      "outcomeWaiting": "Żaden kolektor nie jest online, więc v{to} nie trafiła jeszcze do nikogo. Wdrożenie rozpocznie się, gdy któryś się połączy.",
+      "waitingForCollector": "Oczekiwanie na kolektor",
+      "notStarted": "Nie rozpoczęto",
       "versionFailedBefore": "v{version} · wcześniej zakończona niepowodzeniem",
       "pickVersion": "Wybierz wersję",
       "autoRollback": "Wycofaj automatycznie",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Wznowiono",
       "eventSkipped": "Pominięto kolektory z błędami",
       "eventStarted": "Rozpoczęto",
+      "eventWaiting": "Oczekiwanie na pojawienie się kolektora online",
       "eventTimedOut": "Przekroczono czas fazy",
       "eventSkippedOffline": "Pominięto kolektor ({count}), który był offline na początku; otrzyma wersję po ponownym połączeniu | Pominięto kolektory ({count}), które były offline na początku; otrzymają wersję po ponownym połączeniu",
       "excluded": "Wykluczono",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Faza, która nie potwierdzi ani nie odrzuci w ciągu {minutes} min, wstrzymuje wdrożenie (ustawienie floty)",
       "phaseVerifying": "Weryfikacja",
       "phases": "Fazy",
-      "planEmpty": "Brak kolektorów do aktualizacji",
+      "planEmpty": "Żaden kolektor nie jest online, więc wdrożenie poczeka, aż któryś się połączy",
+      "planStable": "Brak kolektora online; wersja stabilna trafi do każdego z nich po połączeniu",
       "planOne": "Kolektor w jednej partii: {count} | Kolektory w jednej partii: {count}",
       "planText": "{steps} → pozostałe {last}, faz: {count}",
       "planUnavailable": "Podgląd planu jest niedostępny",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 zachowuje kolektory offline bezterminowo"
     },
     "audit": {
-      "search": "Przeszukaj dziennik audytu",
       "editedConfig": "Edytowano konfigurację",
       "revokedToken": "Odwołano token rejestracyjny",
       "enrolledCollector": "Zarejestrowano kolektor",
@@ -28920,7 +29485,6 @@
       "setDesired": "Zmieniono wersję",
       "autoRollback": "Wycofano automatycznie",
       "rolloutHalted": "Wstrzymano wdrożenie",
-      "assignedFleetConfig": "Przypisano konfigurację floty",
       "createdFleet": "Utworzono flotę",
       "renamedFleet": "Zmieniono nazwę floty",
       "deletedFleet": "Usunięto flotę",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Wycofano wdrożenie",
       "movedByToken": "Przeniesiono przez token rejestracyjny",
       "object": "Obiekt",
+      "search": "Przeszukaj dziennik audytu",
       "allObjects": "Wszystkie obiekty",
       "kind": {
         "fleet": "Flota",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "Wdrażanie v{to}",
       "rolloutHalted": "Wdrożenie v{to} wstrzymane",
+      "rolloutWaiting": "v{to} czeka na pojawienie się kolektora online",
       "autoRolledBack": "Wersja v{to} wycofano automatycznie",
       "noReason": "Nie zgłoszono przyczyny błędu",
       "openRollout": "Otwórz wdrożenie",
diff --git a/web/src/locales/languages/pt-PT.json b/web/src/locales/languages/pt-PT.json
index 46ed660df9..66ac72e21a 100644
--- a/web/src/locales/languages/pt-PT.json
+++ b/web/src/locales/languages/pt-PT.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Ainda não há atividade de LLM",
       "description": "Instrumente os seus serviços com as convenções semânticas de IA generativa do OpenTelemetry e ingira pelo menos um trace para preencher este dashboard.",
-      "action": "Instrumentar com OpenTelemetry",
-      "actionDesc": "Capture os atributos gen_ai_* nos seus traces"
+      "action": "Todas as integrações de IA",
+      "actionDesc": "Consulte todos os guias de frameworks e fornecedores",
+      "suggested": "Configurar o tracing de {name}",
+      "suggestedDesc": "Sugerido porque veio da documentação de {name}",
+      "codingAgent": "Instrumentar com um agente de programação",
+      "codingAgentDesc": "O seu agente de programação adiciona o tracing e verifica o primeiro trace",
+      "startFrom": "Ou comece por"
     },
     "noLLMSessions": {
       "title": "Ainda não há sessões de LLM",
@@ -4797,6 +4802,13 @@
       "success": "Sucesso",
       "failed": "Falhou",
       "testRun": "Execução de teste",
+      "source": "Origem",
+      "sourceHttp": "Pedido HTTP",
+      "sourceAlertFired": "Alerta disparado",
+      "sourceIncidentEvent": "Evento de incidente",
+      "sourceRetry": "Execução de nova tentativa",
+      "sourceManual": "Execução manual",
+      "sourceOther": "Outro",
       "runType": "Tipo",
       "testRunTooltip": "Iniciada a partir do editor. As etapas de destino fazem envios reais.",
       "showTestRuns": "Mostrar {count} execução(ões) de teste",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Repetir esta execução?",
       "retryMessage": "Isto cria uma nova execução a partir da entrada que a execução com falha registou. As etapas de destino fazem envios reais.",
       "retryStarted": "Nova tentativa iniciada — aparece na lista como uma nova execução.",
-      "retryError": "Não foi possível repetir esta execução"
+      "retryError": "Não foi possível repetir esta execução",
+      "statusQueued": "Em fila",
+      "statusRunning": "Em execução",
+      "statusExpired": "Expirado",
+      "reasonExpired": "nunca executado · em fila há mais de 1 h",
+      "reasonWorkerLost": "worker perdido · não reexecutado",
+      "reasonWorkflowDisabled": "o fluxo de trabalho estava desativado",
+      "reasonRunTimeout": "excedeu o tempo limite após 15 min",
+      "allTriggers": "Todos os acionadores",
+      "triggerFilter": "Acionador",
+      "run": "Execução",
+      "searchRuns": "Pesquisar ID de execução, chave de idempotência ou alerta",
+      "sourceDetails": "Detalhes da origem",
+      "detailsWithKey": "{ip} · chave {key}",
+      "detailsNoKey": "{ip} · sem chave de idempotência",
+      "retryOf": "Nova tentativa de {run}",
+      "openRun": "Abrir execução",
+      "alertFiredEmptyTitle": "Nenhuma execução disparada por alerta neste intervalo de tempo",
+      "incidentEventEmptyTitle": "Nenhuma execução de evento de incidente neste intervalo de tempo",
+      "filterEmptyTitle": "Nenhuma execução correspondente neste intervalo de tempo",
+      "filterEmptyDimmed": "As outras execuções continuam na linha temporal, esbatidas.",
+      "searchEmptyTitle": "Nenhuma execução corresponde a esta pesquisa",
+      "searchEmptyAction": "Limpar pesquisa",
+      "timelineNow": "agora",
+      "timelineAgoMinutes": "−{n}m",
+      "timelineAgoHours": "−{n}h",
+      "timelineAgoDays": "−{n}d"
     },
     "edit": "Editar",
     "view": "Visualizar",
@@ -4958,7 +4996,9 @@
           "noMatch": "Sem correspondência"
         },
         "suppressed": "Suprimido — não enviado para o destino real"
-      }
+      },
+      "payloadFrom": "Payload de",
+      "payloadFromHint": "A estrutura HTTP é o que os chamadores do endpoint enviam."
     },
     "linkAlerts": {
       "title": "Vincular fluxo de trabalho a alertas",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Formato de Saída",
       "tlsVerifyLabel": "Verificação TLS",
       "tlsDisabled": "Desativado"
+    },
+    "http": {
+      "runTestHint": "Executa os passos com um payload HTTP de exemplo; não chama o URL",
+      "runTestHintList": "Abra o fluxo de trabalho para executar um teste",
+      "runsEmptyTitle": "Nenhum pedido HTTP neste intervalo de tempo",
+      "runsEmptyBody": "Alargue o intervalo de tempo ou envie um pedido de teste a partir do painel do endpoint HTTP.",
+      "runsEmptyAction": "Mostrar todos os acionadores",
+      "runFailedAt": "Esta execução falhou no passo {step}: {error}",
+      "openStep": "Abrir passo",
+      "runGuardHint": "As execuções HTTP transportam o pedido, não os campos de alerta. Se este passo lê {fields}, proteja-o com uma Condição: {guard}.",
+      "runExpiredBanner": "Este pedido esperou mais de 1 hora na fila e nunca foi executado. Nenhum passo foi executado e nenhum destino foi chamado.",
+      "runWorkerLostBanner": "O worker que estava a executar este pedido parou. Não é reexecutado automaticamente, porque os destinos podem já ter sido chamados. Verifique-os antes de o chamador reenviar.",
+      "request": "Pedido",
+      "requestReceived": "Recebido",
+      "requestToken": "Token",
+      "requestCallerIp": "IP do chamador",
+      "requestIdempotencyKey": "Chave de idempotência",
+      "requestContentType": "Tipo de conteúdo",
+      "requestBodySize": "Tamanho do corpo",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Cabeçalhos",
+      "headersKept": "{count} guardado · Authorization, cookies e assinaturas nunca são armazenados | {count} guardados · Authorization, cookies e assinaturas nunca são armazenados",
+      "headerName": "Nome",
+      "headerValue": "Valor",
+      "outputCaption": "O que cada passo seguinte recebeu",
+      "useAsTestInput": "Utilizar como entrada de teste",
+      "editorButton": "Endpoint HTTP",
+      "editorButtonOn": "Ativado",
+      "editorButtonOff": "Desativado",
+      "editorButtonTooltip": "Permitir que outro sistema inicie este fluxo de trabalho com um pedido HTTP",
+      "editorButtonRefusedDraft": "Os pedidos recebem 403 até o fluxo de trabalho ser publicado",
+      "editorButtonRefusedPaused": "Os pedidos recebem 403 enquanto o fluxo de trabalho estiver em pausa",
+      "panelTitle": "Endpoint HTTP",
+      "panelSubtitle": "{name} · fluxo de trabalho {kind}",
+      "acceptRequests": "Aceitar pedidos HTTP",
+      "kindNote": "Steps of this workflow were built for {kind} runs. HTTP runs get the request instead ({field}), so add a Condition if a step needs {kind} fields.",
+      "kindNotePayload": "Mostrar o payload HTTP",
+      "kindNotePayloadHide": "Ocultar o payload HTTP",
+      "unsavedBody": "Este fluxo de trabalho ainda não foi guardado. Guarde-o como rascunho para criar o URL e o token. Os pedidos são recusados até publicar.",
+      "saveAndCreate": "Guardar rascunho e criar endpoint",
+      "needsAdmin": "A criação do endpoint requer um administrador da organização.",
+      "needsEdit": "Alterá-lo requer acesso de edição a este fluxo de trabalho.",
+      "readOnlyOnMeta": "Ativado · pode copiar o URL. Alterá-lo requer acesso de edição a este fluxo de trabalho.",
+      "offBody": "Permitir que outro sistema inicie este fluxo de trabalho com um pedido HTTP. Recebe um URL e um token.",
+      "offExistingBody": "Desativado · os pedidos são recusados (403) até o ativar.",
+      "onMeta": "Ativado · as execuções só começam enquanto o fluxo de trabalho estiver ativo e publicado",
+      "loadError": "Não foi possível carregar as definições do endpoint.",
+      "draftBanner": "Este fluxo de trabalho é um rascunho. As chamadas ao URL recebem 403 até publicar. Pode configurar o endpoint agora, e Executar teste executa os passos do rascunho com um payload HTTP de exemplo.",
+      "disabledBanner": "Os pedidos são recusados (403) até ativar o fluxo de trabalho.",
+      "turnOnFailed": "Não foi possível ativar o endpoint. {reason}",
+      "changeFailed": "Não foi possível guardar o endpoint. {reason}",
+      "endpointExistsHint": "O endpoint já existe. Mostre ou copie o respetivo token na tabela Tokens.",
+      "endpointExistsHintSigned": "O endpoint já existe. Mostre ou copie o respetivo segredo de assinatura na tabela Segredos de assinatura.",
+      "disableTitle": "Desativar o endpoint?",
+      "disableBody": "Os chamadores recebem 403 (endpoint desativado) até o voltar a ativar. O URL e os tokens mantêm-se iguais.",
+      "disableConfirm": "Desativar",
+      "lastCall": "Ativado · Última chamada: {status} · {time} · {link}",
+      "lastCallNone": "Ativado · Ainda não há chamadas — envie um pedido de teste",
+      "lastCallNoneRefused": "Ativado · Ainda não há chamadas",
+      "viewRun": "Ver execução",
+      "lastCallStatus": {
+        "queued": "em fila",
+        "running": "em execução",
+        "succeeded": "com êxito",
+        "failed": "falhou",
+        "expired": "expirado"
+      },
+      "endpointUrl": "URL do endpoint",
+      "tokenLabel": "Token",
+      "secretLabel": "Segredo de assinatura",
+      "newTokenLabel": "Novo token",
+      "newSecretLabel": "Novo segredo de assinatura",
+      "tokenHint": "Mascarado no ecrã; Copiar copia o token real. Envie-o como {header}, nunca no URL.",
+      "secretHint": "Mascarado no ecrã; Copiar copia o segredo real. Assine cada pedido com ele e envie os cabeçalhos {headers}; nunca envie o próprio segredo.",
+      "revealBannerTitle": "Endpoint criado",
+      "revealBannerBody": "Envie este token em cada pedido. Pode voltar a mostrá-lo ou copiá-lo na tabela Tokens.",
+      "revealBannerBodySigned": "Assine cada pedido com este segredo. Pode voltar a mostrá-lo ou copiá-lo na tabela Segredos de assinatura.",
+      "switchedBannerTitle": "Token criado",
+      "switchedBannerTitleSigned": "Segredo de assinatura criado",
+      "rotateBannerTitle": "Novo token criado",
+      "rotateBannerTitleSigned": "Novo segredo de assinatura criado",
+      "rotateBannerBody": "Quem chama mantém o mesmo URL e cabeçalho; apenas o token muda. O token antigo continua a funcionar até expirar e pode ser mostrado até lá.",
+      "rotateBannerBodySigned": "Quem chama mantém o mesmo URL e cabeçalhos; apenas o segredo muda. O segredo antigo continua a funcionar até expirar e pode ser mostrado até lá.",
+      "rotateBannerBodyRevoked": "Quem chama mantém o mesmo URL e cabeçalho; apenas o token muda. O token antigo foi revogado e deixa de funcionar agora.",
+      "rotateBannerBodyRevokedSigned": "Quem chama mantém o mesmo URL e cabeçalhos; apenas o segredo muda. O segredo antigo foi revogado e deixa de funcionar agora.",
+      "rotateBannerBodyFresh": "Quem chama mantém o mesmo URL e cabeçalho e passa a enviar este token a partir de agora.",
+      "rotateBannerBodyFreshSigned": "Quem chama mantém o mesmo URL e cabeçalhos e passa a assinar com este segredo a partir de agora.",
+      "snippetsLabel": "Pedido de exemplo",
+      "sendTest": "Enviar pedido de teste",
+      "sendTestHint": "Verifica as credenciais e mostra o que os seus passos receberiam. Nenhuma execução é iniciada e nenhum destino é chamado.",
+      "sendTestHintPaused": "Verifica as credenciais. O fluxo de trabalho está em pausa, por isso a chamada é recusada antes de ser construída qualquer entrada; Executar teste executa os passos.",
+      "sendTestSigned": "Os navegadores não conseguem assinar pedidos, por isso teste com o pedido de exemplo acima. Adicione ?dry_run=true ao URL para verificar a assinatura sem iniciar uma execução.",
+      "dryRunAccepted": "Execução de teste aceite",
+      "dryRunMeta": "credenciais válidas · corpo de {size}",
+      "dryRunInput": "Entrada que os seus passos receberiam",
+      "dryRunRefused": "Credenciais válidas. Os pedidos são recusados até o fluxo de trabalho ser publicado.",
+      "dryRunRefusedPaused": "Credenciais válidas. Os pedidos são recusados enquanto o fluxo de trabalho estiver em pausa.",
+      "dryRunRateLimited": "Limite de taxa atingido — as execuções de teste contam para o limite.",
+      "dryRunStatus": "O pedido foi recusado com o estado {status}.",
+      "dryRunFailed": "Não foi possível enviar o pedido de teste. {reason}",
+      "runTestInstead": "Executar teste em vez disso",
+      "done": "Concluído",
+      "regionTag": "Região {name}",
+      "regionBanner": "Envie cada pedido, e cada nova tentativa, para o host desta região. As chaves de idempotência e o estado da execução ({field}) são mantidos na região que aceitou a chamada, pelo que uma nova tentativa enviada para outra região pode iniciar uma segunda execução.",
+      "authLabel": "Quem chama autentica-se com",
+      "authToken": "Token",
+      "authSigned": "Pedidos assinados",
+      "authAbout": "Acerca da autenticação",
+      "authInfo": "Token: envie o token no cabeçalho Authorization. Pedidos assinados: assine cada pedido com um segredo partilhado (cabeçalhos {headers}).",
+      "switchToSignedTitle": "Mudar para pedidos assinados?",
+      "switchToSignedBody": "A mudança revoga já o token atual e cria um segredo de assinatura. Quem chama com o token começa a receber 401.",
+      "switchToTokenTitle": "Mudar para token?",
+      "switchToTokenBody": "A mudança revoga de imediato o segredo de assinatura atual e cria um token. Os chamadores que assinam pedidos começam a receber 401.",
+      "tokensTitle": "Tokens",
+      "secretsTitle": "Segredos de assinatura",
+      "colToken": "Token",
+      "colSecret": "Segredo",
+      "colCreated": "Criado",
+      "colLastUsed": "Última utilização",
+      "colStatus": "Estado",
+      "colActions": "Ações",
+      "never": "Nunca",
+      "active": "Ativo",
+      "retiring": "Em retirada",
+      "creatorGone": "O criador já não pertence a esta organização",
+      "revoke": "Revogar",
+      "revokeNow": "Revogar agora",
+      "revokeTitle": "Revogar {prefix}? Os chamadores que o utilizam recebem 401 imediatamente.",
+      "revokeFailed": "Não foi possível revogar. {reason}",
+      "copyToken": "Copiar token",
+      "copySecret": "Copiar segredo",
+      "tokenCopied": "Token copiado",
+      "commandCopied": "Comando copiado",
+      "secretCopied": "Segredo copiado",
+      "revealFailed": "Não foi possível mostrar o token. {reason}",
+      "revealFailedSigned": "Não foi possível mostrar o segredo. {reason}",
+      "revealDenied": "Apenas os administradores podem mostrar ou copiar tokens para este endpoint.",
+      "runTest": "Executar teste",
+      "rotate": "Rodar",
+      "rotateBlocked": "Revogue primeiro o token em retirada",
+      "rotateBlockedSigned": "Revogue primeiro o segredo em retirada",
+      "rotateTitle": "Rodar token",
+      "rotateTitleSigned": "Rodar segredo de assinatura",
+      "rotateLead": "É criado agora um novo token. Manter {prefix} (última utilização: {time}) a funcionar durante",
+      "rotateLeadSigned": "É criado agora um novo segredo de assinatura. Manter {prefix} (última utilização: {time}) a funcionar durante",
+      "overlapNow": "Revogar imediatamente",
+      "overlapHour": "1 hora",
+      "overlapDay": "24 horas",
+      "overlapWeek": "7 dias",
+      "rotateConsequence": "Os chamadores que usam o token atual continuam a funcionar até {time}. Atualize-os antes disso.",
+      "rotateConsequenceSigned": "Os chamadores que assinam com o segredo atual continuam a funcionar até {time}. Atualize-os antes disso.",
+      "rotateConsequenceNow": "Os chamadores que usam o token atual recebem 401 a partir de agora.",
+      "rotateConsequenceNowSigned": "Os chamadores que assinam com o segredo atual recebem 401 a partir de agora.",
+      "rotateConfirm": "Rodar token",
+      "rotateConfirmSigned": "Rodar segredo de assinatura",
+      "rotateFailed": "Não foi possível efetuar a rotação. {reason}",
+      "advanced": "Avançado",
+      "advancedSummary": "Corpo máximo {size} · {count} pedido por minuto | Corpo máximo {size} · {count} pedidos por minuto",
+      "maxBody": "Tamanho máximo do corpo (KiB)",
+      "maxBodyHint": "Até 1024 (1 MiB); só o pode reduzir",
+      "maxBodyRange": "Introduza um número inteiro de 1 a 1024",
+      "rateLimit": "Pedidos por minuto",
+      "rateLimitHint": "Até {org} por minuto para esta organização",
+      "rateLimitRange": "Introduza um número inteiro de 1 a {org}",
+      "saveLimitsFailed": "Não foi possível guardar os limites. {reason}",
+      "deleteMeta": "Remove o URL e todos os tokens ou segredos.",
+      "deleteButton": "Eliminar endpoint",
+      "deleteTitle": "Eliminar este endpoint?",
+      "deleteBody": "O URL deixa de funcionar de imediato: os chamadores recebem 401. Todos os tokens e segredos de assinatura são eliminados e não podem ser recuperados. O histórico de execuções é mantido.",
+      "deleteFailed": "Não foi possível eliminar o endpoint. {reason}",
+      "secretStorageWarning": "Este servidor não tem chave mestra de cifra, pelo que os tokens e segredos de assinatura são guardados de uma forma que qualquer pessoa com acesso à base de dados pode ler. Peça ao seu administrador para definir uma.",
+      "rejectionsLine": "Cerca de {count} pedido rejeitado nas últimas 24 h · último: {reason}, {time} | Cerca de {count} pedidos rejeitados nas últimas 24 h · último: {reason}, {time}",
+      "rejectionsShow": "Mostrar",
+      "rejectionsHide": "Ocultar",
+      "rejectionsTitle": "Rejeições recentes",
+      "rejectionsCaption": "cerca de {count} nas últimas 24 h · o chamador viu apenas o código de estado | cerca de {count} nas últimas 24 h · o chamador viu apenas o código de estado",
+      "rejectionMeta": "cerca de {count} · último {time} · de {ip} | cerca de {count} · último {time} · de {ip}",
+      "rejectionsLoadError": "Não foi possível carregar as rejeições.",
+      "raiseLimit": "Aumentar limite",
+      "rotateLink": "Rodar",
+      "reason": {
+        "invalid_token": {
+          "title": "Token inválido",
+          "fix": "O chamador envia um token revogado, expirado ou mal escrito. Mostre ou copie o token atual da tabela Tokens."
+        },
+        "invalid_signature": {
+          "title": "Assinatura inválida",
+          "fix": "O chamador assina com um segredo antigo ou errado. Verifique se utiliza o segredo atual e se assina {format} exatamente como enviado."
+        },
+        "stale_timestamp": {
+          "title": "Timestamp demasiado antigo",
+          "fix": "O relógio do chamador está desfasado mais de 5 minutos. Sincronize o relógio e assine imediatamente antes de enviar."
+        },
+        "endpoint_disabled": {
+          "title": "Endpoint desativado",
+          "fix": "Ative o endpoint."
+        },
+        "workflow_disabled": {
+          "title": "Fluxo de trabalho em pausa",
+          "fix": "Retome o fluxo de trabalho a partir da lista."
+        },
+        "workflow_not_published": {
+          "title": "Fluxo de trabalho não publicado",
+          "fix": "Publique o fluxo de trabalho; os rascunhos recusam pedidos."
+        },
+        "payload_too_large": {
+          "title": "Payload demasiado grande",
+          "fix": "Superior a {size}. Envie menos ou divida os eventos por vários pedidos."
+        },
+        "credential_in_url": {
+          "title": "Credencial no URL",
+          "fix": "Foi enviado um token ou segredo no URL e o pedido foi recusado. Os URLs acabam nos logs de proxies e navegadores, por isso rode-o agora e envie-o num cabeçalho."
+        },
+        "invalid_idempotency_key": {
+          "title": "Chave de idempotência inválida",
+          "fix": "O cabeçalho Idempotency-Key está vazio ou tem mais de 255 caracteres."
+        },
+        "idempotency_key_reused": {
+          "title": "Chave de idempotência reutilizada",
+          "fix": "A mesma chave chegou com um corpo diferente. Utilize uma nova chave por cada evento distinto."
+        },
+        "rate_limited": {
+          "title": "Limite de pedidos atingido",
+          "fix": "Mais de {count} pedidos por minuto. Agrupe os eventos num único pedido (envie um array JSON) ou aumente o limite — até {org} por minuto para esta organização."
+        },
+        "queue_full": {
+          "title": "Fila cheia",
+          "fix": "Esta organização já tinha {count} execuções HTTP em espera. Os chamadores devem tentar novamente após o atraso indicado em Retry-After; procure um passo lento ou reduza a taxa de envio."
+        },
+        "worker_unavailable": {
+          "title": "Worker indisponível",
+          "fix": "Não estava nenhum worker de fluxos de trabalho em execução nesta região, pelo que nada foi colocado em fila. Os chamadores que tentarem novamente após o atraso Retry-After passam assim que um worker estiver de volta; se o problema persistir, peça ao seu administrador para verificar os workers de fluxos de trabalho."
+        }
+      },
+      "nodeBadge": "Invocável por HTTP",
+      "triggerLinkOn": "Também é executado em pedidos HTTP",
+      "triggerLinkOnAction": "Gerir endpoint",
+      "triggerLinkOff": "Inicie-o também a partir de outro sistema",
+      "triggerLinkOffAction": "Configurar endpoint HTTP",
+      "pickerCue": "Qualquer fluxo de trabalho também pode ser iniciado por um pedido HTTP. Escolha o respetivo acionador e, em seguida, utilize o endpoint HTTP na barra de ferramentas.",
+      "listTag": "HTTP",
+      "listTagTooltip": "Endpoint HTTP ativo",
+      "listMenuItem": "Endpoint HTTP…",
+      "copyUrl": "Copiar URL do endpoint",
+      "copyUrlDraftHint": "Os pedidos são recusados até publicar",
+      "copyUrlFailed": "Não foi possível copiar o URL do endpoint. {reason}",
+      "payloadFrom": "Payload de",
+      "payloadHttp": "Pedido HTTP",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "expira em {count} h | expira em {count} h",
+      "expiresInDays": "expira em {count} dia | expira em {count} dias",
+      "expired": "Expirado",
+      "rotateLeadUnused": "É criado agora um novo token. Mantenha {prefix} (nunca utilizado) a funcionar durante",
+      "rotateLeadUnusedSigned": "É criado agora um novo segredo de assinatura. Mantenha {prefix} (nunca utilizado) a funcionar durante",
+      "fieldGroup": "Pedido HTTP",
+      "fieldGroupBodyHint": "Os campos dentro do corpo do pedido precisam primeiro de um passo de função",
+      "fieldGroupQueryHint": "Os parâmetros de consulta são meta.query.<key>; chaves repetidas chegam como uma lista e nunca correspondem",
+      "rotateLeadNone": "Não há nenhum token ativo, pelo que os chamadores não conseguem autenticar-se. É criado agora um novo token.",
+      "rotateLeadNoneSigned": "Não há nenhum segredo de assinatura ativo, pelo que os chamadores não conseguem autenticar-se. É criado agora um novo segredo de assinatura.",
+      "createForbidden": "Não pode criar credenciais de endpoint nesta organização.",
+      "errorNotConfigured": "Este fluxo de trabalho não tem endpoint HTTP.",
+      "errorNoLiveCredential": "Não há nenhuma credencial ativa. Faça a rotação para criar uma.",
+      "errorNotAllowed": "Não tem permissão para fazer isto.",
+      "copyCredentialChanged": "A credencial foi alterada. Copie novamente.",
+      "copyCommandFailed": "Não foi possível copiar o comando. {reason}",
+      "exampleRequest": "Pedido de exemplo",
+      "exampleActiveToken": "Token ativo · {prefix}",
+      "exampleActiveSecret": "Segredo ativo · {prefix}",
+      "exampleHintToken": "A cópia inclui o token. Cole num terminal ou importe para o Postman ou o Insomnia (Import → Raw text).",
+      "exampleHintSigned": "Execute no bash: assina com openssl e, em seguida, chama o curl. A cópia inclui o segredo. As ferramentas de importação não conseguem assinar.",
+      "exampleHintTokenPlaceholder": "A cópia tem um marcador no local onde entra o token. Cole num terminal ou importe para o Postman ou o Insomnia (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Execute no bash: assina com openssl e, em seguida, chama o curl. A cópia tem um marcador no local onde entra o segredo. As ferramentas de importação não conseguem assinar."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Clique",
       "viewDocsLinkLabel": "aqui",
       "viewDocsSuffix": "para verificar mais documentação.",
-      "selectIntegrationPrompt": "Selecione uma integração para ver os detalhes."
+      "selectIntegrationPrompt": "Selecione uma integração para ver os detalhes.",
+      "codingAgent": {
+        "tabAgent": "Com um agente de programação",
+        "tabSteps": "Passo a passo",
+        "streamLabel": "Nome do stream de traces",
+        "streamHelp": "O agente escreve traces neste stream e verifica-o.",
+        "envTitle": "Descarregue o seu .env",
+        "envHelp": "Guarde-o na raiz do projeto. A skill lê o token deste ficheiro, pelo que nunca vai para o chat.",
+        "envButton": "Descarregar .env",
+        "promptTitle": "Cole isto em {client1}, {client2} ou {client3}",
+        "promptLabel": "Prompt",
+        "promptCopied": "Prompt copiado"
+      }
     },
     "header": "Fontes de dados",
     "resetRUMTokenLabel": "Repor token RUM",
@@ -7670,6 +7995,15 @@
     "queryValues": "Valores de consulta",
     "constant": "Constante",
     "textbox": "Caixa de texto",
+    "date": "Data",
+    "dateFormat": "Formato de data de saída",
+    "dateFormatHelp": "Saída predefinida nas consultas. Substitua caso a caso com ${'{'}name:format{'}'}, por exemplo ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Segundos desde a época (epoch)",
+    "dateFormatEpochms": "Milissegundos epoch (epochms)",
+    "dateFormatEpochus": "Microssegundos epoch (epochus)",
     "newFolder": "Nova pasta",
     "updateFolder": "Atualizar pasta",
     "newReport": "Novo relatório",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Adicionar Anotações",
       "dependentAdhocVariableWarning": "Algumas variáveis dinâmicas não foram aplicadas porque o campo não está presente no stream da consulta. Abra o Inspetor de Consultas para ver todos os detalhes das variáveis e consultas executadas para renderizar este painel",
       "refreshCacheReload": "Atualizar Cache e Recarregar",
+      "exploreCreateAlert": "Criar alerta",
+      "exploreAddToDashboard": "Adicionar ao dashboard",
       "redirectingToLogs": "A redirecionar para a página de logs",
       "pleaseWait": "Aguarde..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Constante",
       "textbox": "Caixa de texto",
       "custom": "Personalizado",
+      "date": "Data",
       "list": "{type} · {example}",
       "csv": "Vírgulas: {example}",
       "pipe": "Barras verticais: {example}",
       "doublequote": "Aspas duplas: {example}",
-      "singlequote": "Aspas simples: {example}"
+      "singlequote": "Aspas simples: {example}",
+      "dateIso": "Data (YYYY-MM-DD): {example}",
+      "dateDmy": "Dia primeiro (DD/MM/YYYY): {example}",
+      "dateMdy": "Mês primeiro (MM/DD/YYYY): {example}",
+      "dateEpoch": "Segundos epoch: {example}",
+      "dateEpochms": "Milissegundos epoch: {example}",
+      "dateEpochus": "Microssegundos epoch: {example}"
     },
     "add": "Adicionar painel",
     "save": "Guardar",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Reconhecido",
         "badgeResolved": "Resolvido",
         "badgeReopened": "Reaberto",
+        "badgeAckEnded": "Reconhecimento terminado",
         "badgeDimensionsUpgraded": "Dimensões atualizadas",
         "badgeTitleChanged": "Título alterado",
         "badgeAssignment": "Atribuição",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "A IA precisa de input",
         "incidentWas": "O incidente foi",
         "theIncident": "o incidente",
+        "ackEndedByPageResolve": "ao resolver um dos seus acionamentos",
         "unnamedAlert": "alerta",
         "alertTriggered": "{alert} disparado | {alert} disparado {count} vezes",
         "severityUpgraded": "Severidade elevada de {from} para {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Alertar-me",
           "toast": "Importado de Análise de Produto: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "Criar alerta",
+          "toast": "Consulta importada da sua pesquisa de traces",
+          "noStream": "Selecione primeiro um stream",
+          "errorCount": "Contagem de erros",
+          "errorRate": "Taxa de erros"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "O seu filtro de pesquisa não foi transferido porque precisa primeiro de uma opção \"Executar como\" na página de logs. Adicione-o à consulta do alerta se precisar.",
         "thresholdColumnGuessed": "O limite foi aplicado a {column}; verifique se é o valor pretendido.",
         "thresholdNotCarried": "O limite {value} do gráfico não foi aplicado porque escolheu uma consulta diferente.",
-        "rumFunnelExclusions": "Usa os filtros do aplicativo deste app como estão agora; recrie-o depois que eles mudarem."
+        "rumFunnelExclusions": "Usa os filtros do aplicativo deste app como estão agora; recrie-o depois que eles mudarem.",
+        "tracesSeedMatches": "Dispara quando os spans correspondentes em {minutes} min excedem {threshold} (agora {current}).",
+        "tracesSeedSpans": "Dispara quando os spans em {minutes} min excedem {threshold} (agora {current}).",
+        "tracesSeedTraces": "Dispara quando os traces em {minutes} min excedem {threshold} (agora {current}).",
+        "tracesSeedErrorSpans": "Dispara quando os spans com erro em {minutes} min excedem {threshold} (agora {current}).",
+        "tracesSeedErrorTraces": "Dispara quando os traces com erros em {minutes} min excedem {threshold} (agora {current}).",
+        "tracesSeedErrorRatio": "Dispara quando a taxa de erros em {minutes} min excede {threshold}% (agora {current}%).",
+        "tracesErrorRatioMinSpans": "Verifica apenas janelas com pelo menos {minimum} spans, para que algumas falhas num período calmo não disparem o alerta.",
+        "tracesErrorRatioMinTraces": "Verifica apenas janelas com pelo menos {minimum} traces, para que algumas falhas num período calmo não disparem o alerta.",
+        "tracesSeedDuration": "Dispara quando a duração {percentile} em {minutes} min está acima de {threshold} ms (agora {current} ms).",
+        "tracesSeedUnavailable": "Não foi possível ler o valor atual, por isso o limiar começa em 0. Defina-o antes de guardar.",
+        "tracesNoMatches": "Ainda não há spans correspondentes, por isso o alerta dispara assim que aparecer um.",
+        "tracesStoredSpans": "As contagens referem-se a spans armazenados, por isso o tráfego amostrado aparece inferior ao real.",
+        "tracesPeriodCapped": "A janela do alerta foi limitada a {minutes} minutos para manter cada verificação rápida.",
+        "tracesNotRun": "Esta pesquisa ainda não foi executada, por isso o alerta usa o filtro do editor."
       }
     },
     "saveFailed": "Não foi possível guardar o alerta.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Nenhuma métrica corresponde aos filtros atuais",
       "noMatchHint": "Tente remover um filtro de rótulo, limpar seleções de prefixo/sufixo ou mudar de “Com dados” para “Todas”.",
       "noMatchHintFavorites": "Tente remover um filtro de rótulo ou mudar de “Com dados” para “Todas”.",
+      "noMatchYet": "Ainda não foram encontradas métricas com dados",
+      "noMatchYetHint": "As métricas verificadas até agora não devolveram dados. Mostre mais para continuar a procurar.",
       "clearAllFilters": "Limpar todos os filtros",
       "emptyActions": {
         "clearSearch": "Limpar pesquisa",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Painel adicionado ao dashboard",
       "errorAddingPanel": "Erro ao adicionar painel",
       "selectDashboard": "Por favor, selecione um dashboard",
-      "selectTab": "Por favor, selecione um separador"
+      "selectTab": "Por favor, selecione um separador",
+      "panelsToAdd": "Painéis a adicionar"
     },
     "groups": {
       "compute": "Computação",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Outros"
   },
   "traces": {
+    "nlNeedsSql": "Esta pergunta requer SQL; abra-a em Logs",
+    "redActions": {
+      "menuGroupDashboards": "Dashboards",
+      "addRedToDashboard": "Adicionar gráficos RED ao dashboard",
+      "durationActions": "Ações de duração",
+      "bucketNotice": {
+        "seconds": "Estes gráficos mantêm as barras de {count} segundos que vê agora.",
+        "minutes": "Estes gráficos mantêm as barras de {count} minutos que vê agora.",
+        "hours": "Estes gráficos mantêm as barras de {count} horas que vê agora.",
+        "days": "Estes gráficos mantêm as barras de {count} dias que vê agora."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Este gráfico mantém as barras de {count} segundos que vê agora.",
+        "minutes": "Este gráfico mantém as barras de {count} minutos que vê agora.",
+        "hours": "Este gráfico mantém as barras de {count} horas que vê agora.",
+        "days": "Este gráfico mantém as barras de {count} dias que vê agora."
+      }
+    },
     "latencyHeatmap": {
       "title": "Duração",
       "tooltipSpans": "{count} span | {count} spans",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Próxima correspondência",
     "searchInSpans": "Pesquisar em spans",
     "criticalPath": "Caminho crítico",
+    "askAi": {
+      "explainTrace": "Explicar trace",
+      "explainTraceHint": "Pergunte à IA sobre os spans mais lentos no caminho crítico e todos os spans com erro",
+      "askAboutSpan": "Perguntar à IA sobre este span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Trace · {operation}"
+    },
     "spansTableView": "Exibição de tabela de spans",
     "comingSoon": "Em breve...",
     "fetchingTrace": "A obter o seu trace.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Filtrar erros",
         "resetFilters": "Repor filtros",
         "errorsNone": "Sem erros · {total} turnos",
-        "latencyLead": "Mais lento {slowest} ·",
+        "latencyLead": "Turno médio {avg} · Mais lento {slowest} ·",
         "costLead": "Pico {peak} ·",
         "tokens": "{ratio}% em cache",
         "cacheImpact": "{ratio}% Reutilizado · {tokens} Tok. lidos",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Sem dados",
       "noErrorsInRange": "Nenhum erro neste intervalo de tempo",
+      "loadFailed": "Não foi possível carregar os erros recentes",
       "time": "Hora",
       "service": "Serviço",
       "operation": "Operação",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Sempre ativo (padrão)",
     "testAtTimeLabel": "Testar à hora UTC",
     "testAtTimeHint": "Deixe em branco para usar a hora atual. Os níveis de pico / fora de pico são resolvidos com base nesta hora.",
-    "localTimeHint": "No seu fuso horário: {range}"
+    "localTimeHint": "No seu fuso horário: {range}",
+    "builtInStatus": {
+      "seed": "Preços incorporados: lista inicial fornecida com esta versão, datada de {date}.",
+      "neverSynced": "A sincronização online não foi executada desde que o servidor foi iniciado.",
+      "lastSynced": "Última sincronização online: {time}."
+    },
+    "unpriced": {
+      "title": "Lacunas de preços",
+      "subtitle": "Modelos nos seus traces de LLM que não tinham preço, ou apenas um preço aproximado, no momento da ingestão",
+      "banner": "{count} modelo não tinha preço ou tinha um preço aproximado no momento da ingestão. O custo registado pode estar incompleto. | {count} modelos não tinham preço ou tinham um preço aproximado no momento da ingestão. Os custos registados podem estar incompletos.",
+      "bannerTruncated": "{total} modelos nos seus traces não tinham preço ou tinham um preço aproximado no momento da ingestão. O custo pode estar errado. A mostrar os {shown} principais por tokens.",
+      "streamLabel": "Stream",
+      "window": "Últimas 24 horas",
+      "windowRange": "{from} – {to}",
+      "colModel": "Modelo visto nos traces",
+      "colPricedAs": "Com preço de",
+      "colTokens": "Tokens",
+      "colCost": "Custo registado",
+      "colActions": "Ações",
+      "spans": "{count} span | {count} spans",
+      "moreAgents": "+{count} mais",
+      "noMatch": "Sem correspondência",
+      "approximate": "Aproximado",
+      "pricedNow": "Com preço para novos spans",
+      "historicalGap": "Esta janela mantém a lacuna de preços registada. Os novos spans utilizam o preço atual.",
+      "noActionNeeded": "Nenhuma ação necessária",
+      "defaultTierPrices": "entrada {input} / saída {output} por 1M",
+      "notPriced": "sem preço",
+      "createPrice": "Criar preço",
+      "keepPrices": "Manter os preços de {name}",
+      "mute": "Silenciar",
+      "muteConfirmTitle": "Silenciar este modelo?",
+      "muteConfirmMessage": "Os novos spans de {model} serão considerados gratuitos. Os spans mais antigos mantêm o custo registado. Elimine o preço \"{name}\" para remover o silenciamento.",
+      "mutedNotif": "{model} silenciado",
+      "keptNotif": "{model} utiliza agora os preços de {name}",
+      "errSave": "Não foi possível guardar o preço",
+      "errLoad": "Não foi possível carregar os modelos sem preço",
+      "emptyTitle": "Não foi registada qualquer utilização de modelos sem preço ou com preço aproximado neste stream nesta janela.",
+      "noStreamsTitle": "Nenhum stream de traces de LLM",
+      "noStreamsDesc": "Os modelos aparecem aqui quando os spans gen_ai chegam a um stream de traces.",
+      "recordedCostNote": "Os novos preços aplicam-se aos spans ingeridos depois de guardar. Os spans mais antigos mantêm o custo registado.",
+      "noModelName": "(sem nome de modelo)",
+      "noModelHint": "Sem modelo para definir preço: defina gen_ai.request.model",
+      "instrumentationDocs": "Guia de instrumentação"
+    }
   },
   "aiObservability": {
     "title": "Observabilidade de IA",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Linhas ignoradas: {full} totalmente · {partial} parcialmente",
       "scoreEvidence": "{scorer} · v{version}: {samples} amostras, {noReference} sem referência, {noTrace} sem trace",
       "scorerApplicability": "{scorer} · v{version}: {eligible} slots elegíveis, {noReference} sem referência",
+      "costUnknown": "custo desconhecido",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Falha ao carregar experimentos",
       "previewError": "Falha ao pré-visualizar os slots do experimento",
       "createSuccess": "Experimento criado",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Este experimento tem um custo estimado de cerca de {cost}, acima do limite de aviso de {threshold}. Criar e executar mesmo assim?",
         "costConfirmMessageUnpriced": "Este experimento tem um custo estimado acima do limite de aviso. Criar e executar mesmo assim?",
         "costConfirmOk": "Criar mesmo assim",
+        "taskProviderFailed": "Nada foi criado. O fornecedor de tarefas {provider} não respondeu à chamada de teste.",
+        "judgeProviderFailed": "Nada foi criado. O fornecedor do juiz {provider} não respondeu à chamada de teste.",
         "skippedFully": "{count} linhas totalmente ignoradas — cada avaliador selecionado precisa de uma saída esperada. As linhas ignoradas não têm custo de execução.",
         "skippedPartially": "{count} linhas parcialmente ignoradas — a tarefa ainda é executada, mas avaliadores baseados em referência não podem pontuar linhas sem uma saída esperada.",
         "skippedNone": "Cada linha correspondente pode ser pontuada em pelo menos uma dimensão.",
@@ -17408,7 +17851,26 @@
           "trials": "Tentativas",
           "dispersion": "Dispersão",
           "latency": "Latência",
-          "p50Latency": "Latência P50"
+          "p50Latency": "Latência P50",
+          "error": "Erro"
+        },
+        "failureBanner": {
+          "title": "{failed} de {total} slots falharam: {cause}.",
+          "cause": "Principal causa, {count} slots: {message}",
+          "moreCauses": "+ {count} outras causas",
+          "noMessage": "não foi registada nenhuma mensagem de erro",
+          "openProviders": "Abrir fornecedores"
+        },
+        "failureKinds": {
+          "provider_auth": "o fornecedor rejeitou as credenciais",
+          "rate_limited": "o fornecedor aplicou um limite de taxa à execução",
+          "timeout": "o fornecedor não respondeu a tempo",
+          "provider_5xx": "o fornecedor devolveu um erro de servidor",
+          "parse_error": "não foi possível interpretar a saída",
+          "mapping_error": "não foi possível construir a entrada da tarefa",
+          "scorer_missing": "um avaliador já não existe",
+          "execution_error": "a chamada da tarefa falhou",
+          "unknown": "a chamada da tarefa falhou"
         },
         "saveAsPrompt": "Guardar como prompt",
         "openPrompt": "Abrir prompt",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Ambiente",
       "agent": "Agente",
-      "version": "Versão"
+      "version": "Versão",
+      "agentIdHint": "ID do agente: {ids}",
+      "noAgentIdentity": "Nenhuma identidade de agente encontrada",
+      "noAgentIdentityDescription": "Estes spans LLM não têm nome de agente, por isso são apresentados por stream. Mapeie o atributo que dá nome ao seu agente para os ver por agente.",
+      "noAgentIdentityAction": "Abrir mapeamento de agentes GenAI"
     },
     "agentGraph": {
       "stream": "Stream",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "As avaliações estão desativadas neste servidor",
+      "description": "Esta página requer avaliações online, que estão desativadas neste servidor. Peça ao seu administrador para as ativar."
+    },
     "traceScoreChip": {
       "reasoning": "Porquê",
       "noReasoning": "Nenhum raciocínio registado para esta pontuação.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Configurar Endpoint"
     },
     "provider": {
-      "backTo": "Voltar para Fornecedores",
+      "backTo": "Fornecedores",
       "createTitle": "Criar fornecedor LLM",
       "editTitle": "Editar fornecedor LLM",
       "subtitle": "Configure o endpoint do modelo usado pelos avaliadores de juiz LLM.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Avaliador {index}: o nome \"{name}\" é usado mais de uma vez nesta importação"
         }
       },
-      "backTo": "Voltar aos avaliadores",
+      "backTo": "Avaliadores",
       "badgeRemote": "Remoto",
       "badgeLlm": "Juiz LLM",
       "createTitleRemote": "Novo Avaliador Remoto",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Selecione o fornecedor",
       "modelLabel": "Modelo",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Temperatura",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 a 2. Deixe em branco para avaliar a 0.",
       "promptLabel": "Prompt do juiz",
       "includeReasoningLabel": "Incluir Raciocínio",
       "includeReasoningHint": "O juiz explica porque atribuiu esta pontuação; a explicação é guardada com cada resultado.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "O nome do cabeçalho é obrigatório",
         "apiKeyTokenRequired": "O token é obrigatório",
         "timeoutInvalid": "O tempo limite tem de ser 0 ou superior",
+        "temperatureInvalid": "A temperatura deve estar entre 0 e 2",
         "retriesInvalid": "O número de tentativas tem de ser 0 ou superior",
         "duplicateFieldName": "Os nomes dos campos têm de ser únicos"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Degradado",
         "waitingForCredentials": "A aguardar credenciais",
         "noRecentRuns": "Sem execuções recentes",
+        "lastScored": "Avaliado pela última vez {time}",
         "summary": "{errors} de {runs} execuções falharam nos últimos 15 minutos",
         "since": "Entrou neste estado {time}",
         "checked": "Última verificação {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Avalia {percent}% dos alvos correspondentes.",
       "samplingValueAllHelp": "Cada alvo correspondente é avaliado.",
       "samplingHelp": "Executa após a filtragem, para controlar o custo.",
-      "backTo": "Voltar para Eval Jobs",
+      "backTo": "Tarefas de avaliação",
       "createTitle": "Novo Eval Job",
       "editTitle": "Atualizar Eval Job",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Este ramo já termina num Destino.",
       "chooseATriggerNodeToStart": "Escolha um nó de gatilho para iniciar o seu fluxo de trabalho",
       "thisConnectionWouldCreateALoop": "Esta ligação criaria um loop",
-      "onlyOneIncomingConnectionToA": "Apenas uma ligação de entrada por etapa é permitida"
+      "onlyOneIncomingConnectionToA": "Apenas uma ligação de entrada por etapa é permitida",
+      "endpointUrlCopied": "URL do endpoint copiado"
     },
     "views": {
       "youAreNotAuthorizedToManage": "Não está autorizado a gerir a licença.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Pesquisar base de dados ou serviço…",
       "unnamedInstance": "Instância sem nome",
+      "schemaCount": "{count} esquema | {count} esquemas",
       "unnamedInstanceHint": "Os relatórios de instruções da própria base de dados provam que este mecanismo está em execução, mas não identificam um host. A linha mostrará um endereço quando um feed que o contenha — amostragem de sessão ou métricas de instância — for configurado.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Contado até {time}; o último meio minuto ainda está a chegar.",
       "lineExact": "Todas as bases de dados a reportar. As velocidades aqui são medidas em cada chamada, pelo que são exatas.",
       "lineExactEstimated": "Todas as bases de dados a reportar. As velocidades aqui são combinadas a partir de vários períodos de tempo, pelo que são aproximadas, mas não exatas.",
+      "lineExactSlowestSchema": "Todas as bases de dados estão a comunicar. As velocidades são exatas por esquema; uma base de dados com vários esquemas mostra o esquema mais lento.",
       "lineSubsetUnnamed": "Os seus filtros reduzem isto abaixo do nível em que estes totais são somados, pelo que as percentagens descrevem as linhas apresentadas em vez da base de dados inteira.",
       "lineQuery": "Os tempos são medidos a partir da sua aplicação, pelo que incluem o tempo de rede e qualquer espera por uma ligação livre.",
       "lineUncodedErrors": "{percent} das falhas aqui foram devolvidas sem código de motivo, pelo que podem ser contadas, mas não explicadas.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "Primeira vez que este alerta disparou.",
     "escalationNotStarted": "Ainda não acionado",
     "escalationPagesNobody": "Não aciona ninguém",
+    "escalationNobodyPaged": "Ninguém está a ser acionado",
     "escalationTo": "escalona para {who} {when}",
     "escalationDetailCapped": "O detalhe do escalonamento em tempo real é carregado para os {count} acionamentos abertos mais antigos.",
     "responder": "Responsável",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "Até",
     "rotationRestrictionAdd": "Adicionar uma janela",
     "rotationRestrictionRemove": "Remover",
-    "rotationRestrictionZeroLength": "De e Até são iguais, pelo que esta janela nunca corresponde e a camada nunca vence, sem qualquer aviso. Para um dia inteiro, defina Até como 24:00.",
+    "rotationRestrictionZeroLength": "De e Até são iguais, por isso esta janela nunca coincide. Guardar permanece desativado até De e Até serem diferentes; para um dia completo, defina Até como 24:00.",
     "rotationRetiredTag": "Desativada",
     "rotationSectionWhen": "Quando ocorre a troca de turno",
     "rotationName": "Nome da rotação",
@@ -25593,6 +26072,10 @@
     "snoozed": "Adiado",
     "snoozedUntil": "Silenciado até {time} — ainda não atribuído",
     "snoozeFailed": "Não foi possível silenciar o acionamento",
+    "unsnooze": "Terminar suspensão",
+    "unsnoozeHint": "Termina a suspensão agora. O acionamento continua a partir do passo onde tinha parado.",
+    "unsnoozed": "Suspensão terminada · acionamento continua",
+    "unsnoozeFailed": "Não foi possível terminar a suspensão",
     "note": "Nota",
     "notePlaceholder": "O que encontrou? O que tentou?",
     "addNote": "Adicionar nota",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "As mesmas pessoas, com um turno de atraso, para que o secundário nunca seja a pessoa que já está de piquete. É uma rotação comum — nada liga as duas rotações, pelo que editar uma e não a outra faz com que fiquem dessincronizadas, e recebe um aviso em vez de uma correção silenciosa.",
     "rotationPreviewPairLegend": "Primário · Secundário",
     "rotationPreviewEmpty": "Escolha as pessoas e a primeira passagem de piquete para ver quem está de piquete em cada período.",
+    "rotationPreviewNow": "Agora – {until}",
     "defaultRotationName": "Rotação",
     "teamCreatedWithoutMembers": "A equipa foi criada, mas os seus membros não puderam ser adicionados. Adicione-os no separador Membros.",
     "teamCreatedWithoutRotation": "A equipa e os seus membros foram criados, mas a rotação não pôde ser guardada. Configure-a no separador Escala.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "ninguém reconheceu — ainda estão a ser acionados",
     "sectionHint_ringingRouted": "ninguém reconheceu — {count} destes ainda está a acionar | ninguém reconheceu — {count} destes ainda estão a acionar",
     "sectionHint_ringingUnrouted": "{count} não tem equipa, pelo que não está a acionar | {count} não têm equipa, pelo que não estão a acionar",
+    "sectionHint_ringingStopped": "{count} não está a ser acionado | {count} não estão a ser acionados",
     "sectionHint_snoozed": "Acionamento em pausa — são retomados automaticamente",
     "sectionHint_handled": "reconhecido — cada um destes tem um responsável",
     "sectionHint_resolved": "fechado — mantido para registo",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "A equipa acionada quando um sinal corresponde. A sua própria escada de escalonamento decide quem é acionado e em que ordem.",
     "scopeOwns": "Esta equipa possui",
     "scopeAdvanced": "Avançado",
-    "ruleEditorConflictUnclaimed": "Nada reivindica este caminho hoje — um acionamento correspondente chega ao último recurso, ou a ninguém.",
+    "ruleEditorConflictUnclaimed": "Nada reivindica este caminho hoje, considerando apenas estas condições — um acionamento que corresponda a este caminho chega à regra genérica, ou a ninguém.",
     "ruleEditorConflictHeldBy": "Hoje um acionamento correspondente vai para {team}, via {path}.",
     "ruleEditorConflictTakesOver": "A sua regra fixa mais condições, por isso retiraria estes a {team}.",
     "ruleEditorConflictKeptBy": "O caminho de {team} fixa mais condições, por isso mantêm estes e esta regra captura apenas o que sobrar.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} aciona esta equipa apenas em {scope}. Noutros locais, cabe a quem possui o âmbito à volta.",
     "scopeNothingDiscovered": "Ainda nada foi descoberto, por isso não há ativos para escolher. Use Avançado para escrever a regra por campo ou envie alguma telemetria primeiro.",
     "scopeAdvancedHint": "Corresponder a qualquer campo e valor, incluindo os que os níveis acima não abrangem.",
+    "scopeValuesSeen": "Estas listas mostram os valores que a descoberta de serviços já viu. Para corresponder a qualquer outro valor, utilize Avançado.",
     "escalationHeld": "Primeiro a triagem por IA · acionamento dentro de {n} s",
     "escalationPagingStep": "A acionar etapa {step} de {total} · {who}",
     "escalationPagingStepOnly": "A acionar etapa {step} de {total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Criar equipa e rotação",
     "removeMemberHandsOver": "{name} assume o turno atual de {leaving} em {rotation}.",
     "removeMemberLeavesGap": "Ninguém assume o turno atual de {leaving} em {rotation}.",
+    "removeMemberReorders": "Também saem de {rotations}, por isso quem está de piquete aí também pode mudar.",
     "membersJoinEnd": "{names} entra no fim de {rotations}. Quem está de piquete agora não muda. | {names} entram no fim de {rotations}. Quem está de piquete agora não muda.",
     "membersAdded": "{names} adicionado. | {names} adicionados.",
     "removeMemberConfirm": "Remover",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Dúvidas: {contact}",
       "outboundQueue": "Mensagens de alerta: {count} em fila, a mais antiga com {age} | Mensagens de alerta: {count} em fila, a mais antiga com {age}",
       "outboundEmpty": "Nenhuma mensagem de alerta em fila",
+      "refusedPosts": "{count} publicação de alerta falhou nas últimas 24 h. Última: {reason} em {destination}, | {count} publicações de alerta falharam nas últimas 24 h. Última: {reason} em {destination},",
       "ageSeconds": "{count} s"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "Não foi possível enviar os lembretes."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(sem nome de modelo)",
+    "topModels": "{models} (principais {shown} de {total})",
+    "cost": {
+      "partial": "parcial",
+      "unknown": "custo desconhecido",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Custo parcial. Sem preço para {models}: os {tokens} tokens neste âmbito ({scope}) não são contabilizados.",
+      "unknownTooltip": "Custo desconhecido. Sem preço para {models}: nenhum dos {tokens} tokens neste âmbito ({scope}) tem um custo.",
+      "scopeSession": "sessão",
+      "scopeTrace": "trace",
+      "unknownModel": "um modelo sem nome",
+      "addPrice": "Adicionar um preço"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} tokens sem preço",
+      "unpricedTooltip": "O custo é um limite inferior: {tokens} tokens em {models} não têm preço. Abra o separador Sem preço em Preços de modelos LLM.",
+      "pricedSinceTooltip": "O custo é um limite inferior: {tokens} tokens em {models} foram registados antes de ser adicionado um preço e ficam sem custo."
+    },
+    "chart": {
+      "costMissing": "Não incluído neste gráfico: {models}. {tokens} tokens não têm preço.",
+      "costMissingPricedSince": "Não incluído neste gráfico: {models}. {tokens} tokens foram registados antes de ser adicionado um preço.",
+      "unpricedModels": "Sem preço: {models}",
+      "pricedSinceModels": "Registados antes de ser adicionado um preço: {models}",
+      "addPrice": "Adicionar um preço"
+    },
+    "health": {
+      "title": "Saúde dos dados",
+      "passing": "{n} aprovados",
+      "checkedAgo": "verificado {ago}",
+      "drawerTitle": "Saúde dos dados de IA",
+      "drawerSubtitle": "{stream} · janela atual",
+      "rerun": "Voltar a executar verificações",
+      "close": "Fechar",
+      "loadError": "Não foi possível executar as verificações de saúde dos dados.",
+      "samples": "Amostras:",
+      "copyLink": "Copiar link para um administrador",
+      "linkCopied": "Link copiado",
+      "status": {
+        "pass": "Aprovado",
+        "warning": "Aviso",
+        "error": "Erro"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Modelos sem preço",
+          "detail": "{count} modelo · {spans} spans · {tokens} tokens contados como $0 | {count} modelos · {spans} spans · {tokens} tokens contados como $0",
+          "pass": "Todos os modelos nesta janela têm um preço. Os spans registados antes de ser adicionado um preço mantêm o custo registado.",
+          "fix": "Corrigir em Preços de modelos LLM",
+          "truncated": "Principais {shown} de {total} por tokens"
+        },
+        "missing_agent_identity": {
+          "label": "Identidade do agente em falta",
+          "detail": "{affected} de {total} spans LLM ({pct}) não têm gen_ai.agent.name, pelo que as vistas de agentes não os mostram.",
+          "pass": "Todos os spans LLM têm um nome ou id de agente.",
+          "fix": "Abrir mapeamento de agentes GenAI"
+        },
+        "zero_duration_spans": {
+          "label": "Spans com duração zero",
+          "detail": "{affected} spans LLM reportam 0 ms, pelo que a latência e a duração das sessões ficam demasiado baixas.",
+          "pass": "Nenhum span LLM reporta 0 ms.",
+          "fix": "Como corrigir"
+        },
+        "missing_session_id": {
+          "label": "Spans sem id de sessão",
+          "detail": "{affected} de {total} spans LLM ({pct}) não têm gen_ai.conversation.id, pelo que as Sessões não os mostram.",
+          "pass": "Todos os spans LLM têm gen_ai.conversation.id.",
+          "fix": "Guia de integração"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Gestão de frota",
     "subtitle": "Registe coletores OpenTelemetry, versione as respetivas configurações e implemente alterações em segurança",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "Em curso",
       "scheduled": "Agendado",
+      "waiting": "A aguardar",
       "completed": "Concluído",
       "halted": "Interrompido",
       "superseded": "Substituído",
@@ -28696,7 +29257,7 @@
       "version": "Versão",
       "pickConfig": "Escolha uma configuração",
       "pickFleet": "Escolha uma frota",
-      "emptyFleet": "A frota não tem coletores, pelo que a versão é definida de imediato",
+      "emptyFleet": "A frota não tem coletores, pelo que a implementação aguarda até um se juntar",
       "startingShortly": "A iniciar em breve",
       "eventGateFailed": "Verificação de saúde falhada",
       "eventHalted": "Interrompida",
@@ -28707,7 +29268,10 @@
       "notFound": "Esta implementação já não existe",
       "notFoundDescription": "A ligação pode estar desatualizada. Escolha uma implementação na lista.",
       "noneTargeted": "Nenhum coletor visado",
-      "outcomeNoneTargeted": "A frota não tinha coletores quando a v{to} foi definida.",
+      "outcomeNoneTargeted": "Nenhum coletor adotou a v{to} nesta implementação.",
+      "outcomeWaiting": "Nenhum coletor está online, pelo que a v{to} ainda não chegou a nenhum. A implementação começa quando um se ligar.",
+      "waitingForCollector": "A aguardar um coletor",
+      "notStarted": "Não iniciado",
       "versionFailedBefore": "v{version} · já falhou antes",
       "pickVersion": "Escolha uma versão",
       "autoRollback": "Reverter automaticamente",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Retomada",
       "eventSkipped": "Coletores com falhas ignorados",
       "eventStarted": "Iniciada",
+      "eventWaiting": "A aguardar que um coletor fique online",
       "eventTimedOut": "Tempo limite da fase excedido",
       "eventSkippedOffline": "Excluído {count} coletor que estava offline no início; assume a versão quando voltar a ligar-se | Excluídos {count} coletores que estavam offline no início; assumem a versão quando voltarem a ligar-se",
       "excluded": "Excluído",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Uma fase que não confirma nem rejeita em {minutes} min interrompe a implementação (definição da frota)",
       "phaseVerifying": "A verificar",
       "phases": "Fases",
-      "planEmpty": "Nenhum coletor para atualizar",
+      "planEmpty": "Nenhum coletor está online, pelo que a implementação aguarda até um se ligar",
+      "planStable": "Nenhum coletor está online; a versão estável é aplicada a cada um quando este se ligar",
       "planOne": "{count} coletor num só lote | {count} coletores num só lote",
       "planText": "{steps} → restantes {last}, {count} fases",
       "planUnavailable": "A pré-visualização do plano não está disponível",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 mantém os coletores offline para sempre"
     },
     "audit": {
-      "search": "Pesquisar no registo de auditoria",
       "editedConfig": "Configuração editada",
       "revokedToken": "Token de registo revogado",
       "enrolledCollector": "Coletor registado",
@@ -28920,7 +29485,6 @@
       "setDesired": "Versão alterada",
       "autoRollback": "Revertida automaticamente",
       "rolloutHalted": "Implementação interrompida",
-      "assignedFleetConfig": "Configuração da frota atribuída",
       "createdFleet": "Frota criada",
       "renamedFleet": "Nome da frota alterado",
       "deletedFleet": "Frota eliminada",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Implementação revertida",
       "movedByToken": "Movido por token de registo",
       "object": "Objeto",
+      "search": "Pesquisar no registo de auditoria",
       "allObjects": "Todos os objetos",
       "kind": {
         "fleet": "Frota",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "A implementar a v{to}",
       "rolloutHalted": "Implementação da v{to} interrompida",
+      "rolloutWaiting": "v{to} aguarda que um coletor fique online",
       "autoRolledBack": "v{to} revertida automaticamente",
       "noReason": "Nenhum motivo de falha comunicado",
       "openRollout": "Abrir implementação",
diff --git a/web/src/locales/languages/ru-RU.json b/web/src/locales/languages/ru-RU.json
index 05b55e8b8e..5c69619872 100644
--- a/web/src/locales/languages/ru-RU.json
+++ b/web/src/locales/languages/ru-RU.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Активность LLM пока отсутствует",
       "description": "Инструментируйте свои сервисы с помощью семантических соглашений OpenTelemetry Gen-AI и примите хотя бы один трейс, чтобы заполнить этот дашборд.",
-      "action": "Инструментировать с OpenTelemetry",
-      "actionDesc": "Фиксируйте атрибуты gen_ai_* в ваших трейсах."
+      "action": "Все ИИ-интеграции",
+      "actionDesc": "Просмотрите руководства по всем фреймворкам и провайдерам",
+      "suggested": "Настройте трейсинг {name}",
+      "suggestedDesc": "Рекомендовано, так как вы пришли из документации {name}",
+      "codingAgent": "Инструментировать с помощью агента для программирования",
+      "codingAgentDesc": "Ваш агент для программирования добавит трейсинг и проверит первый трейс",
+      "startFrom": "Или начните с"
     },
     "noLLMSessions": {
       "title": "Сеансы LLM пока отсутствуют",
@@ -4797,6 +4802,13 @@
       "success": "Успех",
       "failed": "Не удалось",
       "testRun": "Тестовый запуск",
+      "source": "Источник",
+      "sourceHttp": "HTTP-запрос",
+      "sourceAlertFired": "Оповещение сработало",
+      "sourceIncidentEvent": "Событие инцидента",
+      "sourceRetry": "Повторный запуск",
+      "sourceManual": "Ручной запуск",
+      "sourceOther": "Другое",
       "runType": "Тип",
       "testRunTooltip": "Запущен из редактора. Шаги получателей выполняют реальную отправку.",
       "showTestRuns": "Показать тестовые запуски ({count})",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Повторить этот запуск?",
       "retryMessage": "Будет создан новый запуск на основе входных данных, записанных при неудачном запуске. Шаги получателей выполнят реальную отправку.",
       "retryStarted": "Повторный запуск начат — в списке он появится как новый запуск.",
-      "retryError": "Не удалось повторить этот запуск"
+      "retryError": "Не удалось повторить этот запуск",
+      "statusQueued": "В очереди",
+      "statusRunning": "Выполняется",
+      "statusExpired": "Истёк",
+      "reasonExpired": "не выполнялся · в очереди более 1 ч",
+      "reasonWorkerLost": "воркер потерян · не перезапускался",
+      "reasonWorkflowDisabled": "рабочий процесс был отключён",
+      "reasonRunTimeout": "тайм-аут через 15 мин",
+      "allTriggers": "Все триггеры",
+      "triggerFilter": "Триггер",
+      "run": "Запуск",
+      "searchRuns": "Поиск по ID запуска, ключу идемпотентности или оповещению",
+      "sourceDetails": "Детали источника",
+      "detailsWithKey": "{ip} · ключ {key}",
+      "detailsNoKey": "{ip} · нет ключа идемпотентности",
+      "retryOf": "Повтор запуска {run}",
+      "openRun": "Открыть запуск",
+      "alertFiredEmptyTitle": "Нет запусков по оповещениям в этом диапазоне времени",
+      "incidentEventEmptyTitle": "Нет запусков по событиям инцидентов в этом диапазоне времени",
+      "filterEmptyTitle": "Нет подходящих запусков в этом диапазоне времени",
+      "filterEmptyDimmed": "Другие запуски остаются на временной шкале приглушёнными.",
+      "searchEmptyTitle": "Нет запусков, соответствующих этому поиску",
+      "searchEmptyAction": "Очистить поиск",
+      "timelineNow": "сейчас",
+      "timelineAgoMinutes": "−{n} мин",
+      "timelineAgoHours": "−{n} ч",
+      "timelineAgoDays": "−{n} д"
     },
     "edit": "Редактировать",
     "view": "Просмотреть",
@@ -4958,7 +4996,9 @@
           "noMatch": "Нет совпадений"
         },
         "suppressed": "Подавлено — не отправлено реальному получателю"
-      }
+      },
+      "payloadFrom": "Данные из",
+      "payloadFromHint": "HTTP-формат — это то, что отправляют клиенты эндпоинта."
     },
     "linkAlerts": {
       "title": "Привязать рабочий процесс к оповещениям",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Формат вывода",
       "tlsVerifyLabel": "Проверка TLS",
       "tlsDisabled": "Отключено"
+    },
+    "http": {
+      "runTestHint": "Выполняет шаги с примером HTTP-полезной нагрузки; не обращается по URL",
+      "runTestHintList": "Откройте рабочий процесс, чтобы запустить тест",
+      "runsEmptyTitle": "Нет HTTP-запросов в этом диапазоне времени",
+      "runsEmptyBody": "Расширьте временной диапазон или отправьте тестовый запрос на панели HTTP-эндпоинта.",
+      "runsEmptyAction": "Показать все триггеры",
+      "runFailedAt": "Этот запуск завершился ошибкой на шаге {step}: {error}",
+      "openStep": "Открыть шаг",
+      "runGuardHint": "HTTP-запуски содержат запрос, а не поля оповещения. Если этот шаг читает {fields}, защитите его с помощью условия: {guard}.",
+      "runExpiredBanner": "Этот запрос прождал в очереди более 1 часа и так и не был выполнен. Ни один шаг не выполнился, и ни один получатель не был вызван.",
+      "runWorkerLostBanner": "Воркер, выполнявший этот запрос, остановился. Он не перезапускается автоматически, потому что получатели могли уже быть вызваны. Проверьте их, прежде чем вызывающий отправит запрос повторно.",
+      "request": "Запрос",
+      "requestReceived": "Получен",
+      "requestToken": "Токен",
+      "requestCallerIp": "IP вызывающего",
+      "requestIdempotencyKey": "Ключ идемпотентности",
+      "requestContentType": "Тип контента",
+      "requestBodySize": "Размер тела",
+      "bodySizeBytes": "{size} Б",
+      "bodySizeKiB": "{size} КиБ",
+      "headers": "Заголовки",
+      "headersKept": "{count} сохранено · Authorization, куки и подписи никогда не сохраняются | {count} сохранено · Authorization, куки и подписи никогда не сохраняются",
+      "headerName": "Имя",
+      "headerValue": "Значение",
+      "outputCaption": "Что получил каждый последующий шаг",
+      "useAsTestInput": "Использовать как тестовые входные данные",
+      "editorButton": "HTTP-эндпоинт",
+      "editorButtonOn": "Вкл.",
+      "editorButtonOff": "Выкл.",
+      "editorButtonTooltip": "Разрешить другой системе запускать этот рабочий процесс с помощью HTTP-запроса",
+      "editorButtonRefusedDraft": "Запросы получают 403, пока рабочий процесс не опубликован",
+      "editorButtonRefusedPaused": "Запросы получают 403, пока рабочий процесс приостановлен",
+      "panelTitle": "HTTP-эндпоинт",
+      "panelSubtitle": "{name} · рабочий процесс {kind}",
+      "acceptRequests": "Принимать HTTP-запросы",
+      "kindNote": "Шаги этого рабочего процесса созданы для запусков {kind}. HTTP-запуски получают вместо этого запрос ({field}), поэтому добавьте Условие, если шагу нужны поля {kind}.",
+      "kindNotePayload": "Показать HTTP-полезную нагрузку",
+      "kindNotePayloadHide": "Скрыть HTTP-полезную нагрузку",
+      "unsavedBody": "Этот рабочий процесс ещё не сохранён. Сохраните его как черновик, чтобы создать URL и токен. Запросы отклоняются, пока вы не опубликуете.",
+      "saveAndCreate": "Сохранить черновик и создать эндпоинт",
+      "needsAdmin": "Для создания эндпоинта нужен администратор организации.",
+      "needsEdit": "Для изменения нужны права на редактирование этого рабочего процесса.",
+      "readOnlyOnMeta": "Вкл. · вы можете скопировать URL. Для изменения нужны права на редактирование этого рабочего процесса.",
+      "offBody": "Разрешить другой системе запускать этот рабочий процесс с помощью HTTP-запроса. Вы получите URL и токен.",
+      "offExistingBody": "Выкл. · запросы отклоняются (403), пока вы не включите эндпоинт.",
+      "onMeta": "Вкл. · запуски начинаются только когда рабочий процесс включён и опубликован",
+      "loadError": "Не удалось загрузить настройки эндпоинта.",
+      "draftBanner": "Этот рабочий процесс — черновик. Вызовы URL получают 403, пока вы не опубликуете. Вы можете настроить эндпоинт сейчас, а «Запустить тест» выполняет шаги черновика с образцом HTTP-полезной нагрузки.",
+      "disabledBanner": "Запросы отклоняются (403), пока вы не включите рабочий процесс.",
+      "turnOnFailed": "Не удалось включить эндпоинт. {reason}",
+      "changeFailed": "Не удалось сохранить эндпоинт. {reason}",
+      "endpointExistsHint": "Эндпоинт уже существует. Покажите или скопируйте его токен из таблицы «Токены».",
+      "endpointExistsHintSigned": "Эндпоинт уже существует. Покажите или скопируйте его секрет подписи из таблицы «Секреты подписи».",
+      "disableTitle": "Отключить эндпоинт?",
+      "disableBody": "Вызывающие получают 403 (эндпоинт отключён), пока вы снова его не включите. URL и токены остаются прежними.",
+      "disableConfirm": "Отключить",
+      "lastCall": "Вкл. · Последний вызов: {status} · {time} · {link}",
+      "lastCallNone": "Вкл. · Вызовов пока нет — отправьте тестовый запрос",
+      "lastCallNoneRefused": "Вкл. · Вызовов пока нет",
+      "viewRun": "Просмотреть запуск",
+      "lastCallStatus": {
+        "queued": "в очереди",
+        "running": "выполняется",
+        "succeeded": "успешно",
+        "failed": "ошибка",
+        "expired": "истёк"
+      },
+      "endpointUrl": "URL эндпоинта",
+      "tokenLabel": "Токен",
+      "secretLabel": "Секрет подписи",
+      "newTokenLabel": "Новый токен",
+      "newSecretLabel": "Новый секрет подписи",
+      "tokenHint": "На экране скрыт; «Копировать» копирует настоящий токен. Передавайте его в {header}, никогда в URL.",
+      "secretHint": "На экране скрыт; «Копировать» копирует настоящий секрет. Подписывайте им каждый запрос и передавайте заголовки {headers}; сам секрет никогда не отправляйте.",
+      "revealBannerTitle": "Эндпоинт создан",
+      "revealBannerBody": "Передавайте этот токен с каждым запросом. Его можно снова показать или скопировать из таблицы токенов.",
+      "revealBannerBodySigned": "Подписывайте каждый запрос этим секретом. Его можно снова показать или скопировать из таблицы секретов подписи.",
+      "switchedBannerTitle": "Токен создан",
+      "switchedBannerTitleSigned": "Секрет подписи создан",
+      "rotateBannerTitle": "Новый токен создан",
+      "rotateBannerTitleSigned": "Новый секрет подписи создан",
+      "rotateBannerBody": "Вызывающая сторона использует тот же URL и заголовок; меняется только токен. Старый токен продолжает работать до истечения срока, и до тех пор его можно показать.",
+      "rotateBannerBodySigned": "Вызывающая сторона использует тот же URL и заголовки; меняется только секрет. Старый секрет продолжает работать до истечения срока, и до тех пор его можно показать.",
+      "rotateBannerBodyRevoked": "Вызывающая сторона использует тот же URL и заголовок; меняется только токен. Старый токен отозван и перестаёт работать сейчас.",
+      "rotateBannerBodyRevokedSigned": "Вызывающая сторона использует тот же URL и заголовки; меняется только секрет. Старый секрет отозван и перестаёт работать сейчас.",
+      "rotateBannerBodyFresh": "Вызывающая сторона использует тот же URL и заголовок и с этого момента передаёт этот токен.",
+      "rotateBannerBodyFreshSigned": "Вызывающая сторона использует тот же URL и заголовки и с этого момента подписывает запросы этим секретом.",
+      "snippetsLabel": "Пример запроса",
+      "sendTest": "Отправить тестовый запрос",
+      "sendTestHint": "Проверяет учётные данные и показывает, что получат ваши шаги. Запуск не начинается, получатель не вызывается.",
+      "sendTestHintPaused": "Проверяет учётные данные. Рабочий процесс приостановлен, поэтому вызов отклоняется до формирования входных данных; «Запустить тест» выполняет шаги.",
+      "sendTestSigned": "Браузеры не могут подписывать запросы, поэтому тестируйте с помощью примера запроса выше. Добавьте ?dry_run=true в его URL, чтобы проверить подпись без запуска.",
+      "dryRunAccepted": "Пробный запуск принят",
+      "dryRunMeta": "учётные данные действительны · тело {size}",
+      "dryRunInput": "Входные данные, которые получат ваши шаги",
+      "dryRunRefused": "Учётные данные действительны. Запросы отклоняются, пока рабочий процесс не опубликован.",
+      "dryRunRefusedPaused": "Учётные данные действительны. Запросы отклоняются, пока рабочий процесс приостановлен.",
+      "dryRunRateLimited": "Превышен лимит — пробные запуски учитываются в лимите.",
+      "dryRunStatus": "Запрос отклонён со статусом {status}.",
+      "dryRunFailed": "Не удалось отправить тестовый запрос. {reason}",
+      "runTestInstead": "Запустить тест",
+      "done": "Готово",
+      "regionTag": "Регион {name}",
+      "regionBanner": "Отправляйте каждый запрос и каждую повторную попытку на хост этого региона. Ключи идемпотентности и статус запуска ({field}) хранятся в регионе, принявшем вызов, поэтому повторная попытка, отправленная в другой регион, может запустить второй запуск.",
+      "authLabel": "Аутентификация вызывающих сторон",
+      "authToken": "Токен",
+      "authSigned": "Подписанные запросы",
+      "authAbout": "Об аутентификации",
+      "authInfo": "Токен: передавайте токен в заголовке Authorization. Подписанные запросы: подписывайте каждый запрос общим секретом (заголовки {headers}).",
+      "switchToSignedTitle": "Переключиться на подписанные запросы?",
+      "switchToSignedBody": "При переключении текущий токен немедленно отзывается и создаётся секрет подписи. Вызывающие стороны, использующие токен, начнут получать 401.",
+      "switchToTokenTitle": "Переключиться на токен?",
+      "switchToTokenBody": "При переключении текущий секрет подписи отзывается сразу и создаётся токен. Клиенты, подписывающие запросы, начнут получать 401.",
+      "tokensTitle": "Токены",
+      "secretsTitle": "Секреты подписи",
+      "colToken": "Токен",
+      "colSecret": "Секрет",
+      "colCreated": "Создан",
+      "colLastUsed": "Последнее использование",
+      "colStatus": "Статус",
+      "colActions": "Действия",
+      "never": "Никогда",
+      "active": "Активен",
+      "retiring": "Выводится",
+      "creatorGone": "Создатель больше не в этой организации",
+      "revoke": "Отозвать",
+      "revokeNow": "Отозвать сейчас",
+      "revokeTitle": "Отозвать {prefix}? Клиенты, использующие его, сразу получат 401.",
+      "revokeFailed": "Не удалось отозвать. {reason}",
+      "copyToken": "Копировать токен",
+      "copySecret": "Копировать секрет",
+      "tokenCopied": "Токен скопирован",
+      "commandCopied": "Команда скопирована",
+      "secretCopied": "Секрет скопирован",
+      "revealFailed": "Не удалось показать токен. {reason}",
+      "revealFailedSigned": "Не удалось показать секрет. {reason}",
+      "revealDenied": "Только администраторы могут показывать или копировать токены для этого эндпоинта.",
+      "runTest": "Запустить тест",
+      "rotate": "Ротировать",
+      "rotateBlocked": "Сначала отзовите токен, выводимый из обращения",
+      "rotateBlockedSigned": "Сначала отзовите секрет, выводимый из обращения",
+      "rotateTitle": "Ротация токена",
+      "rotateTitleSigned": "Ротация секрета подписи",
+      "rotateLead": "Новый токен создаётся сейчас. {prefix} (последнее использование: {time}) продолжит работать в течение",
+      "rotateLeadSigned": "Новый секрет подписи создаётся сейчас. {prefix} (последнее использование: {time}) продолжит работать в течение",
+      "overlapNow": "Отозвать его немедленно",
+      "overlapHour": "1 час",
+      "overlapDay": "24 часа",
+      "overlapWeek": "7 дней",
+      "rotateConsequence": "Клиенты, использующие текущий токен, продолжат работать до {time}. Обновите их до этого времени.",
+      "rotateConsequenceSigned": "Клиенты, подписывающие запросы текущим секретом, продолжат работать до {time}. Обновите их до этого времени.",
+      "rotateConsequenceNow": "Клиенты, использующие текущий токен, с этого момента будут получать 401.",
+      "rotateConsequenceNowSigned": "Клиенты, подписывающие запросы текущим секретом, с этого момента будут получать 401.",
+      "rotateConfirm": "Ротировать токен",
+      "rotateConfirmSigned": "Ротировать секрет подписи",
+      "rotateFailed": "Не удалось выполнить ротацию. {reason}",
+      "advanced": "Дополнительно",
+      "advancedSummary": "Макс. размер тела {size} · {count} запрос в минуту | Макс. размер тела {size} · {count} запросов в минуту",
+      "maxBody": "Макс. размер тела (KiB)",
+      "maxBodyHint": "До 1024 (1 МиБ); значение можно только уменьшить",
+      "maxBodyRange": "Введите целое число от 1 до 1024",
+      "rateLimit": "Запросов в минуту",
+      "rateLimitHint": "До {org} в минуту для этой организации",
+      "rateLimitRange": "Введите целое число от 1 до {org}",
+      "saveLimitsFailed": "Не удалось сохранить лимиты. {reason}",
+      "deleteMeta": "Удаляет URL и все токены и секреты.",
+      "deleteButton": "Удалить эндпоинт",
+      "deleteTitle": "Удалить этот эндпоинт?",
+      "deleteBody": "URL сразу перестанет работать: вызывающие получат 401. Все токены и секреты подписи будут удалены без возможности восстановления. История запусков сохранится.",
+      "deleteFailed": "Не удалось удалить эндпоинт. {reason}",
+      "secretStorageWarning": "На этом сервере нет мастер-ключа шифрования, поэтому токены и секреты подписи хранятся в виде, доступном для чтения любому, у кого есть доступ к базе данных. Попросите администратора настроить его.",
+      "rejectionsLine": "Примерно {count} запрос отклонён за последние 24 ч · последний: {reason}, {time} | Примерно {count} запросов отклонено за последние 24 ч · последний: {reason}, {time}",
+      "rejectionsShow": "Показать",
+      "rejectionsHide": "Скрыть",
+      "rejectionsTitle": "Недавние отклонения",
+      "rejectionsCaption": "около {count} за последние 24 ч · вызывающая сторона видела только код состояния | около {count} за последние 24 ч · вызывающая сторона видела только код состояния",
+      "rejectionMeta": "около {count} · последний: {time} · из {ip} | около {count} · последний: {time} · из {ip}",
+      "rejectionsLoadError": "Не удалось загрузить отклонения.",
+      "raiseLimit": "Повысить лимит",
+      "rotateLink": "Выполнить ротацию",
+      "reason": {
+        "invalid_token": {
+          "title": "Недействительный токен",
+          "fix": "Вызывающая сторона отправляет отозванный, просроченный или неверно введённый токен. Покажите или скопируйте текущий токен из таблицы токенов."
+        },
+        "invalid_signature": {
+          "title": "Недействительная подпись",
+          "fix": "Вызывающая сторона подписывает старым или неверным секретом. Проверьте, что используется текущий секрет и что подпись {format} формируется в точности по отправленным данным."
+        },
+        "stale_timestamp": {
+          "title": "Слишком старая метка времени",
+          "fix": "Часы вызывающей стороны расходятся более чем на 5 минут. Синхронизируйте её часы и подписывайте непосредственно перед отправкой."
+        },
+        "endpoint_disabled": {
+          "title": "Эндпоинт отключён",
+          "fix": "Включите эндпоинт."
+        },
+        "workflow_disabled": {
+          "title": "Рабочий процесс приостановлен",
+          "fix": "Возобновите рабочий процесс из списка."
+        },
+        "workflow_not_published": {
+          "title": "Рабочий процесс не опубликован",
+          "fix": "Опубликуйте рабочий процесс; черновики отклоняют запросы."
+        },
+        "payload_too_large": {
+          "title": "Полезная нагрузка слишком велика",
+          "fix": "Превышает {size}. Отправляйте меньше данных или разделите события на несколько запросов."
+        },
+        "credential_in_url": {
+          "title": "Учётные данные в URL",
+          "fix": "Токен или секрет был отправлен в URL и отклонён. URL попадают в логи прокси и браузера, поэтому выполните ротацию сейчас, а затем отправляйте его в заголовке."
+        },
+        "invalid_idempotency_key": {
+          "title": "Недействительный ключ идемпотентности",
+          "fix": "Заголовок Idempotency-Key пуст или длиннее 255 символов."
+        },
+        "idempotency_key_reused": {
+          "title": "Ключ идемпотентности использован повторно",
+          "fix": "Тот же ключ пришёл с другим телом запроса. Используйте новый ключ для каждого отдельного события."
+        },
+        "rate_limited": {
+          "title": "Превышен лимит частоты",
+          "fix": "Более {count} запросов в минуту. Объединяйте события в один запрос (отправляйте массив JSON) или повысьте лимит — до {org} в минуту для этой организации."
+        },
+        "queue_full": {
+          "title": "Очередь заполнена",
+          "fix": "У этой организации уже было {count} HTTP-запусков в ожидании. Вызывающей стороне следует повторить попытку после задержки Retry-After; найдите медленный шаг или снизьте частоту отправки."
+        },
+        "worker_unavailable": {
+          "title": "Воркер недоступен",
+          "fix": "В этом регионе не работал ни один воркер рабочих процессов, поэтому ничего не было поставлено в очередь. Вызывающие стороны, которые повторят попытку после задержки Retry-After, пройдут, как только воркер снова запустится; если это повторяется, попросите администратора проверить воркеры рабочих процессов."
+        }
+      },
+      "nodeBadge": "Вызывается по HTTP",
+      "triggerLinkOn": "Также запускается по HTTP-запросам",
+      "triggerLinkOnAction": "Управлять эндпоинтом",
+      "triggerLinkOff": "Запускайте его и из другой системы",
+      "triggerLinkOffAction": "Настроить HTTP-эндпоинт",
+      "pickerCue": "Любой рабочий процесс также можно запустить HTTP-запросом. Выберите его триггер, затем используйте HTTP-эндпоинт на панели инструментов.",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP-эндпоинт включён",
+      "listMenuItem": "HTTP-эндпоинт…",
+      "copyUrl": "Копировать URL эндпоинта",
+      "copyUrlDraftHint": "Запросы отклоняются, пока вы не опубликуете",
+      "copyUrlFailed": "Не удалось скопировать URL эндпоинта. {reason}",
+      "payloadFrom": "Источник полезной нагрузки",
+      "payloadHttp": "HTTP-запрос",
+      "bodySizeMiB": "{size} МиБ",
+      "expiresInHours": "истекает через {count} ч | истекает через {count} ч",
+      "expiresInDays": "истекает через {count} день | истекает через {count} дней",
+      "expired": "Истёк",
+      "rotateLeadUnused": "Новый токен создаётся сейчас. Оставьте {prefix} (не использовался) активным в течение",
+      "rotateLeadUnusedSigned": "Новый секрет подписи создаётся сейчас. Оставьте {prefix} (не использовался) активным в течение",
+      "fieldGroup": "HTTP-запрос",
+      "fieldGroupBodyHint": "Для полей в теле запроса сначала нужен шаг «Функция»",
+      "fieldGroupQueryHint": "Параметры запроса — это meta.query.<key>; повторяющиеся ключи приходят списком и никогда не совпадают",
+      "rotateLeadNone": "Нет активного токена, поэтому клиенты не могут пройти аутентификацию. Сейчас создаётся новый токен.",
+      "rotateLeadNoneSigned": "Нет активного секрета подписи, поэтому клиенты не могут пройти аутентификацию. Сейчас создаётся новый секрет подписи.",
+      "createForbidden": "Вы не можете создавать учётные данные эндпоинта в этой организации.",
+      "errorNotConfigured": "У этого рабочего процесса нет HTTP-эндпоинта.",
+      "errorNoLiveCredential": "Нет активных учётных данных. Выполните ротацию, чтобы создать их.",
+      "errorNotAllowed": "У вас нет прав на это действие.",
+      "copyCredentialChanged": "Учётные данные изменены. Скопируйте ещё раз.",
+      "copyCommandFailed": "Не удалось скопировать команду. {reason}",
+      "exampleRequest": "Пример запроса",
+      "exampleActiveToken": "Активный токен · {prefix}",
+      "exampleActiveSecret": "Активный секрет · {prefix}",
+      "exampleHintToken": "В скопированном тексте есть токен. Вставьте его в терминал или импортируйте в Postman или Insomnia (Import → Raw text).",
+      "exampleHintSigned": "Запустите в bash: скрипт подписывает через openssl, затем вызывает curl. В скопированном тексте есть секрет. Инструменты импорта не умеют подписывать.",
+      "exampleHintTokenPlaceholder": "В скопированном тексте есть заполнитель вместо токена. Вставьте его в терминал или импортируйте в Postman или Insomnia (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Запустите в bash: скрипт подписывает через openssl, затем вызывает curl. В скопированном тексте есть заполнитель вместо секрета. Инструменты импорта не умеют подписывать."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Нажмите",
       "viewDocsLinkLabel": "здесь",
       "viewDocsSuffix": "для просмотра дополнительной документации.",
-      "selectIntegrationPrompt": "Выберите интеграцию для просмотра сведений."
+      "selectIntegrationPrompt": "Выберите интеграцию для просмотра сведений.",
+      "codingAgent": {
+        "tabAgent": "С кодирующим агентом",
+        "tabSteps": "Пошагово",
+        "streamLabel": "Имя потока трейсов",
+        "streamHelp": "Агент записывает трейсы в этот поток и проверяет его.",
+        "envTitle": "Скачайте свой .env",
+        "envHelp": "Сохраните его в корне проекта. Навык читает токен из этого файла, поэтому он не попадает в чат.",
+        "envButton": "Скачать .env",
+        "promptTitle": "Вставьте это в {client1}, {client2} или {client3}",
+        "promptLabel": "Промпт",
+        "promptCopied": "Промпт скопирован"
+      }
     },
     "header": "Источники данных",
     "resetRUMTokenLabel": "Сбросить токен RUM",
@@ -7670,6 +7995,15 @@
     "queryValues": "Значения запроса",
     "constant": "Константа",
     "textbox": "Текстовое поле",
+    "date": "Дата",
+    "dateFormat": "Формат вывода даты",
+    "dateFormatHelp": "Формат вывода по умолчанию в запросах. Переопределяйте для каждого использования с помощью ${'{'}name:format{'}'}, например ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Секунды эпохи (epoch)",
+    "dateFormatEpochms": "Миллисекунды эпохи (epochms)",
+    "dateFormatEpochus": "Микросекунды эпохи (epochus)",
     "newFolder": "Новая папка",
     "updateFolder": "Обновить папку",
     "newReport": "Новый отчёт",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Добавить аннотации",
       "dependentAdhocVariableWarning": "Некоторые динамические переменные не применены, так как поле отсутствует в потоке запроса. Откройте инспектор запросов, чтобы увидеть все детали переменных и запросов, выполненных для отображения этой панели",
       "refreshCacheReload": "Обновить кеш и перезагрузить",
+      "exploreCreateAlert": "Создать оповещение",
+      "exploreAddToDashboard": "Добавить на дашборд",
       "redirectingToLogs": "Перенаправление на страницу логов",
       "pleaseWait": "Пожалуйста, подождите..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Константа",
       "textbox": "Текстовое поле",
       "custom": "Пользовательский",
+      "date": "Дата",
       "list": "{type} · {example}",
       "csv": "Запятые: {example}",
       "pipe": "Вертикальные черты: {example}",
       "doublequote": "Двойные кавычки: {example}",
-      "singlequote": "Одинарные кавычки: {example}"
+      "singlequote": "Одинарные кавычки: {example}",
+      "dateIso": "Дата (YYYY-MM-DD): {example}",
+      "dateDmy": "Сначала день (DD/MM/YYYY): {example}",
+      "dateMdy": "Сначала месяц (MM/DD/YYYY): {example}",
+      "dateEpoch": "Секунды эпохи: {example}",
+      "dateEpochms": "Миллисекунды эпохи: {example}",
+      "dateEpochus": "Микросекунды эпохи: {example}"
     },
     "add": "Добавить панель",
     "save": "Сохранить",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Подтверждено",
         "badgeResolved": "Решено",
         "badgeReopened": "Переоткрыто",
+        "badgeAckEnded": "Подтверждение завершено",
         "badgeDimensionsUpgraded": "Измерения обновлены",
         "badgeTitleChanged": "Заголовок изменен",
         "badgeAssignment": "Назначение",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "ИИ нужен ввод",
         "incidentWas": "Инцидент был",
         "theIncident": "инцидент",
+        "ackEndedByPageResolve": "при разрешении одного из его вызовов",
         "unnamedAlert": "оповещение",
         "alertTriggered": "{alert} сработало | {alert}: срабатываний — {count}",
         "severityUpgraded": "Критичность повышена с {from} до {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Оповестить меня",
           "toast": "Импортировано из продуктовой аналитики: «{sourceLabel}»"
+        },
+        "traces": {
+          "label": "Создать оповещение",
+          "toast": "Запрос импортирован из поиска по трейсам",
+          "noStream": "Сначала выберите поток",
+          "errorCount": "Количество ошибок",
+          "errorRate": "Доля ошибок"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Ваш поисковый фильтр не был перенесён, так как для него сначала нужно выбрать параметр «Запуск от имени» на странице логов. Добавьте его в запрос оповещения, если он вам нужен.",
         "thresholdColumnGuessed": "Порог применён к {column}; убедитесь, что это нужное значение.",
         "thresholdNotCarried": "Порог {value} с графика не применён, так как вы выбрали другой запрос.",
-        "rumFunnelExclusions": "Использует фильтры этого приложения на текущий момент; пересоздайте его после их изменения."
+        "rumFunnelExclusions": "Использует фильтры этого приложения на текущий момент; пересоздайте его после их изменения.",
+        "tracesSeedMatches": "Срабатывает, когда количество совпадающих спанов за {minutes} мин превышает {threshold} (сейчас {current}).",
+        "tracesSeedSpans": "Срабатывает, когда количество спанов за {minutes} мин превышает {threshold} (сейчас {current}).",
+        "tracesSeedTraces": "Срабатывает, когда количество трейсов за {minutes} мин превышает {threshold} (сейчас {current}).",
+        "tracesSeedErrorSpans": "Срабатывает, когда количество спанов с ошибками за {minutes} мин превышает {threshold} (сейчас {current}).",
+        "tracesSeedErrorTraces": "Срабатывает, когда количество трейсов с ошибками за {minutes} мин превышает {threshold} (сейчас {current}).",
+        "tracesSeedErrorRatio": "Срабатывает, когда доля ошибок за {minutes} мин превышает {threshold}% (сейчас {current}%).",
+        "tracesErrorRatioMinSpans": "Проверяются только окна, в которых не менее {minimum} спанов, поэтому несколько сбоев в спокойный период не приведут к срабатыванию.",
+        "tracesErrorRatioMinTraces": "Проверяются только окна, в которых не менее {minimum} трейсов, поэтому несколько сбоев в спокойный период не приведут к срабатыванию.",
+        "tracesSeedDuration": "Срабатывает, когда длительность {percentile} за {minutes} мин превышает {threshold} мс (сейчас {current} мс).",
+        "tracesSeedUnavailable": "Текущее значение не удалось прочитать, поэтому порог начинается с 0. Задайте его перед сохранением.",
+        "tracesNoMatches": "Совпадающих спанов пока нет, поэтому оповещение сработает, как только появится хотя бы один.",
+        "tracesStoredSpans": "Подсчитываются только сохранённые спаны, поэтому при семплировании трафика значения ниже фактических.",
+        "tracesPeriodCapped": "Окно оповещения было ограничено {minutes} минутами, чтобы каждая проверка выполнялась быстро.",
+        "tracesNotRun": "Этот поиск ещё не выполнялся, поэтому в оповещении используется фильтр из редактора."
       }
     },
     "saveFailed": "Не удалось сохранить оповещение.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Нет метрик, соответствующих текущим фильтрам",
       "noMatchHint": "Попробуйте удалить фильтр меток, очистить выбор префикса/суффикса или переключиться с «С данными» на «Все».",
       "noMatchHintFavorites": "Попробуйте удалить фильтр меток или переключиться с «С данными» на «Все».",
+      "noMatchYet": "Метрики с данными пока не найдены",
+      "noMatchYetHint": "Проверенные метрики пока не вернули данных. Нажмите «Показать больше», чтобы продолжить поиск.",
       "clearAllFilters": "Очистить все фильтры",
       "emptyActions": {
         "clearSearch": "Очистить поиск",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Панель добавлена на дашборд",
       "errorAddingPanel": "Ошибка при добавлении панели",
       "selectDashboard": "Пожалуйста, выберите дашборд",
-      "selectTab": "Пожалуйста, выберите вкладку"
+      "selectTab": "Пожалуйста, выберите вкладку",
+      "panelsToAdd": "Панели для добавления"
     },
     "groups": {
       "compute": "Вычисления",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Прочее"
   },
   "traces": {
+    "nlNeedsSql": "Для этого вопроса нужен SQL; откройте его в разделе «Логи»",
+    "redActions": {
+      "menuGroupDashboards": "Дашборды",
+      "addRedToDashboard": "Добавить RED-графики на дашборд",
+      "durationActions": "Действия с длительностью",
+      "bucketNotice": {
+        "seconds": "Эти графики сохранят столбцы по {count} сек., которые вы видите сейчас.",
+        "minutes": "Эти графики сохранят столбцы по {count} мин., которые вы видите сейчас.",
+        "hours": "Эти графики сохранят столбцы по {count} ч., которые вы видите сейчас.",
+        "days": "Эти графики сохранят столбцы по {count} дн., которые вы видите сейчас."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Этот график сохранит столбцы по {count} сек., которые вы видите сейчас.",
+        "minutes": "Этот график сохранит столбцы по {count} мин., которые вы видите сейчас.",
+        "hours": "Этот график сохранит столбцы по {count} ч., которые вы видите сейчас.",
+        "days": "Этот график сохранит столбцы по {count} дн., которые вы видите сейчас."
+      }
+    },
     "latencyHeatmap": {
       "title": "Длительность",
       "tooltipSpans": "{count} спан | Спанов: {count}",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Следующее совпадение",
     "searchInSpans": "Искать в спанах",
     "criticalPath": "Критический путь",
+    "askAi": {
+      "explainTrace": "Объяснить трейс",
+      "explainTraceHint": "Спросите ИИ о самых медленных спанах на критическом пути и обо всех спанах с ошибками",
+      "askAboutSpan": "Спросить ИИ об этом спане",
+      "spanChip": "Спан · {operation}",
+      "traceChip": "Трейс · {operation}"
+    },
     "spansTableView": "Табличное представление спанов",
     "comingSoon": "Скоро...",
     "fetchingTrace": "Загрузка вашего трейса.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Фильтр ошибок",
         "resetFilters": "Сбросить фильтры",
         "errorsNone": "Нет ошибок · Ходов: {total}",
-        "latencyLead": "Самый медленный {slowest} ·",
+        "latencyLead": "Средний ход {avg} · Самый медленный {slowest} ·",
         "costLead": "Пик {peak} ·",
         "tokens": "{ratio}% кэшировано",
         "cacheImpact": "{ratio}% повторно использовано · {tokens} Tok прочитано",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Нет данных",
       "noErrorsInRange": "Нет ошибок в этом временном диапазоне",
+      "loadFailed": "Не удалось загрузить последние ошибки",
       "time": "Время",
       "service": "Сервис",
       "operation": "Операция",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Всегда активен (по умолчанию)",
     "testAtTimeLabel": "Проверить по времени UTC",
     "testAtTimeHint": "Оставьте пустым, чтобы использовать текущее время. Пиковые и непиковые уровни определяются относительно этого времени.",
-    "localTimeHint": "В вашем часовом поясе: {range}"
+    "localTimeHint": "В вашем часовом поясе: {range}",
+    "builtInStatus": {
+      "seed": "Встроенные цены: исходный список, поставляемый с этой версией, от {date}.",
+      "neverSynced": "Онлайн-синхронизация не запускалась с момента старта сервера.",
+      "lastSynced": "Последняя онлайн-синхронизация: {time}."
+    },
+    "unpriced": {
+      "title": "Пробелы в ценах",
+      "subtitle": "Модели в ваших LLM-трейсах, у которых на момент приема не было цены или была только приблизительная",
+      "banner": "{count} модель не имела цены или имела приблизительную цену при приеме. Её записанная стоимость может быть неполной. | {count} моделей не имели цены или имели приблизительную цену при приеме. Их записанные стоимости могут быть неполными.",
+      "bannerTruncated": "У {total} моделей в ваших трейсах на момент приема не было цены или была приблизительная. Их стоимость может быть неверной. Показаны первые {shown} по числу токенов.",
+      "streamLabel": "Поток",
+      "window": "Последние 24 часа",
+      "windowRange": "{from} – {to}",
+      "colModel": "Модель в трейсах",
+      "colPricedAs": "Цена как у",
+      "colTokens": "Токены",
+      "colCost": "Записанная стоимость",
+      "colActions": "Действия",
+      "spans": "{count} спан | {count} спанов",
+      "moreAgents": "ещё +{count}",
+      "noMatch": "Нет совпадений",
+      "approximate": "Приблизительно",
+      "pricedNow": "Цена для новых спанов",
+      "historicalGap": "В этом окне сохраняется зафиксированный пробел в ценах. Новые спаны используют текущую цену.",
+      "noActionNeeded": "Действий не требуется",
+      "defaultTierPrices": "вход {input} / выход {output} за 1M",
+      "notPriced": "без цены",
+      "createPrice": "Создать цену",
+      "keepPrices": "Оставить цены {name}",
+      "mute": "Заглушить",
+      "muteConfirmTitle": "Заглушить эту модель?",
+      "muteConfirmMessage": "Новые спаны {model} будут считаться бесплатными. Старые спаны сохраняют записанную стоимость. Удалите цену \"{name}\", чтобы снять заглушение.",
+      "mutedNotif": "{model} заглушена",
+      "keptNotif": "{model} теперь использует цены {name}",
+      "errSave": "Не удалось сохранить цену",
+      "errLoad": "Не удалось загрузить модели без цены",
+      "emptyTitle": "В этом потоке за это окно не зафиксировано использования моделей без цены или с приблизительной ценой.",
+      "noStreamsTitle": "Нет потоков LLM-трейсов",
+      "noStreamsDesc": "Модели появятся здесь, когда спаны gen_ai попадут в поток трейсов.",
+      "recordedCostNote": "Новые цены применяются к спанам, принятым после сохранения. Старые спаны сохраняют записанную стоимость.",
+      "noModelName": "(без имени модели)",
+      "noModelHint": "Нет модели для оценки: задайте gen_ai.request.model",
+      "instrumentationDocs": "Руководство по инструментированию"
+    }
   },
   "aiObservability": {
     "title": "Наблюдаемость ИИ",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Пропущено строк: {full} полностью · {partial} частично",
       "scoreEvidence": "{scorer} · v{version}: образцов: {samples}, без эталона: {noReference}, без трейса: {noTrace}",
       "scorerApplicability": "{scorer} · v{version}: доступных слотов: {eligible}, без эталона: {noReference}",
+      "costUnknown": "стоимость неизвестна",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Не удалось загрузить эксперименты",
       "previewError": "Не удалось предпросмотреть слоты эксперимента",
       "createSuccess": "Эксперимент создан",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Ожидаемая стоимость этого эксперимента — около {cost}, что превышает порог предупреждения {threshold}. Всё равно создать и запустить его?",
         "costConfirmMessageUnpriced": "Предполагаемая стоимость этого эксперимента превышает порог предупреждения. Всё равно создать и запустить его?",
         "costConfirmOk": "Всё равно создать",
+        "taskProviderFailed": "Ничего не создано. Провайдер задач {provider} не ответил на тестовый вызов.",
+        "judgeProviderFailed": "Ничего не создано. Провайдер-судья {provider} не ответил на тестовый вызов.",
         "skippedFully": "Пропущено строк полностью: {count} — каждому выбранному оценщику требуется ожидаемый результат. Пропущенные строки не требуют затрат на выполнение.",
         "skippedPartially": "Пропущено строк частично: {count} — задача все равно выполняется, но оценщики на основе эталонов не могут оценить строки без ожидаемого результата.",
         "skippedNone": "Каждая подходящая строка может быть оценена хотя бы по одному измерению.",
@@ -17408,7 +17851,26 @@
           "trials": "Прогоны",
           "dispersion": "Разброс",
           "latency": "Задержка",
-          "p50Latency": "Задержка P50"
+          "p50Latency": "Задержка P50",
+          "error": "Ошибка"
+        },
+        "failureBanner": {
+          "title": "Не удалось выполнить {failed} из {total} слотов: {cause}.",
+          "cause": "Основная причина, {count} слотов: {message}",
+          "moreCauses": "+ ещё {count} причин",
+          "noMessage": "сообщение об ошибке не было записано",
+          "openProviders": "Открыть «Провайдеры»"
+        },
+        "failureKinds": {
+          "provider_auth": "провайдер отклонил учётные данные",
+          "rate_limited": "провайдер ограничил частоту запуска",
+          "timeout": "провайдер не ответил вовремя",
+          "provider_5xx": "провайдер вернул ошибку сервера",
+          "parse_error": "не удалось разобрать выходные данные",
+          "mapping_error": "не удалось сформировать входные данные задачи",
+          "scorer_missing": "оценщик больше не существует",
+          "execution_error": "вызов задачи завершился ошибкой",
+          "unknown": "вызов задачи завершился ошибкой"
         },
         "saveAsPrompt": "Сохранить как промпт",
         "openPrompt": "Открыть промпт",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Окружение",
       "agent": "Агент",
-      "version": "Версия"
+      "version": "Версия",
+      "agentIdHint": "ID агента: {ids}",
+      "noAgentIdentity": "Идентичность агента не найдена",
+      "noAgentIdentityDescription": "Эти спаны LLM не содержат имени агента, поэтому они показаны по потоку. Сопоставьте атрибут, задающий имя вашего агента, чтобы просматривать их по агенту.",
+      "noAgentIdentityAction": "Открыть сопоставление агентов GenAI"
     },
     "agentGraph": {
       "stream": "Поток",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Онлайн-оценки отключены на этом сервере",
+      "description": "Для этой страницы нужны онлайн-оценки, но они отключены на этом сервере. Попросите администратора включить их."
+    },
     "traceScoreChip": {
       "reasoning": "Почему",
       "noReasoning": "Для этой оценки не зафиксировано рассуждений.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Настроить эндпоинт"
     },
     "provider": {
-      "backTo": "Назад к провайдерам",
+      "backTo": "Провайдеры",
       "createTitle": "Создать LLM-провайдера",
       "editTitle": "Редактировать LLM-провайдера",
       "subtitle": "Настройте эндпоинт модели, используемый оценщиками-судьями LLM.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Оценщик {index}: имя \"{name}\" используется в этом импорте более одного раза"
         }
       },
-      "backTo": "Назад к оценщикам",
+      "backTo": "Оценщики",
       "badgeRemote": "Удаленный",
       "badgeLlm": "LLM-судья",
       "createTitleRemote": "Новый удаленный оценщик",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Выберите провайдера",
       "modelLabel": "Модель",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Температура",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "От 0 до 2. Оставьте пустым, чтобы оценщик использовал 0.",
       "promptLabel": "Подсказка судьи",
       "includeReasoningLabel": "Включить объяснение",
       "includeReasoningHint": "Судья объясняет, почему он поставил эту оценку; сохраняется с каждым результатом.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Требуется имя заголовка",
         "apiKeyTokenRequired": "Требуется токен",
         "timeoutInvalid": "Тайм-аут должен быть 0 или больше",
+        "temperatureInvalid": "Температура должна быть от 0 до 2",
         "retriesInvalid": "Повторные попытки должны быть 0 или больше",
         "duplicateFieldName": "Имена полей должны быть уникальными"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Ухудшен",
         "waitingForCredentials": "Ожидание учётных данных",
         "noRecentRuns": "Нет недавних запусков",
+        "lastScored": "Последняя оценка: {time}",
         "summary": "{errors} из {runs} запусков завершились ошибкой за последние 15 минут",
         "since": "Перешёл в это состояние {time}",
         "checked": "Последняя проверка: {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Оценивает {percent}% совпавших целей.",
       "samplingValueAllHelp": "Каждая совпавшая цель оценивается.",
       "samplingHelp": "Запускается после фильтрации для контроля затрат.",
-      "backTo": "Назад к заданиям оценки",
+      "backTo": "Задания оценки",
       "createTitle": "Новое задание оценки",
       "editTitle": "Обновить задание оценки",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Эта ветвь уже заканчивается получателем.",
       "chooseATriggerNodeToStart": "Выберите узел-триггер для запуска рабочего процесса",
       "thisConnectionWouldCreateALoop": "Это соединение создаст цикл",
-      "onlyOneIncomingConnectionToA": "К одному шагу разрешено только одно входящее соединение"
+      "onlyOneIncomingConnectionToA": "К одному шагу разрешено только одно входящее соединение",
+      "endpointUrlCopied": "URL конечной точки скопирован"
     },
     "views": {
       "youAreNotAuthorizedToManage": "Вы не авторизованы для управления лицензией.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Поиск базы данных или сервиса…",
       "unnamedInstance": "Экземпляр не назван",
+      "schemaCount": "Схем: {count} | Схем: {count}",
       "unnamedInstanceHint": "Собственные отчёты базы данных подтверждают, что этот движок работает, но они не указывают хост. Строка покажет адрес, когда будет настроен источник данных, который передаёт его — выборки сессий или метрик экземпляра.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Подсчитано до {time}; последние полминуты еще поступают.",
       "lineExact": "Все базы данных сообщают данные. Скорости здесь измеряются по каждому вызову, поэтому они точны.",
       "lineExactEstimated": "Все базы данных сообщают данные. Скорости здесь усреднены за несколько отрезков времени, поэтому они приблизительны, но не точны.",
+      "lineExactSlowestSchema": "Все базы данных передают данные. Скорости точны для каждой схемы; если в базе данных несколько схем, показывается самая медленная.",
       "lineSubsetUnnamed": "Ваши фильтры сужают выборку ниже уровня, на котором суммируются эти итоги, поэтому проценты описывают показанные строки, а не всю базу данных.",
       "lineQuery": "Время измеряется из вашего приложения, поэтому оно включает сетевое время и ожидание свободного соединения.",
       "lineUncodedErrors": "{percent} ошибок здесь вернулись без кода причины, поэтому их можно посчитать, но нельзя объяснить.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "Это оповещение сработало впервые.",
     "escalationNotStarted": "Пока никого не вызывали",
     "escalationPagesNobody": "Никого не вызывает",
+    "escalationNobodyPaged": "Никого не вызывают",
     "escalationTo": "эскалируется на {who} {when}",
     "escalationDetailCapped": "Детали эскалации в реальном времени загружены для самых старых открытых вызовов ({count}).",
     "responder": "Ответственный",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "По",
     "rotationRestrictionAdd": "Добавить окно",
     "rotationRestrictionRemove": "Удалить",
-    "rotationRestrictionZeroLength": "Значения «С» и «По» совпадают, поэтому это окно никогда не срабатывает и уровень незаметно никогда не применяется. Для полного дня укажите для «По» значение 24:00.",
+    "rotationRestrictionZeroLength": "Значения «С» и «По» совпадают, поэтому это окно никогда не срабатывает. Сохранение остаётся отключённым, пока «С» и «По» не будут различаться; для полного дня установите «По» на 24:00.",
     "rotationRetiredTag": "Прекращено",
     "rotationSectionWhen": "Когда происходит смена",
     "rotationName": "Название ротации",
@@ -25593,6 +26072,10 @@
     "snoozed": "Отложено",
     "snoozedUntil": "Отложено до {time} — всё ещё не назначено",
     "snoozeFailed": "Не удалось отложить вызов",
+    "unsnooze": "Завершить паузу",
+    "unsnoozeHint": "Завершает паузу сейчас. Вызов дежурных продолжается с шага, на котором был приостановлен.",
+    "unsnoozed": "Пауза завершена · вызов дежурных продолжается",
+    "unsnoozeFailed": "Не удалось завершить паузу",
     "note": "Заметка",
     "notePlaceholder": "Что вы нашли? Что вы попробовали?",
     "addNote": "Добавить заметку",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Те же люди, на одну смену позже, поэтому вторичный дежурный никогда не совпадает с тем, кто уже на дежурстве. Это обычная ротация — ничто не связывает эти две, поэтому если изменить один состав, но не другой, они разойдутся, и вы получите предупреждение, а не незаметное исправление.",
     "rotationPreviewPairLegend": "Основной · Вторичный",
     "rotationPreviewEmpty": "Выберите людей и первую передачу дежурства, чтобы увидеть, кто и когда дежурит.",
+    "rotationPreviewNow": "Сейчас – {until}",
     "defaultRotationName": "Ротация",
     "teamCreatedWithoutMembers": "Команда создана, но её участников не удалось добавить. Добавьте их на вкладке «Участники».",
     "teamCreatedWithoutRotation": "Команда и её участники созданы, но ротацию не удалось сохранить. Настройте её на вкладке «Расписание».",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "никто не подтвердил — вызовы всё ещё отправляются",
     "sectionHint_ringingRouted": "никто не подтвердил — {count} из них всё ещё вызывает дежурных | никто не подтвердил — {count} из них всё ещё вызывают дежурных",
     "sectionHint_ringingUnrouted": "{count} не имеет команды, поэтому не вызывает дежурных | {count} не имеют команды, поэтому не вызывают дежурных",
+    "sectionHint_ringingStopped": "Не получает вызов: {count} | Не получают вызов: {count}",
     "sectionHint_snoozed": "вызовы приостановлены — они вернутся сами",
     "sectionHint_handled": "подтверждено — за каждое отвечает человек",
     "sectionHint_resolved": "закрыто — сохранено для истории",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "Команда, которую вызывают при совпадении сигнала. Её собственная лестница эскалации решает, кого будить и в каком порядке.",
     "scopeOwns": "Эта команда владеет",
     "scopeAdvanced": "Дополнительно",
-    "ruleEditorConflictUnclaimed": "Сейчас этот путь никем не закреплён — соответствующий ему вызов попадает в резервную команду или ни к кому.",
+    "ruleEditorConflictUnclaimed": "Сегодня этот путь никем не занят; если судить только по этим условиям, соответствующий вызов попадёт в catch-all или не попадёт ни к кому.",
     "ruleEditorConflictHeldBy": "Сейчас вызов, соответствующий этому, идёт в {team} через {path}.",
     "ruleEditorConflictTakesOver": "Ваше правило закрепляет больше условий, поэтому оно заберёт их у {team}.",
     "ruleEditorConflictKeptBy": "Путь, удерживаемый командой {team}, закрепляет больше условий, поэтому они оставляют их себе, а это правило перехватывает только оставшееся.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} вызывает эту команду только в {scope}. В других местах это отходит к тому, кто владеет окружающей областью.",
     "scopeNothingDiscovered": "Пока ничего не обнаружено, поэтому выбирать не из чего. Используйте «Расширенный», чтобы задать правило по полю, или сначала отправьте телеметрию.",
     "scopeAdvancedHint": "Сопоставление по любому полю и значению, включая те, которые не охвачены уровнями выше.",
+    "scopeValuesSeen": "Эти списки показывают значения, найденные при обнаружении сервисов. Чтобы сопоставить любое другое значение, используйте «Дополнительно».",
     "escalationHeld": "Сначала ИИ-триаж · вызов в течение {n} с",
     "escalationPagingStep": "Вызов, ступень {step} из {total} · {who}",
     "escalationPagingStepOnly": "Вызов, ступень {step} из {total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Создать команду и ротацию",
     "removeMemberHandsOver": "{name} принимает текущую смену {leaving} в {rotation}.",
     "removeMemberLeavesGap": "Никто не принимает текущую смену {leaving} в {rotation}.",
+    "removeMemberReorders": "Они также покидают {rotations}, поэтому состав дежурных там тоже может измениться.",
     "membersJoinEnd": "{names} встаёт в конец {rotations}. Текущий дежурный не меняется. | {names} встают в конец {rotations}. Текущий дежурный не меняется.",
     "membersAdded": "Добавлено: {names}. | Добавлено: {names}.",
     "removeMemberConfirm": "Удалить",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Вопросы: {contact}",
       "outboundQueue": "Сообщения оповещений: в очереди {count}, старейшее — {age} | Сообщения оповещений: в очереди {count}, старейшее — {age}",
       "outboundEmpty": "Нет сообщений оповещений в очереди",
+      "refusedPosts": "Не удалось опубликовать {count} оповещение за последние 24 ч. Последнее: {reason} на {destination}, | Не удалось опубликовать {count} оповещений за последние 24 ч. Последнее: {reason} на {destination},",
       "ageSeconds": "{count} с"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "Не удалось отправить напоминания."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(имя модели отсутствует)",
+    "topModels": "{models} (топ {shown} из {total})",
+    "cost": {
+      "partial": "частично",
+      "unknown": "стоимость неизвестна",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Неполная стоимость. Нет цены для {models}: количество токенов в этой области ({scope}) — {tokens} — не учитывается.",
+      "unknownTooltip": "Стоимость неизвестна. Нет цены для {models}: ни один токен в этой области ({scope}) не имеет стоимости; всего токенов: {tokens}.",
+      "scopeSession": "сессия",
+      "scopeTrace": "трейс",
+      "unknownModel": "безымянная модель",
+      "addPrice": "Добавить цену"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} токенов без цены",
+      "unpricedTooltip": "Стоимость — это нижняя граница: для {tokens} токенов в {models} нет цены. Откройте вкладку «Без цены» в разделе «Цены моделей LLM».",
+      "pricedSinceTooltip": "Стоимость — это нижняя граница: {tokens} токенов в {models} были записаны до добавления цены и остаются без стоимости."
+    },
+    "chart": {
+      "costMissing": "Нет на этом графике: {models}. Для {tokens} токенов нет цены.",
+      "costMissingPricedSince": "Нет на этом графике: {models}. {tokens} токенов были записаны до добавления цены.",
+      "unpricedModels": "Без цены: {models}",
+      "pricedSinceModels": "Записаны до добавления цены: {models}",
+      "addPrice": "Добавить цену"
+    },
+    "health": {
+      "title": "Состояние данных",
+      "passing": "{n} пройдено",
+      "checkedAgo": "проверено {ago}",
+      "drawerTitle": "Состояние данных ИИ",
+      "drawerSubtitle": "{stream} · текущее окно",
+      "rerun": "Повторить проверки",
+      "close": "Закрыть",
+      "loadError": "Не удалось запустить проверки состояния данных.",
+      "samples": "Примеры:",
+      "copyLink": "Скопировать ссылку для администратора",
+      "linkCopied": "Ссылка скопирована",
+      "status": {
+        "pass": "Пройдено",
+        "warning": "Предупреждение",
+        "error": "Ошибка"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Модели без цены",
+          "detail": "{count} модель · {spans} спанов · {tokens} токенов учтено как $0 | {count} моделей · {spans} спанов · {tokens} токенов учтено как $0",
+          "pass": "У каждой модели в этом окне есть цена. Спаны, записанные до добавления цены, сохраняют зафиксированную стоимость.",
+          "fix": "Исправить в разделе «Цены моделей LLM»",
+          "truncated": "Топ {shown} из {total} по токенам"
+        },
+        "missing_agent_identity": {
+          "label": "Отсутствует идентификатор агента",
+          "detail": "{affected} из {total} LLM-спанов ({pct}) не имеют gen_ai.agent.name, поэтому они отсутствуют в представлениях агентов.",
+          "pass": "Каждый LLM-спан содержит имя или идентификатор агента.",
+          "fix": "Открыть сопоставление агентов GenAI"
+        },
+        "zero_duration_spans": {
+          "label": "Спаны с нулевой длительностью",
+          "detail": "{affected} LLM-спанов показывают 0 мс, поэтому задержка и длительность сессии выглядят заниженными.",
+          "pass": "Ни один LLM-спан не показывает 0 мс.",
+          "fix": "Как исправить"
+        },
+        "missing_session_id": {
+          "label": "Спаны без идентификатора сессии",
+          "detail": "{affected} из {total} LLM-спанов ({pct}) не имеют gen_ai.conversation.id, поэтому они не отображаются в разделе «Сессии».",
+          "pass": "У каждого LLM-спана есть gen_ai.conversation.id.",
+          "fix": "Руководство по интеграции"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Управление парком",
     "subtitle": "Регистрируйте коллекторы OpenTelemetry, версионируйте их конфигурации и безопасно разворачивайте изменения",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "Выполняется",
       "scheduled": "Запланировано",
+      "waiting": "Ожидание",
       "completed": "Завершено",
       "halted": "Остановлено",
       "superseded": "Заменено",
@@ -28696,7 +29257,7 @@
       "version": "Версия",
       "pickConfig": "Выберите конфигурацию",
       "pickFleet": "Выберите парк",
-      "emptyFleet": "В парке нет коллекторов, поэтому версия задаётся сразу",
+      "emptyFleet": "В парке нет коллекторов, поэтому развёртывание ждёт, пока не подключится хотя бы один.",
       "startingShortly": "Скоро начнётся",
       "eventGateFailed": "Проверка здоровья не пройдена",
       "eventHalted": "Остановлено",
@@ -28707,7 +29268,10 @@
       "notFound": "Это развертывание больше не существует",
       "notFoundDescription": "Ссылка могла устареть. Выберите развертывание из списка.",
       "noneTargeted": "Коллекторы не затронуты",
-      "outcomeNoneTargeted": "На момент задания v{to} в парке не было коллекторов.",
+      "outcomeNoneTargeted": "Ни один коллектор не получил v{to} в этом развёртывании.",
+      "outcomeWaiting": "Ни один коллектор не в сети, поэтому v{to} пока не получил никто. Развёртывание начнётся, когда подключится хотя бы один.",
+      "waitingForCollector": "Ожидание коллектора",
+      "notStarted": "Не запущено",
       "versionFailedBefore": "v{version} · ранее завершилась сбоем",
       "pickVersion": "Выберите версию",
       "autoRollback": "Откатывать автоматически",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Возобновлено",
       "eventSkipped": "Сбойные коллекторы пропущены",
       "eventStarted": "Запущено",
+      "eventWaiting": "Ожидание подключения коллектора",
       "eventTimedOut": "Время этапа истекло",
       "eventSkippedOffline": "Пропущен {count} коллектор, который был не в сети на старте; он получит версию при повторном подключении | Пропущены коллекторы ({count}), которые были не в сети на старте; они получат версию при повторном подключении",
       "excluded": "Исключён",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Этап, который не подтверждается и не отклоняется за {minutes} мин, останавливает развертывание (настройка парка)",
       "phaseVerifying": "Проверка",
       "phases": "Этапы",
-      "planEmpty": "Нет коллекторов для обновления",
+      "planEmpty": "Ни один коллектор не в сети, поэтому развёртывание ждёт, пока не подключится хотя бы один.",
+      "planStable": "Ни один коллектор не в сети; стабильная версия будет применена к каждому при подключении",
       "planOne": "{count} коллектор в одной партии | Коллекторов в одной партии: {count}",
       "planText": "{steps} → остаток {last}, этапов: {count}",
       "planUnavailable": "Предпросмотр плана недоступен",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 — хранить коллекторы не в сети бессрочно"
     },
     "audit": {
-      "search": "Поиск по журналу аудита",
       "editedConfig": "Конфигурация изменена",
       "revokedToken": "Токен регистрации отозван",
       "enrolledCollector": "Коллектор зарегистрирован",
@@ -28920,7 +29485,6 @@
       "setDesired": "Версия изменена",
       "autoRollback": "Автоматически откачено",
       "rolloutHalted": "Развертывание остановлено",
-      "assignedFleetConfig": "Назначена конфигурация парка",
       "createdFleet": "Парк создан",
       "renamedFleet": "Парк переименован",
       "deletedFleet": "Парк удалён",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Развертывание откачено",
       "movedByToken": "Перемещён по токену регистрации",
       "object": "Объект",
+      "search": "Поиск по журналу аудита",
       "allObjects": "Все объекты",
       "kind": {
         "fleet": "Парк",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "Развертывается v{to}",
       "rolloutHalted": "Развертывание v{to} остановлено",
+      "rolloutWaiting": "v{to} ожидает подключения коллектора",
       "autoRolledBack": "v{to} автоматически откачена",
       "noReason": "Причина сбоя не передана",
       "openRollout": "Открыть развертывание",
diff --git a/web/src/locales/languages/th-TH.json b/web/src/locales/languages/th-TH.json
index 1e9c8ad907..e6a80798bc 100644
--- a/web/src/locales/languages/th-TH.json
+++ b/web/src/locales/languages/th-TH.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "No LLM activity yet",
       "description": "Instrument your services with the OpenTelemetry Gen-AI semantic conventions and ingest at least one trace to populate this dashboard.",
-      "action": "Instrument with OpenTelemetry",
-      "actionDesc": "Capture gen_ai_* attributes on your traces"
+      "action": "การผสานรวม AI ทั้งหมด",
+      "actionDesc": "เรียกดูคู่มือเฟรมเวิร์กและผู้ให้บริการทั้งหมด",
+      "suggested": "ตั้งค่าการทำเทรซสำหรับ {name}",
+      "suggestedDesc": "แนะนำเพราะคุณมาจากเอกสารคู่มือของ {name}",
+      "codingAgent": "เพิ่ม instrumentation ด้วยเอเจนต์เขียนโค้ด",
+      "codingAgentDesc": "เอเจนต์เขียนโค้ดของคุณจะเพิ่มการทำเทรซและตรวจสอบเทรซแรก",
+      "startFrom": "หรือเริ่มจาก"
     },
     "noLLMSessions": {
       "title": "No LLM sessions yet",
@@ -4797,6 +4802,13 @@
       "success": "สำเร็จ",
       "failed": "Failed",
       "testRun": "Test run",
+      "source": "แหล่งที่มา",
+      "sourceHttp": "คำขอ HTTP",
+      "sourceAlertFired": "การแจ้งเตือนถูกทริกเกอร์",
+      "sourceIncidentEvent": "เหตุการณ์ขัดข้อง",
+      "sourceRetry": "การทำงานแบบลองใหม่",
+      "sourceManual": "การทำงานด้วยตนเอง",
+      "sourceOther": "อื่นๆ",
       "runType": "ประเภท",
       "testRunTooltip": "Started from the editor. Destination steps dispatch for real.",
       "showTestRuns": "Show {count} test run(s)",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Retry this run?",
       "retryMessage": "This creates a new run from the input the failed run recorded. Destination steps dispatch for real.",
       "retryStarted": "Retry started — it appears in the list as a new run.",
-      "retryError": "Could not retry this run"
+      "retryError": "Could not retry this run",
+      "statusQueued": "อยู่ในคิว",
+      "statusRunning": "กำลังทำงาน",
+      "statusExpired": "หมดอายุ",
+      "reasonExpired": "ไม่เคยทำงาน · อยู่ในคิวเกิน 1 ชม.",
+      "reasonWorkerLost": "worker หายไป · ไม่ได้ทำงานซ้ำ",
+      "reasonWorkflowDisabled": "เวิร์กโฟลว์ถูกปิดใช้งาน",
+      "reasonRunTimeout": "หมดเวลาหลังจาก 15 นาที",
+      "allTriggers": "ทริกเกอร์ทั้งหมด",
+      "triggerFilter": "ทริกเกอร์",
+      "run": "การทำงาน",
+      "searchRuns": "ค้นหา ID การทำงาน, คีย์ idempotency หรือการแจ้งเตือน",
+      "sourceDetails": "รายละเอียดแหล่งที่มา",
+      "detailsWithKey": "{ip} · คีย์ {key}",
+      "detailsNoKey": "{ip} · ไม่มีคีย์ idempotency",
+      "retryOf": "ลองใหม่จากการทำงาน {run}",
+      "openRun": "เปิดการทำงาน",
+      "alertFiredEmptyTitle": "ไม่มีการทำงานที่เกิดจากการแจ้งเตือนในช่วงเวลานี้",
+      "incidentEventEmptyTitle": "ไม่มีการทำงานจากเหตุการณ์ขัดข้องในช่วงเวลานี้",
+      "filterEmptyTitle": "ไม่มีการทำงานที่ตรงกันในช่วงเวลานี้",
+      "filterEmptyDimmed": "การทำงานอื่นยังอยู่บนไทม์ไลน์ แต่แสดงแบบจางลง",
+      "searchEmptyTitle": "ไม่มีการทำงานที่ตรงกับการค้นหานี้",
+      "searchEmptyAction": "ล้างการค้นหา",
+      "timelineNow": "ตอนนี้",
+      "timelineAgoMinutes": "−{n} น.",
+      "timelineAgoHours": "−{n} ชม.",
+      "timelineAgoDays": "−{n} วัน"
     },
     "edit": "แก้ไข",
     "view": "ดู",
@@ -4958,7 +4996,9 @@
           "noMatch": "No Match"
         },
         "suppressed": "Suppressed — not sent to the real destination"
-      }
+      },
+      "payloadFrom": "เพย์โหลดจาก",
+      "payloadFromHint": "รูปแบบ HTTP คือสิ่งที่ผู้เรียกปลายทางส่งมา"
     },
     "linkAlerts": {
       "title": "Link Workflow To Alerts",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Output Format",
       "tlsVerifyLabel": "TLS Verification",
       "tlsDisabled": "ปิดใช้งาน"
+    },
+    "http": {
+      "runTestHint": "ทำงานตามขั้นตอนด้วยเพย์โหลด HTTP ตัวอย่าง โดยไม่เรียก URL",
+      "runTestHintList": "เปิดเวิร์กโฟลว์เพื่อทำการทดสอบ",
+      "runsEmptyTitle": "ไม่มีคำขอ HTTP ในช่วงเวลานี้",
+      "runsEmptyBody": "ขยายช่วงเวลา หรือส่งคำขอทดสอบจากพาเนลปลายทาง HTTP",
+      "runsEmptyAction": "แสดงทริกเกอร์ทั้งหมด",
+      "runFailedAt": "การทำงานนี้ล้มเหลวที่ {step}: {error}",
+      "openStep": "เปิดขั้นตอน",
+      "runGuardHint": "การทำงาน HTTP จะพาคำขอ ไม่ใช่ฟิลด์ของการแจ้งเตือน หากขั้นตอนนี้อ่าน {fields} ให้ป้องกันด้วยเงื่อนไข: {guard}",
+      "runExpiredBanner": "คำขอนี้รอในคิวเกิน 1 ชั่วโมงและไม่ถูกเรียกทำงานเลย ไม่มีขั้นตอนใดทำงานและไม่มีการเรียกปลายทางใดๆ",
+      "runWorkerLostBanner": "เวิร์กเกอร์ที่กำลังประมวลผลคำขอนี้หยุดทำงาน คำขอนี้จะไม่ถูกเรียกทำงานซ้ำโดยอัตโนมัติ เนื่องจากอาจมีการเรียกปลายทางไปแล้ว ตรวจสอบปลายทางเหล่านั้นก่อนที่ผู้เรียกจะส่งซ้ำ",
+      "request": "คำขอ",
+      "requestReceived": "เวลาที่ได้รับ",
+      "requestToken": "โทเค็น",
+      "requestCallerIp": "IP ของผู้เรียก",
+      "requestIdempotencyKey": "คีย์ Idempotency",
+      "requestContentType": "ประเภทเนื้อหา",
+      "requestBodySize": "ขนาดบอดี้",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "ส่วนหัว",
+      "headersKept": "เก็บไว้ {count} รายการ · Authorization, คุกกี้ และลายเซ็นจะไม่ถูกจัดเก็บ | เก็บไว้ {count} รายการ · Authorization, คุกกี้ และลายเซ็นจะไม่ถูกจัดเก็บ",
+      "headerName": "ชื่อ",
+      "headerValue": "ค่า",
+      "outputCaption": "สิ่งที่ทุกขั้นตอนถัดไปได้รับ",
+      "useAsTestInput": "ใช้เป็นอินพุตทดสอบ",
+      "editorButton": "ปลายทาง HTTP",
+      "editorButtonOn": "เปิด",
+      "editorButtonOff": "ปิด",
+      "editorButtonTooltip": "ให้ระบบอื่นเริ่มเวิร์กโฟลว์นี้ด้วยคำขอ HTTP",
+      "editorButtonRefusedDraft": "คำขอจะได้รับ 403 จนกว่าเวิร์กโฟลว์จะถูกเผยแพร่",
+      "editorButtonRefusedPaused": "คำขอจะได้รับ 403 ขณะที่เวิร์กโฟลว์ถูกหยุดชั่วคราว",
+      "panelTitle": "ปลายทาง HTTP",
+      "panelSubtitle": "{name} · เวิร์กโฟลว์ {kind}",
+      "acceptRequests": "รับคำขอ HTTP",
+      "kindNote": "ขั้นตอนของเวิร์กโฟลว์นี้ถูกสร้างสำหรับการทำงานแบบ {kind} การทำงานผ่าน HTTP จะได้รับคำขอแทน ({field}) ดังนั้นเพิ่มเงื่อนไขหากขั้นตอนต้องการฟิลด์ {kind}",
+      "kindNotePayload": "แสดงเพย์โหลด HTTP",
+      "kindNotePayloadHide": "ซ่อนเพย์โหลด HTTP",
+      "unsavedBody": "ยังไม่ได้บันทึกเวิร์กโฟลว์นี้ บันทึกเป็นฉบับร่างเพื่อสร้าง URL และโทเค็น คำขอจะถูกปฏิเสธจนกว่าคุณจะเผยแพร่",
+      "saveAndCreate": "บันทึกฉบับร่างและสร้างปลายทาง",
+      "needsAdmin": "การสร้างปลายทางต้องมีผู้ดูแลองค์กร",
+      "needsEdit": "การเปลี่ยนแปลงต้องมีสิทธิ์แก้ไขเวิร์กโฟลว์นี้",
+      "readOnlyOnMeta": "เปิด · คุณสามารถคัดลอก URL ได้ การเปลี่ยนแปลงต้องมีสิทธิ์แก้ไขเวิร์กโฟลว์นี้",
+      "offBody": "ให้ระบบอื่นเริ่มเวิร์กโฟลว์นี้ด้วยคำขอ HTTP คุณจะได้รับ URL และโทเค็น",
+      "offExistingBody": "ปิด · คำขอจะถูกปฏิเสธ (403) จนกว่าคุณจะเปิด",
+      "onMeta": "เปิด · การทำงานจะเริ่มเฉพาะเมื่อเวิร์กโฟลว์เปิดใช้งานและเผยแพร่แล้ว",
+      "loadError": "ไม่สามารถโหลดการตั้งค่าปลายทางได้",
+      "draftBanner": "เวิร์กโฟลว์นี้เป็นฉบับร่าง การเรียก URL จะได้รับ 403 จนกว่าคุณจะเผยแพร่ คุณสามารถตั้งค่าปลายทางได้ตอนนี้ และการเรียกใช้การทดสอบจะเรียกทำงานขั้นตอนของฉบับร่างด้วยเพย์โหลด HTTP ตัวอย่าง",
+      "disabledBanner": "คำขอจะถูกปฏิเสธ (403) จนกว่าคุณจะเปิดใช้งานเวิร์กโฟลว์",
+      "turnOnFailed": "ไม่สามารถเปิดปลายทางได้ {reason}",
+      "changeFailed": "ไม่สามารถบันทึกปลายทางได้ {reason}",
+      "endpointExistsHint": "ปลายทางมีอยู่แล้ว แสดงหรือคัดลอกโทเค็นจากตารางโทเค็น",
+      "endpointExistsHintSigned": "ปลายทางมีอยู่แล้ว แสดงหรือคัดลอกซีเคร็ตการลงนามจากตารางซีเคร็ตการลงนาม",
+      "disableTitle": "ปิดปลายทางหรือไม่",
+      "disableBody": "ผู้เรียกจะได้รับ 403 (ปลายทางปิด) จนกว่าคุณจะเปิดอีกครั้ง URL และโทเค็นจะยังคงเดิม",
+      "disableConfirm": "ปิด",
+      "lastCall": "เปิด · การเรียกครั้งล่าสุด: {status} · {time} · {link}",
+      "lastCallNone": "เปิด · ยังไม่มีการเรียก — ส่งคำขอทดสอบ",
+      "lastCallNoneRefused": "เปิด · ยังไม่มีการเรียก",
+      "viewRun": "ดูการทำงาน",
+      "lastCallStatus": {
+        "queued": "อยู่ในคิว",
+        "running": "กำลังทำงาน",
+        "succeeded": "สำเร็จ",
+        "failed": "ล้มเหลว",
+        "expired": "หมดอายุ"
+      },
+      "endpointUrl": "URL ปลายทาง",
+      "tokenLabel": "โทเค็น",
+      "secretLabel": "รหัสลับสำหรับลงนาม",
+      "newTokenLabel": "โทเค็นใหม่",
+      "newSecretLabel": "รหัสลับสำหรับลงนามใหม่",
+      "tokenHint": "แสดงแบบปิดบังบนหน้าจอ; การคัดลอกจะได้โทเค็นจริง ส่งเป็น {header} ห้ามส่งใน URL",
+      "secretHint": "แสดงแบบปิดบังบนหน้าจอ; การคัดลอกจะได้รหัสลับจริง ใช้ลงนามทุกคำขอและส่งเฮดเดอร์ {headers} ห้ามส่งรหัสลับเอง",
+      "revealBannerTitle": "สร้างปลายทางแล้ว",
+      "revealBannerBody": "ส่งโทเค็นนี้ไปกับทุกคำขอ คุณสามารถแสดงหรือคัดลอกได้อีกครั้งจากตารางโทเค็น",
+      "revealBannerBodySigned": "ลงนามทุกคำขอด้วยรหัสลับนี้ คุณสามารถแสดงหรือคัดลอกได้อีกครั้งจากตารางรหัสลับสำหรับลงนาม",
+      "switchedBannerTitle": "สร้างโทเค็นแล้ว",
+      "switchedBannerTitleSigned": "สร้างรหัสลับสำหรับลงนามแล้ว",
+      "rotateBannerTitle": "สร้างโทเค็นใหม่แล้ว",
+      "rotateBannerTitleSigned": "สร้างรหัสลับสำหรับลงนามใหม่แล้ว",
+      "rotateBannerBody": "ผู้เรียกใช้ยังใช้ URL และเฮดเดอร์เดิม มีเพียงโทเค็นที่เปลี่ยน โทเค็นเก่าจะยังใช้งานได้จนกว่าจะหมดอายุ และสามารถแสดงได้จนถึงตอนนั้น",
+      "rotateBannerBodySigned": "ผู้เรียกใช้ยังใช้ URL และเฮดเดอร์เดิม มีเพียงรหัสลับที่เปลี่ยน รหัสลับเก่าจะยังใช้งานได้จนกว่าจะหมดอายุ และสามารถแสดงได้จนถึงตอนนั้น",
+      "rotateBannerBodyRevoked": "ผู้เรียกใช้ยังใช้ URL และเฮดเดอร์เดิม มีเพียงโทเค็นที่เปลี่ยน โทเค็นเก่าถูกเพิกถอนและหยุดใช้งานทันที",
+      "rotateBannerBodyRevokedSigned": "ผู้เรียกใช้ยังใช้ URL และเฮดเดอร์เดิม มีเพียงรหัสลับที่เปลี่ยน รหัสลับเก่าถูกเพิกถอนและหยุดใช้งานทันที",
+      "rotateBannerBodyFresh": "ผู้เรียกใช้ยังใช้ URL และเฮดเดอร์เดิม และส่งโทเค็นนี้ตั้งแต่ตอนนี้เป็นต้นไป",
+      "rotateBannerBodyFreshSigned": "ผู้เรียกใช้ยังใช้ URL และเฮดเดอร์เดิม และลงนามด้วยรหัสลับนี้ตั้งแต่ตอนนี้เป็นต้นไป",
+      "snippetsLabel": "ตัวอย่างคำขอ",
+      "sendTest": "ส่งคำขอทดสอบ",
+      "sendTestHint": "ตรวจสอบข้อมูลรับรองและแสดงสิ่งที่ขั้นตอนของคุณจะได้รับ ไม่มีการเริ่มการทำงาน และไม่มีการเรียกปลายทาง",
+      "sendTestHintPaused": "ตรวจสอบข้อมูลรับรอง เวิร์กโฟลว์ถูกหยุดชั่วคราว การเรียกจึงถูกปฏิเสธก่อนสร้างอินพุตใด ๆ; เรียกใช้การทดสอบเพื่อรันขั้นตอน",
+      "sendTestSigned": "เบราว์เซอร์ไม่สามารถลงนามคำขอได้ จึงควรทดสอบด้วยตัวอย่างคำขอด้านบน เพิ่ม ?dry_run=true ใน URL เพื่อตรวจสอบลายเซ็นโดยไม่เริ่มการทำงาน",
+      "dryRunAccepted": "ยอมรับ dry run แล้ว",
+      "dryRunMeta": "ข้อมูลรับรองถูกต้อง · เนื้อหาคำขอ {size}",
+      "dryRunInput": "อินพุตที่ขั้นตอนของคุณจะได้รับ",
+      "dryRunRefused": "ข้อมูลรับรองถูกต้อง คำขอจะถูกปฏิเสธจนกว่าเวิร์กโฟลว์จะเผยแพร่",
+      "dryRunRefusedPaused": "ข้อมูลรับรองถูกต้อง คำขอจะถูกปฏิเสธขณะเวิร์กโฟลว์ถูกหยุดชั่วคราว",
+      "dryRunRateLimited": "ถูกจำกัดอัตรา — dry run นับรวมในขีดจำกัด",
+      "dryRunStatus": "คำขอถูกปฏิเสธด้วยสถานะ {status}",
+      "dryRunFailed": "ส่งคำขอทดสอบไม่สำเร็จ {reason}",
+      "runTestInstead": "เรียกใช้การทดสอบแทน",
+      "done": "เสร็จสิ้น",
+      "regionTag": "ภูมิภาค {name}",
+      "regionBanner": "ส่งทุกคำขอ และทุกครั้งที่ลองใหม่ ไปยังโฮสต์ของภูมิภาคนี้ คีย์ Idempotency และสถานะการทำงาน ({field}) จะถูกเก็บไว้ในภูมิภาคที่ยอมรับการเรียก ดังนั้นการลองใหม่ที่ส่งไปยังภูมิภาคอื่นอาจเริ่มการทำงานครั้งที่สอง",
+      "authLabel": "ผู้เรียกใช้ยืนยันตัวตนด้วย",
+      "authToken": "โทเค็น",
+      "authSigned": "คำขอที่ลงนามแล้ว",
+      "authAbout": "เกี่ยวกับการยืนยันตัวตน",
+      "authInfo": "โทเค็น: ส่งโทเค็นในเฮดเดอร์ Authorization คำขอที่ลงนามแล้ว: ลงนามทุกคำขอด้วยรหัสลับที่ใช้ร่วมกัน (เฮดเดอร์: {headers})",
+      "switchToSignedTitle": "เปลี่ยนไปใช้คำขอที่ลงนามแล้วหรือไม่",
+      "switchToSignedBody": "การเปลี่ยนจะเพิกถอนโทเค็นปัจจุบันทันทีและสร้างรหัสลับสำหรับลงนาม ผู้เรียกใช้ที่ใช้โทเค็นจะเริ่มได้รับ 401",
+      "switchToTokenTitle": "สลับไปใช้โทเค็นหรือไม่",
+      "switchToTokenBody": "การสลับจะเพิกถอนซีเคร็ตสำหรับลงนามปัจจุบันทันทีและสร้างโทเค็น ผู้เรียกที่ลงนามในคำขอจะเริ่มได้รับ 401",
+      "tokensTitle": "โทเค็น",
+      "secretsTitle": "ซีเคร็ตสำหรับลงนาม",
+      "colToken": "โทเค็น",
+      "colSecret": "ซีเคร็ต",
+      "colCreated": "สร้างเมื่อ",
+      "colLastUsed": "ใช้งานล่าสุด",
+      "colStatus": "สถานะ",
+      "colActions": "การดำเนินการ",
+      "never": "ไม่เคย",
+      "active": "ใช้งานอยู่",
+      "retiring": "กำลังเลิกใช้",
+      "creatorGone": "ผู้สร้างไม่ได้อยู่ในองค์กรนี้แล้ว",
+      "revoke": "เพิกถอน",
+      "revokeNow": "เพิกถอนตอนนี้",
+      "revokeTitle": "เพิกถอน {prefix} หรือไม่ ผู้เรียกที่ใช้โทเค็นนี้จะได้รับ 401 ทันที",
+      "revokeFailed": "ไม่สามารถเพิกถอนได้ {reason}",
+      "copyToken": "คัดลอกโทเค็น",
+      "copySecret": "คัดลอกซีเคร็ต",
+      "tokenCopied": "คัดลอกโทเค็นแล้ว",
+      "commandCopied": "คัดลอกคำสั่งแล้ว",
+      "secretCopied": "คัดลอกซีเคร็ตแล้ว",
+      "revealFailed": "ไม่สามารถแสดงโทเค็นได้ {reason}",
+      "revealFailedSigned": "ไม่สามารถแสดงซีเคร็ตได้ {reason}",
+      "revealDenied": "เฉพาะผู้ดูแลระบบเท่านั้นที่แสดงหรือคัดลอกโทเค็นสำหรับเอ็นด์พอยต์นี้ได้",
+      "runTest": "เรียกใช้การทดสอบ",
+      "rotate": "หมุนเวียน",
+      "rotateBlocked": "เพิกถอนโทเค็นที่กำลังเลิกใช้ก่อน",
+      "rotateBlockedSigned": "เพิกถอนซีเคร็ตที่กำลังเลิกใช้ก่อน",
+      "rotateTitle": "หมุนเวียนโทเค็น",
+      "rotateTitleSigned": "หมุนเวียนซีเคร็ตสำหรับลงนาม",
+      "rotateLead": "โทเค็นใหม่จะถูกสร้างขึ้นตอนนี้ โดยให้ {prefix} (ใช้งานล่าสุด {time}) ยังคงใช้งานได้อีก",
+      "rotateLeadSigned": "ซีเคร็ตสำหรับลงนามใหม่จะถูกสร้างขึ้นตอนนี้ โดยให้ {prefix} (ใช้งานล่าสุด {time}) ยังคงใช้งานได้อีก",
+      "overlapNow": "เพิกถอนทันที",
+      "overlapHour": "1 ชั่วโมง",
+      "overlapDay": "24 ชั่วโมง",
+      "overlapWeek": "7 วัน",
+      "rotateConsequence": "ผู้เรียกที่ใช้โทเค็นปัจจุบันจะยังใช้งานได้จนถึง {time} โปรดอัปเดตก่อนถึงเวลานั้น",
+      "rotateConsequenceSigned": "ผู้เรียกที่ลงนามด้วยซีเคร็ตปัจจุบันจะยังใช้งานได้จนถึง {time} โปรดอัปเดตก่อนถึงเวลานั้น",
+      "rotateConsequenceNow": "ผู้เรียกที่ใช้โทเค็นปัจจุบันจะได้รับ 401 ตั้งแต่บัดนี้เป็นต้นไป",
+      "rotateConsequenceNowSigned": "ผู้เรียกที่ลงนามด้วยซีเคร็ตปัจจุบันจะได้รับ 401 ตั้งแต่บัดนี้เป็นต้นไป",
+      "rotateConfirm": "หมุนเวียนโทเค็น",
+      "rotateConfirmSigned": "หมุนเวียนซีเคร็ตสำหรับลงนาม",
+      "rotateFailed": "ไม่สามารถหมุนเวียนได้ {reason}",
+      "advanced": "ขั้นสูง",
+      "advancedSummary": "ขนาดบอดีสูงสุด {size} · {count} คำขอต่อนาที | ขนาดบอดีสูงสุด {size} · {count} คำขอต่อนาที",
+      "maxBody": "ขนาดบอดีสูงสุด (KiB)",
+      "maxBodyHint": "สูงสุด 1024 (1 MiB) และสามารถลดได้เท่านั้น",
+      "maxBodyRange": "ป้อนจำนวนเต็มตั้งแต่ 1 ถึง 1024",
+      "rateLimit": "จำนวนคำขอต่อนาที",
+      "rateLimitHint": "สูงสุด {org} ต่อนาทีสำหรับองค์กรนี้",
+      "rateLimitRange": "ป้อนจำนวนเต็มตั้งแต่ 1 ถึง {org}",
+      "saveLimitsFailed": "ไม่สามารถบันทึกขีดจำกัดได้ {reason}",
+      "deleteMeta": "ลบ URL และโทเค็นหรือซีเคร็ตทั้งหมด",
+      "deleteButton": "ลบปลายทาง",
+      "deleteTitle": "ลบปลายทางนี้หรือไม่?",
+      "deleteBody": "URL จะหยุดทำงานทันที ผู้เรียกจะได้รับ 401 โทเค็นและซีเคร็ตการลงนามทั้งหมดจะถูกลบและไม่สามารถกู้คืนได้ ประวัติการทำงานจะยังคงอยู่",
+      "deleteFailed": "ไม่สามารถลบปลายทางได้ {reason}",
+      "secretStorageWarning": "เซิร์ฟเวอร์นี้ไม่มีคีย์หลักสำหรับการเข้ารหัส ดังนั้นโทเค็นและซีเคร็ตการลงนามจึงถูกจัดเก็บในรูปแบบที่ผู้มีสิทธิ์เข้าถึงฐานข้อมูลสามารถอ่านได้ โปรดขอให้ผู้ดูแลระบบตั้งค่าคีย์หลัก",
+      "rejectionsLine": "คำขอประมาณ {count} รายการถูกปฏิเสธใน 24 ชม. ที่ผ่านมา · ล่าสุด: {reason}, {time} | คำขอประมาณ {count} รายการถูกปฏิเสธใน 24 ชม. ที่ผ่านมา · ล่าสุด: {reason}, {time}",
+      "rejectionsShow": "แสดง",
+      "rejectionsHide": "ซ่อน",
+      "rejectionsTitle": "การปฏิเสธล่าสุด",
+      "rejectionsCaption": "ประมาณ {count} รายการใน 24 ชม. ที่ผ่านมา · ผู้เรียกเห็นเพียงรหัสสถานะ | ประมาณ {count} รายการใน 24 ชม. ที่ผ่านมา · ผู้เรียกเห็นเพียงรหัสสถานะ",
+      "rejectionMeta": "ประมาณ {count} · ล่าสุด {time} · จาก {ip} | ประมาณ {count} · ล่าสุด {time} · จาก {ip}",
+      "rejectionsLoadError": "ไม่สามารถโหลดข้อมูลการปฏิเสธได้",
+      "raiseLimit": "เพิ่มขีดจำกัด",
+      "rotateLink": "หมุนเวียน",
+      "reason": {
+        "invalid_token": {
+          "title": "โทเค็นไม่ถูกต้อง",
+          "fix": "ผู้เรียกส่งโทเค็นที่ถูกเพิกถอน หมดอายุ หรือพิมพ์ผิด โปรดแสดงหรือคัดลอกโทเค็นปัจจุบันจากตารางโทเค็น"
+        },
+        "invalid_signature": {
+          "title": "ลายเซ็นไม่ถูกต้อง",
+          "fix": "ผู้เรียกใช้ซีเคร็ตเก่าหรือไม่ถูกต้องในการลงนาม ตรวจสอบว่าใช้ซีเคร็ตปัจจุบันและลงนาม {format} ให้ตรงตามที่ส่งมาทุกประการ"
+        },
+        "stale_timestamp": {
+          "title": "การประทับเวลาเก่าเกินไป",
+          "fix": "นาฬิกาของผู้เรียกคลาดเคลื่อนเกิน 5 นาที โปรดซิงค์นาฬิกาและลงนามก่อนส่งทันที"
+        },
+        "endpoint_disabled": {
+          "title": "ปลายทางปิดอยู่",
+          "fix": "เปิดใช้งานปลายทาง"
+        },
+        "workflow_disabled": {
+          "title": "เวิร์กโฟลว์หยุดชั่วคราว",
+          "fix": "ดำเนินการเวิร์กโฟลว์ต่อจากรายการ"
+        },
+        "workflow_not_published": {
+          "title": "เวิร์กโฟลว์ยังไม่ได้เผยแพร่",
+          "fix": "เผยแพร่เวิร์กโฟลว์ ฉบับร่างจะปฏิเสธคำขอ"
+        },
+        "payload_too_large": {
+          "title": "เพย์โหลดใหญ่เกินไป",
+          "fix": "เกิน {size} โปรดส่งข้อมูลให้น้อยลง หรือแบ่งเหตุการณ์ออกเป็นหลายคำขอ"
+        },
+        "credential_in_url": {
+          "title": "ข้อมูลรับรองใน URL",
+          "fix": "มีการส่งโทเค็นหรือซีเคร็ตใน URL และถูกปฏิเสธ URL มักไปอยู่ในล็อกของพร็อกซีและเบราว์เซอร์ ดังนั้นโปรดหมุนเวียนโทเค็นหรือซีเคร็ตนั้นทันที แล้วส่งผ่านส่วนหัวแทน"
+        },
+        "invalid_idempotency_key": {
+          "title": "คีย์ idempotency ไม่ถูกต้อง",
+          "fix": "ส่วนหัว Idempotency-Key ว่างเปล่าหรือยาวเกิน 255 ตัวอักษร"
+        },
+        "idempotency_key_reused": {
+          "title": "ใช้คีย์ idempotency ซ้ำ",
+          "fix": "คีย์เดิมมาพร้อมเนื้อหาที่แตกต่างกัน โปรดใช้คีย์ใหม่สำหรับแต่ละเหตุการณ์ที่แตกต่างกัน"
+        },
+        "rate_limited": {
+          "title": "ถูกจำกัดอัตรา",
+          "fix": "มีคำขอเกิน {count} รายการต่อนาที โปรดรวมเหตุการณ์เป็นคำขอเดียว (ส่งเป็นอาร์เรย์ JSON) หรือเพิ่มขีดจำกัด — สูงสุด {org} ต่อนาทีสำหรับองค์กรนี้"
+        },
+        "queue_full": {
+          "title": "คิวเต็ม",
+          "fix": "องค์กรนี้มีการทำงาน HTTP ที่รออยู่แล้ว {count} รายการ ผู้เรียกควรลองใหม่หลังระยะเวลาตาม Retry-After ตรวจหาขั้นตอนที่ทำงานช้าหรือลดอัตราการส่ง"
+        },
+        "worker_unavailable": {
+          "title": "ไม่มีเวิร์กเกอร์พร้อมใช้งาน",
+          "fix": "ไม่มีเวิร์กเกอร์เวิร์กโฟลว์ทำงานในภูมิภาคนี้ จึงไม่มีรายการใดถูกเข้าคิว ผู้เรียกที่ลองใหม่หลังระยะเวลาตาม Retry-After จะผ่านได้เมื่อเวิร์กเกอร์กลับมา หากยังเกิดขึ้นซ้ำ โปรดขอให้ผู้ดูแลระบบตรวจสอบเวิร์กเกอร์เวิร์กโฟลว์"
+        }
+      },
+      "nodeBadge": "เรียกใช้ได้ผ่าน HTTP",
+      "triggerLinkOn": "ทำงานเมื่อมีคำขอ HTTP ด้วย",
+      "triggerLinkOnAction": "จัดการปลายทาง",
+      "triggerLinkOff": "เริ่มจากระบบอื่นได้ด้วย",
+      "triggerLinkOffAction": "ตั้งค่าปลายทาง HTTP",
+      "pickerCue": "เวิร์กโฟลว์ใดก็เริ่มได้ด้วยคำขอ HTTP เช่นกัน เลือกทริกเกอร์ของเวิร์กโฟลว์ แล้วใช้ HTTP endpoint ในแถบเครื่องมือ",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP endpoint เปิดอยู่",
+      "listMenuItem": "HTTP endpoint…",
+      "copyUrl": "คัดลอก URL ของ endpoint",
+      "copyUrlDraftHint": "คำขอจะถูกปฏิเสธจนกว่าคุณจะเผยแพร่",
+      "copyUrlFailed": "ไม่สามารถคัดลอก URL ของ endpoint ได้ {reason}",
+      "payloadFrom": "เพย์โหลดจาก",
+      "payloadHttp": "คำขอ HTTP",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "หมดอายุใน {count} ชม. | หมดอายุใน {count} ชม.",
+      "expiresInDays": "หมดอายุใน {count} วัน | หมดอายุใน {count} วัน",
+      "expired": "หมดอายุแล้ว",
+      "rotateLeadUnused": "จะมีการสร้างโทเค็นใหม่ตอนนี้ โดยเก็บ {prefix} (ยังไม่เคยใช้) ให้ใช้งานได้เป็นเวลา",
+      "rotateLeadUnusedSigned": "จะมีการสร้างข้อมูลลับสำหรับลงนามใหม่ตอนนี้ โดยเก็บ {prefix} (ยังไม่เคยใช้) ให้ใช้งานได้เป็นเวลา",
+      "fieldGroup": "คำขอ HTTP",
+      "fieldGroupBodyHint": "ฟิลด์ภายใน body ของคำขอต้องมีขั้นตอนฟังก์ชันก่อน",
+      "fieldGroupQueryHint": "พารามิเตอร์คิวรีคือ meta.query.<key>; คีย์ที่ซ้ำกันจะมาเป็นลิสต์และจะไม่ตรงกันเลย",
+      "rotateLeadNone": "ยังไม่มีโทเค็นที่ใช้งานอยู่ ผู้เรียกจึงยืนยันตัวตนไม่ได้ จะมีการสร้างโทเค็นใหม่ตอนนี้",
+      "rotateLeadNoneSigned": "ยังไม่มีข้อมูลลับสำหรับลงนามที่ใช้งานอยู่ ผู้เรียกจึงยืนยันตัวตนไม่ได้ จะมีการสร้างข้อมูลลับสำหรับลงนามใหม่ตอนนี้",
+      "createForbidden": "คุณไม่สามารถสร้างข้อมูลรับรองของ endpoint ในองค์กรนี้ได้",
+      "errorNotConfigured": "เวิร์กโฟลว์นี้ไม่มี HTTP endpoint",
+      "errorNoLiveCredential": "ไม่มีข้อมูลรับรองที่ใช้งานอยู่ กดหมุนเวียนเพื่อสร้างใหม่",
+      "errorNotAllowed": "คุณไม่มีสิทธิ์ดำเนินการนี้",
+      "copyCredentialChanged": "ข้อมูลรับรองมีการเปลี่ยนแปลง คัดลอกอีกครั้ง",
+      "copyCommandFailed": "ไม่สามารถคัดลอกคำสั่งได้ {reason}",
+      "exampleRequest": "ตัวอย่างคำขอ",
+      "exampleActiveToken": "โทเค็นที่ใช้งานอยู่ · {prefix}",
+      "exampleActiveSecret": "ข้อมูลลับที่ใช้งานอยู่ · {prefix}",
+      "exampleHintToken": "การคัดลอกรวมโทเค็นไว้ด้วย วางในเทอร์มินัล หรือนำเข้าใน Postman หรือ Insomnia (Import → Raw text)",
+      "exampleHintSigned": "เรียกใช้ใน bash: จะลงนามด้วย openssl แล้วเรียก curl การคัดลอกรวมข้อมูลลับไว้ด้วย เครื่องมือนำเข้าไม่สามารถลงนามได้",
+      "exampleHintTokenPlaceholder": "การคัดลอกมีตัวยึดตำแหน่งตรงที่ใส่โทเค็น วางในเทอร์มินัล หรือนำเข้าใน Postman หรือ Insomnia (Import → Raw text)",
+      "exampleHintSignedPlaceholder": "เรียกใช้ใน bash: จะลงนามด้วย openssl แล้วเรียก curl การคัดลอกมีตัวยึดตำแหน่งตรงที่ใส่ข้อมูลลับ เครื่องมือนำเข้าไม่สามารถลงนามได้"
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Click",
       "viewDocsLinkLabel": "here",
       "viewDocsSuffix": "to check further documentation.",
-      "selectIntegrationPrompt": "Select an integration to view details."
+      "selectIntegrationPrompt": "Select an integration to view details.",
+      "codingAgent": {
+        "tabAgent": "ใช้ coding agent",
+        "tabSteps": "ทีละขั้นตอน",
+        "streamLabel": "ชื่อสตรีมเทรซ",
+        "streamHelp": "เอเจนต์จะเขียนเทรซลงในสตรีมนี้และตรวจสอบ",
+        "envTitle": "ดาวน์โหลด .env ของคุณ",
+        "envHelp": "บันทึกไว้ที่รากของโปรเจกต์ สกิลจะอ่านโทเค็นจากไฟล์นี้ โทเค็นจึงไม่ถูกส่งเข้าแชต",
+        "envButton": "ดาวน์โหลด .env",
+        "promptTitle": "วางข้อความนี้ใน {client1}, {client2} หรือ {client3}",
+        "promptLabel": "พรอมต์",
+        "promptCopied": "คัดลอกพรอมต์แล้ว"
+      }
     },
     "header": "Data sources",
     "resetRUMTokenLabel": "Reset RUM Token",
@@ -7670,6 +7995,15 @@
     "queryValues": "Query Values",
     "constant": "Constant",
     "textbox": "Textbox",
+    "date": "วันที่",
+    "dateFormat": "รูปแบบวันที่ของเอาต์พุต",
+    "dateFormatHelp": "ค่าเริ่มต้นของเอาต์พุตในคิวรี แทนที่เฉพาะจุดได้ด้วย ${'{'}name:format{'}'} เช่น ${'{'}name:epochus{'}'}",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "วินาทีแบบ epoch (epoch)",
+    "dateFormatEpochms": "มิลลิวินาทีแบบ Epoch (epochms)",
+    "dateFormatEpochus": "ไมโครวินาทีแบบ Epoch (epochus)",
     "newFolder": "New Folder",
     "updateFolder": "Update Folder",
     "newReport": "New Report",
@@ -8778,6 +9112,8 @@
       "addAnnotations": "Add Annotations",
       "dependentAdhocVariableWarning": "Some dynamic variables are not applied because the field is not present in the query's stream. Open Query Inspector to see all the details of the variables and queries executed to render this panel",
       "refreshCacheReload": "Refresh Cache & Reload",
+      "exploreCreateAlert": "สร้างการแจ้งเตือน",
+      "exploreAddToDashboard": "เพิ่มไปยังแดชบอร์ด",
       "redirectingToLogs": "Redirecting to logs page",
       "pleaseWait": "Please wait..."
     },
@@ -9339,11 +9675,18 @@
       "constant": "Constant",
       "textbox": "Text box",
       "custom": "Custom",
+      "date": "วันที่",
       "list": "{type} · {example}",
       "csv": "Commas: {example}",
       "pipe": "Pipes: {example}",
       "doublequote": "Double quotes: {example}",
-      "singlequote": "Single quotes: {example}"
+      "singlequote": "Single quotes: {example}",
+      "dateIso": "วันที่ (YYYY-MM-DD): {example}",
+      "dateDmy": "รูปแบบวันที่ขึ้นต้นด้วยวัน (DD/MM/YYYY): {example}",
+      "dateMdy": "รูปแบบวันที่ขึ้นต้นด้วยเดือน (MM/DD/YYYY): {example}",
+      "dateEpoch": "วินาทีแบบ Epoch: {example}",
+      "dateEpochms": "มิลลิวินาทีแบบ Epoch: {example}",
+      "dateEpochus": "ไมโครวินาทีแบบ Epoch: {example}"
     },
     "add": "Add Panel",
     "save": "บันทึก",
@@ -11501,6 +11844,7 @@
         "badgeAcknowledged": "Acknowledged",
         "badgeResolved": "Resolved",
         "badgeReopened": "Reopened",
+        "badgeAckEnded": "สิ้นสุดการรับทราบ",
         "badgeDimensionsUpgraded": "Dimensions Upgraded",
         "badgeTitleChanged": "Title Changed",
         "badgeAssignment": "Assignment",
@@ -11512,6 +11856,7 @@
         "badgeAiNeedsInput": "AI needs input",
         "incidentWas": "Incident was",
         "theIncident": "the incident",
+        "ackEndedByPageResolve": "โดยการแก้ไขรายการเรียกเวรหนึ่งรายการ",
         "unnamedAlert": "alert",
         "alertTriggered": "{alert} triggered | {alert} triggered {count} times",
         "severityUpgraded": "Severity upgraded from {from} to {to}",
@@ -12459,6 +12804,13 @@
         "rumfunnel": {
           "label": "Alert me",
           "toast": "Imported from Product Analytics: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "สร้างการแจ้งเตือน",
+          "toast": "นำเข้าคิวรีจากการค้นหาเทรซของคุณ",
+          "noStream": "เลือกสตรีมก่อน",
+          "errorCount": "จำนวนข้อผิดพลาด",
+          "errorRate": "อัตราข้อผิดพลาด"
         }
       },
       "warnings": {
@@ -12492,7 +12844,21 @@
         "heldFilterDropped": "Your search filter was not carried over because it needs a Run as choice on the logs page first. Add it to the alert query if you need it.",
         "thresholdColumnGuessed": "The threshold was applied to {column}; check it is the value you meant.",
         "thresholdNotCarried": "The {value} threshold from the chart wasn't applied because you picked a different query.",
-        "rumFunnelExclusions": "Uses this app's app filters as of now; re-create it after they change."
+        "rumFunnelExclusions": "Uses this app's app filters as of now; re-create it after they change.",
+        "tracesSeedMatches": "จะแจ้งเตือนเมื่อสแปนที่ตรงกันในช่วง {minutes} นาทีมีจำนวนเกิน {threshold} (ขณะนี้ {current})",
+        "tracesSeedSpans": "จะแจ้งเตือนเมื่อจำนวนสแปนในช่วง {minutes} นาทีเกิน {threshold} (ขณะนี้ {current})",
+        "tracesSeedTraces": "จะแจ้งเตือนเมื่อจำนวนเทรซในช่วง {minutes} นาทีเกิน {threshold} (ขณะนี้ {current})",
+        "tracesSeedErrorSpans": "จะแจ้งเตือนเมื่อจำนวนสแปนที่เกิดข้อผิดพลาดในช่วง {minutes} นาทีเกิน {threshold} (ขณะนี้ {current})",
+        "tracesSeedErrorTraces": "จะแจ้งเตือนเมื่อจำนวนเทรซที่มีข้อผิดพลาดในช่วง {minutes} นาทีเกิน {threshold} (ขณะนี้ {current})",
+        "tracesSeedErrorRatio": "จะแจ้งเตือนเมื่ออัตราข้อผิดพลาดในช่วง {minutes} นาทีเกิน {threshold}% (ขณะนี้ {current}%)",
+        "tracesErrorRatioMinSpans": "จะตรวจสอบเฉพาะหน้าต่างเวลาที่มีสแปนอย่างน้อย {minimum} สแปน เพื่อป้องกันไม่ให้ความล้มเหลวเพียงเล็กน้อยในช่วงที่ไม่มีกิจกรรมทำให้เกิดการแจ้งเตือน",
+        "tracesErrorRatioMinTraces": "จะตรวจสอบเฉพาะหน้าต่างเวลาที่มีเทรซอย่างน้อย {minimum} เทรซ เพื่อป้องกันไม่ให้ความล้มเหลวเพียงเล็กน้อยในช่วงที่ไม่มีกิจกรรมทำให้เกิดการแจ้งเตือน",
+        "tracesSeedDuration": "จะแจ้งเตือนเมื่อระยะเวลา {percentile} ในช่วง {minutes} นาทีสูงกว่า {threshold} ms (ขณะนี้ {current} ms)",
+        "tracesSeedUnavailable": "ไม่สามารถอ่านค่าปัจจุบันได้ จึงเริ่มเกณฑ์ที่ 0 โปรดตั้งค่าก่อนบันทึก",
+        "tracesNoMatches": "ยังไม่มีสแปนที่ตรงกัน ดังนั้นการแจ้งเตือนจะเริ่มทำงานทันทีเมื่อมีสแปนปรากฏขึ้น",
+        "tracesStoredSpans": "การนับอ้างอิงจากสแปนที่จัดเก็บไว้ จึงทำให้ปริมาณทราฟฟิกที่ถูกสุ่มตัวอย่างดูต่ำกว่าความเป็นจริง",
+        "tracesPeriodCapped": "หน้าต่างการแจ้งเตือนถูกจำกัดไว้ที่ {minutes} นาที เพื่อให้การตรวจสอบแต่ละครั้งรวดเร็ว",
+        "tracesNotRun": "ยังไม่ได้รันการค้นหานี้ การแจ้งเตือนจึงใช้ตัวกรองในตัวแก้ไข"
       }
     },
     "saveFailed": "Could not save the alert.",
@@ -13904,6 +14270,8 @@
       "noMatch": "No metrics match the current filters",
       "noMatchHint": "Try removing a label filter, clearing prefix/suffix selections, or switching from “With data” to “All”.",
       "noMatchHintFavorites": "Try removing a label filter, or switching from “With data” to “All”.",
+      "noMatchYet": "ยังไม่พบเมทริกซ์ที่มีข้อมูล",
+      "noMatchYetHint": "เมทริกซ์ที่ตรวจสอบไปแล้วยังไม่พบข้อมูล กดแสดงเพิ่มเติมเพื่อค้นหาต่อ",
       "clearAllFilters": "Clear all filters",
       "emptyActions": {
         "clearSearch": "Clear search",
@@ -14120,7 +14488,8 @@
       "panelAdded": "Panel added to dashboard",
       "errorAddingPanel": "Error while adding panel",
       "selectDashboard": "Please select a dashboard",
-      "selectTab": "Please select a tab"
+      "selectTab": "Please select a tab",
+      "panelsToAdd": "พาเนลที่จะเพิ่ม"
     },
     "groups": {
       "compute": "Compute",
@@ -15168,6 +15537,24 @@
     "searchTypeOthers": "Others"
   },
   "traces": {
+    "nlNeedsSql": "คำถามนี้ต้องใช้ SQL โปรดเปิดในล็อก",
+    "redActions": {
+      "menuGroupDashboards": "แดชบอร์ด",
+      "addRedToDashboard": "เพิ่มแผนภูมิ RED ไปยังแดชบอร์ด",
+      "durationActions": "การดำเนินการเกี่ยวกับระยะเวลา",
+      "bucketNotice": {
+        "seconds": "แผนภูมิเหล่านี้จะคงแท่งข้อมูลทุก {count} วินาทีเหมือนที่เห็นตอนนี้",
+        "minutes": "แผนภูมิเหล่านี้จะคงแท่งข้อมูลทุก {count} นาทีเหมือนที่เห็นตอนนี้",
+        "hours": "แผนภูมิเหล่านี้จะคงแท่งข้อมูลทุก {count} ชั่วโมงเหมือนที่เห็นตอนนี้",
+        "days": "แผนภูมิเหล่านี้จะคงแท่งข้อมูลทุก {count} วันเหมือนที่เห็นตอนนี้"
+      },
+      "bucketNoticeSingle": {
+        "seconds": "แผนภูมินี้จะคงแท่งข้อมูลทุก {count} วินาทีเหมือนที่เห็นตอนนี้",
+        "minutes": "แผนภูมินี้จะคงแท่งข้อมูลทุก {count} นาทีเหมือนที่เห็นตอนนี้",
+        "hours": "แผนภูมินี้จะคงแท่งข้อมูลทุก {count} ชั่วโมงเหมือนที่เห็นตอนนี้",
+        "days": "แผนภูมินี้จะคงแท่งข้อมูลทุก {count} วันเหมือนที่เห็นตอนนี้"
+      }
+    },
     "latencyHeatmap": {
       "title": "ระยะเวลา",
       "tooltipSpans": "{count} span | {count} spans",
@@ -15394,6 +15781,13 @@
     "nextMatch": "Next match",
     "searchInSpans": "Search in spans",
     "criticalPath": "Critical path",
+    "askAi": {
+      "explainTrace": "อธิบายเทรซ",
+      "explainTraceHint": "สอบถาม AI เกี่ยวกับสแปนที่ช้าที่สุดบนเส้นทางวิกฤตและสแปนที่เกิดข้อผิดพลาดทั้งหมด",
+      "askAboutSpan": "สอบถาม AI เกี่ยวกับสแปนนี้",
+      "spanChip": "สแปน · {operation}",
+      "traceChip": "เทรซ · {operation}"
+    },
     "spansTableView": "Spans Table View",
     "comingSoon": "Coming soon...",
     "fetchingTrace": "Fetching your trace.",
@@ -15496,7 +15890,7 @@
         "filterErrors": "Filter Errors",
         "resetFilters": "Reset Filters",
         "errorsNone": "No Errors · {total} Turns",
-        "latencyLead": "Slowest {slowest} ·",
+        "latencyLead": "รอบเฉลี่ย {avg} · ช้าที่สุด {slowest} ·",
         "costLead": "Peak {peak} ·",
         "tokens": "{ratio}% Cached",
         "cacheImpact": "{ratio}% Reused · {tokens} Tok Read",
@@ -15672,6 +16066,7 @@
     "lLMErrorTable": {
       "noData": "ไม่มีข้อมูล",
       "noErrorsInRange": "No errors in this time range",
+      "loadFailed": "ไม่สามารถโหลดข้อผิดพลาดล่าสุด",
       "time": "เวลา",
       "service": "Service",
       "operation": "Operation",
@@ -16643,7 +17038,51 @@
     "tierAlwaysActive": "Always active (default)",
     "testAtTimeLabel": "Test at UTC time",
     "testAtTimeHint": "Leave empty to use the current time. Peak / off-peak tiers resolve against this time.",
-    "localTimeHint": "In your timezone: {range}"
+    "localTimeHint": "In your timezone: {range}",
+    "builtInStatus": {
+      "seed": "ราคาที่มีมาให้: รายการเริ่มต้นที่มาพร้อมกับเวอร์ชันนี้ ลงวันที่ {date}",
+      "neverSynced": "การซิงค์ออนไลน์ยังไม่ได้ทำงานตั้งแต่เซิร์ฟเวอร์เริ่มทำงาน",
+      "lastSynced": "ซิงค์ออนไลน์ล่าสุดเมื่อ {time}"
+    },
+    "unpriced": {
+      "title": "ช่องว่างของราคา",
+      "subtitle": "โมเดลในเทรซ LLM ของคุณที่ไม่มีราคา หรือมีเพียงราคาประมาณ ในขณะนำเข้าข้อมูล",
+      "banner": "{count} โมเดลไม่มีราคาหรือมีเพียงราคาประมาณในขณะนำเข้าข้อมูล ค่าใช้จ่ายที่บันทึกไว้อาจไม่สมบูรณ์ | {count} โมเดลไม่มีราคาหรือมีเพียงราคาประมาณในขณะนำเข้าข้อมูล ค่าใช้จ่ายที่บันทึกไว้อาจไม่สมบูรณ์",
+      "bannerTruncated": "มี {total} โมเดลในเทรซของคุณที่ไม่มีราคาหรือมีเพียงราคาประมาณในขณะนำเข้าข้อมูล ค่าใช้จ่ายอาจไม่ถูกต้อง แสดง {shown} อันดับสูงสุดตามจำนวนโทเค็น",
+      "streamLabel": "สตรีม",
+      "window": "24 ชั่วโมงที่ผ่านมา",
+      "windowRange": "{from} – {to}",
+      "colModel": "โมเดลที่พบในเทรซ",
+      "colPricedAs": "คิดราคาเป็น",
+      "colTokens": "โทเค็น",
+      "colCost": "ค่าใช้จ่ายที่บันทึกไว้",
+      "colActions": "การดำเนินการ",
+      "spans": "{count} สแปน | {count} สแปน",
+      "moreAgents": "+{count} รายการ",
+      "noMatch": "ไม่พบรายการที่ตรงกัน",
+      "approximate": "ประมาณ",
+      "pricedNow": "คิดราคาสำหรับสแปนใหม่",
+      "historicalGap": "ช่วงเวลานี้ยังคงช่องว่างราคาที่บันทึกไว้ สแปนใหม่จะใช้ราคาปัจจุบัน",
+      "noActionNeeded": "ไม่ต้องดำเนินการ",
+      "defaultTierPrices": "ขาเข้า {input} / ขาออก {output} ต่อ 1M",
+      "notPriced": "ยังไม่คิดราคา",
+      "createPrice": "สร้างราคา",
+      "keepPrices": "ใช้ราคาของ {name} ต่อไป",
+      "mute": "ปิดเสียงแจ้งเตือน",
+      "muteConfirmTitle": "ปิดเสียงแจ้งเตือนสำหรับโมเดลนี้หรือไม่?",
+      "muteConfirmMessage": "สแปนใหม่ของ {model} จะถูกคิดราคาเป็นฟรี สแปนเก่ายังคงค่าใช้จ่ายที่บันทึกไว้ ลบราคา \"{name}\" เพื่อเปิดเสียงแจ้งเตือนอีกครั้ง",
+      "mutedNotif": "ปิดเสียงแจ้งเตือน {model} แล้ว",
+      "keptNotif": "{model} ใช้ราคาของ {name} แล้ว",
+      "errSave": "บันทึกราคาไม่สำเร็จ",
+      "errLoad": "โหลดโมเดลที่ยังไม่คิดราคาไม่สำเร็จ",
+      "emptyTitle": "ไม่มีการใช้งานโมเดลที่ยังไม่คิดราคาหรือคิดราคาแบบประมาณที่บันทึกไว้ในสตรีมนี้ในช่วงเวลานี้",
+      "noStreamsTitle": "ไม่มีสตรีมเทรซ LLM",
+      "noStreamsDesc": "โมเดลจะแสดงที่นี่เมื่อมีสแปน gen_ai เข้าสู่สตรีมเทรซ",
+      "recordedCostNote": "ราคาใหม่จะมีผลกับสแปนที่นำเข้าหลังจากคุณบันทึก สแปนเก่ายังคงค่าใช้จ่ายที่บันทึกไว้",
+      "noModelName": "(ไม่มีชื่อโมเดล)",
+      "noModelHint": "ไม่มีโมเดลที่จะกำหนดราคา: ตั้งค่า gen_ai.request.model",
+      "instrumentationDocs": "คู่มือการทำ instrumentation"
+    }
   },
   "aiObservability": {
     "title": "AI Observability",
@@ -17236,6 +17675,8 @@
       "skipTiers": "Rows skipped: {full} fully · {partial} partially",
       "scoreEvidence": "{scorer} · v{version}: {samples} samples, {noReference} no reference, {noTrace} no trace",
       "scorerApplicability": "{scorer} · v{version}: {eligible} eligible slots, {noReference} without reference",
+      "costUnknown": "ไม่ทราบค่าใช้จ่าย",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Failed to load experiments",
       "previewError": "Failed to preview experiment slots",
       "createSuccess": "Experiment created",
@@ -17318,6 +17759,8 @@
         "costConfirmMessage": "This experiment is estimated to cost about {cost}, above the {threshold} warning threshold. Create and run it anyway?",
         "costConfirmMessageUnpriced": "This experiment is estimated to cost more than the warning threshold. Create and run it anyway?",
         "costConfirmOk": "Create Anyway",
+        "taskProviderFailed": "ไม่มีการสร้างรายการ ผู้ให้บริการงาน {provider} ไม่ตอบสนองต่อการเรียกทดสอบ",
+        "judgeProviderFailed": "ไม่มีการสร้างรายการ ผู้ให้บริการผู้ตัดสิน LLM {provider} ไม่ตอบสนองต่อการเรียกทดสอบ",
         "skippedFully": "{count} rows fully skipped — every selected scorer needs an expected output. Skipped rows cost nothing to run.",
         "skippedPartially": "{count} rows partially skipped — the task still runs, but reference-based scorers cannot score rows without an expected output.",
         "skippedNone": "Every matched row can be scored on at least one dimension.",
@@ -17406,7 +17849,26 @@
           "trials": "Trials",
           "dispersion": "Dispersion",
           "latency": "Latency",
-          "p50Latency": "P50 Latency"
+          "p50Latency": "P50 Latency",
+          "error": "ข้อผิดพลาด"
+        },
+        "failureBanner": {
+          "title": "{failed} จาก {total} สล็อตล้มเหลว: {cause}",
+          "cause": "สาเหตุอันดับสูงสุด, {count} ช่อง: {message}",
+          "moreCauses": "+ สาเหตุอื่นอีก {count} รายการ",
+          "noMessage": "ไม่มีการบันทึกข้อความข้อผิดพลาด",
+          "openProviders": "เปิดผู้ให้บริการ"
+        },
+        "failureKinds": {
+          "provider_auth": "ผู้ให้บริการปฏิเสธข้อมูลรับรอง",
+          "rate_limited": "ผู้ให้บริการจำกัดอัตราการทำงาน",
+          "timeout": "ผู้ให้บริการไม่ตอบกลับภายในเวลา",
+          "provider_5xx": "ผู้ให้บริการส่งคืนข้อผิดพลาดของเซิร์ฟเวอร์",
+          "parse_error": "ไม่สามารถแยกวิเคราะห์เอาต์พุตได้",
+          "mapping_error": "ไม่สามารถสร้างอินพุตของงานได้",
+          "scorer_missing": "ไม่มีตัวประเมินคะแนนนั้นอยู่แล้ว",
+          "execution_error": "การเรียกงานล้มเหลว",
+          "unknown": "การเรียกงานล้มเหลว"
         },
         "saveAsPrompt": "Save as Prompt",
         "openPrompt": "Open Prompt",
@@ -17687,7 +18149,11 @@
     "scope": {
       "env": "Env",
       "agent": "Agent",
-      "version": "Version"
+      "version": "Version",
+      "agentIdHint": "รหัสเอเจนต์: {ids}",
+      "noAgentIdentity": "ไม่พบข้อมูลระบุตัวตนของเอเจนต์",
+      "noAgentIdentityDescription": "สแปน LLM เหล่านี้ไม่มีชื่อเอเจนต์ จึงแสดงผลตามสตรีม แมปแอตทริบิวต์ที่ระบุชื่อเอเจนต์ของคุณเพื่อดูข้อมูลแยกตามเอเจนต์",
+      "noAgentIdentityAction": "เปิดการแมปเอเจนต์ GenAI"
     },
     "agentGraph": {
       "stream": "Stream",
@@ -18301,6 +18767,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "การประเมินถูกปิดใช้งานบนเซิร์ฟเวอร์นี้",
+      "description": "หน้านี้ต้องใช้การประเมินแบบออนไลน์ ซึ่งถูกปิดอยู่บนเซิร์ฟเวอร์นี้ โปรดขอให้ผู้ดูแลระบบเปิดใช้งาน"
+    },
     "traceScoreChip": {
       "reasoning": "Why",
       "noReasoning": "No reasoning recorded for this score.",
@@ -18547,7 +19017,7 @@
       "remoteCta": "Configure Endpoint"
     },
     "provider": {
-      "backTo": "Back to Providers",
+      "backTo": "ผู้ให้บริการ",
       "createTitle": "Create LLM Provider",
       "editTitle": "Edit LLM Provider",
       "subtitle": "Configure the model endpoint used by LLM judge scorers.",
@@ -18792,7 +19262,7 @@
           "duplicateName": "Scorer {index}: name \"{name}\" is used more than once in this import"
         }
       },
-      "backTo": "Back to Scorers",
+      "backTo": "ตัวประเมินคะแนน",
       "badgeRemote": "Remote",
       "badgeLlm": "LLM Judge",
       "createTitleRemote": "New Remote Scorer",
@@ -18823,6 +19293,9 @@
       "providerPlaceholder": "Select provider",
       "modelLabel": "Model",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "อุณหภูมิ",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 ถึง 2 เว้นว่างไว้เพื่อประเมินที่ 0",
       "promptLabel": "Judge prompt",
       "includeReasoningLabel": "Include Reasoning",
       "includeReasoningHint": "The judge explains why it gave that score, saved with each result.",
@@ -18896,6 +19369,7 @@
         "apiKeyHeaderRequired": "Header name is required",
         "apiKeyTokenRequired": "Token is required",
         "timeoutInvalid": "Timeout must be 0 or greater",
+        "temperatureInvalid": "อุณหภูมิต้องอยู่ระหว่าง 0 ถึง 2",
         "retriesInvalid": "Retries must be 0 or greater",
         "duplicateFieldName": "Field names must be unique"
       },
@@ -19002,6 +19476,7 @@
         "degraded": "Degraded",
         "waitingForCredentials": "Waiting for credentials",
         "noRecentRuns": "No recent runs",
+        "lastScored": "ประเมินคะแนนล่าสุด {time}",
         "summary": "{errors} of {runs} runs failed in the last 15 minutes",
         "since": "Entered this state {time}",
         "checked": "Last checked {time}"
@@ -19024,7 +19499,7 @@
       "samplingValuePreview": "Evaluates {percent}% of matched targets.",
       "samplingValueAllHelp": "Every matched target is evaluated.",
       "samplingHelp": "Runs after filtering, to control cost.",
-      "backTo": "Back to Eval Jobs",
+      "backTo": "งานประเมินผล",
       "createTitle": "New Eval Job",
       "editTitle": "Update Eval Job",
       "stepper": {
@@ -22445,7 +22920,8 @@
       "thisBranchAlreadyEndsInA": "This branch already ends in a Destination.",
       "chooseATriggerNodeToStart": "Choose a trigger node to start your workflow",
       "thisConnectionWouldCreateALoop": "This connection would create a loop",
-      "onlyOneIncomingConnectionToA": "Only one incoming connection to a step is allowed"
+      "onlyOneIncomingConnectionToA": "Only one incoming connection to a step is allowed",
+      "endpointUrlCopied": "คัดลอก URL ปลายทางแล้ว"
     },
     "views": {
       "youAreNotAuthorizedToManage": "You are not authorized to manage the license.",
@@ -24095,6 +24571,7 @@
     "databases": {
       "searchPlaceholder": "Search database or service…",
       "unnamedInstance": "Instance not named",
+      "schemaCount": "{count} สคีมา | {count} สคีมา",
       "unnamedInstanceHint": "The database's own statement reports prove this engine is running, but they don't name a host. The row will show an address once a feed that carries one — session sampling or instance metrics — is set up.",
       "moreServices": "+{count}",
       "columns": {
@@ -24282,6 +24759,7 @@
       "lineCountedTo": "Counted up to {time}; the last half-minute is still coming in.",
       "lineExact": "All databases reporting. Speeds here are measured across every call, so they're exact.",
       "lineExactEstimated": "All databases reporting. Speeds here are blended from several stretches of time, so they're close but not exact.",
+      "lineExactSlowestSchema": "ฐานข้อมูลทั้งหมดรายงานแล้ว ความเร็วเป็นค่าที่แน่นอนรายสคีมา ฐานข้อมูลที่มีหลายสคีมาจะแสดงสคีมาที่ช้าที่สุด",
       "lineSubsetUnnamed": "Your filters narrow this below the level these totals add up at, so the percentages describe the rows shown rather than the whole database.",
       "lineQuery": "Timings are measured from your application, so they include network time and any wait for a free connection.",
       "lineUncodedErrors": "{percent} of the failures here came back without a reason code, so they can be counted but not explained.",
@@ -25306,6 +25784,7 @@
     "contextNoHistory": "First time this alert has fired.",
     "escalationNotStarted": "Not paged yet",
     "escalationPagesNobody": "Pages nobody",
+    "escalationNobodyPaged": "ไม่มีใครถูกเรียกเวร",
     "escalationTo": "escalates to {who} {when}",
     "escalationDetailCapped": "Live escalation detail is loaded for the {count} oldest open pages.",
     "responder": "Responder",
@@ -25439,7 +25918,7 @@
     "rotationRestrictionTo": "To",
     "rotationRestrictionAdd": "Add a window",
     "rotationRestrictionRemove": "Remove",
-    "rotationRestrictionZeroLength": "From and To are the same, so this window never matches and the layer silently never wins. For a full day, set To to 24:00.",
+    "rotationRestrictionZeroLength": "From และ To เป็นช่วงเวลาเดียวกัน หน้าต่างนี้จึงไม่ตรงกับช่วงเวลาใดเลย ปุ่มบันทึกจะยังใช้ไม่ได้จนกว่า From และ To จะต่างกัน หากต้องการเต็มวัน ให้ตั้ง To เป็น 24:00",
     "rotationRetiredTag": "Retired",
     "rotationSectionWhen": "When it turns over",
     "rotationName": "Rotation name",
@@ -25591,6 +26070,10 @@
     "snoozed": "Snoozed",
     "snoozedUntil": "Quiet until {time} — still unassigned",
     "snoozeFailed": "Could not snooze the page",
+    "unsnooze": "เลิกพักการแจ้งเตือน",
+    "unsnoozeHint": "สิ้นสุดการพักการแจ้งเตือนทันที การแจ้งเตือนเรียกเวรจะดำเนินต่อจากขั้นตอนที่หยุดไว้",
+    "unsnoozed": "สิ้นสุดการพักแล้ว · การแจ้งเตือนเรียกเวรดำเนินต่อ",
+    "unsnoozeFailed": "ไม่สามารถสิ้นสุดการพักการแจ้งเตือนได้",
     "note": "Note",
     "notePlaceholder": "What did you find? What did you try?",
     "addNote": "Add note",
@@ -25801,6 +26284,7 @@
     "teamCreateSecondaryHint": "Same people, one shift behind, so the secondary is never the person already on call. It is an ordinary rotation — nothing links the two, so editing one roster and not the other lets them drift, and you get a warning rather than a silent fix.",
     "rotationPreviewPairLegend": "Primary · Secondary",
     "rotationPreviewEmpty": "Pick people and a first handover to see who is on when.",
+    "rotationPreviewNow": "ตอนนี้ – {until}",
     "defaultRotationName": "Rotation",
     "teamCreatedWithoutMembers": "The team was created, but its members could not be added. Add them on the Members tab.",
     "teamCreatedWithoutRotation": "The team and its members were created, but the rotation could not be saved. Set it on the Schedule tab.",
@@ -26569,6 +27053,7 @@
     "sectionHint_ringing": "nobody has acknowledged — these are still paging",
     "sectionHint_ringingRouted": "ยังไม่มีใครรับทราบ — {count} รายการเหล่านี้ยังแจ้งเตือนเรียกเวรอยู่ | ยังไม่มีใครรับทราบ — {count} รายการเหล่านี้ยังแจ้งเตือนเรียกเวรอยู่",
     "sectionHint_ringingUnrouted": "{count} รายการไม่มีทีม จึงไม่มีการแจ้งเตือนเรียกเวร | {count} รายการไม่มีทีม จึงไม่มีการแจ้งเตือนเรียกเวร",
+    "sectionHint_ringingStopped": "{count} ไม่ถูกเรียกเวร | {count} ไม่ถูกเรียกเวร",
     "sectionHint_snoozed": "paging paused — they come back on their own",
     "sectionHint_handled": "acknowledged — a human owns each of these",
     "sectionHint_resolved": "closed — kept for the record",
@@ -26648,7 +27133,7 @@
     "ruleEditorTeamHelp": "The team paged when a signal matches. Its own escalation ladder decides who is woken and in what order.",
     "scopeOwns": "This team owns",
     "scopeAdvanced": "Advanced",
-    "ruleEditorConflictUnclaimed": "Nothing claims this path today — a page matching it reaches the catch-all, or nobody.",
+    "ruleEditorConflictUnclaimed": "ยังไม่มีสิ่งใดอ้างสิทธิ์เส้นทางนี้ในปัจจุบัน เมื่อพิจารณาจากเงื่อนไขเหล่านี้เพียงอย่างเดียว — การแจ้งเตือนที่ตรงกับเงื่อนไขจะไปถึงตัวจัดการแบบ catch-all หรือไม่ถึงใครเลย",
     "ruleEditorConflictHeldBy": "Today a page matching this goes to {team}, via {path}.",
     "ruleEditorConflictTakesOver": "Yours pins more, so it would take these from {team}.",
     "ruleEditorConflictKeptBy": "The path held by {team} pins more, so they keep these and this rule catches only what is left.",
@@ -26670,6 +27155,7 @@
     "scopeClaimServiceHere": "{service} pages this team in {scope} only. Elsewhere it falls to whoever owns the scope around it.",
     "scopeNothingDiscovered": "Nothing has been discovered yet, so there is no estate to pick from. Use Advanced to write the rule by field, or send some telemetry first.",
     "scopeAdvancedHint": "Match on any field and value, including ones the levels above do not cover.",
+    "scopeValuesSeen": "รายการเหล่านี้แสดงค่าที่การค้นพบบริการตรวจพบ หากต้องการจับคู่กับค่าอื่น ให้ใช้ตัวเลือกขั้นสูง",
     "escalationHeld": "การคัดแยกด้วย AI ก่อน · แจ้งเตือนเรียกเวรภายใน {n} วินาที",
     "escalationPagingStep": "ขั้นตอนการแจ้งเตือนเรียกเวร {step} จาก {total} · {who}",
     "escalationPagingStepOnly": "ขั้นตอนการแจ้งเตือนเรียกเวร {step} จาก {total}",
@@ -26707,6 +27193,7 @@
     "createTeamAndRotation": "สร้างทีมและรอบเวร",
     "removeMemberHandsOver": "{name} รับช่วงเวรปัจจุบันของ {leaving} ใน {rotation}",
     "removeMemberLeavesGap": "ไม่มีผู้รับช่วงเวรปัจจุบันของ {leaving} ใน {rotation}",
+    "removeMemberReorders": "พวกเขายังออกจาก {rotations} ด้วย ผู้ที่อยู่เวรในนั้นจึงอาจเปลี่ยนไปด้วย",
     "membersJoinEnd": "{names} จะเข้าร่วมต่อท้าย {rotations} ผู้ที่อยู่เวรในขณะนี้ไม่เปลี่ยนแปลง | {names} จะเข้าร่วมต่อท้าย {rotations} ผู้ที่อยู่เวรในขณะนี้ไม่เปลี่ยนแปลง",
     "membersAdded": "เพิ่ม {names} แล้ว | เพิ่ม {names} แล้ว",
     "removeMemberConfirm": "นำออก",
@@ -28140,6 +28627,7 @@
       "managedQuestions": "Questions: {contact}",
       "outboundQueue": "Alert messages: {count} queued, oldest {age} | Alert messages: {count} queued, oldest {age}",
       "outboundEmpty": "No alert messages queued",
+      "refusedPosts": "{count} การโพสต์การแจ้งเตือนล้มเหลวใน 24 ชม. ที่ผ่านมา ล่าสุด: {reason} บน {destination}, | {count} การโพสต์การแจ้งเตือนล้มเหลวใน 24 ชม. ที่ผ่านมา ล่าสุด: {reason} บน {destination},",
       "ageSeconds": "{count} s"
     },
     "channels": {
@@ -28411,6 +28899,78 @@
       "remindFailed": "The reminders could not be sent."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(ไม่มีชื่อโมเดล)",
+    "topModels": "{models} (อันดับสูงสุด {shown} จาก {total})",
+    "cost": {
+      "partial": "บางส่วน",
+      "unknown": "ไม่ทราบค่าใช้จ่าย",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "ค่าใช้จ่ายบางส่วน ไม่มีราคาสำหรับ {models}: ไม่ได้นับ {tokens} โทเค็นใน{scope}นี้",
+      "unknownTooltip": "ไม่ทราบค่าใช้จ่าย ไม่มีราคาสำหรับ {models}: ไม่มีโทเค็นใดเลยใน {tokens} โทเค็นของ{scope}นี้ที่มีการคิดค่าใช้จ่าย",
+      "scopeSession": "เซสชัน",
+      "scopeTrace": "เทรซ",
+      "unknownModel": "โมเดลที่ไม่มีชื่อ",
+      "addPrice": "เพิ่มราคา"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} โทเค็นที่ยังไม่กำหนดราคา",
+      "unpricedTooltip": "ค่าใช้จ่ายเป็นเพียงขีดจำกัดล่าง: โทเค็น {tokens} รายการบน {models} ไม่มีราคา เปิดแท็บที่ยังไม่กำหนดราคาใน LLM Model Pricing.",
+      "pricedSinceTooltip": "ค่าใช้จ่ายเป็นเพียงขีดจำกัดล่าง: โทเค็น {tokens} รายการบน {models} ถูกบันทึกก่อนมีการเพิ่มราคา และไม่มีค่าใช้จ่าย."
+    },
+    "chart": {
+      "costMissing": "ไม่อยู่ในแผนภูมินี้: {models}. โทเค็น {tokens} รายการไม่มีราคา.",
+      "costMissingPricedSince": "ไม่อยู่ในแผนภูมินี้: {models}. โทเค็น {tokens} รายการถูกบันทึกก่อนมีการเพิ่มราคา.",
+      "unpricedModels": "ยังไม่กำหนดราคา: {models}",
+      "pricedSinceModels": "บันทึกก่อนมีการเพิ่มราคา: {models}",
+      "addPrice": "เพิ่มราคา"
+    },
+    "health": {
+      "title": "สุขภาพข้อมูล",
+      "passing": "ผ่าน {n} รายการ",
+      "checkedAgo": "ตรวจสอบเมื่อ {ago}",
+      "drawerTitle": "สุขภาพข้อมูล AI",
+      "drawerSubtitle": "{stream} · ช่วงเวลาปัจจุบัน",
+      "rerun": "ตรวจสอบซ้ำ",
+      "close": "ปิด",
+      "loadError": "ไม่สามารถดำเนินการตรวจสอบสุขภาพข้อมูลได้.",
+      "samples": "ตัวอย่าง:",
+      "copyLink": "คัดลอกลิงก์สำหรับผู้ดูแลระบบ",
+      "linkCopied": "คัดลอกลิงก์แล้ว",
+      "status": {
+        "pass": "ผ่าน",
+        "warning": "คำเตือน",
+        "error": "ข้อผิดพลาด"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "โมเดลที่ยังไม่กำหนดราคา",
+          "detail": "{count} โมเดล · {spans} สแปน · {tokens} โทเค็นถูกนับเป็น $0 | {count} โมเดล · {spans} สแปน · {tokens} โทเค็นถูกนับเป็น $0",
+          "pass": "ทุกโมเดลในช่วงเวลานี้มีราคา. สแปนที่บันทึกก่อนมีการเพิ่มราคาจะคงค่าใช้จ่ายที่บันทึกไว้.",
+          "fix": "แก้ไขใน LLM Model Pricing",
+          "truncated": "อันดับสูงสุด {shown} จาก {total} ตามจำนวนโทเค็น"
+        },
+        "missing_agent_identity": {
+          "label": "ไม่มีข้อมูลระบุตัวตนของเอเจนต์",
+          "detail": "{affected} จาก {total} สแปน LLM ({pct}) ไม่มี gen_ai.agent.name ทำให้มุมมองเอเจนต์ไม่แสดงสแปนเหล่านี้.",
+          "pass": "ทุกสแปน LLM มีชื่อหรือ ID ของเอเจนต์.",
+          "fix": "เปิด GenAI Agent Mapping"
+        },
+        "zero_duration_spans": {
+          "label": "สแปนที่มีระยะเวลาเป็นศูนย์",
+          "detail": "{affected} สแปน LLM รายงาน 0 ms ทำให้ค่าความหน่วงและระยะเวลาเซสชันต่ำเกินไป.",
+          "pass": "ไม่มีสแปน LLM ใดรายงาน 0 ms.",
+          "fix": "วิธีแก้ไข"
+        },
+        "missing_session_id": {
+          "label": "สแปนที่ไม่มี ID เซสชัน",
+          "detail": "{affected} จาก {total} สแปน LLM ({pct}) ไม่มี gen_ai.conversation.id ทำให้ Sessions ไม่แสดงสแปนเหล่านี้.",
+          "pass": "ทุกสแปน LLM มี gen_ai.conversation.id.",
+          "fix": "คู่มือการเชื่อมต่อ"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Fleet management",
     "subtitle": "Enroll OpenTelemetry collectors, version their configurations and roll changes out safely",
@@ -28450,6 +29010,7 @@
     "badge": {
       "inProgress": "In progress",
       "scheduled": "Scheduled",
+      "waiting": "กำลังรอ",
       "completed": "Completed",
       "halted": "Halted",
       "superseded": "Superseded",
@@ -28694,7 +29255,7 @@
       "version": "Version",
       "pickConfig": "Pick a configuration",
       "pickFleet": "Pick a fleet",
-      "emptyFleet": "The fleet has no collectors, so the version is set at once",
+      "emptyFleet": "กลุ่มเครื่องไม่มีคอลเลกเตอร์ ดังนั้นการทยอยติดตั้งจะรอจนกว่าจะมีคอลเลกเตอร์เข้าร่วม",
       "startingShortly": "Starting shortly",
       "eventGateFailed": "Health gate failed",
       "eventHalted": "Halted",
@@ -28705,7 +29266,10 @@
       "notFound": "This rollout no longer exists",
       "notFoundDescription": "The link may be out of date. Pick a rollout from the list.",
       "noneTargeted": "No collectors targeted",
-      "outcomeNoneTargeted": "The fleet had no collectors when v{to} was set.",
+      "outcomeNoneTargeted": "ไม่มีคอลเลกเตอร์ใดอัปเดตเป็น v{to} ในการทยอยติดตั้งนี้.",
+      "outcomeWaiting": "ไม่มีคอลเลกเตอร์ออนไลน์ ดังนั้น v{to} ยังไม่ได้ถูกส่งไปยังคอลเลกเตอร์ใดเลย. การทยอยติดตั้งจะเริ่มเมื่อมีคอลเลกเตอร์เชื่อมต่อ.",
+      "waitingForCollector": "กำลังรอคอลเลกเตอร์",
+      "notStarted": "ยังไม่เริ่ม",
       "versionFailedBefore": "v{version} · failed before",
       "pickVersion": "Pick a version",
       "autoRollback": "Rollback automatically",
@@ -28730,6 +29294,7 @@
       "eventResumed": "Resumed",
       "eventSkipped": "Failing collectors skipped",
       "eventStarted": "Started",
+      "eventWaiting": "กำลังรอให้คอลเลกเตอร์ออนไลน์",
       "eventTimedOut": "Phase timed out",
       "eventSkippedOffline": "Left out {count} collector that was offline at the start; it takes the version when it reconnects | Left out {count} collectors that were offline at the start; they take the version when they reconnect",
       "excluded": "Excluded",
@@ -28759,7 +29324,8 @@
       "phaseTimeoutNote": "A phase that neither confirms nor rejects within {minutes} min halts the rollout (fleet setting)",
       "phaseVerifying": "Verifying",
       "phases": "Phases",
-      "planEmpty": "No collectors to update",
+      "planEmpty": "ไม่มีคอลเลกเตอร์ออนไลน์ ดังนั้นการทยอยติดตั้งจะรอจนกว่าจะมีตัวหนึ่งเชื่อมต่อ",
+      "planStable": "ไม่มีคอลเลกเตอร์ออนไลน์; เวอร์ชันเสถียรจะถูกส่งไปยังแต่ละตัวเมื่อเชื่อมต่อ",
       "planOne": "{count} collector in one batch | {count} collectors in one batch",
       "planText": "{steps} → remaining {last}, {count} phases",
       "planUnavailable": "The plan preview is unavailable",
@@ -28906,7 +29472,6 @@
       "retentionDaysHelp": "0 keeps offline collectors forever"
     },
     "audit": {
-      "search": "Search the audit trail",
       "editedConfig": "Edited configuration",
       "revokedToken": "Revoked enrollment token",
       "enrolledCollector": "Enrolled collector",
@@ -28918,7 +29483,6 @@
       "setDesired": "Changed version",
       "autoRollback": "Rolled back automatically",
       "rolloutHalted": "Rollout halted",
-      "assignedFleetConfig": "Assigned the fleet's configuration",
       "createdFleet": "Created fleet",
       "renamedFleet": "Renamed fleet",
       "deletedFleet": "Deleted fleet",
@@ -28932,6 +29496,7 @@
       "rolledBackRollout": "Rolled back rollout",
       "movedByToken": "Moved by enrollment token",
       "object": "Object",
+      "search": "Search the audit trail",
       "allObjects": "All objects",
       "kind": {
         "fleet": "Fleet",
@@ -29038,6 +29603,7 @@
     "flowIssues": {
       "rollingOut": "Rolling out v{to}",
       "rolloutHalted": "v{to} rollout halted",
+      "rolloutWaiting": "v{to} รอให้คอลเลกเตอร์ออนไลน์",
       "autoRolledBack": "v{to} rolled back automatically",
       "noReason": "No failure reason reported",
       "openRollout": "Open rollout",
diff --git a/web/src/locales/languages/tr-TR.json b/web/src/locales/languages/tr-TR.json
index f7aa2cf16c..c577c5b5a5 100644
--- a/web/src/locales/languages/tr-TR.json
+++ b/web/src/locales/languages/tr-TR.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Henüz LLM etkinliği yok",
       "description": "Hizmetlerinizi OpenTelemetry Gen-AI anlamsal kurallarıyla enstrümante edin ve bu gösterge panosunu doldurmak için en az bir iz alın.",
-      "action": "OpenTelemetry ile Enstrüman",
-      "actionDesc": "İzlerinizde gen_ai_* niteliklerini yakalayın"
+      "action": "Tüm Yapay Zeka entegrasyonları",
+      "actionDesc": "Tüm çerçeve ve sağlayıcı kılavuzlarına göz atın",
+      "suggested": "{name} izlemesini ayarlayın",
+      "suggestedDesc": "{name} dokümanlarından geldiğiniz için önerildi",
+      "codingAgent": "Kodlama ajanıyla enstrümantasyon yapın",
+      "codingAgentDesc": "Kodlama ajanınız izleme ekler ve ilk izi kontrol eder",
+      "startFrom": "Veya şunlardan başlayın"
     },
     "noLLMSessions": {
       "title": "Henüz LLM oturumu yok",
@@ -4797,6 +4802,13 @@
       "success": "Başarılı",
       "failed": "Başarısız",
       "testRun": "Test çalıştırması",
+      "source": "Kaynak",
+      "sourceHttp": "HTTP isteği",
+      "sourceAlertFired": "Uyarı tetiklendi",
+      "sourceIncidentEvent": "Vaka olayı",
+      "sourceRetry": "Yeniden deneme çalıştırması",
+      "sourceManual": "Manuel çalıştırma",
+      "sourceOther": "Diğer",
       "runType": "Tür",
       "testRunTooltip": "Düzenleyiciden başlatıldı. Hedef adımları gerçekten gönderim yapar.",
       "showTestRuns": "{count} test çalıştırmasını göster",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Bu çalıştırma yeniden denensin mi?",
       "retryMessage": "Bu, başarısız çalıştırmanın kaydettiği girdiden yeni bir çalıştırma oluşturur. Hedef adımlar gerçekten gönderim yapar.",
       "retryStarted": "Yeniden deneme başlatıldı — listede yeni bir çalıştırma olarak görünür.",
-      "retryError": "Bu çalıştırma yeniden denenemedi."
+      "retryError": "Bu çalıştırma yeniden denenemedi.",
+      "statusQueued": "Sırada",
+      "statusRunning": "Çalışıyor",
+      "statusExpired": "Süresi doldu",
+      "reasonExpired": "hiç çalışmadı · 1 saatten fazla kuyrukta",
+      "reasonWorkerLost": "worker kayboldu · yeniden çalıştırılmadı",
+      "reasonWorkflowDisabled": "iş akışı devre dışı bırakıldı",
+      "reasonRunTimeout": "15 dakika sonra zaman aşımına uğradı",
+      "allTriggers": "Tüm tetikleyiciler",
+      "triggerFilter": "Tetikleyici",
+      "run": "Çalıştırma",
+      "searchRuns": "Çalıştırma kimliği, idempotency anahtarı veya uyarı arayın",
+      "sourceDetails": "Kaynak ayrıntıları",
+      "detailsWithKey": "{ip} · anahtar {key}",
+      "detailsNoKey": "{ip} · idempotency anahtarı yok",
+      "retryOf": "{run} çalıştırmasının yeniden denemesi",
+      "openRun": "Çalıştırmayı aç",
+      "alertFiredEmptyTitle": "Bu zaman aralığında uyarıyla tetiklenen çalıştırma yok",
+      "incidentEventEmptyTitle": "Bu zaman aralığında vaka olayı çalıştırması yok",
+      "filterEmptyTitle": "Bu zaman aralığında eşleşen çalıştırma yok",
+      "filterEmptyDimmed": "Diğer çalıştırmalar zaman çizelgesinde soluk olarak duruyor.",
+      "searchEmptyTitle": "Bu aramayla eşleşen çalıştırma yok",
+      "searchEmptyAction": "Aramayı temizle",
+      "timelineNow": "şimdi",
+      "timelineAgoMinutes": "−{n}dk",
+      "timelineAgoHours": "−{n}sa",
+      "timelineAgoDays": "−{n}g"
     },
     "edit": "Düzenle",
     "view": "Görüntüle",
@@ -4958,7 +4996,9 @@
           "noMatch": "Eşleşme Yok"
         },
         "suppressed": "Engellendi — gerçek hedefe gönderilmedi"
-      }
+      },
+      "payloadFrom": "Payload kaynağı",
+      "payloadFromHint": "HTTP biçimi, uç noktayı çağıranların gönderdiği yapıdır."
     },
     "linkAlerts": {
       "title": "İş Akışını Uyarılara Bağla",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Çıktı Biçimi",
       "tlsVerifyLabel": "TLS Doğrulaması",
       "tlsDisabled": "Devre Dışı"
+    },
+    "http": {
+      "runTestHint": "Adımları örnek bir HTTP payload ile çalıştırır; URL'yi çağırmaz",
+      "runTestHintList": "Test çalıştırmak için iş akışını açın",
+      "runsEmptyTitle": "Bu zaman aralığında HTTP isteği yok",
+      "runsEmptyBody": "Zaman aralığını genişletin veya HTTP uç noktası panelinden bir test isteği gönderin.",
+      "runsEmptyAction": "Tüm tetikleyicileri göster",
+      "runFailedAt": "Bu çalıştırma {step} adımında başarısız oldu: {error}",
+      "openStep": "Adımı aç",
+      "runGuardHint": "HTTP çalıştırmaları uyarı alanlarını değil isteği taşır. Bu adım {fields} alanlarını okuyorsa, bir Koşul ile koruyun: {guard}.",
+      "runExpiredBanner": "Bu istek kuyrukta 1 saatten uzun süre bekledi ve hiç çalıştırılmadı. Hiçbir adım çalışmadı ve hiçbir hedef çağrılmadı.",
+      "runWorkerLostBanner": "Bu isteği çalıştıran worker durdu. Hedefler zaten çağrılmış olabileceğinden otomatik olarak yeniden çalıştırılmaz. Çağıran yeniden göndermeden önce bunları kontrol edin.",
+      "request": "İstek",
+      "requestReceived": "Alındı",
+      "requestToken": "Token",
+      "requestCallerIp": "Çağıran IP",
+      "requestIdempotencyKey": "Idempotency anahtarı",
+      "requestContentType": "İçerik türü",
+      "requestBodySize": "Gövde boyutu",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Başlıklar",
+      "headersKept": "{count} tutuldu · Authorization, çerezler ve imzalar asla saklanmaz | {count} tutuldu · Authorization, çerezler ve imzalar asla saklanmaz",
+      "headerName": "Ad",
+      "headerValue": "Değer",
+      "outputCaption": "Her bir alt adımın aldığı",
+      "useAsTestInput": "Test girdisi olarak kullan",
+      "editorButton": "HTTP uç noktası",
+      "editorButtonOn": "Açık",
+      "editorButtonOff": "Kapalı",
+      "editorButtonTooltip": "Başka bir sistemin bu iş akışını bir HTTP isteğiyle başlatmasına izin verin",
+      "editorButtonRefusedDraft": "İş akışı yayımlanana kadar istekler 403 alır",
+      "editorButtonRefusedPaused": "İş akışı duraklatıldığı sürece istekler 403 alır",
+      "panelTitle": "HTTP uç noktası",
+      "panelSubtitle": "{name} · {kind} iş akışı",
+      "acceptRequests": "HTTP isteklerini kabul et",
+      "kindNote": "Bu iş akışının adımları {kind} çalıştırmaları için oluşturulmuştur. HTTP çalıştırmaları bunun yerine isteği alır ({field}); bu nedenle bir adım {kind} alanlarına ihtiyaç duyuyorsa bir Koşul ekleyin.",
+      "kindNotePayload": "HTTP yükünü göster",
+      "kindNotePayloadHide": "HTTP yükünü gizle",
+      "unsavedBody": "Bu iş akışı henüz kaydedilmedi. URL'sini ve token'ını oluşturmak için taslak olarak kaydedin. Yayımlayana kadar istekler reddedilir.",
+      "saveAndCreate": "Taslağı kaydet ve uç nokta oluştur",
+      "needsAdmin": "Uç nokta oluşturmak için bir kuruluş yöneticisi gerekir.",
+      "needsEdit": "Bunu değiştirmek için bu iş akışına düzenleme erişimi gerekir.",
+      "readOnlyOnMeta": "Açık · URL'yi kopyalayabilirsiniz. Bunu değiştirmek için bu iş akışına düzenleme erişimi gerekir.",
+      "offBody": "Başka bir sistemin bu iş akışını bir HTTP isteğiyle başlatmasına izin verin. Bir URL ve bir token alırsınız.",
+      "offExistingBody": "Kapalı · açana kadar istekler reddedilir (403).",
+      "onMeta": "Açık · çalıştırmalar yalnızca iş akışı etkin ve yayımlanmışken başlar",
+      "loadError": "Uç nokta ayarları yüklenemedi.",
+      "draftBanner": "Bu iş akışı bir taslak. Yayımlayana kadar URL'ye yapılan çağrılar 403 alır. Uç noktayı şimdi kurabilirsiniz; Testi çalıştır, taslağın adımlarını örnek bir HTTP yüküyle çalıştırır.",
+      "disabledBanner": "İş akışını etkinleştirene kadar istekler reddedilir (403).",
+      "turnOnFailed": "Uç nokta açılamadı. {reason}",
+      "changeFailed": "Uç nokta kaydedilemedi. {reason}",
+      "endpointExistsHint": "Uç nokta zaten mevcut. Token'ını Tokenlar tablosundan gösterin veya kopyalayın.",
+      "endpointExistsHintSigned": "Uç nokta zaten mevcut. İmzalama gizli anahtarını İmzalama gizli anahtarları tablosundan gösterin veya kopyalayın.",
+      "disableTitle": "Uç nokta kapatılsın mı?",
+      "disableBody": "Yeniden açana kadar çağıranlar 403 alır (uç nokta kapalı). URL ve tokenlar aynı kalır.",
+      "disableConfirm": "Kapat",
+      "lastCall": "Açık · Son çağrı: {status} · {time} · {link}",
+      "lastCallNone": "Açık · Henüz çağrı yok — bir test isteği gönderin",
+      "lastCallNoneRefused": "Açık · Henüz çağrı yok",
+      "viewRun": "Çalıştırmayı görüntüle",
+      "lastCallStatus": {
+        "queued": "kuyrukta",
+        "running": "çalışıyor",
+        "succeeded": "başarılı",
+        "failed": "başarısız",
+        "expired": "süresi doldu"
+      },
+      "endpointUrl": "Uç nokta URL'si",
+      "tokenLabel": "Token",
+      "secretLabel": "İmzalama sırrı",
+      "newTokenLabel": "Yeni token",
+      "newSecretLabel": "Yeni imzalama sırrı",
+      "tokenHint": "Ekranda maskeli görünür; Kopyala gerçek token'ı kopyalar. Bunu {header} olarak gönderin, URL'de asla göndermeyin.",
+      "secretHint": "Ekranda maskeli görünür; Kopyala gerçek sırrı kopyalar. Her isteği bununla imzalayın ve {headers} başlıklarını gönderin; sırrın kendisini asla göndermeyin.",
+      "revealBannerTitle": "Uç nokta oluşturuldu",
+      "revealBannerBody": "Bu token'ı her istekle gönderin. Token'lar tablosundan yeniden görüntüleyebilir veya kopyalayabilirsiniz.",
+      "revealBannerBodySigned": "Her isteği bu sırla imzalayın. İmzalama sırları tablosundan yeniden görüntüleyebilir veya kopyalayabilirsiniz.",
+      "switchedBannerTitle": "Token oluşturuldu",
+      "switchedBannerTitleSigned": "İmzalama sırrı oluşturuldu",
+      "rotateBannerTitle": "Yeni token oluşturuldu",
+      "rotateBannerTitleSigned": "Yeni imzalama sırrı oluşturuldu",
+      "rotateBannerBody": "Çağıranlar aynı URL'yi ve başlığı korur; yalnızca token değişir. Eski token süresi dolana kadar çalışmaya devam eder ve o zamana kadar gösterilebilir.",
+      "rotateBannerBodySigned": "Çağıranlar aynı URL'yi ve başlıkları korur; yalnızca sır değişir. Eski sır süresi dolana kadar çalışmaya devam eder ve o zamana kadar gösterilebilir.",
+      "rotateBannerBodyRevoked": "Çağıranlar aynı URL'yi ve başlığı korur; yalnızca token değişir. Eski token iptal edildi ve artık çalışmayı durdurur.",
+      "rotateBannerBodyRevokedSigned": "Çağıranlar aynı URL'yi ve başlıkları korur; yalnızca sır değişir. Eski sır iptal edildi ve artık çalışmayı durdurur.",
+      "rotateBannerBodyFresh": "Çağıranlar aynı URL'yi ve başlığı korur ve bundan sonra bu token'ı gönderir.",
+      "rotateBannerBodyFreshSigned": "Çağıranlar aynı URL'yi ve başlıkları korur ve bundan sonra bu sırla imzalar.",
+      "snippetsLabel": "Örnek istek",
+      "sendTest": "Test isteği gönder",
+      "sendTestHint": "Kimlik bilgilerini denetler ve adımlarınızın alacağı veriyi gösterir. Çalıştırma başlamaz, hiçbir hedef çağrılmaz.",
+      "sendTestHintPaused": "Kimlik bilgilerini denetler. İş akışı duraklatıldığı için herhangi bir girdi oluşturulmadan önce çağrı reddedilir; Testi çalıştır adımları çalıştırır.",
+      "sendTestSigned": "Tarayıcılar istekleri imzalayamaz, bu nedenle yukarıdaki örnek istekle test edin. Bir çalıştırma başlatmadan imzayı denetlemek için URL'sine ?dry_run=true ekleyin.",
+      "dryRunAccepted": "Deneme çalıştırması kabul edildi",
+      "dryRunMeta": "kimlik bilgileri geçerli · {size} gövde",
+      "dryRunInput": "Adımlarınızın alacağı girdi",
+      "dryRunRefused": "Kimlik bilgileri geçerli. İş akışı yayımlanana kadar istekler reddedilir.",
+      "dryRunRefusedPaused": "Kimlik bilgileri geçerli. İş akışı duraklatılmışken istekler reddedilir.",
+      "dryRunRateLimited": "Hız sınırına takıldı — deneme çalıştırmaları sınıra sayılır.",
+      "dryRunStatus": "İstek {status} durumuyla reddedildi.",
+      "dryRunFailed": "Test isteği gönderilemedi. {reason}",
+      "runTestInstead": "Bunun yerine testi çalıştır",
+      "done": "Tamam",
+      "regionTag": "Bölge {name}",
+      "regionBanner": "Her isteği ve her yeniden denemeyi bu bölgenin ana bilgisayarına gönderin. Idempotency anahtarları ve çalıştırma durumu ({field}) çağrıyı kabul eden bölgede tutulur; bu nedenle başka bir bölgeye gönderilen yeniden deneme ikinci bir çalıştırma başlatabilir.",
+      "authLabel": "Çağıranlar şununla kimlik doğrular",
+      "authToken": "Token",
+      "authSigned": "İmzalı istekler",
+      "authAbout": "Kimlik doğrulama hakkında",
+      "authInfo": "Token: token'ı Authorization başlığında gönderin. İmzalı istekler: her isteği paylaşılan bir sırla ({headers} başlıkları) imzalayın.",
+      "switchToSignedTitle": "İmzalı isteklere geçilsin mi?",
+      "switchToSignedBody": "Geçiş yapmak mevcut token'ı hemen iptal eder ve bir imzalama sırrı oluşturur. Token'ı kullanan çağıranlar 401 almaya başlar.",
+      "switchToTokenTitle": "Token'a geçilsin mi?",
+      "switchToTokenBody": "Geçiş yapmak mevcut imzalama gizli anahtarını hemen iptal eder ve bir token oluşturur. İstekleri imzalayan çağıranlar 401 almaya başlar.",
+      "tokensTitle": "Tokenlar",
+      "secretsTitle": "İmzalama gizli anahtarları",
+      "colToken": "Token",
+      "colSecret": "Gizli anahtar",
+      "colCreated": "Oluşturulma",
+      "colLastUsed": "Son kullanım",
+      "colStatus": "Durum",
+      "colActions": "İşlemler",
+      "never": "Hiçbir zaman",
+      "active": "Etkin",
+      "retiring": "Kullanımdan kalkıyor",
+      "creatorGone": "Oluşturan kişi artık bu kuruluşta değil",
+      "revoke": "İptal et",
+      "revokeNow": "Hemen iptal et",
+      "revokeTitle": "{prefix} iptal edilsin mi? Bunu kullanan çağıranlar hemen 401 alır.",
+      "revokeFailed": "İptal edilemedi. {reason}",
+      "copyToken": "Tokenı kopyala",
+      "copySecret": "Gizli anahtarı kopyala",
+      "tokenCopied": "Token kopyalandı",
+      "commandCopied": "Komut kopyalandı",
+      "secretCopied": "Gizli anahtar kopyalandı",
+      "revealFailed": "Token gösterilemedi. {reason}",
+      "revealFailedSigned": "Gizli anahtar gösterilemedi. {reason}",
+      "revealDenied": "Bu uç nokta için tokenları yalnızca yöneticiler gösterebilir veya kopyalayabilir.",
+      "runTest": "Testi çalıştır",
+      "rotate": "Yenile",
+      "rotateBlocked": "Önce kullanımdan kalkacak tokenı iptal edin",
+      "rotateBlockedSigned": "Önce kullanımdan kalkacak gizli anahtarı iptal edin",
+      "rotateTitle": "Tokenı yenile",
+      "rotateTitleSigned": "İmzalama gizli anahtarını yenile",
+      "rotateLead": "Şimdi yeni bir token oluşturulur. {prefix} (son kullanım {time}) şu süre boyunca çalışmaya devam etsin:",
+      "rotateLeadSigned": "Şimdi yeni bir imzalama gizli anahtarı oluşturulur. {prefix} (son kullanım {time}) şu süre boyunca çalışmaya devam etsin:",
+      "overlapNow": "Hemen iptal et",
+      "overlapHour": "1 saat",
+      "overlapDay": "24 saat",
+      "overlapWeek": "7 gün",
+      "rotateConsequence": "Mevcut tokenı kullanan çağıranlar {time} zamanına kadar çalışmaya devam eder. Onları o zamana kadar güncelleyin.",
+      "rotateConsequenceSigned": "Mevcut gizli anahtarla imzalayan çağıranlar {time} zamanına kadar çalışmaya devam eder. Onları o zamana kadar güncelleyin.",
+      "rotateConsequenceNow": "Mevcut tokenı kullanan çağıranlar bundan sonra 401 alır.",
+      "rotateConsequenceNowSigned": "Mevcut gizli anahtarla imzalayan çağıranlar bundan sonra 401 alır.",
+      "rotateConfirm": "Tokenı yenile",
+      "rotateConfirmSigned": "İmzalama gizli anahtarını yenile",
+      "rotateFailed": "Yenilenemedi. {reason}",
+      "advanced": "Gelişmiş",
+      "advancedSummary": "Maks. gövde {size} · dakikada {count} istek | Maks. gövde {size} · dakikada {count} istek",
+      "maxBody": "Maksimum gövde boyutu (KiB)",
+      "maxBodyHint": "En fazla 1024 (1 MiB); yalnızca düşürebilirsiniz",
+      "maxBodyRange": "1 ile 1024 arasında bir tam sayı girin",
+      "rateLimit": "Dakika başına istek",
+      "rateLimitHint": "Bu kuruluş için dakikada en fazla {org} istek",
+      "rateLimitRange": "1 ile {org} arasında bir tam sayı girin",
+      "saveLimitsFailed": "Sınırlar kaydedilemedi. {reason}",
+      "deleteMeta": "URL'yi, tüm tokenları ve gizli anahtarları kaldırır.",
+      "deleteButton": "Uç noktayı sil",
+      "deleteTitle": "Bu uç nokta silinsin mi?",
+      "deleteBody": "URL hemen çalışmayı durdurur: çağıranlar 401 alır. Tüm tokenlar ve imzalama gizli anahtarları silinir ve geri alınamaz. Çalıştırma geçmişi korunur.",
+      "deleteFailed": "Uç nokta silinemedi. {reason}",
+      "secretStorageWarning": "Bu sunucuda şifreleme ana anahtarı yok; bu nedenle tokenlar ve imzalama gizli anahtarları veritabanına erişimi olan herkesin okuyabileceği bir biçimde saklanır. Yöneticinizden bir ana anahtar ayarlamasını isteyin.",
+      "rejectionsLine": "Son 24 saatte yaklaşık {count} istek reddedildi · son: {reason}, {time} | Son 24 saatte yaklaşık {count} istek reddedildi · son: {reason}, {time}",
+      "rejectionsShow": "Göster",
+      "rejectionsHide": "Gizle",
+      "rejectionsTitle": "Son reddedilen istekler",
+      "rejectionsCaption": "son 24 saatte yaklaşık {count} · çağıran yalnızca durum kodunu gördü | son 24 saatte yaklaşık {count} · çağıran yalnızca durum kodunu gördü",
+      "rejectionMeta": "yaklaşık {count} · son {time} · {ip} adresinden | yaklaşık {count} · son {time} · {ip} adresinden",
+      "rejectionsLoadError": "Reddedilen istekler yüklenemedi.",
+      "raiseLimit": "Sınırı yükselt",
+      "rotateLink": "Döndür",
+      "reason": {
+        "invalid_token": {
+          "title": "Geçersiz token",
+          "fix": "Çağıran; iptal edilmiş, süresi dolmuş veya yanlış yazılmış bir token gönderiyor. Mevcut tokenı Tokenlar tablosundan gösterin veya kopyalayın."
+        },
+        "invalid_signature": {
+          "title": "Geçersiz imza",
+          "fix": "Çağıran, eski veya yanlış bir gizli anahtarla imzalıyor. Mevcut gizli anahtarı kullandığını ve {format} değerini gönderildiği haliyle aynen imzaladığını kontrol edin."
+        },
+        "stale_timestamp": {
+          "title": "Zaman damgası çok eski",
+          "fix": "Çağıranın saati 5 dakikadan fazla sapmış. Saatini eşitleyin ve göndermeden hemen önce imzalayın."
+        },
+        "endpoint_disabled": {
+          "title": "Uç nokta kapalı",
+          "fix": "Uç noktayı açın."
+        },
+        "workflow_disabled": {
+          "title": "İş akışı duraklatıldı",
+          "fix": "İş akışını listeden sürdürün."
+        },
+        "workflow_not_published": {
+          "title": "İş akışı yayımlanmadı",
+          "fix": "İş akışını yayımlayın; taslaklar istekleri reddeder."
+        },
+        "payload_too_large": {
+          "title": "Yük çok büyük",
+          "fix": "{size} sınırını aşıyor. Daha az gönderin veya olayları birkaç isteğe bölün."
+        },
+        "credential_in_url": {
+          "title": "URL'de kimlik bilgisi",
+          "fix": "URL'de bir token veya gizli anahtar gönderildi ve reddedildi. URL'ler proxy ve tarayıcı günlüklerine kaydedilir; bu nedenle hemen döndürün, ardından bir başlıkta gönderin."
+        },
+        "invalid_idempotency_key": {
+          "title": "Geçersiz idempotency anahtarı",
+          "fix": "Idempotency-Key başlığı boş veya 255 karakterden uzun."
+        },
+        "idempotency_key_reused": {
+          "title": "Idempotency anahtarı yeniden kullanıldı",
+          "fix": "Aynı anahtar farklı bir gövdeyle geldi. Her farklı olay için yeni bir anahtar kullanın."
+        },
+        "rate_limited": {
+          "title": "Hız sınırına takıldı",
+          "fix": "Dakikada {count} istekten fazla. Olayları tek istekte toplayın (bir JSON dizisi gönderin) veya sınırı yükseltin — bu kuruluş için dakikada en fazla {org} istek."
+        },
+        "queue_full": {
+          "title": "Kuyruk dolu",
+          "fix": "Bu kuruluşta zaten {count} HTTP çalıştırması bekliyordu. Çağıranlar Retry-After gecikmesinden sonra yeniden denemeli; yavaş bir adım olup olmadığına bakın veya gönderme hızını düşürün."
+        },
+        "worker_unavailable": {
+          "title": "Worker kullanılamıyor",
+          "fix": "Bu bölgede çalışan bir iş akışı worker'ı yoktu, bu nedenle hiçbir şey kuyruğa alınmadı. Retry-After gecikmesinden sonra yeniden deneyen çağıranlar, bir worker geri geldiğinde işleme alınır; sorun devam ederse yöneticinizden iş akışı worker'larını kontrol etmesini isteyin."
+        }
+      },
+      "nodeBadge": "HTTP üzerinden çağrılabilir",
+      "triggerLinkOn": "HTTP isteklerinde de çalışır",
+      "triggerLinkOnAction": "Uç noktayı yönet",
+      "triggerLinkOff": "Başka bir sistemden de başlatın",
+      "triggerLinkOffAction": "HTTP uç noktası ayarla",
+      "pickerCue": "Herhangi bir iş akışı bir HTTP isteğiyle de başlatılabilir. Tetikleyicisini seçin, ardından araç çubuğundaki HTTP uç noktasını kullanın.",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP uç noktası açık",
+      "listMenuItem": "HTTP uç noktası…",
+      "copyUrl": "Uç nokta URL'sini kopyala",
+      "copyUrlDraftHint": "Yayımlayana kadar istekler reddedilir",
+      "copyUrlFailed": "Uç nokta URL'si kopyalanamadı. {reason}",
+      "payloadFrom": "Yük kaynağı",
+      "payloadHttp": "HTTP isteği",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "{count} saat içinde sona erer | {count} saat içinde sona erer",
+      "expiresInDays": "{count} gün içinde sona erer | {count} gün içinde sona erer",
+      "expired": "Süresi doldu",
+      "rotateLeadUnused": "Şimdi yeni bir token oluşturuluyor. {prefix} (hiç kullanılmadı) şu süre boyunca çalışmaya devam eder",
+      "rotateLeadUnusedSigned": "Şimdi yeni bir imzalama gizli anahtarı oluşturuluyor. {prefix} (hiç kullanılmadı) şu süre boyunca çalışmaya devam eder",
+      "fieldGroup": "HTTP isteği",
+      "fieldGroupBodyHint": "İstek gövdesindeki alanlar için önce bir Fonksiyon adımı gerekir",
+      "fieldGroupQueryHint": "Sorgu parametreleri meta.query.<key> biçimindedir; yinelenen anahtarlar liste olarak gelir ve hiçbir zaman eşleşmez",
+      "rotateLeadNone": "Etkin token yok, bu nedenle çağıranlar kimlik doğrulaması yapamaz. Şimdi yeni bir token oluşturuluyor.",
+      "rotateLeadNoneSigned": "Etkin imzalama gizli anahtarı yok, bu nedenle çağıranlar kimlik doğrulaması yapamaz. Şimdi yeni bir imzalama gizli anahtarı oluşturuluyor.",
+      "createForbidden": "Bu kuruluşta uç nokta kimlik bilgileri oluşturamazsınız.",
+      "errorNotConfigured": "Bu iş akışının HTTP uç noktası yok.",
+      "errorNoLiveCredential": "Etkin kimlik bilgisi yok. Oluşturmak için döndürün.",
+      "errorNotAllowed": "Bunu yapma izniniz yok.",
+      "copyCredentialChanged": "Kimlik bilgisi değişti. Tekrar kopyalayın.",
+      "copyCommandFailed": "Komut kopyalanamadı. {reason}",
+      "exampleRequest": "Örnek istek",
+      "exampleActiveToken": "Etkin token · {prefix}",
+      "exampleActiveSecret": "Etkin gizli anahtar · {prefix}",
+      "exampleHintToken": "Kopya token'ı içerir. Bir terminale yapıştırın veya Postman ya da Insomnia'ya aktarın (Import → Raw text).",
+      "exampleHintSigned": "bash içinde çalıştırın: openssl ile imzalar, ardından curl çağırır. Kopya gizli anahtarı içerir. İçe aktarma araçları imzalayamaz.",
+      "exampleHintTokenPlaceholder": "Kopyada token'ın yerine bir yer tutucu var. Bir terminale yapıştırın veya Postman ya da Insomnia'ya aktarın (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "bash içinde çalıştırın: openssl ile imzalar, ardından curl çağırır. Kopyada gizli anahtarın yerine bir yer tutucu var. İçe aktarma araçları imzalayamaz."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Daha fazla dokümantasyon için",
       "viewDocsLinkLabel": "buraya",
       "viewDocsSuffix": "tıklayın.",
-      "selectIntegrationPrompt": "Ayrıntıları görüntülemek için bir entegrasyon seçin."
+      "selectIntegrationPrompt": "Ayrıntıları görüntülemek için bir entegrasyon seçin.",
+      "codingAgent": {
+        "tabAgent": "Kodlama ajanıyla",
+        "tabSteps": "Adım adım",
+        "streamLabel": "İz Akışı Adı",
+        "streamHelp": "Ajan izleri bu akışa yazar ve onu kontrol eder.",
+        "envTitle": ".env dosyanızı indirin",
+        "envHelp": "Proje kök dizinine kaydedin. Beceri token'ı bu dosyadan okur, böylece token hiçbir zaman sohbete girmez.",
+        "envButton": ".env indir",
+        "promptTitle": "Bunu {client1}, {client2} veya {client3} içine yapıştırın",
+        "promptLabel": "İstem",
+        "promptCopied": "İstem kopyalandı"
+      }
     },
     "header": "Veri kaynakları",
     "resetRUMTokenLabel": "RUM Token'ını Sıfırla",
@@ -7670,6 +7995,15 @@
     "queryValues": "Sorgu Değerleri",
     "constant": "Sabit",
     "textbox": "Metin Kutusu",
+    "date": "Tarih",
+    "dateFormat": "Çıktı tarih biçimi",
+    "dateFormatHelp": "Sorgularda varsayılan çıktı. Her kullanımda ${'{'}name:format{'}'} ile geçersiz kılın, ör. ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Epoch saniye (epoch)",
+    "dateFormatEpochms": "Epoch milisaniye (epochms)",
+    "dateFormatEpochus": "Epoch mikrosaniye (epochus)",
     "newFolder": "Yeni Klasör",
     "updateFolder": "Klasörü Güncelle",
     "newReport": "Yeni Rapor",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Açıklama Ekle",
       "dependentAdhocVariableWarning": "Bazı dinamik değişkenler uygulanmadı çünkü alan sorgunun akışında mevcut değil. Bu paneli oluşturmak için çalıştırılan değişkenler ve sorguların tüm ayrıntılarını görmek için Sorgu Denetçisi'ni açın.",
       "refreshCacheReload": "Önbelleği Yenile ve Yeniden Yükle",
+      "exploreCreateAlert": "Uyarı oluştur",
+      "exploreAddToDashboard": "Gösterge panosuna ekle",
       "redirectingToLogs": "Günlük sayfasına yönlendiriliyor",
       "pleaseWait": "Lütfen bekleyin..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Sabit",
       "textbox": "Metin kutusu",
       "custom": "Özel",
+      "date": "Tarih",
       "list": "{type} · {example}",
       "csv": "Virgüller: {example}",
       "pipe": "Dikey çizgiler: {example}",
       "doublequote": "Çift tırnaklar: {example}",
-      "singlequote": "Tek tırnaklar: {example}"
+      "singlequote": "Tek tırnaklar: {example}",
+      "dateIso": "Tarih (YYYY-MM-DD): {example}",
+      "dateDmy": "Önce gün (DD/MM/YYYY): {example}",
+      "dateMdy": "Önce ay (MM/DD/YYYY): {example}",
+      "dateEpoch": "Epoch saniye: {example}",
+      "dateEpochms": "Epoch milisaniye: {example}",
+      "dateEpochus": "Epoch mikrosaniye: {example}"
     },
     "add": "Panel Ekle",
     "save": "Kaydet",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Onaylandı",
         "badgeResolved": "Çözüldü",
         "badgeReopened": "Yeniden Açıldı",
+        "badgeAckEnded": "Üstlenme sona erdi",
         "badgeDimensionsUpgraded": "Boyutlar Yükseltildi",
         "badgeTitleChanged": "Başlık Değiştirildi",
         "badgeAssignment": "Atama",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "Yapay zeka girdi bekliyor",
         "incidentWas": "Vaka",
         "theIncident": "vaka",
+        "ackEndedByPageResolve": "çağrılarından biri çözülerek",
         "unnamedAlert": "uyarı",
         "alertTriggered": "{alert} tetiklendi | {alert} {count} kez tetiklendi",
         "severityUpgraded": "Önem derecesi {from} seviyesinden {to} seviyesine yükseltildi",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Beni uyar",
           "toast": "Ürün Analitiğinden içe aktarıldı: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "Uyarı oluştur",
+          "toast": "Sorgu, iz aramanızdan içe aktarıldı",
+          "noStream": "Önce bir akış seçin",
+          "errorCount": "Hata sayısı",
+          "errorRate": "Hata oranı"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Arama filtreniz taşınamadı çünkü önce günlükler sayfasında bir 'Run as' seçimi gerekiyor. Gerekirse uyarı sorgusuna ekleyin.",
         "thresholdColumnGuessed": "Eşik {column} için uygulandı; kastettiğiniz değer olduğunu kontrol edin.",
         "thresholdNotCarried": "Farklı bir sorgu seçtiğiniz için grafikteki {value} eşiği uygulanmadı.",
-        "rumFunnelExclusions": "Şu anki haliyle bu uygulamanın uygulama filtrelerini kullanır; değiştikten sonra yeniden oluşturun."
+        "rumFunnelExclusions": "Şu anki haliyle bu uygulamanın uygulama filtrelerini kullanır; değiştikten sonra yeniden oluşturun.",
+        "tracesSeedMatches": "{minutes} dk içindeki eşleşen span sayısı {threshold} değerini aştığında tetiklenir (şu an {current}).",
+        "tracesSeedSpans": "{minutes} dk içindeki span sayısı {threshold} değerini aştığında tetiklenir (şu an {current}).",
+        "tracesSeedTraces": "{minutes} dk içindeki iz sayısı {threshold} değerini aştığında tetiklenir (şu an {current}).",
+        "tracesSeedErrorSpans": "{minutes} dk içindeki hatalı span sayısı {threshold} değerini aştığında tetiklenir (şu an {current}).",
+        "tracesSeedErrorTraces": "{minutes} dk içindeki hata içeren iz sayısı {threshold} değerini aştığında tetiklenir (şu an {current}).",
+        "tracesSeedErrorRatio": "{minutes} dk içindeki hata oranı %{threshold} değerini aştığında tetiklenir (şu an %{current}).",
+        "tracesErrorRatioMinSpans": "Yalnızca en az {minimum} span içeren pencereleri kontrol eder; böylece sakin bir dönemdeki birkaç hata tetikleme yapmaz.",
+        "tracesErrorRatioMinTraces": "Yalnızca en az {minimum} iz içeren pencereleri kontrol eder; böylece sakin bir dönemdeki birkaç hata tetikleme yapmaz.",
+        "tracesSeedDuration": "{minutes} dk üzerinden {percentile} süresi {threshold} ms üzerinde olduğunda tetiklenir (şu an {current} ms).",
+        "tracesSeedUnavailable": "Mevcut değer okunamadı, bu nedenle eşik 0'dan başlıyor. Kaydetmeden önce ayarlayın.",
+        "tracesNoMatches": "Henüz eşleşen span yok; bu nedenle bir tane göründüğü anda uyarı tetiklenir.",
+        "tracesStoredSpans": "Sayımlar saklanan span'lere aittir; bu nedenle örneklenmiş trafik gerçekte olduğundan düşük görünür.",
+        "tracesPeriodCapped": "Her kontrolün hızlı kalması için uyarı penceresi {minutes} dakika ile sınırlandırıldı.",
+        "tracesNotRun": "Bu arama henüz çalıştırılmadı; bu nedenle uyarı düzenleyicideki filtreyi kullanır."
       }
     },
     "saveFailed": "Uyarı kaydedilemedi.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Mevcut filtrelerle eşleşen metrik yok",
       "noMatchHint": "Bir etiket filtresini kaldırmayı, ön ek/son ek seçimlerini temizlemeyi veya “Veri ile”den “Tümü”ne geçmeyi deneyin.",
       "noMatchHintFavorites": "Bir etiket filtresini kaldırmayı veya \"Veriyle\"den \"Tümü\"ne geçmeyi deneyin.",
+      "noMatchYet": "Henüz verisi olan metrik bulunamadı",
+      "noMatchYetHint": "Şu ana kadar kontrol edilen metrikler veri döndürmedi. Aramaya devam etmek için daha fazla göster.",
       "clearAllFilters": "Tüm filtreleri temizle",
       "emptyActions": {
         "clearSearch": "Aramayı temizle",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Panel panoya eklendi",
       "errorAddingPanel": "Panel eklenirken hata oluştu",
       "selectDashboard": "Lütfen bir pano seçin",
-      "selectTab": "Lütfen bir sekme seçin"
+      "selectTab": "Lütfen bir sekme seçin",
+      "panelsToAdd": "Eklenecek paneller"
     },
     "groups": {
       "compute": "Hesaplama",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Diğerleri"
   },
   "traces": {
+    "nlNeedsSql": "Bu soru SQL gerektiriyor; Günlükler'de açın",
+    "redActions": {
+      "menuGroupDashboards": "Gösterge panoları",
+      "addRedToDashboard": "RED grafiklerini gösterge panosuna ekle",
+      "durationActions": "Süre işlemleri",
+      "bucketNotice": {
+        "seconds": "Bu grafikler şu anda gördüğünüz {count} saniyelik çubukları korur.",
+        "minutes": "Bu grafikler şu anda gördüğünüz {count} dakikalık çubukları korur.",
+        "hours": "Bu grafikler şu anda gördüğünüz {count} saatlik çubukları korur.",
+        "days": "Bu grafikler şu anda gördüğünüz {count} günlük çubukları korur."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Bu grafik şu anda gördüğünüz {count} saniyelik çubukları korur.",
+        "minutes": "Bu grafik şu anda gördüğünüz {count} dakikalık çubukları korur.",
+        "hours": "Bu grafik şu anda gördüğünüz {count} saatlik çubukları korur.",
+        "days": "Bu grafik şu anda gördüğünüz {count} günlük çubukları korur."
+      }
+    },
     "latencyHeatmap": {
       "title": "Süre",
       "tooltipSpans": "{count} Span | {count} Span",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Sonraki eşleşme",
     "searchInSpans": "Spanlarda ara",
     "criticalPath": "Kritik yol",
+    "askAi": {
+      "explainTrace": "İzi açıkla",
+      "explainTraceHint": "Kritik yoldaki en yavaş span'ler ve tüm hatalı span'ler hakkında yapay zekaya sor",
+      "askAboutSpan": "Bu span hakkında yapay zekaya sor",
+      "spanChip": "Span · {operation}",
+      "traceChip": "İz · {operation}"
+    },
     "spansTableView": "Spanlar Tablo Görünümü",
     "comingSoon": "Yakında...",
     "fetchingTrace": "İziniz getiriliyor.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Hataları filtrele",
         "resetFilters": "Filtreleri Sıfırla",
         "errorsNone": "Hata Yok · {total} Dönüş",
-        "latencyLead": "En yavaş {slowest} ·",
+        "latencyLead": "Ort. Tur {avg} · En Yavaş {slowest} ·",
         "costLead": "Zirve {peak} ·",
         "tokens": "{ratio} %Önbelleğe alındı",
         "cacheImpact": "%{ratio} yeniden kullanıldı · {tokens} token okundu",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Veri yok",
       "noErrorsInRange": "Bu zaman aralığında hata yok",
+      "loadFailed": "Son hatalar yüklenemedi",
       "time": "Zaman",
       "service": "Hizmet",
       "operation": "İşlem",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Her zaman aktif (varsayılan)",
     "testAtTimeLabel": "UTC saatinde test et",
     "testAtTimeHint": "Boş bırakılırsa geçerli saat kullanılır. Tepe / tepe dışı katmanlar bu saate göre belirlenir.",
-    "localTimeHint": "Saat diliminizde: {range}"
+    "localTimeHint": "Saat diliminizde: {range}",
+    "builtInStatus": {
+      "seed": "Yerleşik fiyatlar: bu sürümle birlikte gelen, {date} tarihli başlangıç listesi.",
+      "neverSynced": "Sunucu başladığından beri çevrimiçi eşitleme çalışmadı.",
+      "lastSynced": "Son çevrimiçi eşitleme {time}."
+    },
+    "unpriced": {
+      "title": "Fiyatlandırma boşlukları",
+      "subtitle": "LLM izlerinizde veri alımı sırasında fiyatı olmayan veya yalnızca yaklaşık fiyatı olan modeller",
+      "banner": "{count} modelin veri alımı sırasında fiyatı yoktu veya yaklaşık bir fiyatı vardı. Kaydedilen maliyeti eksik olabilir. | {count} modelin veri alımı sırasında fiyatı yoktu veya yaklaşık bir fiyatı vardı. Kaydedilen maliyetleri eksik olabilir.",
+      "bannerTruncated": "İzlerinizdeki {total} modelin veri alımı sırasında fiyatı yoktu veya yaklaşık bir fiyatı vardı. Maliyetleri hatalı olabilir. Token sayısına göre en üst {shown} tanesi gösteriliyor.",
+      "streamLabel": "Akış",
+      "window": "Son 24 saat",
+      "windowRange": "{from} – {to}",
+      "colModel": "İzlerde görülen model",
+      "colPricedAs": "Fiyatlandırıldığı ad",
+      "colTokens": "Tokenlar",
+      "colCost": "Kaydedilen maliyet",
+      "colActions": "İşlemler",
+      "spans": "{count} span | {count} span",
+      "moreAgents": "+{count} tane daha",
+      "noMatch": "Eşleşme yok",
+      "approximate": "Yaklaşık",
+      "pricedNow": "Yeni spanlar için fiyatlandırıldı",
+      "historicalGap": "Bu pencere kaydedilmiş fiyat boşluğunu korur. Yeni spanlar güncel fiyatı kullanır.",
+      "noActionNeeded": "İşlem gerekmiyor",
+      "defaultTierPrices": "1M başına giriş {input} / çıkış {output}",
+      "notPriced": "fiyatlandırılmadı",
+      "createPrice": "Fiyat oluştur",
+      "keepPrices": "{name} fiyatlarını koru",
+      "mute": "Sessize al",
+      "muteConfirmTitle": "Bu model sessize alınsın mı?",
+      "muteConfirmMessage": "{model} için yeni spanlar ücretsiz olarak fiyatlandırılacak. Daha eski spanlar kaydedilmiş maliyetlerini korur. Sessizden çıkarmak için \"{name}\" fiyatını silin.",
+      "mutedNotif": "{model} sessize alındı",
+      "keptNotif": "{model} artık {name} fiyatlarını kullanıyor",
+      "errSave": "Fiyat kaydedilemedi",
+      "errLoad": "Fiyatlandırılmamış modeller yüklenemedi",
+      "emptyTitle": "Bu akışta bu pencerede fiyatlandırılmamış veya yaklaşık fiyatlı model kullanımı kaydedilmedi.",
+      "noStreamsTitle": "LLM iz akışı yok",
+      "noStreamsDesc": "gen_ai spanları bir iz akışına ulaştığında modeller burada görünür.",
+      "recordedCostNote": "Yeni fiyatlar, kaydettikten sonra alınan spanlar için geçerli olur. Daha eski spanlar kaydedilmiş maliyetlerini korur.",
+      "noModelName": "(model adı yok)",
+      "noModelHint": "Fiyatlandırılacak model yok: gen_ai.request.model ayarlayın",
+      "instrumentationDocs": "Enstrümantasyon kılavuzu"
+    }
   },
   "aiObservability": {
     "title": "LLM Gözlemlenebilirlik",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Atlanan satırlar: {full} tamamen · {partial} kısmen",
       "scoreEvidence": "{scorer} · v{version}: {samples} örnek, {noReference} referans yok, {noTrace} iz yok",
       "scorerApplicability": "{scorer} · v{version}: {eligible} uygun slot, {noReference} referanssız",
+      "costUnknown": "maliyet bilinmiyor",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Deneyler yüklenemedi",
       "previewError": "Deney slotları önizlenemedi",
       "createSuccess": "Deney oluşturuldu",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Bu deneyin maliyetinin yaklaşık {cost} olacağı tahmin ediliyor ve bu, {threshold} uyarı eşiğinin üzerinde. Yine de oluşturulup çalıştırılsın mı?",
         "costConfirmMessageUnpriced": "Bu deneyin tahmini maliyeti uyarı eşiğini aşıyor. Yine de oluşturup çalıştırılsın mı?",
         "costConfirmOk": "Yine de Oluştur",
+        "taskProviderFailed": "Hiçbir şey oluşturulmadı. Görev sağlayıcısı {provider} test çağrısına yanıt vermedi.",
+        "judgeProviderFailed": "Hiçbir şey oluşturulmadı. Hakem sağlayıcısı {provider} test çağrısına yanıt vermedi.",
         "skippedFully": "{count} satır tamamen atlandı — seçilen her puanlayıcı beklenen bir çıktı gerektirir. Atlanan satırların çalıştırılması hiçbir maliyet gerektirmez.",
         "skippedPartially": "{count} satır kısmen atlandı — görev yine de çalışır, ancak referans tabanlı puanlayıcılar beklenen çıktısı olmayan satırları puanlayamaz.",
         "skippedNone": "Eşleşen her satır en az bir boyutta puanlanabilir.",
@@ -17408,7 +17851,26 @@
           "trials": "Denemeler",
           "dispersion": "Dağılım",
           "latency": "Gecikme",
-          "p50Latency": "P50 Gecikme"
+          "p50Latency": "P50 Gecikme",
+          "error": "Hata"
+        },
+        "failureBanner": {
+          "title": "{total} slotun {failed} tanesi başarısız oldu: {cause}.",
+          "cause": "En yaygın neden, {count} slot: {message}",
+          "moreCauses": "+ {count} neden daha",
+          "noMessage": "hata mesajı kaydedilmedi",
+          "openProviders": "Sağlayıcıları Aç"
+        },
+        "failureKinds": {
+          "provider_auth": "sağlayıcı kimlik bilgilerini reddetti",
+          "rate_limited": "sağlayıcı çalıştırmaya hız sınırı uyguladı",
+          "timeout": "sağlayıcı zamanında yanıt vermedi",
+          "provider_5xx": "sağlayıcı bir sunucu hatası döndürdü",
+          "parse_error": "çıktı ayrıştırılamadı",
+          "mapping_error": "görev girdisi oluşturulamadı",
+          "scorer_missing": "bir puanlayıcı artık mevcut değil",
+          "execution_error": "görev çağrısı başarısız oldu",
+          "unknown": "görev çağrısı başarısız oldu"
         },
         "saveAsPrompt": "Prompt olarak kaydet",
         "openPrompt": "Prompt'u aç",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Ortam",
       "agent": "Ajan",
-      "version": "Sürüm"
+      "version": "Sürüm",
+      "agentIdHint": "Ajan Kimliği: {ids}",
+      "noAgentIdentity": "Ajan kimliği bulunamadı",
+      "noAgentIdentityDescription": "Bu LLM span'lerinde ajan adı yok, bu nedenle akışa göre gösteriliyorlar. Ajanınızı adlandıran özniteliği eşleyerek bunları ajana göre görüntüleyin.",
+      "noAgentIdentityAction": "GenAI Ajan Eşlemesini Aç"
     },
     "agentGraph": {
       "stream": "Akış",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Değerlendirmeler bu sunucuda devre dışı",
+      "description": "Bu sayfa, bu sunucuda kapatılmış olan çevrimiçi değerlendirmeleri gerektirir. Etkinleştirmeleri için yöneticinize başvurun."
+    },
     "traceScoreChip": {
       "reasoning": "Neden",
       "noReasoning": "Bu puan için gerekçe kaydedilmedi.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Uç Noktayı Yapılandır"
     },
     "provider": {
-      "backTo": "Sağlayıcılara Geri Dön",
+      "backTo": "Sağlayıcılar",
       "createTitle": "LLM Sağlayıcısı Oluştur",
       "editTitle": "LLM Sağlayıcısını Düzenle",
       "subtitle": "LLM hakemi puanlayıcılarının kullandığı model uç noktasını yapılandırın.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Puanlayıcı {index}: \"{name}\" adı bu içe aktarmada birden fazla kez kullanılıyor"
         }
       },
-      "backTo": "Puanlayıcılara geri dön",
+      "backTo": "Puanlayıcılar",
       "badgeRemote": "Uzaktan",
       "badgeLlm": "LLM Hakemi",
       "createTitleRemote": "Yeni Uzaktan Puanlayıcı",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Sağlayıcı seçin",
       "modelLabel": "Modeli",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Sıcaklık",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 ile 2 arası. 0'da değerlendirmek için boş bırakın.",
       "promptLabel": "Hakem istemi",
       "includeReasoningLabel": "Gerekçeyi Dahil Et",
       "includeReasoningHint": "Hakem, bu puanı neden verdiğini açıklar ve her sonuçla birlikte kaydedilir.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Başlık adı gereklidir",
         "apiKeyTokenRequired": "Token gereklidir",
         "timeoutInvalid": "Zaman aşımı 0 veya daha büyük olmalıdır",
+        "temperatureInvalid": "Sıcaklık 0 ile 2 arasında olmalıdır",
         "retriesInvalid": "Yeniden deneme sayısı 0 veya daha büyük olmalıdır",
         "duplicateFieldName": "Alan adları benzersiz olmalıdır"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Bozulmuş",
         "waitingForCredentials": "Kimlik bilgileri bekleniyor",
         "noRecentRuns": "Yakın zamanda çalıştırma yok",
+        "lastScored": "Son puanlama {time}",
         "summary": "Son 15 dakikada {runs} çalıştırmanın {errors} tanesi başarısız oldu",
         "since": "{time} bu duruma geçti",
         "checked": "Son kontrol: {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Eşleşen hedeflerin %{percent}'ini değerlendirir.",
       "samplingValueAllHelp": "Eşleşen her hedef değerlendirilir.",
       "samplingHelp": "Maliyeti kontrol etmek için filtrelemeden sonra çalışır.",
-      "backTo": "Değerlendirme İşlerine geri dön",
+      "backTo": "Değerlendirme İşleri",
       "createTitle": "Yeni Değerlendirme İşi",
       "editTitle": "Değerlendirme İşini Güncelle",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Bu dal zaten bir Hedef ile bitiyor.",
       "chooseATriggerNodeToStart": "İş akışınızı başlatmak için bir tetikleyici düğüm seçin",
       "thisConnectionWouldCreateALoop": "Bu bağlantı bir döngü oluşturur",
-      "onlyOneIncomingConnectionToA": "Bir adıma yalnızca bir gelen bağlantı izin verilir"
+      "onlyOneIncomingConnectionToA": "Bir adıma yalnızca bir gelen bağlantı izin verilir",
+      "endpointUrlCopied": "Uç nokta URL'si kopyalandı"
     },
     "views": {
       "youAreNotAuthorizedToManage": "Lisansı yönetme yetkiniz yok.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Veritabanı veya hizmet ara…",
       "unnamedInstance": "Örnek adlandırılmamış",
+      "schemaCount": "{count} şema | {count} şema",
       "unnamedInstanceHint": "Veritabanının kendi ifade raporları bu motorun çalıştığını kanıtlıyor, ancak bir ana bilgisayar adı vermiyorlar. Satır, bir adres taşıyan bir akış — oturum örnekleme veya örnek ölçümleri — kurulduğunda bir adres gösterecek.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "{time} saatine kadar sayıldı; son yarım dakika hâlâ işleniyor.",
       "lineExact": "Tüm veritabanları raporluyor. Buradaki hızlar her çağrı üzerinden ölçülür, bu yüzden tamdırlar.",
       "lineExactEstimated": "Tüm veritabanları raporluyor. Buradaki hızlar birkaç zaman diliminden harmanlanır, bu yüzden yaklaşıktır ancak tam değildir.",
+      "lineExactSlowestSchema": "Tüm veritabanları rapor veriyor. Hızlar şema başına kesindir; birden çok şeması olan bir veritabanı en yavaş olanı gösterir.",
       "lineSubsetUnnamed": "Filtreleriniz bunu bu toplamların toplandığı seviyenin altına daraltıyor, bu yüzden yüzdeler tüm veritabanı yerine gösterilen satırları tanımlıyor.",
       "lineQuery": "Zamanlamalar uygulamanızdan ölçülür, bu yüzden ağ süresini ve boş bir bağlantı için bekleme süresini içerir.",
       "lineUncodedErrors": "Buradaki hataların %{percent}'i bir neden kodu olmadan döndü, bu yüzden sayılabilirler ancak açıklanamazlar.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "Bu uyarı ilk kez tetiklendi.",
     "escalationNotStarted": "Henüz çağrı yapılmadı",
     "escalationPagesNobody": "Kimseyi çağırmaz",
+    "escalationNobodyPaged": "Kimseye çağrı gönderilmiyor",
     "escalationTo": "{who} kişisine {when} eskalasyon yapılır",
     "escalationDetailCapped": "Canlı eskalasyon ayrıntısı, en eski {count} açık çağrı için yüklenir.",
     "responder": "Yanıtlayan",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "Bitiş",
     "rotationRestrictionAdd": "Zaman aralığı ekle",
     "rotationRestrictionRemove": "Kaldır",
-    "rotationRestrictionZeroLength": "Başlangıç ve Bitiş aynı olduğundan bu aralık asla eşleşmez ve katman sessizce hiçbir zaman etkinleşmez. Tam gün için Bitiş'i 24:00 yapın.",
+    "rotationRestrictionZeroLength": "Başlangıç ve Bitiş aynı olduğundan bu pencere hiçbir zaman eşleşmez. Başlangıç ve Bitiş farklı olana kadar Kaydet kapalı kalır; tam gün için Bitiş'i 24:00 yapın.",
     "rotationRetiredTag": "Kullanımdan kaldırıldı",
     "rotationSectionWhen": "Devir zamanı",
     "rotationName": "Rotasyon adı",
@@ -25593,6 +26072,10 @@
     "snoozed": "Ertelendi",
     "snoozedUntil": "{time} kadar sessiz — hâlâ atanmamış",
     "snoozeFailed": "Çağrı ertelenemedi",
+    "unsnooze": "Ertelemeyi Bitir",
+    "unsnoozeHint": "Ertelemeyi şimdi bitirir. Çağrı gönderme, durakladığı adımdan devam eder.",
+    "unsnoozed": "Erteleme bitti · çağrı gönderme devam ediyor",
+    "unsnoozeFailed": "Erteleme bitirilemedi",
     "note": "Not",
     "notePlaceholder": "Ne buldun? Ne denedin?",
     "addNote": "Not ekle",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Aynı kişiler bir vardiya kaydırılmıştır; böylece ikincil, zaten nöbette olan kişi asla olmaz. Bu normal bir rotasyondur — ikisini bağlayan hiçbir şey yoktur; bu yüzden bir listeyi düzenleyip diğerini düzenlemezsen, listeler birbirinden sapar ve sessiz bir düzeltme yerine bir uyarı alırsın.",
     "rotationPreviewPairLegend": "Birincil · İkincil",
     "rotationPreviewEmpty": "Kimin ne zaman nöbette olduğunu görmek için kişileri ve bir ilk deviri seç.",
+    "rotationPreviewNow": "Şimdi – {until}",
     "defaultRotationName": "Rotasyon",
     "teamCreatedWithoutMembers": "Ekip oluşturuldu, ancak üyeleri eklenemedi. Onları Üyeler sekmesinden ekle.",
     "teamCreatedWithoutRotation": "Ekip ve üyeleri oluşturuldu, ancak rotasyon kaydedilemedi. Rotasyonu Zamanlama sekmesinde ayarla.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "kimse onaylamadı — bunlar hâlâ arıyor",
     "sectionHint_ringingRouted": "kimse üstlenmedi — bunlardan {count} tanesi hâlâ çağrı gönderiyor | kimse üstlenmedi — bunlardan {count} tanesi hâlâ çağrı gönderiyor",
     "sectionHint_ringingUnrouted": "{count} tanesinin ekibi yok, bu yüzden çağrı göndermiyor | {count} tanesinin ekibi yok, bu yüzden çağrı göndermiyor",
+    "sectionHint_ringingStopped": "{count} kişiye çağrı gönderilmiyor | {count} kişiye çağrı gönderilmiyor",
     "sectionHint_snoozed": "çağrılar duraklatıldı — kendiliğinden geri gelirler",
     "sectionHint_handled": "onaylandı — her birini bir insan üstlendi",
     "sectionHint_resolved": "kapatıldı — kayıt için saklanıyor",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "Bir sinyal eşleştiğinde çağrılan ekip. Kendi eskalasyon merdiveni, kimin hangi sırayla uyandırılacağını belirler.",
     "scopeOwns": "Bu ekip sahiplenir",
     "scopeAdvanced": "Gelişmiş",
-    "ruleEditorConflictUnclaimed": "Bugün hiçbir şey bu yolu sahiplenmiyor — onu eşleştiren bir çağrı catch-all'e ya da kimseye ulaşmaz.",
+    "ruleEditorConflictUnclaimed": "Bugün bu yolu sahiplenen bir şey yok — yalnızca bu koşullara göre değerlendirildiğinde, bununla eşleşen bir çağrı catch-all kuralına ulaşır ya da hiç kimseye ulaşmaz.",
     "ruleEditorConflictHeldBy": "Bugün bununla eşleşen bir çağrı {path} yoluyla {team} ekibine gider.",
     "ruleEditorConflictTakesOver": "Sizinki daha fazla koşul belirliyor, bu yüzden bunları {team} ekibinden alır.",
     "ruleEditorConflictKeptBy": "{team} tarafından tutulan yol daha fazla koşul belirliyor, bu yüzden bunları korur ve bu kural yalnızca kalanı yakalar.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} bu ekibi yalnızca {scope} içinde çağırır. Başka yerlerde, çevresindeki kapsamın sahibine düşer.",
     "scopeNothingDiscovered": "Henüz hiçbir şey keşfedilmedi, bu yüzden seçebileceğiniz bir alan yok. Kuralı alana göre yazmak için Gelişmiş'i kullanın veya önce biraz telemetri gönderin.",
     "scopeAdvancedHint": "Üst seviyelerin kapsamadığı alan ve değerler de dahil olmak üzere herhangi bir alan ve değerle eşleştirin.",
+    "scopeValuesSeen": "Bu listeler, hizmet keşfinin gördüğü değerleri gösterir. Başka bir değerle eşleştirmek için Gelişmiş'i kullanın.",
     "escalationHeld": "Önce Yapay Zeka triyajı · en geç {n} sn içinde çağrı",
     "escalationPagingStep": "Çağrılıyor: kademe {step}/{total} · {who}",
     "escalationPagingStepOnly": "Çağrılıyor: kademe {step}/{total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Ekip ve rotasyon oluştur",
     "removeMemberHandsOver": "{rotation} içinde {leaving} kişisinin mevcut nöbetini {name} devralır.",
     "removeMemberLeavesGap": "{rotation} içinde {leaving} kişisinin mevcut nöbetini kimse devralmaz.",
+    "removeMemberReorders": "Ayrıca {rotations} rotasyonlarından da çıkarlar; bu nedenle orada nöbette kimin olduğu da değişebilir.",
     "membersJoinEnd": "{names}, {rotations} sonuna eklenir. Şu an nöbette olan kişi değişmez. | {names}, {rotations} sonuna eklenir. Şu an nöbette olan kişi değişmez.",
     "membersAdded": "{names} eklendi. | {names} eklendi.",
     "removeMemberConfirm": "Kaldır",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Sorular: {contact}",
       "outboundQueue": "Uyarı mesajları: {count} kuyrukta, en eskisi {age} | Uyarı mesajları: {count} kuyrukta, en eskisi {age}",
       "outboundEmpty": "Kuyrukta uyarı mesajı yok",
+      "refusedPosts": "{count} uyarı gönderisi son 24 saatte başarısız oldu. Son: {destination} üzerinde {reason}, | {count} uyarı gönderisi son 24 saatte başarısız oldu. Son: {destination} üzerinde {reason},",
       "ageSeconds": "{count} sn"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "Hatırlatmalar gönderilemedi."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(model adı yok)",
+    "topModels": "{models} (ilk {shown} / {total})",
+    "cost": {
+      "partial": "kısmi",
+      "unknown": "maliyet bilinmiyor",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Kısmi maliyet. {models} için fiyat yok: bu {scope} içindeki {tokens} token hesaba katılmadı.",
+      "unknownTooltip": "Maliyet bilinmiyor. {models} için fiyat yok: bu {scope} içindeki {tokens} token'ın hiçbirinde maliyet yok.",
+      "scopeSession": "oturum",
+      "scopeTrace": "iz",
+      "unknownModel": "adsız bir model",
+      "addPrice": "Fiyat ekle"
+    },
+    "tile": {
+      "unpricedTokens": "Fiyatlandırılmamış {tokens} token",
+      "unpricedTooltip": "Maliyet bir alt sınırdır: {models} üzerindeki {tokens} tokenin fiyatı yok. LLM Model Fiyatlandırması'nda Fiyatlandırılmamış sekmesini açın.",
+      "pricedSinceTooltip": "Maliyet bir alt sınırdır: {models} üzerindeki {tokens} token, fiyat eklenmeden önce kaydedildi ve maliyetsiz kalır."
+    },
+    "chart": {
+      "costMissing": "Bu grafikte yok: {models}. {tokens} tokenin fiyatı yok.",
+      "costMissingPricedSince": "Bu grafikte yok: {models}. {tokens} token, fiyat eklenmeden önce kaydedildi.",
+      "unpricedModels": "Fiyatlandırılmamış: {models}",
+      "pricedSinceModels": "Fiyat eklenmeden önce kaydedilenler: {models}",
+      "addPrice": "Fiyat ekle"
+    },
+    "health": {
+      "title": "Veri sağlığı",
+      "passing": "{n} başarılı",
+      "checkedAgo": "{ago} kontrol edildi",
+      "drawerTitle": "Yapay Zeka Veri Sağlığı",
+      "drawerSubtitle": "{stream} · geçerli pencere",
+      "rerun": "Kontrolleri yeniden çalıştır",
+      "close": "Kapat",
+      "loadError": "Veri sağlığı kontrolleri çalıştırılamadı.",
+      "samples": "Örnekler:",
+      "copyLink": "Yönetici için bağlantıyı kopyala",
+      "linkCopied": "Bağlantı kopyalandı",
+      "status": {
+        "pass": "Başarılı",
+        "warning": "Uyarı",
+        "error": "Hata"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Fiyatlandırılmamış modeller",
+          "detail": "{count} model · {spans} span · {tokens} token $0 olarak sayıldı | {count} model · {spans} span · {tokens} token $0 olarak sayıldı",
+          "pass": "Bu penceredeki her modelin bir fiyatı var. Fiyat eklenmeden önce kaydedilen span'ler kaydedilmiş maliyetlerini korur.",
+          "fix": "LLM Model Fiyatlandırması'nda düzelt",
+          "truncated": "Token bazında ilk {shown}/{total}"
+        },
+        "missing_agent_identity": {
+          "label": "Eksik ajan kimliği",
+          "detail": "{total} LLM span'inden {affected} tanesinde ({pct}) gen_ai.agent.name yok, bu nedenle ajan görünümleri bunları kaçırır.",
+          "pass": "Her LLM span'i bir ajan adı veya kimliği taşır.",
+          "fix": "GenAI Ajan Eşlemesini aç"
+        },
+        "zero_duration_spans": {
+          "label": "Sıfır süreli span'ler",
+          "detail": "{affected} LLM span'i 0 ms bildiriyor, bu nedenle gecikme ve oturum süresi olduğundan düşük görünüyor.",
+          "pass": "Hiçbir LLM span'i 0 ms bildirmiyor.",
+          "fix": "Nasıl düzeltilir"
+        },
+        "missing_session_id": {
+          "label": "Oturum kimliği olmayan span'ler",
+          "detail": "{total} LLM span'inden {affected} tanesinde ({pct}) gen_ai.conversation.id yok, bu nedenle Oturumlar bunları kaçırır.",
+          "pass": "Her LLM span'inde gen_ai.conversation.id var.",
+          "fix": "Entegrasyon kılavuzu"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Filo yönetimi",
     "subtitle": "OpenTelemetry toplayıcılarını kaydedin, yapılandırmalarını sürümleyin ve değişiklikleri güvenle dağıtın",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "Devam ediyor",
       "scheduled": "Zamanlandı",
+      "waiting": "Bekliyor",
       "completed": "Tamamlandı",
       "halted": "Durduruldu",
       "superseded": "Yerine yenisi geçti",
@@ -28696,7 +29257,7 @@
       "version": "Sürüm",
       "pickConfig": "Bir yapılandırma seçin",
       "pickFleet": "Bir filo seçin",
-      "emptyFleet": "Filoda toplayıcı olmadığından sürüm hemen ayarlanır",
+      "emptyFleet": "Filoda hiç toplayıcı yok, bu nedenle dağıtım bir toplayıcı katılana kadar bekler",
       "startingShortly": "Birazdan başlıyor",
       "eventGateFailed": "Sağlık kapısı başarısız oldu",
       "eventHalted": "Durduruldu",
@@ -28707,7 +29268,10 @@
       "notFound": "Bu dağıtım artık mevcut değil",
       "notFoundDescription": "Bağlantı eski olabilir. Listeden bir dağıtım seçin.",
       "noneTargeted": "Hedeflenen toplayıcı yok",
-      "outcomeNoneTargeted": "v{to} ayarlandığında filoda toplayıcı yoktu.",
+      "outcomeNoneTargeted": "Bu dağıtımda hiçbir toplayıcı v{to} sürümünü almadı.",
+      "outcomeWaiting": "Hiçbir toplayıcı çevrimiçi değil, bu nedenle v{to} henüz hiçbirine gitmedi. Bir toplayıcı bağlandığında dağıtım başlar.",
+      "waitingForCollector": "Bir toplayıcı bekleniyor",
+      "notStarted": "Başlamadı",
       "versionFailedBefore": "v{version} · daha önce başarısız oldu",
       "pickVersion": "Bir sürüm seçin",
       "autoRollback": "Otomatik geri al",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Devam ettirildi",
       "eventSkipped": "Başarısız toplayıcılar atlandı",
       "eventStarted": "Başlatıldı",
+      "eventWaiting": "Bir toplayıcının çevrimiçi olması bekleniyor",
       "eventTimedOut": "Aşama zaman aşımına uğradı",
       "eventSkippedOffline": "Başlangıçta çevrimdışı olan {count} toplayıcı dışarıda bırakıldı; yeniden bağlandığında sürümü alacak | Başlangıçta çevrimdışı olan {count} toplayıcı dışarıda bırakıldı; yeniden bağlandıklarında sürümü alacaklar",
       "excluded": "Hariç tutuldu",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "{minutes} dk içinde ne onaylanan ne de reddedilen bir aşama dağıtımı durdurur (filo ayarı)",
       "phaseVerifying": "Doğrulanıyor",
       "phases": "Aşamalar",
-      "planEmpty": "Güncellenecek toplayıcı yok",
+      "planEmpty": "Hiçbir toplayıcı çevrimiçi değil, bu nedenle dağıtım bir toplayıcı bağlanana kadar bekler",
+      "planStable": "Hiçbir toplayıcı çevrimiçi değil; kararlı sürüm, her biri bağlandığında o toplayıcıya uygulanır",
       "planOne": "Tek grupta {count} toplayıcı | Tek grupta {count} toplayıcı",
       "planText": "{steps} → kalan {last}, {count} aşama",
       "planUnavailable": "Plan önizlemesi kullanılamıyor",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0, çevrimdışı toplayıcıları sonsuza dek tutar"
     },
     "audit": {
-      "search": "Denetim izinde ara",
       "editedConfig": "Yapılandırma düzenlendi",
       "revokedToken": "Kayıt token'ı iptal edildi",
       "enrolledCollector": "Toplayıcı kaydedildi",
@@ -28920,7 +29485,6 @@
       "setDesired": "Sürüm değiştirildi",
       "autoRollback": "Otomatik olarak geri alındı",
       "rolloutHalted": "Dağıtım durduruldu",
-      "assignedFleetConfig": "Filonun yapılandırması atandı",
       "createdFleet": "Filo oluşturuldu",
       "renamedFleet": "Filo yeniden adlandırıldı",
       "deletedFleet": "Filo silindi",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Dağıtım geri alındı",
       "movedByToken": "Kayıt token'ı ile taşındı",
       "object": "Nesne",
+      "search": "Denetim izinde ara",
       "allObjects": "Tüm nesneler",
       "kind": {
         "fleet": "Filo",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "v{to} dağıtılıyor",
       "rolloutHalted": "v{to} dağıtımı durduruldu",
+      "rolloutWaiting": "v{to}, bir toplayıcının çevrimiçi olmasını bekliyor",
       "autoRolledBack": "v{to} otomatik olarak geri alındı",
       "noReason": "Bildirilen hata nedeni yok",
       "openRollout": "Dağıtımı aç",
diff --git a/web/src/locales/languages/vi-VN.json b/web/src/locales/languages/vi-VN.json
index 1d9d707266..196de8da8a 100644
--- a/web/src/locales/languages/vi-VN.json
+++ b/web/src/locales/languages/vi-VN.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "Chưa có hoạt động LLM nào",
       "description": "Hãy cài đặt đo lường cho dịch vụ của bạn bằng các quy ước ngữ nghĩa Gen-AI của OpenTelemetry và tiếp nhận ít nhất một trace để điền dữ liệu vào bảng điều khiển này.",
-      "action": "Trang bị với OpenTelemetry",
-      "actionDesc": "Thu thập các thuộc tính gen_ai_* trên trace của bạn."
+      "action": "Tất cả tích hợp AI",
+      "actionDesc": "Xem hướng dẫn của mọi framework và nhà cung cấp",
+      "suggested": "Thiết lập trace cho {name}",
+      "suggestedDesc": "Được đề xuất vì bạn đến từ tài liệu {name}",
+      "codingAgent": "Thêm instrumentation bằng coding agent",
+      "codingAgentDesc": "Coding agent của bạn thêm trace và kiểm tra trace đầu tiên",
+      "startFrom": "Hoặc bắt đầu từ"
     },
     "noLLMSessions": {
       "title": "Chưa có phiên LLM nào",
@@ -4797,6 +4802,13 @@
       "success": "Thành công",
       "failed": "Thất bại",
       "testRun": "Lần chạy thử",
+      "source": "Nguồn",
+      "sourceHttp": "Yêu cầu HTTP",
+      "sourceAlertFired": "Cảnh báo đã kích hoạt",
+      "sourceIncidentEvent": "Sự kiện sự cố",
+      "sourceRetry": "Lần chạy lại",
+      "sourceManual": "Lần chạy thủ công",
+      "sourceOther": "Khác",
       "runType": "Loại",
       "testRunTooltip": "Được bắt đầu từ trình soạn thảo. Các bước đích sẽ thực sự gửi đi.",
       "showTestRuns": "Hiện {count} lần chạy thử",
@@ -4810,7 +4822,33 @@
       "retryTitle": "Thử lại lần chạy này?",
       "retryMessage": "Thao tác này tạo một lần chạy mới từ đầu vào mà lần chạy thất bại đã ghi lại. Các bước đích sẽ thực sự gửi đi.",
       "retryStarted": "Đã bắt đầu thử lại — lần chạy đó sẽ xuất hiện trong danh sách như một lần chạy mới.",
-      "retryError": "Không thể thử lại lần chạy này"
+      "retryError": "Không thể thử lại lần chạy này",
+      "statusQueued": "Trong hàng đợi",
+      "statusRunning": "Đang chạy",
+      "statusExpired": "Đã hết hạn",
+      "reasonExpired": "chưa từng chạy · trong hàng đợi hơn 1 giờ",
+      "reasonWorkerLost": "mất worker · không chạy lại",
+      "reasonWorkflowDisabled": "quy trình làm việc đã bị tắt",
+      "reasonRunTimeout": "hết thời gian chờ sau 15 phút",
+      "allTriggers": "Tất cả trình kích hoạt",
+      "triggerFilter": "Trình kích hoạt",
+      "run": "Lần chạy",
+      "searchRuns": "Tìm ID lần chạy, idempotency key hoặc cảnh báo",
+      "sourceDetails": "Chi tiết nguồn",
+      "detailsWithKey": "{ip} · key {key}",
+      "detailsNoKey": "{ip} · không có idempotency key",
+      "retryOf": "Chạy lại của {run}",
+      "openRun": "Mở lần chạy",
+      "alertFiredEmptyTitle": "Không có lần chạy do cảnh báo kích hoạt trong khoảng thời gian này",
+      "incidentEventEmptyTitle": "Không có lần chạy do sự kiện sự cố trong khoảng thời gian này",
+      "filterEmptyTitle": "Không có lần chạy phù hợp trong khoảng thời gian này",
+      "filterEmptyDimmed": "Các lần chạy khác vẫn ở trên dòng thời gian, bị làm mờ.",
+      "searchEmptyTitle": "Không có lần chạy nào khớp với tìm kiếm này",
+      "searchEmptyAction": "Xóa tìm kiếm",
+      "timelineNow": "bây giờ",
+      "timelineAgoMinutes": "−{n}m",
+      "timelineAgoHours": "−{n}h",
+      "timelineAgoDays": "−{n}d"
     },
     "edit": "Sửa",
     "view": "Xem",
@@ -4958,7 +4996,9 @@
           "noMatch": "Không khớp"
         },
         "suppressed": "Đã bỏ qua — không gửi tới đích thật"
-      }
+      },
+      "payloadFrom": "Payload từ",
+      "payloadFromHint": "Dạng HTTP là những gì người gọi endpoint gửi."
     },
     "linkAlerts": {
       "title": "Liên kết quy trình với cảnh báo",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "Định dạng đầu ra",
       "tlsVerifyLabel": "Xác minh TLS",
       "tlsDisabled": "Đã tắt"
+    },
+    "http": {
+      "runTestHint": "Chạy các bước với payload HTTP mẫu; không gọi URL",
+      "runTestHintList": "Mở quy trình làm việc để chạy thử",
+      "runsEmptyTitle": "Không có yêu cầu HTTP trong khoảng thời gian này",
+      "runsEmptyBody": "Mở rộng khoảng thời gian, hoặc gửi yêu cầu thử từ panel endpoint HTTP.",
+      "runsEmptyAction": "Hiển thị tất cả trình kích hoạt",
+      "runFailedAt": "Lần chạy này thất bại tại {step}: {error}",
+      "openStep": "Mở bước",
+      "runGuardHint": "Các lần chạy HTTP mang theo yêu cầu, không phải trường cảnh báo. Nếu bước này đọc {fields}, hãy bảo vệ nó bằng một Điều kiện: {guard}.",
+      "runExpiredBanner": "Yêu cầu này đã chờ trong hàng đợi hơn 1 giờ và không bao giờ được chạy. Không bước nào chạy và không đích nào được gọi.",
+      "runWorkerLostBanner": "Worker đang chạy yêu cầu này đã dừng. Yêu cầu không được chạy lại tự động, vì các đích có thể đã được gọi đến. Hãy kiểm tra chúng trước khi người gọi gửi lại.",
+      "request": "Yêu cầu",
+      "requestReceived": "Đã nhận",
+      "requestToken": "Token",
+      "requestCallerIp": "IP người gọi",
+      "requestIdempotencyKey": "Khóa idempotency",
+      "requestContentType": "Loại nội dung",
+      "requestBodySize": "Kích thước body",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "Header",
+      "headersKept": "Đã giữ {count} · Authorization, cookie và chữ ký không bao giờ được lưu trữ | Đã giữ {count} · Authorization, cookie và chữ ký không bao giờ được lưu trữ",
+      "headerName": "Tên",
+      "headerValue": "Giá trị",
+      "outputCaption": "Những gì mọi bước sau nhận được",
+      "useAsTestInput": "Dùng làm đầu vào kiểm thử",
+      "editorButton": "Endpoint HTTP",
+      "editorButtonOn": "Bật",
+      "editorButtonOff": "Tắt",
+      "editorButtonTooltip": "Cho phép hệ thống khác khởi động quy trình làm việc này bằng yêu cầu HTTP",
+      "editorButtonRefusedDraft": "Các yêu cầu sẽ nhận 403 cho đến khi quy trình làm việc được xuất bản",
+      "editorButtonRefusedPaused": "Các yêu cầu sẽ nhận 403 khi quy trình làm việc bị tạm dừng",
+      "panelTitle": "Endpoint HTTP",
+      "panelSubtitle": "{name} · quy trình làm việc {kind}",
+      "acceptRequests": "Chấp nhận yêu cầu HTTP",
+      "kindNote": "Các bước của quy trình làm việc này được xây dựng cho các lần chạy {kind}. Các lần chạy HTTP nhận yêu cầu thay vào đó ({field}), vì vậy hãy thêm Điều kiện nếu một bước cần các trường {kind}.",
+      "kindNotePayload": "Hiển thị payload HTTP",
+      "kindNotePayloadHide": "Ẩn payload HTTP",
+      "unsavedBody": "Quy trình làm việc này chưa được lưu. Hãy lưu dưới dạng bản nháp để tạo URL và token. Các yêu cầu sẽ bị từ chối cho đến khi bạn xuất bản.",
+      "saveAndCreate": "Lưu bản nháp và tạo endpoint",
+      "needsAdmin": "Tạo endpoint cần quản trị viên tổ chức.",
+      "needsEdit": "Thay đổi endpoint cần quyền chỉnh sửa đối với quy trình làm việc này.",
+      "readOnlyOnMeta": "Bật · bạn có thể sao chép URL. Thay đổi endpoint cần quyền chỉnh sửa quy trình làm việc này.",
+      "offBody": "Cho phép hệ thống khác khởi động quy trình làm việc này bằng yêu cầu HTTP. Bạn sẽ nhận được URL và token.",
+      "offExistingBody": "Tắt · các yêu cầu bị từ chối (403) cho đến khi bạn bật lại.",
+      "onMeta": "Bật · các lần chạy chỉ bắt đầu khi quy trình làm việc được bật và xuất bản",
+      "loadError": "Không thể tải cài đặt endpoint.",
+      "draftBanner": "Quy trình làm việc này là bản nháp. Các lệnh gọi đến URL sẽ nhận 403 cho đến khi bạn xuất bản. Bạn có thể thiết lập endpoint ngay bây giờ, và Chạy thử sẽ chạy các bước của bản nháp với payload HTTP mẫu.",
+      "disabledBanner": "Các yêu cầu bị từ chối (403) cho đến khi bạn bật quy trình làm việc.",
+      "turnOnFailed": "Không thể bật endpoint. {reason}",
+      "changeFailed": "Không thể lưu endpoint. {reason}",
+      "endpointExistsHint": "Endpoint đã tồn tại. Hiển thị hoặc sao chép token của endpoint từ bảng Tokens.",
+      "endpointExistsHintSigned": "Endpoint đã tồn tại. Hiển thị hoặc sao chép signing secret của endpoint từ bảng Signing secrets.",
+      "disableTitle": "Tắt endpoint?",
+      "disableBody": "Người gọi sẽ nhận 403 (endpoint đang tắt) cho đến khi bạn bật lại. URL và token giữ nguyên.",
+      "disableConfirm": "Tắt",
+      "lastCall": "Bật · Lần gọi cuối: {status} · {time} · {link}",
+      "lastCallNone": "Bật · Chưa có lệnh gọi nào — gửi yêu cầu kiểm thử",
+      "lastCallNoneRefused": "Bật · Chưa có lệnh gọi nào",
+      "viewRun": "Xem lần chạy",
+      "lastCallStatus": {
+        "queued": "đang chờ",
+        "running": "đang chạy",
+        "succeeded": "thành công",
+        "failed": "thất bại",
+        "expired": "hết hạn"
+      },
+      "endpointUrl": "URL endpoint",
+      "tokenLabel": "Token",
+      "secretLabel": "Secret ký",
+      "newTokenLabel": "Token mới",
+      "newSecretLabel": "Secret ký mới",
+      "tokenHint": "Được ẩn trên màn hình; thao tác Sao chép sẽ sao chép token thật. Gửi nó dưới dạng {header}, không bao giờ trong URL.",
+      "secretHint": "Được ẩn trên màn hình; thao tác Sao chép sẽ sao chép secret thật. Ký từng yêu cầu bằng secret này và gửi các header {headers}; không bao giờ gửi chính secret.",
+      "revealBannerTitle": "Đã tạo endpoint",
+      "revealBannerBody": "Gửi token này với mọi yêu cầu. Bạn có thể hiển thị hoặc sao chép lại từ bảng Token.",
+      "revealBannerBodySigned": "Ký mọi yêu cầu bằng secret này. Bạn có thể hiển thị hoặc sao chép lại từ bảng Secret ký.",
+      "switchedBannerTitle": "Đã tạo token",
+      "switchedBannerTitleSigned": "Đã tạo secret ký",
+      "rotateBannerTitle": "Đã tạo token mới",
+      "rotateBannerTitleSigned": "Đã tạo secret ký mới",
+      "rotateBannerBody": "Bên gọi giữ nguyên URL và header; chỉ token thay đổi. Token cũ vẫn hoạt động cho đến khi hết hạn và có thể được hiển thị cho đến lúc đó.",
+      "rotateBannerBodySigned": "Bên gọi giữ nguyên URL và header; chỉ secret thay đổi. Secret cũ vẫn hoạt động cho đến khi hết hạn và có thể được hiển thị cho đến lúc đó.",
+      "rotateBannerBodyRevoked": "Bên gọi giữ nguyên URL và header; chỉ token thay đổi. Token cũ đã bị thu hồi và ngừng hoạt động ngay bây giờ.",
+      "rotateBannerBodyRevokedSigned": "Bên gọi giữ nguyên URL và header; chỉ secret thay đổi. Secret cũ đã bị thu hồi và ngừng hoạt động ngay bây giờ.",
+      "rotateBannerBodyFresh": "Bên gọi giữ nguyên URL và header và gửi token này từ bây giờ.",
+      "rotateBannerBodyFreshSigned": "Bên gọi giữ nguyên URL và header và ký bằng secret này từ bây giờ.",
+      "snippetsLabel": "Yêu cầu mẫu",
+      "sendTest": "Gửi yêu cầu thử nghiệm",
+      "sendTestHint": "Kiểm tra thông tin xác thực và hiển thị những gì các bước của bạn sẽ nhận. Không có lần chạy nào bắt đầu, không có đích nào được gọi.",
+      "sendTestHintPaused": "Kiểm tra thông tin xác thực. Quy trình làm việc đang tạm dừng, nên lệnh gọi bị từ chối trước khi bất kỳ đầu vào nào được tạo; Chạy thử sẽ chạy các bước.",
+      "sendTestSigned": "Trình duyệt không thể ký yêu cầu, vì vậy hãy kiểm thử bằng yêu cầu mẫu ở trên. Thêm ?dry_run=true vào URL của yêu cầu đó để kiểm tra chữ ký mà không bắt đầu lần chạy.",
+      "dryRunAccepted": "Đã chấp nhận chạy thử",
+      "dryRunMeta": "thông tin xác thực hợp lệ · body {size}",
+      "dryRunInput": "Đầu vào mà các bước của bạn sẽ nhận",
+      "dryRunRefused": "Thông tin xác thực hợp lệ. Yêu cầu bị từ chối cho đến khi quy trình làm việc được xuất bản.",
+      "dryRunRefusedPaused": "Thông tin xác thực hợp lệ. Yêu cầu bị từ chối trong khi quy trình làm việc đang tạm dừng.",
+      "dryRunRateLimited": "Đã bị giới hạn tốc độ — chạy thử được tính vào giới hạn.",
+      "dryRunStatus": "Yêu cầu đã bị từ chối với trạng thái {status}.",
+      "dryRunFailed": "Không thể gửi yêu cầu thử nghiệm. {reason}",
+      "runTestInstead": "Chạy thử thay thế",
+      "done": "Xong",
+      "regionTag": "Vùng {name}",
+      "regionBanner": "Gửi mọi yêu cầu và mọi lần thử lại đến host của vùng này. Khóa idempotency và trạng thái lần chạy ({field}) được lưu ở vùng đã chấp nhận lệnh gọi, vì vậy lần thử lại gửi đến vùng khác có thể bắt đầu lần chạy thứ hai.",
+      "authLabel": "Bên gọi xác thực bằng",
+      "authToken": "Token",
+      "authSigned": "Yêu cầu đã ký",
+      "authAbout": "Giới thiệu về xác thực",
+      "authInfo": "Token: gửi token trong header Authorization. Yêu cầu đã ký: ký từng yêu cầu bằng secret dùng chung (các header {headers}).",
+      "switchToSignedTitle": "Chuyển sang yêu cầu đã ký?",
+      "switchToSignedBody": "Việc chuyển đổi sẽ thu hồi token hiện tại ngay bây giờ và tạo secret ký. Bên gọi dùng token sẽ bắt đầu nhận 401.",
+      "switchToTokenTitle": "Chuyển sang token?",
+      "switchToTokenBody": "Chuyển đổi sẽ thu hồi mã bí mật ký hiện tại ngay bây giờ và tạo một token. Các bên gọi ký yêu cầu sẽ bắt đầu nhận lỗi 401.",
+      "tokensTitle": "Token",
+      "secretsTitle": "Mã bí mật ký",
+      "colToken": "Token",
+      "colSecret": "Mã bí mật",
+      "colCreated": "Đã tạo",
+      "colLastUsed": "Dùng lần cuối",
+      "colStatus": "Trạng thái",
+      "colActions": "Thao tác",
+      "never": "Chưa bao giờ",
+      "active": "Đang hoạt động",
+      "retiring": "Đang ngừng sử dụng",
+      "creatorGone": "Người tạo không còn trong tổ chức này",
+      "revoke": "Thu hồi",
+      "revokeNow": "Thu hồi ngay",
+      "revokeTitle": "Thu hồi {prefix}? Các bên gọi đang dùng nó sẽ nhận lỗi 401 ngay lập tức.",
+      "revokeFailed": "Không thể thu hồi. {reason}",
+      "copyToken": "Sao chép token",
+      "copySecret": "Sao chép mã bí mật",
+      "tokenCopied": "Đã sao chép token",
+      "commandCopied": "Đã sao chép lệnh",
+      "secretCopied": "Đã sao chép mã bí mật",
+      "revealFailed": "Không thể hiển thị token. {reason}",
+      "revealFailedSigned": "Không thể hiển thị mã bí mật. {reason}",
+      "revealDenied": "Chỉ quản trị viên mới có thể hiển thị hoặc sao chép token cho endpoint này.",
+      "runTest": "Chạy thử",
+      "rotate": "Xoay vòng",
+      "rotateBlocked": "Thu hồi token đang ngừng sử dụng trước",
+      "rotateBlockedSigned": "Thu hồi mã bí mật đang ngừng sử dụng trước",
+      "rotateTitle": "Xoay vòng token",
+      "rotateTitleSigned": "Xoay vòng mã bí mật ký",
+      "rotateLead": "Một token mới được tạo ngay bây giờ. Giữ {prefix} (dùng lần cuối {time}) hoạt động thêm",
+      "rotateLeadSigned": "Một mã bí mật ký mới được tạo ngay bây giờ. Giữ {prefix} (dùng lần cuối {time}) hoạt động thêm",
+      "overlapNow": "Thu hồi ngay",
+      "overlapHour": "1 giờ",
+      "overlapDay": "24 giờ",
+      "overlapWeek": "7 ngày",
+      "rotateConsequence": "Các bên gọi đang dùng token hiện tại sẽ tiếp tục hoạt động đến {time}. Hãy cập nhật trước thời điểm đó.",
+      "rotateConsequenceSigned": "Các bên gọi đang ký bằng mã bí mật hiện tại sẽ tiếp tục hoạt động đến {time}. Hãy cập nhật trước thời điểm đó.",
+      "rotateConsequenceNow": "Các bên gọi đang dùng token hiện tại sẽ nhận lỗi 401 từ bây giờ.",
+      "rotateConsequenceNowSigned": "Các bên gọi đang ký bằng mã bí mật hiện tại sẽ nhận lỗi 401 từ bây giờ.",
+      "rotateConfirm": "Xoay vòng token",
+      "rotateConfirmSigned": "Xoay vòng mã bí mật ký",
+      "rotateFailed": "Không thể xoay vòng. {reason}",
+      "advanced": "Nâng cao",
+      "advancedSummary": "Kích thước body tối đa {size} · {count} yêu cầu mỗi phút | Kích thước body tối đa {size} · {count} yêu cầu mỗi phút",
+      "maxBody": "Kích thước body tối đa (KiB)",
+      "maxBodyHint": "Tối đa 1024 (1 MiB); bạn chỉ có thể giảm xuống.",
+      "maxBodyRange": "Nhập một số nguyên từ 1 đến 1024",
+      "rateLimit": "Số yêu cầu mỗi phút",
+      "rateLimitHint": "Tối đa {org} mỗi phút cho tổ chức này",
+      "rateLimitRange": "Nhập số nguyên từ 1 đến {org}",
+      "saveLimitsFailed": "Không thể lưu giới hạn. {reason}",
+      "deleteMeta": "Xóa URL cùng mọi token hoặc secret.",
+      "deleteButton": "Xóa endpoint",
+      "deleteTitle": "Xóa endpoint này?",
+      "deleteBody": "URL ngừng hoạt động ngay lập tức: bên gọi sẽ nhận 401. Tất cả token và signing secret đều bị xóa và không thể khôi phục. Lịch sử chạy được giữ lại.",
+      "deleteFailed": "Không thể xóa endpoint. {reason}",
+      "secretStorageWarning": "Máy chủ này không có khóa chính mã hóa, nên token và signing secret được lưu ở dạng mà bất kỳ ai có quyền truy cập cơ sở dữ liệu đều có thể đọc. Hãy yêu cầu quản trị viên thiết lập một khóa.",
+      "rejectionsLine": "Khoảng {count} yêu cầu bị từ chối trong 24 giờ qua · lần cuối: {reason}, {time} | Khoảng {count} yêu cầu bị từ chối trong 24 giờ qua · lần cuối: {reason}, {time}",
+      "rejectionsShow": "Hiển thị",
+      "rejectionsHide": "Ẩn",
+      "rejectionsTitle": "Các lần từ chối gần đây",
+      "rejectionsCaption": "khoảng {count} trong 24 giờ qua · bên gọi chỉ thấy mã trạng thái | khoảng {count} trong 24 giờ qua · bên gọi chỉ thấy mã trạng thái",
+      "rejectionMeta": "khoảng {count} · lần cuối {time} · từ {ip} | khoảng {count} · lần cuối {time} · từ {ip}",
+      "rejectionsLoadError": "Không thể tải các lần từ chối.",
+      "raiseLimit": "Tăng giới hạn",
+      "rotateLink": "Xoay vòng",
+      "reason": {
+        "invalid_token": {
+          "title": "Token không hợp lệ",
+          "fix": "Bên gọi gửi một token đã bị thu hồi, hết hạn hoặc gõ sai. Hãy hiển thị hoặc sao chép token hiện tại từ bảng token."
+        },
+        "invalid_signature": {
+          "title": "Chữ ký không hợp lệ",
+          "fix": "Bên gọi ký bằng một secret cũ hoặc sai. Kiểm tra xem nó có dùng secret hiện tại và ký {format} chính xác như đã gửi không."
+        },
+        "stale_timestamp": {
+          "title": "Timestamp quá cũ",
+          "fix": "Đồng hồ của bên gọi lệch hơn 5 phút. Hãy đồng bộ đồng hồ của nó và ký ngay trước khi gửi."
+        },
+        "endpoint_disabled": {
+          "title": "Endpoint đã tắt",
+          "fix": "Bật endpoint."
+        },
+        "workflow_disabled": {
+          "title": "Quy trình làm việc đã tạm dừng",
+          "fix": "Tiếp tục quy trình làm việc từ danh sách."
+        },
+        "workflow_not_published": {
+          "title": "Quy trình làm việc chưa được xuất bản",
+          "fix": "Xuất bản quy trình làm việc; bản nháp sẽ từ chối yêu cầu."
+        },
+        "payload_too_large": {
+          "title": "Payload quá lớn",
+          "fix": "Vượt quá {size}. Hãy gửi ít hơn hoặc chia các sự kiện thành nhiều yêu cầu."
+        },
+        "credential_in_url": {
+          "title": "Thông tin xác thực trong URL",
+          "fix": "Một token hoặc secret đã được gửi trong URL và bị từ chối. URL sẽ xuất hiện trong nhật ký proxy và trình duyệt, nên hãy xoay vòng nó ngay, rồi gửi nó trong header."
+        },
+        "invalid_idempotency_key": {
+          "title": "Khóa idempotency không hợp lệ",
+          "fix": "Header Idempotency-Key trống hoặc dài hơn 255 ký tự."
+        },
+        "idempotency_key_reused": {
+          "title": "Khóa idempotency được dùng lại",
+          "fix": "Cùng một khóa nhưng nội dung body khác. Hãy dùng khóa mới cho mỗi sự kiện riêng biệt."
+        },
+        "rate_limited": {
+          "title": "Bị giới hạn tần suất",
+          "fix": "Hơn {count} yêu cầu mỗi phút. Hãy gộp các sự kiện vào một yêu cầu (gửi một mảng JSON) hoặc tăng giới hạn — tối đa {org} mỗi phút cho tổ chức này."
+        },
+        "queue_full": {
+          "title": "Hàng đợi đầy",
+          "fix": "Tổ chức này đã có {count} lượt chạy HTTP đang chờ. Bên gọi nên thử lại sau khoảng thời gian Retry-After; hãy tìm bước chậm hoặc giảm tốc độ gửi."
+        },
+        "worker_unavailable": {
+          "title": "Worker không khả dụng",
+          "fix": "Không có worker quy trình làm việc nào đang chạy trong khu vực này, nên không có gì được đưa vào hàng đợi. Các bên gọi thử lại sau khoảng thời gian Retry-After sẽ được xử lý khi worker hoạt động trở lại; nếu tình trạng này tiếp diễn, hãy yêu cầu quản trị viên kiểm tra các worker quy trình làm việc."
+        }
+      },
+      "nodeBadge": "Có thể gọi qua HTTP",
+      "triggerLinkOn": "Cũng chạy khi có yêu cầu HTTP",
+      "triggerLinkOnAction": "Quản lý endpoint",
+      "triggerLinkOff": "Cũng có thể khởi chạy từ hệ thống khác",
+      "triggerLinkOffAction": "Thiết lập endpoint HTTP",
+      "pickerCue": "Mọi quy trình làm việc cũng có thể được khởi động bằng một yêu cầu HTTP. Chọn trigger của nó, rồi dùng HTTP endpoint trên thanh công cụ.",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP endpoint đang bật",
+      "listMenuItem": "HTTP endpoint…",
+      "copyUrl": "Sao chép URL endpoint",
+      "copyUrlDraftHint": "Các yêu cầu sẽ bị từ chối cho đến khi bạn xuất bản",
+      "copyUrlFailed": "Không thể sao chép URL endpoint. {reason}",
+      "payloadFrom": "Payload từ",
+      "payloadHttp": "Yêu cầu HTTP",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "hết hạn sau {count} h | hết hạn sau {count} h",
+      "expiresInDays": "hết hạn sau {count} ngày | hết hạn sau {count} ngày",
+      "expired": "Đã hết hạn",
+      "rotateLeadUnused": "Một token mới được tạo ngay bây giờ. Giữ {prefix} (chưa từng dùng) hoạt động trong",
+      "rotateLeadUnusedSigned": "Một signing secret mới được tạo ngay bây giờ. Giữ {prefix} (chưa từng dùng) hoạt động trong",
+      "fieldGroup": "Yêu cầu HTTP",
+      "fieldGroupBodyHint": "Các trường bên trong body của yêu cầu cần một bước Hàm trước",
+      "fieldGroupQueryHint": "Tham số truy vấn là meta.query.<key>; các khóa lặp lại đến dưới dạng danh sách và không bao giờ khớp",
+      "rotateLeadNone": "Không có token nào đang hoạt động, nên bên gọi không thể xác thực. Một token mới được tạo ngay bây giờ.",
+      "rotateLeadNoneSigned": "Không có signing secret nào đang hoạt động, nên bên gọi không thể xác thực. Một signing secret mới được tạo ngay bây giờ.",
+      "createForbidden": "Bạn không thể tạo thông tin xác thực endpoint trong tổ chức này.",
+      "errorNotConfigured": "Quy trình làm việc này không có HTTP endpoint.",
+      "errorNoLiveCredential": "Không có thông tin xác thực nào đang hoạt động. Xoay vòng để tạo một thông tin mới.",
+      "errorNotAllowed": "Bạn không có quyền thực hiện thao tác này.",
+      "copyCredentialChanged": "Thông tin xác thực đã thay đổi. Hãy sao chép lại.",
+      "copyCommandFailed": "Không thể sao chép lệnh. {reason}",
+      "exampleRequest": "Yêu cầu mẫu",
+      "exampleActiveToken": "Token đang hoạt động · {prefix}",
+      "exampleActiveSecret": "Secret đang hoạt động · {prefix}",
+      "exampleHintToken": "Bản sao chép bao gồm token. Dán vào terminal, hoặc nhập vào Postman hay Insomnia (Import → Raw text).",
+      "exampleHintSigned": "Chạy trong bash: lệnh ký bằng openssl, rồi gọi curl. Bản sao chép bao gồm secret. Các công cụ nhập không thể ký.",
+      "exampleHintTokenPlaceholder": "Bản sao chép có một chỗ giữ chỗ cho token. Dán vào terminal, hoặc nhập vào Postman hay Insomnia (Import → Raw text).",
+      "exampleHintSignedPlaceholder": "Chạy trong bash: lệnh ký bằng openssl, rồi gọi curl. Bản sao chép có một chỗ giữ chỗ cho secret. Các công cụ nhập không thể ký."
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "Nhấp",
       "viewDocsLinkLabel": "tại đây",
       "viewDocsSuffix": "để xem thêm tài liệu.",
-      "selectIntegrationPrompt": "Chọn một tích hợp để xem chi tiết."
+      "selectIntegrationPrompt": "Chọn một tích hợp để xem chi tiết.",
+      "codingAgent": {
+        "tabAgent": "Với coding agent",
+        "tabSteps": "Từng bước",
+        "streamLabel": "Tên stream trace",
+        "streamHelp": "Agent ghi trace vào stream này và kiểm tra nó.",
+        "envTitle": "Tải xuống tệp .env của bạn",
+        "envHelp": "Lưu tệp này ở thư mục gốc của dự án. Skill đọc token từ tệp này, nên token không bao giờ lọt vào cuộc trò chuyện.",
+        "envButton": "Tải xuống .env",
+        "promptTitle": "Dán nội dung này vào {client1}, {client2} hoặc {client3}",
+        "promptLabel": "Prompt",
+        "promptCopied": "Đã sao chép prompt"
+      }
     },
     "header": "Nguồn dữ liệu",
     "resetRUMTokenLabel": "Đặt lại Token RUM",
@@ -7670,6 +7995,15 @@
     "queryValues": "Giá trị truy vấn",
     "constant": "Hằng số",
     "textbox": "Hộp văn bản",
+    "date": "Ngày",
+    "dateFormat": "Định dạng ngày đầu ra",
+    "dateFormatHelp": "Định dạng đầu ra mặc định trong truy vấn. Ghi đè theo từng lần dùng bằng ${'{'}name:format{'}'}, ví dụ ${'{'}name:epochus{'}'}.",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Giây epoch (epoch)",
+    "dateFormatEpochms": "Mili giây Epoch (epochms)",
+    "dateFormatEpochus": "Micro giây Epoch (epochus)",
     "newFolder": "Thư mục mới",
     "updateFolder": "Cập nhật thư mục",
     "newReport": "Báo cáo mới",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "Thêm chú thích",
       "dependentAdhocVariableWarning": "Một số biến động không được áp dụng vì trường không có trong stream truy vấn. Mở Trình kiểm tra truy vấn để xem tất cả chi tiết về các biến và truy vấn đã thực thi để hiển thị panel này",
       "refreshCacheReload": "Làm mới bộ nhớ đệm & Tải lại",
+      "exploreCreateAlert": "Tạo cảnh báo",
+      "exploreAddToDashboard": "Thêm vào bảng điều khiển",
       "redirectingToLogs": "Đang chuyển hướng đến trang nhật ký",
       "pleaseWait": "Vui lòng chờ..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "Hằng số",
       "textbox": "Hộp văn bản",
       "custom": "Tùy chỉnh",
+      "date": "Ngày",
       "list": "{type} · {example}",
       "csv": "Dấu phẩy: {example}",
       "pipe": "Dấu gạch đứng: {example}",
       "doublequote": "Dấu nháy kép: {example}",
-      "singlequote": "Dấu nháy đơn: {example}"
+      "singlequote": "Dấu nháy đơn: {example}",
+      "dateIso": "Ngày (YYYY-MM-DD): {example}",
+      "dateDmy": "Ngày trước (DD/MM/YYYY): {example}",
+      "dateMdy": "Tháng trước (MM/DD/YYYY): {example}",
+      "dateEpoch": "Giây Epoch: {example}",
+      "dateEpochms": "Mili giây Epoch: {example}",
+      "dateEpochus": "Micro giây Epoch: {example}"
     },
     "add": "Thêm Panel",
     "save": "Lưu",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "Đã xác nhận",
         "badgeResolved": "Đã giải quyết",
         "badgeReopened": "Đã mở lại",
+        "badgeAckEnded": "Xác nhận đã kết thúc",
         "badgeDimensionsUpgraded": "Đã nâng cấp các chiều",
         "badgeTitleChanged": "Đã thay đổi tiêu đề",
         "badgeAssignment": "Phân công",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "AI cần đầu vào",
         "incidentWas": "Sự cố",
         "theIncident": "sự cố",
+        "ackEndedByPageResolve": "bằng cách giải quyết một trong các thông báo trực của nó",
         "unnamedAlert": "cảnh báo",
         "alertTriggered": "{alert} đã kích hoạt | {alert} đã kích hoạt {count} lần",
         "severityUpgraded": "Đã nâng mức độ nghiêm trọng từ {from} lên {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "Cảnh báo cho tôi",
           "toast": "Đã nhập từ Product Analytics: \"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "Tạo cảnh báo",
+          "toast": "Truy vấn được nhập từ tìm kiếm trace của bạn",
+          "noStream": "Chọn một stream trước",
+          "errorCount": "Số lỗi",
+          "errorRate": "Tỷ lệ lỗi"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "Bộ lọc tìm kiếm của bạn không được chuyển sang vì trước tiên nó cần một lựa chọn Run as trên trang nhật ký. Hãy thêm nó vào truy vấn cảnh báo nếu bạn cần.",
         "thresholdColumnGuessed": "Ngưỡng đã được áp dụng cho {column}; hãy kiểm tra đó có phải là giá trị bạn muốn không.",
         "thresholdNotCarried": "Ngưỡng {value} từ biểu đồ không được áp dụng vì bạn đã chọn một truy vấn khác.",
-        "rumFunnelExclusions": "Sử dụng bộ lọc ứng dụng của ứng dụng này tại thời điểm hiện tại; hãy tạo lại sau khi chúng thay đổi."
+        "rumFunnelExclusions": "Sử dụng bộ lọc ứng dụng của ứng dụng này tại thời điểm hiện tại; hãy tạo lại sau khi chúng thay đổi.",
+        "tracesSeedMatches": "Kích hoạt khi số span khớp trong {minutes} phút vượt {threshold} (hiện tại {current}).",
+        "tracesSeedSpans": "Kích hoạt khi số span trong {minutes} phút vượt {threshold} (hiện tại {current}).",
+        "tracesSeedTraces": "Kích hoạt khi số trace trong {minutes} phút vượt {threshold} (hiện tại {current}).",
+        "tracesSeedErrorSpans": "Kích hoạt khi số span lỗi trong {minutes} phút vượt {threshold} (hiện tại {current}).",
+        "tracesSeedErrorTraces": "Kích hoạt khi số trace có lỗi trong {minutes} phút vượt {threshold} (hiện tại {current}).",
+        "tracesSeedErrorRatio": "Kích hoạt khi tỷ lệ lỗi trong {minutes} phút vượt {threshold}% (hiện tại {current}%).",
+        "tracesErrorRatioMinSpans": "Chỉ kiểm tra các cửa sổ có ít nhất {minimum} span, để một vài lỗi trong giai đoạn yên ắng không kích hoạt cảnh báo.",
+        "tracesErrorRatioMinTraces": "Chỉ kiểm tra các cửa sổ có ít nhất {minimum} trace, để một vài lỗi trong giai đoạn yên ắng không kích hoạt cảnh báo.",
+        "tracesSeedDuration": "Kích hoạt khi thời lượng {percentile} trong {minutes} phút vượt {threshold} ms (hiện tại {current} ms).",
+        "tracesSeedUnavailable": "Không thể đọc giá trị hiện tại, nên ngưỡng bắt đầu từ 0. Hãy đặt ngưỡng trước khi lưu.",
+        "tracesNoMatches": "Chưa có span khớp nào, nên cảnh báo sẽ kích hoạt ngay khi có một span xuất hiện.",
+        "tracesStoredSpans": "Số liệu được tính trên các span đã lưu, nên lưu lượng lấy mẫu sẽ thấp hơn so với thực tế.",
+        "tracesPeriodCapped": "Cửa sổ cảnh báo được giới hạn ở {minutes} phút để mỗi lần kiểm tra được nhanh.",
+        "tracesNotRun": "Tìm kiếm này chưa được chạy, nên cảnh báo dùng bộ lọc trong trình soạn thảo."
       }
     },
     "saveFailed": "Không thể lưu cảnh báo.",
@@ -13906,6 +14272,8 @@
       "noMatch": "Không có chỉ số nào khớp với bộ lọc hiện tại",
       "noMatchHint": "Hãy thử xóa bộ lọc nhãn, xóa lựa chọn tiền tố/hậu tố, hoặc chuyển từ “Có dữ liệu” sang “Tất cả”.",
       "noMatchHintFavorites": "Thử loại bỏ bộ lọc nhãn hoặc chuyển từ “Có dữ liệu” sang “Tất cả”.",
+      "noMatchYet": "Chưa tìm thấy chỉ số nào có dữ liệu",
+      "noMatchYetHint": "Các chỉ số đã kiểm tra đến giờ không trả về dữ liệu. Hiển thị thêm để tiếp tục tìm.",
       "clearAllFilters": "Xóa tất cả bộ lọc",
       "emptyActions": {
         "clearSearch": "Xóa tìm kiếm",
@@ -14122,7 +14490,8 @@
       "panelAdded": "Panel đã được thêm vào bảng điều khiển",
       "errorAddingPanel": "Lỗi khi thêm panel",
       "selectDashboard": "Vui lòng chọn một bảng điều khiển",
-      "selectTab": "Vui lòng chọn một tab"
+      "selectTab": "Vui lòng chọn một tab",
+      "panelsToAdd": "Các panel cần thêm"
     },
     "groups": {
       "compute": "Tính toán",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "Khác"
   },
   "traces": {
+    "nlNeedsSql": "Câu hỏi này cần SQL; hãy mở trong Nhật ký",
+    "redActions": {
+      "menuGroupDashboards": "Bảng điều khiển",
+      "addRedToDashboard": "Thêm biểu đồ RED vào bảng điều khiển",
+      "durationActions": "Hành động về thời lượng",
+      "bucketNotice": {
+        "seconds": "Các biểu đồ này giữ nguyên các cột {count} giây như bạn thấy hiện tại.",
+        "minutes": "Các biểu đồ này giữ nguyên các cột {count} phút như bạn thấy hiện tại.",
+        "hours": "Các biểu đồ này giữ nguyên các cột {count} giờ như bạn thấy hiện tại.",
+        "days": "Các biểu đồ này giữ nguyên các cột {count} ngày như bạn thấy hiện tại."
+      },
+      "bucketNoticeSingle": {
+        "seconds": "Biểu đồ này giữ nguyên các cột {count} giây như bạn thấy hiện tại.",
+        "minutes": "Biểu đồ này giữ nguyên các cột {count} phút như bạn thấy hiện tại.",
+        "hours": "Biểu đồ này giữ nguyên các cột {count} giờ như bạn thấy hiện tại.",
+        "days": "Biểu đồ này giữ nguyên các cột {count} ngày như bạn thấy hiện tại."
+      }
+    },
     "latencyHeatmap": {
       "title": "Thời lượng",
       "tooltipSpans": "{count} span | {count} span",
@@ -15396,6 +15783,13 @@
     "nextMatch": "Kết quả tiếp theo",
     "searchInSpans": "Tìm kiếm trong span",
     "criticalPath": "Đường tới hạn",
+    "askAi": {
+      "explainTrace": "Giải thích trace",
+      "explainTraceHint": "Hỏi AI về các span chậm nhất trên đường dẫn tới hạn và mọi span lỗi",
+      "askAboutSpan": "Hỏi AI về span này",
+      "spanChip": "Span · {operation}",
+      "traceChip": "Trace · {operation}"
+    },
     "spansTableView": "Chế độ xem bảng span",
     "comingSoon": "Sắp ra mắt...",
     "fetchingTrace": "Đang tải trace của bạn.",
@@ -15498,7 +15892,7 @@
         "filterErrors": "Lọc lỗi",
         "resetFilters": "Đặt lại bộ lọc",
         "errorsNone": "Không có lỗi · {total} Lượt",
-        "latencyLead": "Chậm nhất {slowest} ·",
+        "latencyLead": "Lượt TB {avg} · Chậm nhất {slowest} ·",
         "costLead": "Cao nhất {peak} ·",
         "tokens": "{ratio}% Đã cache",
         "cacheImpact": "{ratio}% Tái sử dụng · {tokens} Tok Đã đọc",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "Không có dữ liệu",
       "noErrorsInRange": "Không có lỗi trong khoảng thời gian này",
+      "loadFailed": "Không thể tải các lỗi gần đây",
       "time": "Thời gian",
       "service": "Dịch vụ",
       "operation": "Thao tác",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "Luôn hoạt động (mặc định)",
     "testAtTimeLabel": "Kiểm tra tại thời gian UTC",
     "testAtTimeHint": "Để trống để sử dụng thời gian hiện tại. Các bậc cao điểm / thấp điểm được xác định dựa trên thời gian này.",
-    "localTimeHint": "Trong múi giờ của bạn: {range}"
+    "localTimeHint": "Trong múi giờ của bạn: {range}",
+    "builtInStatus": {
+      "seed": "Giá tích hợp sẵn: danh sách khởi tạo đi kèm bản phát hành này, ngày {date}.",
+      "neverSynced": "Đồng bộ trực tuyến chưa chạy kể từ khi máy chủ khởi động.",
+      "lastSynced": "Đồng bộ trực tuyến lần cuối {time}."
+    },
+    "unpriced": {
+      "title": "Khoảng trống về giá",
+      "subtitle": "Các mô hình trong trace LLM của bạn không có giá, hoặc chỉ có giá gần đúng, tại thời điểm tiếp nhận",
+      "banner": "{count} mô hình không có giá hoặc chỉ có giá gần đúng tại thời điểm tiếp nhận. Chi phí đã ghi nhận có thể không đầy đủ. | {count} mô hình không có giá hoặc chỉ có giá gần đúng tại thời điểm tiếp nhận. Chi phí đã ghi nhận của chúng có thể không đầy đủ.",
+      "bannerTruncated": "{total} mô hình trong trace của bạn không có giá hoặc chỉ có giá gần đúng tại thời điểm tiếp nhận. Chi phí của chúng có thể sai. Đang hiển thị {shown} mô hình hàng đầu theo token.",
+      "streamLabel": "Stream",
+      "window": "24 giờ qua",
+      "windowRange": "{from} – {to}",
+      "colModel": "Mô hình thấy trong trace",
+      "colPricedAs": "Được tính giá như",
+      "colTokens": "Token",
+      "colCost": "Chi phí đã ghi nhận",
+      "colActions": "Hành động",
+      "spans": "{count} span | {count} span",
+      "moreAgents": "+{count} nữa",
+      "noMatch": "Không khớp",
+      "approximate": "Gần đúng",
+      "pricedNow": "Áp dụng giá cho span mới",
+      "historicalGap": "Khoảng thời gian này giữ nguyên khoảng trống giá đã ghi nhận. Span mới dùng giá hiện tại.",
+      "noActionNeeded": "Không cần hành động",
+      "defaultTierPrices": "vào {input} / ra {output} trên 1M",
+      "notPriced": "chưa có giá",
+      "createPrice": "Tạo giá",
+      "keepPrices": "Giữ giá {name}",
+      "mute": "Tắt thông báo",
+      "muteConfirmTitle": "Tắt thông báo cho mô hình này?",
+      "muteConfirmMessage": "Span mới của {model} sẽ được tính giá là miễn phí. Span cũ giữ nguyên chi phí đã ghi nhận. Xóa giá \"{name}\" để bật lại thông báo.",
+      "mutedNotif": "Đã tắt thông báo cho {model}",
+      "keptNotif": "{model} giờ dùng giá {name}",
+      "errSave": "Lưu giá thất bại",
+      "errLoad": "Tải các mô hình chưa có giá thất bại",
+      "emptyTitle": "Không có mức sử dụng mô hình chưa có giá hoặc giá gần đúng được ghi nhận trong stream này trong khoảng thời gian này.",
+      "noStreamsTitle": "Không có stream trace LLM",
+      "noStreamsDesc": "Mô hình sẽ xuất hiện ở đây khi span gen_ai đến được một stream trace.",
+      "recordedCostNote": "Giá mới áp dụng cho các span được tiếp nhận sau khi bạn lưu. Span cũ giữ nguyên chi phí đã ghi nhận.",
+      "noModelName": "(không có tên mô hình)",
+      "noModelHint": "Không có mô hình để định giá: đặt gen_ai.request.model",
+      "instrumentationDocs": "Hướng dẫn instrumentation"
+    }
   },
   "aiObservability": {
     "title": "Khả năng quan sát AI",
@@ -17238,6 +17677,8 @@
       "skipTiers": "Hàng bị bỏ qua: {full} hoàn toàn · {partial} một phần",
       "scoreEvidence": "{scorer} · v{version}: {samples} mẫu, {noReference} không tham chiếu, {noTrace} không trace",
       "scorerApplicability": "{scorer} · v{version}: {eligible} ô hợp lệ, {noReference} không tham chiếu",
+      "costUnknown": "không rõ chi phí",
+      "costAtLeast": "≥ {cost}",
       "loadError": "Không thể tải thử nghiệm",
       "previewError": "Không thể xem trước các ô thử nghiệm",
       "createSuccess": "Đã tạo thử nghiệm",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "Thí nghiệm này ước tính tốn khoảng {cost}, vượt ngưỡng cảnh báo {threshold}. Vẫn tạo và chạy?",
         "costConfirmMessageUnpriced": "Thí nghiệm này được ước tính có chi phí vượt ngưỡng cảnh báo. Vẫn tạo và chạy?",
         "costConfirmOk": "Vẫn tạo",
+        "taskProviderFailed": "Không có gì được tạo. Nhà cung cấp tác vụ {provider} không phản hồi cuộc gọi kiểm tra.",
+        "judgeProviderFailed": "Không có gì được tạo. Nhà cung cấp LLM judge {provider} không phản hồi cuộc gọi kiểm tra.",
         "skippedFully": "{count} dòng bị bỏ qua hoàn toàn — mọi bộ chấm điểm đã chọn đều cần đầu ra dự kiến. Các dòng bị bỏ qua không tốn chi phí để chạy.",
         "skippedPartially": "{count} dòng bị bỏ qua một phần — tác vụ vẫn chạy, nhưng các bộ chấm điểm dựa trên tham chiếu không thể chấm điểm các dòng thiếu đầu ra dự kiến.",
         "skippedNone": "Mọi dòng khớp đều có thể được chấm điểm trên ít nhất một tiêu chí.",
@@ -17408,7 +17851,26 @@
           "trials": "Lần thử",
           "dispersion": "Độ phân tán",
           "latency": "Độ trễ",
-          "p50Latency": "Độ trễ P50"
+          "p50Latency": "Độ trễ P50",
+          "error": "Lỗi"
+        },
+        "failureBanner": {
+          "title": "{failed} trên {total} slot thất bại: {cause}.",
+          "cause": "Nguyên nhân hàng đầu, {count} mục: {message}",
+          "moreCauses": "+ {count} nguyên nhân khác",
+          "noMessage": "không có thông báo lỗi nào được ghi lại",
+          "openProviders": "Mở Nhà cung cấp"
+        },
+        "failureKinds": {
+          "provider_auth": "nhà cung cấp đã từ chối thông tin xác thực",
+          "rate_limited": "nhà cung cấp đã giới hạn tần suất lượt chạy",
+          "timeout": "nhà cung cấp không phản hồi kịp thời",
+          "provider_5xx": "nhà cung cấp trả về lỗi máy chủ",
+          "parse_error": "không thể phân tích cú pháp đầu ra",
+          "mapping_error": "không thể tạo đầu vào tác vụ",
+          "scorer_missing": "một bộ chấm điểm không còn tồn tại",
+          "execution_error": "lệnh gọi tác vụ thất bại",
+          "unknown": "lệnh gọi tác vụ thất bại"
         },
         "saveAsPrompt": "Lưu thành Prompt",
         "openPrompt": "Mở Prompt",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "Môi trường",
       "agent": "Agent",
-      "version": "Phiên bản"
+      "version": "Phiên bản",
+      "agentIdHint": "Agent ID: {ids}",
+      "noAgentIdentity": "Không tìm thấy danh tính agent",
+      "noAgentIdentityDescription": "Các span LLM này không có tên agent, nên chúng được hiển thị theo stream. Hãy ánh xạ thuộc tính đặt tên agent của bạn để xem chúng theo agent.",
+      "noAgentIdentityAction": "Mở Ánh xạ Agent GenAI"
     },
     "agentGraph": {
       "stream": "Stream",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "Đánh giá đã bị tắt trên máy chủ này",
+      "description": "Trang này cần tính năng đánh giá trực tuyến, vốn đã bị tắt trên máy chủ này. Hãy yêu cầu quản trị viên bật tính năng này."
+    },
     "traceScoreChip": {
       "reasoning": "Tại sao",
       "noReasoning": "Không có lý giải nào được ghi cho điểm này.",
@@ -18549,7 +19019,7 @@
       "remoteCta": "Cấu hình điểm cuối"
     },
     "provider": {
-      "backTo": "Quay lại Nhà cung cấp",
+      "backTo": "Nhà cung cấp",
       "createTitle": "Tạo nhà cung cấp LLM",
       "editTitle": "Chỉnh sửa nhà cung cấp LLM",
       "subtitle": "Cấu hình điểm cuối mô hình được sử dụng bởi bộ chấm điểm trọng tài LLM.",
@@ -18794,7 +19264,7 @@
           "duplicateName": "Bộ chấm điểm {index}: tên \"{name}\" được sử dụng nhiều hơn một lần trong lần nhập này"
         }
       },
-      "backTo": "Quay lại Bộ chấm điểm",
+      "backTo": "Bộ chấm điểm",
       "badgeRemote": "Từ xa",
       "badgeLlm": "LLM Judge",
       "createTitleRemote": "Bộ chấm điểm từ xa mới",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "Chọn nhà cung cấp",
       "modelLabel": "Mô hình",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "Nhiệt độ",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 đến 2. Để trống để chấm điểm ở 0.",
       "promptLabel": "Lời nhắc của người đánh giá",
       "includeReasoningLabel": "Bao gồm lý luận",
       "includeReasoningHint": "Người đánh giá giải thích lý do cho điểm đó, được lưu kèm mỗi kết quả.",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Tên tiêu đề là bắt buộc",
         "apiKeyTokenRequired": "Token là bắt buộc",
         "timeoutInvalid": "Thời gian chờ phải từ 0 trở lên",
+        "temperatureInvalid": "Nhiệt độ phải nằm trong khoảng 0 đến 2",
         "retriesInvalid": "Số lần thử lại phải từ 0 trở lên",
         "duplicateFieldName": "Tên trường phải là duy nhất"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "Suy giảm",
         "waitingForCredentials": "Đang chờ thông tin xác thực",
         "noRecentRuns": "Không có lần chạy gần đây",
+        "lastScored": "Chấm điểm gần nhất {time}",
         "summary": "{errors} trong {runs} lần chạy đã thất bại trong 15 phút qua",
         "since": "Chuyển sang trạng thái này {time}",
         "checked": "Kiểm tra lần cuối {time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "Đánh giá {percent}% các mục tiêu phù hợp.",
       "samplingValueAllHelp": "Mọi mục tiêu phù hợp đều được đánh giá.",
       "samplingHelp": "Chạy sau khi lọc, để kiểm soát chi phí.",
-      "backTo": "Quay lại Tác vụ đánh giá",
+      "backTo": "Tác vụ đánh giá",
       "createTitle": "Công việc Đánh giá Mới",
       "editTitle": "Cập nhật Công việc Đánh giá",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "Nhánh này đã kết thúc tại một đích.",
       "chooseATriggerNodeToStart": "Chọn nút kích hoạt để bắt đầu quy trình làm việc của bạn",
       "thisConnectionWouldCreateALoop": "Kết nối này sẽ tạo ra một vòng lặp",
-      "onlyOneIncomingConnectionToA": "Chỉ cho phép một kết nối đến cho mỗi bước"
+      "onlyOneIncomingConnectionToA": "Chỉ cho phép một kết nối đến cho mỗi bước",
+      "endpointUrlCopied": "Đã sao chép URL điểm cuối"
     },
     "views": {
       "youAreNotAuthorizedToManage": "Bạn không có quyền quản lý giấy phép.",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "Tìm kiếm cơ sở dữ liệu hoặc dịch vụ…",
       "unnamedInstance": "Phiên bản chưa đặt tên",
+      "schemaCount": "{count} lược đồ | {count} lược đồ",
       "unnamedInstanceHint": "Báo cáo câu lệnh của cơ sở dữ liệu chứng minh công cụ này đang chạy, nhưng chúng không đặt tên máy chủ. Hàng sẽ hiển thị địa chỉ khi một nguồn cấp dữ liệu mang địa chỉ đó — lấy mẫu phiên hoặc chỉ số phiên bản — được thiết lập.",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "Đã đếm đến {time}; nửa phút cuối vẫn đang được cập nhật.",
       "lineExact": "Tất cả cơ sở dữ liệu đang báo cáo. Tốc độ ở đây được đo trên mọi lệnh gọi, vì vậy chúng chính xác.",
       "lineExactEstimated": "Tất cả cơ sở dữ liệu đang báo cáo. Tốc độ ở đây được kết hợp từ một số khoảng thời gian, vì vậy chúng gần đúng nhưng không chính xác.",
+      "lineExactSlowestSchema": "Tất cả cơ sở dữ liệu đều đang gửi dữ liệu. Tốc độ chính xác theo từng lược đồ; cơ sở dữ liệu có nhiều lược đồ sẽ hiển thị lược đồ chậm nhất.",
       "lineSubsetUnnamed": "Bộ lọc của bạn thu hẹp phạm vi này xuống dưới mức mà các tổng này cộng lại, vì vậy tỷ lệ phần trăm mô tả các hàng được hiển thị thay vì toàn bộ cơ sở dữ liệu.",
       "lineQuery": "Thời gian được đo từ ứng dụng của bạn, vì vậy chúng bao gồm thời gian mạng và thời gian chờ kết nối trống.",
       "lineUncodedErrors": "{percent} số lỗi ở đây trả về mà không có mã lý do, vì vậy chúng có thể được đếm nhưng không giải thích được.",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "Đây là lần đầu cảnh báo này kích hoạt.",
     "escalationNotStarted": "Chưa được gọi trực",
     "escalationPagesNobody": "Không gọi trực cho ai",
+    "escalationNobodyPaged": "Không ai đang được gọi trực",
     "escalationTo": "leo thang tới {who} {when}",
     "escalationDetailCapped": "Chi tiết leo thang trực tiếp được tải cho {count} thông báo trực chưa xử lý lâu nhất.",
     "responder": "Người xử lý",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "Đến",
     "rotationRestrictionAdd": "Thêm khung giờ",
     "rotationRestrictionRemove": "Xóa",
-    "rotationRestrictionZeroLength": "Từ và Đến trùng nhau, nên khung giờ này không bao giờ khớp và lớp này âm thầm không bao giờ được chọn. Để áp dụng cả ngày, hãy đặt Đến thành 24:00.",
+    "rotationRestrictionZeroLength": "Từ và Đến trùng nhau, nên khoảng thời gian này không bao giờ khớp. Nút Lưu vẫn bị tắt cho đến khi Từ và Đến khác nhau; để áp dụng cho cả ngày, hãy đặt Đến thành 24:00.",
     "rotationRetiredTag": "Đã ngừng",
     "rotationSectionWhen": "Khi chuyển ca",
     "rotationName": "Tên lịch trực",
@@ -25593,6 +26072,10 @@
     "snoozed": "Đã tạm hoãn",
     "snoozedUntil": "Tạm lặng đến {time} — vẫn chưa được phân công",
     "snoozeFailed": "Không thể tạm hoãn thông báo trực",
+    "unsnooze": "Bỏ tạm hoãn",
+    "unsnoozeHint": "Kết thúc tạm hoãn ngay. Gọi trực sẽ tiếp tục từ bước đã tạm dừng.",
+    "unsnoozed": "Đã kết thúc tạm hoãn · gọi trực sẽ tiếp tục",
+    "unsnoozeFailed": "Không thể kết thúc tạm hoãn",
     "note": "Ghi chú",
     "notePlaceholder": "Bạn đã tìm thấy gì? Bạn đã thử gì?",
     "addNote": "Thêm ghi chú",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "Cùng nhóm người, lệch một ca, để người dự phòng không bao giờ là người đang trực. Đây là một ca luân phiên thông thường — không có gì liên kết hai ca, nên nếu bạn sửa danh sách của ca này mà không sửa ca kia thì chúng sẽ lệch nhau, và bạn sẽ nhận được cảnh báo thay vì được tự động sửa.",
     "rotationPreviewPairLegend": "Chính · Dự phòng",
     "rotationPreviewEmpty": "Chọn người và thời điểm bàn giao đầu tiên để xem ai trực khi nào.",
+    "rotationPreviewNow": "Hiện tại – {until}",
     "defaultRotationName": "Ca luân phiên",
     "teamCreatedWithoutMembers": "Đã tạo nhóm, nhưng không thể thêm thành viên. Hãy thêm họ trong tab Thành viên.",
     "teamCreatedWithoutRotation": "Đã tạo nhóm và các thành viên, nhưng không thể lưu ca luân phiên. Hãy thiết lập trong tab Lịch trực.",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "chưa ai xác nhận — vẫn đang gọi",
     "sectionHint_ringingRouted": "chưa ai xác nhận — {count} trong số này vẫn đang gọi trực | chưa ai xác nhận — {count} trong số này vẫn đang gọi trực",
     "sectionHint_ringingUnrouted": "{count} không có nhóm nên không gọi trực | {count} không có nhóm nên không gọi trực",
+    "sectionHint_ringingStopped": "{count} người không được gọi trực | {count} người không được gọi trực",
     "sectionHint_snoozed": "tạm dừng gọi — chúng sẽ tự quay lại",
     "sectionHint_handled": "đã xác nhận — mỗi mục đều có người phụ trách",
     "sectionHint_resolved": "đã đóng — giữ lại để lưu hồ sơ",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "Nhóm được gọi khi một tín hiệu khớp. Thang leo thang riêng của nhóm quyết định ai được đánh thức và theo thứ tự nào.",
     "scopeOwns": "Nhóm này sở hữu",
     "scopeAdvanced": "Nâng cao",
-    "ruleEditorConflictUnclaimed": "Hiện chưa có gì nhận sở hữu đường dẫn này — một thông báo trực khớp với nó sẽ đến nhóm tiếp nhận tất cả, hoặc không đến ai.",
+    "ruleEditorConflictUnclaimed": "Không có gì đang nhận đường dẫn này hiện tại, xét chỉ dựa trên các điều kiện này — một thông báo trực khớp với nó sẽ đến quy tắc bắt tất cả, hoặc không đến ai.",
     "ruleEditorConflictHeldBy": "Hiện tại, một thông báo trực khớp với mục này sẽ đi đến {team}, qua {path}.",
     "ruleEditorConflictTakesOver": "Quy tắc của bạn ghim nhiều điều kiện hơn, nên nó sẽ lấy những phần này từ {team}.",
     "ruleEditorConflictKeptBy": "Đường dẫn do {team} nắm giữ ghim nhiều điều kiện hơn, nên họ giữ những phần này và quy tắc này chỉ bắt phần còn lại.",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} chỉ gọi nhóm này trong {scope}. Ở nơi khác, nó thuộc về ai sở hữu phạm vi xung quanh.",
     "scopeNothingDiscovered": "Chưa có gì được phát hiện, nên không có mục nào để chọn. Dùng Nâng cao để viết quy tắc theo trường, hoặc gửi telemetry trước.",
     "scopeAdvancedHint": "Khớp trên bất kỳ trường và giá trị nào, kể cả những trường mà các cấp ở trên không bao phủ.",
+    "scopeValuesSeen": "Các danh sách này hiển thị các giá trị mà tính năng khám phá dịch vụ đã thấy. Để khớp với bất kỳ giá trị nào khác, hãy dùng Nâng cao.",
     "escalationHeld": "AI phân loại trước · gửi thông báo trong vòng {n} giây",
     "escalationPagingStep": "Đang gọi bậc {step}/{total} · {who}",
     "escalationPagingStepOnly": "Đang gọi bậc {step}/{total}",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "Tạo nhóm và vòng trực",
     "removeMemberHandsOver": "{name} tiếp nhận ca hiện tại của {leaving} trong {rotation}.",
     "removeMemberLeavesGap": "Không ai tiếp nhận ca hiện tại của {leaving} trong {rotation}.",
+    "removeMemberReorders": "Họ cũng rời khỏi {rotations}, nên người trực ở đó cũng có thể thay đổi.",
     "membersJoinEnd": "{names} được thêm vào cuối {rotations}. Người đang trực hiện tại không thay đổi. | {names} được thêm vào cuối {rotations}. Người đang trực hiện tại không thay đổi.",
     "membersAdded": "Đã thêm {names}. | Đã thêm {names}.",
     "removeMemberConfirm": "Xóa",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "Câu hỏi: {contact}",
       "outboundQueue": "Tin nhắn cảnh báo: {count} đang xếp hàng, cũ nhất {age} | Tin nhắn cảnh báo: {count} đang xếp hàng, cũ nhất {age}",
       "outboundEmpty": "Không có tin nhắn cảnh báo nào đang xếp hàng",
+      "refusedPosts": "{count} bài đăng cảnh báo thất bại trong 24 giờ qua. Lần cuối: {reason} tại {destination}, | {count} bài đăng cảnh báo thất bại trong 24 giờ qua. Lần cuối: {reason} tại {destination},",
       "ageSeconds": "{count} giây"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "Không thể gửi nhắc nhở."
     }
   },
+  "llmDataTrust": {
+    "noModelName": "(không có tên mô hình)",
+    "topModels": "{models} (hàng đầu {shown} trên {total})",
+    "cost": {
+      "partial": "một phần",
+      "unknown": "không rõ chi phí",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "Chi phí một phần. Không có giá cho {models}: {tokens} token trong {scope} này không được tính.",
+      "unknownTooltip": "Không rõ chi phí. Không có giá cho {models}: không có token nào trong {tokens} token ở {scope} này có chi phí.",
+      "scopeSession": "phiên",
+      "scopeTrace": "trace",
+      "unknownModel": "một model không có tên",
+      "addPrice": "Thêm giá"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} token chưa có giá",
+      "unpricedTooltip": "Chi phí là mức sàn: {tokens} token trên {models} chưa có giá. Mở tab Unpriced trong Giá model LLM.",
+      "pricedSinceTooltip": "Chi phí là mức sàn: {tokens} token trên {models} được ghi nhận trước khi có giá và không giữ chi phí nào."
+    },
+    "chart": {
+      "costMissing": "Không có trong biểu đồ này: {models}. {tokens} token chưa có giá.",
+      "costMissingPricedSince": "Không có trong biểu đồ này: {models}. {tokens} token được ghi nhận trước khi có giá.",
+      "unpricedModels": "Chưa có giá: {models}",
+      "pricedSinceModels": "Được ghi nhận trước khi có giá: {models}",
+      "addPrice": "Thêm giá"
+    },
+    "health": {
+      "title": "Sức khỏe dữ liệu",
+      "passing": "{n} đạt",
+      "checkedAgo": "đã kiểm tra {ago}",
+      "drawerTitle": "Sức khỏe dữ liệu AI",
+      "drawerSubtitle": "{stream} · cửa sổ hiện tại",
+      "rerun": "Chạy lại kiểm tra",
+      "close": "Đóng",
+      "loadError": "Không thể chạy kiểm tra sức khỏe dữ liệu.",
+      "samples": "Mẫu:",
+      "copyLink": "Sao chép liên kết cho quản trị viên",
+      "linkCopied": "Đã sao chép liên kết",
+      "status": {
+        "pass": "Đạt",
+        "warning": "Cảnh báo",
+        "error": "Lỗi"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "Model chưa có giá",
+          "detail": "{count} model · {spans} span · {tokens} token được tính là $0 | {count} model · {spans} span · {tokens} token được tính là $0",
+          "pass": "Mọi model trong cửa sổ này đều có giá. Các span được ghi nhận trước khi có giá vẫn giữ chi phí đã ghi nhận.",
+          "fix": "Sửa trong Giá model LLM",
+          "truncated": "Hàng đầu {shown} trên {total} theo token"
+        },
+        "missing_agent_identity": {
+          "label": "Thiếu danh tính agent",
+          "detail": "{affected} trên {total} span LLM ({pct}) không có gen_ai.agent.name, nên các chế độ xem agent bỏ sót chúng.",
+          "pass": "Mọi span LLM đều có tên hoặc id agent.",
+          "fix": "Mở Ánh xạ agent GenAI"
+        },
+        "zero_duration_spans": {
+          "label": "Span có thời lượng bằng 0",
+          "detail": "{affected} span LLM báo 0 ms, nên độ trễ và thời lượng phiên bị đọc thấp hơn thực tế.",
+          "pass": "Không có span LLM nào báo 0 ms.",
+          "fix": "Cách khắc phục"
+        },
+        "missing_session_id": {
+          "label": "Span không có session id",
+          "detail": "{affected} trên {total} span LLM ({pct}) không có gen_ai.conversation.id, nên Sessions bỏ sót chúng.",
+          "pass": "Mọi span LLM đều có gen_ai.conversation.id.",
+          "fix": "Hướng dẫn tích hợp"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Quản lý fleet",
     "subtitle": "Đăng ký collector OpenTelemetry, quản lý phiên bản cấu hình và triển khai thay đổi an toàn",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "Đang thực hiện",
       "scheduled": "Đã lên lịch",
+      "waiting": "Đang chờ",
       "completed": "Đã hoàn tất",
       "halted": "Đã dừng",
       "superseded": "Đã bị thay thế",
@@ -28696,7 +29257,7 @@
       "version": "Phiên bản",
       "pickConfig": "Chọn một cấu hình",
       "pickFleet": "Chọn một fleet",
-      "emptyFleet": "Fleet không có collector nào, nên phiên bản được đặt ngay lập tức",
+      "emptyFleet": "Fleet không có collector nào, nên đợt triển khai chờ đến khi có một collector tham gia",
       "startingShortly": "Sắp bắt đầu",
       "eventGateFailed": "Cổng kiểm tra tình trạng thất bại",
       "eventHalted": "Đã dừng",
@@ -28707,7 +29268,10 @@
       "notFound": "Đợt triển khai này không còn tồn tại",
       "notFoundDescription": "Liên kết có thể đã cũ. Hãy chọn một đợt triển khai từ danh sách.",
       "noneTargeted": "Không có collector nào được nhắm tới",
-      "outcomeNoneTargeted": "Fleet không có collector nào khi v{to} được đặt.",
+      "outcomeNoneTargeted": "Không collector nào nhận v{to} trong đợt triển khai này.",
+      "outcomeWaiting": "Không có collector nào trực tuyến, nên v{to} chưa được giao cho ai. Đợt triển khai sẽ bắt đầu khi có một collector kết nối.",
+      "waitingForCollector": "Đang chờ collector",
+      "notStarted": "Chưa bắt đầu",
       "versionFailedBefore": "v{version} · đã thất bại trước đó",
       "pickVersion": "Chọn một phiên bản",
       "autoRollback": "Tự động quay lui",
@@ -28732,6 +29296,7 @@
       "eventResumed": "Đã tiếp tục",
       "eventSkipped": "Đã bỏ qua các collector bị lỗi",
       "eventStarted": "Đã bắt đầu",
+      "eventWaiting": "Đang chờ một collector trực tuyến",
       "eventTimedOut": "Giai đoạn đã hết thời gian chờ",
       "eventSkippedOffline": "Đã bỏ qua {count} collector ngoại tuyến lúc bắt đầu; nó nhận phiên bản khi kết nối lại | Đã bỏ qua {count} collector ngoại tuyến lúc bắt đầu; chúng nhận phiên bản khi kết nối lại",
       "excluded": "Đã loại trừ",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "Giai đoạn không xác nhận cũng không từ chối trong vòng {minutes} phút sẽ làm đợt triển khai dừng (cài đặt fleet)",
       "phaseVerifying": "Đang xác minh",
       "phases": "Các giai đoạn",
-      "planEmpty": "Không có collector nào để cập nhật",
+      "planEmpty": "Không có collector nào trực tuyến, nên đợt triển khai chờ đến khi có một collector kết nối",
+      "planStable": "Không có collector nào trực tuyến; phiên bản ổn định sẽ được gửi tới từng collector khi nó kết nối",
       "planOne": "{count} collector trong một lô | {count} collector trong một lô",
       "planText": "{steps} → còn lại {last}, {count} giai đoạn",
       "planUnavailable": "Không có bản xem trước kế hoạch",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 giữ collector ngoại tuyến mãi mãi"
     },
     "audit": {
-      "search": "Tìm trong nhật ký kiểm toán",
       "editedConfig": "Đã chỉnh sửa cấu hình",
       "revokedToken": "Đã thu hồi token đăng ký",
       "enrolledCollector": "Đã đăng ký collector",
@@ -28920,7 +29485,6 @@
       "setDesired": "Đã đổi phiên bản",
       "autoRollback": "Đã tự động quay lui",
       "rolloutHalted": "Đợt triển khai đã dừng",
-      "assignedFleetConfig": "Đã gán cấu hình của fleet",
       "createdFleet": "Đã tạo fleet",
       "renamedFleet": "Đã đổi tên fleet",
       "deletedFleet": "Đã xóa fleet",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "Đã quay lui đợt triển khai",
       "movedByToken": "Đã chuyển bởi token đăng ký",
       "object": "Đối tượng",
+      "search": "Tìm trong nhật ký kiểm toán",
       "allObjects": "Tất cả đối tượng",
       "kind": {
         "fleet": "Fleet",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "Đang triển khai v{to}",
       "rolloutHalted": "Đợt triển khai v{to} đã dừng",
+      "rolloutWaiting": "v{to} chờ một collector trực tuyến",
       "autoRolledBack": "v{to} đã tự động quay lui",
       "noReason": "Không có lý do thất bại nào được báo cáo",
       "openRollout": "Mở đợt triển khai",
diff --git a/web/src/locales/languages/zh-CN.json b/web/src/locales/languages/zh-CN.json
index b87b9ddbd3..796540838d 100644
--- a/web/src/locales/languages/zh-CN.json
+++ b/web/src/locales/languages/zh-CN.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "还没有 LLM 活动",
       "description": "使用 OpenTelemetry Gen-AI 语义约定检测您的服务，并摄取至少一条追踪以填充此仪表板。",
-      "action": "使用 OpenTelemetry 检测",
-      "actionDesc": "捕获追踪上的 gen_ai_* 属性"
+      "action": "所有 AI 集成",
+      "actionDesc": "浏览所有框架和提供商指南",
+      "suggested": "设置 {name} 追踪",
+      "suggestedDesc": "因为您来自 {name} 文档而推荐",
+      "codingAgent": "使用编码代理进行插桩",
+      "codingAgentDesc": "您的编码代理会添加追踪并检查首个追踪",
+      "startFrom": "或从以下开始"
     },
     "noLLMSessions": {
       "title": "还没有 LLM 会话",
@@ -4797,6 +4802,13 @@
       "success": "成功",
       "failed": "失败",
       "testRun": "测试运行",
+      "source": "来源",
+      "sourceHttp": "HTTP 请求",
+      "sourceAlertFired": "告警触发",
+      "sourceIncidentEvent": "事件触发",
+      "sourceRetry": "重试运行",
+      "sourceManual": "手动运行",
+      "sourceOther": "其他",
       "runType": "类型",
       "testRunTooltip": "从编辑器启动。目标步骤会真实发送。",
       "showTestRuns": "显示 {count} 个测试运行",
@@ -4810,7 +4822,33 @@
       "retryTitle": "重试此运行？",
       "retryMessage": "这会使用失败运行记录的输入创建新运行。目标步骤将真正发送。",
       "retryStarted": "重试已开始——它会作为新运行出现在列表中。",
-      "retryError": "无法重试此运行"
+      "retryError": "无法重试此运行",
+      "statusQueued": "排队中",
+      "statusRunning": "运行中",
+      "statusExpired": "已过期",
+      "reasonExpired": "从未运行 · 排队超过 1 小时",
+      "reasonWorkerLost": "worker 丢失 · 未重新运行",
+      "reasonWorkflowDisabled": "工作流已停用",
+      "reasonRunTimeout": "15 分钟后超时",
+      "allTriggers": "所有触发器",
+      "triggerFilter": "触发器",
+      "run": "运行",
+      "searchRuns": "搜索运行 ID、幂等键或告警",
+      "sourceDetails": "来源详情",
+      "detailsWithKey": "{ip} · 键 {key}",
+      "detailsNoKey": "{ip} · 无幂等键",
+      "retryOf": "{run} 的重试",
+      "openRun": "打开运行",
+      "alertFiredEmptyTitle": "此时间范围内没有告警触发的运行",
+      "incidentEventEmptyTitle": "此时间范围内没有事件触发的运行",
+      "filterEmptyTitle": "此时间范围内没有匹配的运行",
+      "filterEmptyDimmed": "其他运行仍在时间线上，但已变暗。",
+      "searchEmptyTitle": "没有与此搜索匹配的运行",
+      "searchEmptyAction": "清除搜索",
+      "timelineNow": "现在",
+      "timelineAgoMinutes": "−{n}分钟",
+      "timelineAgoHours": "−{n}小时",
+      "timelineAgoDays": "−{n}天"
     },
     "edit": "编辑",
     "view": "查看",
@@ -4958,7 +4996,9 @@
           "noMatch": "无匹配"
         },
         "suppressed": "已抑制——未发送到实际目标"
-      }
+      },
+      "payloadFrom": "负载来源",
+      "payloadFromHint": "HTTP 请求结构即端点调用方发送的内容。"
     },
     "linkAlerts": {
       "title": "将工作流链接到告警",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "输出格式",
       "tlsVerifyLabel": "TLS 验证",
       "tlsDisabled": "已禁用"
+    },
+    "http": {
+      "runTestHint": "使用示例 HTTP 负载运行步骤；不会调用 URL",
+      "runTestHintList": "打开工作流以运行测试",
+      "runsEmptyTitle": "此时间范围内没有 HTTP 请求",
+      "runsEmptyBody": "扩大时间范围，或从 HTTP 端点面板发送测试请求。",
+      "runsEmptyAction": "显示所有触发器",
+      "runFailedAt": "此运行在 {step} 处失败：{error}",
+      "openStep": "打开步骤",
+      "runGuardHint": "HTTP 运行携带的是请求，而不是告警字段。如果此步骤读取 {fields}，请用条件保护它：{guard}。",
+      "runExpiredBanner": "此请求在队列中等待超过 1 小时，始终未被执行。没有任何步骤运行，也没有调用任何目标。",
+      "runWorkerLostBanner": "运行此请求的工作进程已停止。它不会自动重新执行，因为目标可能已被调用。请在调用方重新发送前先检查这些目标。",
+      "request": "请求",
+      "requestReceived": "接收时间",
+      "requestToken": "令牌",
+      "requestCallerIp": "调用方 IP",
+      "requestIdempotencyKey": "幂等键",
+      "requestContentType": "内容类型",
+      "requestBodySize": "请求体大小",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "请求头",
+      "headersKept": "{count} 个已保留 · Authorization、Cookie 和签名永不存储 | {count} 个已保留 · Authorization、Cookie 和签名永不存储",
+      "headerName": "名称",
+      "headerValue": "值",
+      "outputCaption": "每个下游步骤收到的内容",
+      "useAsTestInput": "用作测试输入",
+      "editorButton": "HTTP 端点",
+      "editorButtonOn": "开",
+      "editorButtonOff": "关",
+      "editorButtonTooltip": "允许其他系统通过 HTTP 请求启动此工作流",
+      "editorButtonRefusedDraft": "工作流发布前，请求将返回 403",
+      "editorButtonRefusedPaused": "工作流暂停期间，请求将返回 403",
+      "panelTitle": "HTTP 端点",
+      "panelSubtitle": "{name} · {kind} 工作流",
+      "acceptRequests": "接受 HTTP 请求",
+      "kindNote": "此工作流的步骤是为 {kind} 运行构建的。HTTP 运行则会收到请求（{field}），因此若某步骤需要 {kind} 字段，请添加条件。",
+      "kindNotePayload": "显示 HTTP 负载",
+      "kindNotePayloadHide": "隐藏 HTTP 负载",
+      "unsavedBody": "此工作流尚未保存。将其保存为草稿以创建其 URL 和令牌。发布前请求将被拒绝。",
+      "saveAndCreate": "保存草稿并创建端点",
+      "needsAdmin": "创建端点需要组织管理员权限。",
+      "needsEdit": "更改它需要对此工作流的编辑权限。",
+      "readOnlyOnMeta": "开 · 您可以复制 URL。更改它需要对此工作流的编辑权限。",
+      "offBody": "允许其他系统通过 HTTP 请求启动此工作流。您将获得一个 URL 和一个令牌。",
+      "offExistingBody": "关 · 在您开启之前，请求将被拒绝（403）。",
+      "onMeta": "开 · 仅在工作流已启用并发布时才会启动运行",
+      "loadError": "无法加载端点设置。",
+      "draftBanner": "此工作流是草稿。发布前对该 URL 的调用将返回 403。您现在即可设置端点，而“运行测试”会用示例 HTTP 负载执行草稿中的步骤。",
+      "disabledBanner": "在您启用工作流之前，请求将被拒绝（403）。",
+      "turnOnFailed": "无法开启端点。{reason}",
+      "changeFailed": "无法保存端点。{reason}",
+      "endpointExistsHint": "端点已存在。请在令牌表中查看或复制其令牌。",
+      "endpointExistsHintSigned": "端点已存在。请在签名密钥表中查看或复制其签名密钥。",
+      "disableTitle": "关闭端点？",
+      "disableBody": "在您重新开启之前，调用方将收到 403（端点已关闭）。URL 和令牌保持不变。",
+      "disableConfirm": "关闭",
+      "lastCall": "开 · 上次调用：{status} · {time} · {link}",
+      "lastCallNone": "开 · 尚无调用 — 发送一个测试请求",
+      "lastCallNoneRefused": "开 · 尚无调用",
+      "viewRun": "查看运行",
+      "lastCallStatus": {
+        "queued": "排队中",
+        "running": "运行中",
+        "succeeded": "成功",
+        "failed": "失败",
+        "expired": "已过期"
+      },
+      "endpointUrl": "端点 URL",
+      "tokenLabel": "令牌",
+      "secretLabel": "签名密钥",
+      "newTokenLabel": "新令牌",
+      "newSecretLabel": "新签名密钥",
+      "tokenHint": "屏幕上会以掩码显示；“复制”复制的是真实令牌。请将其作为 {header} 发送，切勿放在 URL 中。",
+      "secretHint": "屏幕上会以掩码显示；“复制”复制的是真实密钥。用它为每个请求签名，并发送 {headers} 请求头；切勿发送密钥本身。",
+      "revealBannerTitle": "端点已创建",
+      "revealBannerBody": "每个请求都要携带此令牌。你可以从“令牌”表中再次显示或复制它。",
+      "revealBannerBodySigned": "用此密钥为每个请求签名。你可以从“签名密钥”表中再次显示或复制它。",
+      "switchedBannerTitle": "令牌已创建",
+      "switchedBannerTitleSigned": "签名密钥已创建",
+      "rotateBannerTitle": "新令牌已创建",
+      "rotateBannerTitleSigned": "新签名密钥已创建",
+      "rotateBannerBody": "调用方仍使用相同的 URL 和请求头；只有令牌会变。旧令牌在过期前仍可继续使用，在此之前也仍可显示。",
+      "rotateBannerBodySigned": "调用方仍使用相同的 URL 和请求头；只有密钥会变。旧密钥在过期前仍可继续使用，在此之前也仍可显示。",
+      "rotateBannerBodyRevoked": "调用方仍使用相同的 URL 和请求头；只有令牌会变。旧令牌已被吊销，现在就会停止工作。",
+      "rotateBannerBodyRevokedSigned": "调用方仍使用相同的 URL 和请求头；只有密钥会变。旧密钥已被吊销，现在就会停止工作。",
+      "rotateBannerBodyFresh": "调用方仍使用相同的 URL 和请求头，并从现在起发送此令牌。",
+      "rotateBannerBodyFreshSigned": "调用方仍使用相同的 URL 和请求头，并从现在起使用此密钥签名。",
+      "snippetsLabel": "示例请求",
+      "sendTest": "发送测试请求",
+      "sendTestHint": "检查凭据，并显示你的步骤将收到的内容。不会启动运行，也不会调用目标。",
+      "sendTestHintPaused": "检查凭据。工作流已暂停，因此在构建任何输入之前调用就会被拒绝；运行测试会执行这些步骤。",
+      "sendTestSigned": "浏览器无法为请求签名，因此请使用上面的示例请求进行测试。在其 URL 中添加 ?dry_run=true 即可检查签名，而不会启动运行。",
+      "dryRunAccepted": "试运行已接受",
+      "dryRunMeta": "凭据有效 · {size} 请求体",
+      "dryRunInput": "你的步骤将收到的输入",
+      "dryRunRefused": "凭据有效。在工作流发布之前，请求会被拒绝。",
+      "dryRunRefusedPaused": "凭据有效。工作流暂停期间，请求会被拒绝。",
+      "dryRunRateLimited": "已触发速率限制 — 试运行也计入该限制。",
+      "dryRunStatus": "请求被拒绝，状态为 {status}。",
+      "dryRunFailed": "无法发送测试请求。{reason}",
+      "runTestInstead": "改为运行测试",
+      "done": "完成",
+      "regionTag": "区域 {name}",
+      "regionBanner": "请将每个请求以及每次重试都发送到该区域的主机。幂等键和运行状态（{field}）保存在接受调用的区域中，因此发送到另一区域的重试可能会启动第二次运行。",
+      "authLabel": "调用方使用以下方式认证",
+      "authToken": "令牌",
+      "authSigned": "签名请求",
+      "authAbout": "关于认证",
+      "authInfo": "令牌：在 Authorization 请求头中发送令牌。签名请求：使用共享密钥（{headers} 请求头）为每个请求签名。",
+      "switchToSignedTitle": "切换到签名请求？",
+      "switchToSignedBody": "切换会立即吊销当前令牌并创建签名密钥。使用该令牌的调用方将开始收到 401。",
+      "switchToTokenTitle": "切换到令牌？",
+      "switchToTokenBody": "切换后将立即撤销当前的签名密钥并创建令牌。使用签名请求的调用方将开始收到 401。",
+      "tokensTitle": "令牌",
+      "secretsTitle": "签名密钥",
+      "colToken": "令牌",
+      "colSecret": "密钥",
+      "colCreated": "创建时间",
+      "colLastUsed": "最近使用",
+      "colStatus": "状态",
+      "colActions": "操作",
+      "never": "从未",
+      "active": "生效中",
+      "retiring": "停用中",
+      "creatorGone": "创建者已不在该组织中",
+      "revoke": "撤销",
+      "revokeNow": "立即撤销",
+      "revokeTitle": "撤销 {prefix}？使用它的调用方将立即收到 401。",
+      "revokeFailed": "无法撤销。{reason}",
+      "copyToken": "复制令牌",
+      "copySecret": "复制密钥",
+      "tokenCopied": "令牌已复制",
+      "commandCopied": "命令已复制",
+      "secretCopied": "密钥已复制",
+      "revealFailed": "无法显示令牌。{reason}",
+      "revealFailedSigned": "无法显示密钥。{reason}",
+      "revealDenied": "只有管理员可以显示或复制此端点的令牌。",
+      "runTest": "运行测试",
+      "rotate": "轮换",
+      "rotateBlocked": "请先撤销停用中的令牌",
+      "rotateBlockedSigned": "请先撤销停用中的密钥",
+      "rotateTitle": "轮换令牌",
+      "rotateTitleSigned": "轮换签名密钥",
+      "rotateLead": "将立即创建新令牌。让 {prefix}（最近使用 {time}）继续有效",
+      "rotateLeadSigned": "将立即创建新的签名密钥。让 {prefix}（最近使用 {time}）继续有效",
+      "overlapNow": "立即撤销它",
+      "overlapHour": "1 小时",
+      "overlapDay": "24 小时",
+      "overlapWeek": "7 天",
+      "rotateConsequence": "使用当前令牌的调用方在 {time} 前仍可正常调用。请在此之前更新它们。",
+      "rotateConsequenceSigned": "使用当前密钥签名的调用方在 {time} 前仍可正常调用。请在此之前更新它们。",
+      "rotateConsequenceNow": "使用当前令牌的调用方从此刻起将收到 401。",
+      "rotateConsequenceNowSigned": "使用当前密钥签名的调用方从此刻起将收到 401。",
+      "rotateConfirm": "轮换令牌",
+      "rotateConfirmSigned": "轮换签名密钥",
+      "rotateFailed": "无法轮换。{reason}",
+      "advanced": "高级",
+      "advancedSummary": "最大请求体 {size} · 每分钟 {count} 个请求 | 最大请求体 {size} · 每分钟 {count} 个请求",
+      "maxBody": "最大请求体大小 (KiB)",
+      "maxBodyHint": "最大 1024（1 MiB）；只能调低",
+      "maxBodyRange": "请输入 1 到 1024 之间的整数",
+      "rateLimit": "每分钟请求数",
+      "rateLimitHint": "此组织每分钟最多 {org} 次",
+      "rateLimitRange": "请输入 1 到 {org} 之间的整数",
+      "saveLimitsFailed": "无法保存限制。{reason}",
+      "deleteMeta": "移除 URL 以及所有令牌和密钥。",
+      "deleteButton": "删除端点",
+      "deleteTitle": "删除此端点？",
+      "deleteBody": "URL 会立即失效：调用方将收到 401。所有令牌和签名密钥都会被删除且无法恢复。运行历史会保留。",
+      "deleteFailed": "无法删除端点。{reason}",
+      "secretStorageWarning": "此服务器没有加密主密钥，因此令牌和签名密钥的存储形式任何拥有数据库访问权限的人都能读取。请联系管理员设置主密钥。",
+      "rejectionsLine": "过去 24 小时内约有 {count} 个请求被拒绝 · 最近：{reason}，{time} | 过去 24 小时内约有 {count} 个请求被拒绝 · 最近：{reason}，{time}",
+      "rejectionsShow": "显示",
+      "rejectionsHide": "隐藏",
+      "rejectionsTitle": "最近的拒绝记录",
+      "rejectionsCaption": "过去 24 小时内约 {count} 次 · 调用方只能看到状态码 | 过去 24 小时内约 {count} 次 · 调用方只能看到状态码",
+      "rejectionMeta": "约 {count} 次 · 最近 {time} · 来自 {ip} | 约 {count} 次 · 最近 {time} · 来自 {ip}",
+      "rejectionsLoadError": "无法加载拒绝记录。",
+      "raiseLimit": "提高限制",
+      "rotateLink": "轮换",
+      "reason": {
+        "invalid_token": {
+          "title": "令牌无效",
+          "fix": "调用方发送的令牌已被撤销、已过期或输入有误。请在令牌表中显示或复制当前令牌。"
+        },
+        "invalid_signature": {
+          "title": "签名无效",
+          "fix": "调用方使用了旧的或错误的密钥进行签名。请检查其使用的是当前密钥，并按所发送的原样对 {format} 进行签名。"
+        },
+        "stale_timestamp": {
+          "title": "时间戳过旧",
+          "fix": "调用方的时钟偏差超过 5 分钟。请同步其时钟，并在发送前才进行签名。"
+        },
+        "endpoint_disabled": {
+          "title": "端点已关闭",
+          "fix": "开启端点。"
+        },
+        "workflow_disabled": {
+          "title": "工作流已暂停",
+          "fix": "在列表中恢复该工作流。"
+        },
+        "workflow_not_published": {
+          "title": "工作流未发布",
+          "fix": "发布该工作流；草稿会拒绝请求。"
+        },
+        "payload_too_large": {
+          "title": "负载过大",
+          "fix": "超过 {size}。请减少发送量，或将事件拆分到多个请求中。"
+        },
+        "credential_in_url": {
+          "title": "URL 中包含凭证",
+          "fix": "令牌或密钥被放在 URL 中发送并遭拒绝。URL 会出现在代理和浏览器日志中，请立即轮换该凭证，然后改为在请求头中发送。"
+        },
+        "invalid_idempotency_key": {
+          "title": "幂等键无效",
+          "fix": "Idempotency-Key 请求头为空或超过 255 个字符。"
+        },
+        "idempotency_key_reused": {
+          "title": "幂等键被重复使用",
+          "fix": "同一键携带了不同的请求体。请为每个不同的事件使用新的键。"
+        },
+        "rate_limited": {
+          "title": "触发了速率限制",
+          "fix": "每分钟超过 {count} 个请求。请将事件批量合并到一个请求中（发送 JSON 数组），或提高限制——此组织每分钟最多 {org} 次。"
+        },
+        "queue_full": {
+          "title": "队列已满",
+          "fix": "此组织已有 {count} 个 HTTP 运行在等待。调用方应在 Retry-After 指定的延迟后重试；请检查是否存在缓慢的步骤，或降低发送速率。"
+        },
+        "worker_unavailable": {
+          "title": "工作进程不可用",
+          "fix": "此区域没有正在运行的工作流工作进程，因此未排队任何内容。在 Retry-After 延迟后重试的调用方会在工作进程恢复后成功；如果持续发生，请联系管理员检查工作流工作进程。"
+        }
+      },
+      "nodeBadge": "可通过 HTTP 调用",
+      "triggerLinkOn": "也会响应 HTTP 请求运行",
+      "triggerLinkOnAction": "管理端点",
+      "triggerLinkOff": "也可从其他系统启动",
+      "triggerLinkOffAction": "设置 HTTP 端点",
+      "pickerCue": "任何工作流也可以由 HTTP 请求启动。选择其触发器，然后使用工具栏中的 HTTP 端点。",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP 端点已开启",
+      "listMenuItem": "HTTP 端点…",
+      "copyUrl": "复制端点 URL",
+      "copyUrlDraftHint": "发布前请求会被拒绝",
+      "copyUrlFailed": "无法复制端点 URL。{reason}",
+      "payloadFrom": "载荷来源",
+      "payloadHttp": "HTTP 请求",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "{count} 小时后过期 | {count} 小时后过期",
+      "expiresInDays": "{count} 天后过期 | {count} 天后过期",
+      "expired": "已过期",
+      "rotateLeadUnused": "现在将创建一个新令牌。让 {prefix}（从未使用）继续有效，持续",
+      "rotateLeadUnusedSigned": "现在将创建一个新的签名密钥。让 {prefix}（从未使用）继续有效，持续",
+      "fieldGroup": "HTTP 请求",
+      "fieldGroupBodyHint": "请求体中的字段需要先经过函数步骤",
+      "fieldGroupQueryHint": "查询参数为 meta.query.<key>；重复的键会以列表形式到达，且永远不会匹配",
+      "rotateLeadNone": "没有生效的令牌，因此调用方无法通过身份验证。现在将创建一个新令牌。",
+      "rotateLeadNoneSigned": "没有生效的签名密钥，因此调用方无法通过身份验证。现在将创建一个新的签名密钥。",
+      "createForbidden": "您无法在此组织中创建端点凭证。",
+      "errorNotConfigured": "此工作流没有 HTTP 端点。",
+      "errorNoLiveCredential": "没有生效的凭证。请轮换以创建。",
+      "errorNotAllowed": "您没有执行此操作的权限。",
+      "copyCredentialChanged": "凭证已更改。请重新复制。",
+      "copyCommandFailed": "无法复制命令。{reason}",
+      "exampleRequest": "示例请求",
+      "exampleActiveToken": "生效中的令牌 · {prefix}",
+      "exampleActiveSecret": "生效中的密钥 · {prefix}",
+      "exampleHintToken": "复制内容包含令牌。可粘贴到终端，或导入 Postman 或 Insomnia（Import → Raw text）。",
+      "exampleHintSigned": "在 bash 中运行：使用 openssl 签名，然后调用 curl。复制内容包含密钥。导入工具无法签名。",
+      "exampleHintTokenPlaceholder": "复制内容中令牌位置为占位符。可粘贴到终端，或导入 Postman 或 Insomnia（Import → Raw text）。",
+      "exampleHintSignedPlaceholder": "在 bash 中运行：使用 openssl 签名，然后调用 curl。复制内容中密钥位置为占位符。导入工具无法签名。"
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "点击",
       "viewDocsLinkLabel": "这里",
       "viewDocsSuffix": "以查看进一步文档。",
-      "selectIntegrationPrompt": "选择一个集成以查看详情。"
+      "selectIntegrationPrompt": "选择一个集成以查看详情。",
+      "codingAgent": {
+        "tabAgent": "使用编码代理",
+        "tabSteps": "分步操作",
+        "streamLabel": "追踪数据流名称",
+        "streamHelp": "代理会将追踪写入此数据流并进行检查。",
+        "envTitle": "下载您的 .env",
+        "envHelp": "将其保存到项目根目录。技能会从此文件读取令牌，因此令牌不会出现在对话中。",
+        "envButton": "下载 .env",
+        "promptTitle": "将此内容粘贴到 {client1}、{client2} 或 {client3}",
+        "promptLabel": "提示词",
+        "promptCopied": "提示词已复制"
+      }
     },
     "header": "数据源",
     "resetRUMTokenLabel": "重置 RUM Token",
@@ -7670,6 +7995,15 @@
     "queryValues": "查询值",
     "constant": "常量",
     "textbox": "文本框",
+    "date": "日期",
+    "dateFormat": "输出日期格式",
+    "dateFormatHelp": "查询中的默认输出。可在每次使用时用 ${'{'}name:format{'}'} 覆盖，例如 ${'{'}name:epochus{'}'}。",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Unix 时间戳秒 (epoch)",
+    "dateFormatEpochms": "Epoch 毫秒 (epochms)",
+    "dateFormatEpochus": "Epoch 微秒 (epochus)",
     "newFolder": "新建文件夹",
     "updateFolder": "更新文件夹",
     "newReport": "新报表",
@@ -8780,6 +9114,8 @@
       "addAnnotations": "添加注释",
       "dependentAdhocVariableWarning": "某些动态变量未应用，因为字段不在查询的数据流中。打开查询检查器查看用于渲染此面板的变量和查询的所有详细信息。",
       "refreshCacheReload": "刷新缓存并重新加载",
+      "exploreCreateAlert": "创建告警",
+      "exploreAddToDashboard": "添加到仪表盘",
       "redirectingToLogs": "正在重定向到日志页面",
       "pleaseWait": "请稍候..."
     },
@@ -9341,11 +9677,18 @@
       "constant": "常量",
       "textbox": "文本框",
       "custom": "自定义",
+      "date": "日期",
       "list": "{type} · {example}",
       "csv": "逗号：{example}",
       "pipe": "竖线：{example}",
       "doublequote": "双引号：{example}",
-      "singlequote": "单引号：{example}"
+      "singlequote": "单引号：{example}",
+      "dateIso": "日期 (YYYY-MM-DD)：{example}",
+      "dateDmy": "日在前 (DD/MM/YYYY)：{example}",
+      "dateMdy": "月在前 (MM/DD/YYYY)：{example}",
+      "dateEpoch": "Epoch 秒：{example}",
+      "dateEpochms": "Epoch 毫秒：{example}",
+      "dateEpochus": "Epoch 微秒：{example}"
     },
     "add": "添加面板",
     "save": "保存",
@@ -11503,6 +11846,7 @@
         "badgeAcknowledged": "已确认",
         "badgeResolved": "已解决",
         "badgeReopened": "已重新打开",
+        "badgeAckEnded": "确认已结束",
         "badgeDimensionsUpgraded": "维度已升级",
         "badgeTitleChanged": "标题已更改",
         "badgeAssignment": "分配",
@@ -11514,6 +11858,7 @@
         "badgeAiNeedsInput": "AI 需要输入",
         "incidentWas": "事件",
         "theIncident": "该事件",
+        "ackEndedByPageResolve": "通过将其某个呼叫标记为已解决",
         "unnamedAlert": "告警",
         "alertTriggered": "{alert} 已触发 | {alert} 已触发 {count} 次",
         "severityUpgraded": "严重级别已从 {from} 升级到 {to}",
@@ -12461,6 +12806,13 @@
         "rumfunnel": {
           "label": "向我告警",
           "toast": "已从产品分析导入：\"{sourceLabel}\""
+        },
+        "traces": {
+          "label": "创建告警",
+          "toast": "已从您的追踪搜索中导入查询",
+          "noStream": "请先选择数据流",
+          "errorCount": "错误数",
+          "errorRate": "错误率"
         }
       },
       "warnings": {
@@ -12494,7 +12846,21 @@
         "heldFilterDropped": "您的搜索过滤器未带入，因为它需要先在日志页面选择运行身份。如需使用，请将其添加到告警查询中。",
         "thresholdColumnGuessed": "阈值已应用于 {column}；请确认这是您想要的值。",
         "thresholdNotCarried": "由于您选择了其他查询，图表中的阈值 {value} 未被应用。",
-        "rumFunnelExclusions": "使用此应用当前的应用过滤器；过滤器变更后请重新创建。"
+        "rumFunnelExclusions": "使用此应用当前的应用过滤器；过滤器变更后请重新创建。",
+        "tracesSeedMatches": "当 {minutes} 分钟内的匹配 Span 数超过 {threshold}（当前 {current}）时触发。",
+        "tracesSeedSpans": "当 {minutes} 分钟内的 Span 数超过 {threshold}（当前 {current}）时触发。",
+        "tracesSeedTraces": "当 {minutes} 分钟内的追踪数超过 {threshold}（当前 {current}）时触发。",
+        "tracesSeedErrorSpans": "当 {minutes} 分钟内的错误 Span 数超过 {threshold}（当前 {current}）时触发。",
+        "tracesSeedErrorTraces": "当 {minutes} 分钟内出现错误的追踪数超过 {threshold}（当前 {current}）时触发。",
+        "tracesSeedErrorRatio": "当 {minutes} 分钟内的错误率超过 {threshold}%（当前 {current}%）时触发。",
+        "tracesErrorRatioMinSpans": "仅检查至少包含 {minimum} 个 Span 的时间窗口，避免在流量低谷期因少量失败而触发。",
+        "tracesErrorRatioMinTraces": "仅检查至少包含 {minimum} 个追踪的时间窗口，避免在流量低谷期因少量失败而触发。",
+        "tracesSeedDuration": "当 {minutes} 分钟内的 {percentile} 耗时高于 {threshold} ms（当前 {current} ms）时触发。",
+        "tracesSeedUnavailable": "无法读取当前值，因此阈值默认为 0。请在保存前设置。",
+        "tracesNoMatches": "暂无匹配的 Span，因此一旦出现匹配的 Span 就会立即触发告警。",
+        "tracesStoredSpans": "计数基于已存储的 Span，因此采样流量会低于实际值。",
+        "tracesPeriodCapped": "为保证每次检查足够快，告警窗口已被限制为最多 {minutes} 分钟。",
+        "tracesNotRun": "此搜索尚未运行，因此告警将使用编辑器中的过滤器。"
       }
     },
     "saveFailed": "无法保存告警。",
@@ -13906,6 +14272,8 @@
       "noMatch": "没有指标符合当前过滤器",
       "noMatchHint": "尝试移除标签过滤器，清除前缀/后缀选择，或从“有数据”切换到“全部”。",
       "noMatchHintFavorites": "尝试移除标签过滤器，或从“有数据”切换到“全部”。",
+      "noMatchYet": "暂未找到有数据的指标",
+      "noMatchYetHint": "目前已检查的指标均未返回数据。显示更多以继续查找。",
       "clearAllFilters": "清除所有过滤器",
       "emptyActions": {
         "clearSearch": "清除搜索",
@@ -14122,7 +14490,8 @@
       "panelAdded": "面板已添加到仪表盘",
       "errorAddingPanel": "添加面板时出错",
       "selectDashboard": "请选择一个仪表盘",
-      "selectTab": "请选择一个选项卡"
+      "selectTab": "请选择一个选项卡",
+      "panelsToAdd": "要添加的面板"
     },
     "groups": {
       "compute": "计算",
@@ -15170,6 +15539,24 @@
     "searchTypeOthers": "其他"
   },
   "traces": {
+    "nlNeedsSql": "此问题需要用 SQL，请在日志中打开",
+    "redActions": {
+      "menuGroupDashboards": "仪表盘",
+      "addRedToDashboard": "将 RED 图表添加到仪表盘",
+      "durationActions": "耗时相关操作",
+      "bucketNotice": {
+        "seconds": "这些图表将保留您现在看到的 {count} 秒柱状条。",
+        "minutes": "这些图表将保留您现在看到的 {count} 分钟柱状条。",
+        "hours": "这些图表将保留您现在看到的 {count} 小时柱状条。",
+        "days": "这些图表将保留您现在看到的 {count} 天柱状条。"
+      },
+      "bucketNoticeSingle": {
+        "seconds": "此图表将保留您现在看到的 {count} 秒柱状条。",
+        "minutes": "此图表将保留您现在看到的 {count} 分钟柱状条。",
+        "hours": "此图表将保留您现在看到的 {count} 小时柱状条。",
+        "days": "此图表将保留您现在看到的 {count} 天柱状条。"
+      }
+    },
     "latencyHeatmap": {
       "title": "持续时间",
       "tooltipSpans": "{count} 个 Span | {count} 个 Span",
@@ -15396,6 +15783,13 @@
     "nextMatch": "下一个匹配项",
     "searchInSpans": "在 Span 中搜索",
     "criticalPath": "关键路径",
+    "askAi": {
+      "explainTrace": "解释追踪",
+      "explainTraceHint": "让 AI 分析关键路径上最慢的 Span 以及所有错误 Span",
+      "askAboutSpan": "让 AI 分析此 Span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "追踪 · {operation}"
+    },
     "spansTableView": "Span 表格视图",
     "comingSoon": "即将推出...",
     "fetchingTrace": "正在获取您的追踪。",
@@ -15498,7 +15892,7 @@
         "filterErrors": "筛选错误",
         "resetFilters": "重置筛选条件",
         "errorsNone": "无错误 · {total} 个回合",
-        "latencyLead": "最慢 {slowest} ·",
+        "latencyLead": "平均轮次 {avg} · 最慢 {slowest} ·",
         "costLead": "峰值 {peak} ·",
         "tokens": "{ratio}% 已缓存",
         "cacheImpact": "{ratio}% 复用 · 读取 {tokens} Token",
@@ -15674,6 +16068,7 @@
     "lLMErrorTable": {
       "noData": "无数据",
       "noErrorsInRange": "此时间范围内无错误",
+      "loadFailed": "无法加载最近的错误",
       "time": "时间",
       "service": "服务",
       "operation": "操作",
@@ -16645,7 +17040,51 @@
     "tierAlwaysActive": "始终活跃（默认）",
     "testAtTimeLabel": "在 UTC 时间测试",
     "testAtTimeHint": "留空以使用当前时间。高峰/低谷层将以此时间为准。",
-    "localTimeHint": "在您的时区：{range}"
+    "localTimeHint": "在您的时区：{range}",
+    "builtInStatus": {
+      "seed": "内置价格：随此版本提供的种子列表，日期为 {date}。",
+      "neverSynced": "自服务器启动以来，尚未运行在线同步。",
+      "lastSynced": "上次在线同步：{time}。"
+    },
+    "unpriced": {
+      "title": "定价缺口",
+      "subtitle": "您的 LLM 追踪中在摄取时没有价格或仅有近似价格的模型",
+      "banner": "{count} 个模型在摄取时没有价格或仅有近似价格。其记录的成本可能不完整。 | {count} 个模型在摄取时没有价格或仅有近似价格。其记录的成本可能不完整。",
+      "bannerTruncated": "{total} 个模型在您的追踪中于摄取时没有价格或仅有近似价格。其成本可能有误。按 Token 数显示前 {shown} 个。",
+      "streamLabel": "数据流",
+      "window": "最近 24 小时",
+      "windowRange": "{from} – {to}",
+      "colModel": "追踪中出现的模型",
+      "colPricedAs": "定价为",
+      "colTokens": "Token 数",
+      "colCost": "记录成本",
+      "colActions": "操作",
+      "spans": "{count} 个 Span | {count} 个 Span",
+      "moreAgents": "+{count} 个",
+      "noMatch": "无匹配",
+      "approximate": "近似",
+      "pricedNow": "新 Span 将按此定价",
+      "historicalGap": "此时间窗口保留其记录的定价缺口。新 Span 使用当前价格。",
+      "noActionNeeded": "无需操作",
+      "defaultTierPrices": "每 1M：输入 {input} / 输出 {output}",
+      "notPriced": "未定价",
+      "createPrice": "创建价格",
+      "keepPrices": "保留 {name} 价格",
+      "mute": "静音",
+      "muteConfirmTitle": "静音此模型？",
+      "muteConfirmMessage": "{model} 的新 Span 将按免费定价。较旧的 Span 保留其记录的成本。删除 \"{name}\" 价格即可取消静音。",
+      "mutedNotif": "{model} 已静音",
+      "keptNotif": "{model} 现在使用 {name} 价格",
+      "errSave": "保存价格失败",
+      "errLoad": "加载未定价模型失败",
+      "emptyTitle": "此时间窗口内，此数据流未记录未定价或近似定价的模型使用情况。",
+      "noStreamsTitle": "没有 LLM 追踪数据流",
+      "noStreamsDesc": "一旦 gen_ai Span 到达追踪数据流，模型就会显示在这里。",
+      "recordedCostNote": "新价格适用于保存后摄取的 Span。较旧的 Span 保留其记录的成本。",
+      "noModelName": "（无模型名称）",
+      "noModelHint": "没有可定价的模型：请设置 gen_ai.request.model",
+      "instrumentationDocs": "插桩指南"
+    }
   },
   "aiObservability": {
     "title": "LLM 可观测性",
@@ -17238,6 +17677,8 @@
       "skipTiers": "跳过的行：{full} 完全跳过 · {partial} 部分跳过",
       "scoreEvidence": "{scorer} · v{version}: {samples} 个样本，{noReference} 个无参考，{noTrace} 个无轨迹",
       "scorerApplicability": "{scorer} · v{version}: {eligible} 个合格槽位，{noReference} 个无参考",
+      "costUnknown": "成本未知",
+      "costAtLeast": "≥ {cost}",
       "loadError": "加载实验失败",
       "previewError": "预览实验槽位失败",
       "createSuccess": "实验已创建",
@@ -17320,6 +17761,8 @@
         "costConfirmMessage": "该实验预计成本约为 {cost}，超过 {threshold} 警告阈值。仍要创建并运行吗？",
         "costConfirmMessageUnpriced": "该实验的预估成本超过警告阈值。仍要创建并运行吗？",
         "costConfirmOk": "仍然创建",
+        "taskProviderFailed": "未创建任何内容。任务提供商 {provider} 未响应测试调用。",
+        "judgeProviderFailed": "未创建任何内容。评判提供商 {provider} 未响应测试调用。",
         "skippedFully": "{count} 行被完全跳过——每个选定的评分器都需要预期输出。跳过的行运行无需成本。",
         "skippedPartially": "{count} 行被部分跳过——任务仍会运行，但基于参考的评分器无法对没有预期输出的行进行评分。",
         "skippedNone": "每个匹配的行至少可以在一个维度上进行评分。",
@@ -17408,7 +17851,26 @@
           "trials": "试验",
           "dispersion": "离散度",
           "latency": "延迟",
-          "p50Latency": "P50 延迟"
+          "p50Latency": "P50 延迟",
+          "error": "错误"
+        },
+        "failureBanner": {
+          "title": "{total} 个槽位中有 {failed} 个失败：{cause}。",
+          "cause": "首要原因，{count} 个槽位：{message}",
+          "moreCauses": "+ 还有 {count} 个原因",
+          "noMessage": "未记录任何错误消息",
+          "openProviders": "打开提供商"
+        },
+        "failureKinds": {
+          "provider_auth": "提供商拒绝了凭据",
+          "rate_limited": "提供商对本次运行进行了限流",
+          "timeout": "提供商未及时响应",
+          "provider_5xx": "提供商返回了服务器错误",
+          "parse_error": "无法解析输出",
+          "mapping_error": "无法构建任务输入",
+          "scorer_missing": "某个评分器已不存在",
+          "execution_error": "任务调用失败",
+          "unknown": "任务调用失败"
         },
         "saveAsPrompt": "保存为提示词",
         "openPrompt": "打开提示词",
@@ -17689,7 +18151,11 @@
     "scope": {
       "env": "环境",
       "agent": "智能体",
-      "version": "版本"
+      "version": "版本",
+      "agentIdHint": "Agent ID：{ids}",
+      "noAgentIdentity": "未找到 Agent 身份",
+      "noAgentIdentityDescription": "这些 LLM Span 没有 Agent 名称，因此按数据流显示。映射用于指定 Agent 名称的属性后，即可按 Agent 查看它们。",
+      "noAgentIdentityAction": "打开 GenAI Agent 映射"
     },
     "agentGraph": {
       "stream": "数据流",
@@ -18303,6 +18769,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "此服务器已禁用评估功能",
+      "description": "此页面需要在线评估，但此服务器已将其关闭。请联系管理员启用。"
+    },
     "traceScoreChip": {
       "reasoning": "为什么",
       "noReasoning": "未记录此评分的推理过程。",
@@ -18549,7 +19019,7 @@
       "remoteCta": "配置端点"
     },
     "provider": {
-      "backTo": "返回提供商",
+      "backTo": "提供商",
       "createTitle": "创建 LLM 提供商",
       "editTitle": "编辑 LLM 提供商",
       "subtitle": "配置 LLM 评分器使用的模型端点。",
@@ -18794,7 +19264,7 @@
           "duplicateName": "评分器 {index}: 名称 \"{name}\" 在此导入中使用了多次"
         }
       },
-      "backTo": "返回评分器",
+      "backTo": "评分器",
       "badgeRemote": "远程评分器",
       "badgeLlm": "LLM评分器",
       "createTitleRemote": "新建远程评分器",
@@ -18825,6 +19295,9 @@
       "providerPlaceholder": "选择提供商",
       "modelLabel": "模型",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "温度",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 到 2。留空则按 0 进行评判。",
       "promptLabel": "评判提示词",
       "includeReasoningLabel": "包含推理",
       "includeReasoningHint": "评估者解释为何给出该分数，并随每个结果一起保存。",
@@ -18898,6 +19371,7 @@
         "apiKeyHeaderRequired": "Header name is required",
         "apiKeyTokenRequired": "Token is required",
         "timeoutInvalid": "Timeout must be 0 or greater",
+        "temperatureInvalid": "温度必须在 0 到 2 之间",
         "retriesInvalid": "Retries must be 0 or greater",
         "duplicateFieldName": "Field names must be unique"
       },
@@ -19004,6 +19478,7 @@
         "degraded": "已降级",
         "waitingForCredentials": "等待凭证",
         "noRecentRuns": "近期无运行",
+        "lastScored": "上次评分于 {time}",
         "summary": "{runs} 次运行中有 {errors} 次在最近 15 分钟内失败",
         "since": "{time}进入此状态",
         "checked": "上次检查：{time}"
@@ -19026,7 +19501,7 @@
       "samplingValuePreview": "评估匹配目标的 {percent}%。",
       "samplingValueAllHelp": "每个匹配的目标都会被评估。",
       "samplingHelp": "过滤后运行，以控制成本。",
-      "backTo": "返回评估任务",
+      "backTo": "评估作业",
       "createTitle": "新建评估任务",
       "editTitle": "更新评估任务",
       "stepper": {
@@ -22447,7 +22922,8 @@
       "thisBranchAlreadyEndsInA": "此分支已在目标节点结束。",
       "chooseATriggerNodeToStart": "选择触发节点以启动工作流",
       "thisConnectionWouldCreateALoop": "此连接会造成循环",
-      "onlyOneIncomingConnectionToA": "每个步骤仅允许一个传入连接"
+      "onlyOneIncomingConnectionToA": "每个步骤仅允许一个传入连接",
+      "endpointUrlCopied": "端点 URL 已复制"
     },
     "views": {
       "youAreNotAuthorizedToManage": "您无权管理许可证。",
@@ -24097,6 +24573,7 @@
     "databases": {
       "searchPlaceholder": "搜索数据库或服务…",
       "unnamedInstance": "实例未命名",
+      "schemaCount": "{count} 个 Schema | {count} 个 Schema",
       "unnamedInstanceHint": "数据库自身的语句报告证明该引擎正在运行，但未指明主机。一旦设置了包含主机信息的源——如会话采样或实例指标——该行将显示地址。",
       "moreServices": "+{count}",
       "columns": {
@@ -24284,6 +24761,7 @@
       "lineCountedTo": "已统计至 {time}；最后半分钟的数据仍在进入。",
       "lineExact": "所有数据库均已上报。这里的速度是对每次调用进行衡量的，因此它们是精确的。",
       "lineExactEstimated": "所有数据库均已上报。这里的速度是多个时间段的混合结果，因此接近但不精确。",
+      "lineExactSlowestSchema": "所有数据库均已上报。速度按各 Schema 精确显示；包含多个 Schema 的数据库会显示其中最慢的一个。",
       "lineSubsetUnnamed": "您的筛选条件将数据范围缩小到这些总计无法累加的程度，因此百分比描述的是显示的行，而不是整个数据库。",
       "lineQuery": "计时是从您的应用程序端测量的，因此它们包括网络时间以及等待可用连接的时间。",
       "lineUncodedErrors": "此处的失败中有 {percent} 返回时没有原因代码，因此它们可以被计数但无法解释。",
@@ -25308,6 +25786,7 @@
     "contextNoHistory": "这是该告警首次触发。",
     "escalationNotStarted": "尚未呼叫",
     "escalationPagesNobody": "不会呼叫任何人",
+    "escalationNobodyPaged": "当前无人被呼叫",
     "escalationTo": "升级至 {who}，{when}",
     "escalationDetailCapped": "仅针对最旧的 {count} 个未处理呼叫加载实时升级详情。",
     "responder": "响应人",
@@ -25441,7 +25920,7 @@
     "rotationRestrictionTo": "结束",
     "rotationRestrictionAdd": "添加窗口",
     "rotationRestrictionRemove": "移除",
-    "rotationRestrictionZeroLength": "开始和结束时间相同，因此该窗口永远不会匹配，对应的层级永远不会生效。若要覆盖一整天，请将结束时间设为 24:00。",
+    "rotationRestrictionZeroLength": "开始时间和结束时间相同，因此此时间窗口永远不会匹配。在开始时间和结束时间不同之前，保存按钮保持禁用；如需表示全天，请将结束时间设为 24:00。",
     "rotationRetiredTag": "已停用",
     "rotationSectionWhen": "轮换时间",
     "rotationName": "轮换名称",
@@ -25593,6 +26072,10 @@
     "snoozed": "已暂停",
     "snoozedUntil": "静默至 {time} — 仍未分配",
     "snoozeFailed": "无法静默此告警",
+    "unsnooze": "取消静默",
+    "unsnoozeHint": "立即结束静默。呼叫将从暂停的步骤继续。",
+    "unsnoozed": "静默已结束 · 呼叫继续",
+    "unsnoozeFailed": "无法结束静默",
     "note": "备注",
     "notePlaceholder": "你发现了什么？你尝试了什么？",
     "addNote": "添加备注",
@@ -25803,6 +26286,7 @@
     "teamCreateSecondaryHint": "人员相同，只是班次错开一位，因此次要值班者绝不会是当前正在值班的人。它是一个普通轮班——两者之间没有任何关联，所以如果只编辑其中一个名单而不编辑另一个，它们会逐渐偏离；你会收到警告，而不是被悄无声息地修复。",
     "rotationPreviewPairLegend": "主要 · 次要",
     "rotationPreviewEmpty": "选择人员并确定首次交接时间，即可查看谁在何时值班。",
+    "rotationPreviewNow": "现在 – {until}",
     "defaultRotationName": "轮班",
     "teamCreatedWithoutMembers": "团队已创建，但无法添加其成员。请在“成员”标签页中添加他们。",
     "teamCreatedWithoutRotation": "团队及其成员已创建，但轮班未能保存。请在“排班”标签页中进行设置。",
@@ -26571,6 +27055,7 @@
     "sectionHint_ringing": "尚无人确认——这些仍在呼叫",
     "sectionHint_ringingRouted": "无人确认 — 其中 {count} 个仍在呼叫 | 无人确认 — 其中 {count} 个仍在呼叫",
     "sectionHint_ringingUnrouted": "{count} 个没有所属团队，因此不会呼叫 | {count} 个没有所属团队，因此不会呼叫",
+    "sectionHint_ringingStopped": "{count} 个未被呼叫 | {count} 个未被呼叫",
     "sectionHint_snoozed": "呼叫已暂停——它们会自动恢复",
     "sectionHint_handled": "已确认——每项都有人负责",
     "sectionHint_resolved": "已关闭——留作记录",
@@ -26650,7 +27135,7 @@
     "ruleEditorTeamHelp": "当信号匹配时收到呼叫的团队。其自身的升级阶梯会决定唤醒谁、以什么顺序唤醒。",
     "scopeOwns": "此团队负责",
     "scopeAdvanced": "高级",
-    "ruleEditorConflictUnclaimed": "目前没有任何规则认领此路径 — 匹配该路径的呼叫会落到兜底团队，或无人处理。",
+    "ruleEditorConflictUnclaimed": "仅根据这些条件判断，目前没有任何规则占用此路径——匹配此路径的呼叫会进入兜底规则，或者无人处理。",
     "ruleEditorConflictHeldBy": "目前匹配此路径的告警会通过 {path} 发送到 {team}。",
     "ruleEditorConflictTakesOver": "你的规则更具体，因此会从 {team} 手中接管这些匹配。",
     "ruleEditorConflictKeptBy": "{team} 持有的路径更具体，因此他们会保留这些匹配，此规则只捕获剩余部分。",
@@ -26672,6 +27157,7 @@
     "scopeClaimServiceHere": "{service} 仅在 {scope} 中呼叫此团队；其他位置则归属于它所在作用域的所有者。",
     "scopeNothingDiscovered": "尚未发现任何内容，因此没有数据资产可供选择。请使用高级模式按字段编写规则，或先发送一些遥测数据。",
     "scopeAdvancedHint": "可匹配任意字段和值，包括上述层级未涵盖的内容。",
+    "scopeValuesSeen": "这些列表显示服务发现已见到的值。要匹配其他值，请使用高级选项。",
     "escalationHeld": "AI 分诊优先 · {n} 秒内呼叫",
     "escalationPagingStep": "正在呼叫第 {step}/{total} 层 · {who}",
     "escalationPagingStepOnly": "正在呼叫第 {step}/{total} 层",
@@ -26709,6 +27195,7 @@
     "createTeamAndRotation": "创建团队和轮值",
     "removeMemberHandsOver": "{rotation} 中 {leaving} 的当前班次由 {name} 接替。",
     "removeMemberLeavesGap": "{rotation} 中 {leaving} 的当前班次无人接替。",
+    "removeMemberReorders": "该成员还会退出 {rotations}，因此那里的值班人员也可能发生变化。",
     "membersJoinEnd": "{names} 加入 {rotations} 的末尾。当前值班人不变。 | {names} 加入 {rotations} 的末尾。当前值班人不变。",
     "membersAdded": "已添加 {names}。 | 已添加 {names}。",
     "removeMemberConfirm": "移除",
@@ -28142,6 +28629,7 @@
       "managedQuestions": "疑问：{contact}",
       "outboundQueue": "告警消息：{count} 条排队中，最早 {age} | 告警消息：{count} 条排队中，最早 {age}",
       "outboundEmpty": "没有排队的告警消息",
+      "refusedPosts": "过去 24 小时内，{count} 条告警消息发送失败。最近一次：{reason}，发生在 {destination}， | 过去 24 小时内，{count} 条告警消息发送失败。最近一次：{reason}，发生在 {destination}，",
       "ageSeconds": "{count} 秒"
     },
     "channels": {
@@ -28413,6 +28901,78 @@
       "remindFailed": "无法发送提醒。"
     }
   },
+  "llmDataTrust": {
+    "noModelName": "（无模型名称）",
+    "topModels": "{models}（前 {shown}，共 {total}）",
+    "cost": {
+      "partial": "部分",
+      "unknown": "成本未知",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "部分成本。没有 {models} 的价格：此 {scope} 中的 {tokens} 个 token 未计入。",
+      "unknownTooltip": "成本未知。没有 {models} 的价格：此 {scope} 中的 {tokens} 个 token 均无成本。",
+      "scopeSession": "会话",
+      "scopeTrace": "追踪",
+      "unknownModel": "未命名模型",
+      "addPrice": "添加价格"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} 个 token 未定价",
+      "unpricedTooltip": "成本是下限：{models} 上的 {tokens} 个 token 没有价格。请在 LLM 模型定价中打开“未定价”标签页。",
+      "pricedSinceTooltip": "成本是下限：{models} 上的 {tokens} 个 token 记录于添加价格之前，因此没有成本。"
+    },
+    "chart": {
+      "costMissing": "此图表未包含：{models}。{tokens} 个 token 没有价格。",
+      "costMissingPricedSince": "此图表未包含：{models}。{tokens} 个 token 是在添加价格之前记录的。",
+      "unpricedModels": "未定价：{models}",
+      "pricedSinceModels": "添加价格前记录：{models}",
+      "addPrice": "添加价格"
+    },
+    "health": {
+      "title": "数据健康",
+      "passing": "{n} 项通过",
+      "checkedAgo": "上次检查：{ago}",
+      "drawerTitle": "AI 数据健康",
+      "drawerSubtitle": "{stream} · 当前窗口",
+      "rerun": "重新运行检查",
+      "close": "关闭",
+      "loadError": "数据健康检查无法运行。",
+      "samples": "样本：",
+      "copyLink": "复制链接给管理员",
+      "linkCopied": "链接已复制",
+      "status": {
+        "pass": "通过",
+        "warning": "警告",
+        "error": "错误"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "未定价模型",
+          "detail": "{count} 个模型 · {spans} 个 Span · {tokens} 个 token 按 $0 计 | {count} 个模型 · {spans} 个 Span · {tokens} 个 token 按 $0 计",
+          "pass": "此窗口中的每个模型都有价格。在添加价格之前记录的 Span 会保留其已记录的成本。",
+          "fix": "在 LLM 模型定价中修复",
+          "truncated": "按 token 数取前 {shown} 个，共 {total} 个"
+        },
+        "missing_agent_identity": {
+          "label": "缺少智能体身份",
+          "detail": "{affected}/{total} 个 LLM Span（{pct}）没有 gen_ai.agent.name，因此智能体视图会遗漏它们。",
+          "pass": "每个 LLM Span 都带有智能体名称或 ID。",
+          "fix": "打开 GenAI 智能体映射"
+        },
+        "zero_duration_spans": {
+          "label": "零时长 Span",
+          "detail": "{affected} 个 LLM Span 上报为 0 ms，导致延迟和会话时长的读数偏低。",
+          "pass": "没有 LLM Span 上报 0 ms。",
+          "fix": "如何修复"
+        },
+        "missing_session_id": {
+          "label": "缺少会话 ID 的 Span",
+          "detail": "{affected}/{total} 个 LLM Span（{pct}）没有 gen_ai.conversation.id，因此会话视图会遗漏它们。",
+          "pass": "每个 LLM Span 都有 gen_ai.conversation.id。",
+          "fix": "集成指南"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "机群管理",
     "subtitle": "注册 OpenTelemetry Collector，对其配置进行版本管理，并安全地推送变更",
@@ -28452,6 +29012,7 @@
     "badge": {
       "inProgress": "进行中",
       "scheduled": "已计划",
+      "waiting": "等待中",
       "completed": "已完成",
       "halted": "已暂停",
       "superseded": "已被取代",
@@ -28696,7 +29257,7 @@
       "version": "版本",
       "pickConfig": "选择配置",
       "pickFleet": "选择机群",
-      "emptyFleet": "该机群没有 Collector，因此版本将立即设置",
+      "emptyFleet": "Fleet 中没有采集器，因此发布需等到有采集器加入后才继续",
       "startingShortly": "即将开始",
       "eventGateFailed": "健康关卡未通过",
       "eventHalted": "已暂停",
@@ -28707,7 +29268,10 @@
       "notFound": "此上线已不存在",
       "notFoundDescription": "链接可能已过期。请从列表中选择一个上线。",
       "noneTargeted": "未指定 Collector",
-      "outcomeNoneTargeted": "设置 v{to} 时，该机群没有 Collector。",
+      "outcomeNoneTargeted": "本次发布中没有采集器采用 v{to}。",
+      "outcomeWaiting": "没有采集器在线，因此 v{to} 尚未分发到任何采集器。有采集器连接后，发布就会开始。",
+      "waitingForCollector": "等待采集器",
+      "notStarted": "未开始",
       "versionFailedBefore": "v{version} · 之前失败过",
       "pickVersion": "选择版本",
       "autoRollback": "自动回滚",
@@ -28732,6 +29296,7 @@
       "eventResumed": "已继续",
       "eventSkipped": "已跳过失败的 Collector",
       "eventStarted": "已开始",
+      "eventWaiting": "等待采集器上线",
       "eventTimedOut": "阶段超时",
       "eventSkippedOffline": "已排除 {count} 个在开始时离线的 Collector；它重新连接后将采用该版本 | 已排除 {count} 个在开始时离线的 Collector；它们重新连接后将采用该版本",
       "excluded": "已排除",
@@ -28761,7 +29326,8 @@
       "phaseTimeoutNote": "阶段在 {minutes} 分钟内既未确认也未拒绝时，上线将暂停（机群设置）",
       "phaseVerifying": "验证中",
       "phases": "阶段",
-      "planEmpty": "没有需要更新的 Collector",
+      "planEmpty": "没有采集器在线，因此发布需等到有采集器连接后才继续",
+      "planStable": "没有采集器在线；稳定版本会在每个采集器连接时下发",
       "planOne": "单批 {count} 个 Collector | 单批 {count} 个 Collector",
       "planText": "{steps} → 其余 {last}，共 {count} 个阶段",
       "planUnavailable": "无法预览计划",
@@ -28908,7 +29474,6 @@
       "retentionDaysHelp": "0 表示永久保留离线 Collector"
     },
     "audit": {
-      "search": "搜索审计跟踪",
       "editedConfig": "编辑了配置",
       "revokedToken": "撤销了注册令牌",
       "enrolledCollector": "注册了 Collector",
@@ -28920,7 +29485,6 @@
       "setDesired": "更改了版本",
       "autoRollback": "已自动回滚",
       "rolloutHalted": "上线已暂停",
-      "assignedFleetConfig": "分配了机群的配置",
       "createdFleet": "创建了机群",
       "renamedFleet": "重命名了机群",
       "deletedFleet": "删除了机群",
@@ -28934,6 +29498,7 @@
       "rolledBackRollout": "回滚了上线",
       "movedByToken": "通过注册令牌移动",
       "object": "对象",
+      "search": "搜索审计跟踪",
       "allObjects": "所有对象",
       "kind": {
         "fleet": "机群",
@@ -29040,6 +29605,7 @@
     "flowIssues": {
       "rollingOut": "正在上线 v{to}",
       "rolloutHalted": "v{to} 上线已暂停",
+      "rolloutWaiting": "v{to} 等待采集器上线",
       "autoRolledBack": "v{to} 已自动回滚",
       "noReason": "未上报失败原因",
       "openRollout": "打开上线",
diff --git a/web/src/locales/languages/zh-TW.json b/web/src/locales/languages/zh-TW.json
index ed98e87c50..612646b1e1 100644
--- a/web/src/locales/languages/zh-TW.json
+++ b/web/src/locales/languages/zh-TW.json
@@ -321,8 +321,13 @@
     "noLLMInsights": {
       "title": "尚無 LLM 活動",
       "description": "使用 OpenTelemetry Gen-AI 語意慣例對您的服務進行檢測，並擷取至少一筆追蹤以填入此儀表板。",
-      "action": "使用 OpenTelemetry 檢測",
-      "actionDesc": "在您的追蹤上擷取 gen_ai_* 屬性"
+      "action": "所有 AI 整合",
+      "actionDesc": "瀏覽所有框架與供應商指南",
+      "suggested": "設定 {name} 追蹤",
+      "suggestedDesc": "建議使用，因為您來自 {name} 文件",
+      "codingAgent": "使用編碼代理進行埋點",
+      "codingAgentDesc": "您的編碼代理會加入追蹤，並檢查第一筆追蹤",
+      "startFrom": "或從以下開始"
     },
     "noLLMSessions": {
       "title": "尚無 LLM 工作階段",
@@ -4797,6 +4802,13 @@
       "success": "成功",
       "failed": "失敗",
       "testRun": "測試執行",
+      "source": "來源",
+      "sourceHttp": "HTTP 請求",
+      "sourceAlertFired": "警示觸發",
+      "sourceIncidentEvent": "事件相關事件",
+      "sourceRetry": "重試執行",
+      "sourceManual": "手動執行",
+      "sourceOther": "其他",
       "runType": "類型",
       "testRunTooltip": "從編輯器啟動。目標步驟會實際傳送。",
       "showTestRuns": "顯示 {count} 個測試執行",
@@ -4810,7 +4822,33 @@
       "retryTitle": "要重試此執行嗎？",
       "retryMessage": "這會根據失敗執行所記錄的輸入建立新的執行。目標步驟會實際傳送。",
       "retryStarted": "重試已開始——它會以新執行的形式出現在清單中。",
-      "retryError": "無法重試此執行。"
+      "retryError": "無法重試此執行。",
+      "statusQueued": "已排隊",
+      "statusRunning": "執行中",
+      "statusExpired": "已過期",
+      "reasonExpired": "從未執行 · 排隊超過 1 小時",
+      "reasonWorkerLost": "worker 遺失 · 未重新執行",
+      "reasonWorkflowDisabled": "工作流程已停用",
+      "reasonRunTimeout": "15 分鐘後逾時",
+      "allTriggers": "所有觸發",
+      "triggerFilter": "觸發",
+      "run": "執行",
+      "searchRuns": "搜尋執行 ID、冪等鍵或警示",
+      "sourceDetails": "來源詳情",
+      "detailsWithKey": "{ip} · 鍵 {key}",
+      "detailsNoKey": "{ip} · 無冪等鍵",
+      "retryOf": "{run} 的重試",
+      "openRun": "開啟執行",
+      "alertFiredEmptyTitle": "此時間範圍內沒有警示觸發的執行",
+      "incidentEventEmptyTitle": "此時間範圍內沒有事件相關事件的執行",
+      "filterEmptyTitle": "此時間範圍內沒有符合的執行",
+      "filterEmptyDimmed": "其他執行仍在時間軸上，只是已變暗。",
+      "searchEmptyTitle": "沒有符合此搜尋的執行",
+      "searchEmptyAction": "清除搜尋",
+      "timelineNow": "現在",
+      "timelineAgoMinutes": "−{n}分",
+      "timelineAgoHours": "−{n}時",
+      "timelineAgoDays": "−{n}天"
     },
     "edit": "編輯",
     "view": "檢視",
@@ -4958,7 +4996,9 @@
           "noMatch": "無相符"
         },
         "suppressed": "已抑制 — 未傳送至實際目標"
-      }
+      },
+      "payloadFrom": "酬載來源",
+      "payloadFromHint": "HTTP 格式即為端點呼叫者所傳送的內容。"
     },
     "linkAlerts": {
       "title": "將工作流程連結至警示",
@@ -5151,6 +5191,279 @@
       "outputFormatLabel": "輸出格式",
       "tlsVerifyLabel": "TLS 驗證",
       "tlsDisabled": "已停用"
+    },
+    "http": {
+      "runTestHint": "以範例 HTTP 酬載執行步驟；不會呼叫 URL",
+      "runTestHintList": "開啟工作流程以執行測試",
+      "runsEmptyTitle": "此時間範圍內沒有 HTTP 請求",
+      "runsEmptyBody": "擴大時間範圍，或從 HTTP 端點面板傳送測試請求。",
+      "runsEmptyAction": "顯示所有觸發",
+      "runFailedAt": "此執行在 {step} 失敗：{error}",
+      "openStep": "開啟步驟",
+      "runGuardHint": "HTTP 執行攜帶的是請求，而非警示欄位。若此步驟會讀取 {fields}，請以條件防護：{guard}。",
+      "runExpiredBanner": "此請求在佇列中等待超過 1 小時，且從未執行。沒有任何步驟執行，也沒有呼叫任何目標。",
+      "runWorkerLostBanner": "執行此請求的工作程序已停止。系統不會自動重新執行，因為目標可能已被呼叫。請在呼叫方重新傳送前先檢查這些目標。",
+      "request": "請求",
+      "requestReceived": "接收時間",
+      "requestToken": "權杖",
+      "requestCallerIp": "呼叫方 IP",
+      "requestIdempotencyKey": "冪等鍵",
+      "requestContentType": "內容類型",
+      "requestBodySize": "主體大小",
+      "bodySizeBytes": "{size} B",
+      "bodySizeKiB": "{size} KiB",
+      "headers": "標頭",
+      "headersKept": "已保留 {count} 個 · Authorization、Cookie 與簽章一律不會儲存 | 已保留 {count} 個 · Authorization、Cookie 與簽章一律不會儲存",
+      "headerName": "名稱",
+      "headerValue": "值",
+      "outputCaption": "每個下游步驟收到的內容",
+      "useAsTestInput": "用作測試輸入",
+      "editorButton": "HTTP 端點",
+      "editorButtonOn": "開啟",
+      "editorButtonOff": "關閉",
+      "editorButtonTooltip": "允許其他系統透過 HTTP 請求啟動此工作流程",
+      "editorButtonRefusedDraft": "在工作流程發佈前，請求會收到 403",
+      "editorButtonRefusedPaused": "工作流程暫停期間，請求會收到 403",
+      "panelTitle": "HTTP 端點",
+      "panelSubtitle": "{name} · {kind} 工作流程",
+      "acceptRequests": "接受 HTTP 請求",
+      "kindNote": "此工作流程的步驟是為 {kind} 執行所建立。HTTP 執行則會改為取得請求 ({field})，因此若某步驟需要 {kind} 欄位，請新增條件。",
+      "kindNotePayload": "顯示 HTTP 酬載",
+      "kindNotePayloadHide": "隱藏 HTTP 酬載",
+      "unsavedBody": "此工作流程尚未儲存。請將其儲存為草稿，以建立其 URL 和權杖。在您發佈前，請求都會被拒絕。",
+      "saveAndCreate": "儲存草稿並建立端點",
+      "needsAdmin": "建立端點需要組織管理員權限。",
+      "needsEdit": "變更端點需要此工作流程的編輯權限。",
+      "readOnlyOnMeta": "開啟 · 您可以複製 URL。變更端點需要此工作流程的編輯權限。",
+      "offBody": "允許其他系統透過 HTTP 請求啟動此工作流程。您會取得 URL 和權杖。",
+      "offExistingBody": "關閉 · 在您開啟前，請求都會被拒絕 (403)。",
+      "onMeta": "開啟 · 只有在工作流程已啟用且發佈時，執行才會開始",
+      "loadError": "無法載入端點設定。",
+      "draftBanner": "此工作流程是草稿。在您發佈前，呼叫 URL 會收到 403。您現在可以設定端點，而「執行測試」會使用範例 HTTP 酬載執行草稿的步驟。",
+      "disabledBanner": "在工作流程啟用前，請求都會被拒絕 (403)。",
+      "turnOnFailed": "無法開啟端點。{reason}",
+      "changeFailed": "無法儲存端點。{reason}",
+      "endpointExistsHint": "端點已存在。請至「權杖」資料表顯示或複製其權杖。",
+      "endpointExistsHintSigned": "端點已存在。請至「簽章密鑰」資料表顯示或複製其簽章密鑰。",
+      "disableTitle": "要關閉端點嗎？",
+      "disableBody": "在您再次開啟前，呼叫方會收到 403 (端點已關閉)。URL 和權杖維持不變。",
+      "disableConfirm": "關閉",
+      "lastCall": "開啟 · 上次呼叫：{status} · {time} · {link}",
+      "lastCallNone": "開啟 · 尚無呼叫 — 傳送測試請求",
+      "lastCallNoneRefused": "開啟 · 尚無呼叫",
+      "viewRun": "檢視執行",
+      "lastCallStatus": {
+        "queued": "已排隊",
+        "running": "執行中",
+        "succeeded": "成功",
+        "failed": "失敗",
+        "expired": "已過期"
+      },
+      "endpointUrl": "端點 URL",
+      "tokenLabel": "權杖",
+      "secretLabel": "簽章密鑰",
+      "newTokenLabel": "新權杖",
+      "newSecretLabel": "新簽章密鑰",
+      "tokenHint": "畫面上會遮蔽；「複製」會複製真正的權杖。請以 {header} 傳送，切勿放在 URL 中。",
+      "secretHint": "畫面上會遮蔽；「複製」會複製真正的密鑰。請用它為每個請求簽章，並傳送 {headers} 標頭；切勿傳送密鑰本身。",
+      "revealBannerTitle": "端點已建立",
+      "revealBannerBody": "每個請求都請帶上此權杖。您可以在「權杖」資料表中再次顯示或複製它。",
+      "revealBannerBodySigned": "請使用此密鑰為每個請求簽章。您可以在「簽章密鑰」資料表中再次顯示或複製它。",
+      "switchedBannerTitle": "權杖已建立",
+      "switchedBannerTitleSigned": "簽章密鑰已建立",
+      "rotateBannerTitle": "新權杖已建立",
+      "rotateBannerTitleSigned": "新簽章密鑰已建立",
+      "rotateBannerBody": "呼叫端會沿用相同的 URL 與標頭；只有權杖會變更。舊權杖在到期前仍可繼續使用，且在此之前仍可顯示。",
+      "rotateBannerBodySigned": "呼叫端會沿用相同的 URL 與標頭；只有密鑰會變更。舊密鑰在到期前仍可繼續使用，且在此之前仍可顯示。",
+      "rotateBannerBodyRevoked": "呼叫端會沿用相同的 URL 與標頭；只有權杖會變更。舊權杖已被撤銷，現在起停止運作。",
+      "rotateBannerBodyRevokedSigned": "呼叫端會沿用相同的 URL 與標頭；只有密鑰會變更。舊密鑰已被撤銷，現在起停止運作。",
+      "rotateBannerBodyFresh": "呼叫端會沿用相同的 URL 與標頭，並從現在起傳送此權杖。",
+      "rotateBannerBodyFreshSigned": "呼叫端會沿用相同的 URL 與標頭，並從現在起使用此密鑰簽章。",
+      "snippetsLabel": "範例請求",
+      "sendTest": "傳送測試請求",
+      "sendTestHint": "檢查憑證，並顯示您的步驟會收到的內容。不會啟動任何執行，也不會呼叫任何目標。",
+      "sendTestHintPaused": "檢查憑證。此工作流程已暫停，因此在建構任何輸入前就會拒絕呼叫；「執行測試」會執行步驟。",
+      "sendTestSigned": "瀏覽器無法為請求簽章，因此請使用上方的範例請求進行測試。在其 URL 加上 ?dry_run=true，即可在不啟動執行的情況下檢查簽章。",
+      "dryRunAccepted": "已接受試運行",
+      "dryRunMeta": "憑證有效 · {size} 主體",
+      "dryRunInput": "您的步驟會收到的輸入",
+      "dryRunRefused": "憑證有效。在工作流程發布前，請求都會被拒絕。",
+      "dryRunRefusedPaused": "憑證有效。工作流程暫停期間，請求都會被拒絕。",
+      "dryRunRateLimited": "已達速率限制 — 試運行會計入限制。",
+      "dryRunStatus": "請求遭到拒絕，狀態為 {status}。",
+      "dryRunFailed": "無法傳送測試請求。{reason}",
+      "runTestInstead": "改為執行測試",
+      "done": "完成",
+      "regionTag": "區域 {name}",
+      "regionBanner": "請將每個請求及每次重試都傳送到此區域的主機。冪等鍵與執行狀態（{field}）會保留在接受呼叫的區域，因此傳送到其他區域的重試可能會啟動第二次執行。",
+      "authLabel": "呼叫端使用以下方式驗證",
+      "authToken": "權杖",
+      "authSigned": "簽章請求",
+      "authAbout": "關於驗證",
+      "authInfo": "權杖：在 Authorization 標頭中傳送權杖。簽章請求：使用共用密鑰為每個請求簽章（{headers} 標頭）。",
+      "switchToSignedTitle": "要切換為簽章請求嗎？",
+      "switchToSignedBody": "切換後會立即撤銷目前的權杖，並建立簽章密鑰。使用該權杖的呼叫端將開始收到 401。",
+      "switchToTokenTitle": "切換為權杖？",
+      "switchToTokenBody": "切換後會立即撤銷目前的簽署密鑰並建立權杖。簽署請求的呼叫端將開始收到 401。",
+      "tokensTitle": "權杖",
+      "secretsTitle": "簽署密鑰",
+      "colToken": "權杖",
+      "colSecret": "密鑰",
+      "colCreated": "建立時間",
+      "colLastUsed": "上次使用",
+      "colStatus": "狀態",
+      "colActions": "操作",
+      "never": "從未",
+      "active": "啟用中",
+      "retiring": "退役中",
+      "creatorGone": "建立者已不在此組織中",
+      "revoke": "撤銷",
+      "revokeNow": "立即撤銷",
+      "revokeTitle": "要撤銷 {prefix} 嗎？使用它的呼叫端會立即收到 401。",
+      "revokeFailed": "無法撤銷。{reason}",
+      "copyToken": "複製權杖",
+      "copySecret": "複製密鑰",
+      "tokenCopied": "已複製權杖",
+      "commandCopied": "已複製命令",
+      "secretCopied": "已複製密鑰",
+      "revealFailed": "無法顯示權杖。{reason}",
+      "revealFailedSigned": "無法顯示密鑰。{reason}",
+      "revealDenied": "只有管理員可以顯示或複製此端點的權杖。",
+      "runTest": "執行測試",
+      "rotate": "輪換",
+      "rotateBlocked": "請先撤銷退役中的權杖",
+      "rotateBlockedSigned": "請先撤銷退役中的密鑰",
+      "rotateTitle": "輪換權杖",
+      "rotateTitleSigned": "輪換簽署密鑰",
+      "rotateLead": "現在會建立新的權杖。讓 {prefix}（上次使用 {time}）繼續運作",
+      "rotateLeadSigned": "現在會建立新的簽署密鑰。讓 {prefix}（上次使用 {time}）繼續運作",
+      "overlapNow": "立即撤銷",
+      "overlapHour": "1 小時",
+      "overlapDay": "24 小時",
+      "overlapWeek": "7 天",
+      "rotateConsequence": "使用目前權杖的呼叫端會持續運作到 {time}。請在此之前更新。",
+      "rotateConsequenceSigned": "使用目前密鑰簽署的呼叫端會持續運作到 {time}。請在此之前更新。",
+      "rotateConsequenceNow": "使用目前權杖的呼叫端從現在起會收到 401。",
+      "rotateConsequenceNowSigned": "使用目前密鑰簽署的呼叫端從現在起會收到 401。",
+      "rotateConfirm": "輪換權杖",
+      "rotateConfirmSigned": "輪換簽署密鑰",
+      "rotateFailed": "無法輪換。{reason}",
+      "advanced": "進階",
+      "advancedSummary": "最大主體 {size} · 每分鐘 {count} 個請求 | 最大主體 {size} · 每分鐘 {count} 個請求",
+      "maxBody": "最大主體大小 (KiB)",
+      "maxBodyHint": "上限為 1024 (1 MiB)；只能調低",
+      "maxBodyRange": "請輸入 1 到 1024 的整數",
+      "rateLimit": "每分鐘請求數",
+      "rateLimitHint": "此組織每分鐘最多 {org} 次",
+      "rateLimitRange": "請輸入 1 到 {org} 之間的整數",
+      "saveLimitsFailed": "無法儲存限制。{reason}",
+      "deleteMeta": "移除 URL 及所有權杖或密鑰。",
+      "deleteButton": "刪除端點",
+      "deleteTitle": "要刪除此端點嗎？",
+      "deleteBody": "URL 會立即失效：呼叫方會收到 401。所有權杖與簽章密鑰都會被刪除且無法復原。執行歷程會保留。",
+      "deleteFailed": "無法刪除端點。{reason}",
+      "secretStorageWarning": "此伺服器沒有加密主密鑰，因此權杖與簽章密鑰會以任何可存取資料庫的人都能讀取的形式儲存。請要求管理員設定一組。",
+      "rejectionsLine": "過去 24 小時約有 {count} 個請求遭拒 · 最近一次：{reason}，{time} | 過去 24 小時約有 {count} 個請求遭拒 · 最近一次：{reason}，{time}",
+      "rejectionsShow": "顯示",
+      "rejectionsHide": "隱藏",
+      "rejectionsTitle": "近期拒絕",
+      "rejectionsCaption": "過去 24 小時約 {count} 次 · 呼叫方只看到狀態碼 | 過去 24 小時約 {count} 次 · 呼叫方只看到狀態碼",
+      "rejectionMeta": "約 {count} 次 · 最近 {time} · 來自 {ip} | 約 {count} 次 · 最近 {time} · 來自 {ip}",
+      "rejectionsLoadError": "無法載入拒絕記錄。",
+      "raiseLimit": "提高限制",
+      "rotateLink": "輪替",
+      "reason": {
+        "invalid_token": {
+          "title": "權杖無效",
+          "fix": "呼叫方傳送的權杖已撤銷、過期或輸入錯誤。請從「權杖」資料表顯示或複製目前的權杖。"
+        },
+        "invalid_signature": {
+          "title": "簽章無效",
+          "fix": "呼叫方使用舊的或錯誤的密鑰簽章。請確認其使用目前的密鑰，並完全按照傳送的內容簽署 {format}。"
+        },
+        "stale_timestamp": {
+          "title": "時間戳過舊",
+          "fix": "呼叫方的時鐘偏差超過 5 分鐘。請同步其時鐘，並在傳送前才簽章。"
+        },
+        "endpoint_disabled": {
+          "title": "端點已關閉",
+          "fix": "開啟端點。"
+        },
+        "workflow_disabled": {
+          "title": "工作流程已暫停",
+          "fix": "從清單中繼續工作流程。"
+        },
+        "workflow_not_published": {
+          "title": "工作流程尚未發佈",
+          "fix": "發佈工作流程；草稿會拒絕請求。"
+        },
+        "payload_too_large": {
+          "title": "承載內容過大",
+          "fix": "超過 {size}。請減少傳送量，或將事件分散到多個請求。"
+        },
+        "credential_in_url": {
+          "title": "URL 中含有憑證",
+          "fix": "權杖或密鑰被放在 URL 中傳送而遭拒。URL 會留在代理與瀏覽器日誌中，因此請立即輪替，之後改在標頭中傳送。"
+        },
+        "invalid_idempotency_key": {
+          "title": "冪等鍵無效",
+          "fix": "Idempotency-Key 標頭為空或超過 255 個字元。"
+        },
+        "idempotency_key_reused": {
+          "title": "冪等鍵重複使用",
+          "fix": "相同的鍵以不同的內容送達。每個不同事件請使用新的鍵。"
+        },
+        "rate_limited": {
+          "title": "已受速率限制",
+          "fix": "每分鐘超過 {count} 個請求。請將事件批次合併為單一請求（傳送 JSON 陣列），或提高限制——此組織每分鐘最多 {org} 次。"
+        },
+        "queue_full": {
+          "title": "佇列已滿",
+          "fix": "此組織已有 {count} 個 HTTP 執行在等待。呼叫方應在 Retry-After 延遲後重試；請找出緩慢的步驟或降低傳送速率。"
+        },
+        "worker_unavailable": {
+          "title": "Worker 無法使用",
+          "fix": "此區域沒有執行中的工作流程 Worker，因此沒有任何項目排入佇列。在 Retry-After 延遲後重試的呼叫方，會在 Worker 恢復後成功；若持續發生，請要求管理員檢查工作流程 Worker。"
+        }
+      },
+      "nodeBadge": "可透過 HTTP 呼叫",
+      "triggerLinkOn": "也會在 HTTP 請求時執行",
+      "triggerLinkOnAction": "管理端點",
+      "triggerLinkOff": "也可從其他系統啟動",
+      "triggerLinkOffAction": "設定 HTTP 端點",
+      "pickerCue": "任何工作流程也可以透過 HTTP 請求啟動。請選擇其觸發器，然後使用工具列中的 HTTP 端點。",
+      "listTag": "HTTP",
+      "listTagTooltip": "HTTP 端點已啟用",
+      "listMenuItem": "HTTP 端點…",
+      "copyUrl": "複製端點 URL",
+      "copyUrlDraftHint": "發布前，請求將被拒絕",
+      "copyUrlFailed": "無法複製端點 URL。{reason}",
+      "payloadFrom": "承載資料來源",
+      "payloadHttp": "HTTP 請求",
+      "bodySizeMiB": "{size} MiB",
+      "expiresInHours": "{count} 小時後到期 | {count} 小時後到期",
+      "expiresInDays": "{count} 天後到期 | {count} 天後到期",
+      "expired": "已到期",
+      "rotateLeadUnused": "現在會建立新權杖。讓 {prefix}（從未使用）繼續有效，為期",
+      "rotateLeadUnusedSigned": "現在會建立新的簽章密鑰。讓 {prefix}（從未使用）繼續有效，為期",
+      "fieldGroup": "HTTP 請求",
+      "fieldGroupBodyHint": "請求本文內的欄位需要先經過函式步驟",
+      "fieldGroupQueryHint": "查詢參數為 meta.query.<key>；重複的鍵會以清單形式傳入，且不會相符",
+      "rotateLeadNone": "目前沒有使用中的權杖，因此呼叫端無法驗證。現在會建立新權杖。",
+      "rotateLeadNoneSigned": "目前沒有使用中的簽章密鑰，因此呼叫端無法驗證。現在會建立新的簽章密鑰。",
+      "createForbidden": "您無法在此組織中建立端點憑證。",
+      "errorNotConfigured": "此工作流程沒有 HTTP 端點。",
+      "errorNoLiveCredential": "目前沒有使用中的憑證。請輪替以建立一個。",
+      "errorNotAllowed": "您沒有執行此操作的權限。",
+      "copyCredentialChanged": "憑證已變更。請再次複製。",
+      "copyCommandFailed": "無法複製指令。{reason}",
+      "exampleRequest": "請求範例",
+      "exampleActiveToken": "使用中的權杖 · {prefix}",
+      "exampleActiveSecret": "使用中的密鑰 · {prefix}",
+      "exampleHintToken": "複製內容包含權杖。可貼到終端機，或匯入 Postman 或 Insomnia（Import → Raw text）。",
+      "exampleHintSigned": "在 bash 中執行：它會使用 openssl 簽章，然後呼叫 curl。複製內容包含密鑰。匯入工具無法簽章。",
+      "exampleHintTokenPlaceholder": "複製內容會在權杖的位置放置預留位置。可貼到終端機，或匯入 Postman 或 Insomnia（Import → Raw text）。",
+      "exampleHintSignedPlaceholder": "在 bash 中執行：它會使用 openssl 簽章，然後呼叫 curl。複製內容會在密鑰的位置放置預留位置。匯入工具無法簽章。"
     }
   },
   "pipeline": {
@@ -6021,7 +6334,19 @@
       "viewDocsPrefix": "按一下",
       "viewDocsLinkLabel": "這裡",
       "viewDocsSuffix": "以查看進一步的文件。",
-      "selectIntegrationPrompt": "選取一個整合以檢視詳細資訊。"
+      "selectIntegrationPrompt": "選取一個整合以檢視詳細資訊。",
+      "codingAgent": {
+        "tabAgent": "使用程式碼代理",
+        "tabSteps": "逐步操作",
+        "streamLabel": "追蹤串流名稱",
+        "streamHelp": "代理程式會將追蹤資料寫入此串流並進行檢查。",
+        "envTitle": "下載您的 .env",
+        "envHelp": "請將其儲存在專案根目錄。技能會從此檔案讀取權杖，因此權杖不會出現在聊天中。",
+        "envButton": "下載 .env",
+        "promptTitle": "將此內容貼到 {client1}、{client2} 或 {client3}",
+        "promptLabel": "提示詞",
+        "promptCopied": "已複製提示詞"
+      }
     },
     "header": "資料來源",
     "resetRUMTokenLabel": "重設 RUM 權杖",
@@ -7665,6 +7990,15 @@
     "queryValues": "查詢值",
     "constant": "常數",
     "textbox": "文字方塊",
+    "date": "日期",
+    "dateFormat": "輸出日期格式",
+    "dateFormatHelp": "查詢中的預設輸出。每次使用時可透過 ${'{'}name:format{'}'} 覆寫，例如 ${'{'}name:epochus{'}'}。",
+    "dateFormatIso": "YYYY-MM-DD (iso)",
+    "dateFormatDmy": "DD/MM/YYYY (dmy)",
+    "dateFormatMdy": "MM/DD/YYYY (mdy)",
+    "dateFormatEpoch": "Epoch 秒 (epoch)",
+    "dateFormatEpochms": "Epoch 毫秒 (epochms)",
+    "dateFormatEpochus": "Epoch 微秒 (epochus)",
     "newFolder": "新增資料夾",
     "updateFolder": "更新資料夾",
     "newReport": "新增報表",
@@ -8775,6 +9109,8 @@
       "addAnnotations": "新增註釋",
       "dependentAdhocVariableWarning": "部分動態變數未套用，因為該欄位不存在於查詢的串流中。開啟查詢檢查器以查看變數和執行以呈現此面板的查詢的所有詳細資訊。",
       "refreshCacheReload": "重新整理快取並重新載入",
+      "exploreCreateAlert": "建立警示",
+      "exploreAddToDashboard": "新增至儀表板",
       "redirectingToLogs": "正在重新導向至日誌頁面",
       "pleaseWait": "請稍候..."
     },
@@ -9336,11 +9672,18 @@
       "constant": "常數",
       "textbox": "文字方塊",
       "custom": "自訂",
+      "date": "日期",
       "list": "{type} · {example}",
       "csv": "逗號：{example}",
       "pipe": "豎線：{example}",
       "doublequote": "雙引號：{example}",
-      "singlequote": "單引號：{example}"
+      "singlequote": "單引號：{example}",
+      "dateIso": "日期 (YYYY-MM-DD)：{example}",
+      "dateDmy": "日優先 (DD/MM/YYYY)：{example}",
+      "dateMdy": "月優先 (MM/DD/YYYY)：{example}",
+      "dateEpoch": "Epoch 秒：{example}",
+      "dateEpochms": "Epoch 毫秒：{example}",
+      "dateEpochus": "Epoch 微秒：{example}"
     },
     "add": "新增面板",
     "save": "儲存",
@@ -11498,6 +11841,7 @@
         "badgeAcknowledged": "已確認",
         "badgeResolved": "已解決",
         "badgeReopened": "已重新開啟",
+        "badgeAckEnded": "確認已結束",
         "badgeDimensionsUpgraded": "維度已升級",
         "badgeTitleChanged": "標題已變更",
         "badgeAssignment": "指派",
@@ -11509,6 +11853,7 @@
         "badgeAiNeedsInput": "AI 需要輸入",
         "incidentWas": "事故已",
         "theIncident": "此事故",
+        "ackEndedByPageResolve": "透過解決其中一個值班通知",
         "unnamedAlert": "警示",
         "alertTriggered": "{alert} 已觸發 | {alert} 已觸發 {count} 次",
         "severityUpgraded": "嚴重程度已從 {from} 升級為 {to}",
@@ -12456,6 +12801,13 @@
         "rumfunnel": {
           "label": "警示我",
           "toast": "已從產品分析匯入:「{sourceLabel}」"
+        },
+        "traces": {
+          "label": "建立警示",
+          "toast": "已從您的追蹤搜尋匯入查詢",
+          "noStream": "請先選擇串流",
+          "errorCount": "錯誤計數",
+          "errorRate": "錯誤率"
         }
       },
       "warnings": {
@@ -12489,7 +12841,21 @@
         "heldFilterDropped": "您的搜尋篩選條件未一併帶入，因為它需要先在日誌頁面選擇執行身分。如需使用，請將其加入警示查詢。",
         "thresholdColumnGuessed": "閾值已套用至 {column}；請確認這是您想要的值。",
         "thresholdNotCarried": "由於您選擇了其他查詢，圖表中的閾值 {value} 未被套用。",
-        "rumFunnelExclusions": "使用此應用程式目前的應用程式篩選器；當它們變更後，請重新建立。"
+        "rumFunnelExclusions": "使用此應用程式目前的應用程式篩選器；當它們變更後，請重新建立。",
+        "tracesSeedMatches": "當 {minutes} 分鐘內符合條件的 Span 超過 {threshold}（目前為 {current}）時觸發。",
+        "tracesSeedSpans": "當 {minutes} 分鐘內的 Span 超過 {threshold}（目前為 {current}）時觸發。",
+        "tracesSeedTraces": "當 {minutes} 分鐘內的追蹤超過 {threshold}（目前為 {current}）時觸發。",
+        "tracesSeedErrorSpans": "當 {minutes} 分鐘內的錯誤 Span 超過 {threshold}（目前為 {current}）時觸發。",
+        "tracesSeedErrorTraces": "當 {minutes} 分鐘內含錯誤的追蹤超過 {threshold}（目前為 {current}）時觸發。",
+        "tracesSeedErrorRatio": "當 {minutes} 分鐘內的錯誤率超過 {threshold}%（目前為 {current}%）時觸發。",
+        "tracesErrorRatioMinSpans": "僅檢查至少有 {minimum} 個 Span 的時間範圍，因此在平靜期間的少數失敗不會觸發。",
+        "tracesErrorRatioMinTraces": "僅檢查至少有 {minimum} 個追蹤的時間範圍，因此在平靜期間的少數失敗不會觸發。",
+        "tracesSeedDuration": "當 {minutes} 分鐘內的 {percentile} 持續時間高於 {threshold} ms（目前為 {current} ms）時觸發。",
+        "tracesSeedUnavailable": "無法讀取目前的值，因此閾值從 0 開始。儲存前請先設定。",
+        "tracesNoMatches": "目前尚無符合條件的 Span，因此一旦出現就會觸發警示。",
+        "tracesStoredSpans": "計數以已儲存的 Span 為準，因此取樣流量會比實際偏低。",
+        "tracesPeriodCapped": "警示時間範圍已上限為 {minutes} 分鐘，以確保每次檢查快速。",
+        "tracesNotRun": "此搜尋尚未執行，因此警示會使用編輯器中的篩選條件。"
       }
     },
     "saveFailed": "無法儲存警示。",
@@ -13901,6 +14267,8 @@
       "noMatch": "沒有符合目前篩選條件的指標",
       "noMatchHint": "請嘗試移除標籤篩選器、清除前綴/後綴選項，或從「有資料」切換為「全部」。",
       "noMatchHintFavorites": "嘗試移除標籤篩選器，或從「有資料」切換至「全部」。",
+      "noMatchYet": "尚未找到含有資料的指標",
+      "noMatchYetHint": "目前檢查的指標未傳回資料。顯示更多以繼續尋找。",
       "clearAllFilters": "清除所有篩選器",
       "emptyActions": {
         "clearSearch": "清除搜尋",
@@ -14117,7 +14485,8 @@
       "panelAdded": "面板已新增至儀表板",
       "errorAddingPanel": "新增面板時發生錯誤",
       "selectDashboard": "請選擇儀表板",
-      "selectTab": "請選擇標籤頁"
+      "selectTab": "請選擇標籤頁",
+      "panelsToAdd": "要新增的面板"
     },
     "groups": {
       "compute": "計算",
@@ -15165,6 +15534,24 @@
     "searchTypeOthers": "其他"
   },
   "traces": {
+    "nlNeedsSql": "此問題需要 SQL；請在日誌中開啟",
+    "redActions": {
+      "menuGroupDashboards": "儀表板",
+      "addRedToDashboard": "將 RED 圖表新增至儀表板",
+      "durationActions": "持續時間操作",
+      "bucketNotice": {
+        "seconds": "這些圖表會保留您目前看到的 {count} 秒長條。",
+        "minutes": "這些圖表會保留您目前看到的 {count} 分鐘長條。",
+        "hours": "這些圖表會保留您目前看到的 {count} 小時長條。",
+        "days": "這些圖表會保留您目前看到的 {count} 天長條。"
+      },
+      "bucketNoticeSingle": {
+        "seconds": "此圖表會保留您目前看到的 {count} 秒長條。",
+        "minutes": "此圖表會保留您目前看到的 {count} 分鐘長條。",
+        "hours": "此圖表會保留您目前看到的 {count} 小時長條。",
+        "days": "此圖表會保留您目前看到的 {count} 天長條。"
+      }
+    },
     "latencyHeatmap": {
       "title": "持續時間",
       "tooltipSpans": "{count} 個 Span | {count} 個 Span",
@@ -15391,6 +15778,13 @@
     "nextMatch": "下一個符合",
     "searchInSpans": "在 spans 中搜尋",
     "criticalPath": "關鍵路徑",
+    "askAi": {
+      "explainTrace": "說明追蹤",
+      "explainTraceHint": "向 AI 詢問關鍵路徑上最慢的 Span 以及每個錯誤 Span",
+      "askAboutSpan": "向 AI 詢問此 Span",
+      "spanChip": "Span · {operation}",
+      "traceChip": "追蹤 · {operation}"
+    },
     "spansTableView": "Spans 表格檢視",
     "comingSoon": "即將推出...",
     "fetchingTrace": "正在擷取追蹤。",
@@ -15493,7 +15887,7 @@
         "filterErrors": "篩選錯誤",
         "resetFilters": "重設篩選條件",
         "errorsNone": "無錯誤 · {total} 輪次",
-        "latencyLead": "最慢 {slowest} ·",
+        "latencyLead": "平均輪次 {avg} · 最慢 {slowest} ·",
         "costLead": "峰值 {peak} ·",
         "tokens": "{ratio}% 已快取",
         "cacheImpact": "{ratio}% 被重用 · {tokens} Tok 讀取",
@@ -15669,6 +16063,7 @@
     "lLMErrorTable": {
       "noData": "無資料",
       "noErrorsInRange": "此時間範圍內沒有錯誤",
+      "loadFailed": "無法載入最近的錯誤",
       "time": "時間",
       "service": "服務",
       "operation": "操作",
@@ -16640,7 +17035,51 @@
     "tierAlwaysActive": "永遠啟用 (預設)",
     "testAtTimeLabel": "以 UTC 時間測試",
     "testAtTimeHint": "留空以使用目前時間。尖峰 / 離峰層級將依據此時間判斷。",
-    "localTimeHint": "您的時區：{range}"
+    "localTimeHint": "您的時區：{range}",
+    "builtInStatus": {
+      "seed": "內建價格：隨此版本提供的初始清單，日期為 {date}。",
+      "neverSynced": "伺服器啟動後尚未執行線上同步。",
+      "lastSynced": "上次線上同步時間 {time}。"
+    },
+    "unpriced": {
+      "title": "定價缺口",
+      "subtitle": "在擷取時，您的 LLM 追蹤中沒有價格或僅有約略價格的模型",
+      "banner": "在擷取時，{count} 個模型沒有價格或僅有約略價格。其記錄的成本可能不完整。 | 在擷取時，{count} 個模型沒有價格或僅有約略價格。其記錄的成本可能不完整。",
+      "bannerTruncated": "您的追蹤中有 {total} 個模型在擷取時沒有價格或僅有約略價格。其成本可能有誤。依 token 數顯示前 {shown} 個。",
+      "streamLabel": "串流",
+      "window": "過去 24 小時",
+      "windowRange": "{from} – {to}",
+      "colModel": "追蹤中出現的模型",
+      "colPricedAs": "計價為",
+      "colTokens": "Token",
+      "colCost": "記錄的成本",
+      "colActions": "操作",
+      "spans": "{count} 個 Span | {count} 個 Span",
+      "moreAgents": "+{count} 個",
+      "noMatch": "無符合項目",
+      "approximate": "約略",
+      "pricedNow": "已為新的 Span 計價",
+      "historicalGap": "此時間範圍保留其記錄的定價缺口。新的 Span 使用目前價格。",
+      "noActionNeeded": "無需操作",
+      "defaultTierPrices": "輸入 {input} / 輸出 {output} 每 1M",
+      "notPriced": "未計價",
+      "createPrice": "建立價格",
+      "keepPrices": "保留 {name} 價格",
+      "mute": "靜音",
+      "muteConfirmTitle": "要靜音此模型嗎？",
+      "muteConfirmMessage": "{model} 的新 Span 將以免費計價。較舊的 Span 保留其記錄的成本。刪除 \"{name}\" 價格即可取消靜音。",
+      "mutedNotif": "{model} 已靜音",
+      "keptNotif": "{model} 現在使用 {name} 價格",
+      "errSave": "儲存價格失敗",
+      "errLoad": "載入未計價模型失敗",
+      "emptyTitle": "此串流在此時間範圍內沒有記錄到未計價或約略計價的模型用量。",
+      "noStreamsTitle": "沒有 LLM 追蹤串流",
+      "noStreamsDesc": "當 gen_ai Span 進入追蹤串流後，模型就會顯示在這裡。",
+      "recordedCostNote": "新價格套用於儲存後擷取的 Span。較舊的 Span 保留其記錄的成本。",
+      "noModelName": "（無模型名稱）",
+      "noModelHint": "沒有可計價的模型：請設定 gen_ai.request.model",
+      "instrumentationDocs": "Instrumentation 指南"
+    }
   },
   "aiObservability": {
     "title": "AI 可觀測性",
@@ -17233,6 +17672,8 @@
       "skipTiers": "已略過列：{full} 完全略過 · {partial} 部分略過",
       "scoreEvidence": "{scorer} · v{version}：{samples} 個樣本，{noReference} 個無參考，{noTrace} 個無追蹤",
       "scorerApplicability": "{scorer} · v{version}：{eligible} 個有效槽位，{noReference} 個無參考",
+      "costUnknown": "成本未知",
+      "costAtLeast": "≥ {cost}",
       "loadError": "載入實驗失敗",
       "previewError": "預覽實驗槽位失敗",
       "createSuccess": "實驗已建立",
@@ -17315,6 +17756,8 @@
         "costConfirmMessage": "此實驗估計成本約 {cost}，超過 {threshold} 警告閾值。仍要建立並執行嗎？",
         "costConfirmMessageUnpriced": "此實驗的預估成本超過警示閾值。仍要建立並執行嗎？",
         "costConfirmOk": "仍要建立",
+        "taskProviderFailed": "未建立任何內容。任務供應商 {provider} 未回應測試呼叫。",
+        "judgeProviderFailed": "未建立任何內容。評分供應商 {provider} 未回應測試呼叫。",
         "skippedFully": "{count} 行完全跳過 — 每個選取的評分器都需要預期輸出。跳過的行執行不花費任何成本。",
         "skippedPartially": "{count} 行部分跳過 — 任務仍會執行，但基於參考的評分器無法對沒有預期輸出的行進行評分。",
         "skippedNone": "每個匹配的行至少可在一項維度上評分。",
@@ -17403,7 +17846,26 @@
           "trials": "試驗",
           "dispersion": "離散度",
           "latency": "延遲",
-          "p50Latency": "P50 延遲"
+          "p50Latency": "P50 延遲",
+          "error": "錯誤"
+        },
+        "failureBanner": {
+          "title": "{total} 個執行槽中有 {failed} 個失敗：{cause}。",
+          "cause": "主要原因，{count} 個執行槽：{message}",
+          "moreCauses": "+ 另有 {count} 個原因",
+          "noMessage": "未記錄錯誤訊息",
+          "openProviders": "開啟供應商"
+        },
+        "failureKinds": {
+          "provider_auth": "供應商拒絕了憑證",
+          "rate_limited": "供應商對此次執行做了速率限制",
+          "timeout": "供應商未及時回應",
+          "provider_5xx": "供應商傳回伺服器錯誤",
+          "parse_error": "無法解析輸出",
+          "mapping_error": "無法建構任務輸入",
+          "scorer_missing": "評分器已不存在",
+          "execution_error": "任務呼叫失敗",
+          "unknown": "任務呼叫失敗"
         },
         "saveAsPrompt": "另存為提示詞",
         "openPrompt": "開啟提示詞",
@@ -17684,7 +18146,11 @@
     "scope": {
       "env": "環境",
       "agent": "代理",
-      "version": "版本"
+      "version": "版本",
+      "agentIdHint": "Agent ID：{ids}",
+      "noAgentIdentity": "找不到 Agent 身分",
+      "noAgentIdentityDescription": "這些 LLM Span 沒有 Agent 名稱，因此依串流呈現。請對應可指出 Agent 名稱的屬性，即可依 Agent 檢視。",
+      "noAgentIdentityAction": "開啟 GenAI Agent 對應"
     },
     "agentGraph": {
       "stream": "串流",
@@ -18298,6 +18764,10 @@
   },
   "onlineEvals": {
     "versionPrefix": "v",
+    "disabled": {
+      "title": "此伺服器已停用評估",
+      "description": "此頁面需要線上評估功能，但此伺服器已將其關閉。請聯絡管理員啟用。"
+    },
     "traceScoreChip": {
       "reasoning": "為什麼",
       "noReasoning": "此分數未記錄推理內容。",
@@ -18544,7 +19014,7 @@
       "remoteCta": "設定端點"
     },
     "provider": {
-      "backTo": "返回供應商",
+      "backTo": "供應商",
       "createTitle": "建立 LLM 供應商",
       "editTitle": "編輯 LLM 供應商",
       "subtitle": "設定 LLM 評審評分器使用的模型端點。",
@@ -18789,7 +19259,7 @@
           "duplicateName": "Scorer {index}: 名稱 \"{name}\" 在此匯入中重複使用"
         }
       },
-      "backTo": "返回評分器",
+      "backTo": "評分器",
       "badgeRemote": "遠端",
       "badgeLlm": "LLM 評審",
       "createTitleRemote": "新增遠端評分器",
@@ -18820,6 +19290,9 @@
       "providerPlaceholder": "選擇供應商",
       "modelLabel": "模型",
       "modelPlaceholder": "gpt-4o",
+      "temperatureLabel": "溫度",
+      "temperaturePlaceholder": "0",
+      "temperatureHelp": "0 到 2。留空則以 0 進行評分。",
       "promptLabel": "評審提示",
       "includeReasoningLabel": "包含推理",
       "includeReasoningHint": "評審解釋為何給出該分數，並與每個結果一起儲存。",
@@ -18893,6 +19366,7 @@
         "apiKeyHeaderRequired": "Header name is required",
         "apiKeyTokenRequired": "Token is required",
         "timeoutInvalid": "Timeout must be 0 or greater",
+        "temperatureInvalid": "溫度必須介於 0 到 2 之間",
         "retriesInvalid": "Retries must be 0 or greater",
         "duplicateFieldName": "Field names must be unique"
       },
@@ -18999,6 +19473,7 @@
         "degraded": "已降級",
         "waitingForCredentials": "等待憑證",
         "noRecentRuns": "近期沒有執行紀錄",
+        "lastScored": "上次評分 {time}",
         "summary": "過去 15 分鐘內，{runs} 次執行中有 {errors} 次失敗",
         "since": "{time}進入此狀態",
         "checked": "上次檢查：{time}"
@@ -19021,7 +19496,7 @@
       "samplingValuePreview": "評估 {percent}% 的匹配目標。",
       "samplingValueAllHelp": "每個匹配的目標都會被評估。",
       "samplingHelp": "在過濾後執行，以控制成本。",
-      "backTo": "返回評估作業",
+      "backTo": "評估工作",
       "createTitle": "新增評估工作",
       "editTitle": "更新評估工作",
       "stepper": {
@@ -22442,7 +22917,8 @@
       "thisBranchAlreadyEndsInA": "此分支已結束於一個目標。",
       "chooseATriggerNodeToStart": "選擇觸發節點以開始您的工作流程",
       "thisConnectionWouldCreateALoop": "此連線會造成迴圈",
-      "onlyOneIncomingConnectionToA": "每個步驟只允許一個傳入連線"
+      "onlyOneIncomingConnectionToA": "每個步驟只允許一個傳入連線",
+      "endpointUrlCopied": "端點 URL 已複製"
     },
     "views": {
       "youAreNotAuthorizedToManage": "您無權管理授權。",
@@ -24092,6 +24568,7 @@
     "databases": {
       "searchPlaceholder": "搜尋資料庫或服務…",
       "unnamedInstance": "執行個體未命名",
+      "schemaCount": "{count} 個結構描述 | {count} 個結構描述",
       "unnamedInstanceHint": "資料庫自身的陳述式報告證明此引擎正在執行，但未指明主機。一旦設定了帶有主機的來源 — 工作階段取樣或執行個體指標 — 該列便會顯示位址。",
       "moreServices": "+{count}",
       "columns": {
@@ -24279,6 +24756,7 @@
       "lineCountedTo": "計數截至 {time}；最後半分鐘仍在陸續進入。",
       "lineExact": "所有資料庫都已在回報。這裡的速度是針對每次呼叫測量的，因此是精確的。",
       "lineExactEstimated": "所有資料庫都已在回報。這裡的速度是從多段時間混合而來，因此接近但不精確。",
+      "lineExactSlowestSchema": "所有資料庫皆有回報。速度依各結構描述精確計算；含多個結構描述的資料庫會顯示最慢的那一個。",
       "lineSubsetUnnamed": "您的篩選條件將此範圍縮小到低於這些總計的彙總層級，因此百分比描述的是顯示的列，而非整個資料庫。",
       "lineQuery": "時間是從您的應用程式測量，因此包含網路時間以及等待可用連線的時間。",
       "lineUncodedErrors": "{percent} 的失敗沒有回傳原因代碼，因此可以被計數但無法解釋。",
@@ -25303,6 +25781,7 @@
     "contextNoHistory": "這是此警示首次觸發。",
     "escalationNotStarted": "尚未呼叫",
     "escalationPagesNobody": "不會呼叫任何人",
+    "escalationNobodyPaged": "目前沒有人被呼叫值班",
     "escalationTo": "升級至 {who}，{when}",
     "escalationDetailCapped": "即時升級詳細資料會為最早的 {count} 個未處理呼叫載入",
     "responder": "應變者",
@@ -25436,7 +25915,7 @@
     "rotationRestrictionTo": "至",
     "rotationRestrictionAdd": "新增時段",
     "rotationRestrictionRemove": "移除",
-    "rotationRestrictionZeroLength": "開始和結束時間相同，因此這個時段永遠不會匹配，該層級也永遠不會生效。若需全天，請將結束時間設為 24:00。",
+    "rotationRestrictionZeroLength": "「從」與「到」相同，因此這個時間範圍永遠不會符合。在「從」與「到」不同之前無法儲存；若要涵蓋一整天，請將「到」設為 24:00。",
     "rotationRetiredTag": "已退役",
     "rotationSectionWhen": "輪替時機",
     "rotationName": "輪值名稱",
@@ -25588,6 +26067,10 @@
     "snoozed": "已暫緩",
     "snoozedUntil": "靜音至 {time}——仍未指派",
     "snoozeFailed": "無法將此呼叫靜音",
+    "unsnooze": "取消暫停",
+    "unsnoozeHint": "立即結束暫停。呼叫會從暫停的步驟繼續。",
+    "unsnoozed": "暫停已結束 · 呼叫持續進行",
+    "unsnoozeFailed": "無法結束暫停",
     "note": "備註",
     "notePlaceholder": "你發現了什麼？你嘗試了什麼？",
     "addNote": "新增備註",
@@ -25798,6 +26281,7 @@
     "teamCreateSecondaryHint": "相同的人員，向後順延一個班次，因此次要值班者永遠不會是目前正在值班的人。這是一個普通的輪值——兩者之間沒有任何連結，若只編輯其中一個名單而未編輯另一個，它們會逐漸產生差異；系統會發出警告，而非默默地修正。",
     "rotationPreviewPairLegend": "主要 · 次要",
     "rotationPreviewEmpty": "選擇人員並指定首次交接，即可查看誰在何時值班。",
+    "rotationPreviewNow": "現在 – {until}",
     "defaultRotationName": "輪值",
     "teamCreatedWithoutMembers": "團隊已建立，但無法新增其成員。請在「成員」分頁中新增。",
     "teamCreatedWithoutRotation": "團隊及其成員已建立，但無法儲存輪值。請在「排班」分頁中設定。",
@@ -26566,6 +27050,7 @@
     "sectionHint_ringing": "尚無人確認 — 這些仍在呼叫中",
     "sectionHint_ringingRouted": "尚無人確認 — 其中 {count} 筆仍在呼叫值班 | 尚無人確認 — 其中 {count} 筆仍在呼叫值班",
     "sectionHint_ringingUnrouted": "{count} 筆沒有團隊，因此不會呼叫值班 | {count} 筆沒有團隊，因此不會呼叫值班",
+    "sectionHint_ringingStopped": "{count} 位未被呼叫 | {count} 位未被呼叫",
     "sectionHint_snoozed": "呼叫已暫停 — 時間到會自動恢復",
     "sectionHint_handled": "已確認 — 每項皆有人負責",
     "sectionHint_resolved": "已關閉 — 保留作為紀錄",
@@ -26645,7 +27130,7 @@
     "ruleEditorTeamHelp": "當訊號符合時被呼叫的團隊。該團隊自己的升級階梯會決定喚醒誰，以及順序。",
     "scopeOwns": "此團隊擁有",
     "scopeAdvanced": "進階",
-    "ruleEditorConflictUnclaimed": "目前沒有任何規則認領此路徑 — 符合的呼叫會到達後備團隊或無人接收。",
+    "ruleEditorConflictUnclaimed": "目前沒有任何規則涵蓋此路徑（僅依這些條件判斷）——符合的呼叫會落到攔截全部規則，或無人處理。",
     "ruleEditorConflictHeldBy": "目前，符合該路徑的呼叫會送達 {team}，路徑為 {path}。",
     "ruleEditorConflictTakesOver": "你的規則涵蓋更多條件，因此會從 {team} 承接這些路徑。",
     "ruleEditorConflictKeptBy": "由 {team} 持有的規則精確度更高，因此他們會保留這些，而此規則只會承接剩餘的部分。",
@@ -26667,6 +27152,7 @@
     "scopeClaimServiceHere": "{service} 只會在 {scope} 中呼叫此團隊。其他地方則由該範圍的擁有者接管。",
     "scopeNothingDiscovered": "目前尚未探索到任何內容，因此沒有可選擇的資產。使用進階模式依欄位編寫規則，或先傳送一些遙測資料。",
     "scopeAdvancedHint": "可依任何欄位與值進行比對，包括上方層級未涵蓋的項目。",
+    "scopeValuesSeen": "這些清單顯示服務探索曾看過的值。若要比對其他值，請使用「進階」。",
     "escalationHeld": "AI 分診優先 · {n} 秒內呼叫",
     "escalationPagingStep": "正在呼叫第 {step}/{total} 層 · {who}",
     "escalationPagingStepOnly": "正在呼叫第 {step}/{total} 層",
@@ -26704,6 +27190,7 @@
     "createTeamAndRotation": "建立團隊和輪值",
     "removeMemberHandsOver": "{rotation} 中 {leaving} 的目前班次由 {name} 接手。",
     "removeMemberLeavesGap": "{rotation} 中 {leaving} 的目前班次無人接手。",
+    "removeMemberReorders": "他們也會退出 {rotations}，因此該處的值班人員也可能變動。",
     "membersJoinEnd": "{names} 加入 {rotations} 的最後。目前值班人不變。 | {names} 加入 {rotations} 的最後。目前值班人不變。",
     "membersAdded": "已新增 {names}。 | 已新增 {names}。",
     "removeMemberConfirm": "移除",
@@ -28137,6 +28624,7 @@
       "managedQuestions": "問題請洽：{contact}",
       "outboundQueue": "警示訊息：{count} 則已排隊，最舊 {age} | 警示訊息：{count} 則已排隊，最舊 {age}",
       "outboundEmpty": "沒有已排隊的警示訊息",
+      "refusedPosts": "{count} 則警示貼文在過去 24 小時內失敗。最近一次：{reason}，於 {destination}，| {count} 則警示貼文在過去 24 小時內失敗。最近一次：{reason}，於 {destination}，",
       "ageSeconds": "{count} 秒"
     },
     "channels": {
@@ -28408,6 +28896,78 @@
       "remindFailed": "無法傳送提醒。"
     }
   },
+  "llmDataTrust": {
+    "noModelName": "（無模型名稱）",
+    "topModels": "{models}（前 {shown} 個，共 {total} 個）",
+    "cost": {
+      "partial": "部分",
+      "unknown": "費用未知",
+      "atLeast": "≥ {cost}",
+      "partialTooltip": "部分費用。{models} 沒有價格：此{scope}中的 {tokens} 個 token 未計入。",
+      "unknownTooltip": "費用未知。{models} 沒有價格：此{scope}中的 {tokens} 個 token 皆無費用。",
+      "scopeSession": "工作階段",
+      "scopeTrace": "追蹤",
+      "unknownModel": "未命名模型",
+      "addPrice": "新增價格"
+    },
+    "tile": {
+      "unpricedTokens": "{tokens} 個 token 未定價",
+      "unpricedTooltip": "成本為下限：{models} 上的 {tokens} 個 token 沒有價格。請在 LLM 模型定價中開啟「未定價」分頁。",
+      "pricedSinceTooltip": "成本為下限：{models} 上的 {tokens} 個 token 是在新增價格之前記錄的，因此不計成本。"
+    },
+    "chart": {
+      "costMissing": "未顯示於此圖表：{models}。{tokens} 個 token 沒有價格。",
+      "costMissingPricedSince": "未顯示於此圖表：{models}。{tokens} 個 token 是在新增價格之前記錄的。",
+      "unpricedModels": "未定價：{models}",
+      "pricedSinceModels": "新增價格前記錄：{models}",
+      "addPrice": "新增價格"
+    },
+    "health": {
+      "title": "資料健康度",
+      "passing": "{n} 項通過",
+      "checkedAgo": "已於 {ago}檢查",
+      "drawerTitle": "AI 資料健康度",
+      "drawerSubtitle": "{stream} · 目前時間範圍",
+      "rerun": "重新執行檢查",
+      "close": "關閉",
+      "loadError": "無法執行資料健康度檢查。",
+      "samples": "樣本：",
+      "copyLink": "複製連結給管理員",
+      "linkCopied": "已複製連結",
+      "status": {
+        "pass": "通過",
+        "warning": "警告",
+        "error": "錯誤"
+      },
+      "checks": {
+        "unpriced_models": {
+          "label": "未定價模型",
+          "detail": "{count} 個模型 · {spans} 個 Span · {tokens} 個 token 計為 $0 | {count} 個模型 · {spans} 個 Span · {tokens} 個 token 計為 $0",
+          "pass": "此時間範圍內的每個模型都有價格。在新增價格之前記錄的 Span 會保留其記錄的成本。",
+          "fix": "在 LLM 模型定價中修正",
+          "truncated": "依 token 計算的前 {shown} 名（共 {total} 名）"
+        },
+        "missing_agent_identity": {
+          "label": "缺少代理身分",
+          "detail": "{total} 個 LLM Span 中有 {affected} 個（{pct}）沒有 gen_ai.agent.name，因此代理檢視會遺漏它們。",
+          "pass": "每個 LLM Span 都帶有代理名稱或 ID。",
+          "fix": "開啟 GenAI 代理對應"
+        },
+        "zero_duration_spans": {
+          "label": "零時長 Span",
+          "detail": "{affected} 個 LLM Span 回報 0 ms，因此延遲與工作階段時長會偏低。",
+          "pass": "沒有 LLM Span 回報 0 ms。",
+          "fix": "如何修正"
+        },
+        "missing_session_id": {
+          "label": "沒有工作階段 ID 的 Span",
+          "detail": "{total} 個 LLM Span 中有 {affected} 個（{pct}）沒有 gen_ai.conversation.id，因此工作階段檢視會遺漏它們。",
+          "pass": "每個 LLM Span 都有 gen_ai.conversation.id。",
+          "fix": "整合指南"
+        }
+      }
+    }
+  },
   "fleet": {
     "title": "Fleet 管理",
     "subtitle": "註冊 OpenTelemetry 收集器、為其組態建立版本，並安全地推出變更",
@@ -28447,6 +29007,7 @@
     "badge": {
       "inProgress": "進行中",
       "scheduled": "已排程",
+      "waiting": "等待中",
       "completed": "已完成",
       "halted": "已中止",
       "superseded": "已被取代",
@@ -28691,7 +29252,7 @@
       "version": "版本",
       "pickConfig": "選擇組態",
       "pickFleet": "選擇機群",
-      "emptyFleet": "此機群沒有收集器，因此會直接設定版本",
+      "emptyFleet": "機群中沒有收集器，因此部署會等到有收集器加入後才開始",
       "startingShortly": "即將開始",
       "eventGateFailed": "健康檢查關卡未通過",
       "eventHalted": "已中止",
@@ -28702,7 +29263,10 @@
       "notFound": "此推出已不存在",
       "notFoundDescription": "連結可能已過期。請從清單中選擇推出。",
       "noneTargeted": "沒有目標收集器",
-      "outcomeNoneTargeted": "設定 v{to} 時，機群中沒有收集器。",
+      "outcomeNoneTargeted": "此次部署中沒有收集器採用 v{to}。",
+      "outcomeWaiting": "目前沒有收集器上線，因此 v{to} 尚未派送到任何收集器。當有收集器連線時，部署便會開始。",
+      "waitingForCollector": "等待收集器",
+      "notStarted": "尚未開始",
       "versionFailedBefore": "v{version} · 先前失敗",
       "pickVersion": "選擇版本",
       "autoRollback": "自動回復",
@@ -28727,6 +29291,7 @@
       "eventResumed": "已繼續",
       "eventSkipped": "已略過失敗的收集器",
       "eventStarted": "已開始",
+      "eventWaiting": "等待收集器上線",
       "eventTimedOut": "階段逾時",
       "eventSkippedOffline": "已排除開始時處於離線的 {count} 個收集器；它們重新連線後會取得該版本 | 已排除開始時處於離線的 {count} 個收集器；它們重新連線後會取得該版本",
       "excluded": "已排除",
@@ -28756,7 +29321,8 @@
       "phaseTimeoutNote": "若某階段在 {minutes} 分鐘內既未確認也未拒絕，推出將中止（機群設定）",
       "phaseVerifying": "驗證中",
       "phases": "階段",
-      "planEmpty": "沒有要更新的收集器",
+      "planEmpty": "目前沒有收集器上線，因此部署會等到有收集器連線後才開始",
+      "planStable": "沒有收集器在線；穩定版本會在每個收集器連線時推送給它",
       "planOne": "單一批次共 {count} 個收集器 | 單一批次共 {count} 個收集器",
       "planText": "{steps} → 其餘 {last}，共 {count} 個階段",
       "planUnavailable": "無法預覽計畫",
@@ -28903,7 +29469,6 @@
       "retentionDaysHelp": "0 表示永久保留離線收集器"
     },
     "audit": {
-      "search": "搜尋稽核軌跡",
       "editedConfig": "編輯了組態",
       "revokedToken": "撤銷了註冊權杖",
       "enrolledCollector": "註冊了收集器",
@@ -28915,7 +29480,6 @@
       "setDesired": "變更了版本",
       "autoRollback": "自動回復",
       "rolloutHalted": "推出已中止",
-      "assignedFleetConfig": "指派了機群的組態",
       "createdFleet": "建立了機群",
       "renamedFleet": "重新命名了機群",
       "deletedFleet": "刪除了機群",
@@ -28929,6 +29493,7 @@
       "rolledBackRollout": "回復了推出",
       "movedByToken": "由註冊權杖移動",
       "object": "物件",
+      "search": "搜尋稽核軌跡",
       "allObjects": "所有物件",
       "kind": {
         "fleet": "機群",
@@ -29035,6 +29600,7 @@
     "flowIssues": {
       "rollingOut": "正在推出 v{to}",
       "rolloutHalted": "v{to} 推出已中止",
+      "rolloutWaiting": "v{to} 正在等待收集器上線",
       "autoRolledBack": "v{to} 已自動回復",
       "noReason": "未回報失敗原因",
       "openRollout": "開啟推出",
diff --git a/web/src/plugins/logs/Index.autoRun.spec.ts b/web/src/plugins/logs/Index.autoRun.spec.ts
index 4b03bb0f52..0586df4561 100644
--- a/web/src/plugins/logs/Index.autoRun.spec.ts
+++ b/web/src/plugins/logs/Index.autoRun.spec.ts
@@ -243,8 +243,12 @@ describe("Logs Index — first landing and URL loads (item 2)", { timeout: 30000
   });
 
   describe("re-applied query links (AI chat, search history)", () => {
-    const reApply = async (query: Record<string, string>) => {
-      store.state.zoConfig = { ...originalZoConfig, auto_query_enabled: true };
+    const reApply = async (
+      query: Record<string, string>,
+      zoConfig: Record<string, unknown> = {},
+      logs?: Mock,
+    ) => {
+      store.state.zoConfig = { ...originalZoConfig, auto_query_enabled: true, ...zoConfig };
       (store.state as any).logs = { isInitialized: false, logs: {} };
       vi.spyOn(store, "dispatch").mockResolvedValue(undefined as any);
       (getFieldsFromQuery as Mock).mockResolvedValue({ fields: [], filters: [], streamName: "" });
@@ -253,6 +257,7 @@ describe("Logs Index — first landing and URL loads (item 2)", { timeout: 30000
         attachTo: "#app",
         global: { provide: { store }, plugins: [i18n, router] },
       });
+      if (logs) wrapper.vm.autoRun.setExecutors({ logs });
       await vi.waitFor(
         () => expect(wrapper.vm.searchObj.data.stream.streamLists.length).toBeGreaterThan(0),
         { timeout: 10000 },
@@ -283,6 +288,61 @@ describe("Logs Index — first landing and URL loads (item 2)", { timeout: 30000
       },
     );
 
+    it.each(["ai_chat_query", "search_history_re_apply"])(
+      "%s loaded without running shows the run-query prompt, not an empty result grid",
+      async (type) => {
+        await reApply(
+          { type, stream: "k8s_json", stream_type: "logs", period: "15m" },
+          { auto_query_enabled: false, query_on_stream_selection: true },
+        );
+        await vi.waitFor(() =>
+          expect(wrapper.vm.searchObj.data.stream.selectedStreamFields.length).toBeGreaterThan(0),
+        );
+        await flushPromises();
+        expect(wrapper.vm.searchObj.meta.searchApplied).toBe(false);
+        expect(wrapper.find('[data-test="logs-search-apply-search-text"]').exists()).toBe(true);
+        expect(wrapper.find('[data-test="logs-search-search-result"]').exists()).toBe(false);
+      },
+    );
+
+    it("a search Auto Run starts during a re-apply keeps its hits", async () => {
+      const logs = vi.fn(async () => {
+        wrapper.vm.searchObj.data.queryResults = { hits: [{ _timestamp: 1, body: "row" }] };
+        wrapper.vm.searchObj.meta.searchApplied = true;
+      });
+      await reApply(
+        { type: "search_history_re_apply", stream: "k8s_json", stream_type: "logs", period: "15m" },
+        { auto_query_enabled: true, query_on_stream_selection: false },
+        logs,
+      );
+      await vi.waitFor(() =>
+        expect(wrapper.vm.searchObj.data.stream.selectedStreamFields.length).toBeGreaterThan(0),
+      );
+      await vi.waitFor(() => expect(logs).toHaveBeenCalled());
+      await flushPromises();
+      expect(wrapper.vm.searchObj.data.queryResults.hits).toHaveLength(1);
+      expect(wrapper.find('[data-test="logs-search-apply-search-text"]').exists()).toBe(false);
+    });
+
+    it("a search Auto Run starts during a re-apply keeps loading, not the run-query prompt, while it is pending", async () => {
+      const logs = vi.fn(() => {
+        wrapper.vm.searchObj.loading = true;
+        return new Promise(() => {});
+      });
+      await reApply(
+        { type: "search_history_re_apply", stream: "k8s_json", stream_type: "logs", period: "15m" },
+        { auto_query_enabled: true, query_on_stream_selection: false },
+        logs,
+      );
+      await vi.waitFor(() =>
+        expect(wrapper.vm.searchObj.data.stream.selectedStreamFields.length).toBeGreaterThan(0),
+      );
+      await vi.waitFor(() => expect(logs).toHaveBeenCalled());
+      await flushPromises();
+      expect(wrapper.vm.searchObj.loading).toBe(true);
+      expect(wrapper.find('[data-test="logs-search-apply-search-text"]').exists()).toBe(false);
+    });
+
     it("a re-applied query loaded without running lets the user's edited run push history", async () => {
       await router.replace({ name: "home" });
       await reApply({
diff --git a/web/src/plugins/logs/Index.vue b/web/src/plugins/logs/Index.vue
index b90b8de0a8..f0c3363450 100644
--- a/web/src/plugins/logs/Index.vue
+++ b/web/src/plugins/logs/Index.vue
@@ -1748,12 +1748,19 @@ export default defineComponent({
     // loadLogsData() minus getQueryData(): a re-applied query is loaded for the user to run, not run for them.
     async function applyReAppliedQuery() {
       resetRunStateForReapply();
+      const gridAtStart = autoRun.engine.currentGeneration("grid")?.id;
       searchObj.meta.searchApplied = false;
+      // The run-query prompt needs a `hits` array; set before the awaits so an Auto Run search that lands meanwhile keeps its hits.
+      searchObj.data.queryResults.hits = [];
       await getStreamList(true, { fromUrl: true });
       await getFunctions();
       await extractFields();
       refreshData();
-      searchObj.loading = false;
+      const latest = autoRun.engine.currentGeneration("grid");
+      // A search started during the load owns the loading state; its completion or cancel clears it.
+      if (!latest || latest.id === gridAtStart || latest.settled || latest.cancelled) {
+        searchObj.loading = false;
+      }
     }
 
     // Helper function for handling the stream explorer
diff --git a/web/src/plugins/metrics/AddToDashboard.spec.ts b/web/src/plugins/metrics/AddToDashboard.spec.ts
index 109069ce69..227db684c4 100644
--- a/web/src/plugins/metrics/AddToDashboard.spec.ts
+++ b/web/src/plugins/metrics/AddToDashboard.spec.ts
@@ -85,8 +85,9 @@ const mockStore = {
       label: "Test Org",
     },
     organizationData: {
-      folders: [],
+      folders: [] as any[],
     },
+    userInfo: { email: "user@example.com" },
   },
 };
 
@@ -171,19 +172,20 @@ const createWrapper = (props: Record<string, any> = {}) => {
         },
         SelectFolderDropdown: {
           template:
-            '<div class=\'select-folder-dropdown\' @click=\'$emit("folder-selected", { value: "folder-1", label: "Folder 1" })\'></div>',
+            "<div class='select-folder-dropdown' :data-active-folder-id='activeFolderId' @click='$emit(\"folder-selected\", { value: \"folder-1\", label: \"Folder 1\" })'></div>",
+          props: ["activeFolderId"],
           emits: ["folder-selected"],
         },
         SelectDashboardDropdown: {
           template:
-            '<div class=\'select-dashboard-dropdown\' @click=\'$emit("dashboard-selected", { value: "dash-1", label: "Dashboard 1" })\'></div>',
-          props: ["folderId"],
+            "<div class='select-dashboard-dropdown' :data-preferred='preferredDashboardId' @click='$emit(\"dashboard-selected\", { value: \"dash-1\", label: \"Dashboard 1\" })'></div>",
+          props: ["folderId", "preferredDashboardId"],
           emits: ["dashboard-selected"],
         },
         SelectTabDropdown: {
           template:
-            '<div class=\'select-tab-dropdown\' @click=\'$emit("tab-selected", { value: "tab-1", label: "Tab 1" })\'></div>',
-          props: ["folderId", "dashboardId"],
+            "<div class='select-tab-dropdown' :data-preferred-tab='preferredTabId' @click='$emit(\"tab-selected\", { value: \"tab-1\", label: \"Tab 1\" })'></div>",
+          props: ["folderId", "dashboardId", "preferredTabId"],
           emits: ["tab-selected"],
         },
       },
@@ -590,6 +592,19 @@ describe("AddToDashboard — onSubmit validation", () => {
       query: { dashboard: "dash-1", folder: "folder-1", tab: "tab-1" },
     });
   });
+
+  it("closes itself after a successful add, so a kept-alive page does not reopen with it", async () => {
+    const wrapper = createWrapper();
+    await flushPromises();
+
+    wrapper.vm.selectedDashboard = "dash-1";
+    wrapper.vm.activeTabId = "tab-1";
+
+    await wrapper.vm.onSubmit({ panelTitle: "New Panel" });
+    await flushPromises();
+
+    expect(wrapper.emitted("update:open")?.at(-1)).toEqual([false]);
+  });
 });
 
 describe("AddToDashboard — error handling in addPanelToDashboard", () => {
@@ -647,6 +662,20 @@ describe("AddToDashboard — error handling in addPanelToDashboard", () => {
     expect(wrapper.emitted("save")).toBeTruthy();
   });
 
+  it("stays open when addPanel throws, so the user can retry", async () => {
+    mockAddPanel.mockRejectedValue(new Error("failure"));
+    const wrapper = createWrapper();
+    await flushPromises();
+
+    wrapper.vm.selectedDashboard = "dash-1";
+    wrapper.vm.activeTabId = "tab-1";
+
+    await wrapper.vm.onSubmit({ panelTitle: "Panel" });
+    await flushPromises();
+
+    expect(wrapper.emitted("update:open")).toBeFalsy();
+  });
+
   it("calls dismiss function in finally block", async () => {
     const dismissFn = vi.fn();
     mockToast.mockReturnValue(dismissFn);
@@ -1053,3 +1082,213 @@ describe("AddToDashboard — product analytics", () => {
     expect(analytics.track).not.toHaveBeenCalled();
   });
 });
+
+describe("AddToDashboard — multi-panel title list", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockAddPanel.mockResolvedValue({});
+  });
+
+  const mountWithForm = (props: Record<string, any> = {}) =>
+    mount(AddToDashboard, {
+      props: { dashboardPanelData: { data: {} }, open: true, ...props },
+      global: {
+        stubs: {
+          ODialog: { template: "<div><slot /></div>" },
+          SelectFolderDropdown: true,
+          SelectDashboardDropdown: true,
+          SelectTabDropdown: true,
+        },
+      },
+    });
+
+  it("lists the panel titles instead of the panel title field", async () => {
+    const wrapper = mountWithForm({
+      panels: [
+        { title: "Rate", queries: [] },
+        { title: "Errors", queries: [] },
+      ],
+    });
+    await flushPromises();
+
+    const items = wrapper.findAll('[data-test="add-to-dashboard-panel-title"]');
+    expect(items.map((i) => i.text())).toEqual(["Rate", "Errors"]);
+    expect(wrapper.find('[data-test="metrics-new-dashboard-panel-title"]').exists()).toBe(false);
+  });
+
+  it("keeps the panel title field in single-panel mode", async () => {
+    const wrapper = mountWithForm();
+    await flushPromises();
+
+    expect(wrapper.find('[data-test="add-to-dashboard-panel-titles"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="metrics-new-dashboard-panel-title"]').exists()).toBe(true);
+  });
+
+  it("submits multi-panel mode with no panel title", async () => {
+    const wrapper = mountWithForm({ panels: [{ title: "Rate", queries: [] }] });
+    await flushPromises();
+    (wrapper.vm as any).selectedDashboard = "dash-1";
+    (wrapper.vm as any).activeTabId = "tab-1";
+
+    const form = (wrapper.findComponent(OFormReal).vm as any).form;
+    await form.handleSubmit();
+    await flushPromises();
+
+    expect(mockAddPanel).toHaveBeenCalledTimes(1);
+    expect(mockAddPanel.mock.calls[0][2].title).toBe("Rate");
+  });
+});
+
+describe("AddToDashboard — retry after a partial failure", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+  });
+
+  const threePanels = () => [
+    { title: "Rate", queries: [] },
+    { title: "Errors", queries: [] },
+    { title: "Duration", queries: [] },
+  ];
+
+  it("adds only the panels that failed on the next submit", async () => {
+    mockAddPanel
+      .mockResolvedValueOnce({})
+      .mockRejectedValueOnce(new Error("Server error"))
+      .mockResolvedValue({});
+    const wrapper = createWrapper({ panels: threePanels() });
+    await flushPromises();
+    wrapper.vm.selectedDashboard = "dash-1";
+    wrapper.vm.activeTabId = "tab-1";
+
+    await wrapper.vm.onSubmit({ panelTitle: "" });
+    await flushPromises();
+    expect(mockAddPanel.mock.calls.map((c: any[]) => c[2].title)).toEqual(["Rate", "Errors"]);
+
+    mockAddPanel.mockClear();
+    await wrapper.vm.onSubmit({ panelTitle: "" });
+    await flushPromises();
+
+    expect(mockAddPanel.mock.calls.map((c: any[]) => c[2].title)).toEqual(["Errors", "Duration"]);
+  });
+
+  it("adds every panel again after a full success to the same dashboard", async () => {
+    mockAddPanel.mockResolvedValue({});
+    const wrapper = createWrapper({ panels: threePanels() });
+    await flushPromises();
+    wrapper.vm.selectedDashboard = "dash-1";
+    wrapper.vm.activeTabId = "tab-1";
+    await wrapper.vm.onSubmit({ panelTitle: "" });
+    await flushPromises();
+
+    mockAddPanel.mockClear();
+    await wrapper.vm.onSubmit({ panelTitle: "" });
+    await flushPromises();
+
+    expect(mockAddPanel).toHaveBeenCalledTimes(3);
+  });
+
+  it("adds every panel again when the retry targets another dashboard", async () => {
+    mockAddPanel.mockResolvedValueOnce({}).mockRejectedValueOnce(new Error("Server error"));
+    const wrapper = createWrapper({ panels: threePanels() });
+    await flushPromises();
+    wrapper.vm.selectedDashboard = "dash-1";
+    wrapper.vm.activeTabId = "tab-1";
+    await wrapper.vm.onSubmit({ panelTitle: "" });
+    await flushPromises();
+
+    mockAddPanel.mockClear();
+    mockAddPanel.mockResolvedValue({});
+    wrapper.vm.selectedDashboard = "dash-2";
+    await wrapper.vm.onSubmit({ panelTitle: "" });
+    await flushPromises();
+
+    expect(mockAddPanel).toHaveBeenCalledTimes(3);
+  });
+});
+
+describe("AddToDashboard — remembers the last dashboard", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    mockAddPanel.mockResolvedValue({});
+    window.localStorage.clear();
+  });
+
+  afterEach(() => {
+    mockStore.state.organizationData.folders = [];
+    window.localStorage.clear();
+  });
+
+  const saveTo = async (folder: string, dashboard: string, tab: string) => {
+    const wrapper = createWrapper();
+    await flushPromises();
+    wrapper.vm.activeFolderId = folder;
+    wrapper.vm.selectedDashboard = dashboard;
+    wrapper.vm.activeTabId = tab;
+    await wrapper.vm.onSubmit({ panelTitle: "Panel" });
+    await flushPromises();
+    wrapper.unmount();
+  };
+
+  it("preselects the folder and dashboard used last time", async () => {
+    mockStore.state.organizationData.folders = [{ folderId: "folder-9", name: "Ops" }];
+    await saveTo("folder-9", "dash-9", "tab-9");
+
+    const wrapper = createWrapper();
+    await flushPromises();
+
+    expect(wrapper.vm.activeFolderId).toBe("folder-9");
+    expect(wrapper.find(".select-folder-dropdown").attributes("data-active-folder-id")).toBe(
+      "folder-9",
+    );
+    expect(wrapper.find(".select-dashboard-dropdown").attributes("data-preferred")).toBe("dash-9");
+  });
+
+  it("preselects the remembered tab only on the remembered dashboard", async () => {
+    mockStore.state.organizationData.folders = [{ folderId: "folder-9", name: "Ops" }];
+    await saveTo("folder-9", "dash-9", "tab-9");
+
+    const wrapper = createWrapper();
+    await flushPromises();
+    wrapper.vm.selectedDashboard = "dash-9";
+    await flushPromises();
+    expect(wrapper.find(".select-tab-dropdown").attributes("data-preferred-tab")).toBe("tab-9");
+
+    wrapper.vm.selectedDashboard = "dash-other";
+    await flushPromises();
+    expect(wrapper.find(".select-tab-dropdown").attributes("data-preferred-tab")).toBeUndefined();
+  });
+
+  it("does not save a target when adding the panel fails", async () => {
+    mockAddPanel.mockRejectedValueOnce(new Error("Server error"));
+    mockStore.state.organizationData.folders = [{ folderId: "folder-9", name: "Ops" }];
+    await saveTo("folder-9", "dash-9", "tab-9");
+
+    const wrapper = createWrapper();
+    await flushPromises();
+
+    expect(wrapper.vm.activeFolderId).toBe("default");
+  });
+
+  it("falls back to the default folder when the remembered one is gone", async () => {
+    mockStore.state.organizationData.folders = [{ folderId: "folder-9", name: "Ops" }];
+    await saveTo("folder-9", "dash-9", "tab-9");
+    mockStore.state.organizationData.folders = [];
+
+    const wrapper = createWrapper();
+    await flushPromises();
+
+    expect(wrapper.vm.activeFolderId).toBe("default");
+  });
+
+  it("keeps the remembered target per user", async () => {
+    mockStore.state.organizationData.folders = [{ folderId: "folder-9", name: "Ops" }];
+    await saveTo("folder-9", "dash-9", "tab-9");
+    mockStore.state.userInfo = { email: "other@example.com" };
+
+    const wrapper = createWrapper();
+    await flushPromises();
+    mockStore.state.userInfo = { email: "user@example.com" };
+
+    expect(wrapper.vm.activeFolderId).toBe("default");
+  });
+});
diff --git a/web/src/plugins/metrics/AddToDashboard.vue b/web/src/plugins/metrics/AddToDashboard.vue
index fe94274b87..c128176fbd 100644
--- a/web/src/plugins/metrics/AddToDashboard.vue
+++ b/web/src/plugins/metrics/AddToDashboard.vue
@@ -12,7 +12,7 @@
   >
     <OForm
       id="add-to-dashboard-form"
-      :schema="addToDashboardSchema"
+      :schema="isMulti ? multiPanelSchema : addToDashboardSchema"
       :default-values="addToDashboardDefaults(defaultPanelTitle)"
       @submit="onSubmit"
     >
@@ -25,12 +25,16 @@
           data-test="add-to-dashboard-notice"
         />
         <!-- select folder or create new folder and select -->
-        <SelectFolderDropdown @folder-selected="updateActiveFolderId" />
+        <SelectFolderDropdown
+          :active-folder-id="rememberedTarget?.folderId ?? null"
+          @folder-selected="updateActiveFolderId"
+        />
 
         <!-- select folder or create new folder and select -->
         <SelectDashboardDropdown
           v-if="activeFolderId"
           :folder-id="activeFolderId"
+          :preferred-dashboard-id="rememberedTarget?.dashboardId"
           @dashboard-selected="updateSelectedDashboard"
         />
 
@@ -39,9 +43,29 @@
           v-if="activeFolderId && selectedDashboard"
           :folder-id="activeFolderId"
           :dashboard-id="selectedDashboard"
+          :preferred-tab-id="
+            rememberedTarget?.dashboardId === selectedDashboard
+              ? rememberedTarget?.tabId
+              : undefined
+          "
           @tab-selected="updateActiveTabId"
         />
+        <div v-if="isMulti" class="flex flex-col gap-1" data-test="add-to-dashboard-panel-titles">
+          <span class="text-compact text-input-label-text leading-tight font-medium">
+            {{ t("metrics.addToDashboardPage.panelsToAdd") }}
+          </span>
+          <ul class="text-text-body flex flex-col gap-0.5 text-sm">
+            <li
+              v-for="(panel, index) in panels"
+              :key="index"
+              data-test="add-to-dashboard-panel-title"
+            >
+              <OTruncatedText>{{ panel.title }}</OTruncatedText>
+            </li>
+          </ul>
+        </div>
         <OFormInput
+          v-else
           name="panelTitle"
           :label="t('dashboard.panelTitle')"
           required
@@ -65,6 +89,8 @@ import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
 import OForm from "@/lib/forms/Form/OForm.vue";
 import OFormInput from "@/lib/forms/Input/OFormInput.vue";
 import OBanner from "@/lib/feedback/Banner/OBanner.vue";
+import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
+import { z } from "zod";
 import { useRouter } from "vue-router";
 import useNotifications from "@/composables/useNotifications";
 import { toast } from "@/lib/feedback/Toast/useToast";
@@ -75,6 +101,12 @@ import {
   type AddToDashboardForm,
 } from "./AddToDashboard.schema";
 
+interface DashboardTarget {
+  folderId: string;
+  dashboardId: string;
+  tabId: string;
+}
+
 export default defineComponent({
   name: "AddToDashboard",
   components: {
@@ -85,6 +117,7 @@ export default defineComponent({
     OForm,
     OFormInput,
     OBanner,
+    OTruncatedText,
   },
   props: {
     open: {
@@ -133,6 +166,36 @@ export default defineComponent({
     const activeTabId: any = ref(null);
     const { t } = useI18nTyped();
     const addToDashboardSchema = makeAddToDashboardSchema(t);
+    // Each panel brings its own title, so the hidden title field must not block submit.
+    const multiPanelSchema = z.object({ panelTitle: z.string() });
+    const isMulti = computed(() => props.panels.length > 0);
+
+    const rememberedTargetKey = () =>
+      `addToDashboard.lastTarget.${store.state.selectedOrganization?.identifier ?? ""}.${
+        store.state.userInfo?.email ?? ""
+      }`;
+    const rememberedTarget = ref<DashboardTarget | null>(null);
+
+    const readRememberedTarget = (): DashboardTarget | null => {
+      try {
+        const parsed = JSON.parse(window.localStorage.getItem(rememberedTargetKey()) ?? "null");
+        return parsed && typeof parsed.folderId === "string" ? parsed : null;
+      } catch {
+        return null;
+      }
+    };
+
+    const writeRememberedTarget = (target: DashboardTarget) => {
+      try {
+        window.localStorage.setItem(rememberedTargetKey(), JSON.stringify(target));
+      } catch {
+        // A full or blocked localStorage only loses the preselection next time.
+      }
+    };
+
+    // Panel indexes already written to savedTarget, so a retry adds only the rest.
+    const savedPanelIndexes = new Set<number>();
+    let savedTarget = "";
 
     const { showErrorNotification, showConfictErrorNotificationWithRefreshBtn } =
       useNotifications();
@@ -146,11 +209,17 @@ export default defineComponent({
       () => props.open,
       async (isOpen) => {
         if (isOpen) {
+          rememberedTarget.value = readRememberedTarget();
           await getFoldersList(store);
+          const folderId = rememberedTarget.value?.folderId;
+          if (store.state.organizationData.folders.some((f: any) => f.folderId === folderId)) {
+            activeFolderId.value = folderId as string;
+          }
         } else {
           activeFolderId.value = "default";
           selectedDashboard.value = null;
           activeTabId.value = null;
+          savedPanelIndexes.clear();
         }
       },
       { immediate: true },
@@ -176,7 +245,12 @@ export default defineComponent({
     ) => {
       let dismiss = function () {};
 
-      const multi = props.panels && props.panels.length > 0;
+      const multi = isMulti.value;
+      const target = `${dashboardId}/${tabId}`;
+      if (target !== savedTarget) {
+        savedPanelIndexes.clear();
+        savedTarget = target;
+      }
       // Counted per write: a later panel failing does not undo the ones already saved.
       let written = 0;
       try {
@@ -193,12 +267,16 @@ export default defineComponent({
           // auto-positions each one (side-by-side, then wrapping), so N calls
           // lay out an N-panel grid. Each needs a fresh panel id; the title comes
           // from the panel data (per-metric), falling back to the form title.
-          for (const panelData of props.panels) {
+          for (const [index, panelData] of props.panels.entries()) {
+            if (savedPanelIndexes.has(index)) continue;
             panelData.id = getPanelId();
             if (!panelData.title) panelData.title = panelTitle;
             await addPanel(store, dashboardId, panelData, folderId, tabId);
+            savedPanelIndexes.add(index);
             written++;
           }
+          // The page is kept alive, so a later Add from the same dialog must write every panel.
+          savedPanelIndexes.clear();
         } else {
           dashboardPanelData.value.data.id = getPanelId();
           // panel name will come from add to dashboard component
@@ -207,12 +285,15 @@ export default defineComponent({
           await addPanel(store, dashboardId, dashboardPanelData.value.data, folderId, tabId);
           written++;
         }
+        writeRememberedTarget({ folderId, dashboardId, tabId });
         toast({
           message: multi
             ? t("metrics.addToDashboardPage.panelsAdded")
             : t("metrics.addToDashboardPage.panelAdded"),
           variant: "success",
         });
+        // A kept-alive caller page would show the dialog still open on return.
+        emit("update:open", false);
         router.push({
           name: "viewDashboard",
           query: { dashboard: dashboardId, folder: folderId, tab: tabId },
@@ -267,6 +348,9 @@ export default defineComponent({
       // built schema MUST be exposed or `:schema` resolves to undefined
       // (which silently disables validation).
       addToDashboardSchema,
+      multiPanelSchema,
+      isMulti,
+      rememberedTarget,
       addToDashboardDefaults,
       selectedDashboard,
       filteredDashboards,
diff --git a/web/src/plugins/traces/Index.spec.ts b/web/src/plugins/traces/Index.spec.ts
index 90f1cc687b..28a1393bbd 100644
--- a/web/src/plugins/traces/Index.spec.ts
+++ b/web/src/plugins/traces/Index.spec.ts
@@ -3143,6 +3143,52 @@ describe("Index.vue (Main Traces Page)", () => {
       });
     });
 
+    // The header org switch re-keys MainLayout's content, so the page remounts; the router may not have left the old URL yet.
+    describe("remount after a header org switch", () => {
+      afterEach(() => {
+        delete store.state.zoConfig.auto_query_enabled;
+        globalThis.localStorage.removeItem("oo_toggle_auto_run");
+      });
+
+      async function remountWith(query: Record<string, string>, autoRun: boolean, lastOrg: string) {
+        store.state.zoConfig.auto_query_enabled = true;
+        globalThis.localStorage.setItem("oo_toggle_auto_run", String(autoRun));
+        mockSearchObj.meta.liveMode = autoRun;
+        mockSearchObj.organizationIdentifier = lastOrg;
+        routerCurrentRouteSpy.mockReturnValue({
+          value: { query, name: "traces", path: "/traces" },
+        } as any);
+        wrapper = mountIndexStubbed();
+        await vi.waitFor(() => expect(mockSearchObj.loadingStream).toBe(false), { timeout: 10000 });
+        await new Promise((resolve) => setTimeout(resolve, 50));
+        await flushPromises();
+      }
+
+      it.each([
+        ["the old org's URL", { stream: "default", org_identifier: "old-org" }],
+        ["the new org's bare URL", { org_identifier: "default" }],
+      ])("does not search with Auto Run off while the router still shows %s", async (_l, query) => {
+        await remountWith(query, false, "old-org");
+        expect(mockFetchQueryDataWithHttpStream).not.toHaveBeenCalled();
+        expect(mockSearchObj.data.stream.selectedStream.value).toBeTruthy();
+      });
+
+      it("still searches with Auto Run on", async () => {
+        await remountWith({ stream: "default", org_identifier: "old-org" }, true, "old-org");
+        expect(mockFetchQueryDataWithHttpStream).toHaveBeenCalled();
+      });
+
+      it("searches a shared link for the org being switched to with Auto Run off", async () => {
+        await remountWith({ stream: "default", org_identifier: "default" }, false, "old-org");
+        expect(mockFetchQueryDataWithHttpStream).toHaveBeenCalled();
+      });
+
+      it("searches a shared link for another org opened without an org switch", async () => {
+        await remountWith({ stream: "default", org_identifier: "other-org" }, false, "default");
+        expect(mockFetchQueryDataWithHttpStream).toHaveBeenCalled();
+      });
+    });
+
     describe("onActivated", () => {
       // Helper: mount Index inside a KeepAlive wrapper so that toggling
       // the `show` ref produces real deactivate/activate lifecycle calls.
@@ -3204,6 +3250,42 @@ describe("Index.vue (Main Traces Page)", () => {
         parentWrapper.unmount();
       });
 
+      it.each([
+        ["does not search", "false", false],
+        ["still searches", "true", true],
+      ])("%s on an org switch when the Auto Run toggle is %s", async (_label, toggle, searches) => {
+        store.state.zoConfig.auto_query_enabled = true;
+        globalThis.localStorage.setItem("oo_toggle_auto_run", toggle);
+        // The page's own URL sync always writes stream=, so the URL looks like a shared link.
+        routerCurrentRouteSpy.mockReturnValue({
+          value: { query: { stream: "default" }, name: "traces", path: "/traces" },
+        } as any);
+        mockSearchObj.organizationIdentifier = "default";
+        const { parentWrapper, show } = mountWithKeepAlive();
+        // The first load must settle, or reactivation re-runs the first-load path instead.
+        await vi.waitFor(() => expect(mockSearchObj.loadingStream).toBe(false));
+        await flushPromises();
+
+        show.value = false;
+        await flushPromises();
+        mockFetchQueryDataWithHttpStream.mockClear();
+        mockSearchObj.organizationIdentifier = "old-org";
+        show.value = true;
+        await flushPromises();
+        if (searches) {
+          await vi.waitFor(() => expect(mockFetchQueryDataWithHttpStream).toHaveBeenCalled());
+        } else {
+          await vi.waitFor(() => expect(mockSearchObj.loadingStream).toBe(false));
+          await new Promise((resolve) => setTimeout(resolve, 50));
+          await flushPromises();
+          expect(mockFetchQueryDataWithHttpStream).not.toHaveBeenCalled();
+        }
+        expect(mockSearchObj.data.stream.selectedStream.value).toBe("default");
+
+        parentWrapper.unmount();
+        delete store.state.zoConfig.auto_query_enabled;
+      });
+
       it("should read oo_toggle_auto_run from localStorage and set liveMode on activation", async () => {
         globalThis.localStorage.setItem("oo_toggle_auto_run", "true");
 
diff --git a/web/src/plugins/traces/Index.vue b/web/src/plugins/traces/Index.vue
index 82fcde40cf..867c24c6d9 100644
--- a/web/src/plugins/traces/Index.vue
+++ b/web/src/plugins/traces/Index.vue
@@ -331,14 +331,13 @@ import { describePeriod } from "@/utils/dashboard/calendarPeriods";
 import { cloneDeep } from "lodash-es";
 import { computed } from "vue";
 import useStreams from "@/composables/useStreams";
-import { parseDurationWhereClause } from "@/composables/useDurationPercentiles";
 import { applyFieldGrouping, buildSemanticIndex, type FieldObj } from "@/utils/fieldCategories";
 import {
   useServiceCorrelation,
   type KeyFieldsConfig,
   type FieldGroupingConfig,
 } from "@/composables/useServiceCorrelation";
-import { parseSpanKindWhereClause } from "@/utils/traces/constants";
+import { resolveTracesFilter } from "@/utils/traces/resolveTracesFilter";
 import { logsUtils } from "@/composables/useLogs/logsUtils";
 import { useTracesTableColumns } from "./composables/useTracesTableColumns";
 import { tracesRowNavAnnouncement } from "./composables/tracesRowNav";
@@ -705,18 +704,7 @@ function buildSearch(reuseLastWindow = false) {
     let whereClause = query.trim();
 
     if (whereClause.trim() != "") {
-      // Convert human-readable duration suffixes (e.g. '1.50ms') to raw µs.
-      const durationParseResult = parseDurationWhereClause(
-        whereClause,
-        tracesParser.value,
-        searchObj.data.stream.selectedStream.value,
-      );
-      if (typeof durationParseResult === "string") {
-        whereClause = durationParseResult;
-      }
-
-      // Convert span_kind display labels (e.g. 'Server') to numeric OTEL keys (e.g. '2').
-      whereClause = parseSpanKindWhereClause(
+      whereClause = resolveTracesFilter(
         whereClause,
         tracesParser.value,
         searchObj.data.stream.selectedStream.value,
@@ -868,13 +856,11 @@ const updateFieldValues = (data) => {
 
 // The whole editor value is the where clause; a "|" split is quote-unaware and would cut match_all('a | b').
 function buildEditorFilter() {
-  const streamName = searchObj.data.stream.selectedStream.value;
-  let filter = searchObj.data.editorValue.trim();
-  const filterParseResult = parseDurationWhereClause(filter, tracesParser.value, streamName);
-  if (typeof filterParseResult === "string") {
-    filter = filterParseResult;
-  }
-  return parseSpanKindWhereClause(filter, tracesParser.value, streamName);
+  return resolveTracesFilter(
+    searchObj.data.editorValue,
+    tracesParser.value,
+    searchObj.data.stream.selectedStream.value,
+  );
 }
 
 // Every new search and sort (stream, mode, editor) rebuilds its filter in getQueryData, so the selection is checked there.
@@ -1469,10 +1455,14 @@ function generateHistogramData() {
 
 const isAutoRunOff = () => !!store.state.zoConfig?.auto_query_enabled && !searchObj.meta.liveMode;
 
-async function loadPageData() {
+/** `leftOrg`: the org an org switch left; a URL still on that org is the page's own sync, not a shared link. */
+async function loadPageData({ leftOrg = "" } = {}) {
   const generation = pageGeneration;
   pageLoaded = false;
-  const streamFromUrl = typeof router.currentRoute.value.query.stream === "string";
+  const query = router.currentRoute.value.query;
+  // The header switch re-keys the page before the router may have left the old org's URL.
+  const urlFromLeftOrg = !!leftOrg && (query.org_identifier ?? leftOrg) === leftOrg;
+  const streamFromUrl = !urlFromLeftOrg && typeof query.stream === "string";
   // Claimed before any early return, so a restore that finds no stream is not left for a later landing.
   // A newer restore wins over one a left load never acted on.
   const landing = takeRecentLanding("traces") ?? pendingLanding;
@@ -1559,10 +1549,9 @@ function stopInFlightRequests() {
 async function initializePage() {
   const generation = pageGeneration;
   pageLoaded = false;
-  if (
-    searchObj.organizationIdentifier &&
-    searchObj.organizationIdentifier !== store.state.selectedOrganization.identifier
-  ) {
+  const lastOrg = searchObj.organizationIdentifier;
+  const leftOrg = lastOrg && lastOrg !== store.state.selectedOrganization.identifier ? lastOrg : "";
+  if (leftOrg) {
     resetSearchObj();
   }
   restoreUrlQueryParams();
@@ -1574,7 +1563,7 @@ async function initializePage() {
   await loadTracesParser().catch((e) => console.error("Failed to load the traces parser", e));
   if (generation !== pageGeneration) return;
   if (!searchObj.loading) {
-    await loadPageData();
+    await loadPageData({ leftOrg });
   } else {
     searchObj.loadingStream = false;
     pendingUrlPage = null;
@@ -1642,9 +1631,10 @@ onActivated(async () => {
   }
 
   if (searchObj.organizationIdentifier != store.state.selectedOrganization.identifier) {
+    const leftOrg = searchObj.organizationIdentifier;
     resetSearchObj();
     restoreUrlQueryParams();
-    await loadPageData();
+    await loadPageData({ leftOrg });
     if (left()) return;
     reloaded = true;
   }
diff --git a/web/src/plugins/traces/IndexList.vue b/web/src/plugins/traces/IndexList.vue
index 6077a99eaa..034c31cf1a 100644
--- a/web/src/plugins/traces/IndexList.vue
+++ b/web/src/plugins/traces/IndexList.vue
@@ -203,10 +203,9 @@ import OSelect from "@/lib/forms/Select/OSelect.vue";
 import type { SelectModelValue } from "@/lib/forms/Select/OSelect.types";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import useFieldValuesStream from "@/composables/useFieldValuesStream";
-import useDurationPercentiles, {
-  parseDurationWhereClause,
-} from "@/composables/useDurationPercentiles";
-import { SPAN_KIND_MAP, parseSpanKindWhereClause } from "@/utils/traces/constants";
+import useDurationPercentiles from "@/composables/useDurationPercentiles";
+import { SPAN_KIND_MAP } from "@/utils/traces/constants";
+import { resolveTracesFilter } from "@/utils/traces/resolveTracesFilter";
 import { logsUtils } from "@/composables/useLogs/logsUtils";
 import { escapeSingleQuotes } from "@/utils/queryUtils";
 import { splitOnAnd } from "@/utils/query/sqlFilterBuilder";
@@ -422,19 +421,8 @@ export default defineComponent({
     const buildFieldValuesSql = (fieldName: string): string => {
       // The whole editor value is the where clause — never split it on "|", the
       // split is quote-unaware and would truncate match_all('text | error').
-      let whereClause = searchObj.data.editorValue.trim();
-
-      const durationParseResult = parseDurationWhereClause(
-        whereClause,
-        tracesParser.value,
-        searchObj.data.stream.selectedStream.value,
-      );
-      if (typeof durationParseResult === "string") {
-        whereClause = durationParseResult;
-      }
-
-      whereClause = parseSpanKindWhereClause(
-        whereClause,
+      const whereClause = resolveTracesFilter(
+        searchObj.data.editorValue,
         tracesParser.value,
         searchObj.data.stream.selectedStream.value,
       );
diff --git a/web/src/plugins/traces/LLMCostCell.vue b/web/src/plugins/traces/LLMCostCell.vue
new file mode 100644
index 0000000000..aa765a66d4
--- /dev/null
+++ b/web/src/plugins/traces/LLMCostCell.vue
@@ -0,0 +1,119 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!-- Cost of a trace or session. When some tokens have no price the cost is a
+     lower bound ("≥ $X partial"); when none do it reads "cost unknown" instead
+     of $0. The tooltip names the unpriced models and links to the fix. -->
+<script setup lang="ts">
+import { computed } from "vue";
+import { useStore } from "vuex";
+import { raw, useI18nTyped } from "@/types/i18n";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
+import { costKind, pricingGapsRoute, type TimeWindow } from "./llmDataTrust.utils";
+
+const props = withDefaults(
+  defineProps<{
+    cost: number;
+    tokens: number;
+    unpricedTokens?: number;
+    unpricedModels?: string[];
+    scope: "session" | "trace";
+    /** Trace stream, for the "Add a price" link. */
+    stream?: string;
+    /** The list's window (µs), so "Add a price" lists this row's models; else the last 24 h. */
+    timeWindow?: TimeWindow | null;
+    format?: (cost: number) => string;
+  }>(),
+  {
+    unpricedTokens: 0,
+    unpricedModels: () => [],
+    stream: "",
+    timeWindow: null,
+    format: (cost: number) => `$${cost.toFixed(4)}`,
+  },
+);
+
+const { t } = useI18nTyped();
+const store = useStore();
+
+const kind = computed(() => costKind(props.cost, props.tokens, props.unpricedTokens));
+
+const tooltip = computed(() => {
+  const models = props.unpricedModels.length
+    ? props.unpricedModels.join(", ")
+    : t("llmDataTrust.cost.unknownModel");
+  const params = {
+    models,
+    tokens: props.unpricedTokens.toLocaleString(),
+    scope:
+      props.scope === "session"
+        ? t("llmDataTrust.cost.scopeSession")
+        : t("llmDataTrust.cost.scopeTrace"),
+  };
+  return kind.value === "unknown"
+    ? t("llmDataTrust.cost.unknownTooltip", params)
+    : t("llmDataTrust.cost.partialTooltip", params);
+});
+
+const fixRoute = computed(() =>
+  pricingGapsRoute(
+    props.stream,
+    store.state.selectedOrganization?.identifier ?? "",
+    props.timeWindow,
+  ),
+);
+</script>
+
+<template>
+  <span v-if="kind === 'exact'" class="tabular-nums" data-test="llm-cost-cell">{{
+    format(cost)
+  }}</span>
+  <span
+    v-else
+    class="inline-flex items-center gap-1 whitespace-nowrap tabular-nums"
+    data-test="llm-cost-cell"
+    :data-cost-kind="kind"
+  >
+    <!-- Inline like the plain numbers beside it: a pill would outgrow narrow cost columns. -->
+    <span
+      v-if="kind === 'partial'"
+      class="inline-flex items-center gap-1"
+      data-test="llm-cost-cell-partial"
+    >
+      {{ t("llmDataTrust.cost.atLeast", { cost: format(cost) }) }}
+      <OIcon name="warning-amber" size="xs" class="text-status-warning-text" />
+      <span class="sr-only">{{ t("llmDataTrust.cost.partial") }}</span>
+    </span>
+    <span v-else class="text-text-secondary italic" data-test="llm-cost-cell-unknown">{{
+      t("llmDataTrust.cost.unknown")
+    }}</span>
+    <OTooltip hoverable max-width="18rem">
+      <template #content>
+        <div class="flex flex-col gap-1">
+          <span>{{ raw(tooltip) }}</span>
+          <router-link
+            :to="fixRoute"
+            class="text-text-link hover:text-text-link-hover underline"
+            data-test="llm-cost-cell-add-price"
+            @click.stop
+            >{{ t("llmDataTrust.cost.addPrice") }}</router-link
+          >
+        </div>
+      </template>
+    </OTooltip>
+  </span>
+</template>
diff --git a/web/src/plugins/traces/LLMDataHealthStrip.spec.ts b/web/src/plugins/traces/LLMDataHealthStrip.spec.ts
new file mode 100644
index 0000000000..2a4a0966e5
--- /dev/null
+++ b/web/src/plugins/traces/LLMDataHealthStrip.spec.ts
@@ -0,0 +1,152 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it, vi } from "vitest";
+import { mount, type VueWrapper } from "@vue/test-utils";
+import { createStore } from "vuex";
+import type { DataHealthCheck, DataHealthModelUsage } from "@/services/gen-ai-data-health.service";
+import LLMDataHealthStrip from "./LLMDataHealthStrip.vue";
+
+vi.mock("vue-router", () => ({
+  useRouter: () => ({ push: vi.fn(), currentRoute: { value: { query: {} } } }),
+}));
+
+const ODrawerStub = { name: "ODrawer", template: "<div><slot /></div>" };
+
+function mountStrip(
+  models: DataHealthModelUsage[],
+  totals: Partial<DataHealthCheck> = {},
+  { pricingEnabled = true, extraChecks = [] as DataHealthCheck[] } = {},
+) {
+  const store = createStore({
+    state: {
+      selectedOrganization: { identifier: "test-org" },
+      zoConfig: { model_pricing_enabled: pricingEnabled },
+    },
+  });
+  return mount(LLMDataHealthStrip, {
+    props: {
+      health: {
+        checked_at: 0,
+        checks: [
+          { id: "unpriced_models", status: "warning", affected: 12, total: 40, models, ...totals },
+          ...extraChecks,
+        ],
+      },
+      stream: "default",
+      samples: null,
+    },
+    global: { provide: { store }, mocks: { $store: store }, stubs: { ODrawer: ODrawerStub } },
+  });
+}
+
+const cardText = (w: VueWrapper) =>
+  w.find('[data-test="llm-data-health-card-unpriced_models"]').text();
+
+describe("LLMDataHealthStrip unpriced models detail", () => {
+  let wrapper: VueWrapper;
+
+  afterEach(() => wrapper?.unmount());
+
+  it("uses the singular form for one unpriced model", () => {
+    wrapper = mountStrip([{ model: "acme", spans: 12, tokens: 1000 }]);
+    expect(cardText(wrapper)).toContain("1 model ·");
+  });
+
+  it("uses the plural form for several unpriced models", () => {
+    wrapper = mountStrip([
+      { model: "acme", spans: 6, tokens: 500 },
+      { model: "beta", spans: 6, tokens: 500 },
+    ]);
+    expect(cardText(wrapper)).toContain("2 models ·");
+  });
+
+  it("counts every unpriced model and token, not just the listed top 20", () => {
+    const listed = Array.from({ length: 20 }, (_, i) => ({
+      model: `model-${i}`,
+      spans: 1,
+      tokens: 10,
+    }));
+    wrapper = mountStrip(listed, {
+      model_count: 25,
+      unpriced_tokens: 5000,
+      models_truncated: true,
+    });
+    expect(wrapper.find('[data-test="llm-data-health-chip-unpriced_models"]').text()).toContain(
+      "· 25",
+    );
+    expect(cardText(wrapper)).toContain("25 models ·");
+    expect(cardText(wrapper)).toContain("5.0K tokens");
+    expect(wrapper.find('[data-test="llm-data-health-unpriced-truncated"]').text()).toBe(
+      "Top 20 of 25 by tokens",
+    );
+  });
+
+  it("shows no truncation note when every model is listed", () => {
+    wrapper = mountStrip([{ model: "acme", spans: 12, tokens: 1000 }], {
+      model_count: 1,
+      unpriced_tokens: 1000,
+      models_truncated: false,
+    });
+    expect(wrapper.find('[data-test="llm-data-health-unpriced-truncated"]').exists()).toBe(false);
+  });
+
+  it("hides the unpriced check when model pricing is disabled", () => {
+    const models = [{ model: "acme", spans: 12, tokens: 1000 }];
+    wrapper = mountStrip(models, {}, { pricingEnabled: false });
+    // Nothing else is failing: no strip at all.
+    expect(wrapper.find('[data-test="llm-data-health-strip"]').exists()).toBe(false);
+    wrapper.unmount();
+
+    wrapper = mountStrip(
+      models,
+      {},
+      {
+        pricingEnabled: false,
+        extraChecks: [{ id: "zero_duration_spans", status: "warning", affected: 3, total: 40 }],
+      },
+    );
+    expect(wrapper.find('[data-test="llm-data-health-strip"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="llm-data-health-chip-unpriced_models"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="llm-data-health-card-unpriced_models"]').exists()).toBe(false);
+    expect(wrapper.find('[data-test="llm-data-health-chip-zero_duration_spans"]').exists()).toBe(
+      true,
+    );
+  });
+});
+
+describe("LLMDataHealthStrip summary row", () => {
+  let wrapper: VueWrapper;
+
+  afterEach(() => wrapper?.unmount());
+
+  it("gives only failing checks a chip and folds passing ones into one link", () => {
+    wrapper = mountStrip(
+      [{ model: "acme", spans: 12, tokens: 1000 }],
+      {},
+      {
+        extraChecks: [
+          { id: "zero_duration_spans", status: "pass", affected: 0, total: 40 },
+          { id: "missing_session_id", status: "pass", affected: 0, total: 40 },
+        ],
+      },
+    );
+    expect(wrapper.find('[data-test="llm-data-health-chip-unpriced_models"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="llm-data-health-chip-zero_duration_spans"]').exists()).toBe(
+      false,
+    );
+    expect(wrapper.find('[data-test="llm-data-health-passing"]').text()).toBe("2 passing");
+  });
+});
diff --git a/web/src/plugins/traces/LLMDataHealthStrip.vue b/web/src/plugins/traces/LLMDataHealthStrip.vue
new file mode 100644
index 0000000000..07d27d7e47
--- /dev/null
+++ b/web/src/plugins/traces/LLMDataHealthStrip.vue
@@ -0,0 +1,378 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<!-- AI data health strip on LLM Insights: one chip per failing check with its
+     count for the current scope and window, and a drawer whose cards link each
+     problem to the setting or guide that fixes it. Hidden when every check passes. -->
+<script setup lang="ts">
+import { computed, ref, watch } from "vue";
+import { useRouter } from "vue-router";
+import { useStore } from "vuex";
+import { formatDistanceToNowStrict } from "date-fns";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
+import OBadge from "@/lib/core/Badge/OBadge.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import ODrawer from "@/lib/overlay/Drawer/ODrawer.vue";
+import { toast } from "@/lib/feedback/Toast/useToast";
+import type {
+  DataHealthCheck,
+  DataHealthCheckId,
+  DataHealthResponse,
+} from "@/services/gen-ai-data-health.service";
+import {
+  fixTarget,
+  healthCounts,
+  sortChecks,
+  unpricedTotals,
+  type TimeWindow,
+} from "./llmDataTrust.utils";
+import type { DataHealthSamples } from "./composables/useLLMDataHealth";
+import { formatTokens } from "@/utils/llmUtils";
+
+const props = defineProps<{
+  health: DataHealthResponse | null;
+  loading?: boolean;
+  error?: boolean;
+  stream: string;
+  /** The window `health` was checked over; the fix links open the same window. */
+  checkedWindow?: TimeWindow | null;
+  /** Sample trace ids per check; null until loaded. */
+  samples: DataHealthSamples | null;
+  samplesLoading?: boolean;
+}>();
+
+const emit = defineEmits<{
+  rerun: [];
+  "load-samples": [];
+  "view-trace": [traceId: string];
+}>();
+
+const { t } = useI18nTyped();
+const router = useRouter();
+const store = useStore();
+
+const drawerOpen = ref(false);
+const focusedCheck = ref<DataHealthCheckId | null>(null);
+
+// With model pricing off (ZO_MODEL_PRICING_ENABLED=false) nothing is priced and
+// Model Pricing is hidden in Settings, so there is no unpriced check to show or fix.
+const pricingEnabled = computed(() => !!store.state.zoConfig?.model_pricing_enabled);
+const checks = computed(() =>
+  sortChecks(
+    (props.health?.checks ?? []).filter((c) => c.id !== "unpriced_models" || pricingEnabled.value),
+  ),
+);
+const counts = computed(() => healthCounts(checks.value));
+// Passing checks fold into the "N passing" link; the drawer lists them all.
+const failing = computed(() => checks.value.filter((c) => c.status !== "pass"));
+const visible = computed(() => !!props.health && counts.value.errors + counts.value.warnings > 0);
+const checkedAgo = computed(() =>
+  props.health?.checked_at
+    ? formatDistanceToNowStrict(new Date(props.health.checked_at / 1000), { addSuffix: true })
+    : "",
+);
+
+function pct(check: DataHealthCheck): string {
+  if (!check.total) return "0%";
+  const p = (check.affected / check.total) * 100;
+  return `${p < 1 && p > 0 ? p.toFixed(1) : Math.round(p)}%`;
+}
+
+const LABELS: Record<DataHealthCheckId, I18nText> = {
+  unpriced_models: t("llmDataTrust.health.checks.unpriced_models.label"),
+  missing_agent_identity: t("llmDataTrust.health.checks.missing_agent_identity.label"),
+  zero_duration_spans: t("llmDataTrust.health.checks.zero_duration_spans.label"),
+  missing_session_id: t("llmDataTrust.health.checks.missing_session_id.label"),
+};
+
+/** The count a chip shows: models for pricing, share for identity/session, spans otherwise. */
+function chipCount(check: DataHealthCheck): string {
+  switch (check.id) {
+    case "unpriced_models":
+      return String(unpricedTotals(check).modelCount || check.affected);
+    case "missing_agent_identity":
+    case "missing_session_id":
+      return pct(check);
+    default:
+      return check.affected.toLocaleString();
+  }
+}
+
+function detail(check: DataHealthCheck): I18nText {
+  if (check.status === "pass") {
+    switch (check.id) {
+      case "unpriced_models":
+        return t("llmDataTrust.health.checks.unpriced_models.pass");
+      case "missing_agent_identity":
+        return t("llmDataTrust.health.checks.missing_agent_identity.pass");
+      case "zero_duration_spans":
+        return t("llmDataTrust.health.checks.zero_duration_spans.pass");
+      case "missing_session_id":
+        return t("llmDataTrust.health.checks.missing_session_id.pass");
+    }
+  }
+  const params = {
+    affected: check.affected.toLocaleString(),
+    total: check.total.toLocaleString(),
+    pct: pct(check),
+  };
+  switch (check.id) {
+    case "unpriced_models": {
+      const { modelCount, tokens } = unpricedTotals(check);
+      return t(
+        "llmDataTrust.health.checks.unpriced_models.detail",
+        {
+          count: modelCount.toLocaleString(),
+          spans: check.affected.toLocaleString(),
+          tokens: formatTokens(tokens),
+        },
+        modelCount,
+      );
+    }
+    case "missing_agent_identity":
+      return t("llmDataTrust.health.checks.missing_agent_identity.detail", params);
+    case "zero_duration_spans":
+      return t("llmDataTrust.health.checks.zero_duration_spans.detail", params);
+    case "missing_session_id":
+      return t("llmDataTrust.health.checks.missing_session_id.detail", params);
+  }
+}
+
+/** "Top 20 of 25 by tokens" when the server lists only part of the unpriced models. */
+function truncatedNote(check: DataHealthCheck): I18nText | null {
+  const { truncated, models, modelCount } = unpricedTotals(check);
+  if (!truncated) return null;
+  return t("llmDataTrust.health.checks.unpriced_models.truncated", {
+    shown: models.length,
+    total: modelCount.toLocaleString(),
+  });
+}
+
+function fixLabel(id: DataHealthCheckId): I18nText {
+  switch (id) {
+    case "unpriced_models":
+      return t("llmDataTrust.health.checks.unpriced_models.fix");
+    case "missing_agent_identity":
+      return t("llmDataTrust.health.checks.missing_agent_identity.fix");
+    case "zero_duration_spans":
+      return t("llmDataTrust.health.checks.zero_duration_spans.fix");
+    case "missing_session_id":
+      return t("llmDataTrust.health.checks.missing_session_id.fix");
+  }
+}
+
+function statusVariant(status: DataHealthCheck["status"]) {
+  if (status === "error") return "error-soft" as const;
+  if (status === "warning") return "warning-soft" as const;
+  return "success-soft" as const;
+}
+
+function statusLabel(status: DataHealthCheck["status"]): I18nText {
+  if (status === "error") return t("llmDataTrust.health.status.error");
+  if (status === "warning") return t("llmDataTrust.health.status.warning");
+  return t("llmDataTrust.health.status.pass");
+}
+
+function orgId(): string {
+  return store.state.selectedOrganization?.identifier ?? "";
+}
+
+function targetFor(id: DataHealthCheckId) {
+  return fixTarget(id, props.stream, orgId(), props.checkedWindow);
+}
+
+function openFix(id: DataHealthCheckId) {
+  const target = targetFor(id);
+  if (target.kind === "route") {
+    drawerOpen.value = false;
+    router.push(target.to);
+  } else {
+    window.open(target.href, "_blank", "noopener,noreferrer");
+  }
+}
+
+/** For users who cannot open the setting themselves: a link an admin can follow. */
+async function copyFixLink(id: DataHealthCheckId) {
+  const target = targetFor(id);
+  const href =
+    target.kind === "route"
+      ? new URL(router.resolve(target.to).href, window.location.origin).toString()
+      : target.href;
+  try {
+    await navigator.clipboard.writeText(href);
+    toast({ variant: "success", message: t("llmDataTrust.health.linkCopied") });
+  } catch (e) {
+    console.error("Copy fix link failed:", e);
+  }
+}
+
+function openDrawer(id: DataHealthCheckId | null) {
+  focusedCheck.value = id;
+  drawerOpen.value = true;
+}
+
+// Samples cost a query per failing check, so they load only while the drawer
+// is open; a new scope or a re-run clears them and they load again.
+watch(
+  () => drawerOpen.value && props.samples === null && !props.samplesLoading,
+  (needed) => {
+    if (needed) emit("load-samples");
+  },
+);
+
+function shortTraceId(id: string): string {
+  return id.length > 12 ? `${id.slice(0, 4)}…${id.slice(-4)}` : id;
+}
+
+function viewTrace(traceId: string) {
+  drawerOpen.value = false;
+  emit("view-trace", traceId);
+}
+</script>
+
+<template>
+  <div
+    v-if="error && !health"
+    class="text-2xs text-text-secondary mt-2.5 flex items-center gap-2"
+    data-test="llm-data-health-error"
+  >
+    <OIcon name="error" size="xs" />
+    <span>{{ t("llmDataTrust.health.loadError") }}</span>
+    <OButton variant="ghost-primary" size="xs" @click="emit('rerun')">{{
+      t("llmDataTrust.health.rerun")
+    }}</OButton>
+  </div>
+  <div
+    v-else-if="visible"
+    class="bg-card-glass-bg rounded-default border-border-default mt-2.5 flex flex-wrap items-center gap-x-3 gap-y-1.5 border px-3 py-2 text-xs"
+    data-test="llm-data-health-strip"
+  >
+    <span class="text-text-heading inline-flex items-center gap-1.5 font-semibold">
+      <OIcon name="monitor-heart" size="sm" />
+      {{ t("llmDataTrust.health.title") }}
+    </span>
+    <!-- The icon carries the status, so it reads without the colour. -->
+    <button
+      v-for="check in failing"
+      :key="check.id"
+      type="button"
+      class="rounded-default border-border-default hover:bg-surface-subtle inline-flex items-center gap-1 border px-2 py-0.5"
+      :class="check.status === 'error' ? 'text-status-error-text' : 'text-status-warning-text'"
+      :data-test="`llm-data-health-chip-${check.id}`"
+      @click="openDrawer(check.id)"
+    >
+      <OIcon :name="check.status === 'error' ? 'error' : 'warning-amber'" size="xs" />
+      {{ LABELS[check.id] }} · {{ raw(chipCount(check)) }}
+    </button>
+    <button
+      v-if="counts.passing"
+      type="button"
+      class="text-text-secondary hover:text-text-heading inline-flex items-center"
+      data-test="llm-data-health-passing"
+      @click="openDrawer(null)"
+    >
+      {{ t("llmDataTrust.health.passing", { n: counts.passing }) }}
+      <OIcon name="chevron-right" size="xs" />
+    </button>
+    <span v-if="checkedAgo" class="text-text-secondary ms-auto">{{
+      t("llmDataTrust.health.checkedAgo", { ago: checkedAgo })
+    }}</span>
+  </div>
+
+  <ODrawer
+    v-model:open="drawerOpen"
+    size="md"
+    :title="t('llmDataTrust.health.drawerTitle')"
+    :sub-title="t('llmDataTrust.health.drawerSubtitle', { stream })"
+    :primary-button-label="t('llmDataTrust.health.rerun')"
+    :primary-button-loading="loading"
+    primary-button-data-test="llm-data-health-rerun"
+    :secondary-button-label="t('llmDataTrust.health.close')"
+    @click:primary="emit('rerun')"
+    @click:secondary="drawerOpen = false"
+  >
+    <div class="flex flex-col gap-2.5 p-3" data-test="llm-data-health-drawer">
+      <div
+        v-for="check in checks"
+        :key="check.id"
+        class="rounded-default border-border-default flex flex-col gap-1.5 border p-3"
+        :class="{ 'ring-accent ring-1': focusedCheck === check.id }"
+        :data-test="`llm-data-health-card-${check.id}`"
+      >
+        <div class="flex items-center justify-between gap-2">
+          <span class="text-text-heading text-sm font-semibold">{{ LABELS[check.id] }}</span>
+          <OBadge :variant="statusVariant(check.status)" size="sm">{{
+            statusLabel(check.status)
+          }}</OBadge>
+        </div>
+        <span class="text-text-secondary text-xs">{{ detail(check) }}</span>
+        <div
+          v-if="check.id === 'unpriced_models' && check.models?.length"
+          class="flex flex-wrap gap-1"
+        >
+          <OBadge
+            v-for="m in check.models"
+            :key="m.model ?? ''"
+            variant="default-outline"
+            size="sm"
+            >{{
+              raw(`${m.model ?? t("llmDataTrust.noModelName")} · ${formatTokens(m.tokens)}`)
+            }}</OBadge
+          >
+          <span
+            v-if="truncatedNote(check)"
+            class="text-2xs text-text-secondary self-center"
+            data-test="llm-data-health-unpriced-truncated"
+            >{{ truncatedNote(check) }}</span
+          >
+        </div>
+        <div
+          v-if="check.status !== 'pass' && samples?.[check.id]?.length"
+          class="text-2xs text-text-secondary flex flex-wrap items-center gap-1.5"
+        >
+          <span>{{ t("llmDataTrust.health.samples") }}</span>
+          <button
+            v-for="id in samples?.[check.id]"
+            :key="id"
+            type="button"
+            class="text-text-link hover:text-text-link-hover font-mono underline"
+            :data-test="`llm-data-health-sample-${check.id}`"
+            @click="viewTrace(id)"
+          >
+            {{ raw(shortTraceId(id)) }}
+          </button>
+        </div>
+        <div v-if="check.status !== 'pass'" class="flex flex-wrap items-center gap-2 pt-1">
+          <OButton
+            variant="primary"
+            size="xs"
+            :data-test="`llm-data-health-fix-${check.id}`"
+            @click="openFix(check.id)"
+            >{{ fixLabel(check.id) }}</OButton
+          >
+          <OButton
+            v-if="targetFor(check.id).kind === 'route'"
+            variant="ghost-muted"
+            size="xs"
+            @click="copyFixLink(check.id)"
+            >{{ t("llmDataTrust.health.copyLink") }}</OButton
+          >
+        </div>
+      </div>
+    </div>
+  </ODrawer>
+</template>
diff --git a/web/src/plugins/traces/LLMErrorTable.spec.ts b/web/src/plugins/traces/LLMErrorTable.spec.ts
new file mode 100644
index 0000000000..555cde6ce7
--- /dev/null
+++ b/web/src/plugins/traces/LLMErrorTable.spec.ts
@@ -0,0 +1,132 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// @vitest-environment jsdom
+//
+// "Recent errors" must not claim "No errors" before its query has answered:
+// it shows its loading state until the first query returns, the empty message
+// only after an empty result, and a load-failure message when the query fails.
+
+const mockExecuteQuery = vi.fn();
+
+vi.mock("./composables/useLLMStreamQuery", () => ({
+  useLLMStreamQuery: () => ({ executeQuery: mockExecuteQuery, cancelAll: vi.fn() }),
+}));
+
+vi.mock("vuex", () => ({
+  useStore: () => ({ state: { timezone: "UTC", selectedOrganization: { identifier: "o" } } }),
+}));
+
+vi.mock("vue-i18n", () => ({
+  useI18n: () => ({ t: (key: string) => key }),
+}));
+
+vi.mock("@/lib/core/Table/OTable.vue", () => ({
+  default: {
+    name: "OTable",
+    props: ["data", "loading", "emptyMessage"],
+    template: `<div data-test="table">
+      <span v-if="loading" data-test="table-loading" />
+      <span v-else-if="!data.length" data-test="table-empty">{{ emptyMessage }}</span>
+      <span v-else data-test="table-rows">{{ data.length }}</span>
+    </div>`,
+  },
+}));
+
+vi.mock("./LLMPanelCard.vue", () => ({
+  default: {
+    name: "LLMPanelCard",
+    template: `<div><slot /></div>`,
+    methods: {
+      getRootEl(this: { $el: Element }) {
+        return this.$el;
+      },
+    },
+  },
+}));
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+import { mount, flushPromises } from "@vue/test-utils";
+import LLMErrorTable from "./LLMErrorTable.vue";
+import { LLM_INSIGHTS_PANELS } from "./config/llmInsightsPanels";
+import { errorRowsCache } from "./llmInsightsCache";
+
+const panel = LLM_INSIGHTS_PANELS.find((p) => p.type === "table")!;
+
+// The panel loads when it scrolls into view; make "in view" a test switch.
+let reportVisible: ((visible: boolean) => void) | null = null;
+class FakeIntersectionObserver {
+  constructor(cb: (entries: { isIntersecting: boolean }[]) => void) {
+    reportVisible = (visible) => cb([{ isIntersecting: visible }]);
+  }
+  observe() {}
+  disconnect() {}
+}
+
+async function mountTable(streamName = "llm_traces") {
+  const wrapper = mount(LLMErrorTable, {
+    props: { panel, streamName, startTime: 1, endTime: 2, cacheKey: `k-${Math.random()}` },
+  });
+  await new Promise((r) => setTimeout(r, 0));
+  await flushPromises();
+  return wrapper;
+}
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  errorRowsCache.clear();
+  reportVisible = null;
+  vi.stubGlobal("IntersectionObserver", FakeIntersectionObserver);
+});
+
+describe("LLMErrorTable — loading vs empty", () => {
+  it("shows loading, not the empty message, before the panel has queried", async () => {
+    const wrapper = await mountTable();
+    expect(mockExecuteQuery).not.toHaveBeenCalled();
+    expect(wrapper.find('[data-test="table-loading"]').exists()).toBe(true);
+    expect(wrapper.find('[data-test="table-empty"]').exists()).toBe(false);
+  });
+
+  it("stays loading while there is no stream to query yet", async () => {
+    const wrapper = await mountTable("");
+    reportVisible!(true);
+    await flushPromises();
+    expect(mockExecuteQuery).not.toHaveBeenCalled();
+    expect(wrapper.find('[data-test="table-loading"]').exists()).toBe(true);
+  });
+
+  it("shows loading until the query returns, then the empty message for no rows", async () => {
+    const q = Promise.withResolvers<unknown[]>();
+    mockExecuteQuery.mockReturnValue(q.promise);
+    const wrapper = await mountTable();
+
+    reportVisible!(true);
+    await flushPromises();
+    expect(mockExecuteQuery).toHaveBeenCalledTimes(1);
+    expect(wrapper.find('[data-test="table-loading"]').exists()).toBe(true);
+
+    q.resolve([]);
+    await flushPromises();
+    expect(wrapper.find('[data-test="table-empty"]').text()).toBe(
+      "traces.lLMErrorTable.noErrorsInRange",
+    );
+  });
+
+  it("shows the rows when the query returns errors", async () => {
+    mockExecuteQuery.mockResolvedValue([{ trace_id: "t1" }, { trace_id: "t2" }]);
+    const wrapper = await mountTable();
+    reportVisible!(true);
+    await flushPromises();
+    expect(wrapper.find('[data-test="table-rows"]').text()).toBe("2");
+  });
+
+  it("says the errors could not load when the query fails — never 'No errors'", async () => {
+    mockExecuteQuery.mockRejectedValue(new Error("boom"));
+    vi.spyOn(console, "error").mockImplementation(() => {});
+    const wrapper = await mountTable();
+    reportVisible!(true);
+    await flushPromises();
+    expect(wrapper.find('[data-test="table-empty"]').text()).toBe(
+      "traces.lLMErrorTable.loadFailed",
+    );
+  });
+});
diff --git a/web/src/plugins/traces/LLMErrorTable.vue b/web/src/plugins/traces/LLMErrorTable.vue
index 8101d7ec49..3e3aa6b31a 100644
--- a/web/src/plugins/traces/LLMErrorTable.vue
+++ b/web/src/plugins/traces/LLMErrorTable.vue
@@ -43,7 +43,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       show-index
       pagination="none"
       :empty-message="
-        panel.emptyStateKey ? t(panel.emptyStateKey) : t('traces.lLMErrorTable.noData')
+        loadFailed
+          ? t('traces.lLMErrorTable.loadFailed')
+          : panel.emptyStateKey
+            ? t(panel.emptyStateKey)
+            : t('traces.lLMErrorTable.noData')
       "
       @row-click="onRowClick"
       data-test="llm-recent-errors-table"
@@ -117,7 +121,16 @@ const { executeQuery, cancelAll } = useLLMStreamQuery();
 const timezone = computed(() => store.state.timezone || "UTC");
 
 const rows = ref<any[]>([]);
-const loading = ref(false);
+// True until the query for the current inputs has returned. The panel loads
+// lazily (on entering the viewport) and may mount before its stream is known,
+// so "no rows" says nothing until then — the table shows its loading state, and
+// "No errors in this time range" only after a query really came back empty.
+const loading = ref(true);
+// Bumped per load so a superseded response can't overwrite newer rows or end
+// the newer load's loading state.
+let loadSeq = 0;
+// The last query failed: the empty table says so instead of "No errors".
+const loadFailed = ref(false);
 
 const columns: OTableColumnDef[] = [
   {
@@ -168,11 +181,14 @@ async function loadErrors() {
   // Serve this exact selection+window from the in-memory cache if we have it —
   // a tab toggle back here skips the query entirely. Keyed on the dashboard's
   // canonical selection id (`cacheKey`); skip caching only if it wasn't passed.
+  const seq = ++loadSeq;
   const key = props.cacheKey;
   if (key) {
     const cached = errorRowsCache.get(key);
     if (cached) {
       rows.value = cached;
+      loadFailed.value = false;
+      loading.value = false;
       return;
     }
   }
@@ -188,16 +204,21 @@ async function loadErrors() {
   });
   try {
     const hits = await executeQuery(sql, props.startTime, props.endTime);
+    if (seq !== loadSeq) return;
     // OTable needs a stable row-key; error spans can repeat a trace_id, so key
     // by position instead.
     rows.value = (hits as any[]).map((h, i) => ({ ...h, id: i }));
+    loadFailed.value = false;
     // Snapshot for this selection+window so a return visit restores instantly.
     if (key) errorRowsCache.set(key, rows.value);
   } catch (e: any) {
+    if (seq !== loadSeq) return;
+    // A failed query is not "no errors": say it could not load.
     rows.value = [];
+    loadFailed.value = true;
     console.error(`[LLM panel ${props.panel.id}] fetch error`, e);
   } finally {
-    loading.value = false;
+    if (seq === loadSeq) loading.value = false;
   }
 }
 
@@ -215,6 +236,9 @@ watch(
   () => [props.streamName, props.startTime, props.endTime, props.agentFilter],
   () => {
     needsReload.value = true;
+    // The rows on screen belong to the old inputs: back to loading until the
+    // new query (run now, or when the panel scrolls into view) returns.
+    loading.value = true;
     if (isVisible.value) loadErrors();
   },
 );
diff --git a/web/src/plugins/traces/LLMInsightsDashboard.spec.ts b/web/src/plugins/traces/LLMInsightsDashboard.spec.ts
index b77ee0e537..8809854ce9 100644
--- a/web/src/plugins/traces/LLMInsightsDashboard.spec.ts
+++ b/web/src/plugins/traces/LLMInsightsDashboard.spec.ts
@@ -36,8 +36,14 @@ const mockGetStreams = vi.fn().mockResolvedValue({
   ],
 });
 const mockRouterPush = vi.fn();
+const mockRouterReplace = vi.fn(() => Promise.resolve());
+const mockListAgents = vi.fn();
+// Mutable per test; the default (set in beforeEach) is `?type=stream`.
+const mockRouteQuery: Record<string, string> = {};
 
 import { reactive, ref } from "vue";
+import type { DataHealthResponse } from "@/services/gen-ai-data-health.service";
+import type { GenAiAgentListItem } from "@/services/gen-ai-agent-mapping.service";
 
 const mockStoreState = reactive({ selectedOrganization: { identifier: "test-org" } });
 
@@ -64,6 +70,7 @@ const mockError = ref<string | null>(null);
 const mockHasLoadedOnce = ref(false);
 const mockAvailableStreams = ref<string[]>([]);
 const mockStreamsLoaded = ref(false);
+const mockHealth = ref<DataHealthResponse | null>(null);
 
 vi.mock("./composables/useLLMInsights", () => ({
   useLLMInsights: () => ({
@@ -80,6 +87,19 @@ vi.mock("./composables/useLLMInsights", () => ({
   }),
 }));
 
+vi.mock("./composables/useLLMDataHealth", () => ({
+  useLLMDataHealth: () => ({
+    health: mockHealth,
+    loading: ref(false),
+    error: ref(false),
+    samples: ref(null),
+    samplesLoading: ref(false),
+    fetchHealth: vi.fn(),
+    fetchSamples: vi.fn(),
+    reset: vi.fn(),
+  }),
+}));
+
 vi.mock("@/composables/useStreams", () => ({
   default: () => ({
     getStreams: mockGetStreams,
@@ -93,11 +113,17 @@ vi.mock("vue-i18n", () => ({
 }));
 
 vi.mock("vue-router", () => ({
-  useRouter: () => ({ push: mockRouterPush, replace: vi.fn(() => Promise.resolve()) }),
-  // This suite exercises the stream-mode paths. The dashboard now defaults to
-  // Agent scope and only `?type=stream` (NOT a saved preference) opts into
-  // Stream mode, so drive stream mode through the URL the way the component reads it.
-  useRoute: () => ({ query: { type: "stream" } }),
+  useRouter: () => ({ push: mockRouterPush, replace: mockRouterReplace }),
+  // Most of this suite exercises the stream-mode paths, driven through the URL
+  // (`?type=stream`) the way the component reads it; scope tests override it.
+  useRoute: () => ({ query: mockRouteQuery }),
+}));
+
+vi.mock("@/services/gen-ai-agent-mapping.service", () => ({
+  default: {
+    listAgents: (...args: any[]) => mockListAgents(...args),
+    listVersionsForCompare: vi.fn().mockResolvedValue([]),
+  },
 }));
 
 // Partial-mock vuex so `createStore` (used by `src/stores/index.ts`)
@@ -113,16 +139,25 @@ vi.mock("vuex", async (importOriginal) => {
 // ---------------------------------------------------------------------------
 
 import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
-import { mount, flushPromises } from "@vue/test-utils";
+import { mount, flushPromises, enableAutoUnmount } from "@vue/test-utils";
 import LLMInsightsDashboard from "./LLMInsightsDashboard.vue";
 import config from "@/aws-exports";
 // The KPI cache is a module singleton (survives remounts in the app); clear it
 // between tests so a warmed entry from one mount doesn't suppress the fetch in
 // the next.
 import { kpiCache } from "./llmInsightsCache";
+import { queryClient } from "@/composables/query/queryClient";
+import { SCOPE_MODE_CHOICE_LS_KEY } from "@/enterprise/composables/useAgentScope";
 
 const STREAM_LS_KEY = "llmInsights_streamFilter";
 
+// The stream each panel mount was given, in mount order — a remount (which
+// cancels the panel's in-flight query) shows up as a second entry.
+let panelMounts: string[] = [];
+
+// Earlier tests' dashboards would otherwise stay mounted and react to the shared mock refs.
+enableAutoUnmount(afterEach);
+
 /** Mount the dashboard with default props that satisfy the loadInsights guard. */
 function mountDashboard(
   propsOverrides: Partial<{ streamName: string; startTime: number; endTime: number }> = {},
@@ -139,8 +174,15 @@ function mountDashboard(
         // Children — all stubbed so we don't try to render echarts /
         // sparkline math during dashboard-level tests.
         LLMSchemaPanel: { template: '<div data-test="llm-schema-panel" />' },
-        LLMErrorTable: { template: '<div data-test="llm-error-table" />' },
+        LLMErrorTable: {
+          props: ["streamName"],
+          template: '<div data-test="llm-error-table" />',
+          mounted(this: { streamName: string }) {
+            panelMounts.push(this.streamName);
+          },
+        },
         KpiSparkline: { template: '<div data-test="kpi-sparkline" />' },
+        LLMDataHealthStrip: { template: '<div data-test="llm-data-health-strip" />' },
         LLMInsightsSkeleton: { template: '<div data-test="llm-insights-skeleton" />' },
         OButton: {
           template: "<button @click=\"$emit('click')\"><slot /></button>",
@@ -155,6 +197,11 @@ beforeEach(() => {
   // Fresh mock state for every test.
   vi.clearAllMocks();
   kpiCache.clear();
+  queryClient.clear();
+  panelMounts = [];
+  for (const k of Object.keys(mockRouteQuery)) delete mockRouteQuery[k];
+  mockRouteQuery.type = "stream";
+  mockListAgents.mockResolvedValue({ agents: [] });
   mockStoreState.selectedOrganization = { identifier: "test-org" };
   mockKpi.value = {
     requestCount: 0,
@@ -177,6 +224,7 @@ beforeEach(() => {
   mockHasLoadedOnce.value = false;
   mockAvailableStreams.value = [];
   mockStreamsLoaded.value = false;
+  mockHealth.value = null;
   // Reset localStorage between tests so the dashboard's stream
   // initialisation doesn't bleed across cases.
   localStorage.clear();
@@ -533,6 +581,7 @@ describe("LLMInsightsDashboard — OSS builds (neither isEnterprise nor isCloud
   it("keeps the Stream/Agent toggle (Agent locked) and hides the Compare entry — both need the enterprise-only agent-mapping API", async () => {
     config.isEnterprise = "false";
     const wrapper = mountDashboard();
+    await (wrapper.vm as any).refresh();
     await flushPromises();
     expect(wrapper.find("[data-test='llm-insights-filter-mode']").exists()).toBe(true);
     expect(wrapper.find("[data-test='llm-insights-compare-entry']").exists()).toBe(false);
@@ -542,7 +591,326 @@ describe("LLMInsightsDashboard — OSS builds (neither isEnterprise nor isCloud
     config.isEnterprise = "false";
     config.isCloud = "true";
     const wrapper = mountDashboard();
+    await (wrapper.vm as any).refresh();
     await flushPromises();
     expect(wrapper.find("[data-test='llm-insights-filter-mode']").exists()).toBe(true);
   });
 });
+
+// ===========================================================================
+// Scope: mode resolution (AIO-02/03), URL scope (AIO-08), one agents fetch (AIO-18)
+// ===========================================================================
+
+const agentAt = (name: string, stream: string, env: string, version: string) => ({
+  name,
+  id: `id-${name}`,
+  source_stream: stream,
+  source_stream_type: "traces",
+  env,
+  version,
+});
+
+/** Mount and run the parent's mount-time load (DateTime's window replay: no force). */
+async function mountAndEnter() {
+  const wrapper = mountDashboard();
+  await (wrapper.vm as any).refresh(undefined, undefined, false);
+  await flushPromises();
+  return wrapper;
+}
+
+// Agent mode needs the enterprise-only agent-mapping API, so these run as an
+// enterprise build regardless of the local `.env` (CI has none, so it is OSS).
+describe("LLMInsightsDashboard — scope resolution", () => {
+  const originalIsEnterprise = config.isEnterprise;
+
+  beforeEach(() => {
+    config.isEnterprise = "true";
+    delete mockRouteQuery.type;
+  });
+
+  afterEach(() => {
+    config.isEnterprise = originalIsEnterprise;
+  });
+
+  it("opens in Stream mode with the 'No agent identity found' banner when the window has no agents but an LLM stream exists", async () => {
+    mockListAgents.mockResolvedValue({ agents: [] });
+
+    const wrapper = await mountAndEnter();
+
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+    expect(mockFetchAll).toHaveBeenCalledWith(
+      "default",
+      1_700_000_000_000_000,
+      1_700_001_000_000_000,
+      null,
+    );
+    expect(wrapper.find("[data-test='llm-insights-no-agent-identity']").exists()).toBe(true);
+    // The auto-picked mode stays out of the URL, so a reload re-decides.
+    const lastQuery = (mockRouterReplace.mock.calls.at(-1) as any[])[0].query;
+    expect(lastQuery.type).toBeUndefined();
+    expect(lastQuery.stream).toBe("default");
+  });
+
+  it("opens in Agent mode when the window has agents", async () => {
+    mockListAgents.mockResolvedValue({ agents: [agentAt("omp", "s1", "production", "1")] });
+
+    const wrapper = await mountAndEnter();
+
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+    // The auto-picked agent stays out of the URL too, so a reload with no agents ends in Stream.
+    const lastQuery = (mockRouterReplace.mock.calls.at(-1) as any[])[0].query;
+    expect([lastQuery.type, lastQuery.agent, lastQuery.env, lastQuery.version]).toEqual([
+      undefined,
+      undefined,
+      undefined,
+      undefined,
+    ]);
+    expect(wrapper.find("[data-test='llm-insights-no-agent-identity']").exists()).toBe(false);
+  });
+
+  it("mounts the panels once, with the final scope — never the first agent then the linked one", async () => {
+    Object.assign(mockRouteQuery, { agent: "omp", env: "production", version: "2" });
+    mockListAgents.mockResolvedValue({
+      agents: [
+        agentAt("a23ca1dd38a1ff350", "s_hash", "staging", "1"),
+        agentAt("omp", "s_staging", "staging", "2"),
+        agentAt("omp", "s_prod", "production", "2"),
+      ],
+    });
+
+    const wrapper = await mountAndEnter();
+
+    const vm = wrapper.vm as any;
+    expect([vm.filterMode, vm.selectedEnv, vm.selectedAgentName, vm.selectedVersion]).toEqual([
+      "agent",
+      "production",
+      "omp",
+      "2",
+    ]);
+    expect(panelMounts).toEqual(["s_prod"]);
+    expect(mockFetchAll).toHaveBeenCalledTimes(1);
+  });
+
+  it("keeps a remembered explicit Agent choice even when the window has no agents", async () => {
+    localStorage.setItem(SCOPE_MODE_CHOICE_LS_KEY, "agent");
+    mockListAgents.mockResolvedValue({ agents: [] });
+
+    const wrapper = await mountAndEnter();
+
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+    expect(wrapper.find("[data-test='llm-insights-agent-empty']").exists()).toBe(true);
+  });
+
+  it("keeps the URL's explicit Stream choice even when the window has agents", async () => {
+    mockRouteQuery.type = "stream";
+    mockListAgents.mockResolvedValue({ agents: [agentAt("omp", "s1", "production", "1")] });
+
+    const wrapper = await mountAndEnter();
+
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+  });
+
+  it.each([{ env: "production" }, { version: "2" }])(
+    "keeps an env/version-only URL scope over the remembered Stream choice: %o",
+    async (query) => {
+      localStorage.setItem(SCOPE_MODE_CHOICE_LS_KEY, "stream");
+      Object.assign(mockRouteQuery, query);
+      mockListAgents.mockResolvedValue({
+        agents: [
+          agentAt("first", "s_staging", "staging", "1"),
+          agentAt("linked", "s_prod", "production", "2"),
+        ],
+      });
+      const wrapper = await mountAndEnter();
+      // Vue Test Utils omits script-setup state from its public-instance type.
+      const vm = wrapper.vm as unknown as {
+        filterMode: string;
+        selectedEnv: string;
+        selectedVersion: string;
+      };
+      expect([vm.filterMode, vm.selectedEnv, vm.selectedVersion]).toEqual([
+        "agent",
+        "production",
+        "2",
+      ]);
+      expect(panelMounts).toEqual(["s_prod"]);
+      expect(mockRouterReplace).toHaveBeenLastCalledWith({
+        query: expect.objectContaining(query),
+      });
+    },
+  );
+
+  it("shows explicit Stream panels while the agents registry is still pending", async () => {
+    mockRouteQuery.type = "stream";
+    const agentsResult = Promise.withResolvers<{ agents: GenAiAgentListItem[] }>();
+    mockListAgents.mockReturnValue(agentsResult.promise);
+    const wrapper = mountDashboard();
+    // Vue Test Utils omits the script-setup method from its public-instance type.
+    const vm = wrapper.vm as unknown as {
+      refresh: (start?: number, end?: number, force?: boolean) => Promise<void>;
+    };
+    const pending = vm.refresh(undefined, undefined, false);
+    await flushPromises();
+    expect(panelMounts).toEqual(["default"]);
+    agentsResult.resolve({ agents: [agentAt("omp", "s1", "production", "1")] });
+    await pending;
+    await flushPromises();
+    expect(panelMounts).toEqual(["default"]);
+  });
+
+  it("remembers a toggle click as the explicit choice and writes it to the URL", async () => {
+    mockListAgents.mockResolvedValue({ agents: [] });
+    const wrapper = await mountAndEnter();
+
+    (wrapper.vm as any).onFilterModeChange("agent");
+    await flushPromises();
+
+    expect(localStorage.getItem(SCOPE_MODE_CHOICE_LS_KEY)).toBe("agent");
+    expect((mockRouterReplace.mock.calls.at(-1) as any[])[0].query.type).toBe("agent");
+  });
+
+  it("fetches gen_ai/agents once per view across mount replays and mode toggles", async () => {
+    mockListAgents.mockResolvedValue({ agents: [agentAt("omp", "s1", "production", "1")] });
+    const wrapper = mountDashboard();
+    const vm = wrapper.vm as any;
+    // DateTime may replay its window more than once on mount, concurrently.
+    await Promise.all([
+      vm.refresh(undefined, undefined, false),
+      vm.refresh(undefined, undefined, false),
+    ]);
+    await flushPromises();
+    vm.onFilterModeChange("stream");
+    await flushPromises();
+    vm.onFilterModeChange("agent");
+    await flushPromises();
+
+    expect(mockListAgents).toHaveBeenCalledTimes(1);
+  });
+
+  it("decides an auto mode again when the user picks a window with no agents", async () => {
+    mockListAgents.mockResolvedValue({ agents: [agentAt("omp", "s1", "production", "1")] });
+    const wrapper = await mountAndEnter();
+    const vm = wrapper.vm as any;
+    expect(vm.filterMode).toBe("agent");
+
+    // A mount-time replay of another window decides nothing.
+    mockListAgents.mockResolvedValue({ agents: [] });
+    await vm.refresh(1_600_000_000_000_000, 1_600_001_000_000_000, false);
+    await flushPromises();
+    expect(vm.filterMode).toBe("agent");
+
+    // The user's own pick does: the new window has no agents, so Stream.
+    await vm.refresh(1_500_000_000_000_000, 1_500_001_000_000_000, true, true);
+    await flushPromises();
+    expect(vm.filterMode).toBe("stream");
+    expect(mockFetchAll.mock.calls.at(-1)).toEqual([
+      "default",
+      1_500_000_000_000_000,
+      1_500_001_000_000_000,
+      null,
+    ]);
+  });
+
+  it("keeps an explicit Agent choice when the user picks a window with no agents", async () => {
+    mockRouteQuery.type = "agent";
+    mockListAgents.mockResolvedValue({ agents: [agentAt("omp", "s1", "production", "1")] });
+    const wrapper = await mountAndEnter();
+    const vm = wrapper.vm as any;
+
+    mockListAgents.mockResolvedValue({ agents: [] });
+    await vm.refresh(1_500_000_000_000_000, 1_500_001_000_000_000, true, true);
+    await flushPromises();
+    expect(vm.filterMode).toBe("agent");
+  });
+});
+
+describe("LLMInsightsDashboard — Total Cost tile", () => {
+  async function costTileText(cost: number, tokens: number, unpricedTokens: number) {
+    // A window with requests, so the tiles render rather than the empty state.
+    mockKpi.value = {
+      ...mockKpi.value,
+      requestCount: 10,
+      traceCount: 5,
+      totalCost: cost,
+      totalTokens: tokens,
+    };
+    mockHealth.value =
+      unpricedTokens > 0
+        ? {
+            checked_at: 1,
+            checks: [
+              {
+                id: "unpriced_models",
+                status: "warning",
+                affected: 3,
+                total: 10,
+                models: [{ model: "mystery-model", spans: 3, tokens: unpricedTokens }],
+              },
+            ],
+          }
+        : null;
+    mockHasLoadedOnce.value = true;
+    const wrapper = mountDashboard();
+    await (wrapper.vm as any).refresh(undefined, undefined, false);
+    await flushPromises();
+    return wrapper.find("[data-test='llm-insights-kpi-value']").text();
+  }
+
+  it("reads 'cost unknown' when none of the tokens were priced", async () => {
+    const text = await costTileText(0, 1000, 1000);
+    expect(text).toContain("llmDataTrust.cost.unknown");
+    expect(text).not.toContain("≥");
+    expect(text).not.toContain("0.00");
+  });
+
+  it("reads as a lower bound when some tokens were priced", async () => {
+    const text = await costTileText(1.5, 1000, 400);
+    expect(text).toContain("≥");
+    expect(text).toContain("1.50");
+  });
+
+  it("reads plain when every token was priced", async () => {
+    const text = await costTileText(1.5, 1000, 0);
+    expect(text).not.toContain("≥");
+    expect(text).toContain("1.50");
+  });
+
+  it("reads the server's uncapped unpriced tokens, not the sum of the listed models", async () => {
+    mockKpi.value = {
+      ...mockKpi.value,
+      requestCount: 10,
+      traceCount: 5,
+      totalCost: 1.5,
+      totalTokens: 1000,
+    };
+    // The listed top models hold 400 tokens; models past the list cap hold the other 600.
+    mockHealth.value = {
+      checked_at: 1,
+      checks: [
+        {
+          id: "unpriced_models",
+          status: "warning",
+          affected: 30,
+          total: 40,
+          models: [{ model: "mystery-model", spans: 3, tokens: 400 }],
+          model_count: 25,
+          unpriced_tokens: 1000,
+          models_truncated: true,
+        },
+      ],
+    };
+    mockHasLoadedOnce.value = true;
+    const wrapper = mountDashboard();
+    // Exposed by the component for tests; the cast names only the method used here.
+    const vm = wrapper.vm as unknown as { refresh: (...args: unknown[]) => Promise<void> };
+    await vm.refresh(undefined, undefined, false);
+    await flushPromises();
+    expect(wrapper.find("[data-test='llm-insights-kpi-value']").text()).toContain(
+      "llmDataTrust.cost.unknown",
+    );
+    // The tooltip names the listed models as the top ones of all 25.
+    const tooltip = wrapper.find("[data-test='llm-insights-cost-unpriced']").attributes("title");
+    expect(tooltip).toContain("llmDataTrust.topModels");
+    expect(tooltip).toContain('\\"shown\\":1,\\"total\\":\\"25\\"');
+  });
+});
diff --git a/web/src/plugins/traces/LLMInsightsDashboard.vue b/web/src/plugins/traces/LLMInsightsDashboard.vue
index 13fda7af79..f9515d492e 100644
--- a/web/src/plugins/traces/LLMInsightsDashboard.vue
+++ b/web/src/plugins/traces/LLMInsightsDashboard.vue
@@ -31,7 +31,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
          holds a picker-shaped skeleton until the agents list first lands;
          solidAgentTrigger keeps the "All Agents" empty state in solid text. -->
     <AiScopeBar
-      v-if="availableStreams.length > 0"
+      v-if="availableStreams.length > 0 && scopeReady"
       :filter-mode="filterMode"
       v-model:active-stream="activeStream"
       v-model:selected-env="selectedEnv"
@@ -59,6 +59,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :streams-loaded="true"
       :agents-loaded="agentsLoaded"
       @filter-mode-change="onFilterModeChange"
+      @agent-pick="modeExplicit = true"
       @stream-change="onStreamChange"
     >
       <template #trailing>
@@ -113,6 +114,14 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </template>
     </AiScopeBar>
 
+    <!-- Stream mode because these LLM spans carry no agent identity: say so and
+         link to GenAI Agent Mapping. Not over the first-run empty state, which
+         already says what is missing. -->
+    <AiNoAgentIdentityBanner
+      v-if="noAgentIdentity && scopeReady && !isEmpty"
+      data-test="llm-insights"
+    />
+
     <VersionCompareView
       v-if="genAiAgentMappingAccess.allowed && compareMode"
       :version-list="compareVersionList"
@@ -136,13 +145,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
          empty states / dashboard content stays intact without adding a DOM
          wrapper node. -->
     <template v-if="!compareMode">
-      <!-- Full-page skeleton only until the stream list is known. Once we have a
-         stream, we fall through to the content so the trend/table panels mount
-         and fire their queries immediately — in parallel with the KPI fetch,
-         rather than waiting for it (the KPI strip keeps its own skeleton). -->
+      <!-- Full-page skeleton until the stream list is known and the first load
+         has settled the mode and the selection (agents list included). The
+         panels then mount once, with the final scope, and fire their queries
+         in parallel with the KPI fetch (the KPI strip keeps its own skeleton).
+         Mounting them earlier meant a mode or agent flip remounted them and
+         cancelled their in-flight queries. -->
       <LLMInsightsSkeleton
-        v-if="!streamsLoaded || switching"
-        :hide-toolbar="streamsLoaded"
+        v-if="!streamsLoaded || !scopeReady || switching"
+        :hide-toolbar="streamsLoaded && scopeReady"
         class="px-page-edge flex-1"
       />
 
@@ -158,22 +169,67 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         :title="t('traces.lLMInsightsDashboard.failedToLoad')"
         :description="raw(error || '')"
         :action-label="t('traces.lLMInsightsDashboard.retry')"
+        action-id="retry"
         action-icon="refresh"
         @action="loadInsights()"
       />
 
+      <!-- Agent tab whose agents list failed to load: not "no agents". -->
+      <div
+        v-else-if="agentsLoadFailed"
+        class="px-page-edge flex min-h-0 flex-1 items-center justify-center"
+      >
+        <AiAgentsLoadError
+          :error="agentsError ?? 'failed'"
+          data-test="llm-insights"
+          @retry="loadInsights(undefined, undefined, { force: true })"
+        />
+      </div>
+
       <!-- Consolidated empty state — single OEmptyState covers all three
          "no data" shapes (no LLM streams in the org, the active stream has
          no gen_ai_* fields, or the time window returned nothing). The page
-         doesn't expose a search/filter widget, so we never set `:filtered`
-         — both the first-run and the "no data right now" cases land on
-         the preset's "Instrument with OpenTelemetry" call to action. -->
+         doesn't expose a search/filter widget, so we never set `:filtered`.
+         Its actions open a specific integration guide: the one whose docs
+         page the user came from (first), the coding-agent setup, then all
+         integrations, with the most-read guides as chips underneath. -->
       <div
         v-else-if="isEmpty"
         class="px-page-edge flex min-h-0 flex-1 items-center justify-center"
         data-test="llm-insights-empty"
       >
-        <OEmptyState size="hero" preset="no-llm-insights" @action="onEmptyAction" />
+        <OEmptyState
+          size="hero"
+          preset="no-llm-insights"
+          :actions="emptyStateActions"
+          @action="onEmptyAction"
+        >
+          <template #extra>
+            <div
+              class="flex flex-wrap items-center justify-center gap-2"
+              data-test="llm-insights-empty-integrations"
+            >
+              <span class="text-text-secondary text-compact">
+                {{ t("emptyState.noLLMInsights.startFrom") }}
+              </span>
+              <EmptyStateIngestionChip
+                v-for="integration in popularIntegrations"
+                :key="integration.routeName"
+                :data-test="`o2-empty-state-action-integration-${integration.slug}`"
+                :data-empty-state-action="`integration-${integration.slug}`"
+                @click="onEmptyAction(`integration-${integration.slug}`)"
+              >
+                <img
+                  v-if="integration.logo"
+                  :src="integration.logo"
+                  alt=""
+                  class="size-3.5 shrink-0 object-contain"
+                />
+                {{ integration.name }}
+              </EmptyStateIngestionChip>
+            </div>
+          </template>
+        </OEmptyState>
       </div>
 
       <!-- Agent tab with no agents in the window — its own empty state (reuses
@@ -190,6 +246,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :title="t('traces.lLMInsightsDashboard.noAgentsInRange')"
           :description="t('traces.lLMInsightsDashboard.noAgentsDescription')"
           :action-label="t('traces.lLMInsightsDashboard.viewByStream')"
+          action-id="view-by-stream"
           @action="onFilterModeChange('stream')"
         />
       </div>
@@ -198,6 +255,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
          here (inside the scroll container) so the scrollbar sits at the
          content-area edge with content padded away from it. -->
       <div v-else class="px-page-edge flex-1 overflow-y-auto pb-3">
+        <!-- AI data health (AIO-17): between the scope bar and the KPI tiles;
+           hidden when every check passes. -->
+        <LLMDataHealthStrip
+          :health="dataHealth"
+          :loading="dataHealthLoading"
+          :error="dataHealthError"
+          :stream="effectiveStream"
+          :checked-window="dataHealthWindow"
+          :samples="dataHealthSamples"
+          :samples-loading="dataHealthSamplesLoading"
+          @rerun="loadDataHealth(true)"
+          @load-samples="fetchSamples"
+          @view-trace="onViewTrace"
+        />
         <!-- KPI strip: keep a skeleton until the first KPI result lands so the
            cards never flash zeros. The panels below render regardless, so
            their queries fire in parallel with the KPI fetch. -->
@@ -207,8 +278,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <div
             v-for="card in kpiCards"
             :key="card.label"
-            class="bg-card-glass-bg rounded-default border-border-default flex flex-col gap-1 border px-3.5 py-2.5 max-lg:shrink-0 max-lg:basis-auto max-lg:px-1.5 max-lg:py-1"
-            :title="lgUp ? undefined : card.label"
+            class="bg-card-glass-bg rounded-default border-border-default flex min-w-0 flex-col gap-1 border px-3.5 py-2.5 max-lg:shrink-0 max-lg:basis-auto max-lg:gap-0.5 max-lg:px-2 max-lg:py-1.5"
           >
             <!-- P95 rides its own (slower) query — skeleton the WHOLE card while
                it loads, matching the initial strip skeleton tile (see
@@ -222,13 +292,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               <OSkeleton type="text" class="h-6 w-[55%]" />
             </template>
             <template v-else>
-              <div
-                class="flex flex-col gap-1 max-lg:flex-row-reverse max-lg:items-center max-lg:gap-1.5"
-              >
+              <!-- The label stays visible at every width; a compact tile
+                 without it is a bare number. -->
+              <div class="flex flex-col gap-1 max-lg:gap-0.5">
                 <div class="mb-1 flex items-center justify-between gap-2 max-lg:mb-0">
                   <OTruncatedText
                     as="div"
-                    class="text-2xs text-text-secondary leading-normal font-semibold max-lg:hidden"
+                    class="text-2xs text-text-secondary leading-normal font-semibold"
                   >
                     {{ card.label }}
                   </OTruncatedText>
@@ -238,7 +308,12 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                     <OIcon :name="card.icon" size="sm" />
                   </span>
                 </div>
-                <div class="flex items-baseline gap-[0.2rem]">
+                <div class="flex items-baseline gap-[0.2rem]" data-test="llm-insights-kpi-value">
+                  <span
+                    v-if="card.prefix"
+                    class="text-text-secondary text-lg leading-none font-bold max-lg:text-base"
+                    >{{ card.prefix }}</span
+                  >
                   <span class="text-text-secondary text-2xl leading-none font-bold max-lg:text-lg">
                     {{ card.value }}
                   </span>
@@ -246,6 +321,16 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                     {{ card.unit }}
                   </span>
                 </div>
+                <button
+                  v-if="card.note"
+                  type="button"
+                  class="text-2xs text-status-warning-text self-start text-left underline-offset-2 hover:underline"
+                  :title="card.noteTooltip"
+                  data-test="llm-insights-cost-unpriced"
+                  @click="openUnpricedTab"
+                >
+                  {{ card.note }}
+                </button>
               </div>
               <KpiSparkline
                 v-if="card.sparkData && card.sparkData.length > 1"
@@ -294,6 +379,38 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :dashboard-id="panelCacheDashboardId"
               :folder-id="PANEL_CACHE_FOLDER"
             />
+            <!-- Charts name what they leave out: unpriced models are missing from
+               the cost trend and tagged on tokens by model (AIO-16). -->
+            <div
+              v-if="unpriced && (panel.id === 'cost-trend' || panel.id === 'tokens-by-model')"
+              class="text-2xs text-text-secondary mt-1 flex flex-wrap items-center gap-1.5 px-1"
+              :data-test="`llm-insights-unpriced-note-${panel.id}`"
+            >
+              <OIcon name="info" size="xs" />
+              <span>{{
+                panel.id === "cost-trend"
+                  ? t(
+                      unpriced.pricedSince
+                        ? "llmDataTrust.chart.costMissingPricedSince"
+                        : "llmDataTrust.chart.costMissing",
+                      { models: unpricedModelNames, tokens: formatTokens(unpriced.tokens) },
+                    )
+                  : t(
+                      unpriced.pricedSince
+                        ? "llmDataTrust.chart.pricedSinceModels"
+                        : "llmDataTrust.chart.unpricedModels",
+                      { models: unpricedModelNames },
+                    )
+              }}</span>
+              <button
+                v-if="!unpriced.pricedSince"
+                type="button"
+                class="text-text-link hover:text-text-link-hover underline"
+                @click="openUnpricedTab"
+              >
+                {{ t("llmDataTrust.chart.addPrice") }}
+              </button>
+            </div>
           </div>
         </div>
 
@@ -311,28 +428,48 @@ import type { AcceptableValue } from "reka-ui";
 import { useRoute, useRouter } from "vue-router";
 import { useStore } from "vuex";
 import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
-import useBreakpoint from "@/composables/useBreakpoint";
 import { useLLMInsights } from "./composables/useLLMInsights";
 import { splitNumberWithUnit, splitDuration, splitCost } from "./llmInsightsDashboard.utils";
 import KpiSparkline from "./KpiSparkline.vue";
 import KpiCardRow from "@/components/common/KpiCardRow.vue";
 import LLMSchemaPanel from "./LLMSchemaPanel.vue";
 import LLMErrorTable from "./LLMErrorTable.vue";
+import LLMDataHealthStrip from "./LLMDataHealthStrip.vue";
+import { useLLMDataHealth } from "./composables/useLLMDataHealth";
+import { costKind, unpricedSummary, pricingGapsRoute } from "./llmDataTrust.utils";
+import { formatTokens } from "@/utils/llmUtils";
 import LLMInsightsSkeleton from "./LLMInsightsSkeleton.vue";
 import OSkeleton from "@/lib/feedback/Skeleton/OSkeleton.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
+import EmptyStateIngestionChip from "@/lib/core/EmptyState/EmptyStateIngestionChip.vue";
+import type { EmptyStateAction } from "@/lib/core/EmptyState/presets";
+import AiNoAgentIdentityBanner from "@/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue";
+import AiAgentsLoadError from "@/enterprise/components/AIObservability/AiAgentsLoadError.vue";
+import { readPrefill } from "@/components/login/firstSourceOptions";
+import {
+  POPULAR_AI_INTEGRATION_ROUTES,
+  aiIntegrationByRoute,
+  referredAiIntegration,
+} from "./llmInsightsEmptyState";
 import { LLM_INSIGHTS_PANELS } from "./config/llmInsightsPanels";
 import { kpiCache, selectionKey } from "./llmInsightsCache";
 import useStreams from "@/composables/useStreams";
 import genAiAgentMappingService, {
   type GenAiAgentListItem,
 } from "@/services/gen-ai-agent-mapping.service";
-import { genAiAgentsQuery } from "@/services/gen-ai-agent-mapping.queries";
-import { queryClient } from "@/composables/query/queryClient";
+import {
+  useAgentScope,
+  readUrlScope,
+  explicitScopeMode,
+  resolveScopeMode,
+  rememberModeChoice,
+  scopeUrlQuery,
+  agentIdentityKey,
+  type ScopeMode,
+} from "@/enterprise/composables/useAgentScope";
 import { buildAgentTraceFilter } from "./llmAgentFilter";
-import { useAgentScope } from "@/enterprise/composables/useAgentScope";
 import AiScopeBar from "@/enterprise/components/AIObservability/AiScopeBar.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import OTruncatedText from "@/lib/core/Typography/OTruncatedText.vue";
@@ -343,7 +480,6 @@ import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDi
 import { buildFeatureGateContext, checkFeatureAccess } from "@/utils/enterpriseFeatures";
 
 const { t } = useI18nTyped();
-const { lgUp } = useBreakpoint();
 const { getStreams } = useStreams(t);
 const router = useRouter();
 const route = useRoute();
@@ -352,11 +488,7 @@ const store = useStore();
 // Initial filter selection precedence: URL query (deep link / shareable) >
 // localStorage (last used) > default. Read once at setup; we write the URL
 // back on every change via syncFilterUrl().
-const urlType = typeof route.query.type === "string" ? route.query.type : "";
-const urlStream = typeof route.query.stream === "string" ? route.query.stream : "";
-const urlAgentName = typeof route.query.agent === "string" ? route.query.agent : "";
-const urlEnv = typeof route.query.env === "string" ? route.query.env : "";
-const urlVersion = typeof route.query.version === "string" ? route.query.version : "";
+const urlScope = readUrlScope(route.query);
 
 interface Props {
   streamName: string;
@@ -382,14 +514,64 @@ const {
   streamsLoaded,
 } = useLLMInsights();
 
+// AI data health (AIO-17) — also feeds the Total Cost tile's unpriced note (AIO-16).
+const {
+  health: dataHealth,
+  checkedWindow: dataHealthWindow,
+  loading: dataHealthLoading,
+  error: dataHealthError,
+  samples: dataHealthSamples,
+  samplesLoading: dataHealthSamplesLoading,
+  fetchHealth,
+  fetchSamples,
+  reset: resetDataHealth,
+} = useLLMDataHealth();
+const unpriced = computed(() => unpricedSummary(dataHealth.value));
+// The server lists the top 20 unpriced models; the tile and chart notes say so when there are more.
+const unpricedModelNames = computed(() => {
+  const u = unpriced.value;
+  if (!u) return "";
+  const names = u.models.map((m) => m.model ?? t("llmDataTrust.noModelName")).join(", ");
+  return u.truncated
+    ? t("llmDataTrust.topModels", {
+        models: names,
+        shown: u.models.length,
+        total: u.modelCount.toLocaleString(),
+      })
+    : names;
+});
+function loadDataHealth(refresh = false, start = props.startTime, end = props.endTime) {
+  const agent = effectiveAgent.value;
+  fetchHealth(store.state.selectedOrganization?.identifier ?? "", {
+    stream_name: effectiveStream.value,
+    start_time: start,
+    end_time: end,
+    agent: agent?.name,
+    agent_id: agent?.id,
+    env: agent?.env,
+    version: agent?.version,
+    refresh,
+  });
+}
+// The tile's unpriced note comes from the health check, so open the window it counted.
+function openUnpricedTab() {
+  router.push(
+    pricingGapsRoute(
+      effectiveStream.value,
+      store.state.selectedOrganization?.identifier ?? "",
+      dataHealthWindow.value,
+    ),
+  );
+}
+
 // activeStream is component-local (drives the select v-model), but its
 // initial value falls back to localStorage / parent prop. Once the streams
 // list is reconciled, it's clamped to a valid option.
 const activeStream = ref<string>(
-  urlStream || localStorage.getItem(STREAM_LS_KEY) || props.streamName || "",
+  urlScope.stream || localStorage.getItem(STREAM_LS_KEY) || props.streamName || "",
 );
 // Persists the RESOLVED agent name/env/version of the cascade selection. On
-// reload we re-seed the cascade from them (see `pendingAgentName` +
+// reload we re-seed the cascade from them (see `pendingScope` +
 // `selectAgentByScope`), so the last-picked variant is remembered exactly.
 const AGENT_LS_KEY = "llmInsights_agentFilter";
 const ENV_LS_KEY = "llmInsights_envFilter";
@@ -407,7 +589,6 @@ const switching = ref(false);
 
 // Filter mode: "stream" = view a whole stream; "agent" = view a single agent,
 // whose source stream + trace filter both come from the agents API.
-const MODE_LS_KEY = "llmInsights_filterMode";
 // Cloud registers the SAME enterprise route tree and backend as an enterprise
 // build (see router/index.ts's userCloudRoutes() picked for isCloud too) — only
 // a true OSS build lacks the agent-mapping API this gates. Goes through the
@@ -419,37 +600,39 @@ const genAiAgentMappingAccess = checkFeatureAccess(
   buildFeatureGateContext(store.state.zoConfig),
 );
 const { open: openUpgradeDialog } = useEnterpriseUpgradeDialog();
-// Default scope is ALWAYS "agent" — the AI module is agent-centric and every AI
-// page lands on Agent for consistency. Only an explicit `?type=stream` URL param
-// overrides it (a stale saved preference must not silently land on Stream).
-// Agent mode calls the enterprise-only agent-mapping API (and gates version
-// compare), so OSS is pinned to Stream regardless of the URL/localStorage — the
-// toggle to reach Agent is locked, not gone, but clicking it is a no-op.
-const filterMode = ref<"stream" | "agent">(
-  !genAiAgentMappingAccess.allowed ? "stream" : urlType === "stream" ? "stream" : "agent",
-);
+// The mode the user asked for (URL `type`/`agent`, else the remembered toggle),
+// or null when the agents list decides: Agent when the window has agents,
+// Stream when it has none (see loadInsights). OSS has no agent-mapping API, so
+// it is pinned to Stream. Until the mode is resolved the panels stay unmounted,
+// so they mount once, with the final mode, and no query is started and then
+// cancelled by a mode flip.
+const explicitMode = genAiAgentMappingAccess.allowed ? explicitScopeMode(urlScope) : "stream";
+const filterMode = ref<ScopeMode>(explicitMode ?? "stream");
+const modeExplicit = ref(explicitMode !== null);
+// False until the first loadInsights has settled the mode and the selection;
+// the panels and the scope bar wait for it.
+const scopeReady = ref(false);
+// Whether an agents list has decided the mode. A failed agents load decides
+// nothing, so the next load after it decides again; so does a window the user
+// picks, whose agents may differ (unless the user chose the mode).
+let modeSettled = false;
 // Env/name/version to seed the cascade with once the list loads: the URL
-// deep-link first, else the persisted last selection. Resolved into
-// selectedEnv/AgentName/Version via `selectAgentByScope` (falls back to
-// `selectAgentByName` when the exact env+version no longer exists), then
-// cleared. (The URL carries readable values, not the internal agent key.)
-const pendingAgentName = ref<string | null>(
-  filterMode.value === "agent" ? urlAgentName || localStorage.getItem(AGENT_LS_KEY) || null : null,
-);
-// Env/version come from the same source as the name, so a name-only link never pairs with a stored variant of another agent.
-const pendingEnv = ref<string | null>(
-  filterMode.value !== "agent"
-    ? null
-    : urlAgentName
-      ? urlEnv || null
-      : localStorage.getItem(ENV_LS_KEY) || null,
-);
-const pendingVersion = ref<string | null>(
-  filterMode.value !== "agent"
-    ? null
-    : urlAgentName
-      ? urlVersion || null
-      : localStorage.getItem(VERSION_LS_KEY) || null,
+// deep-link first (any of agent/env/version), else the persisted last
+// selection. Resolved into selectedEnv/AgentName/Version via
+// `selectAgentByScope`, then cleared. (The URL carries readable values, not the
+// internal agent key.) Env/version come from the same source as the name, so a
+// name-only link never pairs with a stored variant of another agent.
+const urlHasAgentScope = !!(urlScope.agent || urlScope.env || urlScope.version);
+const pendingScope = ref<{ env: string; name: string; version: string } | null>(
+  urlHasAgentScope
+    ? { env: urlScope.env, name: urlScope.agent, version: urlScope.version }
+    : localStorage.getItem(AGENT_LS_KEY)
+      ? {
+          env: localStorage.getItem(ENV_LS_KEY) || "",
+          name: localStorage.getItem(AGENT_LS_KEY) || "",
+          version: localStorage.getItem(VERSION_LS_KEY) || "",
+        }
+      : null,
 );
 
 // Shared derived scope computeds come from useAgentScope. LLM Insights injects
@@ -462,6 +645,11 @@ const pendingVersion = ref<string | null>(
 // (see loadInsights). `agentFilterClause` stays page-local (LLM's trace-filter
 // builder). Injected refs are the SAME instances the page owns.
 const {
+  loadAgents: loadAgentList,
+  agentsError,
+  agentsLoadFailed,
+  agentEmpty,
+  noAgentIdentity,
   streamSelectOptions,
   selectedStreamCount,
   selectedAgent,
@@ -686,37 +874,21 @@ watch(panelCacheDashboardId, (id) => ensurePanelCacheStub(id), {
   flush: "sync",
 });
 
-// Agent tab is open but the agents API returned none for this window — drives a
-// dedicated empty state (vs. the generic "no LLM data" one). Only true once the
-// list has actually loaded, so we don't flash it before the first fetch.
-const agentEmpty = computed(
-  () => filterMode.value === "agent" && agentsLoaded.value && agents.value.length === 0,
-);
-
 // Reflect the current filter in the URL so the view is shareable / survives a
-// reload: `?type=stream&stream=<name>` or `?type=agent&agent=<name>&env=<env>&version=<version>`.
-// We keep readable values (not the internal agent key) and preserve other params
+// reload: `?stream=<name>` or `?agent=<name>&env=<env>&version=<version>`, plus
+// `type` when the mode was chosen rather than picked from the agents list. We
+// keep readable values (not the internal agent key) and preserve other params
 // (e.g. the time range owned by the parent).
 function syncFilterUrl() {
-  const query: Record<string, any> = { ...route.query, type: filterMode.value };
-  if (filterMode.value === "agent") {
-    delete query.stream;
-    if (selectedAgent.value?.name) {
-      query.agent = selectedAgent.value.name;
-      query.env = selectedEnv.value;
-      query.version = selectedVersion.value;
-    } else {
-      delete query.agent;
-      delete query.env;
-      delete query.version;
-    }
-  } else {
-    delete query.agent;
-    delete query.env;
-    delete query.version;
-    if (activeStream.value) query.stream = activeStream.value;
-    else delete query.stream;
-  }
+  const agent = selectedAgent.value
+    ? { name: selectedAgent.value.name, env: selectedEnv.value, version: selectedVersion.value }
+    : null;
+  const query = scopeUrlQuery(route.query, {
+    mode: filterMode.value,
+    explicit: modeExplicit.value,
+    stream: activeStream.value,
+    agent,
+  });
   // replace (not push) — filter tweaks shouldn't pile up in browser history.
   router.replace({ query }).catch(() => {});
 }
@@ -763,55 +935,25 @@ async function loadTraceStreams() {
   }
 }
 
-// The window the agent list was last loaded for. The agents API is scoped to a
-// time range, so the list only needs refreshing when that window changes — not
-// on every tab toggle. Guarding on this kills a redundant /gen_ai/agents call
-// per toggle.
-let agentsLoadedWindow = "";
-async function loadAgents(startTime?: number, endTime?: number, force = false) {
-  const orgId = store.state.selectedOrganization?.identifier;
-  const start = startTime ?? props.startTime;
-  const end = endTime ?? props.endTime;
-  // No org/window yet (pre-resolve mount): mark loaded with an empty list rather
-  // than returning early — otherwise `agentsLoaded` never flips and the cascade
-  // is stuck behind its loading skeleton forever.
-  if (!orgId || !start || !end) {
-    agents.value = [];
-    agentsLoaded.value = true;
-    return;
-  }
-  const windowKey = `${start}-${end}`;
-  if (agentsLoaded.value && agentsLoadedWindow === windowKey) return;
-  try {
-    const options = genAiAgentsQuery(orgId, start, end);
-    // Past the window guard a user refresh must reach the server: the key buckets the window by the minute.
-    if (force) {
-      await queryClient.invalidateQueries({
-        queryKey: options.queryKey,
-        exact: true,
-        refetchType: "none",
-      });
-    }
-    const agentList = await queryClient.fetchQuery(options);
-    agents.value = agentList.agents;
-    agentsLoadedWindow = windowKey;
-    // Proactively seed the panel-cache stub for every selection at this window —
-    // the Stream tab plus each agent. A cold tab/agent switch can mount the
-    // panels before the per-id sync watcher fires, so pre-seeding here (right
-    // after the list resolves, before any switch) closes that race and keeps
-    // getDashboard a store lookup in every case.
-    ensurePanelCacheStub(selectionKey(orgId, activeStream.value, "_stream", start, end));
-    for (const agent of agents.value) {
-      ensurePanelCacheStub(selectionKey(orgId, agent.source_stream, agent.name, start, end));
-    }
-    // The cascade selection is reconciled against the fresh list by
-    // useAgentScope's watcher (invalid env/name/version fall back / clear), so
-    // there is no page-local selection to clamp here anymore.
-  } catch (e) {
-    console.warn("Failed to load GenAI agents", e);
-    agents.value = [];
-  } finally {
-    agentsLoaded.value = true;
+// Agents for the window, through useAgentScope's single loader (one request
+// per window bucket; `force` only on a user refresh). Then seed the panel-cache
+// stub for every selection at this window — the Stream tab plus each agent — so
+// a cold tab/agent switch that mounts the panels before the per-id sync watcher
+// fires still finds getDashboard a store lookup.
+async function loadAgents(start: number, end: number, force: boolean) {
+  await loadAgentList(start, end, force);
+  const orgId = store.state.selectedOrganization?.identifier ?? "";
+  ensurePanelCacheStub(selectionKey(orgId, activeStream.value, "_stream", start, end));
+  for (const a of agents.value) {
+    ensurePanelCacheStub(
+      selectionKey(
+        orgId,
+        a.source_stream,
+        `${a.name}::${a.env ?? ""}::${a.version ?? ""}`,
+        start,
+        end,
+      ),
+    );
   }
 }
 
@@ -843,18 +985,60 @@ const isEmpty = computed<boolean>(
       (hasLoadedOnce.value && !hasData.value && !loading.value)),
 );
 
-// The empty-state action card emits its `id` here. `instrument` routes to
-// the in-app AI integrations page (OpenTelemetry / Gen-AI guides) — the
-// closest thing we have to a "set this up" landing surface and keeps the
-// user inside the product instead of bouncing to docs.
+// The integration guide the user most likely needs: the one whose docs page
+// they came from — the signup docs referrer (kept for the Get started dialog
+// until it is answered), else this page load's own referrer.
+const suggestedIntegration = referredAiIntegration([readPrefill()?.referrer, document.referrer]);
+// The guides AI-docs visitors read most, as one-click chips (minus the suggested one).
+const popularIntegrations = POPULAR_AI_INTEGRATION_ROUTES.map(aiIntegrationByRoute).filter(
+  (i): i is NonNullable<typeof i> => !!i && i.routeName !== suggestedIntegration?.routeName,
+);
+const emptyStateActions: EmptyStateAction[] = [
+  ...(suggestedIntegration
+    ? [
+        {
+          id: `suggested-${suggestedIntegration.slug}`,
+          icon: "auto-awesome",
+          titleKey: "emptyState.noLLMInsights.suggested",
+          titleParams: { name: suggestedIntegration.name },
+          descriptionKey: "emptyState.noLLMInsights.suggestedDesc",
+          descriptionParams: { name: suggestedIntegration.name },
+        } satisfies EmptyStateAction,
+      ]
+    : []),
+  {
+    id: "instrument-with-coding-agent",
+    icon: "smart-toy",
+    titleKey: "emptyState.noLLMInsights.codingAgent",
+    descriptionKey: "emptyState.noLLMInsights.codingAgentDesc",
+  },
+  {
+    id: "all-integrations",
+    icon: "widgets",
+    titleKey: "emptyState.noLLMInsights.action",
+    descriptionKey: "emptyState.noLLMInsights.actionDesc",
+  },
+];
+
+// Every empty-state action opens an in-app integration page. A guide's own
+// route (not `ai-integrations`, whose default child redirect lands on the
+// first integration and drops the query) is what makes the click land on it.
 function onEmptyAction(id?: string) {
-  if (id !== "instrument") return;
-  router.push({
-    name: "ai-integrations",
-    query: {
-      org_identifier: store.state.selectedOrganization?.identifier,
-    },
-  });
+  const org_identifier = store.state.selectedOrganization?.identifier;
+  if (id === "all-integrations") {
+    router.push({ name: "ai-integrations", query: { org_identifier } });
+    return;
+  }
+  if (id === "instrument-with-coding-agent") {
+    router.push({ name: "ai-openai-python", query: { org_identifier, tab: "agent" } });
+    return;
+  }
+  const slug = id?.replace(/^(suggested|integration)-/, "");
+  const integration =
+    suggestedIntegration?.slug === slug
+      ? suggestedIntegration
+      : popularIntegrations.find((i) => i.slug === slug);
+  if (integration) router.push({ name: integration.routeName, query: { org_identifier } });
 }
 
 interface KpiCard {
@@ -863,6 +1047,11 @@ interface KpiCard {
   icon: string;
   value: string;
   unit?: string;
+  /** Shown before the value, e.g. "≥" when the cost is a lower bound. */
+  prefix?: string;
+  /** Clickable line under the value (unpriced tokens → Model Pricing). */
+  note?: string;
+  noteTooltip?: string;
   sparkData?: number[];
   sparkColor?: string;
   // True while this card's own value is still loading (P95 only — it rides a
@@ -877,13 +1066,31 @@ const kpiCards = computed<KpiCard[]>(() => {
   const errorRate =
     kpi.value.traceCount > 0 ? (kpi.value.errorCount / kpi.value.traceCount) * 100 : 0;
 
-  // Cost comes straight from SUM(gen_ai_usage_cost) on the KPI summary.
-  // If it's 0, either there are no LLM spans in the window or the SDK
-  // isn't emitting cost; either way we render "$0".
+  // Cost is the KPI summary's gen_ai_usage_cost sum over LLM-call spans
+  // (llmCallUsageSum). Spans whose model has no price carry no cost, so when the
+  // data health check finds unpriced tokens the tile reads as a lower bound
+  // ("≥ $X"), or "cost unknown" when none of the window's tokens were priced,
+  // with the token count under it.
+  const u = unpriced.value;
+  const kind = costKind(kpi.value.totalCost, kpi.value.totalTokens, u?.tokens ?? 0);
   const costCard: KpiCard = {
     label: t("traces.lLMInsightsDashboard.totalCost"),
     icon: "payments",
-    ...splitCost(kpi.value.totalCost),
+    ...(kind === "unknown"
+      ? { value: t("llmDataTrust.cost.unknown") }
+      : splitCost(kpi.value.totalCost)),
+    ...(kind === "partial" ? { prefix: "≥" } : {}),
+    ...(u
+      ? {
+          note: t("llmDataTrust.tile.unpricedTokens", { tokens: formatTokens(u.tokens) }),
+          noteTooltip: t(
+            u.pricedSince
+              ? "llmDataTrust.tile.pricedSinceTooltip"
+              : "llmDataTrust.tile.unpricedTooltip",
+            { tokens: formatTokens(u.tokens), models: unpricedModelNames.value },
+          ),
+        }
+      : {}),
     sparkData: sparklines.value.cost,
     sparkColor: "#0ea5e9",
   };
@@ -941,40 +1148,62 @@ function kpiCacheKey(start: number, end: number): string {
   );
 }
 
+// Identity of the agent loadInsights last resolved and loaded for, and whether
+// a loadInsights is between loading the agents and settling the selection. The
+// selected-agent watcher below skips both, so the selection loadInsights itself
+// seeds (the cascade's first-agent default, then the URL / remembered agent)
+// doesn't start a second load that remounts the panels and cancels their
+// queries.
+let loadedAgentKey = "";
+let resolvingScope = 0;
+
 // Single fetch entry point. Always pulls from the current props (which the
 // parent keeps in sync via `recomputeInsightsTimeRange`). Stream selector
 // changes, refresh button, and onMounted all funnel through here. `force`
-// (manual refresh) bypasses the KPI cache and pulls fresh numbers.
-async function loadInsights(startTime?: number, endTime?: number, opts?: { force?: boolean }) {
+// (manual refresh) bypasses the KPI and agents caches and pulls fresh numbers.
+// `windowPicked` (a user's date pick) lets the new window's agents decide an
+// auto mode again.
+async function loadInsights(
+  startTime?: number,
+  endTime?: number,
+  opts?: { force?: boolean; windowPicked?: boolean },
+) {
   try {
     const force = opts?.force ?? false;
     const start = startTime ?? props.startTime;
     const end = endTime ?? props.endTime;
     if (!start || !end) return;
-    localStorage.setItem(MODE_LS_KEY, filterMode.value);
-
     // Stream-mode reads `effectiveStream` from `activeStream`, which is only set
     // once the stream list loads — so make sure that's done before we fetch,
     // regardless of whether this call raced ahead of the mount's stream load.
     await ensureStreamsLoaded();
 
+    // The agents list decides the mode (when the user didn't choose one), fills
+    // the Agent cascade and the stream picker's agent counts, and drives the
+    // "No agent identity found" banner — one request per window.
+    resolvingScope++;
+    try {
+      if (genAiAgentMappingAccess.allowed && availableStreams.value.length > 0) {
+        const agentsLoad = loadAgents(start, end, force);
+        // Explicit Stream queries need no agent identity. Counts and the
+        // instrumentation banner can settle after the panels start loading.
+        if (!modeExplicit.value || filterMode.value === "agent") await agentsLoad;
+      }
+    } finally {
+      resolvingScope--;
+    }
+    if ((!modeSettled || opts?.windowPicked) && !modeExplicit.value) {
+      filterMode.value = resolveScopeMode(null, agents.value.length, agentsError.value);
+    }
+    if (!agentsError.value) modeSettled = true;
+
     if (filterMode.value === "agent") {
-      // Agent tab can't fetch until it knows the agent's source stream, so the
-      // agents list must be loaded first — await it here. (Agents API is only
-      // ever hit on the Agent tab.)
-      await loadAgents(start, end, force);
       // Seed the cascade from the carried-over env/name/version (URL deep-link,
-      // else the persisted last selection) now that the list exists: the exact
-      // triple when env and version are known, else by name; then clear it.
-      if (pendingAgentName.value) {
-        if (pendingEnv.value && pendingVersion.value) {
-          selectAgentByScope(pendingEnv.value, pendingAgentName.value, pendingVersion.value);
-        } else {
-          selectAgentByName(pendingAgentName.value);
-        }
-        pendingAgentName.value = null;
-        pendingEnv.value = null;
-        pendingVersion.value = null;
+      // else the persisted last selection) now that the list exists; then clear it.
+      if (pendingScope.value && agents.value.length > 0) {
+        const { env, name, version } = pendingScope.value;
+        selectAgentByScope(env, name, version);
+        pendingScope.value = null;
       }
       // Default to the first agent when nothing valid is selected (fresh entry
       // to the tab, or the previously-picked agent is gone for this window).
@@ -989,10 +1218,11 @@ async function loadInsights(startTime?: number, endTime?: number, opts?: { force
         localStorage.setItem(VERSION_LS_KEY, selectedVersion.value);
       }
     } else {
-      // Agents API is only relevant on the Agent tab — don't touch it in Stream
-      // mode. The list loads lazily when the user switches to the Agent tab.
       localStorage.setItem(STREAM_LS_KEY, activeStream.value);
     }
+    loadedAgentKey = agentIdentityKey(selectedAgent.value);
+    // Mode and selection are final: the panels may mount now, exactly once.
+    scopeReady.value = true;
 
     // Keep the URL in step with the resolved selection (runs even when there's
     // nothing to query, e.g. the Agent tab with no agents).
@@ -1000,7 +1230,12 @@ async function loadInsights(startTime?: number, endTime?: number, opts?: { force
 
     // Stream comes from the agent (Agent tab) or the picker (Stream tab).
     const stream = effectiveStream.value;
-    if (!stream) return;
+    if (!stream) {
+      resetDataHealth();
+      return;
+    }
+    // Data health runs alongside (server-cached ~1 min; a manual refresh re-runs it).
+    loadDataHealth(force, start, end);
 
     // Per-selection KPI retention: restore the summary numbers for this exact
     // stream+agent+window instead of refetching on a tab toggle. `force`
@@ -1033,12 +1268,16 @@ async function loadInsights(startTime?: number, endTime?: number, opts?: { force
   }
 }
 
+// A toggle click is an explicit choice: it is kept in the URL and remembered for
+// the other Monitor pages, so the agents list no longer picks the mode.
 function onFilterModeChange(mode: boolean | AcceptableValue | AcceptableValue[]) {
   const next = mode === "agent" ? "agent" : "stream";
   if (next === filterMode.value) return;
   filterMode.value = next;
-  // Entering the Agent tab fetches the agents list before any KPI fetch — show
-  // the skeleton for that whole stretch so the switch is immediate, not stale.
+  modeExplicit.value = true;
+  rememberModeChoice(next);
+  // Entering the Agent tab can wait on the agents list before any KPI fetch —
+  // show the skeleton for that stretch so the switch is immediate, not stale.
   if (next === "agent") switching.value = true;
   loadInsights();
 }
@@ -1053,12 +1292,16 @@ function onStreamChange() {
 // the former @agent-change handler. Keyed on the agent's stream-scoped identity +
 // version so a same-named agent in a different stream/version still reloads.
 watch(
-  () => {
-    const a = selectedAgent.value;
-    return a ? `${a.source_stream}::${a.name}::${a.env ?? ""}::${a.version ?? ""}` : "";
-  },
-  () => {
-    if (filterMode.value !== "agent") return;
+  () => agentIdentityKey(selectedAgent.value),
+  (key) => {
+    if (
+      filterMode.value !== "agent" ||
+      !scopeReady.value ||
+      resolvingScope > 0 ||
+      key === loadedAgentKey
+    ) {
+      return;
+    }
     switching.value = true;
     loadInsights();
   },
@@ -1066,9 +1309,12 @@ watch(
 
 // Parent calls this on Run Query / Refresh / date-range change, passing
 // the freshly computed start/end so we don't have to wait for Vue's
-// next-tick prop propagation.
-async function refresh(startTime?: number, endTime?: number) {
-  await loadInsights(startTime, endTime, { force: true });
+// next-tick prop propagation. `force` is false for the window DateTime replays
+// on mount, so entering the page does not bypass the caches. `windowPicked` is
+// true only for a user's own date pick: an auto-decided mode is decided again
+// for that window (Agent with no agents → Stream), as Agent Behavior does.
+async function refresh(startTime?: number, endTime?: number, force = true, windowPicked = false) {
+  await loadInsights(startTime, endTime, { force, windowPicked });
 }
 
 // "Last refreshed" timestamp for the whole-page refresh indicator. Stamped when
diff --git a/web/src/plugins/traces/SearchBar.spec.ts b/web/src/plugins/traces/SearchBar.spec.ts
index af227a60b5..30dca56fd4 100644
--- a/web/src/plugins/traces/SearchBar.spec.ts
+++ b/web/src/plugins/traces/SearchBar.spec.ts
@@ -18,6 +18,7 @@ import { mount, VueWrapper, flushPromises } from "@vue/test-utils";
 import { ref, computed, reactive } from "vue";
 import store from "@/test/unit/helpers/store";
 import router from "@/test/unit/helpers/router";
+import config from "@/aws-exports";
 
 // ---------------------------------------------------------------------------
 // Module-level mocks — vi.mock is hoisted by Vitest; never use vi.doMock here
@@ -35,6 +36,13 @@ vi.mock("@/aws-exports", () => ({
   default: { isCloud: "false", isEnterprise: "true" },
 }));
 
+const nlFilterMock = vi.hoisted(() =>
+  vi.fn((_sql: string, _parser: unknown): string | null => null),
+);
+vi.mock("@/plugins/traces/utils/nlSqlToTracesFilter", () => ({
+  nlSqlToTracesFilter: nlFilterMock,
+}));
+
 // getImageURL is called by the metricsIcon computed; stub to avoid asset loading.
 // Use importOriginal so mergeRoutes (used by router.ts) is not lost.
 vi.mock("@/utils/zincutils", async (importOriginal) => {
@@ -300,6 +308,23 @@ vi.mock("@/composables/useTraces", () => ({
   }),
 }));
 
+const alertAction = vi.hoisted(() => ({
+  createAlert: vi.fn(),
+  disabledReason: { value: null as string | null },
+  queryNotRun: { value: false },
+}));
+
+vi.mock("@/plugins/traces/composables/useTracesAlertAction", async () => {
+  const { computed } = await import("vue");
+  return {
+    useTracesAlertAction: () => ({
+      createAlert: alertAction.createAlert,
+      disabledReason: computed(() => alertAction.disabledReason.value),
+      queryNotRun: computed(() => alertAction.queryNotRun.value),
+    }),
+  };
+});
+
 // ---------------------------------------------------------------------------
 // Import the component AFTER all vi.mock declarations.
 // ---------------------------------------------------------------------------
@@ -342,7 +367,7 @@ const sharedStubs = {
       };
     },
   },
-  CodeQueryEditor: {
+  UnifiedQueryEditor: {
     // Monaco's caret element: the recent-searches dropdown opens at it.
     template:
       '<div data-test="code-query-editor-stub"><div class="monaco-editor"><div class="cursors-layer"><div class="cursor" /></div></div></div>',
@@ -359,8 +384,11 @@ const sharedStubs = {
       "filterMode",
       "debounceTime",
       "fieldValueResolver",
+      "hideNlToggle",
+      "nlpMode",
+      "transformGeneratedQuery",
     ],
-    emits: ["update:query", "run-query", "focus", "blur", "user-edit"],
+    emits: ["update:query", "run-query", "focus", "blur", "user-edit", "update:nlpMode"],
     setup(_: unknown, { emit }: { emit: (event: "focus") => void }) {
       return {
         setValue: vi.fn(),
@@ -421,6 +449,11 @@ const sharedStubs = {
     template: '<div v-bind="$attrs"><slot name="label-action" /><slot /></div>',
   },
   ODropdownSeparator: { template: "<hr />" },
+  AddToDashboard: {
+    name: "AddToDashboard",
+    template: '<div data-test="traces-add-to-dashboard-stub" />',
+    props: ["open", "panels", "notice", "dashboardPanelData"],
+  },
   ODropdownSub: {
     name: "ODropdownSub",
     template:
@@ -1456,8 +1489,7 @@ describe("SearchBar", () => {
       wrapper = mountSearchBar();
       await flushPromises();
 
-      // OButton: the download button uses title="Export Traces" (no .download-logs-btn class)
-      expect(wrapper.find('[title="traces.exportTraces"]').exists()).toBe(true);
+      expect(wrapper.find('[data-test="traces-search-bar-export-btn"]').exists()).toBe(true);
     });
 
     it("should be disabled when queryResults.hits is empty", async () => {
@@ -1465,10 +1497,9 @@ describe("SearchBar", () => {
       wrapper = mountSearchBar();
       await flushPromises();
 
-      // OButton uses native HTML disabled attribute (not a CSS "disabled" class)
-      const btn = wrapper.find('[title="traces.exportTraces"]');
+      const btn = wrapper.find('[data-test="traces-search-bar-export-btn"]');
       expect(btn.exists()).toBe(true);
-      expect(btn.attributes("disabled")).toBeDefined();
+      expect(btn.attributes("disabled")).toBe("true");
     });
 
     it("should be enabled when queryResults.hits has entries", async () => {
@@ -1483,10 +1514,9 @@ describe("SearchBar", () => {
       wrapper = mountSearchBar();
       await flushPromises();
 
-      // OButton: when enabled, native disabled attribute should be absent
-      const btn = wrapper.find('[title="traces.exportTraces"]');
+      const btn = wrapper.find('[data-test="traces-search-bar-export-btn"]');
       expect(btn.exists()).toBe(true);
-      expect(btn.attributes("disabled")).toBeUndefined();
+      expect(btn.attributes("disabled")).toBe("false");
     });
 
     it("should export a traces-mode hit with a services object as aligned CSV", async () => {
@@ -1545,6 +1575,88 @@ describe("SearchBar", () => {
     });
   });
 
+  // -------------------------------------------------------------------------
+  describe("more actions menu", () => {
+    const moreBtn = () => wrapper.find('[data-test="traces-search-bar-more-actions-btn"]');
+    const alertItem = () => wrapper.find('[data-test="traces-create-alert-btn"]');
+    const redItem = () => wrapper.find('[data-test="traces-add-red-to-dashboard-btn"]');
+
+    beforeEach(() => {
+      alertAction.createAlert.mockReset();
+      alertAction.disabledReason.value = null;
+      alertAction.queryNotRun.value = false;
+    });
+
+    it("renders the more actions trigger with Export, Create alert and Add RED charts inside", async () => {
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(moreBtn().exists()).toBe(true);
+      expect(wrapper.find('[data-test="traces-search-bar-export-btn"]').exists()).toBe(true);
+      expect(alertItem().exists()).toBe(true);
+      expect(redItem().exists()).toBe(true);
+      expect(wrapper.find('[title="traces.exportTraces"]').exists()).toBe(false);
+    });
+
+    it("exports from the menu item", async () => {
+      downloadFileMock.mockReturnValue(true);
+      wrapper = mountSearchBar();
+      await flushPromises();
+      await wrapper.find('[data-test="traces-search-bar-export-btn"]').trigger("click");
+      expect(downloadFileMock).toHaveBeenCalledTimes(1);
+    });
+
+    it("hides the menu outside the spans and traces views", async () => {
+      searchObjInstance.meta.searchMode = "service-graph";
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(moreBtn().exists()).toBe(false);
+    });
+
+    it("creates a matches alert on select", async () => {
+      wrapper = mountSearchBar();
+      await flushPromises();
+      await alertItem().trigger("click");
+      expect(alertAction.createAlert).toHaveBeenCalledWith("matches");
+    });
+
+    it("disables Create alert with the reason when no stream is picked", async () => {
+      alertAction.disabledReason.value = "Pick a stream first";
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(alertItem().attributes("disabled")).toBe("true");
+      expect(alertItem().attributes("description")).toBe("Pick a stream first");
+      await alertItem().trigger("click");
+      expect(alertAction.createAlert).not.toHaveBeenCalled();
+    });
+
+    it("notes when the query has not run yet", async () => {
+      alertAction.queryNotRun.value = true;
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(alertItem().attributes("description")).toBe("search.queryActions.usesUnrunQuery");
+    });
+
+    it("opens Add to dashboard with Rate, Errors and Duration panels and the bucket notice", async () => {
+      wrapper = mountSearchBar();
+      await flushPromises();
+      await redItem().trigger("click");
+      await flushPromises();
+      const dialog = wrapper.findComponent({ name: "AddToDashboard" });
+      expect(dialog.exists()).toBe(true);
+      const panels = dialog.props("panels") as any[];
+      expect(panels.map((p) => p.title.split(" · ")[0])).toEqual(["Rate", "Errors", "Duration"]);
+      expect(panels.every((p) => p.queries[0].fields.stream_type === "traces")).toBe(true);
+      expect(dialog.props("notice")).toBe("traces.redActions.bucketNotice.seconds");
+    });
+
+    it("disables Add RED charts when no stream is picked", async () => {
+      searchObjInstance.data.stream.selectedStream = { label: "", value: "" };
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(redItem().attributes("disabled")).toBe("true");
+    });
+  });
+
   // -------------------------------------------------------------------------
   describe("structural elements", () => {
     it("should render the date-time dropdown", async () => {
@@ -1588,6 +1700,67 @@ describe("SearchBar", () => {
     });
   });
 
+  // -------------------------------------------------------------------------
+  describe("plain-English filter (Ask AI) on the query editor", () => {
+    const editor = () => wrapper.findComponent({ ref: "queryEditorRef" });
+
+    afterEach(() => {
+      config.isEnterprise = "true";
+      delete store.state.zoConfig.ai_enabled;
+      nlFilterMock.mockReset();
+    });
+
+    it("keeps the Monaco host id the e2e helpers look for", async () => {
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(editor().props("editorId")).toBe("traces-query-editor");
+    });
+
+    it("shows the AI toggle on an enterprise build with AI enabled", async () => {
+      store.state.zoConfig.ai_enabled = true;
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(editor().props("hideNlToggle")).toBe(false);
+    });
+
+    it("hides the AI toggle when AI is off", async () => {
+      store.state.zoConfig.ai_enabled = false;
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(editor().props("hideNlToggle")).toBe(true);
+    });
+
+    it("hides the AI toggle on a non-enterprise build", async () => {
+      store.state.zoConfig.ai_enabled = true;
+      config.isEnterprise = "false";
+      wrapper = mountSearchBar();
+      await flushPromises();
+      expect(editor().props("hideNlToggle")).toBe(true);
+    });
+
+    it("writes only the WHERE part of the generated SQL into the editor", async () => {
+      nlFilterMock.mockReturnValue("service_name = 'querier'");
+      wrapper = mountSearchBar();
+      await flushPromises();
+      const sql = "SELECT * FROM default WHERE service_name = 'querier' LIMIT 100";
+      expect(editor().props("transformGeneratedQuery")(sql)).toBe("service_name = 'querier'");
+      expect(nlFilterMock).toHaveBeenCalledWith(sql, tracesParserRef.value);
+      expect(toastMock).not.toHaveBeenCalled();
+    });
+
+    it("keeps the user's text and says the question needs SQL when no filter fits", async () => {
+      nlFilterMock.mockReturnValue(null);
+      wrapper = mountSearchBar();
+      await flushPromises();
+      const sql = "SELECT service_name, count(*) FROM default GROUP BY service_name";
+      expect(editor().props("transformGeneratedQuery")(sql)).toBeNull();
+      expect(toastMock).toHaveBeenCalledWith({
+        message: "traces.nlNeedsSql",
+        variant: "warning",
+      });
+    });
+  });
+
   // -------------------------------------------------------------------------
   describe("query editor autocomplete wiring", () => {
     const editorProps = () => wrapper.findComponent({ ref: "queryEditorRef" });
diff --git a/web/src/plugins/traces/SearchBar.vue b/web/src/plugins/traces/SearchBar.vue
index 0ef8e6ae4f..a562de4993 100644
--- a/web/src/plugins/traces/SearchBar.vue
+++ b/web/src/plugins/traces/SearchBar.vue
@@ -418,15 +418,6 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               </ODropdown>
             </div>
           </div>
-          <OButton
-            variant="outline"
-            size="icon-toolbar"
-            :disabled="!searchObj.data.queryResults?.hits?.length"
-            :title="t('traces.exportTraces')"
-            @click="downloadLogs"
-          >
-            <OIcon name="download" size="sm" />
-          </OButton>
           <ShareButton
             data-test="logs-search-bar-share-link-btn"
             :url="tracesShareURL"
@@ -434,6 +425,85 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             size="icon-toolbar"
             shortcut-id="tracesCopyUrl"
           />
+          <ODropdown side="bottom" align="end">
+            <template #trigger>
+              <OButton
+                data-test="traces-search-bar-more-actions-btn"
+                class="hover:bg-interactive-hover-bg! size-[2.125rem]!"
+                variant="outline"
+                size="icon-toolbar"
+              >
+                <OIcon name="menu" size="sm" />
+                <OTooltip max-width="7rem" :content="t('search.moreActions')" />
+              </OButton>
+            </template>
+
+            <ODropdownGroup :label="t('search.menuGroupDownloads')">
+              <ODropdownItem
+                data-test="traces-search-bar-export-btn"
+                :disabled="!searchObj.data.queryResults?.hits?.length"
+                @select="downloadLogs"
+              >
+                <template #icon-left>
+                  <span
+                    class="rounded-default bg-section-header-bg text-text-secondary inline-flex h-7 w-7 shrink-0 items-center justify-center"
+                  >
+                    <OIcon name="download" size="sm" />
+                  </span>
+                </template>
+                {{ t("traces.exportTraces") }}
+              </ODropdownItem>
+            </ODropdownGroup>
+
+            <ODropdownSeparator />
+
+            <ODropdownGroup :label="t('search.menuGroupAlerts')">
+              <ODropdownItem
+                data-test="traces-create-alert-btn"
+                :disabled="!!createAlertDisabledReason"
+                focusable-unavailable
+                :description="createAlertDisabledReason || createAlertNote"
+                @select="onCreateAlert"
+              >
+                <template #icon-left>
+                  <span
+                    class="rounded-default bg-section-header-bg text-text-secondary inline-flex h-7 w-7 shrink-0 items-center justify-center"
+                  >
+                    <OIcon :name="createAlertIcon" size="sm" />
+                  </span>
+                </template>
+                {{ t("alerts.prefill.sources.traces.label") }}
+              </ODropdownItem>
+            </ODropdownGroup>
+
+            <ODropdownSeparator />
+
+            <ODropdownGroup :label="t('traces.redActions.menuGroupDashboards')">
+              <ODropdownItem
+                data-test="traces-add-red-to-dashboard-btn"
+                :disabled="!!redDashboardDisabledReason"
+                focusable-unavailable
+                :description="redDashboardDisabledReason"
+                @select="openRedDashboardDialog"
+              >
+                <template #icon-left>
+                  <span
+                    class="rounded-default bg-section-header-bg text-text-secondary inline-flex h-7 w-7 shrink-0 items-center justify-center"
+                  >
+                    <OIcon name="dashboard" size="sm" />
+                  </span>
+                </template>
+                {{ t("traces.redActions.addRedToDashboard") }}
+              </ODropdownItem>
+            </ODropdownGroup>
+          </ODropdown>
+          <AddToDashboard
+            v-if="redDashboardOpen"
+            v-model:open="redDashboardOpen"
+            :dashboard-panel-data="{ data: {} }"
+            :panels="redDashboardPanels"
+            :notice="redDashboardNotice"
+          />
         </div>
 
         <!-- Service Graph right toolbar: DateTime, Refresh, Tree/Graph tabs, Layout -->
@@ -527,17 +597,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         class="relative flex h-full w-full flex-col overflow-hidden"
         @keydown.capture="onRecentEditorKeydown"
       >
-        <CodeQueryEditor
+        <UnifiedQueryEditor
           ref="queryEditorRef"
           editor-id="traces-query-editor"
+          data-test-prefix="traces-search-bar"
           v-model:query="searchObj.data.editorValue"
+          v-model:nlp-mode="nlpMode"
           :keywords="effectiveKeywords"
           :suggestions="effectiveSuggestions"
           :field-value-resolver="resolveFieldValues"
           :recent-queries="recentQueries"
           :debounce-time="100"
           :filter-mode="!searchObj.meta.sqlMode"
-          language="sql"
+          :hide-nl-toggle="!isAiEnabled"
+          :transform-generated-query="toTracesFilter"
+          editor-height="100%"
           @update:query="updateQueryValue"
           @user-edit="onRecentEditorEdit"
           @run-query="searchData"
@@ -560,7 +634,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           v-if="
             searchObj.data.editorValue === '' &&
             searchObj.meta.queryEditorPlaceholderFlag &&
-            !recentFocusOpen
+            !recentFocusOpen &&
+            !nlpMode
           "
           class="query-editor-placeholder-overlay pointer-events-none absolute top-0 right-0 bottom-0 left-0 z-1 flex items-start [padding:0.1875rem_0.5rem_0_2.15rem] select-none"
         >
@@ -604,8 +679,15 @@ import {
   onActivated,
   computed,
   toRef,
+  shallowRef,
 } from "vue";
 import { useQueryPlaceholder } from "@/components/logs/useQueryPlaceholder";
+import { useTracesAlertAction } from "@/plugins/traces/composables/useTracesAlertAction";
+import { getAlertSource } from "@/utils/alerts/alertSourceRegistry";
+import { resolveTracesFilter } from "@/utils/traces/resolveTracesFilter";
+import { nlSqlToTracesFilter } from "@/plugins/traces/utils/nlSqlToTracesFilter";
+import { chartInterval } from "./metrics/latencyHeatmap";
+import { buildTracesRedPanels, tracesBucketNotice } from "./metrics/tracesRedPanels";
 import { useI18nTyped } from "@/types/i18n";
 import { useRouter } from "vue-router";
 import { useStore } from "vuex";
@@ -621,6 +703,7 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
 import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import ODropdownSeparator from "@/lib/overlay/Dropdown/ODropdownSeparator.vue";
+import ODropdownGroup from "@/lib/overlay/Dropdown/ODropdownGroup.vue";
 import ODialog from "@/lib/overlay/Dialog/ODialog.vue";
 import OInput from "@/lib/forms/Input/OInput.vue";
 import OSwitch from "@/lib/forms/Switch/OSwitch.vue";
@@ -698,12 +781,14 @@ export default defineComponent({
     ODropdown,
     ODropdownItem,
     ODropdownSeparator,
+    ODropdownGroup,
+    AddToDashboard: defineAsyncComponent(() => import("@/plugins/metrics/AddToDashboard.vue")),
     ODialog,
     OInput,
     OSwitch,
     OSelect,
     OTooltip,
-    CodeQueryEditor: defineAsyncComponent(() => import("@/components/CodeQueryEditor.vue")),
+    UnifiedQueryEditor: defineAsyncComponent(() => import("@/components/QueryEditor.vue")),
     SyntaxGuide,
     RecentSearchesButton,
     RecentSearchesDrawer,
@@ -756,6 +841,16 @@ export default defineComponent({
     const { searchObj, tracesShareURL, tracesParser } = useTraces();
     const queryEditorRef = ref(null);
 
+    const nlpMode = ref(false);
+    const isAiEnabled = computed(
+      () => config.isEnterprise === "true" && Boolean(store.state.zoConfig.ai_enabled),
+    );
+    const toTracesFilter = (sql: string): string | null => {
+      const filter = nlSqlToTracesFilter(sql, tracesParser.value);
+      if (filter === null) toast({ message: t("traces.nlNeedsSql"), variant: "warning" });
+      return filter;
+    };
+
     const {
       onFocus: _sqlOnFocus,
       onBlur: _sqlOnBlur,
@@ -1125,6 +1220,50 @@ export default defineComponent({
       }
     };
 
+    const {
+      createAlert,
+      disabledReason: createAlertDisabledReason,
+      queryNotRun,
+    } = useTracesAlertAction();
+    const createAlertIcon = getAlertSource("traces").icon;
+    const createAlertNote = computed(() =>
+      queryNotRun.value ? t("search.queryActions.usesUnrunQuery") : null,
+    );
+    const onCreateAlert = () => {
+      if (!createAlertDisabledReason.value) createAlert("matches");
+    };
+
+    const redDashboardOpen = ref(false);
+    const redDashboardPanels = shallowRef([]);
+    const redDashboardNotice = ref(undefined);
+    const redDashboardDisabledReason = computed(() =>
+      searchObj.data.stream.selectedStream?.value
+        ? null
+        : t("alerts.prefill.sources.traces.noStream"),
+    );
+    const openRedDashboardDialog = () => {
+      const stream = searchObj.data.stream.selectedStream?.value;
+      if (!stream) return;
+      const view = searchObj.meta.searchMode === "spans" ? "spans" : "traces";
+      // Same bucket the RED charts compute for this range.
+      const interval = chartInterval(
+        searchObj.data.datetime.startTime,
+        searchObj.data.datetime.endTime,
+      );
+      const editorText = searchObj.data.editorValue ?? "";
+      redDashboardPanels.value = buildTracesRedPanels({
+        streamName: stream,
+        filter: resolveTracesFilter(editorText, tracesParser.value, stream),
+        filterText: editorText,
+        view,
+        interval,
+        rateUnit: t(`traces.metrics.perSecond.${view}`),
+      });
+      const { unit, count } = tracesBucketNotice(interval.seconds);
+      redDashboardNotice.value = t(`traces.redActions.bucketNotice.${unit}`, { count });
+      redDashboardOpen.value = true;
+    };
+
     const updateTimezone = () => {
       emit("onChangeTimezone");
     };
@@ -1463,6 +1602,9 @@ export default defineComponent({
       store,
       searchObj,
       queryEditorRef,
+      nlpMode,
+      isAiEnabled,
+      toTracesFilter,
       onQueryEditorFocus,
       onQueryEditorBlur,
       queryEditorBoxRef,
@@ -1482,6 +1624,15 @@ export default defineComponent({
       updateQueryValue,
       updateDateTime,
       downloadLogs,
+      createAlertDisabledReason,
+      createAlertNote,
+      createAlertIcon,
+      onCreateAlert,
+      redDashboardOpen,
+      redDashboardPanels,
+      redDashboardNotice,
+      redDashboardDisabledReason,
+      openRedDashboardDialog,
       setEditorValue,
       autoCompleteKeywords,
       effectiveKeywords,
diff --git a/web/src/plugins/traces/ServiceGraph.vue b/web/src/plugins/traces/ServiceGraph.vue
index 5d27636c48..ef3f4b1096 100644
--- a/web/src/plugins/traces/ServiceGraph.vue
+++ b/web/src/plugins/traces/ServiceGraph.vue
@@ -299,45 +299,12 @@
                 @click="handleNodeClick"
               />
 
-              <!-- Zoom controls: explicit buttons drive zoom + fit-to-screen,
-                   floated bottom-right like a map control. -->
-              <div
-                class="rounded-default border-border-default bg-surface-panel absolute right-3 bottom-3 z-10 flex flex-col overflow-hidden border"
-                data-test="service-graph-zoom-controls"
-              >
-                <OButton
-                  variant="ghost"
-                  size="icon-sm"
-                  icon-left="add"
-                  class="rounded-none"
-                  data-test="service-graph-zoom-in"
-                  @click="zoomIn"
-                >
-                  <OTooltip side="left" :content="t('traces.serviceGraph.zoomIn')" />
-                </OButton>
-                <OSeparator />
-                <OButton
-                  variant="ghost"
-                  size="icon-sm"
-                  icon-left="remove"
-                  class="rounded-none"
-                  data-test="service-graph-zoom-out"
-                  @click="zoomOut"
-                >
-                  <OTooltip side="left" :content="t('traces.serviceGraph.zoomOut')" />
-                </OButton>
-                <OSeparator />
-                <OButton
-                  variant="ghost"
-                  size="icon-sm"
-                  icon-left="fullscreen"
-                  class="rounded-none"
-                  data-test="service-graph-fit-screen"
-                  @click="fitToScreen"
-                >
-                  <OTooltip side="left" :content="t('traces.serviceGraph.fitToScreen')" />
-                </OButton>
-              </div>
+              <ChartZoomControls
+                data-test-prefix="service-graph"
+                @zoom-in="zoomIn"
+                @zoom-out="zoomOut"
+                @fit="fitToScreen"
+              />
 
               <!-- Service Graph Side Panel (node) -->
               <ServiceGraphSidePanel
@@ -428,11 +395,14 @@ import OCheckbox from "@/lib/forms/Checkbox/OCheckbox.vue";
 import OToggleGroup from "@/lib/core/ToggleGroup/OToggleGroup.vue";
 import OToggleGroupItem from "@/lib/core/ToggleGroup/OToggleGroupItem.vue";
 import ServiceGraphNoDataState from "./ServiceGraphNoDataState.vue";
+import ChartZoomControls from "@/components/traces/ChartZoomControls.vue";
+import useChartZoom from "@/composables/traces/useChartZoom";
 import { getEffectiveTimeRange } from "@/utils/date";
 
 export default defineComponent({
   name: "ServiceGraph",
   components: {
+    ChartZoomControls,
     OSeparator,
     ChartRenderer,
     ServiceGraphSidePanel,
@@ -652,44 +622,6 @@ export default defineComponent({
       applyFilters();
     };
 
-    // ── Zoom controls ─────────────────────────────────────────────────────────
-    // The mouse still zooms (roam:true) so you can focus an area with the wheel;
-    // scaleLimit on the series bounds it so it can't run away (the old "erratic"
-    // feel). The +/- buttons drive the SAME series `zoom` option via setOption,
-    // reading the chart's CURRENT zoom first so button + wheel stay in sync.
-    // Match the series `scaleLimit` (convertTraceData.ts) so the +/- buttons and
-    // box-zoom never compute a factor the chart will silently clamp away.
-    const ZOOM_MIN = 0.4;
-    const ZOOM_MAX = 3;
-
-    // The live zoom level from the chart (kept in sync with wheel zoom), so a
-    // button press adjusts from where the user actually is, not a stale ref.
-    const currentZoom = (chart: any): number => {
-      const opt = chart.getOption?.();
-      const z = opt?.series?.[0]?.zoom;
-      return typeof z === "number" && z > 0 ? z : 1;
-    };
-
-    const zoomBy = (factor: number) => {
-      const chart = chartRendererRef.value?.chart;
-      if (!chart) return;
-      const next = Math.min(ZOOM_MAX, Math.max(ZOOM_MIN, currentZoom(chart) * factor));
-      // Merge only the zoom so positions/data stay put.
-      chart.setOption({ series: [{ zoom: next }] }, { lazyUpdate: true });
-    };
-
-    const zoomIn = () => zoomBy(1.25);
-    const zoomOut = () => zoomBy(1 / 1.25);
-
-    // Fit-to-screen: recreate the chart (keyed on chartKey) so ECharts re-fits
-    // the full graph bounding box into the panel at zoom 1, re-centered — the
-    // reliable reset for both tree (layout:none) and graph series (also clears
-    // any wheel pan/zoom the user applied).
-    const fitToScreen = () => {
-      lastChartOptions = null;
-      chartKey.value++;
-    };
-
     const toggleKindVisibility = (kind: string) => {
       const s = new Set(hiddenKinds.value);
       s.has(kind) ? s.delete(kind) : s.add(kind);
@@ -821,8 +753,12 @@ export default defineComponent({
     // filtered — the "Show types" button reflects this (active state + count).
     const activeFilterCount = computed(() => hiddenKinds.value.size);
 
-    // Key to control chart recreation - only change when layout/visualization type changes
-    const chartKey = ref(0);
+    const { chartKey, zoomIn, zoomOut, fitToScreen } = useChartZoom(
+      () => chartRendererRef.value?.chart,
+      () => {
+        lastChartOptions = null;
+      },
+    );
 
     // Restore drag-to-pan (map-style). The shared ChartRenderer arms the
     // `dataZoomSelect` global cursor on every render, which turns a drag into a
diff --git a/web/src/plugins/traces/ServicesCatalog.spec.ts b/web/src/plugins/traces/ServicesCatalog.spec.ts
index 3cb4a93509..2164610e14 100644
--- a/web/src/plugins/traces/ServicesCatalog.spec.ts
+++ b/web/src/plugins/traces/ServicesCatalog.spec.ts
@@ -1759,7 +1759,13 @@ describe("ServicesCatalog", () => {
 
       it("keeps inferred dependencies with the same name but different identities separate", async () => {
         mockStreamSchema.mockResolvedValueOnce({
-          data: { schema: [{ name: "infer_service_name" }] },
+          data: {
+            schema: [
+              { name: "infer_service_name" },
+              { name: "infer_service_system" },
+              { name: "infer_service_type" },
+            ],
+          },
         });
         mockFetchQueryDataWithHttpStream.mockImplementation((_req: any, callbacks: any) => {
           callbacks.data(null, {
@@ -2275,6 +2281,34 @@ describe("ServicesCatalog", () => {
       expect(wrapper.find('[data-test="services-catalog-requests-nightly-cron"]').text()).toBe("0");
     });
 
+    it("selects NULL for inferred system and type columns the stream does not have", async () => {
+      const sql = await loadWithSchema(
+        schemaWith("infer_service_name", "reference_parent_span_id"),
+      );
+      expect(selectItem(sql, "_infer_service_system").trim()).toBe(
+        "NULL AS _infer_service_system,",
+      );
+      expect(selectItem(sql, "_infer_service_type").trim()).toBe("NULL AS _infer_service_type,");
+      expect(sql).not.toContain("NULLIF(infer_service_system");
+      expect(sql).not.toContain("NULLIF(infer_service_type");
+      const groupBy = sql.split("GROUP BY")[1].split("ORDER BY")[0];
+      expect(groupBy.trim().split(",\n")).toEqual([
+        "COALESCE(NULLIF(infer_service_name, ''), service_name)",
+        "  NULLIF(infer_service_name, '')",
+      ]);
+    });
+
+    it("groups by only the inferred column the stream has", async () => {
+      const sql = await loadWithSchema(schemaWith("infer_service_name", "infer_service_type"));
+      expect(selectItem(sql, "_infer_service_system").trim()).toBe(
+        "NULL AS _infer_service_system,",
+      );
+      expect(selectItem(sql, "_infer_service_type")).toContain("NULLIF(infer_service_type, '')");
+      const groupBy = sql.split("GROUP BY")[1].split("ORDER BY")[0];
+      expect(groupBy).toContain("NULLIF(infer_service_type, '')");
+      expect(groupBy).not.toContain("infer_service_system");
+    });
+
     it("discards a schema fetched for a stream that is no longer selected", async () => {
       let release!: (value: any) => void;
       mockStreamSchema.mockImplementationOnce(
@@ -3080,6 +3114,76 @@ describe("ServicesCatalog", () => {
     });
   });
 
+  describe("search error state", () => {
+    const failSearch = () =>
+      mockFetchQueryDataWithHttpStream.mockImplementation((_req: any, callbacks: any) => {
+        callbacks.error(null, {
+          type: "error",
+          content: { message: "Search field not found: infer_service_system" },
+        });
+      });
+    const errorState = () => wrapper.find('[data-test="services-catalog-error"]');
+    const retry = () => errorState().find('[data-test="o2-empty-state"] button');
+
+    it("shows the load-error state with the server message instead of the empty state", async () => {
+      failSearch();
+      wrapper = mountServicesCatalog();
+      await flushPromises();
+
+      expect(wrapper.find('[data-test="services-catalog-empty"]').exists()).toBe(false);
+      expect(errorState().find('[data-test="o2-empty-state"]').exists()).toBe(true);
+      expect(errorState().text()).toContain("Search field not found: infer_service_system");
+      expect(retry().text()).toContain("Retry");
+    });
+
+    it("retry runs the search again and clears the error once it succeeds", async () => {
+      failSearch();
+      wrapper = mountServicesCatalog();
+      await flushPromises();
+      const calls = mockFetchQueryDataWithHttpStream.mock.calls.length;
+
+      mockFetchQueryDataWithHttpStream.mockImplementation((_req: any, callbacks: any) => {
+        callbacks.complete(null, {});
+      });
+      await retry().trigger("click");
+      await flushPromises();
+
+      expect(mockFetchQueryDataWithHttpStream.mock.calls.length).toBe(calls + 1);
+      expect(errorState().exists()).toBe(false);
+      expect(wrapper.find('[data-test="services-catalog-empty"]').exists()).toBe(true);
+    });
+
+    it("falls back to a generic message when the error has none", async () => {
+      mockFetchQueryDataWithHttpStream.mockImplementation((_req: any, callbacks: any) => {
+        callbacks.error(null, { type: "error", content: {} });
+      });
+      wrapper = mountServicesCatalog();
+      await flushPromises();
+
+      expect(errorState().text()).toContain("Unknown error");
+    });
+
+    it("drops the previous rows and shows the error when a later search fails", async () => {
+      mockFetchQueryDataWithHttpStream.mockImplementation((_req: any, callbacks: any) => {
+        callbacks.data(null, {
+          type: "search_response_hits",
+          content: { results: { hits: [{ service_name: "frontend", total_requests: 3 }] } },
+        });
+        callbacks.complete(null, {});
+      });
+      wrapper = mountServicesCatalog();
+      await flushPromises();
+      expect(wrapper.find('[data-test="services-catalog-row-name-frontend"]').exists()).toBe(true);
+
+      failSearch();
+      await wrapper.vm.loadServicesCatalog();
+      await flushPromises();
+
+      expect(wrapper.find('[data-test="services-catalog-row-name-frontend"]').exists()).toBe(false);
+      expect(errorState().text()).toContain("Search field not found: infer_service_system");
+    });
+  });
+
   describe("side panel time range", () => {
     afterEach(() => {
       vi.useRealTimers();
diff --git a/web/src/plugins/traces/ServicesCatalog.vue b/web/src/plugins/traces/ServicesCatalog.vue
index 5d1de4e9bc..0ace8e7d92 100644
--- a/web/src/plugins/traces/ServicesCatalog.vue
+++ b/web/src/plugins/traces/ServicesCatalog.vue
@@ -318,9 +318,22 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </div>
       </div>
 
+      <div
+        v-if="!isLoading && loadError !== null"
+        class="flex flex-1 items-center justify-center"
+        data-test="services-catalog-error"
+      >
+        <OEmptyState
+          size="hero"
+          preset="load-error"
+          :description="loadError"
+          @action="loadServicesCatalog"
+        />
+      </div>
+
       <!-- Empty state (shown when not loading and no data) -->
       <div
-        v-if="!isLoading && services.length === 0"
+        v-else-if="!isLoading && services.length === 0"
         class="flex flex-1 flex-col items-center justify-center"
         data-test="services-catalog-empty"
       >
@@ -500,7 +513,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 <script setup lang="ts">
 import { ref, computed, watch, onMounted, onUnmounted } from "vue";
-import { raw, useI18nTyped } from "@/types/i18n";
+import { raw, useI18nTyped, type I18nText } from "@/types/i18n";
 import OTable from "@/lib/core/Table/OTable.vue";
 import type { OTableColumnDef } from "@/lib/core/Table/OTable.types";
 import OTableColumnToggle from "@/lib/core/Table/sub-components/OTableColumnToggle.vue";
@@ -528,6 +541,7 @@ import OSelect from "@/lib/forms/Select/OSelect.vue";
 import type { SelectModelValue } from "@/lib/forms/Select/OSelect.types";
 import OSearchInput from "@/lib/forms/SearchInput/OSearchInput.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
+import OEmptyState from "@/lib/core/EmptyState/OEmptyState.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OTabs from "@/lib/navigation/Tabs/OTabs.vue";
 import OTab from "@/lib/navigation/Tabs/OTab.vue";
@@ -640,6 +654,8 @@ const isSearching = ref(false);
 // Epoch-ms of the last completed load, shown on the page header's refresh control.
 const lastRunAt = ref<number | null>(null);
 const services = ref<ServiceRow[]>([]);
+// The failed search's server message; shown instead of the empty state so a broken query never reads as "no services".
+const loadError = ref<I18nText | null>(null);
 const viewState = useListViewState("servicesCatalog", {
   filterText: "",
   typeFilter: "service" as TypeFilter,
@@ -678,6 +694,8 @@ interface StreamSchemaFlags {
   org: string;
   stream: string;
   hasInferColumns: boolean;
+  hasInferSystemColumn: boolean;
+  hasInferTypeColumn: boolean;
   hasParentColumn: boolean;
 }
 const schemaFlags = ref<StreamSchemaFlags | null>(null);
@@ -1108,10 +1126,19 @@ async function fetchSchemaFlags(org: string, stream: string): Promise<StreamSche
       org,
       stream,
       hasInferColumns: has("infer_service_name"),
+      hasInferSystemColumn: has("infer_service_system"),
+      hasInferTypeColumn: has("infer_service_type"),
       hasParentColumn: has("reference_parent_span_id"),
     };
   } catch {
-    return { org, stream, hasInferColumns: false, hasParentColumn: false };
+    return {
+      org,
+      stream,
+      hasInferColumns: false,
+      hasInferSystemColumn: false,
+      hasInferTypeColumn: false,
+      hasParentColumn: false,
+    };
   }
 }
 
@@ -1153,19 +1180,27 @@ ORDER BY total_requests DESC`;
   }
   // infer_service_name is only set on CLIENT and PRODUCER spans (traces/inferred.rs).
   const inferPred = `((NULLIF(infer_service_name, '') IS NOT NULL AND CAST(span_kind AS VARCHAR) IN ('3','4')) OR ${requestPred})`;
+  const inferredColumn = (column: string) =>
+    `CASE WHEN NULLIF(infer_service_name, '') IS NULL THEN NULL ELSE NULLIF(${column}, '') END`;
+  // A column the stream has never seen makes the whole query fail, so absent ones select NULL and stay out of GROUP BY.
+  const systemExpr = flags.hasInferSystemColumn ? inferredColumn("infer_service_system") : null;
+  const typeExpr = flags.hasInferTypeColumn ? inferredColumn("infer_service_type") : null;
+  const groupBy = [
+    "COALESCE(NULLIF(infer_service_name, ''), service_name)",
+    "NULLIF(infer_service_name, '')",
+    systemExpr,
+    typeExpr,
+  ].filter((expr): expr is string => expr !== null);
   return `SELECT
   COALESCE(NULLIF(infer_service_name, ''), service_name) AS service_name,
   NULLIF(infer_service_name, '') AS _infer_service_name,
-  CASE WHEN NULLIF(infer_service_name, '') IS NULL THEN NULL ELSE NULLIF(infer_service_system, '') END AS _infer_service_system,
-  CASE WHEN NULLIF(infer_service_name, '') IS NULL THEN NULL ELSE NULLIF(infer_service_type, '') END AS _infer_service_type,
+  ${systemExpr ?? "NULL"} AS _infer_service_system,
+  ${typeExpr ?? "NULL"} AS _infer_service_type,
   MAX(CASE WHEN service_name IS NOT NULL AND (infer_service_name IS NULL OR infer_service_name = '') THEN 1 ELSE 0 END) AS _is_real_service,
 ${redAggregates(inferPred)}
 FROM "${streamName}"
 GROUP BY
-  COALESCE(NULLIF(infer_service_name, ''), service_name),
-  NULLIF(infer_service_name, ''),
-  CASE WHEN NULLIF(infer_service_name, '') IS NULL THEN NULL ELSE NULLIF(infer_service_system, '') END,
-  CASE WHEN NULLIF(infer_service_name, '') IS NULL THEN NULL ELSE NULLIF(infer_service_type, '') END
+${groupBy.map((expr) => `  ${expr}`).join(",\n")}
 ORDER BY total_requests DESC`;
 }
 
@@ -1315,6 +1350,7 @@ async function loadServicesCatalog() {
   // stay on screen while the next search runs rather than the panel emptying.
   isLoading.value = services.value.length === 0;
   isSearching.value = true;
+  loadError.value = null;
   const load = ++catalogLoad;
 
   const { start_time, end_time } = getTimeRange();
@@ -1423,8 +1459,14 @@ async function loadServicesCatalog() {
           if (hits.length > 0) publish();
         }
       },
-      error: () => {
+      error: (_payload: any, err: any) => {
         if (load !== catalogLoad) return;
+        const errData = err?.content ?? err;
+        loadError.value = raw(
+          errData?.message || errData?.error_detail || t("common.unknownError"),
+        );
+        // Rows from an earlier search (possibly another stream) would otherwise sit beside the error.
+        services.value = [];
         closePanelIfRowGone();
         isLoading.value = false;
         isSearching.value = false;
diff --git a/web/src/plugins/traces/SessionDetails.spec.ts b/web/src/plugins/traces/SessionDetails.spec.ts
index ba1e5e0fa3..445293f19e 100644
--- a/web/src/plugins/traces/SessionDetails.spec.ts
+++ b/web/src/plugins/traces/SessionDetails.spec.ts
@@ -115,7 +115,7 @@ vi.mock("./llmInsightsDashboard.utils", () => ({
 // ---------------------------------------------------------------------------
 
 import { describe, it, expect, vi, beforeEach } from "vitest";
-import { mount, flushPromises } from "@vue/test-utils";
+import { mount, flushPromises, type VueWrapper } from "@vue/test-utils";
 import SessionDetails from "./SessionDetails.vue";
 
 // ---------------------------------------------------------------------------
@@ -387,6 +387,22 @@ describe("SessionDetails — KPI strip", () => {
     expect(latencyKpi.text()).toContain("traces.sessionDetail.kpi.duration");
   });
 
+  it("shows the session's duration in the Duration tile, not the average turn", async () => {
+    mockFetchSession.mockResolvedValue({
+      detail: makeDetail({ durationNanos: 90_000_000_000 }),
+      traces: [
+        makeTrace({ traceId: "t1", durationNanos: 400_000_000 }),
+        makeTrace({ traceId: "t2", durationNanos: 600_000_000 }),
+      ],
+    });
+    const wrapper = await mountComponent();
+    const latencyKpi = wrapper.find("[data-test='session-detail-kpi-latency']");
+    // splitDuration is mocked to echo its µs input: the tile value is the
+    // session's 90 s; the 500 ms average turn moves to the sub-line.
+    expect(latencyKpi.text()).toContain("traces.sessionDetail.kpi.duration90000000ns");
+    expect(latencyKpi.text()).toContain('"avg":"500000ns"');
+  });
+
   it("renders KPI strip with Tokens label", async () => {
     const wrapper = await mountComponent();
     const tokensKpi = wrapper.find("[data-test='session-detail-kpi-tokens']");
@@ -412,6 +428,64 @@ describe("SessionDetails — KPI strip", () => {
     expect(costKpi.text()).not.toContain("$0.01");
   });
 
+  describe("peak-turn chip on the Cost tile", () => {
+    const peakChips = (wrapper: VueWrapper) =>
+      wrapper
+        .find("[data-test='session-detail-kpi-cost']")
+        .findAll("[data-test='turn-preview-stub']");
+
+    it("is shown for an exact cost", async () => {
+      const wrapper = await mountComponent();
+      expect(peakChips(wrapper)).toHaveLength(1);
+    });
+
+    it("is hidden when the cost is unknown (every token unpriced)", async () => {
+      mockFetchSession.mockResolvedValue({
+        detail: makeDetail({ cost: 0, tokens: 300, unpricedTokens: 300, unpricedModels: ["m"] }),
+        traces: [
+          makeTrace({ traceId: "t1", cost: 0, tokens: 150, unpricedTokens: 150 }),
+          makeTrace({ traceId: "t2", cost: 0, tokens: 150, unpricedTokens: 150 }),
+        ],
+      });
+      const wrapper = await mountComponent();
+      expect(peakChips(wrapper)).toHaveLength(0);
+    });
+
+    it("for a partial cost, names the peak turn only when it carries a priced cost", async () => {
+      mockFetchSession.mockResolvedValue({
+        detail: makeDetail({
+          cost: 0.004,
+          tokens: 300,
+          unpricedTokens: 150,
+          unpricedModels: ["m"],
+        }),
+        traces: [
+          makeTrace({ traceId: "t1", cost: 0.004, tokens: 150, unpricedTokens: 0 }),
+          makeTrace({ traceId: "t2", cost: 0, tokens: 150, unpricedTokens: 150 }),
+        ],
+      });
+      let wrapper = await mountComponent();
+      expect(peakChips(wrapper)).toHaveLength(1);
+
+      // Rounding left every turn at $0: the peak is turn 1 by default, whose
+      // tokens are all unpriced, so there is no priced peak to name.
+      mockFetchSession.mockResolvedValue({
+        detail: makeDetail({
+          cost: 0.004,
+          tokens: 300,
+          unpricedTokens: 150,
+          unpricedModels: ["m"],
+        }),
+        traces: [
+          makeTrace({ traceId: "t1", cost: 0, tokens: 150, unpricedTokens: 150 }),
+          makeTrace({ traceId: "t2", cost: 0, tokens: 150, unpricedTokens: 0 }),
+        ],
+      });
+      wrapper = await mountComponent();
+      expect(peakChips(wrapper)).toHaveLength(0);
+    });
+  });
+
   it("renders net cache impact with cost breakdown from session cache fields", async () => {
     mockFetchSession.mockResolvedValue({
       detail: makeDetail({
diff --git a/web/src/plugins/traces/SessionDetails.vue b/web/src/plugins/traces/SessionDetails.vue
index 99c5210cce..05171235c2 100644
--- a/web/src/plugins/traces/SessionDetails.vue
+++ b/web/src/plugins/traces/SessionDetails.vue
@@ -102,8 +102,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           data-test="session-detail-skeleton"
         >
           <!-- Shape row: KPI tiles + ribbon -->
-          <div class="mb-2.5 grid flex-shrink-0 grid-cols-2 gap-2.5">
-            <div class="grid grid-cols-3 gap-2.5">
+          <div class="mb-2.5 grid flex-shrink-0 grid-cols-1 gap-2.5 lg:grid-cols-2">
+            <div class="grid grid-cols-2 gap-2.5 sm:grid-cols-3">
               <div v-for="n in 6" :key="n" :class="kpiCardClass()">
                 <OSkeleton type="rect" animation="wave" class="rounded-default h-[0.7rem] w-12" />
                 <OSkeleton
@@ -224,14 +224,15 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
         <!-- Content -->
         <template v-else>
-          <!-- Shape row: KPI tiles (left) + session ribbon (right), always two
-           equal columns side by side (matches the mockup's 1fr 1fr). -->
-          <div class="mb-2.5 grid flex-shrink-0 grid-cols-2 gap-2.5">
+          <!-- Shape row: KPI tiles (left) + session ribbon (right) as two equal
+           columns (the mockup's 1fr 1fr); below lg they stack so each KPI tile
+           keeps room for its label. -->
+          <div class="mb-2.5 grid flex-shrink-0 grid-cols-1 gap-2.5 lg:grid-cols-2">
             <!-- KPI strip — six session-level metric tiles. Card chrome + danger
            variant are Tailwind utilities (see kpiCardClass / kpiAccentClass),
            matching the LLM Insights dashboard so the AI module stays consistent. -->
             <div
-              class="grid h-full grid-cols-3 grid-rows-2 gap-2.5"
+              class="grid h-full grid-cols-2 gap-2.5 sm:grid-cols-3 sm:grid-rows-2"
               data-test="session-detail-kpis"
             >
               <div
@@ -346,22 +347,23 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             <SessionRibbon :traces="traces" :cache-pct="cacheRatio" @jump="jumpToTurn" />
           </div>
 
-          <!-- Lower area: conversation column (left) + hotspot rail (right). Full-page
-           scroll — the column grows with content; the rail sticks (items-start so
-           it doesn't stretch to the tall conversation's height). -->
-          <div class="grid grid-cols-[minmax(0,1fr)_21.25rem] items-start gap-2.5">
+          <!-- Lower area: conversation column (left) + hotspot rail (right; below the
+           conversation under the lg breakpoint). Full-page scroll — the column grows with
+           content; the rail sticks (items-start so it doesn't stretch to the tall
+           conversation's height). -->
+          <div class="grid grid-cols-1 items-start gap-2.5 lg:grid-cols-[minmax(0,1fr)_21.25rem]">
             <!-- Conversation column: toolbar + panel -->
             <div class="flex min-h-0 min-w-0 flex-col">
               <!-- Conversation toolbar: search (fills width) + status + model filters.
            Sorting lives on the Collapsed view's metric column headers. -->
-              <div class="mb-2.5 flex flex-shrink-0 items-center gap-2">
+              <div class="mb-2.5 flex flex-shrink-0 flex-wrap items-center gap-2">
                 <OSearchInput
                   v-model="searchText"
                   :placeholder="t('traces.sessionDetail.searchPlaceholder')"
                   clearable
                   :debounce="200"
                   size="xs"
-                  class="no-border h-9 flex-1!"
+                  class="no-border h-9 min-w-48 flex-1!"
                 />
                 <div class="w-36 flex-shrink-0">
                   <OSelect
@@ -512,8 +514,22 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                           <span
                             class="text-text-secondary text-right text-xs font-semibold tabular-nums"
                           >
-                            {{ t("traces.sessionDetail.currencySymbol")
-                            }}{{ trace.cost.toFixed(4) }}
+                            <LLMCostCell
+                              scope="trace"
+                              :cost="trace.cost"
+                              :tokens="trace.tokens"
+                              :unpriced-tokens="trace.unpricedTokens"
+                              :unpriced-models="trace.unpricedModels"
+                              :stream="streamName"
+                              :time-window="{
+                                start: sessionEvaluationRange.startTime,
+                                end: sessionEvaluationRange.endTime,
+                              }"
+                              :format="
+                                (c: number) =>
+                                  `${t('traces.sessionDetail.currencySymbol')}${c.toFixed(4)}`
+                              "
+                            />
                           </span>
                           <OProgressBar :value="ratio(trace.cost, maxTurnCost)" size="xs" />
                         </div>
@@ -765,7 +781,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                         class="text-2xs flex flex-shrink-0 items-center gap-[0.3rem] tabular-nums"
                       >
                         <span class="text-text-secondary font-semibold">
-                          {{ formatDuration(row.duration) }}
+                          {{ formatDuration(row.durationNanos) }}
                         </span>
                         <span class="text-text-muted">
                           ·
@@ -964,6 +980,8 @@ import { useEnterpriseUpgradeDialog } from "@/composables/useEnterpriseUpgradeDi
 import { useLockedAffordance } from "@/composables/useLockedAffordance";
 
 import { splitNumberWithUnit, splitDuration } from "./llmInsightsDashboard.utils";
+import LLMCostCell from "./LLMCostCell.vue";
+import { costKind } from "./llmDataTrust.utils";
 import { renderMarkdown } from "./markdown";
 
 const ManualEvaluationDialog = defineAsyncComponent(
@@ -1084,6 +1102,11 @@ const sessionStats = computed(() => {
   const costs = rows.map((tr) => tr.cost);
   const maxCost = costs.length ? Math.max(...costs) : 0;
   const peakTurn = (costs.indexOf(maxCost) >= 0 ? costs.indexOf(maxCost) : 0) + 1;
+  // Whether the peak turn's cost is a price at all: a turn whose tokens are all
+  // unpriced has $0 recorded, which is not "the turn that cost the most".
+  const peakRow = rows[peakTurn - 1];
+  const peakTurnPriced =
+    !!peakRow && costKind(peakRow.cost, peakRow.tokens, peakRow.unpricedTokens ?? 0) !== "unknown";
 
   const cachedTokens = d.cacheReadInputTokens;
   const cacheDenominator = cacheInputDenominator(d);
@@ -1100,6 +1123,7 @@ const sessionStats = computed(() => {
     slowestTurn,
     maxCost,
     peakTurn,
+    peakTurnPriced,
     cachedTokens,
     cacheRatio,
     cacheImpact,
@@ -1173,8 +1197,23 @@ const kpiCards = computed<
   if (!d || !s) return [];
 
   const dur = splitDuration(d.durationNanos / 1000);
-  const lat = splitDuration(s.avgLat / 1000);
-  const cost = { value: usd4(d.cost), unit: "" };
+  // Unpriced tokens make the cost a lower bound ("≥ $X") or unknown, never a silent $0.
+  const unpricedTokens = d.unpricedTokens ?? 0;
+  const kind = costKind(d.cost, d.tokens, unpricedTokens);
+  const unpricedParams = {
+    models: (d.unpricedModels ?? []).join(", ") || t("llmDataTrust.cost.unknownModel"),
+    tokens: unpricedTokens.toLocaleString(),
+    scope: t("llmDataTrust.cost.scopeSession"),
+  };
+  const cost = {
+    value:
+      kind === "partial"
+        ? t("llmDataTrust.cost.atLeast", { cost: usd4(d.cost) })
+        : kind === "unknown"
+          ? t("llmDataTrust.cost.unknown")
+          : usd4(d.cost),
+    unit: "",
+  };
   const tokens = splitNumberWithUnit(d.tokens);
   const turnWord = t("traces.sessionDetail.turnLabel");
 
@@ -1221,11 +1260,13 @@ const kpiCards = computed<
       key: "latency",
       icon: "schedule",
       label: t("traces.sessionDetail.kpi.duration"),
-      value: lat.value,
-      unit: lat.unit,
+      // The session's own wall-clock span; per-turn latency goes in the sub-line.
+      value: dur.value,
+      unit: dur.unit,
       // Latency is never colour-flagged — "good" latency is too workload-
       // specific to threshold reliably, so the tile stays neutral.
       subLead: t("traces.sessionDetail.kpiSub.latencyLead", {
+        avg: formatDuration(s.avgLat),
         slowest: formatDuration(s.slowestLat),
       }),
       subTurns: [{ n: s.slowestTurn, label: raw(`${turnWord} ${s.slowestTurn}`) }],
@@ -1237,10 +1278,18 @@ const kpiCards = computed<
       label: t("traces.sessionDetail.kpi.cost"),
       value: cost.value,
       unit: cost.unit,
-      subLead: t("traces.sessionDetail.kpiSub.costLead", {
-        peak: usd4(s.maxCost),
-      }),
-      subTurns: [{ n: s.peakTurn, label: raw(`${turnWord} ${s.peakTurn}`) }],
+      subLead:
+        kind === "exact"
+          ? t("traces.sessionDetail.kpiSub.costLead", { peak: usd4(s.maxCost) })
+          : kind === "partial"
+            ? t("llmDataTrust.cost.partialTooltip", unpricedParams)
+            : t("llmDataTrust.cost.unknownTooltip", unpricedParams),
+      // An unknown cost has no peak turn; a partial one names it only when that
+      // turn carries a priced cost.
+      subTurns:
+        kind === "unknown" || (kind === "partial" && !s.peakTurnPriced)
+          ? []
+          : [{ n: s.peakTurn, label: raw(`${turnWord} ${s.peakTurn}`) }],
       subTail: "",
     },
     {
@@ -1485,7 +1534,8 @@ const costHotspots = computed(() =>
 );
 interface ToolHotspot {
   name: string;
-  duration: number;
+  /** Summed span duration in nanoseconds, the unit `formatDuration` takes. */
+  durationNanos: number;
   calls: number;
   tokens: number;
   topTraceId: string;
@@ -1498,20 +1548,21 @@ const toolHotspots = computed<ToolHotspot[]>(() => {
   for (const s of sessionSpans.value) {
     if (String(s.gen_ai_operation_name || "").toLowerCase() !== "execute_tool") continue;
     const name = String(s.tool_name || s.gen_ai_tool_name || s.operation_name || "tool");
-    const dur = Number(s.duration) || 0;
+    // Span `duration` is in microseconds; the rail formats nanoseconds.
+    const dur = (Number(s.duration) || 0) * 1000;
     const tokens = Number(s.gen_ai_usage_total_tokens) || 0;
     const a =
       agg[name] ||
       (agg[name] = {
         name,
-        duration: 0,
+        durationNanos: 0,
         calls: 0,
         tokens: 0,
         topTraceId: s.trace_id,
         topDur: -1,
         turnsSet: new Set<number>(),
       });
-    a.duration += dur;
+    a.durationNanos += dur;
     a.calls += 1;
     a.tokens += tokens;
     const turnNum = originalTurnIndex(String(s.trace_id)) + 1;
@@ -1529,7 +1580,7 @@ const toolHotspots = computed<ToolHotspot[]>(() => {
       ...rest,
       turns: [...turnsSet].sort((p, q) => p - q),
     }))
-    .sort((x, y) => y.calls - x.calls || y.duration - x.duration);
+    .sort((x, y) => y.calls - x.calls || y.durationNanos - x.durationNanos);
 });
 
 // Jump to a turn (1-based): clear filters so it's visible, expand it, then
diff --git a/web/src/plugins/traces/SessionsList.spec.ts b/web/src/plugins/traces/SessionsList.spec.ts
index f415f815cb..105d3daf61 100644
--- a/web/src/plugins/traces/SessionsList.spec.ts
+++ b/web/src/plugins/traces/SessionsList.spec.ts
@@ -27,6 +27,8 @@ const mockSortOrder = ref<"asc" | "desc">("desc");
 const mockSearchKeyword = ref("");
 const mockAgents = ref<any[]>([]);
 const mockAgentsLoaded = ref(false);
+const mockAgentsError = ref<"forbidden" | "failed" | null>(null);
+const mockAgentsOrg = ref<string | null>(null);
 const mockFetchPage = vi.fn();
 const mockCancelAll = vi.fn();
 const mockListAgents = vi.fn();
@@ -59,6 +61,8 @@ vi.mock("./composables/useSessions", () => ({
     sortOrder: mockSortOrder,
     agents: mockAgents,
     agentsLoaded: mockAgentsLoaded,
+    agentsError: mockAgentsError,
+    agentsOrg: mockAgentsOrg,
     fetchPage: mockFetchPage,
     cancelAll: mockCancelAll,
   })),
@@ -220,6 +224,9 @@ import { mount, flushPromises } from "@vue/test-utils";
 import SessionsList from "./SessionsList.vue";
 import AgentScopeCascade from "@/enterprise/components/AIObservability/AgentScopeCascade.vue";
 import config from "@/aws-exports";
+import { queryClient } from "@/composables/query/queryClient";
+import { SCOPE_MODE_CHOICE_LS_KEY } from "@/enterprise/composables/useAgentScope";
+import type { GenAiAgentListItem } from "@/services/gen-ai-agent-mapping.service";
 
 const defaultProps = {
   streamName: "test-stream",
@@ -269,7 +276,11 @@ beforeEach(() => {
   mockSortOrder.value = "desc";
   mockAgents.value = [];
   mockAgentsLoaded.value = false;
+  mockAgentsError.value = null;
+  mockAgentsOrg.value = null;
   mockRouteQuery = {};
+  // The agents query is cached per window bucket; each test brings its own list.
+  queryClient.clear();
 
   // Default: streams load fine
   mockGetStreams.mockResolvedValue({
@@ -445,12 +456,53 @@ describe("SessionsList — sessions table", () => {
     expect(mockFetchPage).toHaveBeenCalledWith("test-stream", 1000, 2000, 0, 20, "", undefined);
   });
 
-  it("should not load agents while refreshing when in stream mode", async () => {
+  it("loads the agents once per view in stream mode too (agent counts, no-identity banner)", async () => {
     mockRouteQuery = { type: "stream" };
     const wrapper = await mountComponent();
+    // The parent's mount-time window replay (no force), possibly twice.
+    await (wrapper.vm as any).refresh(undefined, undefined, false);
+    await flushPromises();
+    await (wrapper.vm as any).refresh(undefined, undefined, false);
+    await flushPromises();
+
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+    expect(mockListAgents).toHaveBeenCalledTimes(1);
+  });
+
+  it("fetches explicit Stream sessions while the agents request is still pending", async () => {
+    mockRouteQuery = { type: "stream" };
+    const agentsResult = Promise.withResolvers<{ agents: GenAiAgentListItem[] }>();
+    mockListAgents.mockReturnValue(agentsResult.promise);
+    const wrapper = await mountComponent();
+    // Vue Test Utils omits the script-setup method from its public-instance type.
+    const vm = wrapper.vm as unknown as {
+      refresh: (start?: number, end?: number, force?: boolean) => Promise<void>;
+    };
+    const pending = vm.refresh(undefined, undefined, false);
+    await flushPromises();
+    expect(mockFetchPage).toHaveBeenCalledWith("test-stream", 1000, 2000, 0, 20, "", undefined);
+    agentsResult.resolve({ agents: [] });
+    await pending;
+  });
+
+  it("opens in Stream mode with the no-agent-identity banner when the window has no agents", async () => {
+    mockListAgents.mockResolvedValue({ agents: [] });
+    const wrapper = await mountComponent();
     await refreshComponent(wrapper);
 
-    expect(mockListAgents).not.toHaveBeenCalled();
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+    expect(mockFetchPage.mock.calls.at(-1)?.[0]).toBe("test-stream");
+    expect(wrapper.find("[data-test='sessions-list-no-agent-identity']").exists()).toBe(true);
+  });
+
+  it("keeps a remembered explicit Agent choice when the window has no agents", async () => {
+    localStorage.setItem(SCOPE_MODE_CHOICE_LS_KEY, "agent");
+    mockListAgents.mockResolvedValue({ agents: [] });
+    const wrapper = await mountComponent();
+    await refreshComponent(wrapper);
+
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+    expect(wrapper.find("[data-test='sessions-list-no-agent-identity']").exists()).toBe(false);
   });
 
   it("renders session rows when sessions data is present", async () => {
@@ -562,6 +614,40 @@ describe("SessionsList — agent filter", () => {
     );
   });
 
+  it("opens on the agent, env and version in the URL (no type), not the first agent", async () => {
+    mockRouteQuery = { agent: "omp", env: "production", version: "2" };
+    mockGetStreams.mockResolvedValue({
+      list: [{ name: "s_prod", settings: { is_llm_stream: true } }],
+    });
+    const at = (name: string, id: string, stream: string, env: string, version: string) => ({
+      name,
+      id,
+      source_stream: stream,
+      source_stream_type: "traces",
+      env,
+      version,
+    });
+    mockListAgents.mockResolvedValue({
+      agents: [
+        at("a23ca1dd38a1ff350", "a23", "s_hash", "staging", "1"),
+        at("omp", "omp-staging", "s_staging", "staging", "2"),
+        at("omp", "omp-prod", "s_prod", "production", "2"),
+      ],
+    });
+
+    const wrapper = await mountComponent({ streamName: "", startTime: 1000, endTime: 2000 });
+    await refreshComponent(wrapper);
+
+    const vm = wrapper.vm as any;
+    expect([vm.filterMode, vm.selectedEnv, vm.selectedAgentName, vm.selectedVersion]).toEqual([
+      "agent",
+      "production",
+      "omp",
+      "2",
+    ]);
+    expect(mockFetchPage.mock.calls.at(-1)?.[0]).toBe("s_prod");
+  });
+
   it("shows the no-agents state and skips session fetch when Agent mode has no agents", async () => {
     mockRouteQuery = { type: "agent" };
     mockGetStreams.mockResolvedValue({
@@ -642,6 +728,7 @@ describe("SessionsList — agent selection survives a back-navigation remount",
     localStorage.setItem("sessionsList_versionFilter", "v1");
     mockAgents.value = [agentA, agentB];
     mockAgentsLoaded.value = true;
+    mockAgentsOrg.value = "test-org";
     mockHasLoadedOnce.value = true;
     mockLoadedOrg.value = "test-org";
     mockError.value = null;
@@ -666,6 +753,7 @@ describe("SessionsList — agent selection survives a back-navigation remount",
     // first in the list, so a name-only restore would wrongly land on it.
     mockAgents.value = [agentA, agentB, agentBStaging];
     mockAgentsLoaded.value = true;
+    mockAgentsOrg.value = "test-org";
     mockHasLoadedOnce.value = true;
     mockLoadedOrg.value = "test-org";
     mockError.value = null;
@@ -680,6 +768,113 @@ describe("SessionsList — agent selection survives a back-navigation remount",
   });
 });
 
+describe("SessionsList — auto mode is decided per org", () => {
+  const agentA = {
+    name: "agent-a",
+    id: "agent-a-id",
+    source_stream: "test-stream",
+    source_stream_type: "traces",
+  };
+
+  it("opens in Stream mode on an org without agents after one with agents", async () => {
+    // The module-scoped list still holds the previous org's agents (it decided
+    // Agent mode there); this org has none and the user never chose a mode.
+    mockAgents.value = [agentA];
+    mockAgentsLoaded.value = true;
+    mockAgentsOrg.value = "org-with-agents";
+    mockListAgents.mockResolvedValue({ agents: [] });
+
+    const wrapper = await mountComponent();
+    await refreshComponent(wrapper);
+
+    expect(mockListAgents).toHaveBeenCalledWith("test-org", 1000, 2000);
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+    expect(wrapper.find("[data-test='sessions-empty-no-agents']").exists()).toBe(false);
+    expect(mockFetchPage.mock.calls.at(-1)?.[0]).toBe("test-stream");
+  });
+
+  it("decides an auto mode again only when the user picks a window", async () => {
+    mockListAgents.mockResolvedValue({ agents: [agentA] });
+    const wrapper = await mountComponent();
+    await refreshComponent(wrapper);
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+
+    // A forced reload that is not a window pick keeps the decided mode.
+    mockListAgents.mockResolvedValue({ agents: [] });
+    await (wrapper.vm as any).refresh(3000, 4000, true);
+    await flushPromises();
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+
+    await (wrapper.vm as any).refresh(5000, 6000, true, true);
+    await flushPromises();
+    expect(mockListAgents).toHaveBeenLastCalledWith("test-org", 5000, 6000);
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+  });
+
+  it("keeps an explicit Agent choice when the user picks a window with no agents", async () => {
+    mockRouteQuery = { type: "agent" };
+    mockListAgents.mockResolvedValue({ agents: [agentA] });
+    const wrapper = await mountComponent();
+    await refreshComponent(wrapper);
+
+    mockListAgents.mockResolvedValue({ agents: [] });
+    await (wrapper.vm as any).refresh(5000, 6000, true, true);
+    await flushPromises();
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+  });
+
+  it("does not let a module-scoped list from another window settle the mode", async () => {
+    // A back-navigation remount: the module-scoped list (from an earlier window)
+    // holds agents and shows Agent mode, but the next load that runs decides
+    // from its own window's list.
+    mockAgents.value = [agentA];
+    mockAgentsLoaded.value = true;
+    mockAgentsOrg.value = "test-org";
+    mockListAgents.mockResolvedValue({ agents: [] });
+
+    const wrapper = await mountComponent();
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+    await refreshComponent(wrapper);
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+  });
+});
+
+describe("SessionsList — agents list fails to load", () => {
+  it("shows the load error with a retry, not Stream mode or the no-identity banner", async () => {
+    mockListAgents.mockRejectedValue(
+      Object.assign(new Error("boom"), { isAxiosError: true, response: { status: 500 } }),
+    );
+
+    const wrapper = await mountComponent();
+    await refreshComponent(wrapper);
+
+    expect((wrapper.vm as any).filterMode).toBe("agent");
+    expect(wrapper.find("[data-test='sessions-list-no-agent-identity']").exists()).toBe(false);
+    expect(wrapper.find("[data-test='sessions-empty-no-agents']").exists()).toBe(false);
+    expect(wrapper.find("[data-test='sessions-empty-agents-error']").exists()).toBe(true);
+
+    // Retry: the list loads (empty), so the mode is decided now — Stream.
+    mockListAgents.mockResolvedValue({ agents: [] });
+    await wrapper.find("[data-test='o2-empty-state-action-retry']").trigger("click");
+    await flushPromises();
+
+    expect((wrapper.vm as any).filterMode).toBe("stream");
+    expect(wrapper.find("[data-test='sessions-empty-agents-error']").exists()).toBe(false);
+  });
+
+  it("shows the no-access state for a 403", async () => {
+    mockListAgents.mockRejectedValue(
+      Object.assign(new Error("Forbidden"), { isAxiosError: true, response: { status: 403 } }),
+    );
+
+    const wrapper = await mountComponent();
+    await refreshComponent(wrapper);
+
+    expect(wrapper.find("[data-test='sessions-empty-agents-forbidden']").exists()).toBe(true);
+    expect(wrapper.find("[data-test='sessions-list-no-agent-identity']").exists()).toBe(false);
+  });
+});
+
 describe("SessionsList — row click", () => {
   it("emits sessionSelected with the row data when a row is clicked", async () => {
     const session = makeSession({ sessionId: "sess-click" });
@@ -734,11 +929,14 @@ describe("SessionsList — OSS builds (neither isEnterprise nor isCloud is 'true
     expect(wrapper.find("[data-test='sessions-list-filter-mode']").exists()).toBe(true);
   });
 
-  it("defaults to Agent mode on a cloud build, same as enterprise", async () => {
+  it("opens in Agent mode on a cloud build when the window has agents, same as enterprise", async () => {
     config.isEnterprise = "false";
     config.isCloud = "true";
+    mockListAgents.mockResolvedValue({
+      agents: [{ name: "a", id: "a", source_stream: "test-stream", source_stream_type: "traces" }],
+    });
     const wrapper = await mountComponent();
-    await flushPromises();
+    await refreshComponent(wrapper);
     expect(wrapper.findComponent(AgentScopeCascade).exists()).toBe(true);
   });
 });
diff --git a/web/src/plugins/traces/SessionsList.vue b/web/src/plugins/traces/SessionsList.vue
index 52945f0e9b..6a5f079404 100644
--- a/web/src/plugins/traces/SessionsList.vue
+++ b/web/src/plugins/traces/SessionsList.vue
@@ -65,6 +65,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :streams-loaded="streamsLoaded"
       :agents-loaded="agentsLoaded"
       @filter-mode-change="onFilterModeChange"
+      @agent-pick="modeExplicit = true"
       @stream-change="onStreamChange"
     >
       <!-- List search — one box, matched against the user id OR the
@@ -94,6 +95,9 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       </template>
     </AiScopeBar>
 
+    <!-- Stream mode because these LLM spans carry no agent identity. -->
+    <AiNoAgentIdentityBanner v-if="noAgentIdentity" data-test="sessions-list" class="pb-2" />
+
     <!-- Streams exist: OTable owns the data surface (column chooser, server-side
          pagination footer, column resize, empty/error body). The scope control
          lives in the page-level bar above; the header owns refresh + date.
@@ -142,9 +146,17 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :title="t('traces.sessionsList.failedToLoad')"
           :description="raw(error || '')"
           :action-label="t('traces.sessionsList.retry')"
+          action-id="retry"
           action-icon="refresh"
           @action="loadSessions()"
         />
+        <!-- Agent mode whose agents list failed to load: not "no agents". -->
+        <AiAgentsLoadError
+          v-else-if="agentsLoadFailed"
+          :error="agentsError ?? 'failed'"
+          data-test="sessions-empty"
+          @retry="refresh()"
+        />
         <OEmptyState
           v-else-if="agentEmpty"
           size="hero"
@@ -153,6 +165,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :title="t('traces.sessionsList.noAgentsTitle')"
           :description="t('traces.sessionsList.noAgentsDescription')"
           :action-label="t('traces.sessionsList.viewByStream')"
+          action-id="view-by-stream"
           @action="onFilterModeChange('stream')"
         />
         <!-- A search that matched nothing is NOT a first-run situation — the
@@ -166,6 +179,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :title="t('traces.sessionsList.search.noResultsTitle')"
           :description="t('traces.sessionsList.search.noResultsDescription')"
           :action-label="t('traces.sessionsList.search.clear')"
+          action-id="clear-search"
           @action="clearSearch"
         />
         <div v-else class="flex items-center justify-center py-12" data-test="sessions-empty">
@@ -233,9 +247,17 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
       <!-- Cost -->
       <template #cell-cost="{ row }">
-        <span class="text-xs"
-          >{{ t("traces.sessionDetail.currencySymbol") }}{{ row.cost.toFixed(4) }}</span
-        >
+        <LLMCostCell
+          class="text-xs"
+          scope="session"
+          :cost="row.cost"
+          :tokens="row.tokens"
+          :unpriced-tokens="row.unpricedTokens"
+          :unpriced-models="row.unpricedModels"
+          :stream="effectiveStream"
+          :time-window="{ start: startTime, end: endTime }"
+          :format="(c: number) => `${t('traces.sessionDetail.currencySymbol')}${c.toFixed(4)}`"
+        />
       </template>
 
       <!-- Status (derived from error_count) -->
@@ -261,7 +283,18 @@ import { COL } from "@/lib/core/Table/OTable.types";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import OUserCell from "@/lib/core/Table/cells/OUserCell.vue";
 import { useLlmTraceStreams } from "@/enterprise/composables/useLlmTraceStreams";
-import { useAgentScope } from "@/enterprise/composables/useAgentScope";
+import {
+  useAgentScope,
+  readUrlScope,
+  explicitScopeMode,
+  resolveScopeMode,
+  rememberModeChoice,
+  scopeUrlQuery,
+  agentIdentityKey,
+  type ScopeMode,
+} from "@/enterprise/composables/useAgentScope";
+import AiNoAgentIdentityBanner from "@/enterprise/components/AIObservability/AiNoAgentIdentityBanner.vue";
+import AiAgentsLoadError from "@/enterprise/components/AIObservability/AiAgentsLoadError.vue";
 import {
   useSessions,
   normalizeSearchTerm,
@@ -274,11 +307,10 @@ import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
 import { useShortcuts } from "@/lib/vue-shortcut-manager";
 import { isInputFocused } from "@/utils/keyboardShortcuts";
 import type { AcceptableValue } from "reka-ui";
-import { genAiAgentsQuery } from "@/services/gen-ai-agent-mapping.queries";
-import { queryClient } from "@/composables/query/queryClient";
 import type { SessionSortField, SessionSortOrder } from "@/services/sessions";
 import { buildAgentSessionFilter } from "./llmAgentFilter";
 import { splitNumberWithUnit, splitDuration } from "./llmInsightsDashboard.utils";
+import LLMCostCell from "./LLMCostCell.vue";
 import AiScopeBar from "@/enterprise/components/AIObservability/AiScopeBar.vue";
 import { buildFeatureGateContext, checkFeatureAccess } from "@/utils/enterpriseFeatures";
 
@@ -318,15 +350,13 @@ const {
   sortOrder,
   agents,
   agentsLoaded,
+  agentsError,
+  agentsOrg,
   fetchPage,
   cancelAll,
 } = useSessions();
 
-const urlType = typeof route.query.type === "string" ? route.query.type : "";
-const urlStream = typeof route.query.stream === "string" ? route.query.stream : "";
-const urlAgentName = typeof route.query.agent === "string" ? route.query.agent : "";
-const urlEnv = typeof route.query.env === "string" ? route.query.env : "";
-const urlVersion = typeof route.query.version === "string" ? route.query.version : "";
+const urlScope = readUrlScope(route.query);
 // Search deep-link: `?keyword=<term>`. Read once at setup, like the scope.
 const urlKeyword = normalizeSearchTerm(
   typeof route.query.keyword === "string" ? route.query.keyword : "",
@@ -356,7 +386,7 @@ const activeSearch = computed<SessionSearch | undefined>(() =>
 );
 
 const activeStream = ref<string>(
-  urlStream || localStorage.getItem(STREAM_LS_KEY) || props.streamName || "",
+  urlScope.stream || localStorage.getItem(STREAM_LS_KEY) || props.streamName || "",
 );
 // Trace-stream loading is shared with the other AI pages via
 // useLlmTraceStreams. availableStreams/streamsLoaded/ensureStreamsLoaded are
@@ -365,12 +395,9 @@ const { availableStreams, streamsLoaded, ensureStreamsLoaded } = useLlmTraceStre
   activeStream,
   t,
 );
-const MODE_LS_KEY = "sessionsList_filterMode";
-// Persists the RESOLVED agent NAME/env/version of the cascade selection (was
-// the old single `activeAgent` key). On reload we re-seed the cascade from
-// them (see `pendingAgentName`/`pendingEnv`/`pendingVersion` +
-// `selectAgentByScope`), so the last-picked agent is remembered exactly as
-// before — just via the cascade, not the retired `activeAgent` ref.
+// Persists the RESOLVED agent NAME/env/version of the cascade selection. On
+// reload we re-seed the cascade from them (see `pendingScope` +
+// `selectAgentByScope`), so the last-picked agent is remembered exactly.
 const AGENT_LS_KEY = "sessionsList_agentFilter";
 const ENV_LS_KEY = "sessionsList_envFilter";
 const VERSION_LS_KEY = "sessionsList_versionFilter";
@@ -384,30 +411,51 @@ const genAiAgentMappingAccess = checkFeatureAccess(
   "genAiAgentMapping",
   buildFeatureGateContext(store.state.zoConfig),
 );
-// Default scope is ALWAYS "agent" — every AI page lands on Agent for consistency.
-// Only an explicit `?type=stream` URL param overrides it (a stale saved
-// preference must not silently land on Stream). Agent mode calls the
-// enterprise-only agent-mapping API, so OSS is pinned to Stream regardless of
-// the URL/localStorage — the toggle to reach Agent is locked, not gone, but
-// clicking it is a no-op.
-const filterMode = ref<"stream" | "agent">(
-  !genAiAgentMappingAccess.allowed ? "stream" : urlType === "stream" ? "stream" : "agent",
+// The mode the user asked for (URL `type`/`agent`, else the remembered toggle),
+// or null when the agents list decides: Agent when the window has agents,
+// Stream when it has none (see loadSessions). OSS has no agent-mapping API, so
+// it is pinned to Stream. `agents` / `agentsLoaded` are module-scoped (see
+// useSessions), so a back-navigation remount decides from the list it already
+// has — but only if that list belongs to this org.
+function currentOrg(): string {
+  return store.state.selectedOrganization?.identifier || "default";
+}
+// Drops a module-scoped agents list that belongs to another org: it must not
+// decide this org's mode or fill its picker.
+function claimAgentsForOrg(org: string) {
+  if (agentsOrg.value === org) return;
+  agents.value = [];
+  agentsLoaded.value = false;
+  agentsError.value = null;
+  agentsOrg.value = org;
+}
+claimAgentsForOrg(currentOrg());
+const explicitMode = genAiAgentMappingAccess.allowed ? explicitScopeMode(urlScope) : "stream";
+const agentsDecided = agentsLoaded.value && !agentsError.value;
+const filterMode = ref<ScopeMode>(
+  explicitMode ?? (agentsDecided ? resolveScopeMode(null, agents.value.length) : "stream"),
 );
-// `agents` / `agentsLoaded` are module-scoped (see useSessions) so the agent
-// picker keeps its options — and stays off its skeleton — across a remount.
+const modeExplicit = ref(explicitMode !== null);
+// The org whose agents list decided the mode. A load for another org, after a
+// failed agents load, or for a window the user picked decides again (unless the
+// user chose a mode). The module-scoped list above may belong to another window,
+// so it only seeds the mode a back-navigation's cached rows show; the next load
+// that runs decides from its own window's list.
+let modeSettledOrg: string | null = null;
 // Env/name/version to seed the cascade with once the list is available: the
-// URL deep-link first, else the persisted last selection. Resolved into
-// selectedEnv/AgentName/Version via `selectAgentByScope` (falls back to
-// `selectAgentByName` when the exact env+version no longer exists), then
+// URL deep-link first (any of agent/env/version), else the persisted last
+// selection, never a mix of the two. Resolved via `selectAgentByScope`, then
 // cleared.
-const pendingAgentName = ref<string | null>(
-  filterMode.value === "agent" ? urlAgentName || localStorage.getItem(AGENT_LS_KEY) || null : null,
-);
-const pendingEnv = ref<string | null>(
-  filterMode.value === "agent" ? urlEnv || localStorage.getItem(ENV_LS_KEY) || null : null,
-);
-const pendingVersion = ref<string | null>(
-  filterMode.value === "agent" ? urlVersion || localStorage.getItem(VERSION_LS_KEY) || null : null,
+const pendingScope = ref<{ env: string; name: string; version: string } | null>(
+  urlScope.agent || urlScope.env || urlScope.version
+    ? { env: urlScope.env, name: urlScope.agent, version: urlScope.version }
+    : localStorage.getItem(AGENT_LS_KEY)
+      ? {
+          env: localStorage.getItem(ENV_LS_KEY) || "",
+          name: localStorage.getItem(AGENT_LS_KEY) || "",
+          version: localStorage.getItem(VERSION_LS_KEY) || "",
+        }
+      : null,
 );
 
 // Server-side pagination (1-indexed). OTable owns the footer controls in
@@ -438,6 +486,9 @@ const sessionSortFieldMap: Record<string, SessionSortField> = {
 // filter builder). Injected refs are the SAME instances the page owns, so
 // module scoping is unchanged.
 const {
+  loadAgents,
+  agentsLoadFailed,
+  noAgentIdentity,
   streamSelectOptions,
   selectedStreamCount,
   selectedAgent,
@@ -457,6 +508,7 @@ const {
   activeStream,
   agents,
   agentsLoaded,
+  agentsError,
   availableStreams,
   orgId: () => store.state.selectedOrganization?.identifier,
   getWindow: () => ({ start: props.startTime, end: props.endTime }),
@@ -466,19 +518,13 @@ const {
 });
 
 // Pins the cascade from the carried-over env/name/version (URL deep-link,
-// else the persisted last selection) when a match is possible: the exact
-// triple when both env and version are known, else by name alone. One-shot —
-// clears the pending state whether or not `agents` was ready to resolve it.
+// else the persisted last selection) when a match is possible. One-shot —
+// cleared once `agents` was ready to resolve it.
 function seedPendingCascade() {
-  if (!pendingAgentName.value || agents.value.length === 0) return;
-  if (pendingEnv.value && pendingVersion.value) {
-    selectAgentByScope(pendingEnv.value, pendingAgentName.value, pendingVersion.value);
-  } else {
-    selectAgentByName(pendingAgentName.value);
-  }
-  pendingAgentName.value = null;
-  pendingEnv.value = null;
-  pendingVersion.value = null;
+  if (!pendingScope.value || agents.value.length === 0) return;
+  const { env, name, version } = pendingScope.value;
+  selectAgentByScope(env, name, version);
+  pendingScope.value = null;
 }
 
 // `agents` can already be populated here on a back-navigation remount (it's
@@ -490,6 +536,13 @@ function seedPendingCascade() {
 // `loadAgents()` populates the list for the first time.
 seedPendingCascade();
 
+// Identity of the agent loadSessions last resolved, and whether a loadSessions
+// is between loading the agents and settling the selection. The selected-agent
+// watcher skips both, so the selection loadSessions itself seeds (the cascade's
+// first-agent default, then the URL / remembered agent) is not fetched twice.
+let loadedAgentKey = agentIdentityKey(selectedAgent.value);
+let resolvingScope = 0;
+
 const agentFilterClause = computed(() =>
   buildAgentSessionFilter(effectiveAgent.value, effectiveStream.value),
 );
@@ -576,7 +629,8 @@ const tableColumns = computed(() =>
       id: "cost",
       header: t("traces.sessionsList.columns.cost"),
       accessorKey: "cost",
-      size: 100,
+      // Fits "≥ $0.0000 partial" and "cost unknown" (unpriced tokens, AIO-16).
+      size: 150,
       sortable: true,
       hideable: true,
       meta: { align: "right" },
@@ -634,55 +688,15 @@ function formatTokens(n: number): string {
   return `${t.value}${t.unit}`;
 }
 
-async function loadAgents(startTime?: number, endTime?: number, force = false) {
-  const orgId = store.state.selectedOrganization?.identifier;
-  const start = startTime ?? props.startTime;
-  const end = endTime ?? props.endTime;
-  if (!orgId || !start || !end) return;
-  agentsLoaded.value = false;
-  try {
-    const options = genAiAgentsQuery(orgId, start, end);
-    // Agents appear as they emit spans and no write expires the list, so a user refresh forces.
-    if (force) {
-      await queryClient.invalidateQueries({
-        queryKey: options.queryKey,
-        exact: true,
-        refetchType: "none",
-      });
-    }
-    const agentList = await queryClient.fetchQuery(options);
-    agents.value = agentList.agents;
-    // The cascade selection is reconciled against the fresh list by
-    // useAgentScope's watcher (invalid env/name/version fall back / clear), so
-    // there is no page-local selection to clamp here anymore.
-  } catch (e) {
-    console.warn("Failed to load GenAI agents", e);
-    agents.value = [];
-  } finally {
-    agentsLoaded.value = true;
-  }
-}
-
 function syncFilterUrl() {
-  const query: Record<string, any> = { ...route.query, type: filterMode.value };
-  if (filterMode.value === "agent") {
-    delete query.stream;
-    if (selectedAgent.value?.name) {
-      query.agent = selectedAgent.value.name;
-      query.env = selectedEnv.value;
-      query.version = selectedVersion.value;
-    } else {
-      delete query.agent;
-      delete query.env;
-      delete query.version;
-    }
-  } else {
-    delete query.agent;
-    delete query.env;
-    delete query.version;
-    if (activeStream.value) query.stream = activeStream.value;
-    else delete query.stream;
-  }
+  const query = scopeUrlQuery(route.query, {
+    mode: filterMode.value,
+    explicit: modeExplicit.value,
+    stream: activeStream.value,
+    agent: selectedAgent.value
+      ? { name: selectedAgent.value.name, env: selectedEnv.value, version: selectedVersion.value }
+      : null,
+  });
   // Only the applied term — so the filtered view has a link and survives a
   // reload, and a cleared box leaves no stale param behind.
   if (searchKeyword.value) query.keyword = searchKeyword.value;
@@ -702,6 +716,7 @@ async function loadSessions(
   endTime?: number,
   force = false,
   forceAgents = false,
+  windowPicked = false,
 ) {
   const start = startTime ?? props.startTime;
   const end = endTime ?? props.endTime;
@@ -712,7 +727,7 @@ async function loadSessions(
   // programmatically) — we keep the previous page instead of re-fetching. Only
   // an explicit refresh or a real date change passes `force`. A prior error or
   // an org switch invalidates the cache so those still re-fetch.
-  const orgId = store.state.selectedOrganization?.identifier || "default";
+  const orgId = currentOrg();
   if (
     !force &&
     !searchChangedByUrl &&
@@ -729,12 +744,10 @@ async function loadSessions(
     searchKeyword.value = "";
   }
 
-  localStorage.setItem(MODE_LS_KEY, filterMode.value);
-
   // Hold the table skeleton across the whole load. We await the stream list and
-  // (in Agent mode) the agents API before `fetchPage`, which is the only thing
-  // that flips `loading`. Setting it true up front means the table shows one
-  // continuous skeleton instead of flashing its empty body between phases.
+  // the agents API before `fetchPage`, which is the only thing that flips
+  // `loading`. Setting it true up front means the table shows one continuous
+  // skeleton instead of flashing its empty body between phases.
   loading.value = true;
 
   // Stream-mode reads `effectiveStream` from `activeStream`, which is only set
@@ -742,9 +755,28 @@ async function loadSessions(
   // regardless of whether this call raced ahead of the mount's stream load.
   await ensureStreamsLoaded();
 
-  // Agents API is only relevant in Agent mode — don't touch it in Stream mode.
+  // The agents list decides the mode (when the user didn't choose one), fills
+  // the Agent cascade and the stream agent counts, and drives the "No agent
+  // identity found" banner. Served from the query cache within a window.
+  claimAgentsForOrg(orgId);
+  resolvingScope++;
+  try {
+    if (genAiAgentMappingAccess.allowed && availableStreams.value.length > 0) {
+      const agentsLoad = loadAgents(start, end, forceAgents);
+      // Explicit Stream queries need no agent identity. Counts and the
+      // instrumentation banner can settle after the sessions start loading.
+      if (!modeExplicit.value || filterMode.value === "agent") await agentsLoad;
+    }
+  } finally {
+    resolvingScope--;
+  }
+  if ((modeSettledOrg !== orgId || windowPicked) && !modeExplicit.value) {
+    filterMode.value = resolveScopeMode(null, agents.value.length, agentsError.value);
+  }
+  // A failed load decided nothing about agent identity: the next load decides.
+  if (!agentsError.value) modeSettledOrg = orgId;
+
   if (filterMode.value === "agent") {
-    await loadAgents(start, end, forceAgents);
     // Seeds the cascade now that the list exists (a no-op if the setup-time
     // call above already resolved it — see seedPendingCascade's own comment).
     seedPendingCascade();
@@ -765,6 +797,7 @@ async function loadSessions(
   } else {
     localStorage.setItem(STREAM_LS_KEY, activeStream.value);
   }
+  loadedAgentKey = agentIdentityKey(selectedAgent.value);
 
   syncFilterUrl();
 
@@ -808,10 +841,14 @@ function onStreamChange() {
   loadSessions(undefined, undefined, true);
 }
 
+// A toggle click is an explicit choice: kept in the URL and remembered for the
+// other Monitor pages, so the agents list no longer picks the mode.
 function onFilterModeChange(mode?: AcceptableValue | AcceptableValue[] | boolean) {
   const next = mode === "agent" ? "agent" : "stream";
   if (next === filterMode.value) return;
   filterMode.value = next;
+  modeExplicit.value = true;
+  rememberModeChoice(next);
   currentPage.value = 1;
   clearSessionRows();
   loadSessions(undefined, undefined, true);
@@ -823,12 +860,9 @@ function onFilterModeChange(mode?: AcceptableValue | AcceptableValue[] | boolean
 // @agent-change handler. Keyed on the agent's stream-scoped identity + version so
 // a same-named agent in a different stream/version still triggers a reload.
 watch(
-  () => {
-    const a = selectedAgent.value;
-    return a ? `${a.source_stream}::${a.name}::${a.env ?? ""}::${a.version ?? ""}` : "";
-  },
-  () => {
-    if (filterMode.value !== "agent") return;
+  () => agentIdentityKey(selectedAgent.value),
+  (key) => {
+    if (filterMode.value !== "agent" || resolvingScope > 0 || key === loadedAgentKey) return;
     currentPage.value = 1;
     loadSessions(undefined, undefined, true);
   },
@@ -875,11 +909,13 @@ function handleRowClick(row: SessionRow) {
 // Explicit refresh (header button) / real date change — always re-fetches,
 // bypassing the cache guard. `lastRunAt` is stamped inside `fetchPage`, so it
 // only advances on an actual load, never on a cache hit.
-async function refresh(startTime?: number, endTime?: number, force = true) {
+// `windowPicked` is true only for a user's own date pick: an auto-decided mode
+// is decided again for that window (Agent with no agents → Stream).
+async function refresh(startTime?: number, endTime?: number, force = true, windowPicked = false) {
   // Only snap back to page 1 when we're actually going to fetch. On the
   // non-forced mount replay we skip the fetch and keep the restored page.
   if (force) currentPage.value = 1;
-  await loadSessions(startTime, endTime, force, force);
+  await loadSessions(startTime, endTime, force, force, windowPicked);
 }
 
 defineExpose({ refresh, lastRunAt, loading });
diff --git a/web/src/plugins/traces/ThreadToolCalls.vue b/web/src/plugins/traces/ThreadToolCalls.vue
index cffadac7e7..068f6815bc 100644
--- a/web/src/plugins/traces/ThreadToolCalls.vue
+++ b/web/src/plugins/traces/ThreadToolCalls.vue
@@ -38,7 +38,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               ? t("traces.threadToolCalls.toolCall")
               : t("traces.threadToolCalls.toolCalls")
           }}
-          · {{ formatDuration(totalToolDuration(toolCalls)) }}
+          · {{ formatTimeWithSuffix(totalToolDuration(toolCalls)) }}
         </span>
         <span class="tt-link text-thread-tool-link">{{
           t("traces.threadToolCalls.showCalls")
@@ -72,7 +72,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             "
           >
             {{ tool.span_status === "ERROR" ? "ERROR" : "OK" }}
-            · {{ formatDuration(tool.duration) }}
+            · {{ formatTimeWithSuffix(Number(tool.duration)) }}
           </span>
           <button
             class="thread-tool-row__view text-text-secondary"
@@ -121,6 +121,7 @@ import { ref } from "vue";
 import { useI18nTyped } from "@/types/i18n";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import { getInputRaw, getOutputRaw } from "./threadView.utils";
+import { formatTimeWithSuffix } from "@/utils/zincutils";
 
 defineProps<{
   /** The turn's execute_tool spans (name/args/result/status/duration). */
@@ -141,6 +142,7 @@ function toggleTool(spanId: string) {
   expandedTools.value = next;
 }
 
+/** Summed span `duration`s, in microseconds. */
 function totalToolDuration(tools: any[]): number {
   let sum = 0;
   for (const t of tools) sum += Number(t.duration) || 0;
@@ -169,15 +171,6 @@ function formatToolPayload(value: unknown): string {
     return String(value);
   }
 }
-
-function formatDuration(ns: number): string {
-  if (!ns || !isFinite(ns)) return "0ms";
-  const ms = ns / 1_000_000;
-  if (ms < 1) return ms.toFixed(2) + "ms";
-  if (ms < 1000) return Math.round(ms) + "ms";
-  if (ms < 60_000) return (ms / 1000).toFixed(2) + "s";
-  return (ms / 60_000).toFixed(2) + "m";
-}
 </script>
 
 <style scoped>
diff --git a/web/src/plugins/traces/ThreadView.spec.ts b/web/src/plugins/traces/ThreadView.spec.ts
index d57ddd7aaf..1f2f720547 100644
--- a/web/src/plugins/traces/ThreadView.spec.ts
+++ b/web/src/plugins/traces/ThreadView.spec.ts
@@ -68,7 +68,7 @@ function makeLLMSpan(overrides: Record<string, unknown> = {}): Record<string, un
     gen_ai_usage_total_tokens: "150",
     start_time: BASE_TIME_NS,
     end_time: BASE_TIME_NS + 500_000_000, // 500 ms later
-    duration: 500_000_000,
+    duration: 500_000, // µs, as stored
     span_status: "UNSET",
     ...overrides,
   };
@@ -84,7 +84,7 @@ function makeToolSpan(overrides: Record<string, unknown> = {}): Record<string, u
     gen_ai_input_messages: undefined,
     start_time: BASE_TIME_NS + 100_000_000,
     end_time: BASE_TIME_NS + 300_000_000,
-    duration: 200_000_000,
+    duration: 200_000, // µs
     span_status: "UNSET",
     ...overrides,
   };
@@ -231,13 +231,13 @@ describe("ThreadView", () => {
       wrapper = mountThreadView({ spans: [makeLLMSpan()] });
       const durationChip = wrapper.find(".thread-chip--duration");
       expect(durationChip.exists()).toBe(true);
-      expect(durationChip.text()).toContain("500ms");
+      expect(durationChip.text()).toContain("500.00ms");
     });
 
-    it("should display Duration chip as '0ms' when spans is empty", () => {
+    it("should display Duration chip as '0us' when spans is empty", () => {
       wrapper = mountThreadView({ spans: [] });
       const durationChip = wrapper.find(".thread-chip--duration");
-      expect(durationChip.text()).toContain("0ms");
+      expect(durationChip.text()).toContain("0us");
     });
 
     it("should display Cost as '$0' when spans have no cost data", () => {
@@ -408,6 +408,28 @@ describe("ThreadView", () => {
       expect(wrapper.find(".thread-tool-row").exists()).toBe(false);
     });
 
+    // Issue #3135: `span.duration` is µs. A 3.51 s LLM call and a 10.10 ms
+    // tool call must read as the waterfall shows them.
+    it("shows per-turn and per-tool durations from a real µs span as the waterfall does", async () => {
+      const llm = makeLLMSpan({
+        span_id: "llm-p",
+        end_time: BASE_TIME_NS + 3_510_000_000,
+        duration: 3_510_000,
+      });
+      const tool = makeLinkedToolSpan("llm-p", {
+        end_time: BASE_TIME_NS + 110_100_000,
+        duration: 10_100,
+      });
+      wrapper = mountThreadView({ spans: [llm, tool] });
+
+      const turnMetric = wrapper.find('.thread-metric[title="Duration"]');
+      expect(turnMetric.text()).toContain("3.51s");
+      expect(wrapper.find(".tt-count").text()).toContain("10.10ms");
+
+      await reveal(wrapper);
+      expect(wrapper.find(".thread-pill").text()).toContain("10.10ms");
+    });
+
     it("should not show tool body by default (collapsed)", async () => {
       const llm = makeLLMSpan({ span_id: "llm-p" });
       const tool = makeLinkedToolSpan("llm-p");
@@ -586,20 +608,20 @@ describe("ThreadView", () => {
   });
 
   // =========================================================================
-  // formatDuration — exercised through the Duration chip
+  // Duration formatting — exercised through the Duration chip
   // =========================================================================
 
-  describe("formatDuration (via Duration chip)", () => {
-    it("should show '0ms' when all span times are 0", () => {
+  describe("duration formatting (via Duration chip)", () => {
+    it("should show '0us' when all span times are 0", () => {
       wrapper = mountThreadView({
         spans: [makeLLMSpan({ start_time: 0, end_time: 0 })],
       });
       const chip = wrapper.find(".thread-chip--duration");
-      expect(chip.text()).toContain("0ms");
+      expect(chip.text()).toContain("0us");
     });
 
-    it("should format sub-millisecond durations with two decimal places", () => {
-      // end - start = 500_000 ns = 0.5 ms → "0.50ms"
+    it("should format sub-millisecond durations in microseconds", () => {
+      // end - start ≈ 500_000 ns ≈ 500 µs (BASE_TIME_NS exceeds float precision)
       wrapper = mountThreadView({
         spans: [
           makeLLMSpan({
@@ -609,13 +631,11 @@ describe("ThreadView", () => {
         ],
       });
       const chip = wrapper.find(".thread-chip--duration");
-      // Should not say "0ms" for a finite but sub-1ms duration
-      expect(chip.text()).not.toBe("Duration 0ms");
-      expect(chip.text()).toMatch(/0\.\d+ms/);
+      expect(chip.text()).toMatch(/\d{3}\.\d{2}us/);
     });
 
-    it("should format millisecond-range durations without decimal places", () => {
-      // 500 ms = 500_000_000 ns → "500ms"
+    it("should format millisecond-range durations with two decimal places", () => {
+      // 500 ms = 500_000_000 ns → "500.00ms"
       wrapper = mountThreadView({
         spans: [
           makeLLMSpan({
@@ -625,7 +645,7 @@ describe("ThreadView", () => {
         ],
       });
       const chip = wrapper.find(".thread-chip--duration");
-      expect(chip.text()).toContain("500ms");
+      expect(chip.text()).toContain("500.00ms");
     });
 
     it("computes the total duration over 200,000 spans without a RangeError", () => {
diff --git a/web/src/plugins/traces/ThreadView.vue b/web/src/plugins/traces/ThreadView.vue
index 7bcfeed9f2..6ad82b46e9 100644
--- a/web/src/plugins/traces/ThreadView.vue
+++ b/web/src/plugins/traces/ThreadView.vue
@@ -69,7 +69,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           >{{ t("traces.threadView.duration") }}</span
         >
         <span class="thread-chip__value text-text-body text-xs font-semibold">
-          {{ formatDuration(summary.totalDurationNs) }}
+          {{ formatTimeWithSuffix(summary.totalDurationNs / 1000) }}
         </span>
       </OTag>
 
@@ -280,7 +280,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :title="t('traces.threadView.duration')"
                 >
                   <OIcon name="timer" size="xs" />
-                  {{ formatDuration(turn.span.duration) }}
+                  {{ formatTimeWithSuffix(Number(turn.span.duration)) }}
                 </span>
                 <span
                   class="thread-metric rounded-default bg-surface-subtle border-border-default text-text-secondary text-2xs inline-flex shrink-0 items-center gap-1 border px-2 py-[0.18rem] leading-none whitespace-nowrap"
@@ -365,6 +365,7 @@ import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTag from "@/lib/core/Badge/OTag.vue";
 import ThreadToolCalls from "./ThreadToolCalls.vue";
 import { renderMarkdown } from "./markdown";
+import { formatTimeWithSuffix } from "@/utils/zincutils";
 
 const { t } = useI18nTyped();
 
@@ -425,7 +426,8 @@ const displayGroups = computed<TraceGroup[]>(() => {
     const mergedSpan = {
       ...last,
       start_time: first.start_time,
-      duration: g.totalDurationNs,
+      // `duration` is in microseconds, like every span's (the waterfall unit).
+      duration: g.totalDurationNs / 1000,
       gen_ai_usage_cost: g.totalCost,
       gen_ai_usage_total_tokens: totalTokens,
       span_status: anyError ? "ERROR" : last.span_status,
@@ -489,15 +491,6 @@ const summary = computed(() => {
 });
 
 /* ─── formatters ──────────────────────────────────────────────────────── */
-function formatDuration(ns: number): string {
-  if (!ns || !isFinite(ns)) return "0ms";
-  const ms = ns / 1_000_000;
-  if (ms < 1) return ms.toFixed(2) + "ms";
-  if (ms < 1000) return Math.round(ms) + "ms";
-  if (ms < 60_000) return (ms / 1000).toFixed(2) + "s";
-  return (ms / 60_000).toFixed(2) + "m";
-}
-
 function formatCost(usd: number): string {
   if (!usd || usd <= 0) return "$0";
   if (usd >= 1) return `$${usd.toFixed(2)}`;
diff --git a/web/src/plugins/traces/TraceDetails.spec.ts b/web/src/plugins/traces/TraceDetails.spec.ts
index 70662f7095..a4f87f1177 100644
--- a/web/src/plugins/traces/TraceDetails.spec.ts
+++ b/web/src/plugins/traces/TraceDetails.spec.ts
@@ -20,6 +20,7 @@ import { getManager } from "@/lib/vue-shortcut-manager";
 import OPageHeader from "@/lib/core/PageHeader/OPageHeader.vue";
 import i18n from "@/locales";
 import store from "@/test/unit/helpers/store";
+import config from "@/aws-exports";
 import router from "@/test/unit/helpers/router";
 import { http, HttpResponse } from "msw";
 import tracesMockData from "@/test/unit/mockData/traces";
@@ -936,6 +937,39 @@ describe("TraceDetails", () => {
       expect(series()).toMatchObject({ left: 55, right: 55 });
     });
 
+    it("zooms both views from the chart's live level and fit recreates the chart", async () => {
+      let liveZoom = 1;
+      fakeChart.getOption = () => ({ series: [{ zoom: liveZoom }] });
+      fakeChart.setOption = vi.fn((opt: any) => {
+        liveZoom = opt.series[0].zoom;
+      });
+      await mountMap();
+
+      for (const view of ["tree", "graph"]) {
+        if (view === "graph") {
+          await graphBtn().trigger("click");
+          await flushPromises();
+        }
+        expect(wrapper.find('[data-test="trace-graph-zoom-controls"]').exists()).toBe(true);
+        liveZoom = 1;
+        await wrapper.find('[data-test="trace-graph-zoom-in"]').trigger("click");
+        expect(liveZoom).toBeCloseTo(1.25);
+        await wrapper.find('[data-test="trace-graph-zoom-out"]').trigger("click");
+        expect(liveZoom).toBeCloseTo(1);
+
+        const keyBefore = wrapper.vm.traceGraphChartKey;
+        await wrapper.find('[data-test="trace-graph-fit-screen"]').trigger("click");
+        expect(wrapper.vm.traceGraphChartKey).toBe(keyBefore + 1);
+      }
+    });
+
+    it("hides the zoom controls when no service matches", async () => {
+      await mountMap();
+      wrapper.vm.traceGraphSearch = "nope";
+      await flushPromises();
+      expect(wrapper.find('[data-test="trace-graph-zoom-controls"]').exists()).toBe(false);
+    });
+
     it("truncates graph labels and hides overlapping ones", async () => {
       await mountMap();
       await graphBtn().trigger("click");
@@ -989,6 +1023,29 @@ describe("TraceDetails", () => {
       expect(fakeChart.off).toHaveBeenCalledWith("mouseover", expect.any(Function));
     });
 
+    it("resolves the hovered node in the searched tree, not the full one", async () => {
+      const tooltipSetupDelay = () => new Promise((resolve) => setTimeout(resolve, 350));
+      const chartDom = document.createElement("div");
+      fakeChart.getDom = () => chartDom;
+      await mountMap();
+      wrapper.vm.setTraceGraphView("tree");
+      await tooltipSetupDelay();
+      const fullCatalog = series().data[0].children.find((n: any) => n.name === "catalog");
+      wrapper.vm.traceGraphSearch = "catalog";
+      await flushPromises();
+      await tooltipSetupDelay();
+
+      const catalog = series().data[0].children[0];
+      expect(catalog.name).toBe("catalog");
+      expect(catalog.treePath).not.toEqual(fullCatalog.treePath);
+      const handlers = fakeChart.on.mock.calls.filter(([event]: any[]) => event === "mouseover");
+      handlers.at(-1)[1]({ data: catalog, event: { offsetX: 10, offsetY: 10 } });
+
+      const tooltip = chartDom.lastElementChild as HTMLElement;
+      expect(tooltip.innerHTML).toContain("catalog");
+      expect(tooltip.innerHTML).not.toContain("checkout");
+    });
+
     it("does not attach the tree tooltip when Graph View is chosen during the setup delay", async () => {
       const tooltipSetupDelay = () => new Promise((resolve) => setTimeout(resolve, 350));
       await mountMap();
@@ -3191,4 +3248,92 @@ describe("TraceDetails", () => {
       expect(viewSpanLogs).not.toHaveBeenCalled();
     });
   });
+
+  describe("Ask AI: Explain trace and the span relay", () => {
+    const EXPLAIN = '[data-test="trace-explain-trace-btn"]';
+    const sidebarStub = () => ({
+      ...mountOptions.global.stubs["trace-details-sidebar"],
+      props: [...mountOptions.global.stubs["trace-details-sidebar"].props, "showAskAi"],
+      emits: [...mountOptions.global.stubs["trace-details-sidebar"].emits, "sendToAiChat"],
+    });
+    let savedEnterprise: string;
+    let savedAiEnabled: unknown;
+
+    async function mountAskAi(showAskAi: boolean, { enterprise = true, ai = true } = {}) {
+      config.isEnterprise = enterprise ? "true" : "false";
+      store.state.zoConfig.ai_enabled = ai;
+      wrapper.unmount();
+      wrapper = mount(TraceDetails, {
+        ...mountOptions,
+        props: { ...mountOptions.props, showAskAi },
+        global: {
+          ...mountOptions.global,
+          stubs: { ...mountOptions.global.stubs, "trace-details-sidebar": sidebarStub() },
+        },
+      });
+      await flushPromises();
+      wrapper.vm.activeTab = "waterfall";
+      await flushPromises();
+    }
+
+    async function openSidebar() {
+      wrapper.vm.updateSelectedSpan(tracesMockData.tracesDetails.traceSpans.hits[0].span_id);
+      await flushPromises();
+      return wrapper.findComponent('[data-test="trace-details-sidebar"]');
+    }
+
+    beforeEach(() => {
+      savedEnterprise = config.isEnterprise;
+      savedAiEnabled = store.state.zoConfig.ai_enabled;
+    });
+
+    afterEach(() => {
+      config.isEnterprise = savedEnterprise;
+      store.state.zoConfig.ai_enabled = savedAiEnabled;
+    });
+
+    it.each([
+      ["the parent leaves showAskAi off", false, {}],
+      ["the build is not enterprise", true, { enterprise: false }],
+      ["AI is disabled on the server", true, { ai: false }],
+    ])("hides Explain trace and the span button when %s", async (_label, show, gate) => {
+      await mountAskAi(show, gate);
+      expect(wrapper.find(EXPLAIN).exists()).toBe(false);
+      expect((await openSidebar()).props("showAskAi")).toBe(false);
+    });
+
+    it("shows Explain trace beside the Critical path toggle on the Waterfall tab only", async () => {
+      await mountAskAi(true);
+      expect(wrapper.find(EXPLAIN).exists()).toBe(true);
+      wrapper.vm.activeTab = "flame-graph";
+      await flushPromises();
+      expect(wrapper.find(EXPLAIN).exists()).toBe(false);
+    });
+
+    it("emits sendToAiChat with the trace summary when Explain trace is clicked", async () => {
+      await mountAskAi(true);
+      await wrapper.find(EXPLAIN).trigger("click");
+      const [payload] = wrapper.emitted("sendToAiChat")![0] as [Record<string, any>];
+      expect(payload.chipName).toBe(`Trace · ${wrapper.vm.traceTree[0].operationName}`);
+      expect(payload).toMatchObject({ newChat: true, autoSend: false });
+      expect(payload.context).toMatchObject({
+        currentPage: "traces",
+        streamType: "traces",
+        selectedStreams: ["test-stream"],
+        traceId: "test-trace-id",
+      });
+      const summary = payload.context.trace_summary;
+      expect(summary.total_spans).toBe(tracesMockData.tracesDetails.traceSpans.hits.length);
+      expect(summary.critical_path.length).toBeGreaterThan(0);
+    });
+
+    it("turns the span button on and relays its sendToAiChat", async () => {
+      await mountAskAi(true);
+      const sidebar = await openSidebar();
+      expect(sidebar.props("showAskAi")).toBe(true);
+      const payload = { query: "q", chipName: "Span · x", newChat: true, autoSend: false };
+      sidebar.vm.$emit("sendToAiChat", payload);
+      expect(wrapper.emitted("sendToAiChat")![0]).toEqual([payload]);
+    });
+  });
 });
diff --git a/web/src/plugins/traces/TraceDetails.vue b/web/src/plugins/traces/TraceDetails.vue
index b6f0753bbd..a1b8747cf5 100644
--- a/web/src/plugins/traces/TraceDetails.vue
+++ b/web/src/plugins/traces/TraceDetails.vue
@@ -447,6 +447,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               data-test="trace-details-critical-path-toggle"
               @update:model-value="setShowCriticalPath"
             />
+            <OButton
+              v-if="activeTab === 'waterfall' && askAiVisible"
+              variant="outline"
+              size="sm"
+              class="h-8! text-xs font-normal!"
+              data-test="trace-explain-trace-btn"
+              @click="explainTrace"
+            >
+              <template #icon-left>
+                <img :src="aiIconSrc" class="h-4 w-4 shrink-0" alt="" />
+              </template>
+              {{ t("traces.askAi.explainTrace") }}
+              <OTooltip side="bottom" :content="t('traces.askAi.explainTraceHint')" />
+            </OButton>
             <!-- Unified Search Input Group -->
             <div
               v-if="activeTab !== 'flame-graph' && activeTab !== 'map' && activeTab !== 'thread'"
@@ -685,6 +699,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :show-log-stream-selector="showLogStreamSelector"
                   :show-evaluate-button="canManualEvaluate"
                   :show-annotate-buttons="canAnnotate"
+                  :show-ask-ai="askAiVisible"
+                  @send-to-ai-chat="relayToAiChat"
                   @view-logs="redirectToLogs"
                   @evaluate="openSpanEvaluation"
                   @add-to-dataset="openSpanDataset"
@@ -749,6 +765,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :show-log-stream-selector="showLogStreamSelector"
                   :show-evaluate-button="canManualEvaluate"
                   :show-annotate-buttons="canAnnotate"
+                  :show-ask-ai="askAiVisible"
+                  @send-to-ai-chat="relayToAiChat"
                   @view-logs="redirectToLogs"
                   @evaluate="openSpanEvaluation"
                   @add-to-dataset="openSpanDataset"
@@ -829,6 +847,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   :show-log-stream-selector="showLogStreamSelector"
                   :show-evaluate-button="canManualEvaluate"
                   :show-annotate-buttons="canAnnotate"
+                  :show-ask-ai="askAiVisible"
+                  @send-to-ai-chat="relayToAiChat"
                   @view-logs="redirectToLogs"
                   @evaluate="openSpanEvaluation"
                   @add-to-dataset="openSpanDataset"
@@ -882,13 +902,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                 />
               </div>
               <!-- Chart Container -->
-              <div class="min-h-0 flex-1 overflow-hidden p-2.5">
+              <div class="relative min-h-0 flex-1 overflow-hidden p-2.5">
                 <ChartRenderer
                   ref="chartRendererRef"
                   data-test="trace-details-service-map-chart"
                   :data="traceServiceMapChartOptions"
+                  :key="traceGraphChartKey"
                   class="h-full"
                 />
+                <ChartZoomControls
+                  v-if="traceGraphHasChart"
+                  data-test-prefix="trace-graph"
+                  @zoom-in="zoomTraceGraphIn"
+                  @zoom-out="zoomTraceGraphOut"
+                  @fit="fitTraceGraph"
+                />
               </div>
             </div>
           </div>
@@ -990,6 +1018,8 @@ import TraceDAG from "./TraceDAG.vue";
 import TraceHeader from "./TraceHeader.vue";
 import TraceErrorSpansMenu from "./components/TraceErrorSpansMenu.vue";
 import { errorSpansDeepestFirst } from "./utils/traceErrorSummary";
+import { buildTraceAiPayload, type AiChatHandoff } from "./utils/traceAiPayload";
+import { useAiIcon } from "@/composables/useAiIcon";
 import { useStore } from "vuex";
 import useTheme from "@/composables/useTheme";
 import { createTracesContextProvider } from "@/composables/contextProviders/tracesContextProvider";
@@ -1016,7 +1046,7 @@ import {
 import { getAllSpanColors } from "@/utils/traces/traceColors";
 import { resolveReplaySpan, resolveSessionId, resolveUrlTimeRange } from "./traceDetails.utils";
 import { buildFilterTerm, applyFilterTerm } from "@/utils/traces/filterUtils";
-import { buildPatternConsolidatedTree } from "@/utils/traces/patternDetection";
+import { buildPathPatterns, buildPatternConsolidatedTree } from "@/utils/traces/patternDetection";
 import { useTracePatternTree } from "@/composables/useTracePatternTree";
 import type { TreeNode as PatternTreeNode } from "@/composables/useTreeVisualization";
 import type { EnrichedSpan } from "@/ts/interfaces/traces/span.types";
@@ -1074,6 +1104,8 @@ import {
 import type { ServiceDetectionConfig } from "@/ts/interfaces/traces/serviceDetection.types";
 import { useServiceCorrelation, type KeyFieldsConfig } from "@/composables/useServiceCorrelation";
 import { getOrSetServiceColor } from "@/utils/traces/serviceColorRegistry";
+import ChartZoomControls from "@/components/traces/ChartZoomControls.vue";
+import useChartZoom from "@/composables/traces/useChartZoom";
 
 // Import FlameGraphView
 const FlameGraphView = defineAsyncComponent(() => import("@/components/traces/FlameGraphView.vue"));
@@ -1278,6 +1310,11 @@ export default defineComponent({
       type: Boolean,
       default: true,
     },
+    // Only the routed Traces page has a listener for sendToAiChat; embeds leave this off.
+    showAskAi: {
+      type: Boolean,
+      default: false,
+    },
   },
   components: {
     ShareButton,
@@ -1289,6 +1326,7 @@ export default defineComponent({
     TraceHeader,
     TraceErrorSpansMenu,
     FlameGraphView,
+    ChartZoomControls,
     OToggleGroup,
     OToggleGroupItem,
     OButton,
@@ -1311,7 +1349,7 @@ export default defineComponent({
     AddToDatasetDrawer,
   },
 
-  emits: ["searchQueryUpdated", "close", "spanSelected"],
+  emits: ["searchQueryUpdated", "close", "spanSelected", "sendToAiChat"],
   setup(props, { emit }) {
     const serviceDetectionConfig = ref<ServiceDetectionConfig | null>(null);
     provide(TRACE_SERVICE_DETECTION_KEY, serviceDetectionConfig);
@@ -1342,6 +1380,18 @@ export default defineComponent({
 
     // Chart renderer ref for tooltip integration
     const chartRendererRef = ref<any>(null);
+    // Recreating the chart drops the tree view's hover listeners, so fit re-attaches them.
+    const {
+      chartKey: traceGraphChartKey,
+      zoomIn: zoomTraceGraphIn,
+      zoomOut: zoomTraceGraphOut,
+      fitToScreen: fitTraceGraph,
+    } = useChartZoom(
+      () => chartRendererRef.value?.chart,
+      () => {
+        setupTooltips();
+      },
+    );
     // The tree view's span sidebar; it owns the correlation lookup.
     const treeSidebarRef = ref<any>(null);
 
@@ -1365,6 +1415,7 @@ export default defineComponent({
 
     // Pattern View - new functionality
     const consolidatedPatterns = ref(new Map());
+    const tracePathPatterns = ref(new Map());
     const { isDark: isDarkMode } = useTheme();
 
     // Set up pattern tree composable and visualization engine
@@ -1374,7 +1425,10 @@ export default defineComponent({
       getNodeLabel: getPatternNodeLabel,
       getNodeTooltip: getPatternNodeTooltip,
       getNodeErrorRate: getPatternNodeErrorRate,
-    } = useTracePatternTree(consolidatedPatterns, isDarkMode);
+    } = useTracePatternTree(consolidatedPatterns, isDarkMode, tracePathPatterns);
+    const traceGraphTree = computed(() =>
+      filterTraceTree(patternTreeData.value, traceGraphSearch.value),
+    );
 
     // Computed chart options that switches between pattern and span views
     const traceServiceMapChartOptions = computed(() => {
@@ -1436,7 +1490,7 @@ export default defineComponent({
         errorRate: node.errorRate ?? 0,
         metadata: node.metadata,
       });
-      const treeData = filterTraceTree(patternTreeData.value, traceGraphSearch.value);
+      const treeData = traceGraphTree.value;
       // ECharts' tree series throws on empty data and leaves the chart stuck until reload.
       if (!treeData.length) return { options: {}, notMerge: true };
       const chartOptions = generateEChartsOptions(
@@ -1462,6 +1516,10 @@ export default defineComponent({
       };
     });
 
+    const traceGraphHasChart = computed(
+      () => !!(traceServiceMapChartOptions.value.options as { series?: unknown }).series,
+    );
+
     const spanDimensions = {
       height: 30,
       barHeight: 8,
@@ -2091,6 +2149,29 @@ export default defineComponent({
       },
     );
 
+    const { aiIconSrc } = useAiIcon();
+    const askAiVisible = computed(
+      () => props.showAskAi && config.isEnterprise === "true" && !!store.state.zoConfig.ai_enabled,
+    );
+
+    const relayToAiChat = (payload: AiChatHandoff) => emit("sendToAiChat", payload);
+
+    const explainTrace = () => {
+      const trace = searchObj.data.traceDetails.selectedTrace;
+      const criticalPath = computeCriticalPathForRoots(traceTree.value.map(toCriticalPathNode));
+      relayToAiChat(
+        buildTraceAiPayload(t, {
+          spans: effectiveSpanList.value,
+          criticalPathSpanIds: criticalPath.map((section) => section.spanId),
+          rootOperation: String(traceTree.value[0]?.operationName ?? ""),
+          traceId: effectiveTraceId.value,
+          stream: currentTraceStreamName.value,
+          traceStartTime: Number(trace?.trace_start_time) || 0,
+          traceEndTime: Number(trace?.trace_end_time) || 0,
+        }),
+      );
+    };
+
     const setShowCriticalPath = (value: unknown) => {
       showCriticalPath.value = value === true;
       try {
@@ -2151,7 +2232,10 @@ export default defineComponent({
           tooltipCleanup = setupTraceNodeTooltips(
             chart,
             {
-              treeData: patternTreeData.value,
+              // A getter, so a hover resolves its tree path in the tree the chart draws now, even after a search.
+              get treeData() {
+                return traceGraphTree.value;
+              },
               getNodeTooltip: getPatternNodeTooltip,
               getNodeErrorRate: getPatternNodeErrorRate,
             } as TreeVisualizationData,
@@ -2871,6 +2955,7 @@ export default defineComponent({
       });
 
       // Build consolidated patterns for pattern view
+      tracePathPatterns.value = buildPathPatterns(traceTree.value);
       consolidatedPatterns.value = buildPatternConsolidatedTree(traceTree.value);
       // console.log('[DEBUG] consolidatedPatterns size:', consolidatedPatterns.value?.size || 0);
       // console.log('[DEBUG] consolidatedPatterns keys:', Array.from(consolidatedPatterns.value?.keys() || []));
@@ -3396,6 +3481,10 @@ export default defineComponent({
       raw,
       showCriticalPath,
       setShowCriticalPath,
+      aiIconSrc,
+      askAiVisible,
+      relayToAiChat,
+      explainTrace,
       traceGraphView,
       setTraceGraphView,
       traceGraphSearch,
@@ -3435,6 +3524,11 @@ export default defineComponent({
       traceServiceMap,
       traceServiceMapChartOptions,
       chartRendererRef,
+      traceGraphChartKey,
+      traceGraphHasChart,
+      zoomTraceGraphIn,
+      zoomTraceGraphOut,
+      fitTraceGraph,
       treeSidebarRef,
       activeVisual,
       traceVisuals,
diff --git a/web/src/plugins/traces/TraceDetailsSidebar.spec.ts b/web/src/plugins/traces/TraceDetailsSidebar.spec.ts
index a9a197c992..b569868fa5 100644
--- a/web/src/plugins/traces/TraceDetailsSidebar.spec.ts
+++ b/web/src/plugins/traces/TraceDetailsSidebar.spec.ts
@@ -2824,3 +2824,78 @@ describe("TraceDetailsSidebar — span to profile link", () => {
     w.unmount();
   });
 });
+
+describe("TraceDetailsSidebar — Ask AI about this span", () => {
+  const ASK_AI = '[data-test="trace-span-ask-ai-btn"]';
+
+  async function mountWith(props: Record<string, unknown> = {}) {
+    const w = mountSidebar({ streamName: "default", ...props });
+    await flushPromises();
+    return w;
+  }
+
+  beforeEach(() => {
+    mockSearch.mockReset();
+    mockSearch.mockResolvedValue({
+      data: { hits: [{ n: 120, p50: 1000, p75: 2000, p90: 4000, p99: 8000 }] },
+    });
+    mockSearchObj.data = {
+      stream: { selectedStream: { label: "default", value: "default" } },
+      queryPayload: { query: { start_time: 1752490000000000, end_time: 1752490900000000 } },
+      traceDetails: {
+        selectedTrace: { trace_start_time: 1752490492843000, trace_end_time: 1752490493164419 },
+      },
+    };
+  });
+
+  afterEach(() => {
+    delete (mockSearchObj as Record<string, unknown>).data;
+  });
+
+  it("is hidden unless the parent turns it on", async () => {
+    const w = await mountWith();
+    expect(w.find(ASK_AI).exists()).toBe(false);
+    w.unmount();
+  });
+
+  it("sits in the always-visible action group, not beside the standalone-only View logs", async () => {
+    const w = await mountWith({ showAskAi: true, parentMode: "embedded" });
+    const actions = w.find('[data-test="trace-details-sidebar-header-toolbar-actions"]');
+    expect(actions.find(ASK_AI).exists()).toBe(true);
+    w.unmount();
+  });
+
+  it("emits sendToAiChat with the span payload and its operation p50", async () => {
+    const w = await mountWith({ showAskAi: true });
+    await w.find(ASK_AI).trigger("click");
+    const [payload] = w.emitted("sendToAiChat")![0] as [Record<string, any>];
+    expect(payload.query).toBe("Why did this span take 321.37 ms? Its operation's p50 is 1 ms.");
+    expect(payload.chipName).toBe(`Span · ${mockSpan.operation_name}`);
+    expect(payload).toMatchObject({ newChat: true, autoSend: false });
+    expect(payload.context).toMatchObject({
+      currentPage: "traces",
+      streamType: "traces",
+      selectedStreams: ["default"],
+      traceId: mockSpan.trace_id,
+      traceStartTime: 1752490492843000,
+      traceEndTime: 1752490493164419,
+      span: {
+        span_id: mockSpan.span_id,
+        duration_us: mockSpan.duration,
+        operation_p50_us: 1000,
+      },
+    });
+    w.unmount();
+  });
+
+  it("sends a null p50 when the operation has too few samples", async () => {
+    mockSearch.mockResolvedValue({
+      data: { hits: [{ n: 3, p50: 1000, p75: 2000, p90: 4000, p99: 8000 }] },
+    });
+    const w = await mountWith({ showAskAi: true });
+    await w.find(ASK_AI).trigger("click");
+    const [payload] = w.emitted("sendToAiChat")![0] as [Record<string, any>];
+    expect(payload.context.span.operation_p50_us).toBeNull();
+    w.unmount();
+  });
+});
diff --git a/web/src/plugins/traces/TraceDetailsSidebar.vue b/web/src/plugins/traces/TraceDetailsSidebar.vue
index 5c031b0ce4..5ee28960df 100644
--- a/web/src/plugins/traces/TraceDetailsSidebar.vue
+++ b/web/src/plugins/traces/TraceDetailsSidebar.vue
@@ -236,6 +236,18 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                row itself has no gap (its children carry their own margins), so
                these three are grouped and spaced on the header's rhythm. -->
           <div class="ms-2 flex items-center gap-2">
+            <OButton
+              v-if="showAskAi"
+              variant="outline"
+              size="icon-xs"
+              :aria-label="t('traces.askAi.askAboutSpan')"
+              data-test="trace-span-ask-ai-btn"
+              @click.stop="askAiAboutSpan"
+            >
+              <img :src="aiIconSrc" class="h-4 w-4 shrink-0" alt="" />
+              <OTooltip side="bottom" :content="t('traces.askAi.askAboutSpan')" />
+            </OButton>
+
             <OButton
               v-if="showEvaluateButton && canPreviewSpan"
               variant="outline"
@@ -1036,11 +1048,14 @@ import {
   onUnmounted,
   defineAsyncComponent,
   nextTick,
+  unref,
 } from "vue";
 import { useStore } from "vuex";
 import useTheme from "@/composables/useTheme";
 import { raw, useI18nTyped } from "@/types/i18n";
 import { formatTimeWithSuffix, convertTimeFromNsToUs, getImageURL } from "@/utils/zincutils";
+import { useAiIcon } from "@/composables/useAiIcon";
+import { buildSpanAiPayload } from "@/plugins/traces/utils/traceAiPayload";
 import useTraces from "@/composables/useTraces";
 import { useRouter } from "vue-router";
 import LogsHighLighting from "@/components/logs/LogsHighLighting.vue";
@@ -1195,6 +1210,10 @@ export default defineComponent({
       type: Boolean,
       default: false,
     },
+    showAskAi: {
+      type: Boolean,
+      default: false,
+    },
   },
   components: {
     OSeparator,
@@ -1246,6 +1265,7 @@ export default defineComponent({
     "evaluate",
     "add-to-dataset",
     "update:activeTab",
+    "sendToAiChat",
   ],
   setup(props, { emit }) {
     const serviceDetectionConfig = inject(TRACE_SERVICE_DETECTION_KEY, ref(null));
@@ -2022,12 +2042,18 @@ export default defineComponent({
       { immediate: true },
     );
 
-    const operationPercentile = computed(() => {
+    const reliableOperationStats = computed((): OperationStats | null => {
       const req = operationStatsRequest.value;
       const stats = req ? operationStatsCache.value[req.key] : null;
-      const duration = Number(props.span?.duration);
       // approx_percentile_cont returns 0 when the column type is not inferred.
       if (!stats || !(stats.n >= OPERATION_STATS_MIN_SAMPLES) || !(stats.p50 > 0)) return null;
+      return stats;
+    });
+
+    const operationPercentile = computed(() => {
+      const stats = reliableOperationStats.value;
+      const duration = Number(props.span?.duration);
+      if (!stats) return null;
       if (!Number.isFinite(duration)) return null;
       let band = t("traces.traceDetailsSidebar.operationBandAboveP99");
       let variant: BadgeVariant = "error-soft";
@@ -2050,6 +2076,23 @@ export default defineComponent({
       return { band, variant, tooltip };
     });
 
+    const { aiIconSrc } = useAiIcon();
+
+    const askAiAboutSpan = () => {
+      const trace = searchObj.data?.traceDetails?.selectedTrace;
+      emit(
+        "sendToAiChat",
+        buildSpanAiPayload(t, {
+          span: props.span,
+          stream: spanSourceStream.value,
+          traceStartTime: Number(trace?.trace_start_time) || 0,
+          traceEndTime: Number(trace?.trace_end_time) || 0,
+          operationP50Us: reliableOperationStats.value?.p50 ?? null,
+          hasError: !!unref(hasSpanError),
+        }),
+      );
+    };
+
     const spanProfileCache = ref<Record<string, SpanProfileMatch | null>>({});
     const pendingSpanProfiles = new Set<string>();
 
@@ -2797,6 +2840,8 @@ export default defineComponent({
       navigateToError,
       getDuration,
       operationPercentile,
+      aiIconSrc,
+      askAiAboutSpan,
       spanProfileMatch,
       viewSpanProfile,
       getTTFT,
diff --git a/web/src/plugins/traces/agentOptionFormat.ts b/web/src/plugins/traces/agentOptionFormat.ts
index 930862677e..83f345645a 100644
--- a/web/src/plugins/traces/agentOptionFormat.ts
+++ b/web/src/plugins/traces/agentOptionFormat.ts
@@ -55,29 +55,27 @@ export function buildAgentSelectOptions(
   return result;
 }
 
-/**
- * Stream-picker options, each annotated with how many discovered agents the
- * stream contains — e.g. `sre_agent_traces_production (2 agents)`. The count is
- * shared across every AI page's Stream picker so they read identically. `value`
- * stays the bare stream name; the label carries the count.
- */
 /**
  * Stream-picker options. The label is the bare stream name (so it truncates
  * cleanly with a tooltip in a fixed-width trigger — stream names are arbitrary
  * length), and the agent count rides along as `agentCount` so callers render it
  * as a separate badge rather than cramming it into the truncated label text.
+ * The count is of distinct agent names, as the Agent picker lists them: one
+ * agent seen with and without an id, or in two envs, is still one agent.
  */
 export function buildStreamSelectOptions(
   streams: string[],
   agents: GenAiAgentListItem[],
 ): (SelectOption & { agentCount: number })[] {
-  const counts = new Map<string, number>();
+  const names = new Map<string, Set<string>>();
   for (const a of agents) {
-    counts.set(a.source_stream, (counts.get(a.source_stream) ?? 0) + 1);
+    const set = names.get(a.source_stream) ?? new Set<string>();
+    set.add(a.name);
+    names.set(a.source_stream, set);
   }
   return streams.map((s) => ({
     label: raw(s),
     value: s,
-    agentCount: counts.get(s) ?? 0,
+    agentCount: names.get(s)?.size ?? 0,
   }));
 }
diff --git a/web/src/plugins/traces/components/TracesSearchResultList.vue b/web/src/plugins/traces/components/TracesSearchResultList.vue
index 98aaaba38f..220fc65235 100644
--- a/web/src/plugins/traces/components/TracesSearchResultList.vue
+++ b/web/src/plugins/traces/components/TracesSearchResultList.vue
@@ -180,11 +180,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
                 <template #cell-cost="{ row }">
                   <span class="text-text-body font-mono text-xs" data-test="trace-row-cost">
-                    {{
-                      isLLMTrace(row)
-                        ? `$${formatCost(extractLLMData(row)?.cost?.total ?? 0)}`
-                        : "-"
-                    }}
+                    <LLMCostCell
+                      v-if="isLLMTrace(row)"
+                      scope="trace"
+                      :cost="extractLLMData(row)?.cost?.total ?? 0"
+                      :tokens="extractLLMData(row)?.usage?.total ?? 0"
+                      :unpriced-tokens="unpricedFields(row).unpricedTokens"
+                      :unpriced-models="unpricedFields(row).unpricedModels"
+                      :stream="searchObj.data.stream.selectedStream?.value ?? ''"
+                      :time-window="{
+                        start: searchObj.data.datetime.startTime,
+                        end: searchObj.data.datetime.endTime,
+                      }"
+                      :format="(c: number) => `$${formatCost(c)}`"
+                    />
+                    <template v-else>-</template>
                   </span>
                 </template>
 
@@ -298,6 +308,8 @@ import SpanErrorCell from "./SpanErrorCell.vue";
 import SpanEventsCell from "./SpanEventsCell.vue";
 import { SPAN_ERROR_COLUMN_ID, SPAN_EVENTS_COLUMN_ID } from "./spanResultCells";
 import { isLLMTrace, extractLLMData, formatCost, formatTokens } from "../../../utils/llmUtils";
+import LLMCostCell from "../LLMCostCell.vue";
+import { unpricedFields } from "../llmDataTrust.utils";
 import { formatTimeWithSuffix } from "../../../utils/zincutils";
 import { escapeSingleQuotes } from "../../../utils/queryUtils";
 import { severityIndicatorColor } from "@/utils/logs/statusParser";
diff --git a/web/src/plugins/traces/composables/useLLMDataHealth.spec.ts b/web/src/plugins/traces/composables/useLLMDataHealth.spec.ts
new file mode 100644
index 0000000000..c23f157efd
--- /dev/null
+++ b/web/src/plugins/traces/composables/useLLMDataHealth.spec.ts
@@ -0,0 +1,115 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+const getDataHealth = vi.fn();
+vi.mock("@/services/gen-ai-data-health.service", () => ({
+  getDataHealth: (...args: unknown[]) => getDataHealth(...args),
+}));
+
+import { useLLMDataHealth } from "./useLLMDataHealth";
+
+const params = { stream_name: "llm", start_time: 1, end_time: 2, agent: "a" };
+
+const response = (samples?: string[]) => ({
+  data: {
+    checked_at: 1,
+    checks: [
+      { id: "missing_session_id", status: "warning", affected: 2, total: 4, samples },
+      { id: "zero_duration_spans", status: "pass", affected: 0, total: 4, samples: samples && [] },
+    ],
+  },
+});
+
+beforeEach(() => {
+  getDataHealth.mockReset();
+});
+
+describe("useLLMDataHealth — samples", () => {
+  it("the default load asks for no samples; the drawer's request asks once", async () => {
+    const h = useLLMDataHealth();
+    getDataHealth.mockResolvedValueOnce(response());
+    await h.fetchHealth("org", params);
+    expect(getDataHealth).toHaveBeenCalledTimes(1);
+    expect(getDataHealth.mock.calls[0][1].include_samples).toBe(false);
+    expect(h.samples.value).toBeNull();
+
+    getDataHealth.mockResolvedValueOnce(response(["t1", "t2"]));
+    await h.fetchSamples();
+    expect(getDataHealth.mock.calls[1]).toEqual(["org", { ...params, include_samples: true }]);
+    expect(h.samples.value).toEqual({ missing_session_id: ["t1", "t2"], zero_duration_spans: [] });
+
+    // Loaded for this scope: reopening the drawer costs nothing.
+    await h.fetchSamples();
+    expect(getDataHealth).toHaveBeenCalledTimes(2);
+  });
+
+  it("a new scope clears the samples and drops a samples answer still in flight", async () => {
+    const h = useLLMDataHealth();
+    getDataHealth.mockResolvedValueOnce(response());
+    await h.fetchHealth("org", params);
+
+    const late = Promise.withResolvers<unknown>();
+    getDataHealth.mockReturnValueOnce(late.promise);
+    const pending = h.fetchSamples();
+
+    getDataHealth.mockResolvedValueOnce(response());
+    await h.fetchHealth("org", { ...params, agent: "b" });
+    late.resolve(response(["old"]));
+    await pending;
+    expect(h.samples.value).toBeNull();
+    expect(h.samplesLoading.value).toBe(false);
+  });
+});
+
+describe("useLLMDataHealth — scope changes", () => {
+  it("a new scope hides the previous answer while it loads", async () => {
+    const h = useLLMDataHealth();
+    getDataHealth.mockResolvedValueOnce(response());
+    await h.fetchHealth("org", params);
+    expect(h.health.value).not.toBeNull();
+
+    getDataHealth.mockReturnValueOnce(new Promise(() => {}));
+    void h.fetchHealth("org", { ...params, agent: "b" });
+    expect(h.health.value).toBeNull();
+    expect(h.checkedWindow.value).toBeNull();
+  });
+
+  it("a rerun of the same scope keeps the current answer while it loads", async () => {
+    const h = useLLMDataHealth();
+    getDataHealth.mockResolvedValueOnce(response());
+    await h.fetchHealth("org", params);
+
+    getDataHealth.mockReturnValueOnce(new Promise(() => {}));
+    void h.fetchHealth("org", { ...params, refresh: true });
+    expect(h.health.value).not.toBeNull();
+    expect(h.checkedWindow.value).toEqual({ start: 1, end: 2 });
+  });
+
+  it("invalid input clears the answer and drops a request still in flight", async () => {
+    const h = useLLMDataHealth();
+    const late = Promise.withResolvers<unknown>();
+    getDataHealth.mockReturnValueOnce(late.promise);
+    const pending = h.fetchHealth("org", params);
+
+    await h.fetchHealth("org", { ...params, stream_name: "" });
+    late.resolve(response());
+    await pending;
+    expect(h.health.value).toBeNull();
+    expect(h.checkedWindow.value).toBeNull();
+    expect(h.loading.value).toBe(false);
+  });
+});
diff --git a/web/src/plugins/traces/composables/useLLMDataHealth.ts b/web/src/plugins/traces/composables/useLLMDataHealth.ts
new file mode 100644
index 0000000000..daa72be163
--- /dev/null
+++ b/web/src/plugins/traces/composables/useLLMDataHealth.ts
@@ -0,0 +1,142 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { ref } from "vue";
+import {
+  getDataHealth,
+  type DataHealthCheckId,
+  type DataHealthParams,
+  type DataHealthResponse,
+} from "@/services/gen-ai-data-health.service";
+import type { TimeWindow } from "../llmDataTrust.utils";
+
+export type DataHealthSamples = Partial<Record<DataHealthCheckId, string[]>>;
+
+/** What a response describes: org, scope and window, but not `refresh`. */
+function scopeKey(orgId: string, p: DataHealthParams): string {
+  return JSON.stringify([
+    orgId,
+    p.stream_name,
+    p.agent,
+    p.agent_id,
+    p.env,
+    p.version,
+    p.start_time,
+    p.end_time,
+  ]);
+}
+
+/**
+ * AI data health for LLM Insights: one request per scope + window, shared by
+ * the health strip and the Total Cost tile (which reads the unpriced check).
+ * Sample trace ids cost an extra query per failing check, so they are
+ * fetched only on demand (the data health drawer) for the last scope + window.
+ * A response that lands after a newer request started is dropped.
+ */
+export function useLLMDataHealth() {
+  const health = ref<DataHealthResponse | null>(null);
+  /** The window `health` was checked over, so links can open the same window. */
+  const checkedWindow = ref<TimeWindow | null>(null);
+  const loading = ref(false);
+  const error = ref(false);
+  /** Samples per check for the last fetched scope + window; null until requested. */
+  const samples = ref<DataHealthSamples | null>(null);
+  const samplesLoading = ref(false);
+  let seq = 0;
+  let samplesSeq = 0;
+  let last: { orgId: string; params: DataHealthParams } | null = null;
+  let lastKey = "";
+
+  function clearSamples() {
+    samplesSeq++;
+    samples.value = null;
+    samplesLoading.value = false;
+  }
+
+  async function fetchHealth(orgId: string, params: DataHealthParams): Promise<void> {
+    if (!orgId || !params.stream_name || !params.start_time || !params.end_time) {
+      reset();
+      return;
+    }
+    const key = scopeKey(orgId, params);
+    if (key !== lastKey) {
+      // Another scope's answer must not show while this one loads.
+      health.value = null;
+      checkedWindow.value = null;
+      lastKey = key;
+    }
+    const mine = ++seq;
+    last = { orgId, params: { ...params, include_samples: false } };
+    clearSamples();
+    loading.value = true;
+    error.value = false;
+    try {
+      const res = await getDataHealth(orgId, last.params);
+      if (mine !== seq) return;
+      health.value = res.data;
+      checkedWindow.value = { start: params.start_time, end: params.end_time };
+    } catch (e) {
+      if (mine !== seq) return;
+      console.error("LLM data health fetch error:", e);
+      health.value = null;
+      checkedWindow.value = null;
+      error.value = true;
+    } finally {
+      if (mine === seq) loading.value = false;
+    }
+  }
+
+  /** Sample trace ids for the last scope + window; a no-op once loaded or loading. */
+  async function fetchSamples(): Promise<void> {
+    if (!last || samples.value !== null || samplesLoading.value) return;
+    const { orgId, params } = last;
+    const mine = ++samplesSeq;
+    samplesLoading.value = true;
+    try {
+      const res = await getDataHealth(orgId, { ...params, include_samples: true });
+      if (mine !== samplesSeq) return;
+      samples.value = Object.fromEntries(res.data.checks.map((c) => [c.id, c.samples ?? []]));
+    } catch (e) {
+      if (mine !== samplesSeq) return;
+      console.error("LLM data health samples fetch error:", e);
+      samples.value = {};
+    } finally {
+      if (mine === samplesSeq) samplesLoading.value = false;
+    }
+  }
+
+  function reset() {
+    seq++;
+    last = null;
+    lastKey = "";
+    clearSamples();
+    health.value = null;
+    checkedWindow.value = null;
+    loading.value = false;
+    error.value = false;
+  }
+
+  return {
+    health,
+    checkedWindow,
+    loading,
+    error,
+    samples,
+    samplesLoading,
+    fetchHealth,
+    fetchSamples,
+    reset,
+  };
+}
diff --git a/web/src/plugins/traces/composables/useLLMInsights.spec.ts b/web/src/plugins/traces/composables/useLLMInsights.spec.ts
index 857166fd6e..c705322ae4 100644
--- a/web/src/plugins/traces/composables/useLLMInsights.spec.ts
+++ b/web/src/plugins/traces/composables/useLLMInsights.spec.ts
@@ -44,6 +44,7 @@ vi.mock("@/utils/zincutils", () => ({
 import { describe, it, expect, vi, beforeEach } from "vitest";
 import { isRef } from "vue";
 import { useLLMInsights } from "./useLLMInsights";
+import { llmCallUsageSum } from "../config/llmInsightsPanels";
 
 beforeEach(() => {
   vi.clearAllMocks();
@@ -177,6 +178,45 @@ describe("useLLMInsights — fetchAll fires 2 parallel queries", () => {
     // No interval literal like histogram(_timestamp, '15 minutes').
     expect(sql).not.toMatch(/histogram\(_timestamp,/);
   });
+
+  // An agent span repeats its children's usage; the KPI totals must sum only
+  // LLM-call spans (same rule as the backend's trace/session totals).
+  it("sums tokens and cost only over LLM-call spans", () => {
+    const { fetchAll } = useLLMInsights();
+    fetchAll("default", 100, 200);
+
+    const calls = mockFetchQueryDataWithHttpStream.mock.calls;
+    const sql: string = calls.find(([p]) => p.queryReq.query.sql.includes("GROUP BY ts"))![0]
+      .queryReq.query.sql;
+    expect(sql).not.toMatch(/SUM\(\s*gen_ai_usage_/i);
+    expect(sql).toContain(
+      `COALESCE(${llmCallUsageSum("gen_ai_usage_total_tokens")}, 0) as total_tokens`,
+    );
+    expect(sql).toContain(`COALESCE(${llmCallUsageSum("gen_ai_usage_cost")}, 0) as total_cost`);
+  });
+
+  // Many SDKs tag only the agent span with the agent's identity, so an
+  // agent-scoped bucket may match no LLM-call span; it then sums what matched.
+  it("agent-scoped totals fall back to the matched spans when no LLM call matched", () => {
+    const { fetchAll } = useLLMInsights();
+    fetchAll("default", 100, 200, {
+      name: "support-agent",
+      source_stream: "default",
+      source_stream_type: "traces",
+    });
+
+    const sql: string = mockFetchQueryDataWithHttpStream.mock.calls.find(([p]) =>
+      p.queryReq.query.sql.includes("GROUP BY ts"),
+    )![0].queryReq.query.sql;
+    for (const [column, alias] of [
+      ["gen_ai_usage_total_tokens", "total_tokens"],
+      ["gen_ai_usage_cost", "total_cost"],
+    ]) {
+      expect(sql).toContain(
+        `COALESCE(NULLIF(${llmCallUsageSum(column)}, 0), SUM(${column}), 0) as ${alias}`,
+      );
+    }
+  });
 });
 
 describe("useLLMInsights — fetchAll resolves and populates KPI on success", () => {
diff --git a/web/src/plugins/traces/composables/useLLMInsights.ts b/web/src/plugins/traces/composables/useLLMInsights.ts
index 9115df0fdc..0f5e732838 100644
--- a/web/src/plugins/traces/composables/useLLMInsights.ts
+++ b/web/src/plugins/traces/composables/useLLMInsights.ts
@@ -18,7 +18,7 @@ import { gt } from "@/types/i18n";
 import { b64EncodeUnicode, generateTraceContext } from "@/utils/zincutils";
 import type { GenAiAgentListItem } from "@/services/gen-ai-agent-mapping.service";
 import { buildAgentTraceFilter } from "../llmAgentFilter";
-import { compactSql } from "../config/llmInsightsPanels";
+import { compactSql, llmCallUsageSum } from "../config/llmInsightsPanels";
 import useHttpStreaming from "@/composables/useStreamingSearch";
 import { useStore } from "vuex";
 
@@ -222,7 +222,12 @@ export function useLLMInsights() {
    * so the frontend never needs to know the interval.
    *
    * Summing is exact for the additive aggregates (SUM(tokens), SUM(cost),
-   * COUNT(requests)). `trace_count` / `error_count` use `approx_distinct`,
+   * COUNT(requests)). Tokens and cost sum over LLM-call spans only
+   * (`llmCallUsageSum`) so agent spans repeating their children's usage
+   * don't double-count. The agent filter matches spans, and many SDKs tag
+   * only the agent span with the agent's identity, so an agent-scoped bucket
+   * with no matching LLM-call usage falls back to summing the spans it did
+   * match. `trace_count` / `error_count` use `approx_distinct`,
    * so a trace with spans in two buckets is counted in both — the sums
    * can run slightly high, which is an accepted tradeoff for serving the
    * whole strip from one query. The error-rate CARD divides the summed
@@ -240,14 +245,18 @@ export function useLLMInsights() {
     const size = 10_000;
 
     const agentFilter = buildAgentTraceFilter(agent, streamName);
+    const usageSum = (column: string) =>
+      agentFilter
+        ? `COALESCE(NULLIF(${llmCallUsageSum(column)}, 0), SUM(${column}), 0)`
+        : `COALESCE(${llmCallUsageSum(column)}, 0)`;
     const mainSql = compactSql(`
       SELECT
         histogram(_timestamp) as ts,
         COUNT(*) FILTER (WHERE gen_ai_operation_name IS NOT NULL) as request_count,
         approx_distinct(trace_id) as trace_count,
         approx_distinct(trace_id) FILTER (WHERE span_status = 'ERROR') as error_count,
-        COALESCE(SUM(gen_ai_usage_total_tokens), 0) as total_tokens,
-        COALESCE(SUM(gen_ai_usage_cost), 0) as total_cost,
+        ${usageSum("gen_ai_usage_total_tokens")} as total_tokens,
+        ${usageSum("gen_ai_usage_cost")} as total_cost,
         COALESCE(approx_percentile_cont(duration, 0.95) FILTER (WHERE gen_ai_operation_name IS NOT NULL), 0) as p95_duration
       FROM "${streamName}"
       ${agentFilter ? `WHERE ${agentFilter}` : ""}
diff --git a/web/src/plugins/traces/composables/useSessions.ts b/web/src/plugins/traces/composables/useSessions.ts
index 833dcb5c43..ba97a6ea82 100644
--- a/web/src/plugins/traces/composables/useSessions.ts
+++ b/web/src/plugins/traces/composables/useSessions.ts
@@ -19,8 +19,10 @@ import { ref } from "vue";
 import { useStore } from "vuex";
 import sessionsService, { type SessionSortField, type SessionSortOrder } from "@/services/sessions";
 import { type GenAiAgentListItem } from "@/services/gen-ai-agent-mapping.service";
+import type { AgentsLoadError } from "@/enterprise/composables/useAgentScope";
 import { useLLMStreamQuery } from "./useLLMStreamQuery";
 import { compactSql } from "../config/llmInsightsPanels";
+import { unpricedFields } from "../llmDataTrust.utils";
 
 export interface SessionDetail {
   sessionId: string;
@@ -33,6 +35,9 @@ export interface SessionDetail {
   outputTokens: number;
   tokens: number;
   cost: number;
+  /** Tokens with no price (their cost is missing from `cost`) and their models. */
+  unpricedTokens: number;
+  unpricedModels: string[];
   cacheReadInputTokens: number;
   cacheCreationInputTokens: number;
   cacheReadInputCost: number;
@@ -53,6 +58,8 @@ export interface SessionTraceRow {
   outputTokens: number;
   tokens: number;
   cost: number;
+  unpricedTokens: number;
+  unpricedModels: string[];
   cacheReadInputTokens: number;
   cacheCreationInputTokens: number;
   cacheReadInputCost: number;
@@ -122,6 +129,8 @@ export interface SessionRow {
   outputTokens: number;
   tokens: number;
   cost: number;
+  unpricedTokens: number;
+  unpricedModels: string[];
   cacheReadInputTokens: number;
   cacheCreationInputTokens: number;
   cacheReadInputCost: number;
@@ -192,6 +201,10 @@ let fetchSeq = 0;
 // reset `agentsLoaded` to false and strand the agent picker on its skeleton.
 const agents = ref<GenAiAgentListItem[]>([]);
 const agentsLoaded = ref(false);
+const agentsError = ref<AgentsLoadError | null>(null);
+// The org `agents` belongs to: another org's list must not decide this org's
+// mode or fill its picker, so SessionsList resets the three above on a mismatch.
+const agentsOrg = ref<string | null>(null);
 
 /**
  * Composable owning the Sessions tab's list state and fetch flow.
@@ -276,6 +289,7 @@ export function useSessions() {
           outputTokens: Number(h.gen_ai_usage_output_tokens) || 0,
           tokens: Number(h.gen_ai_usage_total_tokens) || 0,
           cost: Number(h.gen_ai_usage_cost) || 0,
+          ...unpricedFields(h),
           cacheReadInputTokens: Number(h.gen_ai_usage_cache_read_input_tokens) || 0,
           cacheCreationInputTokens: Number(h.gen_ai_usage_cache_creation_input_tokens) || 0,
           cacheReadInputCost: Number(h.gen_ai_usage_cost_cache_read_input) || 0,
@@ -358,7 +372,8 @@ export function useSessions() {
     //   duration              → microseconds (server returns ns/1000)
     //   spans                 → [total_spans, error_spans] tuple
     //   service_name          → [{ service_name, count, duration }]
-    //   gen_ai_usage_*        → cumulative across all spans
+    //   gen_ai_usage_*        → summed over LLM-call spans (chat / text_completion /
+    //                           generate_content / embeddings, or no operation name)
     //   gen_ai_input_messages → FIRST_VALUE — the user question
     //
     // `startTimeMicros` / `durationNanos` on the row type are
@@ -400,6 +415,7 @@ export function useSessions() {
         outputTokens: Number(r.gen_ai_usage_output_tokens) || 0,
         tokens: Number(r.gen_ai_usage_total_tokens) || 0,
         cost: Number(r.gen_ai_usage_cost) || 0,
+        ...unpricedFields(r),
         cacheReadInputTokens: Number(r.gen_ai_usage_cache_read_input_tokens) || 0,
         cacheCreationInputTokens: Number(r.gen_ai_usage_cache_creation_input_tokens) || 0,
         cacheReadInputCost: Number(r.gen_ai_usage_cost_cache_read_input) || 0,
@@ -430,6 +446,8 @@ export function useSessions() {
     let totalEstimatedCostWithoutCache = 0;
     let totalCacheReadSavings = 0;
     let totalNetCacheImpact = 0;
+    let totalUnpricedTokens = 0;
+    const unpricedModels = new Set<string>();
     let totalErrors = 0;
     let userId: string | null = null;
     let serviceName: string | null = null;
@@ -444,6 +462,8 @@ export function useSessions() {
       totalOutputTokens += t.outputTokens;
       totalTokens += t.tokens;
       totalCost += t.cost;
+      totalUnpricedTokens += t.unpricedTokens;
+      for (const m of t.unpricedModels) unpricedModels.add(m);
       totalCacheReadInputTokens += t.cacheReadInputTokens;
       totalCacheCreationInputTokens += t.cacheCreationInputTokens;
       totalCacheReadInputCost += t.cacheReadInputCost;
@@ -473,6 +493,8 @@ export function useSessions() {
       outputTokens: totalOutputTokens,
       tokens: totalTokens,
       cost: totalCost,
+      unpricedTokens: totalUnpricedTokens,
+      unpricedModels: [...unpricedModels],
       cacheReadInputTokens: totalCacheReadInputTokens,
       cacheCreationInputTokens: totalCacheCreationInputTokens,
       cacheReadInputCost: totalCacheReadInputCost,
@@ -603,6 +625,8 @@ export function useSessions() {
     sortOrder,
     agents,
     agentsLoaded,
+    agentsError,
+    agentsOrg,
     fetchPage,
     fetchSession,
     fetchTurnDetail,
diff --git a/web/src/plugins/traces/composables/useTracesAlertAction.spec.ts b/web/src/plugins/traces/composables/useTracesAlertAction.spec.ts
new file mode 100644
index 0000000000..022b335fb8
--- /dev/null
+++ b/web/src/plugins/traces/composables/useTracesAlertAction.spec.ts
@@ -0,0 +1,237 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, vi, beforeEach, afterEach } from "vitest";
+import { defineComponent, reactive } from "vue";
+import { mount, flushPromises } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import searchService from "@/services/search";
+import {
+  alertCreationDialog,
+  closeAlertCreationDialog,
+  rebuildAlertPrefill,
+} from "@/composables/alerts/useAlertCreation";
+import { tracesSearchRunSignature } from "@/plugins/traces/tracesSearchBar.utils";
+
+vi.mock("@/services/search", () => ({ default: { search: vi.fn() } }));
+
+const state = vi.hoisted(() => ({ searchObj: null as any }));
+
+vi.mock("@/composables/useTraces", () => ({
+  default: () => ({ searchObj: state.searchObj, tracesParser: { value: null } }),
+}));
+
+const resolveSpy = vi.hoisted(() => vi.fn((text: string | undefined) => (text ?? "").trim()));
+vi.mock("@/utils/traces/resolveTracesFilter", () => ({ resolveTracesFilter: resolveSpy }));
+
+import { useTracesAlertAction } from "./useTracesAlertAction";
+
+const search = vi.mocked(searchService.search);
+
+const makeSearchObj = () =>
+  reactive({
+    meta: { searchMode: "traces", sqlMode: false, lastRunSignature: null as string | null },
+    data: {
+      editorValue: "service_name = 'checkout'",
+      stream: { selectedStream: { label: "default", value: "default" } as any },
+      datetime: { type: "relative", relativeTimePeriod: "15m", startTime: 0, endTime: 0 },
+    },
+  });
+
+const markRun = () => {
+  state.searchObj.meta.lastRunSignature = tracesSearchRunSignature(state.searchObj);
+};
+
+let action: ReturnType<typeof useTracesAlertAction>;
+const mountHost = () =>
+  mount(
+    defineComponent({
+      setup() {
+        action = useTracesAlertAction();
+        return () => null;
+      },
+    }),
+    { global: { plugins: [i18n, store] } },
+  );
+
+const respond = (row: Record<string, unknown> | null) =>
+  search.mockResolvedValue({ data: { hits: row ? [row] : [] } } as any);
+
+describe("useTracesAlertAction", () => {
+  beforeEach(() => {
+    state.searchObj = makeSearchObj();
+    search.mockReset();
+    resolveSpy.mockClear();
+    closeAlertCreationDialog();
+  });
+  afterEach(() => closeAlertCreationDialog());
+
+  it("is disabled with 'Pick a stream first' when no stream is selected", () => {
+    state.searchObj.data.stream.selectedStream = { label: "", value: "" };
+    mountHost();
+    expect(action.disabledReason.value).toBe("Pick a stream first");
+  });
+
+  it("is enabled once a stream is selected", () => {
+    mountHost();
+    expect(action.disabledReason.value).toBeNull();
+  });
+
+  it("seeds an Errors alert from one count over the capped period and opens the confirm dialog", async () => {
+    state.searchObj.data.datetime = {
+      type: "relative",
+      relativeTimePeriod: "6h",
+      startTime: 0,
+      endTime: 0,
+    };
+    markRun();
+    respond({ errors: 720 });
+    mountHost();
+    const before = Date.now() * 1000;
+    await action.createAlert("errors");
+    await flushPromises();
+
+    expect(search).toHaveBeenCalledTimes(2);
+    const [arg] = search.mock.calls[0];
+    expect(arg.page_type).toBe("traces");
+    expect(arg.query.query.sql).toBe(
+      "SELECT approx_distinct(trace_id) AS errors FROM \"default\" WHERE (service_name = 'checkout') AND span_status = 'ERROR'",
+    );
+    const { start_time, end_time } = arg.query.query;
+    expect(end_time).toBeGreaterThanOrEqual(before);
+    expect(end_time - start_time).toBe(60 * 60 * 1_000_000);
+
+    const prefill = alertCreationDialog.value?.prefill;
+    expect(alertCreationDialog.value?.open).toBe(true);
+    expect(prefill?.streamType).toBe("traces");
+    expect(prefill?.sql).toContain("HAVING approx_distinct(trace_id) > 1080");
+    expect(prefill?.triggerThreshold).toBe(1);
+    expect(prefill?.triggerOperator).toBe(">=");
+    expect(prefill?.warnings.map((w) => w.key)).toContain("tracesPeriodCapped");
+    expect(prefill?.warnings.map((w) => w.key)).not.toContain("tracesNotRun");
+  });
+
+  it("counts spans in the Spans view", async () => {
+    state.searchObj.meta.searchMode = "spans";
+    markRun();
+    respond({ matches: 10 });
+    mountHost();
+    await action.createAlert("matches");
+    expect(search.mock.calls[0][0].query.query.sql).toBe(
+      "SELECT count(*) AS matches FROM \"default\" WHERE service_name = 'checkout'",
+    );
+    expect(alertCreationDialog.value?.prefill.meta?.view).toBe("spans");
+  });
+
+  it("uses the editor's filter with a 'not run yet' note when the query has not run", async () => {
+    state.searchObj.data.editorValue = "duration > '500ms'";
+    respond({ matches: 3 });
+    mountHost();
+    await action.createAlert("matches");
+    expect(resolveSpy).toHaveBeenCalledWith("duration > '500ms'", null, "default");
+    const keys = alertCreationDialog.value?.prefill.warnings.map((w) => w.key);
+    expect(keys).toContain("tracesNotRun");
+  });
+
+  it("passes a null seed when the count fails", async () => {
+    markRun();
+    search.mockRejectedValue(new Error("boom"));
+    mountHost();
+    await action.createAlert("rate");
+    const prefill = alertCreationDialog.value?.prefill;
+    expect(prefill?.meta?.seed).toBeNull();
+    expect(prefill?.warnings.map((w) => w.key)).toContain("tracesSeedUnavailable");
+  });
+
+  it("treats a null seed value as unavailable instead of seeding 0", async () => {
+    markRun();
+    respond({ p95_duration: null, spans: 0 });
+    mountHost();
+    await action.createAlert("duration");
+    const prefill = alertCreationDialog.value?.prefill;
+    expect(prefill?.meta?.seed).toBeNull();
+    expect(prefill?.warnings.map((w) => w.key)).toContain("tracesSeedUnavailable");
+  });
+
+  it("ignores a second click while the seed queries are still running", async () => {
+    markRun();
+    respond({ matches: 5 });
+    mountHost();
+    const first = action.createAlert("matches");
+    const second = action.createAlert("matches");
+    await Promise.all([first, second]);
+    expect(search).toHaveBeenCalledTimes(1);
+
+    await action.createAlert("matches");
+    expect(search).toHaveBeenCalledTimes(2);
+  });
+
+  it("does nothing without a stream", async () => {
+    state.searchObj.data.stream.selectedStream = null;
+    mountHost();
+    await action.createAlert("errors");
+    expect(search).not.toHaveBeenCalled();
+    expect(alertCreationDialog.value).toBeNull();
+  });
+
+  it("offers Error count (default) and Error rate as query choices for Errors, and rebuilds on a pick", async () => {
+    markRun();
+    search.mockImplementation((async (arg: any) => {
+      const sql: string = arg.query.query.sql;
+      const row = sql.includes("AS error_rate")
+        ? { error_rate: 4.2, traces: 500 }
+        : { errors: 720 };
+      return { data: { hits: [row] } };
+    }) as any);
+    mountHost();
+    await action.createAlert("errors");
+
+    expect(search).toHaveBeenCalledTimes(2);
+    const prefill = alertCreationDialog.value!.prefill;
+    expect(prefill.queryChoices?.map((c) => c.tabName)).toEqual(["Error count", "Error rate"]);
+    expect(prefill.queryIndex).toBe(0);
+    expect(prefill.sql).toContain("HAVING approx_distinct(trace_id) > 1080");
+
+    rebuildAlertPrefill({ queryIndex: 1 });
+    const rebuilt = alertCreationDialog.value!.prefill;
+    expect(rebuilt.queryIndex).toBe(1);
+    expect(rebuilt.sql).toContain("AS error_rate");
+    expect(rebuilt.sql).toMatch(/HAVING CAST\(.+\) \* 100 \/ approx_distinct\(trace_id\) > 7 /);
+  });
+
+  it("offers p50/p95/p99 as query choices for Duration, p95 first, and rebuilds on a pick", async () => {
+    markRun();
+    search.mockImplementation((async (arg: any) => {
+      const sql: string = arg.query.query.sql;
+      const p = sql.match(/AS (p\d+)_duration/)![1];
+      const value = { p50: 1000, p95: 2000, p99: 3000 }[p];
+      return { data: { hits: [{ [`${p}_duration`]: value, spans: 100 }] } };
+    }) as any);
+    mountHost();
+    await action.createAlert("duration");
+
+    expect(search).toHaveBeenCalledTimes(3);
+    const prefill = alertCreationDialog.value!.prefill;
+    expect(prefill.queryChoices?.map((c) => c.tabName)).toEqual(["p50", "p95", "p99"]);
+    expect(prefill.queryIndex).toBe(1);
+    expect(prefill.sql).toContain("approx_percentile_cont(duration, 0.95) > 3000");
+
+    rebuildAlertPrefill({ queryIndex: 2 });
+    const rebuilt = alertCreationDialog.value!.prefill;
+    expect(rebuilt.queryIndex).toBe(2);
+    expect(rebuilt.sql).toContain("approx_percentile_cont(duration, 0.99) > 4500");
+  });
+});
diff --git a/web/src/plugins/traces/composables/useTracesAlertAction.ts b/web/src/plugins/traces/composables/useTracesAlertAction.ts
new file mode 100644
index 0000000000..7147cfbf8a
--- /dev/null
+++ b/web/src/plugins/traces/composables/useTracesAlertAction.ts
@@ -0,0 +1,144 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { computed } from "vue";
+import { useStore } from "vuex";
+import { raw, useI18nTyped } from "@/types/i18n";
+import useTraces from "@/composables/useTraces";
+import searchService from "@/services/search";
+import { requestAlertCreation } from "@/composables/alerts/useAlertCreation";
+import { warn } from "@/utils/alerts/alertPrefill";
+import {
+  buildPrefillFromTraces,
+  buildTracesSeedQuery,
+  tracesAlertPeriod,
+  type TracesAlertMetric,
+  type TracesAlertPercentile,
+  type TracesPrefillInput,
+} from "@/utils/alerts/prefill/fromTraces";
+import type { AlertBuildOptions, AlertPrefill } from "@/ts/interfaces/alertPrefill";
+import { resolveTracesFilter } from "@/utils/traces/resolveTracesFilter";
+import { tracesSearchRunSignature } from "@/plugins/traces/tracesSearchBar.utils";
+
+const DURATION_PERCENTILES: TracesAlertPercentile[] = [0.5, 0.95, 0.99];
+const DEFAULT_DURATION_INDEX = 1;
+const ERROR_METRICS: TracesAlertMetric[] = ["errors", "error_ratio"];
+
+/** Create alert from the Traces page: seeds the threshold from the current value, then opens the confirm dialog. */
+export const useTracesAlertAction = () => {
+  const store = useStore();
+  const { t } = useI18nTyped();
+  const { searchObj, tracesParser } = useTraces();
+
+  const streamName = computed<string>(() => searchObj.data.stream.selectedStream?.value ?? "");
+
+  const disabledReason = computed(() =>
+    streamName.value ? null : t("alerts.prefill.sources.traces.noStream"),
+  );
+
+  const queryNotRun = computed(
+    () => searchObj.meta.lastRunSignature !== tracesSearchRunSignature(searchObj),
+  );
+
+  const readSeed = async (input: TracesPrefillInput, startUs: number, endUs: number) => {
+    const { sql, valueColumn } = buildTracesSeedQuery(input);
+    try {
+      const res = await searchService.search(
+        {
+          org_identifier: store.state.selectedOrganization.identifier,
+          query: { query: { sql, start_time: startUs, end_time: endUs, from: 0, size: 1 } },
+          page_type: "traces",
+        },
+        "ui",
+      );
+      const value = res?.data?.hits?.[0]?.[valueColumn];
+      if (value === undefined || value === null) return null;
+      const seed = Number(value);
+      return Number.isFinite(seed) ? seed : null;
+    } catch {
+      return null;
+    }
+  };
+
+  let creating = false;
+
+  const createAlert = async (metric: TracesAlertMetric): Promise<void> => {
+    const stream = streamName.value;
+    if (!stream || creating) return;
+
+    const { type, relativeTimePeriod, startTime, endTime } = searchObj.data.datetime;
+    const input: TracesPrefillInput = {
+      streamName: stream,
+      filter: resolveTracesFilter(searchObj.data.editorValue, tracesParser.value, stream),
+      view: searchObj.meta.searchMode === "spans" ? "spans" : "traces",
+      metric,
+      datetime: {
+        type: type === "absolute" ? "absolute" : "relative",
+        relativeTimePeriod,
+        startTime,
+        endTime,
+      },
+    };
+    const notRun = queryNotRun.value;
+
+    const { minutes } = tracesAlertPeriod(input.datetime);
+    const endUs = Date.now() * 1000;
+    const startUs = endUs - minutes * 60 * 1_000_000;
+
+    const isDuration = metric === "duration";
+    const isErrors = metric === "errors";
+    const variants: TracesPrefillInput[] = isDuration
+      ? DURATION_PERCENTILES.map((percentile) => ({ ...input, percentile }))
+      : isErrors
+        ? ERROR_METRICS.map((errorMetric) => ({ ...input, metric: errorMetric }))
+        : [input];
+    creating = true;
+    let seeds: (number | null)[];
+    try {
+      seeds = await Promise.all(variants.map((variant) => readSeed(variant, startUs, endUs)));
+    } finally {
+      creating = false;
+    }
+
+    const choiceLabel = (variant: TracesPrefillInput) =>
+      isDuration
+        ? raw(`p${Math.round((variant.percentile ?? 0.95) * 100)}`)
+        : variant.metric === "error_ratio"
+          ? t("alerts.prefill.sources.traces.errorRate")
+          : t("alerts.prefill.sources.traces.errorCount");
+
+    const build = (options: AlertBuildOptions = {}): AlertPrefill => {
+      const defaultIndex = isDuration ? DEFAULT_DURATION_INDEX : 0;
+      const index = variants.length > 1 ? (options.queryIndex ?? defaultIndex) : 0;
+      const prefill = buildPrefillFromTraces(variants[index], seeds[index]);
+      if (notRun) prefill.warnings.push(warn("tracesNotRun", "info"));
+      if (variants.length === 1) return prefill;
+      return {
+        ...prefill,
+        queryIndex: index,
+        queryChoices: variants.map((variant, choiceIndex) => ({
+          index: choiceIndex,
+          tabName: choiceLabel(variant),
+          query: buildPrefillFromTraces(variant, seeds[choiceIndex]).sql ?? "",
+        })),
+      };
+    };
+
+    // Always confirmed: the seeded threshold is stated there before the form opens.
+    requestAlertCreation(build(), {}, build);
+  };
+
+  return { createAlert, disabledReason, queryNotRun, streamName };
+};
diff --git a/web/src/plugins/traces/config/llmInsightsPanels.spec.ts b/web/src/plugins/traces/config/llmInsightsPanels.spec.ts
index f14c3f24aa..a862e192d6 100644
--- a/web/src/plugins/traces/config/llmInsightsPanels.spec.ts
+++ b/web/src/plugins/traces/config/llmInsightsPanels.spec.ts
@@ -13,6 +13,7 @@ import {
   renderPanelSql,
   compactSql,
   pickInterval,
+  llmCallUsageSum,
   type LLMPanelDef,
 } from "./llmInsightsPanels";
 
@@ -372,3 +373,68 @@ describe("LLM_INSIGHTS_PANELS — registry invariants", () => {
     expect(fields).toContain("trace_id");
   });
 });
+
+/**
+ * Evaluate a generated `SUM(CASE WHEN <op predicate> THEN col ELSE 0 END)`
+ * over in-memory spans: reads the IN list and the IS NULL branch out of the
+ * SQL so the test checks what the query would actually sum.
+ */
+function evalUsageSum(
+  sql: string,
+  column: string,
+  spans: Array<Record<string, string | number | null>>,
+): number {
+  const ops = [
+    ...(sql.match(/gen_ai_operation_name IN \(([^)]*)\)/)?.[1] ?? "").matchAll(/'([^']+)'/g),
+  ].map((m) => m[1]);
+  const nullCounts = /gen_ai_operation_name IS NULL OR/.test(sql);
+  expect(sql).toContain(`THEN ${column} ELSE 0 END`);
+  return spans
+    .filter((s) => {
+      const op = s.gen_ai_operation_name;
+      return op == null ? nullCounts : ops.includes(String(op));
+    })
+    .reduce((acc, s) => acc + Number(s[column] ?? 0), 0);
+}
+
+describe("llmCallUsageSum", () => {
+  // An agent span repeats its children's usage; only the LLM calls count.
+  it("sums an agent span with two chat children to the children's total", () => {
+    const spans = [
+      { gen_ai_operation_name: "invoke_agent", gen_ai_usage_total_tokens: 60 },
+      { gen_ai_operation_name: "chat", gen_ai_usage_total_tokens: 30 },
+      { gen_ai_operation_name: "chat", gen_ai_usage_total_tokens: 30 },
+    ];
+    const sql = llmCallUsageSum("gen_ai_usage_total_tokens");
+    expect(evalUsageSum(sql, "gen_ai_usage_total_tokens", spans)).toBe(60);
+  });
+
+  it("counts every generation operation and spans with no operation name", () => {
+    const spans = [
+      { gen_ai_operation_name: "text_completion", gen_ai_usage_cost: 1 },
+      { gen_ai_operation_name: "generate_content", gen_ai_usage_cost: 2 },
+      { gen_ai_operation_name: "embeddings", gen_ai_usage_cost: 4 },
+      { gen_ai_operation_name: null, gen_ai_usage_cost: 8 },
+      { gen_ai_operation_name: "execute_tool", gen_ai_usage_cost: 16 },
+      { gen_ai_operation_name: "create_agent", gen_ai_usage_cost: 32 },
+    ];
+    const sql = llmCallUsageSum("gen_ai_usage_cost");
+    expect(evalUsageSum(sql, "gen_ai_usage_cost", spans)).toBe(15);
+  });
+
+  it("every panel sums usage columns only over LLM-call spans", () => {
+    const usagePanels = LLM_INSIGHTS_PANELS.filter((p) => /gen_ai_usage_/.test(p.query.sql));
+    expect(usagePanels.length).toBeGreaterThan(0);
+    for (const p of usagePanels) {
+      const sql = compactSql(p.query.sql);
+      expect(sql, `panel ${p.id} sums usage over every span`).not.toMatch(/SUM\(\s*gen_ai_usage_/i);
+      const column = sql.match(/THEN (gen_ai_usage_\w+) ELSE 0 END/)![1];
+      const spans = [
+        { gen_ai_operation_name: "invoke_agent", [column]: 60 },
+        { gen_ai_operation_name: "chat", [column]: 30 },
+        { gen_ai_operation_name: "chat", [column]: 30 },
+      ];
+      expect(evalUsageSum(sql, column, spans), `panel ${p.id}`).toBe(60);
+    }
+  });
+});
diff --git a/web/src/plugins/traces/config/llmInsightsPanels.ts b/web/src/plugins/traces/config/llmInsightsPanels.ts
index 41cd931405..e3a1373fe3 100644
--- a/web/src/plugins/traces/config/llmInsightsPanels.ts
+++ b/web/src/plugins/traces/config/llmInsightsPanels.ts
@@ -135,6 +135,29 @@ const OBSERVATION_TYPE_FIELD = `gen_ai_operation_name`;
 // ~9x the real model and its token bar was always a flat zero.
 const modelScopedFilter = `${baseFilter} AND ${MODEL_FIELD} IS NOT NULL`;
 
+// Operations that are LLM calls (mirrors GENERATION_GEN_AI_OPERATIONS in
+// src/config/src/meta/traces.rs). Agent/workflow spans repeat their children's
+// usage, so summing every span double-counts tokens and cost.
+const GENERATION_GEN_AI_OPERATIONS = ["chat", "text_completion", "generate_content", "embeddings"];
+
+/**
+ * SUM of a usage column over LLM-call spans only — the same rule the backend
+ * applies to trace/session totals. A span without an operation name counts.
+ *
+ * Every LLM Insights query already references `gen_ai_operation_name`, so a
+ * stream without that column fails at parse time and lands on the "no LLM
+ * fields" empty state; there is no plain-SUM fallback to pick here.
+ *
+ * @example
+ *   llmCallUsageSum("gen_ai_usage_cost")
+ *   // => SUM(CASE WHEN (gen_ai_operation_name IS NULL OR gen_ai_operation_name IN ('chat', ...)) THEN gen_ai_usage_cost ELSE 0 END)
+ */
+export function llmCallUsageSum(column: string): string {
+  const ops = GENERATION_GEN_AI_OPERATIONS.map((op) => `'${op}'`).join(", ");
+  const predicate = `(${OBSERVATION_TYPE_FIELD} IS NULL OR ${OBSERVATION_TYPE_FIELD} IN (${ops}))`;
+  return `SUM(CASE WHEN ${predicate} THEN ${column} ELSE 0 END)`;
+}
+
 export const LLM_INSIGHTS_PANELS: LLMPanelDef[] = [
   {
     id: "cost-trend",
@@ -150,7 +173,7 @@ export const LLM_INSIGHTS_PANELS: LLMPanelDef[] = [
         SELECT
           histogram(_timestamp, '{{interval}}') as ts,
           ${MODEL_FIELD} as model,
-          COALESCE(SUM(${COST_FIELD}), 0) as cost
+          COALESCE(${llmCallUsageSum(COST_FIELD)}, 0) as cost
         FROM {{stream}}
         WHERE ${modelScopedFilter}
         GROUP BY ts, ${MODEL_FIELD}
@@ -173,7 +196,7 @@ export const LLM_INSIGHTS_PANELS: LLMPanelDef[] = [
         SELECT
           histogram(_timestamp, '{{interval}}') as ts,
           ${MODEL_FIELD} as model,
-          COALESCE(SUM(${TOKENS_FIELD}), 0) as tokens
+          COALESCE(${llmCallUsageSum(TOKENS_FIELD)}, 0) as tokens
         FROM {{stream}}
         WHERE ${modelScopedFilter}
         GROUP BY ts, ${MODEL_FIELD}
@@ -323,7 +346,7 @@ export const LLM_INSIGHTS_PANELS: LLMPanelDef[] = [
       sql: `
         SELECT
           ${MODEL_FIELD} as model,
-          COALESCE(SUM(${TOKENS_FIELD}), 0) as tokens
+          COALESCE(${llmCallUsageSum(TOKENS_FIELD)}, 0) as tokens
         FROM {{stream}}
         WHERE ${modelScopedFilter}
         GROUP BY ${MODEL_FIELD}
diff --git a/web/src/plugins/traces/llmDataTrust.utils.spec.ts b/web/src/plugins/traces/llmDataTrust.utils.spec.ts
new file mode 100644
index 0000000000..2225076699
--- /dev/null
+++ b/web/src/plugins/traces/llmDataTrust.utils.spec.ts
@@ -0,0 +1,167 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import {
+  costKind,
+  fixTarget,
+  healthCounts,
+  pricingGapsRoute,
+  sortChecks,
+  unpricedFields,
+  unpricedSummary,
+} from "./llmDataTrust.utils";
+import type { DataHealthCheck } from "@/services/gen-ai-data-health.service";
+
+const check = (over: Partial<DataHealthCheck>): DataHealthCheck => ({
+  id: "zero_duration_spans",
+  status: "pass",
+  affected: 0,
+  total: 10,
+  samples: [],
+  ...over,
+});
+
+describe("costKind", () => {
+  it("is exact without unpriced tokens, partial with some, unknown when nothing is priced", () => {
+    expect(costKind(0.5, 100, 0)).toBe("exact");
+    expect(costKind(0, 0, 0)).toBe("exact");
+    // An exactly matched free/muted price has tokens and a real $0 cost, but
+    // contributes no unpriced tokens to the cell's aggregate.
+    expect(costKind(0, 100, 0)).toBe("exact");
+    expect(costKind(0.5, 100, 40)).toBe("partial");
+    expect(costKind(0, 100, 40)).toBe("unknown");
+    expect(costKind(0.5, 100, 100)).toBe("unknown");
+  });
+});
+
+describe("unpricedFields", () => {
+  it("tolerates rows from servers without the fields", () => {
+    expect(unpricedFields({})).toEqual({ unpricedTokens: 0, unpricedModels: [] });
+    expect(
+      unpricedFields({ gen_ai_unpriced_tokens: "12", gen_ai_unpriced_models: ["a", null] }),
+    ).toEqual({ unpricedTokens: 12, unpricedModels: ["a"] });
+  });
+});
+
+describe("unpricedSummary", () => {
+  it("sums model tokens of the recorded unpriced spans and is null when there are none", () => {
+    expect(unpricedSummary(null)).toBeNull();
+    const clean = { checked_at: 1, checks: [check({ id: "unpriced_models" })] };
+    expect(unpricedSummary(clean)).toBeNull();
+    const failing = {
+      checked_at: 1,
+      checks: [
+        check({
+          id: "unpriced_models",
+          status: "error",
+          affected: 3,
+          models: [
+            { model: "acme", spans: 2, tokens: 900 },
+            { model: "other", spans: 1, tokens: 100 },
+          ],
+        }),
+      ],
+    };
+    expect(unpricedSummary(failing)).toMatchObject({ tokens: 1000, spans: 3, pricedSince: false });
+  });
+
+  it("keeps spans recorded before a price was added as a lower bound once the check passes", () => {
+    const pricedSince = {
+      checked_at: 1,
+      checks: [
+        check({
+          id: "unpriced_models",
+          status: "pass",
+          affected: 2,
+          unpriced_tokens: 500,
+          models: [{ model: "acme", spans: 2, tokens: 500 }],
+        }),
+      ],
+    };
+    expect(unpricedSummary(pricedSince)).toMatchObject({
+      tokens: 500,
+      spans: 2,
+      pricedSince: true,
+    });
+  });
+
+  it("takes the uncapped totals, not the length or sum of the capped list", () => {
+    const models = Array.from({ length: 20 }, (_, i) => ({ model: `m${i}`, spans: 1, tokens: 10 }));
+    const health = {
+      checked_at: 1,
+      checks: [
+        check({
+          id: "unpriced_models",
+          status: "error",
+          affected: 30,
+          models,
+          model_count: 25,
+          unpriced_tokens: 5000,
+          models_truncated: true,
+        }),
+      ],
+    };
+    expect(unpricedSummary(health)).toMatchObject({
+      tokens: 5000,
+      modelCount: 25,
+      truncated: true,
+      spans: 30,
+    });
+  });
+});
+
+describe("health checks", () => {
+  it("counts and orders worst first", () => {
+    const checks = [
+      check({ id: "missing_session_id" }),
+      check({ id: "zero_duration_spans", status: "warning", affected: 2 }),
+      check({ id: "unpriced_models", status: "error", affected: 1 }),
+    ];
+    expect(healthCounts(checks)).toEqual({ errors: 1, warnings: 1, passing: 1 });
+    expect(sortChecks(checks).map((c) => c.id)).toEqual([
+      "unpriced_models",
+      "zero_duration_spans",
+      "missing_session_id",
+    ]);
+  });
+
+  it("links each check to its fix", () => {
+    expect(fixTarget("unpriced_models", "default", "org1")).toEqual({
+      kind: "route",
+      to: {
+        name: "modelPricingGaps",
+        query: { stream: "default", org_identifier: "org1" },
+      },
+    });
+    expect(fixTarget("missing_agent_identity", "default", "org1")).toMatchObject({
+      kind: "route",
+      to: { name: "genAiAgentMapping" },
+    });
+    expect(fixTarget("zero_duration_spans", "default", "org1").kind).toBe("url");
+  });
+
+  it("carries the counted window to Pricing gaps, and drops an unset one", () => {
+    expect(fixTarget("unpriced_models", "default", "org1", { start: 100, end: 200 })).toMatchObject(
+      {
+        to: { query: { stream: "default", start_time: "100", end_time: "200" } },
+      },
+    );
+    expect(pricingGapsRoute("default", "org1", { start: 0, end: 0 }).query).toEqual({
+      stream: "default",
+      org_identifier: "org1",
+    });
+  });
+});
diff --git a/web/src/plugins/traces/llmDataTrust.utils.ts b/web/src/plugins/traces/llmDataTrust.utils.ts
new file mode 100644
index 0000000000..fd8968115d
--- /dev/null
+++ b/web/src/plugins/traces/llmDataTrust.utils.ts
@@ -0,0 +1,154 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Cost trust (unpriced / partial cost) and AI data health helpers shared by
+// LLM Insights, Sessions and Traces. Ingest leaves `gen_ai_usage_cost` null and
+// sets `gen_ai_usage_cost_status = 'unpriced'` when no price matches a model, and
+// the trace/session APIs report those tokens as `gen_ai_unpriced_tokens`.
+
+import type {
+  DataHealthCheck,
+  DataHealthCheckId,
+  DataHealthModelUsage,
+  DataHealthResponse,
+} from "@/services/gen-ai-data-health.service";
+
+/** How a row's cost reads: exact, a lower bound, or unknown. */
+export type CostKind = "exact" | "partial" | "unknown";
+
+export function costKind(cost: number, tokens: number, unpricedTokens: number): CostKind {
+  if (!(unpricedTokens > 0)) return "exact";
+  // Nothing priced: the recorded $0 is not a cost.
+  if (!(cost > 0) || unpricedTokens >= tokens) return "unknown";
+  return "partial";
+}
+
+/** Reads the per-row unpriced fields the trace / session APIs return (absent on older servers). */
+export function unpricedFields(hit: {
+  gen_ai_unpriced_tokens?: unknown;
+  gen_ai_unpriced_models?: unknown;
+}): { unpricedTokens: number; unpricedModels: string[] } {
+  const raw = hit?.gen_ai_unpriced_models;
+  const models = Array.isArray(raw)
+    ? raw.filter((m): m is string => typeof m === "string" && m.length > 0)
+    : [];
+  return { unpricedTokens: Number(hit?.gen_ai_unpriced_tokens) || 0, unpricedModels: models };
+}
+
+export interface UnpricedTotals {
+  /** Every distinct unpriced model; `models` lists at most 20 of them. */
+  modelCount: number;
+  /** Tokens on every unpriced span. */
+  tokens: number;
+  /** `models` holds only the models with the most tokens, not all `modelCount`. */
+  truncated: boolean;
+  models: DataHealthModelUsage[];
+}
+
+/** The unpriced check's uncapped totals from the server, not the length or sum of its list. */
+export function unpricedTotals(check: DataHealthCheck): UnpricedTotals {
+  const models = check.models ?? [];
+  return {
+    modelCount: check.model_count ?? models.length,
+    tokens: check.unpriced_tokens ?? models.reduce((sum, m) => sum + (Number(m.tokens) || 0), 0),
+    truncated: !!check.models_truncated,
+    models,
+  };
+}
+
+export interface UnpricedSummary extends UnpricedTotals {
+  spans: number;
+  /** Every model now has a price; the spans were recorded at $0 before it was added. */
+  pricedSince: boolean;
+}
+
+/** The spans recorded unpriced, for the cost tile and charts; null when there are none. */
+export function unpricedSummary(
+  health: DataHealthResponse | null | undefined,
+): UnpricedSummary | null {
+  const check = health?.checks.find((c) => c.id === "unpriced_models");
+  if (!check || check.affected <= 0) return null;
+  return { ...unpricedTotals(check), spans: check.affected, pricedSince: check.status === "pass" };
+}
+
+export interface HealthCounts {
+  errors: number;
+  warnings: number;
+  passing: number;
+}
+
+export function healthCounts(checks: DataHealthCheck[]): HealthCounts {
+  return checks.reduce<HealthCounts>(
+    (acc, c) => {
+      if (c.status === "error") acc.errors += 1;
+      else if (c.status === "warning") acc.warnings += 1;
+      else acc.passing += 1;
+      return acc;
+    },
+    { errors: 0, warnings: 0, passing: 0 },
+  );
+}
+
+/** Worst first (error, warning, pass), keeping the server order within a status. */
+export function sortChecks(checks: DataHealthCheck[]): DataHealthCheck[] {
+  const rank = { error: 0, warning: 1, pass: 2 } as const;
+  return [...checks].sort((a, b) => rank[a.status] - rank[b.status]);
+}
+
+export const AI_INSTRUMENTATION_DOCS_URL = "https://openobserve.ai/docs/integration/ai/";
+
+export type FixTarget =
+  | { kind: "route"; to: { name: string; query: Record<string, string> } }
+  | { kind: "url"; href: string };
+
+/** A time window in epoch microseconds. */
+export interface TimeWindow {
+  start: number;
+  end: number;
+}
+
+/** Where each check is fixed: a setting when one exists, else the instrumentation docs. */
+export function fixTarget(
+  id: DataHealthCheckId,
+  stream: string,
+  orgId: string,
+  window?: TimeWindow | null,
+): FixTarget {
+  switch (id) {
+    case "unpriced_models":
+      return {
+        kind: "route",
+        to: pricingGapsRoute(stream, orgId, window),
+      };
+    case "missing_agent_identity":
+      return { kind: "route", to: { name: "genAiAgentMapping", query: { org_identifier: orgId } } };
+    case "zero_duration_spans":
+    case "missing_session_id":
+      return { kind: "url", href: AI_INSTRUMENTATION_DOCS_URL };
+  }
+}
+
+/**
+ * Route to Model Pricing's Pricing gaps page for `stream`. Pass the window the linking
+ * page counted over, or the page lists only the last 24 h and can miss what the link named.
+ */
+export function pricingGapsRoute(stream: string, orgId: string, window?: TimeWindow | null) {
+  const query: Record<string, string> = { stream, org_identifier: orgId };
+  if (window && window.start > 0 && window.end > window.start) {
+    query.start_time = String(window.start);
+    query.end_time = String(window.end);
+  }
+  return { name: "modelPricingGaps", query };
+}
diff --git a/web/src/plugins/traces/llmInsightsEmptyState.spec.ts b/web/src/plugins/traces/llmInsightsEmptyState.spec.ts
new file mode 100644
index 0000000000..83b624f947
--- /dev/null
+++ b/web/src/plugins/traces/llmInsightsEmptyState.spec.ts
@@ -0,0 +1,65 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// Which integration guide the LLM Insights empty state suggests, from the docs
+// page the user came from, and the most-read guides it links as chips.
+
+import { describe, it, expect } from "vitest";
+import {
+  POPULAR_AI_INTEGRATION_ROUTES,
+  aiIntegrationByRoute,
+  referredAiIntegration,
+} from "./llmInsightsEmptyState";
+
+describe("referredAiIntegration", () => {
+  it("maps an integration's docs page (and pages under it) to that integration", () => {
+    expect(
+      referredAiIntegration(["https://openobserve.ai/docs/integration/ai/claude-code-tracing/"])
+        ?.routeName,
+    ).toBe("ai-claude-code");
+    expect(
+      referredAiIntegration([
+        "https://openobserve.ai/docs/integration/ai/providers/deepseek/#setup",
+      ])?.routeName,
+    ).toBe("ai-deepseek");
+    expect(
+      referredAiIntegration(["https://openobserve.ai/docs/integration/ai/tools/mcp-use"])
+        ?.routeName,
+    ).toBe("ai-mcp-use");
+  });
+
+  it("takes the first referrer that names an integration", () => {
+    expect(
+      referredAiIntegration([
+        undefined,
+        "https://openobserve.ai/docs/integration/ai/providers/google-gemini/",
+      ])?.routeName,
+    ).toBe("ai-google-gemini");
+  });
+
+  it("ignores other hosts, non-integration docs pages and garbage", () => {
+    expect(
+      referredAiIntegration([
+        "https://example.com/docs/integration/ai/providers/deepseek/",
+        "https://openobserve.ai/docs/getting-started/",
+        "not a url",
+        "",
+        null,
+      ]),
+    ).toBeUndefined();
+  });
+
+  it("does not match a docs path that only shares a prefix with a guide", () => {
+    expect(
+      referredAiIntegration(["https://openobserve.ai/docs/integration/ai/providers/deepseek-r2/"])
+        ?.routeName,
+    ).not.toBe("ai-deepseek");
+  });
+});
+
+describe("POPULAR_AI_INTEGRATION_ROUTES", () => {
+  it("names only integrations that exist in the catalog", () => {
+    for (const route of POPULAR_AI_INTEGRATION_ROUTES) {
+      expect(aiIntegrationByRoute(route)?.routeName).toBe(route);
+    }
+  });
+});
diff --git a/web/src/plugins/traces/llmInsightsEmptyState.ts b/web/src/plugins/traces/llmInsightsEmptyState.ts
new file mode 100644
index 0000000000..2b7cf730e5
--- /dev/null
+++ b/web/src/plugins/traces/llmInsightsEmptyState.ts
@@ -0,0 +1,75 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// Which AI integration guides the LLM Insights empty state links to: the guides
+// AI-docs visitors read most, and the one whose docs page the user came from.
+
+import { aiCategories, type AIIntegration } from "@/components/ingestion/ai/data";
+
+/** Route names of the guides AI-docs visitors read most, in the order the chips show. */
+export const POPULAR_AI_INTEGRATION_ROUTES = [
+  "ai-mcp-use",
+  "ai-deepseek",
+  "ai-google-gemini",
+  "ai-claude-code",
+  "ai-openai-python",
+] as const;
+
+export function aiIntegrationByRoute(routeName: string): AIIntegration | undefined {
+  for (const category of aiCategories) {
+    const hit = category.integrations.find((i) => i.routeName === routeName);
+    if (hit) return hit;
+  }
+  return undefined;
+}
+
+const docsPath = (url: URL) => url.pathname.toLowerCase().replace(/\/+$/, "");
+
+/**
+ * The integration whose openobserve.ai docs page one of `referrers` is (or sits
+ * under), checked in order; the deepest docs path wins within one referrer.
+ * Undefined when none is an AI integration docs page.
+ */
+export function referredAiIntegration(
+  referrers: readonly (string | null | undefined)[],
+): AIIntegration | undefined {
+  for (const referrer of referrers) {
+    if (!referrer) continue;
+    let url: URL;
+    try {
+      url = new URL(referrer);
+    } catch {
+      continue;
+    }
+    const host = url.hostname.toLowerCase();
+    if (host !== "openobserve.ai" && !host.endsWith(".openobserve.ai")) continue;
+    const path = docsPath(url);
+    let best: { integration: AIIntegration; length: number } | undefined;
+    for (const category of aiCategories) {
+      for (const integration of category.integrations) {
+        let guide: string;
+        try {
+          guide = docsPath(new URL(integration.docURL));
+        } catch {
+          continue;
+        }
+        if (path !== guide && !path.startsWith(`${guide}/`)) continue;
+        if (!best || guide.length > best.length) best = { integration, length: guide.length };
+      }
+    }
+    if (best) return best.integration;
+  }
+  return undefined;
+}
diff --git a/web/src/plugins/traces/metrics/TracesLatencyHeatmap.spec.ts b/web/src/plugins/traces/metrics/TracesLatencyHeatmap.spec.ts
index 932033d53d..c70c11abc3 100644
--- a/web/src/plugins/traces/metrics/TracesLatencyHeatmap.spec.ts
+++ b/web/src/plugins/traces/metrics/TracesLatencyHeatmap.spec.ts
@@ -116,6 +116,11 @@ const mountHeatmap = async (
   return wrapper;
 };
 
+const selectionDropdown = (wrapper: any) =>
+  wrapper
+    .findAllComponents({ name: "ODropdown" })
+    .find((dropdown: any) => dropdown.props("side") === "right");
+
 const options = (wrapper: any) =>
   wrapper.findComponent({ name: "ChartRenderer" }).props("data").options;
 
@@ -259,6 +264,35 @@ describe("TracesLatencyHeatmap", () => {
     });
   });
 
+  describe("header actions", () => {
+    const inlineMenu = {
+      ODropdown: { template: "<div><slot name='trigger' /><slot /></div>" },
+      ODropdownItem: {
+        emits: ["select"],
+        template: "<div v-bind='$attrs' @click=\"$emit('select')\"><slot /></div>",
+      },
+    };
+
+    it("shows a labelled ⋮ on the Duration header", async () => {
+      wrapper = await mountHeatmap(undefined, inlineMenu);
+      const btn = wrapper.find('[data-test="traces-duration-actions-btn"]');
+      expect(btn.exists()).toBe(true);
+      expect(btn.attributes("aria-label")).toBe(i18n.global.t("traces.redActions.durationActions"));
+    });
+
+    it("emits create-alert from Create alert", async () => {
+      wrapper = await mountHeatmap(undefined, inlineMenu);
+      await wrapper.find('[data-test="traces-duration-create-alert"]').trigger("click");
+      expect(wrapper.emitted("create-alert")).toHaveLength(1);
+    });
+
+    it("emits add-to-dashboard from Add to dashboard", async () => {
+      wrapper = await mountHeatmap(undefined, inlineMenu);
+      await wrapper.find('[data-test="traces-duration-add-to-dashboard"]').trigger("click");
+      expect(wrapper.emitted("add-to-dashboard")).toHaveLength(1);
+    });
+  });
+
   describe("chart option", () => {
     it("uses two category axes, a hidden x/y box zoom and a hidden visual map", async () => {
       wrapper = await mountHeatmap();
@@ -642,7 +676,7 @@ describe("TracesLatencyHeatmap", () => {
     it("leaves the box and the parent selection alone when the menu is dismissed outside", async () => {
       wrapper = await mountAttached();
       await drawBox();
-      wrapper.findComponent({ name: "ODropdown" }).vm.$emit("update:open", false);
+      selectionDropdown(wrapper).vm.$emit("update:open", false);
       await settle();
       expect(drawn().exists()).toBe(true);
       expect(wrapper.emitted("clear")).toBeUndefined();
@@ -651,7 +685,7 @@ describe("TracesLatencyHeatmap", () => {
     it("reopens the menu from the box's corner control, a labelled button, after it was dismissed", async () => {
       wrapper = await mountAttached();
       await drawBox();
-      wrapper.findComponent({ name: "ODropdown" }).vm.$emit("update:open", false);
+      selectionDropdown(wrapper).vm.$emit("update:open", false);
       await settle();
       expect(menu()).toBeNull();
       const reopen = el("reopen")!;
diff --git a/web/src/plugins/traces/metrics/TracesLatencyHeatmap.vue b/web/src/plugins/traces/metrics/TracesLatencyHeatmap.vue
index f2f0218f8a..6d2d625321 100644
--- a/web/src/plugins/traces/metrics/TracesLatencyHeatmap.vue
+++ b/web/src/plugins/traces/metrics/TracesLatencyHeatmap.vue
@@ -43,6 +43,33 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           {{ t("traces.latencyHeatmap.colorBy.errors") }}
         </OToggleGroupItem>
       </OToggleGroup>
+      <ODropdown side="bottom" align="end">
+        <template #trigger>
+          <OButton
+            :aria-label="t('traces.redActions.durationActions')"
+            variant="ghost"
+            size="icon"
+            class="shrink-0"
+            data-test="traces-duration-actions-btn"
+          >
+            <OIcon name="more-vert" size="sm" />
+          </OButton>
+        </template>
+        <ODropdownItem
+          data-test="traces-duration-create-alert"
+          icon-left="shield-alert-outline"
+          @select="emit('create-alert')"
+        >
+          {{ t("dashboard.panelContainer.exploreCreateAlert") }}
+        </ODropdownItem>
+        <ODropdownItem
+          data-test="traces-duration-add-to-dashboard"
+          icon-left="dashboard"
+          @select="emit('add-to-dashboard')"
+        >
+          {{ t("dashboard.panelContainer.exploreAddToDashboard") }}
+        </ODropdownItem>
+      </ODropdown>
     </PanelBar>
     <div class="relative min-h-0 flex-1">
       <div
@@ -182,6 +209,7 @@ import searchService from "@/services/search";
 import PanelBar from "@/components/common/PanelBar.vue";
 import OSpinner from "@/lib/feedback/Spinner/OSpinner.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
 import ODropdown from "@/lib/overlay/Dropdown/ODropdown.vue";
 import ODropdownItem from "@/lib/overlay/Dropdown/ODropdownItem.vue";
 import ODropdownSeparator from "@/lib/overlay/Dropdown/ODropdownSeparator.vue";
@@ -236,6 +264,8 @@ const emit = defineEmits<{
   (e: "drill-down"): void;
   (e: "clear"): void;
   (e: "ask-ai", payload: LatencyHeatmapAskAi): void;
+  (e: "create-alert"): void;
+  (e: "add-to-dashboard"): void;
 }>();
 
 const { t } = useI18nTyped();
diff --git a/web/src/plugins/traces/metrics/TracesMetricsDashboard.spec.ts b/web/src/plugins/traces/metrics/TracesMetricsDashboard.spec.ts
index 56973b183a..f32a595667 100644
--- a/web/src/plugins/traces/metrics/TracesMetricsDashboard.spec.ts
+++ b/web/src/plugins/traces/metrics/TracesMetricsDashboard.spec.ts
@@ -36,10 +36,23 @@ vi.mock("./TracesLatencyHeatmap.vue", () => ({
     name: "TracesLatencyHeatmap",
     template: '<div data-test="traces-latency-heatmap"></div>',
     props: ["request", "selection", "aiEnabled"],
-    emits: ["select", "filter", "drill-down", "clear", "ask-ai"],
+    emits: [
+      "select",
+      "filter",
+      "drill-down",
+      "clear",
+      "ask-ai",
+      "create-alert",
+      "add-to-dashboard",
+    ],
   },
 }));
 
+const createAlertMock = vi.hoisted(() => vi.fn());
+vi.mock("@/plugins/traces/composables/useTracesAlertAction", () => ({
+  useTracesAlertAction: () => ({ createAlert: createAlertMock }),
+}));
+
 vi.mock("./TracesComparison.vue", () => ({
   default: {
     name: "TracesComparison",
@@ -153,7 +166,15 @@ function mountComponent(props: Record<string, unknown> = {}): VueWrapper<any> {
       stubs: {
         teleport: true,
         RenderDashboardCharts: {
+          name: "RenderDashboardCharts",
           template: '<div data-test="render-dashboard-charts"></div>',
+          props: ["viewOnly", "exploreActions", "dashboardData", "currentTimeObj"],
+          emits: ["updated:dataZoom", "exploreCreateAlert", "exploreAddToDashboard"],
+        },
+        AddToDashboard: {
+          name: "AddToDashboard",
+          template: '<div data-test="traces-add-to-dashboard-stub"></div>',
+          props: ["open", "dashboardPanelData", "defaultPanelTitle", "notice", "panels"],
         },
         TracesComparison: {
           name: "TracesComparison",
@@ -1522,6 +1543,63 @@ describe("TracesMetricsDashboard", () => {
     });
   });
 
+  // -------------------------------------------------------------------------
+  // Chart actions
+  // -------------------------------------------------------------------------
+  describe("chart actions", () => {
+    const charts = () => wrapper.findComponent({ name: "RenderDashboardCharts" });
+    const heatmap = () => wrapper.findComponent({ name: "TracesLatencyHeatmap" });
+    const dialog = () => wrapper.findComponent({ name: "AddToDashboard" });
+
+    beforeEach(async () => {
+      mockSearchObj.data.datetime = { startTime: THIRTY_MIN_START, endTime: THIRTY_MIN_END };
+      mockSearchObj.data.editorValue = "service_name = 'checkout'";
+      await wrapper.vm.loadDashboard();
+      await flushPromises();
+    });
+
+    it("turns on the chart ⋮ for the RED panels", () => {
+      expect(charts().props("exploreActions")).toBe(true);
+      expect(charts().props("viewOnly")).toBe(true);
+    });
+
+    it("alerts on rate from Rate and on errors from Errors", async () => {
+      charts().vm.$emit("exploreCreateAlert", getPanel(wrapper, "Rate"));
+      charts().vm.$emit("exploreCreateAlert", getPanel(wrapper, "Errors"));
+      await flushPromises();
+      expect(createAlertMock.mock.calls).toEqual([["rate"], ["errors"]]);
+    });
+
+    it("alerts on duration from the heatmap header", async () => {
+      heatmap().vm.$emit("create-alert");
+      await flushPromises();
+      expect(createAlertMock).toHaveBeenCalledWith("duration");
+    });
+
+    it("adds the one chart it came from, with a filled title and the bucket the charts use", async () => {
+      expect(dialog().exists()).toBe(false);
+      charts().vm.$emit("exploreAddToDashboard", getPanel(wrapper, "Errors"));
+      await flushPromises();
+      const panel = dialog().props("dashboardPanelData").data;
+      expect(dialog().props("defaultPanelTitle")).toBe("Errors · service_name = 'checkout'");
+      expect(panel.queries[0].query).toContain("histogram(_timestamp, '15 second')");
+      expect(panel.queries[0].query).toContain("span_status = 'ERROR'");
+      expect(panel.queries[0].fields.stream_type).toBe("traces");
+      expect(dialog().props("notice")).toBe(
+        i18n.global.t("traces.redActions.bucketNoticeSingle.seconds", { count: 15 }),
+      );
+    });
+
+    it("adds a p50/p95/p99 Duration panel from the heatmap header", async () => {
+      heatmap().vm.$emit("add-to-dashboard");
+      await flushPromises();
+      const panel = dialog().props("dashboardPanelData").data;
+      expect(panel.type).toBe("line");
+      expect(panel.queries[0].query).toContain("approx_percentile_cont(duration, 0.99)");
+      expect(dialog().props("defaultPanelTitle")).toBe("Duration · service_name = 'checkout'");
+    });
+  });
+
   // -------------------------------------------------------------------------
   // Edge cases
   // -------------------------------------------------------------------------
diff --git a/web/src/plugins/traces/metrics/TracesMetricsDashboard.vue b/web/src/plugins/traces/metrics/TracesMetricsDashboard.vue
index 8e55c5e67c..a6eb56f43a 100644
--- a/web/src/plugins/traces/metrics/TracesMetricsDashboard.vue
+++ b/web/src/plugins/traces/metrics/TracesMetricsDashboard.vue
@@ -31,8 +31,11 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             :dashboardData="dashboardData || {}"
             :currentTimeObj="currentTimeObj"
             :allowAlertCreation="false"
+            :exploreActions="true"
             searchType="dashboards"
             @updated:dataZoom="onDataZoom"
+            @exploreCreateAlert="onExploreCreateAlert"
+            @exploreAddToDashboard="onExploreAddToDashboard"
           />
         </div>
         <!-- Tied to the Rate/Errors panels: metrics.json h (9 rows after migration) × 17px cellHeight, 4px GridStack margin -->
@@ -46,11 +49,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             @drill-down="onHeatmapDrillDown"
             @clear="onHeatmapClear"
             @ask-ai="onHeatmapAskAi"
+            @create-alert="createAlert('duration')"
+            @add-to-dashboard="openAddToDashboard('duration')"
           />
         </div>
       </div>
     </transition>
 
+    <AddToDashboard
+      v-if="addToDashboardPanel"
+      v-model:open="addToDashboardOpen"
+      :dashboard-panel-data="{ data: addToDashboardPanel }"
+      :default-panel-title="addToDashboardPanel.title"
+      :notice="addToDashboardNotice"
+    />
+
     <Teleport v-if="showComparison" defer to="#traces-drill-down-page">
       <TracesComparison
         :selection="comparisonSelection"
@@ -88,8 +101,10 @@ import {
   type LatencyHeatmapSelection,
 } from "./latencyHeatmap";
 import useTraces from "@/composables/useTraces";
-import { parseDurationWhereClause } from "@/composables/useDurationPercentiles";
-import { parseSpanKindWhereClause } from "@/utils/traces/constants";
+import { resolveTracesFilter } from "@/utils/traces/resolveTracesFilter";
+import { useTracesAlertAction } from "@/plugins/traces/composables/useTracesAlertAction";
+import { buildTracesRedPanel, tracesBucketNotice, type TracesRedChart } from "./tracesRedPanels";
+import type { I18nText } from "@/types/i18n";
 
 const RenderDashboardCharts = defineAsyncComponent(
   () => import("@/views/Dashboards/RenderDashboardCharts.vue"),
@@ -97,6 +112,8 @@ const RenderDashboardCharts = defineAsyncComponent(
 
 const TracesComparison = defineAsyncComponent(() => import("./TracesComparison.vue"));
 
+const AddToDashboard = defineAsyncComponent(() => import("@/plugins/metrics/AddToDashboard.vue"));
+
 export interface AiChatHandoff {
   query: string;
   chipName: string;
@@ -138,23 +155,8 @@ const { t } = useI18nTyped();
 // composable — the same object buildSearch() reads — guarantees the latest value.
 const effectiveFilter = computed(() => searchObj.data.editorValue);
 
-// Query editor text may contain human-readable duration/span_kind literals
-// (e.g. duration <= '1.64s') for display; decode them back to raw SQL values
-// (microseconds, numeric OTEL keys) before use in any generated query.
-const decodeFilter = (text: string | undefined): string => {
-  const trimmed = text?.trim();
-  if (!trimmed) return "";
-  const parsed = parseDurationWhereClause(
-    trimmed,
-    tracesParser.value,
-    searchObj.data.stream.selectedStream.value,
-  );
-  return parseSpanKindWhereClause(
-    typeof parsed === "string" ? parsed : trimmed,
-    tracesParser.value,
-    searchObj.data.stream.selectedStream.value,
-  );
-};
+const decodeFilter = (text: string | undefined): string =>
+  resolveTracesFilter(text, tracesParser.value, searchObj.data.stream.selectedStream.value);
 const parseEffectiveFilter = (): string => decodeFilter(effectiveFilter.value);
 
 const effectiveTimeRange = computed<TimeRange>(() => ({
@@ -194,6 +196,8 @@ let chartsFilter = "";
 // The stream and mode the charts ran with, for the same reason.
 let chartsStream = "";
 let chartsMode: "spans" | "traces" = "traces";
+// The bucket the charts were drawn with, which an exported panel keeps.
+let chartsInterval: { sql: string; seconds: number } | null = null;
 // The range the open comparison measured, which its Filter/Exclude restores.
 let comparisonRange: TimeRange | null = null;
 // Store the original time range before selection for baseline comparison
@@ -254,6 +258,7 @@ const loadDashboard = async () => {
     chartsFilter = searchObj.data.editorValue ?? "";
     chartsStream = streamName;
     chartsMode = isSpansMode ? "spans" : "traces";
+    chartsInterval = interval;
     heatmapSelection.value = null;
     convertedDashboard.tabs[0].panels.forEach(
       (
@@ -352,6 +357,44 @@ const onDataZoom = async ({
   await applySelection(panelTitle, data?.id ?? panelTitle, { start, end }, null, null, null, null);
 };
 
+const { createAlert } = useTracesAlertAction();
+
+const CHART_BY_PANEL_TITLE: Record<string, TracesRedChart> = { Rate: "rate", Errors: "errors" };
+
+const onExploreCreateAlert = (panel: { title?: string }) => {
+  const chart = CHART_BY_PANEL_TITLE[panel?.title ?? ""];
+  if (chart === "rate" || chart === "errors") createAlert(chart);
+};
+
+const addToDashboardOpen = ref(false);
+const addToDashboardPanel = shallowRef<any>(null);
+const addToDashboardNotice = ref<I18nText | undefined>(undefined);
+
+const openAddToDashboard = (chart: TracesRedChart) => {
+  const interval =
+    chartsInterval ??
+    chartInterval(effectiveTimeRange.value.startTime, effectiveTimeRange.value.endTime);
+  addToDashboardPanel.value = buildTracesRedPanel(chart, {
+    streamName: chartsStream || searchObj.data.stream.selectedStream.value,
+    filter: decodeFilter(chartsFilter),
+    filterText: chartsFilter,
+    view: chartsMode,
+    interval,
+    rateUnit:
+      chartsMode === "spans"
+        ? t("traces.metrics.perSecond.spans")
+        : t("traces.metrics.perSecond.traces"),
+  });
+  const { unit, count } = tracesBucketNotice(interval.seconds);
+  addToDashboardNotice.value = t(`traces.redActions.bucketNoticeSingle.${unit}`, { count });
+  addToDashboardOpen.value = true;
+};
+
+const onExploreAddToDashboard = (panel: { title?: string }) => {
+  const chart = CHART_BY_PANEL_TITLE[panel?.title ?? ""];
+  if (chart) openAddToDashboard(chart);
+};
+
 const onHeatmapSelect = (selection: LatencyHeatmapSelection) => {
   heatmapSelection.value = selection;
 };
diff --git a/web/src/plugins/traces/metrics/tracesRedPanels.spec.ts b/web/src/plugins/traces/metrics/tracesRedPanels.spec.ts
new file mode 100644
index 0000000000..22d4dfd294
--- /dev/null
+++ b/web/src/plugins/traces/metrics/tracesRedPanels.spec.ts
@@ -0,0 +1,116 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect } from "vitest";
+import {
+  buildTracesRedPanel,
+  buildTracesRedPanels,
+  tracesBucketNotice,
+  tracesPanelTitle,
+  type TracesRedPanelInput,
+} from "./tracesRedPanels";
+
+const input = (over: Partial<TracesRedPanelInput> = {}): TracesRedPanelInput => ({
+  streamName: "default",
+  filter: "service_name = 'checkout'",
+  filterText: "service_name = 'checkout'",
+  view: "traces",
+  interval: { sql: "1 minute", seconds: 60 },
+  rateUnit: "traces/s",
+  ...over,
+});
+
+const sqlOf = (panel: any): string => panel.queries[0].query;
+
+describe("tracesRedPanels", () => {
+  it("builds Rate from metrics.json with every placeholder swapped", () => {
+    const panel = buildTracesRedPanel("rate", input());
+    expect(panel.title).toBe("Rate · service_name = 'checkout'");
+    expect(sqlOf(panel)).toBe(
+      "SELECT histogram(_timestamp, '1 minute') AS time_bucket, approx_distinct(trace_id) / 60.0 AS max_rate FROM \"default\" WHERE service_name = 'checkout' GROUP BY time_bucket ORDER BY time_bucket ASC",
+    );
+    expect(sqlOf(panel)).not.toMatch(/\[|\$__interval/);
+    expect(panel.queries[0].fields.stream).toBe("default");
+    expect(panel.queries[0].fields.stream_type).toBe("traces");
+    expect(panel.config.override_config[0].config[0].value.customUnit).toBe("traces/s");
+  });
+
+  it("counts spans in the Spans view", () => {
+    const rate = buildTracesRedPanel("rate", input({ view: "spans", rateUnit: "spans/s" }));
+    const errors = buildTracesRedPanel("errors", input({ view: "spans" }));
+    expect(sqlOf(rate)).toContain("count(*) / 60.0 AS max_rate");
+    expect(sqlOf(rate)).not.toContain("approx_distinct");
+    expect(sqlOf(errors)).toContain("count(*) FILTER (WHERE span_status = 'ERROR') AS error_rate");
+  });
+
+  it("limits Errors to error spans and keeps an OR filter grouped", () => {
+    const panel = buildTracesRedPanel("errors", input({ filter: "a = 1 OR b = 2" }));
+    expect(panel.type).toBe("bar");
+    expect(sqlOf(panel)).toContain("WHERE span_status = 'ERROR' AND (a = 1 OR b = 2) GROUP BY");
+  });
+
+  it("drops WHERE for an empty filter and titles by stream", () => {
+    const panel = buildTracesRedPanel("rate", input({ filter: "", filterText: "  " }));
+    expect(sqlOf(panel)).toContain('FROM "default" GROUP BY');
+    expect(panel.title).toBe("Rate · default");
+    expect(sqlOf(buildTracesRedPanel("errors", input({ filter: "" })))).toContain(
+      "WHERE span_status = 'ERROR' GROUP BY",
+    );
+  });
+
+  it("keeps the whitespace inside the user's filter", () => {
+    for (const chart of ["rate", "errors", "duration"] as const) {
+      const sql = sqlOf(buildTracesRedPanel(chart, input({ filter: "service_name = 'a  b'" })));
+      expect(sql).toContain("service_name = 'a  b'");
+    }
+  });
+
+  it("builds Duration as a p50/p95/p99 line in microseconds with the export bucket", () => {
+    const panel = buildTracesRedPanel(
+      "duration",
+      input({ filter: "duration > 500000", interval: { sql: "15 second", seconds: 15 } }),
+    );
+    expect(panel.type).toBe("line");
+    expect(panel.title).toBe("Duration · service_name = 'checkout'");
+    expect(sqlOf(panel)).toBe(
+      "SELECT histogram(_timestamp, '15 second') AS time_bucket, approx_percentile_cont(duration, 0.5) AS p50, approx_percentile_cont(duration, 0.95) AS p95, approx_percentile_cont(duration, 0.99) AS p99 FROM \"default\" WHERE duration > 500000 GROUP BY time_bucket ORDER BY time_bucket ASC",
+    );
+    expect(panel.queries[0].fields.y.map((y: any) => y.alias)).toEqual(["p50", "p95", "p99"]);
+    expect(panel.config.unit).toBe("microseconds");
+    expect(panel.config.override_config).toEqual([]);
+    expect(panel.queries[0].fields.stream_type).toBe("traces");
+  });
+
+  it("returns Rate, Errors, Duration as fresh copies", () => {
+    const panels = buildTracesRedPanels(input());
+    expect(panels.map((p) => p.title.split(" · ")[0])).toEqual(["Rate", "Errors", "Duration"]);
+    panels[0].queries[0].query = "changed";
+    expect(sqlOf(buildTracesRedPanel("rate", input()))).not.toBe("changed");
+  });
+
+  it("cuts a long title to 60 characters", () => {
+    const long = "service_name = 'a-really-long-service-name-that-goes-on-and-on'";
+    const title = tracesPanelTitle("Errors", long, "default");
+    expect(title.length).toBe(60);
+    expect(title.startsWith("Errors · service_name")).toBe(true);
+  });
+
+  it("states the bucket in the largest whole unit", () => {
+    expect(tracesBucketNotice(60)).toEqual({ unit: "minutes", count: 1 });
+    expect(tracesBucketNotice(15)).toEqual({ unit: "seconds", count: 15 });
+    expect(tracesBucketNotice(7200)).toEqual({ unit: "hours", count: 2 });
+    expect(tracesBucketNotice(86400)).toEqual({ unit: "days", count: 1 });
+  });
+});
diff --git a/web/src/plugins/traces/metrics/tracesRedPanels.ts b/web/src/plugins/traces/metrics/tracesRedPanels.ts
new file mode 100644
index 0000000000..817e03f86d
--- /dev/null
+++ b/web/src/plugins/traces/metrics/tracesRedPanels.ts
@@ -0,0 +1,152 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import metrics from "./metrics.json";
+import { convertDashboardSchemaVersion } from "@/utils/dashboard/convertDashboardSchemaVersion";
+import { SERIES_OVERRIDE_MATCH_BY } from "@/utils/dashboard/seriesOverrides";
+import { deepCopy } from "@/utils/zincutils";
+
+export type TracesRedChart = "rate" | "errors" | "duration";
+
+export interface TracesRedPanelInput {
+  streamName: string;
+  /** WHERE fragment already resolved by resolveTracesFilter. */
+  filter: string;
+  /** The editor text the title shows; falls back to the stream when blank. */
+  filterText: string;
+  view: "traces" | "spans";
+  /** The bucket the charts use now; a dashboard variable cannot be divided by in Rate. */
+  interval: { sql: string; seconds: number };
+  rateUnit: string;
+}
+
+const TITLE_MAX = 60;
+const CHART_TITLES: Record<TracesRedChart, string> = {
+  rate: "Rate",
+  errors: "Errors",
+  duration: "Duration",
+};
+const PERCENTILES = [0.5, 0.95, 0.99];
+const ERROR_ONLY = "span_status = 'ERROR'";
+
+export const tracesPanelTitle = (chart: string, filterText: string, streamName: string): string =>
+  `${chart} · ${filterText.trim() || streamName}`.slice(0, TITLE_MAX);
+
+const sourcePanel = (title: "Rate" | "Errors"): any =>
+  convertDashboardSchemaVersion(deepCopy(metrics)).tabs[0].panels.find(
+    (panel: { title: string }) => panel.title === title,
+  );
+
+const whereClause = (terms: string[]): string => {
+  const kept = terms.filter(Boolean);
+  return kept.length ? `WHERE ${kept.join(" AND ")}` : "";
+};
+
+const swapPlaceholders = (query: string, input: TracesRedPanelInput, where: string): string =>
+  query
+    .replace(/\s+/g, " ")
+    .trim()
+    .replace(/ ?\[WHERE_CLAUSE\]/, () => (where ? ` ${where}` : ""))
+    .replace("[STREAM_NAME]", () => `"${input.streamName}"`)
+    .replace("[INTERVAL]", input.interval.sql)
+    .replace("[INTERVAL_SECONDS]", String(input.interval.seconds));
+
+const toSpanCounts = (query: string): string =>
+  query
+    .replace(
+      /approx_distinct\(trace_id\)\s+filter\s*\(where\s+span_status\s*=\s*'ERROR'\)/gi,
+      "count(*) FILTER (WHERE span_status = 'ERROR')",
+    )
+    .replace(/approx_distinct\(trace_id\)/gi, "count(*)");
+
+const rateOrErrorsPanel = (chart: "rate" | "errors", input: TracesRedPanelInput): any => {
+  const panel = sourcePanel(chart === "rate" ? "Rate" : "Errors");
+  const filter = input.filter.trim();
+  const where =
+    chart === "errors" ? whereClause([ERROR_ONLY, filter && `(${filter})`]) : whereClause([filter]);
+  let query = swapPlaceholders(panel.queries[0].query, input, where);
+  if (input.view === "spans") query = toSpanCounts(query);
+  panel.queries[0].query = query;
+  panel.queries[0].fields.stream = input.streamName;
+  if (chart === "rate") {
+    panel.config.title_meta = input.rateUnit;
+    panel.config.override_config = [
+      {
+        field: { matchBy: SERIES_OVERRIDE_MATCH_BY.REGEX, value: ".*" },
+        config: [{ type: "unit", value: { unit: "custom", customUnit: input.rateUnit } }],
+      },
+    ];
+  }
+  return panel;
+};
+
+const durationPanel = (input: TracesRedPanelInput): any => {
+  const panel = sourcePanel("Rate");
+  const aliases = PERCENTILES.map((p) => `p${Math.round(p * 100)}`);
+  const selects = PERCENTILES.map(
+    (p, i) => `approx_percentile_cont(duration, ${p}) AS ${aliases[i]}`,
+  ).join(", ");
+  const template = `SELECT histogram(_timestamp, '[INTERVAL]') AS time_bucket, ${selects} FROM [STREAM_NAME] [WHERE_CLAUSE] GROUP BY time_bucket ORDER BY time_bucket ASC`;
+  const query = panel.queries[0];
+  query.query = swapPlaceholders(template, input, whereClause([input.filter.trim()]));
+  query.fields.stream = input.streamName;
+  query.fields.y = aliases.map((alias) => ({
+    ...query.fields.y[0],
+    alias,
+    column: alias,
+    color: null,
+    aggregationFunction: null,
+  }));
+  panel.config = {
+    ...panel.config,
+    unit: "microseconds",
+    unit_custom: "",
+    show_legends: true,
+    override_config: [],
+    color: {
+      mode: "palette-classic-by-series",
+      fixedColor: [],
+      seriesBy: "last",
+      colorBySeries: [],
+    },
+  };
+  delete panel.config.title_meta;
+  return panel;
+};
+
+export const buildTracesRedPanel = (chart: TracesRedChart, input: TracesRedPanelInput): any => {
+  const panel = chart === "duration" ? durationPanel(input) : rateOrErrorsPanel(chart, input);
+  panel.title = tracesPanelTitle(CHART_TITLES[chart], input.filterText, input.streamName);
+  return panel;
+};
+
+export const buildTracesRedPanels = (input: TracesRedPanelInput): any[] =>
+  (["rate", "errors", "duration"] as const).map((chart) => buildTracesRedPanel(chart, input));
+
+const BUCKET_UNITS = [
+  ["days", 86_400],
+  ["hours", 3_600],
+  ["minutes", 60],
+] as const;
+
+/** The bucket in the largest unit it divides into, for the dialog notice. */
+export const tracesBucketNotice = (
+  seconds: number,
+): { unit: "seconds" | "minutes" | "hours" | "days"; count: number } => {
+  const match = BUCKET_UNITS.find(([, size]) => seconds >= size && seconds % size === 0);
+  return match
+    ? { unit: match[0], count: seconds / match[1] }
+    : { unit: "seconds", count: seconds };
+};
diff --git a/web/src/plugins/traces/utils/nlSqlToTracesFilter.spec.ts b/web/src/plugins/traces/utils/nlSqlToTracesFilter.spec.ts
new file mode 100644
index 0000000000..ca9be00a7f
--- /dev/null
+++ b/web/src/plugins/traces/utils/nlSqlToTracesFilter.spec.ts
@@ -0,0 +1,110 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect, beforeAll } from "vitest";
+import useParser from "@/composables/useParser";
+import { nlSqlToTracesFilter } from "./nlSqlToTracesFilter";
+
+let parser: unknown;
+
+beforeAll(async () => {
+  parser = await useParser().sqlParser();
+});
+
+describe("nlSqlToTracesFilter", () => {
+  it("keeps only the WHERE part of a plain span query", () => {
+    const sql =
+      "SELECT _timestamp, trace_id, span_id, service_name, operation_name, duration, span_status, status_message\n" +
+      "FROM default\n" +
+      "WHERE service_name = 'querier' AND span_status = 'ERROR' AND duration > 500000\n" +
+      "ORDER BY duration DESC LIMIT 100";
+    expect(nlSqlToTracesFilter(sql, parser)).toBe(
+      "service_name = 'querier' AND span_status = 'ERROR' AND duration > 500000",
+    );
+  });
+
+  it("keeps functions and nested boolean groups", () => {
+    const sql = "SELECT * FROM \"default\" WHERE match_all('timeout') OR (a = 1 AND b LIKE '%x%')";
+    expect(nlSqlToTracesFilter(sql, parser)).toBe(
+      "match_all('timeout') OR (a = 1 AND b LIKE '%x%')",
+    );
+  });
+
+  it("refuses a query with no WHERE", () => {
+    expect(nlSqlToTracesFilter("SELECT * FROM default LIMIT 10", parser)).toBeNull();
+  });
+
+  it("refuses GROUP BY with count", () => {
+    const sql =
+      "SELECT service_name, count(*) AS errors FROM default WHERE span_status = 'ERROR' GROUP BY service_name";
+    expect(nlSqlToTracesFilter(sql, parser)).toBeNull();
+  });
+
+  it("refuses an aggregate without GROUP BY", () => {
+    expect(nlSqlToTracesFilter("SELECT count(*) FROM default WHERE a = 1", parser)).toBeNull();
+  });
+
+  it("refuses approximate aggregates the parser types as plain functions", () => {
+    const sql = "SELECT approx_percentile_cont(duration, 0.95) FROM default WHERE a = 1";
+    expect(nlSqlToTracesFilter(sql, parser)).toBeNull();
+    expect(
+      nlSqlToTracesFilter("SELECT approx_distinct(trace_id) FROM default WHERE a = 1", parser),
+    ).toBeNull();
+  });
+
+  it("refuses a window function", () => {
+    const sql = "SELECT row_number() OVER (ORDER BY a) FROM default WHERE a = 1";
+    expect(nlSqlToTracesFilter(sql, parser)).toBeNull();
+  });
+
+  it("keeps backticks inside string values", () => {
+    const sql = "SELECT * FROM default WHERE status_message LIKE '%x`y%' AND `service_name` = 'a'";
+    expect(nlSqlToTracesFilter(sql, parser)).toBe(
+      `status_message LIKE '%x\`y%' AND "service_name" = 'a'`,
+    );
+  });
+
+  it("refuses DISTINCT", () => {
+    expect(
+      nlSqlToTracesFilter("SELECT DISTINCT service_name FROM default WHERE a = 1", parser),
+    ).toBeNull();
+  });
+
+  it("refuses HAVING", () => {
+    const sql =
+      "SELECT service_name FROM default WHERE a = 1 GROUP BY service_name HAVING count(*) > 5";
+    expect(nlSqlToTracesFilter(sql, parser)).toBeNull();
+  });
+
+  it("refuses a JOIN", () => {
+    expect(
+      nlSqlToTracesFilter("SELECT * FROM a JOIN b ON a.x = b.x WHERE a.y = 1", parser),
+    ).toBeNull();
+  });
+
+  it("refuses a subquery inside the WHERE", () => {
+    const sql =
+      "SELECT * FROM default WHERE trace_id IN (SELECT trace_id FROM default WHERE span_status = 'ERROR')";
+    expect(nlSqlToTracesFilter(sql, parser)).toBeNull();
+  });
+
+  it("refuses text that does not parse", () => {
+    expect(nlSqlToTracesFilter("I could not find a matching stream.", parser)).toBeNull();
+  });
+
+  it("refuses when the parser is not loaded", () => {
+    expect(nlSqlToTracesFilter("SELECT * FROM default WHERE a = 1", null)).toBeNull();
+  });
+});
diff --git a/web/src/plugins/traces/utils/nlSqlToTracesFilter.ts b/web/src/plugins/traces/utils/nlSqlToTracesFilter.ts
new file mode 100644
index 0000000000..5d816d1a82
--- /dev/null
+++ b/web/src/plugins/traces/utils/nlSqlToTracesFilter.ts
@@ -0,0 +1,72 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful,
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+interface SqlParser {
+  astify: (sql: string) => unknown;
+  exprToSQL: (expr: unknown) => string;
+}
+
+interface SelectAst {
+  type?: string;
+  with?: unknown;
+  distinct?: { type?: string | null } | null;
+  columns?: { expr?: { type?: string } }[] | string;
+  from?: { join?: unknown; expr?: unknown }[] | null;
+  where?: unknown;
+  groupby?: unknown;
+  having?: unknown;
+  _next?: unknown;
+}
+
+const hasSubquery = (node: unknown): boolean => {
+  if (!node || typeof node !== "object") return false;
+  if (Array.isArray(node)) return node.some(hasSubquery);
+  const obj = node as Record<string, unknown>;
+  if (obj.ast || obj.type === "select") return true;
+  return Object.values(obj).some(hasSubquery);
+};
+
+// The parser prints identifiers in backticks; string literals may hold backticks of their own.
+const quoteIdentifiers = (where: string): string =>
+  where
+    .split(/('(?:[^']|'')*')/)
+    .map((part, i) => (i % 2 ? part : part.replace(/`/g, '"')))
+    .join("");
+
+const fitsFilter = (ast: SelectAst): boolean => {
+  if (ast.type !== "select" || !ast.where) return false;
+  if (ast.with || ast.distinct?.type || ast.groupby || ast.having || ast._next) return false;
+  if ((ast.from ?? []).length !== 1 || ast.from?.some((f) => f.join || f.expr)) return false;
+  const columns = Array.isArray(ast.columns) ? ast.columns : [];
+  // approx_* aggregates and window functions parse as other types, so only plain columns pass.
+  if (columns.some((c) => c.expr?.type !== "column_ref")) return false;
+  return !hasSubquery(ast.where);
+};
+
+/** The WHERE of AI-generated SQL as a Traces filter, or null when a filter cannot hold that query. */
+export const nlSqlToTracesFilter = (sql: string, parser: unknown): string | null => {
+  const sqlParser = parser as SqlParser | null;
+  if (!sqlParser?.astify || !sql?.trim()) return null;
+  try {
+    const parsed = sqlParser.astify(sql);
+    if (Array.isArray(parsed) && parsed.length !== 1) return null;
+    const ast = (Array.isArray(parsed) ? parsed[0] : parsed) as SelectAst;
+    if (!ast || !fitsFilter(ast)) return null;
+    const where = sqlParser.exprToSQL(ast.where);
+    return where ? quoteIdentifiers(where) : null;
+  } catch {
+    return null;
+  }
+};
diff --git a/web/src/plugins/traces/utils/traceAiPayload.spec.ts b/web/src/plugins/traces/utils/traceAiPayload.spec.ts
new file mode 100644
index 0000000000..201c8d6d35
--- /dev/null
+++ b/web/src/plugins/traces/utils/traceAiPayload.spec.ts
@@ -0,0 +1,228 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect } from "vitest";
+import i18n from "@/locales";
+import type { TranslateFn } from "@/types/i18n";
+import {
+  buildSpanAiPayload,
+  buildTraceAiPayload,
+  SPAN_AI_ATTRIBUTE_LIMIT,
+  SPAN_AI_EVENT_LIMIT,
+  TRACE_AI_CRITICAL_LIMIT,
+  TRACE_AI_ERROR_LIMIT,
+} from "./traceAiPayload";
+
+const t = i18n.global.t as unknown as TranslateFn;
+
+const baseSpan = {
+  span_id: "s1",
+  trace_id: "tr1",
+  service_name: "querier",
+  operation_name: "service:search:grpc:flight::enter",
+  duration: 2050,
+  span_status: "UNSET",
+  status_message: "",
+  start_time: 1_000_000_000,
+  end_time: 1_002_050_000,
+  events: "[]",
+  http_method: "GET",
+};
+
+const spanInput = (overrides: Record<string, unknown> = {}, extra = {}) => ({
+  span: { ...baseSpan, ...overrides },
+  stream: "default",
+  traceStartTime: 100,
+  traceEndTime: 200,
+  operationP50Us: null as number | null,
+  hasError: false,
+  ...extra,
+});
+
+describe("buildSpanAiPayload", () => {
+  it("sends the heatmap hand-off envelope with the span context", () => {
+    const p = buildSpanAiPayload(t, spanInput({}, { operationP50Us: 900 }));
+    expect(p.chipName).toBe("Span · service:search:grpc:flight::enter");
+    expect(p.newChat).toBe(true);
+    expect(p.autoSend).toBe(false);
+    expect(p.context).toMatchObject({
+      currentPage: "traces",
+      streamType: "traces",
+      selectedStreams: ["default"],
+      traceId: "tr1",
+      traceStartTime: 100,
+      traceEndTime: 200,
+      span: {
+        span_id: "s1",
+        service_name: "querier",
+        operation_name: "service:search:grpc:flight::enter",
+        duration_us: 2050,
+        operation_p50_us: 900,
+        span_status: "UNSET",
+        status_message: "",
+      },
+    });
+  });
+
+  it("asks why a span slower than its operation p50 took that long, in ms", () => {
+    const p = buildSpanAiPayload(t, spanInput({}, { operationP50Us: 900 }));
+    expect(p.query).toBe("Why did this span take 2.05 ms? Its operation's p50 is 0.9 ms.");
+  });
+
+  it("asks why an error span failed, quoting its error message", () => {
+    const p = buildSpanAiPayload(
+      t,
+      spanInput(
+        { span_status: "ERROR", status_message: "deadline exceeded" },
+        {
+          operationP50Us: 900,
+          hasError: true,
+        },
+      ),
+    );
+    expect(p.query).toBe('Why did this span fail with "deadline exceeded"?');
+  });
+
+  it("asks why an error span failed when it has no message", () => {
+    const p = buildSpanAiPayload(t, spanInput({ span_status: "ERROR" }, { hasError: true }));
+    expect(p.query).toBe("Why did this span fail?");
+  });
+
+  it.each([
+    ["no p50", null],
+    ["a span at or below p50", 2050],
+    ["a span below p50", 5000],
+  ])("asks a neutral question for %s", (_label, p50) => {
+    const p = buildSpanAiPayload(t, spanInput({}, { operationP50Us: p50 }));
+    expect(p.query).toBe("What does this span do, and does anything about it look unusual?");
+    expect(p.context.span).toMatchObject({ operation_p50_us: p50 });
+  });
+
+  it("keeps the first 20 events and parses them from the stored JSON string", () => {
+    const events = Array.from({ length: 30 }, (_, i) => ({ name: `e${i}` }));
+    const p = buildSpanAiPayload(t, spanInput({ events: JSON.stringify(events) }));
+    const sent = (p.context.span as { events: { name: string }[] }).events;
+    expect(SPAN_AI_EVENT_LIMIT).toBe(20);
+    expect(sent).toHaveLength(20);
+    expect(sent[0].name).toBe("e0");
+    expect(sent[19].name).toBe("e19");
+  });
+
+  it("sends no events for malformed event JSON", () => {
+    const p = buildSpanAiPayload(t, spanInput({ events: "{not json" }));
+    expect((p.context.span as { events: unknown[] }).events).toEqual([]);
+  });
+
+  it("keeps the first 50 attribute keys and leaves out the fields sent on their own", () => {
+    const attrs = Object.fromEntries(Array.from({ length: 80 }, (_, i) => [`attr_${i}`, i]));
+    const p = buildSpanAiPayload(t, spanInput(attrs));
+    const sent = (p.context.span as { attributes: Record<string, unknown> }).attributes;
+    expect(SPAN_AI_ATTRIBUTE_LIMIT).toBe(50);
+    expect(Object.keys(sent)).toHaveLength(50);
+    expect(sent.http_method).toBe("GET");
+    for (const key of ["span_id", "operation_name", "duration", "events", "span_status"]) {
+      expect(sent).not.toHaveProperty(key);
+    }
+  });
+
+  it("sends no stream when the span has none", () => {
+    const p = buildSpanAiPayload(t, spanInput({}, { stream: "" }));
+    expect(p.context.selectedStreams).toEqual([]);
+  });
+});
+
+const traceSpan = (i: number, overrides: Record<string, unknown> = {}) => ({
+  span_id: `s${i}`,
+  trace_id: "tr1",
+  service_name: `svc${i}`,
+  operation_name: `op${i}`,
+  duration: i * 10,
+  span_status: "UNSET",
+  status_message: "",
+  start_time: i,
+  reference_parent_span_id: i === 0 ? "" : "s0",
+  ...overrides,
+});
+
+const traceInput = (spans: Record<string, unknown>[], criticalPathSpanIds: string[]) => ({
+  spans,
+  criticalPathSpanIds,
+  rootOperation: "GET /api/search",
+  traceId: "tr1",
+  stream: "default",
+  traceStartTime: 100,
+  traceEndTime: 900,
+});
+
+type Summary = {
+  critical_path: { span_id: string; duration_us: number }[];
+  error_spans: { span_id: string; message: string }[];
+  total_spans: number;
+  error_span_count: number;
+};
+
+describe("buildTraceAiPayload", () => {
+  it("sends the hand-off envelope with the trace context", () => {
+    const spans = [traceSpan(0), traceSpan(1)];
+    const p = buildTraceAiPayload(t, traceInput(spans, ["s0"]));
+    expect(p.chipName).toBe("Trace · GET /api/search");
+    expect(p.newChat).toBe(true);
+    expect(p.autoSend).toBe(false);
+    expect(p.context).toMatchObject({
+      currentPage: "traces",
+      streamType: "traces",
+      selectedStreams: ["default"],
+      traceId: "tr1",
+      traceStartTime: 100,
+      traceEndTime: 900,
+    });
+    expect(p.query).toBe("Where does this trace spend its time, and what makes it slow?");
+  });
+
+  it("keeps only the 20 slowest critical-path spans, slowest first", () => {
+    const spans = Array.from({ length: 40 }, (_, i) => traceSpan(i));
+    const critical = spans.filter((_, i) => i % 2 === 0).map((s) => s.span_id);
+    const summary = buildTraceAiPayload(t, traceInput(spans, critical)).context
+      .trace_summary as Summary;
+    expect(TRACE_AI_CRITICAL_LIMIT).toBe(20);
+    expect(summary.critical_path).toHaveLength(20);
+    expect(summary.critical_path[0]).toMatchObject({ span_id: "s38", duration_us: 380 });
+    expect(summary.critical_path.every((s) => critical.includes(s.span_id))).toBe(true);
+    expect(summary.total_spans).toBe(40);
+  });
+
+  it("counts a critical-path span once even when it has several sections", () => {
+    const spans = [traceSpan(0), traceSpan(1)];
+    const summary = buildTraceAiPayload(t, traceInput(spans, ["s0", "s1", "s0"])).context
+      .trace_summary as Summary;
+    expect(summary.critical_path.map((s) => s.span_id)).toEqual(["s1", "s0"]);
+  });
+
+  it("sends every error span up to 50 with its message, and asks why the trace failed", () => {
+    const spans = [
+      traceSpan(0),
+      ...Array.from({ length: 60 }, (_, i) =>
+        traceSpan(i + 1, { span_status: "ERROR", status_message: `boom ${i + 1}` }),
+      ),
+    ];
+    const p = buildTraceAiPayload(t, traceInput(spans, ["s0"]));
+    const summary = p.context.trace_summary as Summary;
+    expect(TRACE_AI_ERROR_LIMIT).toBe(50);
+    expect(summary.error_spans).toHaveLength(50);
+    expect(summary.error_span_count).toBe(60);
+    expect(summary.error_spans[0]).toMatchObject({ span_id: "s1", message: "boom 1" });
+    expect(p.query).toBe("Why did this trace fail, and where does its time go?");
+  });
+});
diff --git a/web/src/plugins/traces/utils/traceAiPayload.ts b/web/src/plugins/traces/utils/traceAiPayload.ts
new file mode 100644
index 0000000000..f213cdd2e6
--- /dev/null
+++ b/web/src/plugins/traces/utils/traceAiPayload.ts
@@ -0,0 +1,175 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { I18nText, TranslateFn } from "@/types/i18n";
+import { errorSpansDeepestFirst, spanErrorMessage } from "./traceErrorSummary";
+
+type RawSpan = Record<string, unknown>;
+
+export const SPAN_AI_EVENT_LIMIT = 20;
+export const SPAN_AI_ATTRIBUTE_LIMIT = 50;
+export const TRACE_AI_CRITICAL_LIMIT = 20;
+export const TRACE_AI_ERROR_LIMIT = 50;
+
+const SPAN_OWN_FIELDS = new Set([
+  "span_id",
+  "trace_id",
+  "service_name",
+  "operation_name",
+  "duration",
+  "span_status",
+  "status_message",
+  "events",
+  "start_time",
+  "end_time",
+  "_start_time_ns",
+  "_end_time_ns",
+  "_timestamp",
+]);
+
+export interface AiChatHandoff {
+  query: string;
+  chipName: I18nText;
+  newChat: true;
+  autoSend: false;
+  context: Record<string, unknown>;
+}
+
+export interface SpanAiInput {
+  span: RawSpan;
+  stream: string;
+  traceStartTime: number;
+  traceEndTime: number;
+  operationP50Us: number | null;
+  hasError: boolean;
+}
+
+export interface TraceAiInput {
+  spans: RawSpan[];
+  criticalPathSpanIds: Iterable<string>;
+  rootOperation: string;
+  traceId: string;
+  stream: string;
+  traceStartTime: number;
+  traceEndTime: number;
+}
+
+const text = (value: unknown): string =>
+  value === null || value === undefined ? "" : String(value);
+
+const formatMs = (us: number): string => String(Number((us / 1000).toFixed(2)));
+
+const parseEvents = (raw: unknown): unknown[] => {
+  if (Array.isArray(raw)) return raw;
+  try {
+    const parsed = JSON.parse(text(raw) || "[]");
+    return Array.isArray(parsed) ? parsed : [];
+  } catch {
+    return [];
+  }
+};
+
+const spanSummary = (span: RawSpan) => ({
+  span_id: text(span.span_id),
+  service_name: text(span.service_name),
+  operation_name: text(span.operation_name),
+  duration_us: Number(span.duration) || 0,
+  span_status: text(span.span_status),
+  status_message: text(span.status_message),
+});
+
+const envelope = (
+  query: string,
+  chipName: I18nText,
+  input: { traceId: string; stream: string; traceStartTime: number; traceEndTime: number },
+  extra: Record<string, unknown>,
+): AiChatHandoff => ({
+  query,
+  chipName,
+  newChat: true,
+  autoSend: false,
+  context: {
+    currentPage: "traces",
+    streamType: "traces",
+    selectedStreams: input.stream ? [input.stream] : [],
+    traceId: input.traceId,
+    traceStartTime: input.traceStartTime,
+    traceEndTime: input.traceEndTime,
+    ...extra,
+  },
+});
+
+// Questions are model input, not screen copy: kept English, like the traces heatmap's Ask AI prompt.
+const spanQuestion = (span: RawSpan, p50Us: number | null, hasError: boolean): string => {
+  if (hasError) {
+    const message = spanErrorMessage(span);
+    return message ? `Why did this span fail with "${message}"?` : "Why did this span fail?";
+  }
+  const durationUs = Number(span.duration);
+  if (p50Us !== null && p50Us > 0 && durationUs > p50Us) {
+    return `Why did this span take ${formatMs(durationUs)} ms? Its operation's p50 is ${formatMs(p50Us)} ms.`;
+  }
+  return "What does this span do, and does anything about it look unusual?";
+};
+
+/** Ask AI hand-off for one span, matching the object the latency heatmap sends. */
+export function buildSpanAiPayload(t: TranslateFn, input: SpanAiInput): AiChatHandoff {
+  const { span, operationP50Us, hasError } = input;
+  const attributes = Object.fromEntries(
+    Object.entries(span)
+      .filter(([key]) => !SPAN_OWN_FIELDS.has(key))
+      .slice(0, SPAN_AI_ATTRIBUTE_LIMIT),
+  );
+  return envelope(
+    spanQuestion(span, operationP50Us, hasError),
+    t("traces.askAi.spanChip", { operation: text(span.operation_name) }),
+    { ...input, traceId: text(span.trace_id) },
+    {
+      span: {
+        ...spanSummary(span),
+        operation_p50_us: operationP50Us,
+        events: parseEvents(span.events).slice(0, SPAN_AI_EVENT_LIMIT),
+        attributes,
+      },
+    },
+  );
+}
+
+/** "Explain trace" hand-off: the slowest critical-path spans plus the error spans. */
+export function buildTraceAiPayload(t: TranslateFn, input: TraceAiInput): AiChatHandoff {
+  const byId = new Map(input.spans.map((span) => [text(span.span_id), span]));
+  const criticalPath = [...new Set(input.criticalPathSpanIds)]
+    .map((id) => byId.get(id))
+    .filter((span): span is RawSpan => !!span)
+    .map(spanSummary)
+    .sort((a, b) => b.duration_us - a.duration_us)
+    .slice(0, TRACE_AI_CRITICAL_LIMIT);
+  const errors = errorSpansDeepestFirst(input.spans);
+  const errorSpans = errors.slice(0, TRACE_AI_ERROR_LIMIT).map((error) => ({
+    ...spanSummary(byId.get(error.spanId) ?? {}),
+    message: error.message,
+  }));
+  const query = errors.length
+    ? "Why did this trace fail, and where does its time go?"
+    : "Where does this trace spend its time, and what makes it slow?";
+  return envelope(query, t("traces.askAi.traceChip", { operation: input.rootOperation }), input, {
+    trace_summary: {
+      total_spans: input.spans.length,
+      error_span_count: errors.length,
+      critical_path: criticalPath,
+      error_spans: errorSpans,
+    },
+  });
+}
diff --git a/web/src/plugins/workflows/WorkflowNode.spec.ts b/web/src/plugins/workflows/WorkflowNode.spec.ts
index a8e032438a..d737cb8bf4 100644
--- a/web/src/plugins/workflows/WorkflowNode.spec.ts
+++ b/web/src/plugins/workflows/WorkflowNode.spec.ts
@@ -78,6 +78,7 @@ vi.mock("@/lib/overlay/Tooltip/OTooltip.vue", () => ({
 import WorkflowNode from "@/plugins/workflows/WorkflowNode.vue";
 import { workflowObj } from "@/plugins/workflows/useWorkflowCanvas";
 import { toast } from "@/lib/feedback/Toast/useToast";
+import { httpEditorState, resetHttpEditorState } from "@/plugins/workflows/httpEndpointUi";
 
 const TRIGGER = { id: "t1", data: { node_type: "workflow_trigger" } };
 const CONDITION = { id: "c1", data: { node_type: "condition" } };
@@ -1061,3 +1062,41 @@ describe("WorkflowNode", () => {
     });
   });
 });
+
+describe("WorkflowNode HTTP badge", () => {
+  beforeEach(() => {
+    setGraph([TRIGGER, CONDITION]);
+    workflowObj.readOnly = false;
+    // Earlier describes leave the step dialog open, which would mask a click that leaked to the node.
+    workflowObj.dialog.show = false;
+    resetHttpEditorState();
+  });
+  afterEach(() => {
+    resetHttpEditorState();
+    workflowObj.readOnly = false;
+  });
+
+  it("badge opens the panel", async () => {
+    httpEditorState.endpointOn = true;
+    const w = mountNode("t1", TRIGGER.data);
+    const badge = w.find('[data-test="workflow-trigger-http-badge"]');
+    expect(badge.text()).toContain(i18n.global.t("workflow.http.nodeBadge"));
+    await badge.trigger("click");
+    expect(httpEditorState.panelOpen).toBe(true);
+    expect(workflowObj.dialog.show).toBe(false);
+  });
+
+  it("hides the badge while the endpoint is off, on other steps and in the run view", async () => {
+    expect(
+      mountNode("t1", TRIGGER.data).find('[data-test="workflow-trigger-http-badge"]').exists(),
+    ).toBe(false);
+    httpEditorState.endpointOn = true;
+    expect(
+      mountNode("c1", CONDITION.data).find('[data-test="workflow-trigger-http-badge"]').exists(),
+    ).toBe(false);
+    workflowObj.readOnly = true;
+    expect(
+      mountNode("t1", TRIGGER.data).find('[data-test="workflow-trigger-http-badge"]').exists(),
+    ).toBe(false);
+  });
+});
diff --git a/web/src/plugins/workflows/WorkflowNode.vue b/web/src/plugins/workflows/WorkflowNode.vue
index 5ef97df1ed..b29941fa97 100644
--- a/web/src/plugins/workflows/WorkflowNode.vue
+++ b/web/src/plugins/workflows/WorkflowNode.vue
@@ -83,6 +83,18 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       <div
         class="absolute -top-2.5 left-1 z-10 flex max-w-[calc(100%-2.25rem)] flex-wrap items-center gap-1"
       >
+        <OBadge
+          v-if="showHttpBadge"
+          variant="blue-soft"
+          size="xs"
+          icon="webhook"
+          clickable
+          class="nodrag"
+          data-test="workflow-trigger-http-badge"
+          @click.stop="openHttpPanel"
+        >
+          {{ t("workflow.http.nodeBadge") }}
+        </OBadge>
         <OBadge
           v-if="isDisabled"
           variant="default"
@@ -294,6 +306,7 @@ import useWorkflowCanvas, {
   branchUnwiredHandles,
   isTestEarnedResult,
 } from "./useWorkflowCanvas";
+import { httpEditorState, openHttpPanel } from "./httpEndpointUi";
 
 const props = defineProps<{
   id: string;
@@ -315,6 +328,12 @@ const isDisabled = computed(() => isNodeDisabled(node.value));
 // Placeholder / "Configure Later" — e.g. a Destination saved with no destination.
 const isIncomplete = computed(() => isNodeIncomplete(node.value));
 const onToggleDisabled = () => toggleNodeDisabled(props.id);
+const showHttpBadge = computed(
+  () =>
+    props.data?.node_type === "workflow_trigger" &&
+    httpEditorState.endpointOn &&
+    !workflowObj.readOnly,
+);
 // Fan-out (Branch) nodes render one source handle per arm; every other type is
 // single-output and passes nothing so the card keeps its lone "output" handle.
 const outputHandles = computed(() => branchHandles(node.value).map((id) => ({ id })));
diff --git a/web/src/plugins/workflows/alertFields.ts b/web/src/plugins/workflows/alertFields.ts
index 53d6bf9e20..c7259ad8df 100644
--- a/web/src/plugins/workflows/alertFields.ts
+++ b/web/src/plugins/workflows/alertFields.ts
@@ -29,6 +29,8 @@ export interface WorkflowFieldOption {
   label: I18nText;
   value: string;
   type: string;
+  /** A non-selectable group heading in the field picker (OSelect `header`). */
+  header?: boolean;
 }
 
 // Schema of the fixed `meta` block the Alert Trigger emits per firing, shown
diff --git a/web/src/plugins/workflows/httpEndpoint.spec.ts b/web/src/plugins/workflows/httpEndpoint.spec.ts
new file mode 100644
index 0000000000..c9c76f14a0
--- /dev/null
+++ b/web/src/plugins/workflows/httpEndpoint.spec.ts
@@ -0,0 +1,72 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import enUS from "@/locales/languages/en-US.json";
+import {
+  RUN_SOURCE_LABEL_KEYS,
+  hasHttpEndpoint,
+  isHttpRun,
+  runSourceOf,
+  workflowHooksEnabled,
+} from "./httpEndpoint";
+
+const lookup = (key: string): unknown =>
+  key.split(".").reduce<any>((node, part) => (node == null ? undefined : node[part]), enUS);
+
+describe("workflowHooksEnabled", () => {
+  it("is on only when the config flag is exactly true", () => {
+    expect(workflowHooksEnabled({ workflow_hooks_enabled: true })).toBe(true);
+    expect(workflowHooksEnabled({ workflow_hooks_enabled: false })).toBe(false);
+    expect(workflowHooksEnabled({ workflow_hooks_enabled: "true" })).toBe(false);
+    expect(workflowHooksEnabled({})).toBe(false);
+    expect(workflowHooksEnabled(undefined)).toBe(false);
+    expect(workflowHooksEnabled(null)).toBe(false);
+  });
+});
+
+describe("hasHttpEndpoint", () => {
+  it("is true only when the list row says http_endpoint_enabled", () => {
+    expect(hasHttpEndpoint({ http_endpoint_enabled: true })).toBe(true);
+    expect(hasHttpEndpoint({ http_endpoint_enabled: false })).toBe(false);
+    expect(hasHttpEndpoint({})).toBe(false);
+    expect(hasHttpEndpoint(null)).toBe(false);
+  });
+});
+
+describe("runSourceOf", () => {
+  it("a Webhook run is an HTTP request; every other type keeps its own source", () => {
+    expect(runSourceOf({ event_type: "Webhook" })).toBe("http");
+    expect(runSourceOf({ event_type: "AlertFired" })).toBe("alert_fired");
+    expect(runSourceOf({ event_type: "AlertResolved" })).toBe("alert_fired");
+    expect(runSourceOf({ event_type: "IncidentEvent" })).toBe("incident_event");
+    expect(runSourceOf({ event_type: "Test" })).toBe("test");
+    expect(runSourceOf({ event_type: "Retry" })).toBe("retry");
+    expect(runSourceOf({ event_type: "Manual" })).toBe("manual");
+    expect(runSourceOf({ event_type: "SomethingNewer" })).toBe("other");
+  });
+
+  it("isHttpRun follows the run type, not the request facts", () => {
+    expect(isHttpRun({ event_type: "Webhook" })).toBe(true);
+    expect(isHttpRun({ event_type: "Retry" })).toBe(false);
+  });
+
+  it("every source label key exists in en-US", () => {
+    for (const key of Object.values(RUN_SOURCE_LABEL_KEYS)) {
+      expect(typeof lookup(key)).toBe("string");
+    }
+    expect(lookup(RUN_SOURCE_LABEL_KEYS.http)).toBe("HTTP request");
+  });
+});
diff --git a/web/src/plugins/workflows/httpEndpoint.ts b/web/src/plugins/workflows/httpEndpoint.ts
new file mode 100644
index 0000000000..e52f5b5f89
--- /dev/null
+++ b/web/src/plugins/workflows/httpEndpoint.ts
@@ -0,0 +1,60 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { I18nKey } from "@/types/i18n";
+import type { WorkflowHistoryRow, WorkflowListHttpFields } from "@/services/workflows";
+
+export type RunSource =
+  "http" | "alert_fired" | "incident_event" | "test" | "retry" | "manual" | "other";
+
+const SOURCE_BY_TYPE: Record<string, RunSource> = {
+  Webhook: "http",
+  AlertFired: "alert_fired",
+  AlertResolved: "alert_fired",
+  IncidentEvent: "incident_event",
+  Test: "test",
+  Retry: "retry",
+  Manual: "manual",
+};
+
+export const RUN_SOURCE_LABEL_KEYS: Record<RunSource, I18nKey> = {
+  http: "workflow.history.sourceHttp",
+  alert_fired: "workflow.history.sourceAlertFired",
+  incident_event: "workflow.history.sourceIncidentEvent",
+  test: "workflow.history.testRun",
+  retry: "workflow.history.sourceRetry",
+  manual: "workflow.history.sourceManual",
+  other: "workflow.history.sourceOther",
+};
+
+/** Every HTTP surface hides unless the server says hooks are on; an absent flag means an older server. */
+export function workflowHooksEnabled(
+  zoConfig: { workflow_hooks_enabled?: unknown } | null | undefined,
+): boolean {
+  return zoConfig?.workflow_hooks_enabled === true;
+}
+
+export function hasHttpEndpoint(row: WorkflowListHttpFields | null | undefined): boolean {
+  return row?.http_endpoint_enabled === true;
+}
+
+/** The run's own type decides the source; a retry of an HTTP run is a retry and carries no request facts. */
+export function runSourceOf(row: Pick<WorkflowHistoryRow, "event_type">): RunSource {
+  return SOURCE_BY_TYPE[row.event_type] ?? "other";
+}
+
+export function isHttpRun(row: Pick<WorkflowHistoryRow, "event_type">): boolean {
+  return runSourceOf(row) === "http";
+}
diff --git a/web/src/plugins/workflows/httpEndpointUi.ts b/web/src/plugins/workflows/httpEndpointUi.ts
new file mode 100644
index 0000000000..f2186d4c1c
--- /dev/null
+++ b/web/src/plugins/workflows/httpEndpointUi.ts
@@ -0,0 +1,177 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { inject, reactive, type InjectionKey } from "vue";
+import { raw, type I18nKey, type I18nText, type TranslateFn } from "@/types/i18n";
+import type { HookReasonCode, HookRunStatus, OverlapSeconds } from "@/services/workflows";
+import { buildHttpRequestSample } from "./httpRequestSample";
+import { bodySizeParts } from "./runStatus";
+import type { useWorkflowHttpEndpoint } from "./useWorkflowHttpEndpoint";
+
+export type PayloadFrom = "trigger" | "http";
+
+export type WorkflowHttpEndpoint = ReturnType<typeof useWorkflowHttpEndpoint>;
+
+/** The section provides its endpoint so the reveal, steady and advanced parts share one instance. */
+export const HTTP_ENDPOINT_KEY: InjectionKey<WorkflowHttpEndpoint> = Symbol("workflowHttpEndpoint");
+
+const MIB = 1024 * 1024;
+
+/** The default per-org queue cap (`ZO_WORKFLOW_HOOK_ORG_QUEUE_MAX`), named by the `queue_full` fix text. */
+export const ORG_QUEUE_MAX = 1000;
+
+/** Editor-wide endpoint state shared by the header, canvas badge, step dialog and Test drawer. */
+export const httpEditorState = reactive({
+  panelOpen: false,
+  endpointOn: false,
+  payloadFrom: "trigger" as PayloadFrom,
+});
+
+export const HOOK_REASON_KEYS: Record<HookReasonCode, { title: I18nKey; fix: I18nKey }> = {
+  invalid_token: {
+    title: "workflow.http.reason.invalid_token.title",
+    fix: "workflow.http.reason.invalid_token.fix",
+  },
+  invalid_signature: {
+    title: "workflow.http.reason.invalid_signature.title",
+    fix: "workflow.http.reason.invalid_signature.fix",
+  },
+  stale_timestamp: {
+    title: "workflow.http.reason.stale_timestamp.title",
+    fix: "workflow.http.reason.stale_timestamp.fix",
+  },
+  credential_in_url: {
+    title: "workflow.http.reason.credential_in_url.title",
+    fix: "workflow.http.reason.credential_in_url.fix",
+  },
+  endpoint_disabled: {
+    title: "workflow.http.reason.endpoint_disabled.title",
+    fix: "workflow.http.reason.endpoint_disabled.fix",
+  },
+  workflow_disabled: {
+    title: "workflow.http.reason.workflow_disabled.title",
+    fix: "workflow.http.reason.workflow_disabled.fix",
+  },
+  workflow_not_published: {
+    title: "workflow.http.reason.workflow_not_published.title",
+    fix: "workflow.http.reason.workflow_not_published.fix",
+  },
+  payload_too_large: {
+    title: "workflow.http.reason.payload_too_large.title",
+    fix: "workflow.http.reason.payload_too_large.fix",
+  },
+  invalid_idempotency_key: {
+    title: "workflow.http.reason.invalid_idempotency_key.title",
+    fix: "workflow.http.reason.invalid_idempotency_key.fix",
+  },
+  idempotency_key_reused: {
+    title: "workflow.http.reason.idempotency_key_reused.title",
+    fix: "workflow.http.reason.idempotency_key_reused.fix",
+  },
+  rate_limited: {
+    title: "workflow.http.reason.rate_limited.title",
+    fix: "workflow.http.reason.rate_limited.fix",
+  },
+  queue_full: {
+    title: "workflow.http.reason.queue_full.title",
+    fix: "workflow.http.reason.queue_full.fix",
+  },
+  worker_unavailable: {
+    title: "workflow.http.reason.worker_unavailable.title",
+    fix: "workflow.http.reason.worker_unavailable.fix",
+  },
+};
+
+/** The status code each stored reason answered with (design §7). */
+export const HOOK_REASON_STATUS: Record<HookReasonCode, number> = {
+  invalid_token: 401,
+  invalid_signature: 401,
+  stale_timestamp: 401,
+  credential_in_url: 400,
+  endpoint_disabled: 403,
+  workflow_disabled: 403,
+  workflow_not_published: 403,
+  payload_too_large: 413,
+  invalid_idempotency_key: 400,
+  idempotency_key_reused: 422,
+  rate_limited: 429,
+  queue_full: 503,
+  worker_unavailable: 503,
+};
+
+export const LAST_CALL_STATUS_KEYS: Record<HookRunStatus, I18nKey> = {
+  queued: "workflow.http.lastCallStatus.queued",
+  running: "workflow.http.lastCallStatus.running",
+  succeeded: "workflow.http.lastCallStatus.succeeded",
+  failed: "workflow.http.lastCallStatus.failed",
+  expired: "workflow.http.lastCallStatus.expired",
+};
+
+export const OVERLAP_OPTIONS: { value: OverlapSeconds; labelKey: I18nKey }[] = [
+  { value: 0, labelKey: "workflow.http.overlapNow" },
+  { value: 3600, labelKey: "workflow.http.overlapHour" },
+  { value: 86400, labelKey: "workflow.http.overlapDay" },
+  { value: 604800, labelKey: "workflow.http.overlapWeek" },
+];
+
+/** A client-side refusal whose reason is an i18n key, so no English reaches the panel's copy. */
+export class HttpEndpointError extends Error {
+  constructor(public readonly key: I18nKey) {
+    super(key);
+    this.name = "HttpEndpointError";
+  }
+}
+
+export function openHttpPanel(): void {
+  httpEditorState.panelOpen = true;
+}
+
+export function resetHttpEditorState(): void {
+  httpEditorState.panelOpen = false;
+  httpEditorState.endpointOn = false;
+  httpEditorState.payloadFrom = "trigger";
+}
+
+/** True while the author previews steps with the HTTP request instead of the kind's event. */
+export function usesHttpPayload(): boolean {
+  return httpEditorState.endpointOn && httpEditorState.payloadFrom === "http";
+}
+
+/** The HTTP request an author previews before any run; the Test drawer uses trigger id "test". */
+export function httpPreviewSample(triggerId?: string): unknown[] {
+  return buildHttpRequestSample(triggerId ? { trigger_id: triggerId } : {});
+}
+
+export function useHttpEndpoint(): WorkflowHttpEndpoint {
+  const endpoint = inject(HTTP_ENDPOINT_KEY);
+  if (!endpoint) throw new Error("useHttpEndpoint needs WorkflowHttpEndpointSection");
+  return endpoint;
+}
+
+/** The server's message, a client refusal's translated reason, else the unknown-error copy. */
+export function httpErrorText(err: unknown, t: TranslateFn): I18nText {
+  if (err instanceof HttpEndpointError) return t(err.key);
+  const message = (err as { response?: { data?: { message?: string } } } | null)?.response?.data
+    ?.message;
+  return message ? raw(message) : t("common.unknownError");
+}
+
+/** Whole mebibytes read as MiB, everything else through the run view's B / KiB formatter. */
+export function formatBodySize(bytes: number, t: TranslateFn): I18nText {
+  if (bytes >= MIB && bytes % MIB === 0)
+    return t("workflow.http.bodySizeMiB", { size: bytes / MIB });
+  const { key, size } = bodySizeParts(bytes);
+  return t(key, { size });
+}
diff --git a/web/src/plugins/workflows/httpRequestSample.spec.ts b/web/src/plugins/workflows/httpRequestSample.spec.ts
new file mode 100644
index 0000000000..a79b354c4f
--- /dev/null
+++ b/web/src/plugins/workflows/httpRequestSample.spec.ts
@@ -0,0 +1,111 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import {
+  HTTP_HEADER_ALLOWLIST,
+  HTTP_REQUEST_PAYLOAD_FIELDS,
+  buildHttpRequestSample,
+  httpQueryKeys,
+  httpRequestPayloadFields,
+  isHttpRequestInput,
+} from "./httpRequestSample";
+
+describe("buildHttpRequestSample", () => {
+  it("the sample carries trigger_source http", () => {
+    const sample = buildHttpRequestSample() as any[];
+
+    expect(sample).toHaveLength(1);
+    expect(sample[0].meta).toMatchObject({
+      event_type: "webhook",
+      trigger_source: "http",
+      query: {},
+      headers: { "content-type": "application/json" },
+    });
+    expect(typeof sample[0].meta.trigger_id).toBe("string");
+    expect(typeof sample[0].meta.run_id).toBe("string");
+    expect(Number.isInteger(sample[0].meta.received_at)).toBe(true);
+    expect(String(sample[0].meta.received_at)).toHaveLength(16);
+    expect(Array.isArray(sample[0].data)).toBe(true);
+    expect(sample[0].data.length).toBeGreaterThan(0);
+  });
+
+  it("takes the trigger id and the body rows it is given", () => {
+    const [first] = buildHttpRequestSample({ trigger_id: "test", data: [{ a: 1 }] }) as any[];
+
+    expect(first.meta.trigger_id).toBe("test");
+    expect(first.data).toEqual([{ a: 1 }]);
+  });
+
+  it("returns a fresh copy every call", () => {
+    const a = buildHttpRequestSample() as any[];
+    a[0].meta.headers.extra = "x";
+
+    expect((buildHttpRequestSample() as any[])[0].meta.headers.extra).toBeUndefined();
+  });
+});
+
+describe("HTTP_REQUEST_PAYLOAD_FIELDS", () => {
+  it("the field list has no data fields", () => {
+    const values = HTTP_REQUEST_PAYLOAD_FIELDS.map((f) => f.value);
+
+    expect(values.some((v) => v.startsWith("data"))).toBe(false);
+    expect(values).toEqual(
+      expect.arrayContaining(["meta_trigger_source", "meta_event_type", "meta_trigger_id"]),
+    );
+  });
+
+  it("offers every allowlisted header as meta.headers.<name>", () => {
+    expect(HTTP_HEADER_ALLOWLIST).toHaveLength(13);
+    for (const name of HTTP_HEADER_ALLOWLIST) {
+      expect(HTTP_REQUEST_PAYLOAD_FIELDS.map((f) => String(f.label))).toContain(
+        `meta.headers.${name}`,
+      );
+    }
+    expect(HTTP_HEADER_ALLOWLIST).not.toContain("authorization");
+  });
+
+  it("query keys become meta.query fields", () => {
+    const fields = httpRequestPayloadFields(["env", "region"]);
+
+    expect(fields.slice(-2)).toEqual([
+      { label: "meta.query.env", value: "meta_query_env", type: "Utf8" },
+      { label: "meta.query.region", value: "meta_query_region", type: "Utf8" },
+    ]);
+    expect(fields.slice(0, HTTP_REQUEST_PAYLOAD_FIELDS.length)).toEqual(
+      HTTP_REQUEST_PAYLOAD_FIELDS,
+    );
+  });
+});
+
+describe("reading an HTTP request input", () => {
+  const http = JSON.stringify([
+    { meta: { trigger_source: "http", query: { env: ["a", "b"], region: "eu" } }, data: [] },
+  ]);
+
+  it("httpQueryKeys lists the query keys of an HTTP input and nothing else", () => {
+    expect(httpQueryKeys(http)).toEqual(["env", "region"]);
+    expect(httpQueryKeys(JSON.stringify(buildHttpRequestSample()))).toEqual([]);
+    expect(httpQueryKeys(JSON.stringify([{ meta: { query: { a: 1 } } }]))).toEqual([]);
+    expect(httpQueryKeys("not json")).toEqual([]);
+    expect(httpQueryKeys(undefined)).toEqual([]);
+  });
+
+  it("isHttpRequestInput is true only for records stamped trigger_source http", () => {
+    expect(isHttpRequestInput(http)).toBe(true);
+    expect(isHttpRequestInput(JSON.stringify([{ meta: { alert_name: "x" } }]))).toBe(false);
+    expect(isHttpRequestInput("{")).toBe(false);
+  });
+});
diff --git a/web/src/plugins/workflows/httpRequestSample.ts b/web/src/plugins/workflows/httpRequestSample.ts
new file mode 100644
index 0000000000..0cef5bf3c4
--- /dev/null
+++ b/web/src/plugins/workflows/httpRequestSample.ts
@@ -0,0 +1,101 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { raw } from "@/types/i18n";
+import type { WorkflowFieldOption } from "./alertFields";
+
+/** The headers a run keeps, in the server's order (`payload.rs` HEADER_ALLOWLIST). */
+export const HTTP_HEADER_ALLOWLIST = [
+  "content-type",
+  "content-length",
+  "user-agent",
+  "x-request-id",
+  "x-correlation-id",
+  "traceparent",
+  "tracestate",
+  "webhook-id",
+  "webhook-timestamp",
+  "idempotency-key",
+  "x-github-event",
+  "x-github-delivery",
+  "x-event-type",
+] as const;
+
+const SAMPLE_RECEIVED_AT = 1792575542418000;
+
+const field = (path: string): WorkflowFieldOption => ({
+  label: raw(path),
+  value: path.replace(/\./g, "_"),
+  type: "Utf8",
+});
+
+// No `data.*`: `data` is always an array and condition column lookup only walks objects.
+export const HTTP_REQUEST_PAYLOAD_FIELDS: WorkflowFieldOption[] = [
+  field("meta.trigger_source"),
+  field("meta.event_type"),
+  field("meta.trigger_id"),
+  ...HTTP_HEADER_ALLOWLIST.map((name) => field(`meta.headers.${name}`)),
+];
+
+/** The fixed fields plus `meta.query.<key>` for each query key the caller sends. */
+export function httpRequestPayloadFields(queryKeys: readonly string[] = []): WorkflowFieldOption[] {
+  return [...HTTP_REQUEST_PAYLOAD_FIELDS, ...queryKeys.map((key) => field(`meta.query.${key}`))];
+}
+
+/** True when a JSON input's first record is an HTTP request (`meta.trigger_source = "http"`). */
+export function isHttpRequestInput(text: string | undefined): boolean {
+  return httpRequestMeta(text) !== null;
+}
+
+/** The query keys of a JSON HTTP request input, so the field pickers can offer `meta.query.<key>`. */
+export function httpQueryKeys(text: string | undefined): string[] {
+  const query = httpRequestMeta(text)?.query;
+  return query && typeof query === "object" && !Array.isArray(query) ? Object.keys(query) : [];
+}
+
+/** What every step of an HTTP run receives (`payload.rs` build_input); `received_at` is in µs. */
+export function buildHttpRequestSample(
+  opts: { trigger_id?: string; run_id?: string; received_at?: number; data?: unknown[] } = {},
+): unknown[] {
+  return [
+    {
+      meta: {
+        event_type: "webhook",
+        trigger_source: "http",
+        trigger_id: opts.trigger_id ?? "7fT2kQ9xLmN4pR8sV1wY3z",
+        run_id: opts.run_id ?? "0199f3c2-7d1e-7a4b-9c2d-5e6f7a8b9c0d",
+        received_at: opts.received_at ?? SAMPLE_RECEIVED_AT,
+        query: {},
+        headers: { "content-type": "application/json" },
+      },
+      data: opts.data ?? [{ service: "checkout", deploy_id: "d-4821", reason: "canary failed" }],
+    },
+  ];
+}
+
+function httpRequestMeta(text: string | undefined): Record<string, unknown> | null {
+  let parsed: unknown;
+  try {
+    parsed = JSON.parse(text ?? "");
+  } catch {
+    return null;
+  }
+  const first: unknown = Array.isArray(parsed) ? parsed[0] : null;
+  const meta: unknown =
+    first && typeof first === "object" ? (first as { meta?: unknown }).meta : undefined;
+  if (!meta || typeof meta !== "object") return null;
+  const record = meta as Record<string, unknown>;
+  return record.trigger_source === "http" ? record : null;
+}
diff --git a/web/src/plugins/workflows/httpSnippets.spec.ts b/web/src/plugins/workflows/httpSnippets.spec.ts
new file mode 100644
index 0000000000..bcba606fc0
--- /dev/null
+++ b/web/src/plugins/workflows/httpSnippets.spec.ts
@@ -0,0 +1,160 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import {
+  DEFAULT_SAMPLE_BODY,
+  buildMaskedSnippet,
+  buildSnippet,
+  maskSecret,
+  type SnippetLang,
+} from "./httpSnippets";
+
+const URL = "https://o2.example.com/api/v2/default/workflows/hooks/7fT2kQ9xLmN4pR8sV1wY3z";
+const TOKEN = "o2wh_4fK9pQ2mZ7vX1cR8tY3nB6wL0sD5hJ2gE9aU1oI4k";
+const SIGNING = "whsec_MfKQ9r8GKYqrTwjUPD8ILPZIo2LaLaSw";
+const BODY = '{"service":"checkout","deploy_id":"d-4821","reason":"canary failed"}';
+const LANGS: SnippetLang[] = ["curl", "js", "python"];
+
+const token = { url: URL, mode: "token" as const, secret: TOKEN, sampleBody: BODY };
+const signed = { url: URL, mode: "signature" as const, secret: SIGNING, sampleBody: BODY };
+
+describe("buildSnippet", () => {
+  it("curl uses -sS and --data-binary", () => {
+    const curl = buildSnippet("curl", token);
+
+    expect(curl).toContain(`curl -sS -X POST '${URL}'`);
+    expect(curl).toContain(`-H 'Authorization: Bearer ${TOKEN}'`);
+    expect(curl).toContain("-H 'Content-Type: application/json'");
+    expect(curl).toContain(`--data-binary '${BODY}'`);
+    expect(curl).not.toMatch(/\s-d\s/);
+  });
+
+  it("curl escapes a single quote in the body for the shell", () => {
+    const curl = buildSnippet("curl", { ...token, sampleBody: `{"note":"it's"}` });
+
+    expect(curl).toContain(`--data-binary '{"note":"it'\\''s"}'`);
+  });
+
+  it("adds the Idempotency-Key header when one is given", () => {
+    expect(buildSnippet("curl", { ...token, idempotencyKey: "deploy-d-4821" })).toContain(
+      "-H 'Idempotency-Key: deploy-d-4821'",
+    );
+    expect(buildSnippet("curl", token)).not.toContain("Idempotency-Key");
+  });
+
+  it("JavaScript posts with fetch, headers and the raw body", () => {
+    const js = buildSnippet("js", token);
+
+    expect(js).toContain(`fetch(${JSON.stringify(URL)}, {`);
+    expect(js).toContain('method: "POST"');
+    expect(js).toContain(`Authorization: ${JSON.stringify(`Bearer ${TOKEN}`)}`);
+    expect(js).toContain(`body: ${JSON.stringify(BODY)}`);
+  });
+
+  it("Python posts with requests.post and data=body", () => {
+    const python = buildSnippet("python", token);
+
+    expect(python).toContain("import requests");
+    expect(python).toContain(`requests.post(\n    ${JSON.stringify(URL)},`);
+    expect(python).toContain("headers=headers");
+    expect(python).toContain("data=body");
+    expect(python).toContain(`"Authorization": ${JSON.stringify(`Bearer ${TOKEN}`)}`);
+  });
+
+  it("signed mode snippet computes the signature in shell", () => {
+    const curl = buildSnippet("curl", signed);
+
+    expect(curl).toContain(`SECRET='${SIGNING}'`);
+    expect(curl).toContain(`BODY='${BODY}'`);
+    expect(curl).toContain("openssl dgst -sha256 -mac HMAC");
+    expect(curl).toContain('-H "webhook-id: $MSG_ID"');
+    expect(curl).toContain('-H "webhook-timestamp: $TS"');
+    expect(curl).toContain('-H "webhook-signature: v1,$SIG"');
+    expect(curl).toContain('--data-binary "$BODY"');
+    expect(curl).not.toContain("Authorization");
+  });
+
+  it("signed JavaScript and Python sign id.timestamp.body with HMAC-SHA256", () => {
+    const js = buildSnippet("js", signed);
+    const python = buildSnippet("python", signed);
+
+    expect(js).toContain('createHmac("sha256"');
+    expect(js).toContain("`${id}.${ts}.${body}`");
+    expect(js).toContain('"webhook-signature": `v1,${signature}`');
+    expect(python).toContain('hmac.new(key, f"{msg_id}.{ts}.{body}".encode(), hashlib.sha256)');
+    expect(python).toContain('"webhook-signature": f"v1,{signature}"');
+  });
+
+  it("a missing secret renders a placeholder, never an empty credential", () => {
+    expect(buildSnippet("curl", { ...token, secret: null })).toContain(
+      '-H "Authorization: Bearer $O2_HOOK_TOKEN"',
+    );
+  });
+});
+
+describe("buildMaskedSnippet", () => {
+  it("masked snippets never contain the secret", () => {
+    for (const lang of LANGS) {
+      const maskedToken = buildMaskedSnippet(lang, {
+        url: URL,
+        mode: "token",
+        sampleBody: BODY,
+        displayPrefix: "o2wh_4fK9…oI4k",
+      });
+      const maskedSigned = buildMaskedSnippet(lang, {
+        url: URL,
+        mode: "signature",
+        sampleBody: BODY,
+        displayPrefix: "whsec_MfKQ…LaSw",
+      });
+
+      expect(maskedToken).not.toContain(TOKEN);
+      expect(maskedToken).not.toContain("4fK9");
+      expect(maskedToken).toContain("o2wh_••••••••••••••••");
+      expect(maskedSigned).not.toContain(SIGNING);
+      expect(maskedSigned).toContain("whsec_••••••••••••••••");
+    }
+  });
+
+  it("keeps everything but the credential identical to the real snippet", () => {
+    const real = buildSnippet("curl", token);
+    const masked = buildMaskedSnippet("curl", {
+      url: URL,
+      mode: "token",
+      sampleBody: BODY,
+      displayPrefix: "o2wh_4fK9…oI4k",
+    });
+
+    expect(masked).toBe(real.replace(TOKEN, "o2wh_••••••••••••••••"));
+  });
+});
+
+describe("maskSecret", () => {
+  it("keeps the display prefix ends and hides the middle", () => {
+    expect(maskSecret("o2wh_4fK9…oI4k")).toBe(`o2wh_4fK9${"•".repeat(20)}oI4k`);
+    expect(maskSecret("whsec_Q2xm…8f0=")).toBe(`whsec_Q2xm${"•".repeat(20)}8f0=`);
+  });
+
+  it("masks a prefix without an ellipsis whole", () => {
+    expect(maskSecret("o2wh_abcd")).toBe(`o2wh_abcd${"•".repeat(20)}`);
+  });
+});
+
+describe("DEFAULT_SAMPLE_BODY", () => {
+  it("is compact JSON", () => {
+    expect(JSON.stringify(JSON.parse(DEFAULT_SAMPLE_BODY))).toBe(DEFAULT_SAMPLE_BODY);
+  });
+});
diff --git a/web/src/plugins/workflows/httpSnippets.ts b/web/src/plugins/workflows/httpSnippets.ts
new file mode 100644
index 0000000000..bf69d08bf7
--- /dev/null
+++ b/web/src/plugins/workflows/httpSnippets.ts
@@ -0,0 +1,208 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { HttpAuthMode } from "@/services/workflows";
+
+export type SnippetLang = "curl" | "js" | "python";
+
+export interface SnippetInput {
+  url: string;
+  mode: HttpAuthMode;
+  /** `null` renders an environment-variable placeholder instead of a value. */
+  secret: string | null;
+  sampleBody: string;
+  idempotencyKey?: string;
+}
+
+export type MaskedSnippetInput = Omit<SnippetInput, "secret"> & { displayPrefix: string };
+
+export const DEFAULT_SAMPLE_BODY =
+  '{"service":"checkout","deploy_id":"d-4821","reason":"canary failed"}';
+
+const MASK = "•";
+const TOKEN_ENV = "O2_HOOK_TOKEN";
+const SECRET_ENV = "O2_HOOK_SECRET";
+const SCHEME_PREFIX: Record<HttpAuthMode, string> = { token: "o2wh_", signature: "whsec_" };
+
+// Single-quoted shell words keep `$` and `\` literal; only `'` needs the close-escape-reopen dance.
+const shellQuote = (value: string): string => `'${value.replace(/'/g, "'\\''")}'`;
+
+const json = (value: string): string => JSON.stringify(value);
+
+const curlToken = (input: SnippetInput): string => {
+  const auth =
+    input.secret === null
+      ? `-H "Authorization: Bearer $${TOKEN_ENV}"`
+      : `-H ${shellQuote(`Authorization: Bearer ${input.secret}`)}`;
+  const lines = [
+    `curl -sS -X POST ${shellQuote(input.url)}`,
+    `  ${auth}`,
+    `  -H 'Content-Type: application/json'`,
+  ];
+  if (input.idempotencyKey) {
+    lines.push(`  -H ${shellQuote(`Idempotency-Key: ${input.idempotencyKey}`)}`);
+  }
+  lines.push(`  --data-binary ${shellQuote(input.sampleBody)}`);
+  return lines.join(" \\\n");
+};
+
+// `--data-binary "$BODY"` sends exactly the bytes the HMAC covered.
+const curlSigned = (input: SnippetInput): string =>
+  [
+    input.secret === null ? `SECRET="$${SECRET_ENV}"` : `SECRET=${shellQuote(input.secret)}`,
+    `URL=${shellQuote(input.url)}`,
+    `BODY=${shellQuote(input.sampleBody)}`,
+    `MSG_ID="msg_$(openssl rand -hex 12)"`,
+    `TS=$(date +%s)`,
+    `KEY_HEX=$(printf '%s' "\${SECRET#whsec_}" | openssl base64 -d -A | od -An -tx1 | tr -d ' \\n')`,
+    `SIG=$(printf '%s.%s.%s' "$MSG_ID" "$TS" "$BODY" \\`,
+    `      | openssl dgst -sha256 -mac HMAC -macopt "hexkey:$KEY_HEX" -binary | openssl base64 -A)`,
+    [
+      `curl -sS -X POST "$URL"`,
+      `  -H 'Content-Type: application/json'`,
+      `  -H "webhook-id: $MSG_ID"`,
+      `  -H "webhook-timestamp: $TS"`,
+      `  -H "webhook-signature: v1,$SIG"`,
+      `  --data-binary "$BODY"`,
+    ].join(" \\\n"),
+  ].join("\n");
+
+const jsFetch = (url: string, headers: string[], body: string): string =>
+  [
+    `const response = await fetch(${json(url)}, {`,
+    `  method: "POST",`,
+    `  headers: {`,
+    ...headers.map((h) => `    ${h},`),
+    `  },`,
+    `  body: ${body},`,
+    `});`,
+    `console.log(response.status, await response.text());`,
+  ].join("\n");
+
+const jsToken = (input: SnippetInput): string => {
+  const auth =
+    input.secret === null
+      ? `Authorization: \`Bearer \${process.env.${TOKEN_ENV}}\``
+      : `Authorization: ${json(`Bearer ${input.secret}`)}`;
+  const headers = [auth, `"Content-Type": "application/json"`];
+  if (input.idempotencyKey) headers.push(`"Idempotency-Key": ${json(input.idempotencyKey)}`);
+  return jsFetch(input.url, headers, json(input.sampleBody));
+};
+
+const jsSigned = (input: SnippetInput): string =>
+  [
+    `import { createHmac, randomBytes } from "node:crypto";`,
+    ``,
+    `const secret = ${input.secret === null ? `process.env.${SECRET_ENV}` : json(input.secret)};`,
+    `const body = ${json(input.sampleBody)};`,
+    `const id = \`msg_\${randomBytes(12).toString("hex")}\`;`,
+    `const ts = Math.floor(Date.now() / 1000);`,
+    `const key = Buffer.from(secret.replace(/^whsec_/, ""), "base64");`,
+    `const signature = createHmac("sha256", key).update(\`\${id}.\${ts}.\${body}\`).digest("base64");`,
+    ``,
+    jsFetch(
+      input.url,
+      [
+        `"Content-Type": "application/json"`,
+        `"webhook-id": id`,
+        `"webhook-timestamp": String(ts)`,
+        `"webhook-signature": \`v1,\${signature}\``,
+      ],
+      "body",
+    ),
+  ].join("\n");
+
+const pythonPost = (url: string): string[] => [
+  ``,
+  `response = requests.post(`,
+  `    ${json(url)},`,
+  `    headers=headers,`,
+  `    data=body,`,
+  `)`,
+  `print(response.status_code, response.text)`,
+];
+
+const pythonToken = (input: SnippetInput): string => {
+  const auth =
+    input.secret === null
+      ? `"Authorization": f"Bearer {os.environ['${TOKEN_ENV}']}"`
+      : `"Authorization": ${json(`Bearer ${input.secret}`)}`;
+  const headers = [auth, `"Content-Type": "application/json"`];
+  if (input.idempotencyKey) headers.push(`"Idempotency-Key": ${json(input.idempotencyKey)}`);
+  return [
+    ...(input.secret === null ? [`import os`, ``] : []),
+    `import requests`,
+    ``,
+    `body = ${json(input.sampleBody)}`,
+    `headers = {`,
+    ...headers.map((h) => `    ${h},`),
+    `}`,
+    ...pythonPost(input.url),
+  ].join("\n");
+};
+
+const pythonSigned = (input: SnippetInput): string =>
+  [
+    `import base64`,
+    `import hashlib`,
+    `import hmac`,
+    ...(input.secret === null ? [`import os`] : []),
+    `import secrets`,
+    `import time`,
+    ``,
+    `import requests`,
+    ``,
+    `secret = ${input.secret === null ? `os.environ["${SECRET_ENV}"]` : json(input.secret)}`,
+    `body = ${json(input.sampleBody)}`,
+    `msg_id = f"msg_{secrets.token_hex(12)}"`,
+    `ts = str(int(time.time()))`,
+    `key = base64.b64decode(secret.removeprefix("whsec_"))`,
+    `signature = base64.b64encode(`,
+    `    hmac.new(key, f"{msg_id}.{ts}.{body}".encode(), hashlib.sha256).digest()`,
+    `).decode()`,
+    `headers = {`,
+    `    "Content-Type": "application/json",`,
+    `    "webhook-id": msg_id,`,
+    `    "webhook-timestamp": ts,`,
+    `    "webhook-signature": f"v1,{signature}",`,
+    `}`,
+    ...pythonPost(input.url),
+  ].join("\n");
+
+const BUILDERS: Record<SnippetLang, Record<HttpAuthMode, (input: SnippetInput) => string>> = {
+  curl: { token: curlToken, signature: curlSigned },
+  js: { token: jsToken, signature: jsSigned },
+  python: { token: pythonToken, signature: pythonSigned },
+};
+
+/** The real call (never `dry_run=true`), so a copied snippet starts a run. */
+export function buildSnippet(lang: SnippetLang, input: SnippetInput): string {
+  return BUILDERS[lang][input.mode](input);
+}
+
+/** Same text as `buildSnippet` with the credential replaced by its scheme and bullets. */
+export function buildMaskedSnippet(lang: SnippetLang, input: MaskedSnippetInput): string {
+  const { displayPrefix, ...rest } = input;
+  const scheme = displayPrefix.includes("_")
+    ? displayPrefix.slice(0, displayPrefix.indexOf("_") + 1)
+    : SCHEME_PREFIX[input.mode];
+  return buildSnippet(lang, { ...rest, secret: `${scheme}${MASK.repeat(16)}` });
+}
+
+/** `o2wh_4fK9…oI4k` → `o2wh_4fK9••••••••••••••••••••oI4k`; the display prefix is not secret. */
+export function maskSecret(displayPrefix: string): string {
+  const [head, tail = ""] = displayPrefix.split("…");
+  return `${head}${MASK.repeat(20)}${tail}`;
+}
diff --git a/web/src/plugins/workflows/nodes/WorkflowBranch.spec.ts b/web/src/plugins/workflows/nodes/WorkflowBranch.spec.ts
index 28efbe1c5a..ecf0aba47b 100644
--- a/web/src/plugins/workflows/nodes/WorkflowBranch.spec.ts
+++ b/web/src/plugins/workflows/nodes/WorkflowBranch.spec.ts
@@ -65,6 +65,7 @@ vi.mock("@/components/flow/forms/ConditionBuilder.vue", () => ({
 import { workflowObj } from "@/plugins/workflows/useWorkflowCanvas";
 import { ALERT_PAYLOAD_FIELDS } from "@/plugins/workflows/alertFields";
 import { INCIDENT_PAYLOAD_FIELDS } from "@/plugins/workflows/incidentFields";
+import { httpEditorState, resetHttpEditorState } from "@/plugins/workflows/httpEndpointUi";
 import WorkflowBranch from "./WorkflowBranch.vue";
 
 const seedTrigger = (kind = "alert_fired") => {
@@ -524,3 +525,32 @@ describe("WorkflowBranch", () => {
     });
   });
 });
+
+describe("WorkflowBranch HTTP request field group (AC-UI-32)", () => {
+  beforeEach(() => {
+    workflowObj.currentSelectedNodeData = null;
+    seedTrigger("incident_event");
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: true };
+  });
+  afterEach(() => {
+    resetHttpEditorState();
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    workflowObj.currentSelectedWorkflow.nodes = [];
+  });
+
+  it("every case offers the HTTP group while the endpoint is on, and only the kind's list while off", () => {
+    expect(builders(createWrapper())[0].props("fields")).toEqual(INCIDENT_PAYLOAD_FIELDS);
+    httpEditorState.endpointOn = true;
+    const fields = builders(createWrapper())[0].props("fields");
+    const values = fields.map((f: any) => f.value);
+    expect(values).toContain("meta_event_type");
+    expect(values).toContain("meta_trigger_source");
+    expect(values.filter((v: string) => v.startsWith("data"))).toEqual([]);
+    expect(fields.map((f: any) => String(f.label))).not.toContain(
+      i18n.global.t("workflow.http.fieldGroupBodyHint"),
+    );
+    expect(
+      createWrapper().find('[data-test="workflow-condition-http-body-hint"]').text(),
+    ).toContain(i18n.global.t("workflow.http.fieldGroupBodyHint"));
+  });
+});
diff --git a/web/src/plugins/workflows/nodes/WorkflowBranch.vue b/web/src/plugins/workflows/nodes/WorkflowBranch.vue
index a8e3104d42..6fa0af1b02 100644
--- a/web/src/plugins/workflows/nodes/WorkflowBranch.vue
+++ b/web/src/plugins/workflows/nodes/WorkflowBranch.vue
@@ -108,6 +108,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           optional
         />
       </div>
+      <WorkflowHttpFieldHint v-if="httpOn" />
 
       <OButton variant="dashed" size="sm" data-test="workflow-branch-add-case" @click="addCase">
         <OIcon name="add" size="xs" />
@@ -131,7 +132,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script lang="ts" setup>
-import { ref } from "vue";
+import { computed, ref } from "vue";
+import { useStore } from "vuex";
 import { useI18nTyped, raw, type I18nText } from "@/types/i18n";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
@@ -145,7 +147,11 @@ import {
   currentTriggerKind,
   setNodeIncomplete,
 } from "@/plugins/workflows/useWorkflowCanvas";
-import { triggerDef } from "@/plugins/workflows/triggers";
+import { conditionFieldOptions } from "@/plugins/workflows/triggers";
+import { workflowHooksEnabled } from "@/plugins/workflows/httpEndpoint";
+import { httpEditorState } from "@/plugins/workflows/httpEndpointUi";
+import { httpQueryKeys } from "@/plugins/workflows/httpRequestSample";
+import WorkflowHttpFieldHint from "./WorkflowHttpFieldHint.vue";
 
 // The else arm's handle is fixed: `branchHandleRank` sorts it last on the canvas,
 // and a case can never claim it (case handles are always `case-N`).
@@ -158,6 +164,7 @@ interface CaseRow {
 }
 
 const { t } = useI18nTyped();
+const store = useStore();
 
 const tips: I18nText[] = [
   t("workflow.node.branchNoteFirstMatch"),
@@ -167,7 +174,12 @@ const tips: I18nText[] = [
 // Field options come from the CURRENT trigger's kind, exactly as WorkflowCondition
 // does; with no trigger we offer nothing rather than a wrong set.
 const kind = currentTriggerKind();
-const fields = kind ? triggerDef(kind).conditionFields : [];
+const httpOn = computed(
+  () => workflowHooksEnabled(store.state.zoConfig) && httpEditorState.endpointOn,
+);
+const fields = computed(() =>
+  conditionFieldOptions(kind, httpOn.value, t, httpQueryKeys(workflowObj.testRun.input)),
+);
 
 const saved = workflowObj.currentSelectedNodeData?.data?.cases;
 
diff --git a/web/src/plugins/workflows/nodes/WorkflowCondition.spec.ts b/web/src/plugins/workflows/nodes/WorkflowCondition.spec.ts
index 94111af062..4a9ef099e5 100644
--- a/web/src/plugins/workflows/nodes/WorkflowCondition.spec.ts
+++ b/web/src/plugins/workflows/nodes/WorkflowCondition.spec.ts
@@ -56,6 +56,7 @@ vi.mock("@/components/flow/forms/ConditionBuilder.vue", () => ({
 import { workflowObj } from "@/plugins/workflows/useWorkflowCanvas";
 import { ALERT_PAYLOAD_FIELDS } from "@/plugins/workflows/alertFields";
 import { INCIDENT_PAYLOAD_FIELDS } from "@/plugins/workflows/incidentFields";
+import { httpEditorState, resetHttpEditorState } from "@/plugins/workflows/httpEndpointUi";
 import WorkflowCondition from "./WorkflowCondition.vue";
 
 // The condition's field options come from the CURRENT trigger's kind, so seed a
@@ -229,3 +230,65 @@ describe("WorkflowCondition", () => {
     expect(wrapper.findComponent({ name: "ConditionBuilder" }).props("optional")).toBe(true);
   });
 });
+
+describe("WorkflowCondition HTTP request field group (AC-UI-32)", () => {
+  beforeEach(() => {
+    seedTrigger("alert_fired");
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: true };
+  });
+  afterEach(() => {
+    resetHttpEditorState();
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    workflowObj.currentSelectedWorkflow.nodes = [];
+  });
+
+  it("offers the HTTP group with the body and repeated-key hints on their own line", () => {
+    httpEditorState.endpointOn = true;
+    const wrapper = createWrapper();
+    const fields: { value: string; label: unknown }[] = wrapper
+      .findComponent({ name: "ConditionBuilder" })
+      .props("fields");
+    const values = fields.map((f) => f.value);
+    expect(values).toContain("meta_alert_name");
+    expect(values).toContain("meta_trigger_source");
+    expect(values.filter((v) => v.startsWith("data"))).toEqual([]);
+    expect(fields.map((f) => String(f.label))).not.toContain(
+      i18n.global.t("workflow.http.fieldGroupBodyHint"),
+    );
+    const hint = wrapper.find('[data-test="workflow-condition-http-body-hint"]');
+    expect(hint.text()).toContain(i18n.global.t("workflow.http.fieldGroupBodyHint"));
+    expect(hint.text()).toContain(i18n.global.t("workflow.http.fieldGroupQueryHint"));
+    expect(i18n.global.t("workflow.http.fieldGroupQueryHint")).toContain(
+      "repeated keys arrive as a list and never match",
+    );
+  });
+
+  it("offers meta.query keys from the HTTP test input", () => {
+    httpEditorState.endpointOn = true;
+    workflowObj.testRun.input = JSON.stringify([
+      { meta: { trigger_source: "http", query: { env: "prod" } }, data: [] },
+    ]);
+    const fields: { value: string }[] = createWrapper()
+      .findComponent({ name: "ConditionBuilder" })
+      .props("fields");
+    workflowObj.testRun.input = "";
+    expect(fields.map((f) => f.value)).toContain("meta_query_env");
+  });
+
+  it("shows no HTTP hint while the endpoint is off", () => {
+    expect(createWrapper().find('[data-test="workflow-condition-http-body-hint"]').exists()).toBe(
+      false,
+    );
+  });
+
+  it("keeps the kind's list while the endpoint is off or hooks are off (regression guard)", () => {
+    expect(createWrapper().findComponent({ name: "ConditionBuilder" }).props("fields")).toEqual(
+      ALERT_PAYLOAD_FIELDS,
+    );
+    httpEditorState.endpointOn = true;
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    expect(createWrapper().findComponent({ name: "ConditionBuilder" }).props("fields")).toEqual(
+      ALERT_PAYLOAD_FIELDS,
+    );
+  });
+});
diff --git a/web/src/plugins/workflows/nodes/WorkflowCondition.vue b/web/src/plugins/workflows/nodes/WorkflowCondition.vue
index 3ed0199c34..cb93cf9ff9 100644
--- a/web/src/plugins/workflows/nodes/WorkflowCondition.vue
+++ b/web/src/plugins/workflows/nodes/WorkflowCondition.vue
@@ -100,11 +100,13 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
         </div>
       </template>
     </ConditionBuilder>
+    <WorkflowHttpFieldHint v-if="httpOn" />
   </div>
 </template>
 
 <script lang="ts" setup>
-import { ref } from "vue";
+import { computed, ref } from "vue";
+import { useStore } from "vuex";
 import { useI18nTyped, type I18nText } from "@/types/i18n";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OButton from "@/lib/core/Button/OButton.vue";
@@ -116,9 +118,14 @@ import {
   currentTriggerKind,
   setNodeIncomplete,
 } from "@/plugins/workflows/useWorkflowCanvas";
-import { triggerDef } from "@/plugins/workflows/triggers";
+import { conditionFieldOptions } from "@/plugins/workflows/triggers";
+import { workflowHooksEnabled } from "@/plugins/workflows/httpEndpoint";
+import { httpEditorState } from "@/plugins/workflows/httpEndpointUi";
+import { httpQueryKeys } from "@/plugins/workflows/httpRequestSample";
+import WorkflowHttpFieldHint from "./WorkflowHttpFieldHint.vue";
 
 const { t } = useI18nTyped();
+const store = useStore();
 
 // The guidelines, as data — rendered in BOTH the inline first-run box and the
 // recall tooltip, so the copy lives in one place. The null/empty value hints
@@ -142,7 +149,12 @@ const dismissGuidelines = () => {
 // With no trigger (it was deleted), we offer nothing rather than a wrong set —
 // the user can still type any column via allow-custom-columns.
 const kind = currentTriggerKind();
-const fields = kind ? triggerDef(kind).conditionFields : [];
+const httpOn = computed(
+  () => workflowHooksEnabled(store.state.zoConfig) && httpEditorState.endpointOn,
+);
+const fields = computed(() =>
+  conditionFieldOptions(kind, httpOn.value, t, httpQueryKeys(workflowObj.testRun.input)),
+);
 const savedConditions = workflowObj.currentSelectedNodeData?.data?.conditions ?? null;
 
 const builder = ref<any>(null);
diff --git a/web/src/plugins/workflows/nodes/WorkflowFunction.spec.ts b/web/src/plugins/workflows/nodes/WorkflowFunction.spec.ts
index 3a844ce695..174a0d5b6f 100644
--- a/web/src/plugins/workflows/nodes/WorkflowFunction.spec.ts
+++ b/web/src/plugins/workflows/nodes/WorkflowFunction.spec.ts
@@ -62,6 +62,7 @@ vi.mock("@/components/flow/forms/FunctionPicker.vue", () => ({
 import { workflowObj } from "@/plugins/workflows/useWorkflowCanvas";
 import { buildTestSample } from "@/plugins/workflows/testSample";
 import WorkflowFunction from "./WorkflowFunction.vue";
+import { httpEditorState, resetHttpEditorState } from "@/plugins/workflows/httpEndpointUi";
 
 // The "Events" sample comes from the CURRENT trigger's kind, so seed a trigger
 // node in the graph. Default = alert; individual tests override it.
@@ -335,3 +336,34 @@ describe("WorkflowFunction", () => {
     });
   });
 });
+
+describe("WorkflowFunction HTTP sample", () => {
+  beforeEach(() => {
+    resetHttpEditorState();
+    seedTrigger();
+  });
+  afterEach(() => {
+    resetHttpEditorState();
+    workflowObj.currentSelectedWorkflow.nodes = [];
+  });
+
+  it("offers the HTTP sample while the endpoint is on", () => {
+    httpEditorState.endpointOn = true;
+    httpEditorState.payloadFrom = "http";
+    const events = picker(createWrapper()).props("sampleEvents") as any[];
+    expect(events).toHaveLength(1);
+    expect(events[0].meta.trigger_source).toBe("http");
+  });
+
+  it("keeps the kind sample by default and while the endpoint is off", () => {
+    httpEditorState.endpointOn = true;
+    expect(
+      (picker(createWrapper()).props("sampleEvents") as any[])[0].meta.trigger_source,
+    ).toBeUndefined();
+    httpEditorState.endpointOn = false;
+    httpEditorState.payloadFrom = "http";
+    expect(
+      (picker(createWrapper()).props("sampleEvents") as any[])[0].meta.trigger_source,
+    ).toBeUndefined();
+  });
+});
diff --git a/web/src/plugins/workflows/nodes/WorkflowFunction.vue b/web/src/plugins/workflows/nodes/WorkflowFunction.vue
index 9712d0c667..e14edb3d67 100644
--- a/web/src/plugins/workflows/nodes/WorkflowFunction.vue
+++ b/web/src/plugins/workflows/nodes/WorkflowFunction.vue
@@ -76,7 +76,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 </template>
 
 <script lang="ts" setup>
-import { ref, onBeforeUnmount } from "vue";
+import { computed, ref, onBeforeUnmount } from "vue";
 import { useI18nTyped } from "@/types/i18n";
 import OIcon from "@/lib/core/Icon/OIcon.vue";
 import OTooltip from "@/lib/overlay/Tooltip/OTooltip.vue";
@@ -89,6 +89,7 @@ import {
 } from "@/plugins/workflows/useWorkflowCanvas";
 import { buildTestDisplaySample } from "@/plugins/workflows/testSample";
 import { buildIncidentDisplaySample } from "@/plugins/workflows/incidentSample";
+import { httpPreviewSample, usesHttpPayload } from "@/plugins/workflows/httpEndpointUi";
 
 const { t } = useI18nTyped();
 const savedData: any = workflowObj.currentSelectedNodeData?.data || {};
@@ -114,7 +115,10 @@ const JS_DEFAULT_CODE = `// \`row\` is the trigger event: { meta: {...}, data: [
 const kind = currentTriggerKind();
 const displaySample = (k: string): unknown =>
   k === "incident_event" ? buildIncidentDisplaySample() : buildTestDisplaySample();
-const sampleEvents = kind ? [displaySample(kind)] : [];
+const sampleEvents = computed(() => {
+  if (!kind) return [];
+  return [usesHttpPayload() ? httpPreviewSample()[0] : displaySample(kind)];
+});
 
 // Inline "Create New Function" widens the drawer + hides its footer (the
 // AddFunction toolbar owns save/cancel).
diff --git a/web/src/plugins/workflows/nodes/WorkflowHttpFieldHint.vue b/web/src/plugins/workflows/nodes/WorkflowHttpFieldHint.vue
new file mode 100644
index 0000000000..3e9993d5f1
--- /dev/null
+++ b/web/src/plugins/workflows/nodes/WorkflowHttpFieldHint.vue
@@ -0,0 +1,29 @@
+<!-- Copyright 2026 OpenObserve Inc.
+
+This program is free software: you can redistribute it and/or modify
+it under the terms of the GNU Affero General Public License as published by
+the Free Software Foundation, either version 3 of the License, or
+(at your option) any later version.
+
+This program is distributed in the hope that it will be useful
+but WITHOUT ANY WARRANTY; without even the implied warranty of
+MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+GNU Affero General Public License for more details.
+
+You should have received a copy of the GNU Affero General Public License
+along with this program.  If not, see <http://www.gnu.org/licenses/>.
+-->
+
+<template>
+  <div data-test="workflow-condition-http-body-hint" class="mt-2 flex flex-col gap-1">
+    <OText variant="meta" as="p">{{ t("workflow.http.fieldGroupBodyHint") }}</OText>
+    <OText variant="meta" as="p">{{ t("workflow.http.fieldGroupQueryHint") }}</OText>
+  </div>
+</template>
+
+<script lang="ts" setup>
+import { useI18nTyped } from "@/types/i18n";
+import OText from "@/lib/core/Typography/OText.vue";
+
+const { t } = useI18nTyped();
+</script>
diff --git a/web/src/plugins/workflows/nodes/WorkflowTrigger.spec.ts b/web/src/plugins/workflows/nodes/WorkflowTrigger.spec.ts
index e639fed0f8..da17c27a7e 100644
--- a/web/src/plugins/workflows/nodes/WorkflowTrigger.spec.ts
+++ b/web/src/plugins/workflows/nodes/WorkflowTrigger.spec.ts
@@ -44,6 +44,7 @@ import { TRIGGER_META_VARS } from "@/plugins/workflows/alertFields";
 import { buildTestSampleText } from "@/plugins/workflows/testSample";
 import { INCIDENT_EVENT_TYPES } from "@/plugins/workflows/incidentSample";
 import WorkflowTrigger from "./WorkflowTrigger.vue";
+import { httpEditorState, resetHttpEditorState } from "@/plugins/workflows/httpEndpointUi";
 
 function createWrapper() {
   return mount(WorkflowTrigger, {
@@ -215,3 +216,78 @@ describe("WorkflowTrigger", () => {
     });
   });
 });
+
+describe("WorkflowTrigger HTTP endpoint", () => {
+  const select = (w: any) => w.findComponent({ name: "OSelect" });
+  const payloadOf = (w: any) => w.findComponent({ name: "QueryEditor" }).props("query") as string;
+  const setKind = (kind: string) => {
+    workflowObj.currentSelectedNodeData = {
+      id: "t1",
+      data: { node_type: "workflow_trigger", trigger_kind: kind },
+    } as any;
+  };
+
+  beforeEach(() => {
+    resetHttpEditorState();
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: true };
+    workflowObj.readOnly = false;
+    setKind("alert_fired");
+  });
+  afterEach(() => {
+    resetHttpEditorState();
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+  });
+
+  it("offers Payload from with the HTTP request sample when the endpoint is on", async () => {
+    httpEditorState.endpointOn = true;
+    const w = createWrapper();
+    expect(select(w).props("label")).toBe(i18n.global.t("workflow.http.payloadFrom"));
+    const labels = select(w)
+      .props("options")
+      .map((o: any) => o.label);
+    expect(labels).toEqual(["Alert Fired", i18n.global.t("workflow.http.payloadHttp")]);
+    const http = select(w).props("options")[1].value;
+    await select(w).vm.$emit("update:modelValue", http);
+    expect(httpEditorState.payloadFrom).toBe("http");
+    expect(payloadOf(w)).toContain('"trigger_source": "http"');
+  });
+
+  it("no Payload from while the endpoint is off", () => {
+    const w = createWrapper();
+    expect(select(w).exists()).toBe(false);
+    expect(payloadOf(w)).not.toContain("trigger_source");
+  });
+
+  it("appends HTTP request to the incident event types", () => {
+    httpEditorState.endpointOn = true;
+    setKind("incident_event");
+    const w = createWrapper();
+    const labels = select(w)
+      .props("options")
+      .map((o: any) => o.label);
+    expect(labels.length).toBeGreaterThan(2);
+    expect(labels[labels.length - 1]).toBe(i18n.global.t("workflow.http.payloadHttp"));
+  });
+
+  it("the link row reads by endpoint state and asks to open the panel", async () => {
+    const off = createWrapper();
+    const link = off.find('[data-test="workflow-trigger-http-link"]');
+    expect(link.text()).toContain(i18n.global.t("workflow.http.triggerLinkOff"));
+    expect(link.text()).toContain(i18n.global.t("workflow.http.triggerLinkOffAction"));
+    await off.find('[data-test="workflow-trigger-http-link-action"]').trigger("click");
+    expect(off.emitted("open-http-endpoint")).toHaveLength(1);
+    httpEditorState.endpointOn = true;
+    const on = createWrapper();
+    expect(on.find('[data-test="workflow-trigger-http-link"]').text()).toContain(
+      i18n.global.t("workflow.http.triggerLinkOnAction"),
+    );
+  });
+
+  it("hides the badge and link row when hooks are off", () => {
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    httpEditorState.endpointOn = true;
+    const w = createWrapper();
+    expect(w.find('[data-test="workflow-trigger-http-link"]').exists()).toBe(false);
+    expect(select(w).exists()).toBe(false);
+  });
+});
diff --git a/web/src/plugins/workflows/nodes/WorkflowTrigger.vue b/web/src/plugins/workflows/nodes/WorkflowTrigger.vue
index 43d28df70c..7b6b73e00e 100644
--- a/web/src/plugins/workflows/nodes/WorkflowTrigger.vue
+++ b/web/src/plugins/workflows/nodes/WorkflowTrigger.vue
@@ -37,65 +37,78 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       {{ t(introKey) }}
     </p>
 
-    <!-- VARIANT VIEW (kinds with commonMetaKeys, e.g. incidents): an event_type
-         picker above the selected event's FULL payload — common and event-specific
-         fields merged in one `meta`. Preview-only — the trigger node has no config. -->
-    <template v-if="isSplit">
-      <OSelect
-        v-model="selectedVariant"
-        :label="t(variantLabelKey)"
-        :options="variantOptions"
-        class="mb-3"
-        data-test="workflow-trigger-sample-variant"
+    <div
+      v-if="showHttpLink"
+      data-test="workflow-trigger-http-link"
+      class="border-border-default rounded-default mb-3 flex items-center gap-2 border px-3 py-1.5 text-xs"
+    >
+      <OIcon name="webhook" size="xs" class="text-text-secondary shrink-0" />
+      <span class="text-text-secondary min-w-0 flex-1">
+        {{
+          httpEditorState.endpointOn
+            ? t("workflow.http.triggerLinkOn")
+            : t("workflow.http.triggerLinkOff")
+        }}
+      </span>
+      <OButton
+        variant="ghost-primary"
+        size="xs"
+        data-test="workflow-trigger-http-link-action"
+        @click="emit('open-http-endpoint')"
+      >
+        {{
+          httpEditorState.endpointOn
+            ? t("workflow.http.triggerLinkOnAction")
+            : t("workflow.http.triggerLinkOffAction")
+        }}
+      </OButton>
+    </div>
+
+    <!-- Kinds with commonMetaKeys (incidents) pick an event_type; with the endpoint on, every kind also offers the HTTP request. -->
+    <OSelect
+      v-if="showPicker"
+      v-model="selectedVariant"
+      :label="pickerLabel"
+      :options="pickerOptions"
+      class="mb-3"
+      data-test="workflow-trigger-sample-variant"
+    />
+
+    <!-- Renders the SAME text the Test dialog seeds, so reference and test input cannot drift. -->
+    <div
+      data-test="workflow-trigger-structure"
+      class="rounded-default border-border-default min-h-0 w-full flex-1 overflow-hidden border"
+    >
+      <QueryEditor
+        :key="selectedVariant"
+        editor-id="workflow-trigger-payload"
+        language="json"
+        :read-only="true"
+        :show-auto-complete="false"
+        :show-line-numbers="false"
+        :sticky-scroll="false"
+        :query="shownPayloadText"
+        class="h-full! w-full"
       />
-
-      <div
-        data-test="workflow-trigger-structure"
-        class="rounded-default border-border-default min-h-0 w-full flex-1 overflow-hidden border"
-      >
-        <QueryEditor
-          :key="selectedVariant"
-          editor-id="workflow-trigger-payload"
-          language="json"
-          :read-only="true"
-          :show-auto-complete="false"
-          :show-line-numbers="false"
-          :sticky-scroll="false"
-          :query="mergedPayloadText"
-          class="h-full! w-full"
-        />
-      </div>
-    </template>
-
-    <!-- SINGLE VIEW (alert): one read-only payload reference. Renders the SAME
-         text the Test dialog seeds, so reference and test input cannot drift. -->
-    <template v-else>
-      <div
-        data-test="workflow-trigger-structure"
-        class="rounded-default border-border-default min-h-0 w-full flex-1 overflow-hidden border"
-      >
-        <QueryEditor
-          editor-id="workflow-trigger-payload"
-          language="json"
-          :read-only="true"
-          :show-auto-complete="false"
-          :show-line-numbers="false"
-          :sticky-scroll="false"
-          :query="payloadText"
-          class="h-full! w-full"
-        />
-      </div>
-      <p v-if="noteKey" class="text-text-secondary mt-2 text-xs leading-normal">
-        {{ t(noteKey) }}
-      </p>
-    </template>
+    </div>
+    <p
+      v-if="noteKey && !isSplit && !showsHttp"
+      class="text-text-secondary mt-2 text-xs leading-normal"
+    >
+      {{ t(noteKey) }}
+    </p>
   </div>
 </template>
 
 <script lang="ts" setup>
-import { computed, defineAsyncComponent, ref } from "vue";
+import { computed, defineAsyncComponent, ref, watch } from "vue";
+import { useStore } from "vuex";
 import { raw, useI18nTyped } from "@/types/i18n";
 import OSelect from "@/lib/forms/Select/OSelect.vue";
+import OButton from "@/lib/core/Button/OButton.vue";
+import OIcon from "@/lib/core/Icon/OIcon.vue";
+import { workflowHooksEnabled } from "@/plugins/workflows/httpEndpoint";
+import { httpEditorState, httpPreviewSample } from "@/plugins/workflows/httpEndpointUi";
 import WorkflowConfigHeader from "./WorkflowConfigHeader.vue";
 import { workflowObj } from "@/plugins/workflows/useWorkflowCanvas";
 import {
@@ -109,6 +122,8 @@ import {
 const QueryEditor = defineAsyncComponent(() => import("@/components/CodeQueryEditor.vue"));
 
 const { t } = useI18nTyped();
+const store = useStore();
+const emit = defineEmits<{ (e: "open-http-endpoint"): void }>();
 
 const savedData = workflowObj.currentSelectedNodeData?.data || {};
 const triggerKind = savedData.trigger_kind || DEFAULT_TRIGGER_KIND;
@@ -128,7 +143,27 @@ const variantOptions = variants.map((v) => ({
   label: v.labelKey ? t(v.labelKey) : raw(v.key),
   value: v.key,
 }));
-const selectedVariant = ref(variants[0]?.key ?? "");
+// Sentinels outside every kind's variant keys, so they never collide with an event_type.
+const KIND_VARIANT = "__kind__";
+const HTTP_VARIANT = "__http__";
+
+const hooksOn = computed(() => workflowHooksEnabled(store.state.zoConfig));
+const showHttpLink = computed(() => hooksOn.value && !workflowObj.readOnly);
+const offersHttp = computed(() => hooksOn.value && httpEditorState.endpointOn);
+
+const selectedVariant = ref(
+  offersHttp.value && httpEditorState.payloadFrom === "http"
+    ? HTTP_VARIANT
+    : (variants[0]?.key ?? KIND_VARIANT),
+);
+const showsHttp = computed(() => selectedVariant.value === HTTP_VARIANT);
+watch(selectedVariant, (v) => {
+  httpEditorState.payloadFrom = v === HTTP_VARIANT ? "http" : "trigger";
+});
+// The endpoint turning off takes the HTTP choice with it.
+watch(offersHttp, (on) => {
+  if (!on && showsHttp.value) selectedVariant.value = variants[0]?.key ?? KIND_VARIANT;
+});
 
 // Kinds with variant samples (e.g. incidents) render a picker + the selected
 // event's FULL payload (common + event-specific merged into one `meta`); the rest
@@ -145,6 +180,20 @@ const mergedPayloadText = computed(() => {
 // Combined single-payload text for non-split kinds (Alert Fired).
 const payloadText = computed(() => buildTriggerSampleText(triggerKind));
 
+const showPicker = computed(() => isSplit || offersHttp.value);
+const pickerLabel = computed(() =>
+  offersHttp.value ? t("workflow.http.payloadFrom") : t(variantLabelKey),
+);
+const pickerOptions = computed(() => {
+  const kindOptions = isSplit ? variantOptions : [{ label: t(def.labelKey), value: KIND_VARIANT }];
+  if (!offersHttp.value) return kindOptions;
+  return [...kindOptions, { label: t("workflow.http.payloadHttp"), value: HTTP_VARIANT }];
+});
+const shownPayloadText = computed(() => {
+  if (showsHttp.value) return JSON.stringify(httpPreviewSample(), null, 2);
+  return isSplit ? mergedPayloadText.value : payloadText.value;
+});
+
 // No editable fields — carry the trigger kind through (persisted in meta).
 const submit = () => ({ trigger_kind: triggerKind });
 
diff --git a/web/src/plugins/workflows/runStatus.spec.ts b/web/src/plugins/workflows/runStatus.spec.ts
new file mode 100644
index 0000000000..afce168a0b
--- /dev/null
+++ b/web/src/plugins/workflows/runStatus.spec.ts
@@ -0,0 +1,164 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+import enUS from "@/locales/languages/en-US.json";
+import {
+  RUN_REASON_KEYS,
+  bodySizeParts,
+  firstFailedStep,
+  hasStoredRunData,
+  matchesRunSearch,
+  matchesTriggerFilter,
+  runReasonOf,
+  shortRunId,
+  triggerFilterSource,
+} from "./runStatus";
+
+const lookup = (key: string): unknown =>
+  key.split(".").reduce<any>((node, part) => (node == null ? undefined : node[part]), enUS);
+
+const facts = (over: Record<string, unknown> = {}) => ({
+  credential_prefix: "o2wh_4fK9",
+  caller_ip: "203.0.113.24",
+  idempotency_key: "deploy-d-4821",
+  content_type: "application/json",
+  body_bytes: 68,
+  status: "failed" as const,
+  error: null,
+  ...over,
+});
+
+describe("runReasonOf", () => {
+  it("names expired runs from the stored status", () => {
+    expect(runReasonOf({ status: "expired", error: null })).toBe("expired");
+  });
+
+  it("reads the ledger code on a failed run, not the stream text", () => {
+    expect(
+      runReasonOf({
+        status: "failed",
+        error: "some node errored",
+        http_request: facts({ error: "worker_lost" }),
+      }),
+    ).toBe("worker_lost");
+    expect(runReasonOf({ status: "failed", error: "workflow_disabled" })).toBe("workflow_disabled");
+    expect(runReasonOf({ status: "failed", error: "run_timeout" })).toBe("run_timeout");
+  });
+
+  it("has no reason for an ordinary step failure or a non-failed run", () => {
+    expect(runReasonOf({ status: "failed", error: "FunctionNode JS error" })).toBeNull();
+    expect(runReasonOf({ status: "succeeded", error: "worker_lost" })).toBeNull();
+    expect(runReasonOf(null)).toBeNull();
+  });
+
+  it("every reason line has an en-US string", () => {
+    for (const key of Object.values(RUN_REASON_KEYS)) expect(typeof lookup(key)).toBe("string");
+  });
+});
+
+describe("hasStoredRunData", () => {
+  it("is false for runs that never executed or never finished", () => {
+    for (const status of ["queued", "running", "expired"] as const)
+      expect(hasStoredRunData({ status, error: null })).toBe(false);
+    expect(hasStoredRunData({ status: "failed", error: "worker_lost" })).toBe(false);
+    expect(hasStoredRunData({ status: "failed", error: "workflow_disabled" })).toBe(false);
+  });
+
+  it("is false for failed runs that ended before any step result was stored", () => {
+    for (const error of ["run_timeout", "payload_missing", "run_failed"])
+      expect(hasStoredRunData({ status: "failed", error })).toBe(false);
+    expect(
+      hasStoredRunData({
+        status: "failed",
+        error: "step text",
+        http_request: { error: "run_timeout" },
+      }),
+    ).toBe(false);
+    expect(hasStoredRunData({ status: "failed", error: "node_errored" })).toBe(true);
+  });
+
+  it("is true for finished runs", () => {
+    expect(hasStoredRunData({ status: "succeeded", error: null })).toBe(true);
+    expect(hasStoredRunData({ status: "failed", error: "boom" })).toBe(true);
+    expect(hasStoredRunData(undefined)).toBe(true);
+  });
+});
+
+describe("trigger filter", () => {
+  const http = { event_type: "Webhook" };
+  const alert = { event_type: "AlertFired" };
+  const retry = { event_type: "Retry" };
+
+  it("maps a kind to the source its runs carry", () => {
+    expect(triggerFilterSource("alert_fired")).toBe("alert_fired");
+    expect(triggerFilterSource("incident_event")).toBe("incident_event");
+    expect(triggerFilterSource("something_new")).toBeNull();
+    expect(triggerFilterSource(undefined)).toBeNull();
+  });
+
+  it("HTTP request matches Webhook runs only; a retry of one stays under all triggers", () => {
+    expect(matchesTriggerFilter(http, "http_request")).toBe(true);
+    expect(matchesTriggerFilter(alert, "http_request")).toBe(false);
+    expect(matchesTriggerFilter(retry, "http_request")).toBe(false);
+    expect(matchesTriggerFilter(retry, "all")).toBe(true);
+  });
+
+  it("a kind filter matches that kind's runs", () => {
+    expect(matchesTriggerFilter(alert, "alert_fired")).toBe(true);
+    expect(matchesTriggerFilter({ event_type: "AlertResolved" }, "alert_fired")).toBe(true);
+    expect(matchesTriggerFilter(http, "alert_fired")).toBe(false);
+  });
+});
+
+describe("matchesRunSearch", () => {
+  const row = { run_id: "0193f2c4-7a1e", http_request: facts() };
+
+  it("matches a run id prefix or an idempotency key, case-insensitively", () => {
+    expect(matchesRunSearch(row, "0193F2")).toBe(true);
+    expect(matchesRunSearch(row, "deploy-d-48")).toBe(true);
+    expect(matchesRunSearch(row, "7a1e")).toBe(false);
+    expect(matchesRunSearch(row, "")).toBe(true);
+    expect(matchesRunSearch({ run_id: "x" }, "deploy")).toBe(false);
+  });
+
+  it("matches the token prefix and the alert name anywhere", () => {
+    expect(matchesRunSearch(row, "4FK9")).toBe(true);
+    expect(matchesRunSearch({ run_id: "a-1" }, "5xx", "checkout_5xx_rate")).toBe(true);
+    expect(matchesRunSearch({ run_id: "a-1" }, "latency", "checkout_5xx_rate")).toBe(false);
+    expect(matchesRunSearch({ run_id: "a-1" }, "5xx", null)).toBe(false);
+  });
+});
+
+describe("formatting helpers", () => {
+  it("shortRunId keeps the first 8 characters", () => {
+    expect(shortRunId("0193f2c4-7a1e-7b3d")).toBe("0193f2c4");
+    expect(shortRunId("")).toBe("");
+  });
+
+  it("bodySizeParts uses bytes under 1 KiB and KiB above", () => {
+    expect(bodySizeParts(68)).toEqual({ key: "workflow.http.bodySizeBytes", size: "68" });
+    expect(bodySizeParts(1536)).toEqual({ key: "workflow.http.bodySizeKiB", size: "1.5" });
+    expect(typeof lookup("workflow.http.bodySizeBytes")).toBe("string");
+    expect(typeof lookup("workflow.http.bodySizeKiB")).toBe("string");
+  });
+
+  it("firstFailedStep follows the step order, not the error map order", () => {
+    const errors = { dest: { error_count: 1 }, fn: { error_count: 1 } };
+    expect(firstFailedStep(errors, ["trig", "fn", "dest"])).toBe("fn");
+    expect(firstFailedStep({}, ["trig"])).toBeNull();
+    expect(firstFailedStep(null, ["trig"])).toBeNull();
+  });
+});
diff --git a/web/src/plugins/workflows/runStatus.ts b/web/src/plugins/workflows/runStatus.ts
new file mode 100644
index 0000000000..8e71717e7c
--- /dev/null
+++ b/web/src/plugins/workflows/runStatus.ts
@@ -0,0 +1,133 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import type { I18nKey } from "@/types/i18n";
+import type { HttpRequestFacts, WorkflowHistoryRow } from "@/services/workflows";
+import { runSourceOf, type RunSource } from "./httpEndpoint";
+
+/** date-fns pattern for times in run lists and the HTTP endpoint panel ("Oct 21, 09:39"). */
+export const RUN_TIME_SHORT = "MMM d, HH:mm";
+/** date-fns pattern for one run's chip and request facts ("Oct 21, 2026 09:39"). */
+export const RUN_TIME_LONG = "MMM d, yyyy HH:mm";
+
+/** Why a run never executed or never finished; drives the second line under its status chip. */
+export type RunReason = "expired" | "worker_lost" | "workflow_disabled" | "run_timeout";
+
+/** "all", "http_request", or a trigger kind such as "alert_fired". */
+export type RunTriggerFilter = string;
+
+export interface RunOutcomeFields {
+  status?: string | null;
+  error?: string | null;
+  http_request?: Pick<HttpRequestFacts, "error"> | null;
+}
+
+export const RUN_REASON_KEYS: Record<RunReason, I18nKey> = {
+  expired: "workflow.history.reasonExpired",
+  worker_lost: "workflow.history.reasonWorkerLost",
+  workflow_disabled: "workflow.history.reasonWorkflowDisabled",
+  run_timeout: "workflow.history.reasonRunTimeout",
+};
+
+const LEDGER_REASONS: ReadonlySet<string> = new Set([
+  "worker_lost",
+  "workflow_disabled",
+  "run_timeout",
+]);
+
+// Each of these ends a run before any step's result is stored.
+const NO_DATA_CODES: ReadonlySet<string> = new Set([
+  "worker_lost",
+  "workflow_disabled",
+  "run_timeout",
+  "payload_missing",
+  "run_failed",
+]);
+
+const KIND_SOURCES: Record<string, RunSource> = {
+  alert_fired: "alert_fired",
+  incident_event: "incident_event",
+};
+
+const KIB = 1024;
+
+/** The ledger's code wins over `error`: a merged stream row's `error` is step text, not the code. */
+export function runReasonOf(row: RunOutcomeFields | null | undefined): RunReason | null {
+  if (row?.status === "expired") return "expired";
+  if (row?.status !== "failed") return null;
+  const code = row.http_request?.error ?? row.error ?? null;
+  return code && LEDGER_REASONS.has(code) ? (code as RunReason) : null;
+}
+
+/** False when no step ran or none finished, so the run detail API holds nothing for it. */
+export function hasStoredRunData(row: RunOutcomeFields | null | undefined): boolean {
+  if (!row) return true;
+  if (row.status === "queued" || row.status === "running" || row.status === "expired") return false;
+  if (row.status !== "failed") return true;
+  const code = row.http_request?.error ?? row.error ?? null;
+  return !(code && NO_DATA_CODES.has(code));
+}
+
+export function triggerFilterSource(kind: string | null | undefined): RunSource | null {
+  return (kind && KIND_SOURCES[kind]) || null;
+}
+
+/** A Retry of an HTTP run is a retry (it carries no request facts), so it only shows under "all". */
+export function matchesTriggerFilter(
+  row: Pick<WorkflowHistoryRow, "event_type">,
+  filter: RunTriggerFilter,
+): boolean {
+  if (filter === "all") return true;
+  const source = runSourceOf(row);
+  if (filter === "http_request") return source === "http";
+  return source === triggerFilterSource(filter);
+}
+
+export function matchesRunSearch(
+  row: {
+    run_id: string;
+    http_request?: Partial<Pick<HttpRequestFacts, "idempotency_key" | "credential_prefix">> | null;
+  },
+  query: string,
+  alertName?: string | null,
+): boolean {
+  const q = query.trim().toLowerCase();
+  if (!q) return true;
+  if (row.run_id.toLowerCase().startsWith(q)) return true;
+  return [row.http_request?.idempotency_key, row.http_request?.credential_prefix, alertName].some(
+    (field) => (field ?? "").toLowerCase().includes(q),
+  );
+}
+
+export function shortRunId(runId: string): string {
+  return runId.slice(0, 8);
+}
+
+export function bodySizeParts(bytes: number): { key: I18nKey; size: string } {
+  if (bytes < KIB) return { key: "workflow.http.bodySizeBytes", size: String(bytes) };
+  return {
+    key: "workflow.http.bodySizeKiB",
+    size: (bytes / KIB).toFixed(1).replace(/\.0$/, ""),
+  };
+}
+
+/** The first errored step in the Steps rail's order, since the error map's key order is arbitrary. */
+export function firstFailedStep(
+  errors: Record<string, unknown> | null | undefined,
+  order: string[],
+): string | null {
+  if (!errors) return null;
+  return order.find((id) => Object.prototype.hasOwnProperty.call(errors, id)) ?? null;
+}
diff --git a/web/src/plugins/workflows/triggers.spec.ts b/web/src/plugins/workflows/triggers.spec.ts
index 1e52fa9092..17c926d6b9 100644
--- a/web/src/plugins/workflows/triggers.spec.ts
+++ b/web/src/plugins/workflows/triggers.spec.ts
@@ -26,7 +26,11 @@ import {
   triggerTypeForKind,
   enabledTriggers,
   buildTriggerSampleText,
+  conditionFieldOptions,
 } from "./triggers";
+import i18n from "@/locales";
+import type { TranslateFn } from "@/types/i18n";
+import { HTTP_REQUEST_PAYLOAD_FIELDS } from "./httpRequestSample";
 import { INCIDENT_EVENT_TYPES, INCIDENT_COMMON_KEYS } from "./incidentSample";
 import { ALERT_PAYLOAD_FIELDS } from "./alertFields";
 import { INCIDENT_PAYLOAD_FIELDS } from "./incidentFields";
@@ -131,3 +135,44 @@ describe("trigger registry", () => {
     });
   });
 });
+
+describe("conditionFieldOptions (AC-UI-32)", () => {
+  const t = i18n.global.t as unknown as TranslateFn;
+
+  it("is the kind's own list while the endpoint is off", () => {
+    expect(conditionFieldOptions("alert_fired", false, t)).toBe(ALERT_PAYLOAD_FIELDS);
+    expect(conditionFieldOptions("incident_event", false, t)).toBe(INCIDENT_PAYLOAD_FIELDS);
+    expect(conditionFieldOptions(undefined, true, t)).toEqual([]);
+  });
+
+  it("adds the HTTP request group after the kind's fields; the hints are not options", () => {
+    const options = conditionFieldOptions("alert_fired", true, t);
+    expect(options[0]).toMatchObject({
+      header: true,
+      label: t("workflow.triggerKind.alertFired.label"),
+    });
+    expect(options.slice(1, 1 + ALERT_PAYLOAD_FIELDS.length)).toEqual(ALERT_PAYLOAD_FIELDS);
+    const groupAt = 1 + ALERT_PAYLOAD_FIELDS.length;
+    expect(options[groupAt]).toMatchObject({ header: true, label: t("workflow.http.fieldGroup") });
+    expect(options.slice(groupAt + 1)).toEqual(HTTP_REQUEST_PAYLOAD_FIELDS);
+    expect(options.map((o) => String(o.label))).not.toContain(
+      t("workflow.http.fieldGroupBodyHint"),
+    );
+  });
+
+  it("offers meta.query.<key> for each query key it is given", () => {
+    const values = conditionFieldOptions("alert_fired", true, t, ["env"]).map((o) => o.value);
+    expect(values.slice(-1)).toEqual(["meta_query_env"]);
+  });
+
+  it("offers meta.trigger_source and never a data.* field", () => {
+    const options = conditionFieldOptions("incident_event", true, t);
+    const values = options.filter((o) => !o.header).map((o) => o.value);
+    expect(values).toContain("meta_trigger_source");
+    expect(values).toContain("meta_headers_content-type");
+    expect(values.filter((v) => v.startsWith("data"))).toEqual([]);
+    expect(options.filter((o) => !o.header).map((o) => String(o.label))).toContain(
+      "meta.trigger_source",
+    );
+  });
+});
diff --git a/web/src/plugins/workflows/triggers.ts b/web/src/plugins/workflows/triggers.ts
index ad75427ac9..fcedcfc155 100644
--- a/web/src/plugins/workflows/triggers.ts
+++ b/web/src/plugins/workflows/triggers.ts
@@ -34,13 +34,14 @@
 // ─────────────────────────────────────────────────────────────────────────────
 
 import type { IconName } from "@/lib/core/Icon/OIcon.icons";
-import type { I18nKey } from "@/types/i18n";
+import type { I18nKey, TranslateFn } from "@/types/i18n";
 import { buildTestSample } from "./testSample";
 import { buildIncidentSample, INCIDENT_EVENT_TYPES, INCIDENT_COMMON_KEYS } from "./incidentSample";
 import { ALERT_PAYLOAD_FIELDS } from "./alertFields";
 import type { WorkflowFieldOption } from "./alertFields";
 import { INCIDENT_PAYLOAD_FIELDS } from "./incidentFields";
 import { buildAlertResolvedSample, ALERT_RESOLVED_PAYLOAD_FIELDS } from "./alertResolvedSample";
+import { httpRequestPayloadFields } from "./httpRequestSample";
 
 // A selectable variant of a trigger's sample payload. When a kind defines more
 // than one (e.g. an incident's lifecycle event_types), the trigger drawer shows
@@ -208,3 +209,28 @@ export const enabledTriggers = (): WorkflowTriggerDef[] =>
 /** Pretty-printed sample payload a kind emits — seeds the read-only reference. */
 export const buildTriggerSampleText = (kind?: string): string =>
   JSON.stringify(triggerDef(kind).buildSample(), null, 2);
+
+const fieldHeader = (label: WorkflowFieldOption["label"], value: string): WorkflowFieldOption => ({
+  label,
+  value,
+  type: "",
+  header: true,
+});
+
+/** Condition / Branch field options: the kind's fields, plus the HTTP request group while the endpoint is on. */
+export function conditionFieldOptions(
+  kind: string | undefined,
+  httpOn: boolean,
+  t: TranslateFn,
+  queryKeys: readonly string[] = [],
+): WorkflowFieldOption[] {
+  if (!kind) return [];
+  const def = triggerDef(kind);
+  if (!httpOn) return def.conditionFields;
+  return [
+    fieldHeader(t(def.labelKey), "__kind_fields__"),
+    ...def.conditionFields,
+    fieldHeader(t("workflow.http.fieldGroup"), "__http_fields__"),
+    ...httpRequestPayloadFields(queryKeys),
+  ];
+}
diff --git a/web/src/plugins/workflows/useWorkflowCanvas.spec.ts b/web/src/plugins/workflows/useWorkflowCanvas.spec.ts
index 4685a883d9..468f55a93b 100644
--- a/web/src/plugins/workflows/useWorkflowCanvas.spec.ts
+++ b/web/src/plugins/workflows/useWorkflowCanvas.spec.ts
@@ -18,7 +18,7 @@
 // response (errors as an ARRAY, per-node inputs as a MAP) into the shared
 // testRun.result shape the canvas badges + step drawer read.
 
-import { describe, it, expect, beforeEach, vi } from "vitest";
+import { describe, it, expect, beforeEach, afterEach, vi } from "vitest";
 import i18nInstance from "@/locales";
 
 const t = (i18nInstance.global as any).t;
@@ -3447,26 +3447,57 @@ describe("useWorkflowCanvas — flushing test state to the server", () => {
 // no stored input, and the endpoint answers 400 "Errored run info not found".
 describe("isRetryableRun — the gate that keeps retry off runs the backend must refuse", () => {
   it("accepts a failed run from a real trigger", () => {
-    expect(isRetryableRun({ event_type: "AlertFired", error: "boom" })).toBe(true);
+    expect(isRetryableRun({ event_type: "AlertFired", status: "failed", error: "boom" })).toBe(
+      true,
+    );
   });
 
   it("accepts the other real trigger types", () => {
     for (const et of ["IncidentEvent", "Webhook", "Manual"]) {
-      expect(isRetryableRun({ event_type: et, error: "boom" })).toBe(true);
+      expect(isRetryableRun({ event_type: et, status: "failed", error: "boom" })).toBe(true);
     }
   });
 
   it("rejects a SUCCESSFUL run — there is nothing to replay", () => {
-    expect(isRetryableRun({ event_type: "AlertFired", error: "" })).toBe(false);
+    expect(isRetryableRun({ event_type: "AlertFired", status: "succeeded", error: "" })).toBe(
+      false,
+    );
     expect(isRetryableRun({ event_type: "AlertFired" })).toBe(false);
   });
 
+  it("reads the outcome from the stored status, not the error text", () => {
+    expect(isRetryableRun({ event_type: "AlertFired", status: "succeeded", error: "boom" })).toBe(
+      false,
+    );
+    expect(isRetryableRun({ event_type: "Webhook", status: "failed", error: null })).toBe(true);
+  });
+
+  it("rejects HTTP runs that never executed or never finished — no input was stored", () => {
+    const runs = [
+      { status: "queued" },
+      { status: "running" },
+      { status: "expired" },
+      { status: "failed", error: "worker_lost" },
+      { status: "failed", error: "workflow_disabled" },
+      { status: "failed", error: "run_timeout" },
+      { status: "failed", error: "some node errored", http_request: { error: "worker_lost" } },
+    ];
+    for (const run of runs)
+      expect(isRetryableRun({ event_type: "Webhook", ...run } as any)).toBe(false);
+    expect(retryBlockedReason({ event_type: "Webhook", status: "expired" } as any)).toBe(
+      "no_input",
+    );
+    expect(
+      retryBlockedReason({ event_type: "Webhook", status: "failed", error: "worker_lost" } as any),
+    ).toBe("no_input");
+  });
+
   it("rejects a failed TEST run — /test never persists the run's input", () => {
-    expect(isRetryableRun({ event_type: "Test", error: "boom" })).toBe(false);
+    expect(isRetryableRun({ event_type: "Test", status: "failed", error: "boom" })).toBe(false);
   });
 
   it("rejects a failed RETRY run — retry_run records the run but stores no input", () => {
-    expect(isRetryableRun({ event_type: "Retry", error: "boom" })).toBe(false);
+    expect(isRetryableRun({ event_type: "Retry", status: "failed", error: "boom" })).toBe(false);
   });
 
   it("rejects null/undefined rather than throwing", () => {
@@ -3475,10 +3506,58 @@ describe("isRetryableRun — the gate that keeps retry off runs the backend must
   });
 
   it("names the blocker so a disabled affordance can say why", () => {
-    expect(retryBlockedReason({ event_type: "Test", error: "boom" })).toBe("test");
-    expect(retryBlockedReason({ event_type: "Retry", error: "boom" })).toBe("retry");
-    expect(retryBlockedReason({ event_type: "AlertFired", error: "" })).toBe("succeeded");
-    expect(retryBlockedReason({ event_type: "AlertFired", error: "boom" })).toBe("");
+    expect(retryBlockedReason({ event_type: "Test", status: "failed", error: "boom" })).toBe(
+      "test",
+    );
+    expect(retryBlockedReason({ event_type: "Retry", status: "failed", error: "boom" })).toBe(
+      "retry",
+    );
+    expect(retryBlockedReason({ event_type: "AlertFired", status: "succeeded", error: "" })).toBe(
+      "succeeded",
+    );
+    expect(retryBlockedReason({ event_type: "AlertFired", status: "failed", error: "boom" })).toBe(
+      "",
+    );
+  });
+});
+
+describe("loadWorkflowRun — a run with no stored step data is not fetched", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    workflowObj.currentSelectedWorkflow = {
+      id: "wf1",
+      name: "wf",
+      nodes: [{ id: "n1" }],
+      edges: [],
+    } as any;
+    workflowObj.testRun.result = null;
+  });
+
+  afterEach(() => {
+    workflowObj.runsHistory.list = [] as any;
+  });
+
+  it("loads an expired HTTP run as an empty history result without calling the run API", async () => {
+    workflowObj.runsHistory.list = [
+      { run_id: "h1", event_type: "Webhook", status: "expired", error: null },
+    ] as any;
+    const r = await loadWorkflowRun({ orgId: "o", workflowId: "wf1", runId: "h1" });
+    expect(r.ok).toBe(true);
+    expect(mockRun).not.toHaveBeenCalled();
+    const res: any = workflowObj.testRun.result;
+    expect(res.mode).toBe("history");
+    expect(res.runId).toBe("h1");
+    expect(res.inputs).toEqual({});
+    expect(res.errors).toEqual({});
+  });
+
+  it("still fetches a finished run", async () => {
+    workflowObj.runsHistory.list = [
+      { run_id: "h2", event_type: "Webhook", status: "failed", error: "boom" },
+    ] as any;
+    mockRun.mockResolvedValue({ data: { errors: null, data: null } });
+    await loadWorkflowRun({ orgId: "o", workflowId: "wf1", runId: "h2" });
+    expect(mockRun).toHaveBeenCalledTimes(1);
   });
 });
 
diff --git a/web/src/plugins/workflows/useWorkflowCanvas.ts b/web/src/plugins/workflows/useWorkflowCanvas.ts
index 3377d56c3c..681cf05e95 100644
--- a/web/src/plugins/workflows/useWorkflowCanvas.ts
+++ b/web/src/plugins/workflows/useWorkflowCanvas.ts
@@ -40,7 +40,8 @@ import { makeEdge } from "@/composables/flow/makeEdge";
 import { getTruncatedConditions } from "@/utils/conditionPreview";
 import { convertV0ToV2, convertV1BEToV2, convertV1ToV2 } from "@/utils/alerts/alertDataTransforms";
 import { DEFAULT_TRIGGER_KIND, triggerTypeForKind } from "./triggers";
-import workflowService from "@/services/workflows";
+import { hasStoredRunData, runReasonOf, type RunOutcomeFields } from "./runStatus";
+import workflowService, { type WorkflowHistoryRow } from "@/services/workflows";
 import { workflowRunsQuery } from "@/services/workflows.queries";
 import { workflowKeys } from "@/services/workflows.querykeys";
 import { queryClient } from "@/composables/query/queryClient";
@@ -725,6 +726,12 @@ export const currentTriggerKind = (): string | undefined => {
   return trigger?.data?.trigger_kind || trigger?.meta?.trigger_kind;
 };
 
+export const currentTriggerNodeId = (): string | undefined => {
+  const nodes: { id: string; data?: { node_type?: string } }[] =
+    workflowObj.currentSelectedWorkflow?.nodes || [];
+  return nodes.find((n) => n.data?.node_type === "workflow_trigger")?.id;
+};
+
 // ── Shared graph helpers ─────────────────────────────────────────────────────
 // Workflows enforce one incoming edge per node (see onConnect), so the graph is
 // a TREE rooted at the trigger (or from_node) — a plain BFS from the root visits
@@ -1533,18 +1540,20 @@ export const restoreTestData = (workflowId: string, opts?: { keepDocumentState?:
 // test_workflow and retry_run just record the run — so a Test and a failed Retry
 // both LOOK retryable in history but answer 400 "Errored run info not found".
 // Why a run cannot be retried, "" when it can — lets a disabled control say which.
+// A run that never executed or never finished stored no input, so its retry would be refused too.
 export const retryBlockedReason = (
-  run: { event_type?: string; error?: string } | null | undefined,
-): "" | "test" | "retry" | "succeeded" => {
+  run: ({ event_type?: string } & RunOutcomeFields) | null | undefined,
+): "" | "test" | "retry" | "succeeded" | "no_input" => {
   if (!run) return "succeeded";
   if (run.event_type === "Test") return "test";
   if (run.event_type === "Retry") return "retry";
-  if (!run.error) return "succeeded";
+  if (runReasonOf(run) || !hasStoredRunData(run)) return "no_input";
+  if (run.status !== "failed") return "succeeded";
   return "";
 };
 
 export const isRetryableRun = (
-  run: { event_type?: string; error?: string } | null | undefined,
+  run: ({ event_type?: string } & RunOutcomeFields) | null | undefined,
 ): boolean => retryBlockedReason(run) === "";
 
 // Replay a failed run server-side. The backend re-runs from the stored input map,
@@ -1556,7 +1565,7 @@ export const retryWorkflowRun = async (opts: {
   workflowId: string;
   runId: string;
   fromNode?: string;
-  run?: { event_type?: string; error?: string } | null;
+  run?: ({ event_type?: string } & RunOutcomeFields) | null;
 }): Promise<{ ok: boolean; error?: string }> => {
   if (opts.run !== undefined && !isRetryableRun(opts.run)) {
     return { ok: false, error: "" };
@@ -1629,6 +1638,23 @@ export const loadWorkflowRun = async (opts: {
   runId: string;
 }): Promise<{ ok: boolean; error?: string }> => {
   const wf = workflowObj.currentSelectedWorkflow;
+  const row = (workflowObj.runsHistory.list as WorkflowHistoryRow[]).find(
+    (r) => r.run_id === opts.runId,
+  );
+  if (row && !hasStoredRunData(row)) {
+    workflowObj.testRun.result = {
+      errors: {},
+      inputs: {},
+      outputs: {},
+      ranNodeIds: [],
+      blockedNodeIds: [],
+      mode: "history",
+      runId: opts.runId,
+      ghostNodeIds: [],
+      source: "run",
+    };
+    return { ok: true };
+  }
   try {
     const res = await workflowService.getWorkflowRun({
       org_identifier: opts.orgId,
diff --git a/web/src/plugins/workflows/useWorkflowHttpButton.spec.ts b/web/src/plugins/workflows/useWorkflowHttpButton.spec.ts
new file mode 100644
index 0000000000..f049adfdbe
--- /dev/null
+++ b/web/src/plugins/workflows/useWorkflowHttpButton.spec.ts
@@ -0,0 +1,141 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { defineComponent, h, ref } from "vue";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import i18n from "@/locales";
+import store from "@/test/unit/helpers/store";
+import { queryClient } from "@/composables/query/queryClient";
+import workflows from "@/services/workflows";
+import { httpAbsent, httpConfig } from "@/test/unit/helpers/workflowHttp";
+import {
+  httpButtonChip,
+  httpButtonState,
+  httpButtonTooltip,
+  useWorkflowHttpButton,
+  type HttpButtonState,
+} from "./useWorkflowHttpButton";
+
+vi.mock("@/services/workflows", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: { getHttpTrigger: vi.fn() },
+  });
+});
+
+const api = vi.mocked(workflows);
+const t = (k: string) => i18n.global.t(k);
+
+describe("httpButtonState", () => {
+  it("reads none, off, draft, paused and on, with draft ahead of paused", () => {
+    expect(httpButtonState(undefined, false, true)).toBe("none");
+    expect(httpButtonState(httpAbsent(), false, true)).toBe("none");
+    expect(httpButtonState(httpConfig({ enabled: false }), true, false)).toBe("off");
+    expect(httpButtonState(httpConfig(), true, false)).toBe("draft");
+    expect(httpButtonState(httpConfig(), false, false)).toBe("paused");
+    expect(httpButtonState(httpConfig(), false, true)).toBe("on");
+  });
+});
+
+describe("httpButtonChip and httpButtonTooltip", () => {
+  const cases: [HttpButtonState, string | null, string | null, string | null][] = [
+    ["on", "success-soft", "On", null],
+    ["paused", "warning-soft", "On", "Requests get 403 while the workflow is paused"],
+    ["draft", "warning-soft", "On", "Requests get 403 until the workflow is published"],
+    ["off", "default-soft", "Off", "Let another system start this workflow with an HTTP request"],
+    ["none", null, null, "Let another system start this workflow with an HTTP request"],
+  ];
+
+  it.each(cases)("%s: chip %s %s, tooltip %s", (state, variant, label, tooltip) => {
+    const chip = httpButtonChip(state);
+    expect(chip?.variant ?? null).toBe(variant);
+    expect(chip ? t(chip.labelKey) : null).toBe(label);
+    const key = httpButtonTooltip(state);
+    expect(key ? t(key) : null).toBe(tooltip);
+  });
+
+  it("the draft and paused tooltips differ", () => {
+    expect(httpButtonTooltip("draft")).not.toBe(httpButtonTooltip("paused"));
+  });
+});
+
+describe("useWorkflowHttpButton", () => {
+  const mounted: VueWrapper[] = [];
+  const isDraft = ref(false);
+  const workflowEnabled = ref(true);
+
+  const mountButton = async (workflowId = "wf1") => {
+    let result!: ReturnType<typeof useWorkflowHttpButton>;
+    const Host = defineComponent({
+      setup() {
+        result = useWorkflowHttpButton({ workflowId: ref(workflowId), isDraft, workflowEnabled });
+        return () => h("div");
+      },
+    });
+    mounted.push(mount(Host, { global: { plugins: [i18n, store] } }));
+    await flushPromises();
+    return result;
+  };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    queryClient.clear();
+    isDraft.value = false;
+    workflowEnabled.value = true;
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: true };
+    api.getHttpTrigger.mockResolvedValue(httpConfig());
+  });
+  afterEach(() => {
+    for (const w of mounted.splice(0)) w.unmount();
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+  });
+
+  it("follows the endpoint and the workflow state", async () => {
+    const button = await mountButton();
+    expect(button.visible.value).toBe(true);
+    expect(button.state.value).toBe("on");
+    expect(button.endpointOn.value).toBe(true);
+    isDraft.value = true;
+    expect(button.state.value).toBe("draft");
+    isDraft.value = false;
+    workflowEnabled.value = false;
+    expect(button.state.value).toBe("paused");
+    expect(button.endpointOn.value).toBe(true);
+  });
+
+  it("an endpoint switched off reads off with the neutral chip", async () => {
+    api.getHttpTrigger.mockResolvedValue(httpConfig({ enabled: false }));
+    const button = await mountButton();
+    expect(button.state.value).toBe("off");
+    expect(button.endpointOn.value).toBe(false);
+    expect(button.chip.value?.variant).toBe("default-soft");
+  });
+
+  it("no endpoint configured shows no chip", async () => {
+    api.getHttpTrigger.mockResolvedValue(httpAbsent());
+    const button = await mountButton();
+    expect(button.state.value).toBe("none");
+    expect(button.chip.value).toBeNull();
+  });
+
+  it("asks for nothing while HTTP endpoints are disabled for the org", async () => {
+    store.state.zoConfig = { ...store.state.zoConfig, workflow_hooks_enabled: false };
+    const button = await mountButton();
+    expect(button.visible.value).toBe(false);
+    expect(button.state.value).toBe("none");
+    expect(api.getHttpTrigger).not.toHaveBeenCalled();
+  });
+});
diff --git a/web/src/plugins/workflows/useWorkflowHttpButton.ts b/web/src/plugins/workflows/useWorkflowHttpButton.ts
new file mode 100644
index 0000000000..cded81f6ef
--- /dev/null
+++ b/web/src/plugins/workflows/useWorkflowHttpButton.ts
@@ -0,0 +1,99 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { computed, type Ref } from "vue";
+import { useQuery } from "@tanstack/vue-query";
+import { useStore } from "vuex";
+import { useOrgId } from "@/composables/query/useOrgId";
+import type { I18nKey } from "@/types/i18n";
+import type { BadgeVariant } from "@/lib/core/Badge/OBadge.types";
+import type { HttpTriggerState } from "@/services/workflows";
+import { workflowHttpTriggerQuery } from "@/services/workflows.queries";
+import { workflowHooksEnabled } from "./httpEndpoint";
+
+/** Where a workflow's endpoint stands for the header button. */
+export type HttpButtonState = "none" | "off" | "on" | "draft" | "paused";
+
+export interface HttpButtonChip {
+  variant: BadgeVariant;
+  labelKey: I18nKey;
+}
+
+export interface UseWorkflowHttpButtonArgs {
+  workflowId: Ref<string>;
+  isDraft: Ref<boolean>;
+  workflowEnabled: Ref<boolean>;
+}
+
+const CHIPS: Record<HttpButtonState, HttpButtonChip | null> = {
+  none: null,
+  off: { variant: "default-soft", labelKey: "workflow.http.editorButtonOff" },
+  on: { variant: "success-soft", labelKey: "workflow.http.editorButtonOn" },
+  draft: { variant: "warning-soft", labelKey: "workflow.http.editorButtonOn" },
+  paused: { variant: "warning-soft", labelKey: "workflow.http.editorButtonOn" },
+};
+
+const TOOLTIPS: Record<HttpButtonState, I18nKey | null> = {
+  none: "workflow.http.editorButtonTooltip",
+  off: "workflow.http.editorButtonTooltip",
+  on: null,
+  draft: "workflow.http.editorButtonRefusedDraft",
+  paused: "workflow.http.editorButtonRefusedPaused",
+};
+
+/** Draft wins over paused, the same order as the panel's status. */
+export function httpButtonState(
+  data: HttpTriggerState | undefined,
+  isDraft: boolean,
+  workflowEnabled: boolean,
+): HttpButtonState {
+  if (!data?.configured) return "none";
+  if (!data.enabled) return "off";
+  if (isDraft) return "draft";
+  if (!workflowEnabled) return "paused";
+  return "on";
+}
+
+export function httpButtonChip(state: HttpButtonState): HttpButtonChip | null {
+  return CHIPS[state];
+}
+
+export function httpButtonTooltip(state: HttpButtonState): I18nKey | null {
+  return TOOLTIPS[state];
+}
+
+/** The header button's gate, chip and tooltip, shared by the editor and the runs page. */
+export function useWorkflowHttpButton(args: UseWorkflowHttpButtonArgs) {
+  const store = useStore();
+  const orgId = useOrgId();
+  const visible = computed(() => workflowHooksEnabled(store.state.zoConfig));
+  const trigger = useQuery(() =>
+    workflowHttpTriggerQuery(orgId.value, visible.value ? args.workflowId.value : ""),
+  );
+  const state = computed(() =>
+    httpButtonState(
+      visible.value ? trigger.data.value : undefined,
+      args.isDraft.value,
+      args.workflowEnabled.value,
+    ),
+  );
+  return {
+    visible,
+    state,
+    endpointOn: computed(() => state.value !== "none" && state.value !== "off"),
+    chip: computed(() => httpButtonChip(state.value)),
+    tooltipKey: computed(() => httpButtonTooltip(state.value)),
+  };
+}
diff --git a/web/src/plugins/workflows/useWorkflowHttpEndpoint.spec.ts b/web/src/plugins/workflows/useWorkflowHttpEndpoint.spec.ts
new file mode 100644
index 0000000000..8a035eb6d4
--- /dev/null
+++ b/web/src/plugins/workflows/useWorkflowHttpEndpoint.spec.ts
@@ -0,0 +1,1025 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { defineComponent, nextTick, ref, type Ref } from "vue";
+import { flushPromises, mount } from "@vue/test-utils";
+import store from "@/test/unit/helpers/store";
+import { queryClient } from "@/composables/query/queryClient";
+import workflows, {
+  dryRunHook,
+  type HttpCredential,
+  type HttpTriggerAbsent,
+  type HttpTriggerConfig,
+} from "@/services/workflows";
+import zoConfigService from "@/services/config";
+import { copyPendingText, copyToClipboard } from "@/utils/clipboard";
+import i18n from "@/locales";
+import { HttpEndpointError, httpErrorText } from "./httpEndpointUi";
+import { buildHttpRequestSample } from "./httpRequestSample";
+import { useWorkflowHttpEndpoint } from "./useWorkflowHttpEndpoint";
+
+vi.mock("@/services/workflows", async (importOriginal) => {
+  const { overlayServiceMock } = await import("@/test/unit/helpers/mockService");
+  return overlayServiceMock(await importOriginal(), {
+    default: {
+      getHttpTrigger: vi.fn(),
+      putHttpTrigger: vi.fn(),
+      deleteHttpTrigger: vi.fn(),
+      rotateHttpCredential: vi.fn(),
+      revokeHttpCredential: vi.fn(),
+      revealHttpCredentialSecret: vi.fn(),
+      getWorkflowRun: vi.fn(),
+    },
+    dryRunHook: vi.fn(),
+  });
+});
+vi.mock("@/utils/clipboard", () => ({ copyToClipboard: vi.fn(), copyPendingText: vi.fn() }));
+vi.mock("@/services/config", () => ({
+  default: { get_config: vi.fn(), get_config_full: vi.fn() },
+}));
+
+const api = vi.mocked(workflows);
+const orgConfig = vi.mocked(zoConfigService.get_config_full);
+const TOKEN = "o2wh_FRESHLYMINTEDTOKENVALUE0000001";
+const ROW_VALUE = "o2wh_ROWVALUEREVEALEDFROMTHETABLE01";
+const permissions = { edit: true, test: true, reveal: true };
+const HOUR_US = 3_600_000_000;
+
+const credential = (over: Partial<HttpCredential> = {}): HttpCredential => ({
+  id: "c1",
+  kind: "token",
+  display_prefix: "o2wh_4fK9…oI4k",
+  state: "active",
+  expires_at: null,
+  created_by: "a@example.com",
+  creator_in_org: true,
+  created_at: 1,
+  last_used_at: null,
+  ...over,
+});
+
+const config = (over: Partial<HttpTriggerConfig> = {}): HttpTriggerConfig => ({
+  configured: true,
+  id: "t1",
+  url: "https://o2.example.com/api/v2/default/workflows/hooks/t1",
+  region_host: null,
+  enabled: true,
+  auth_mode: "token",
+  max_body_bytes: 1_048_576,
+  rate_limit_per_minute: 1200,
+  org_rate_limit_per_minute: 1200,
+  created_by: "a@example.com",
+  created_at: 1,
+  updated_at: 1,
+  last_invoked_at: null,
+  last_call: null,
+  secrets_encrypted_at_rest: true,
+  rejections: {},
+  credentials: [credential()],
+  permissions,
+  ...over,
+});
+
+const absent = (over: Partial<HttpTriggerAbsent> = {}): HttpTriggerAbsent => ({
+  configured: false,
+  org_rate_limit_per_minute: 1200,
+  secrets_encrypted_at_rest: true,
+  permissions,
+  ...over,
+});
+
+const cachesHold = (value: string) =>
+  JSON.stringify(
+    queryClient
+      .getMutationCache()
+      .getAll()
+      .map((m) => m.state),
+  ).includes(value) ||
+  JSON.stringify(
+    queryClient
+      .getQueryCache()
+      .getAll()
+      .map((q) => q.state.data),
+  ).includes(value);
+
+// Unmounted after each test, or a live harness from one test refetches into the next test's cache.
+const mounted: { unmount: () => void }[] = [];
+
+const mountEndpoint = async (
+  opts: {
+    id?: string | null;
+    draft?: boolean;
+    enabled?: boolean;
+    context?: "editor" | "list";
+    beforeCreate?: (id: Ref<string | null>) => Promise<boolean>;
+  } = {},
+) => {
+  const workflowId = ref<string | null>(opts.id === undefined ? "wf1" : opts.id);
+  const isDraftOnly = ref(opts.draft ?? false);
+  const workflowEnabled = ref(opts.enabled ?? true);
+  let endpoint!: ReturnType<typeof useWorkflowHttpEndpoint>;
+  const Harness = defineComponent({
+    setup() {
+      endpoint = useWorkflowHttpEndpoint({
+        workflowId,
+        isDraftOnly,
+        workflowEnabled,
+        context: opts.context,
+        beforeCreate: opts.beforeCreate ? () => opts.beforeCreate!(workflowId) : undefined,
+      });
+      return () => null;
+    },
+  });
+  const wrapper = mount(Harness, { global: { plugins: [store] } });
+  mounted.push(wrapper);
+  await flushPromises();
+  return { endpoint, wrapper, workflowId, isDraftOnly, workflowEnabled };
+};
+
+describe("useWorkflowHttpEndpoint", () => {
+  beforeEach(() => {
+    vi.clearAllMocks();
+    store.state.selectedOrganization = { ...store.state.selectedOrganization, identifier: "acme" };
+    store.state.zoConfig = { ...store.state.zoConfig, rbac_enabled: false };
+    store.state.currentuser = { role: "admin" };
+    api.getHttpTrigger.mockResolvedValue(config());
+    vi.mocked(copyToClipboard).mockResolvedValue(true);
+    vi.mocked(copyPendingText).mockImplementation(async (text) => {
+      await text;
+      return true;
+    });
+    orgConfig.mockResolvedValue({ data: { is_org_admin: true } } as never);
+  });
+
+  afterEach(() => {
+    for (const wrapper of mounted.splice(0)) {
+      try {
+        wrapper.unmount();
+      } catch {
+        // Already unmounted by the test itself.
+      }
+    }
+    queryClient.clear();
+  });
+
+  describe("state machine", () => {
+    it("an unsaved workflow is unsaved and reads nothing", async () => {
+      const { endpoint } = await mountEndpoint({ id: null });
+
+      expect(endpoint.status.value).toBe("unsaved");
+      expect(endpoint.phase.value).toBe("unsaved");
+      expect(api.getHttpTrigger).not.toHaveBeenCalled();
+    });
+
+    it("a workflow without an endpoint is not configured and off", async () => {
+      api.getHttpTrigger.mockResolvedValue(absent());
+      const { endpoint } = await mountEndpoint();
+
+      expect(api.getHttpTrigger).toHaveBeenCalledWith({ org_identifier: "acme", id: "wf1" });
+      expect(endpoint.status.value).toBe("not_configured");
+      expect(endpoint.phase.value).toBe("off");
+      expect(endpoint.chip.value).toBeNull();
+    });
+
+    it("a configured endpoint that is switched off is off", async () => {
+      api.getHttpTrigger.mockResolvedValue(config({ enabled: false }));
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.status.value).toBe("off");
+      expect(endpoint.phase.value).toBe("off");
+    });
+
+    it("an enabled endpoint on a published, enabled workflow is on with a success chip", async () => {
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.status.value).toBe("on");
+      expect(endpoint.phase.value).toBe("steady");
+      expect(endpoint.chip.value).toBe("success");
+    });
+
+    it("a draft or a paused workflow refuses calls, so its chip warns", async () => {
+      const draft = await mountEndpoint({ draft: true });
+      expect(draft.endpoint.status.value).toBe("draft");
+      expect(draft.endpoint.chip.value).toBe("warning");
+
+      const paused = await mountEndpoint({ enabled: false });
+      expect(paused.endpoint.status.value).toBe("paused");
+      expect(paused.endpoint.chip.value).toBe("warning");
+    });
+
+    it("a failed read with nothing cached is the error phase", async () => {
+      api.getHttpTrigger.mockRejectedValue({ response: { status: 500 } });
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.phase.value).toBe("error");
+    });
+
+    it("reports the storage warning only when the server says secrets are not encrypted", async () => {
+      api.getHttpTrigger.mockResolvedValue(config({ secrets_encrypted_at_rest: false }));
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.storageWarning.value).toBe(true);
+    });
+  });
+
+  describe("creating and the unsaved path", () => {
+    it("the secret is not in the mutation cache after reveal", async () => {
+      api.getHttpTrigger.mockResolvedValue(absent());
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: TOKEN });
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.turnOn();
+
+      expect(api.putHttpTrigger).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        payload: { enabled: true, auth_mode: "token" },
+      });
+      expect(endpoint.revealedSecret.value).toBe(TOKEN);
+      expect(endpoint.revealKind.value).toBe("created");
+      expect(endpoint.phase.value).toBe("revealing");
+      expect(endpoint.revealActive.value).toBe(true);
+      expect(cachesHold(TOKEN)).toBe(false);
+    });
+
+    it("Done clears the secret", async () => {
+      api.getHttpTrigger.mockResolvedValueOnce(absent());
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: TOKEN });
+      const { endpoint } = await mountEndpoint();
+      await endpoint.turnOn();
+
+      endpoint.endReveal();
+      await flushPromises();
+
+      expect(endpoint.revealedSecret.value).toBeNull();
+      expect(endpoint.phase.value).toBe("steady");
+    });
+
+    it("unmount clears the secret", async () => {
+      api.getHttpTrigger.mockResolvedValue(absent());
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: TOKEN });
+      const { endpoint, wrapper } = await mountEndpoint();
+      await endpoint.turnOn();
+
+      wrapper.unmount();
+
+      expect(endpoint.revealedSecret.value).toBeNull();
+    });
+
+    it("an org switch clears the secret", async () => {
+      api.getHttpTrigger.mockResolvedValue(absent());
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: TOKEN });
+      const { endpoint } = await mountEndpoint();
+      await endpoint.turnOn();
+
+      store.state.selectedOrganization = { ...store.state.selectedOrganization, identifier: "b" };
+      await nextTick();
+
+      expect(endpoint.revealedSecret.value).toBeNull();
+    });
+
+    it("an endpoint that already existed returns no secret and shows the exists hint", async () => {
+      api.getHttpTrigger.mockResolvedValue(absent());
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: null });
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.turnOn();
+
+      expect(endpoint.revealedSecret.value).toBeNull();
+      expect(endpoint.endpointExists.value).toBe(true);
+    });
+
+    it("an unsaved workflow saves a draft first, then creates its endpoint", async () => {
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: TOKEN });
+      const beforeCreate = vi.fn(async (id: Ref<string | null>) => {
+        id.value = "wf9";
+        return true;
+      });
+      const { endpoint } = await mountEndpoint({ id: null, beforeCreate });
+
+      await endpoint.turnOn();
+
+      expect(beforeCreate).toHaveBeenCalledTimes(1);
+      expect(api.putHttpTrigger).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf9",
+        payload: { enabled: true, auth_mode: "token" },
+      });
+      expect(endpoint.revealedSecret.value).toBe(TOKEN);
+    });
+
+    it("a false beforeCreate creates nothing", async () => {
+      const { endpoint } = await mountEndpoint({ id: null, beforeCreate: async () => false });
+
+      await endpoint.turnOn();
+
+      expect(api.putHttpTrigger).not.toHaveBeenCalled();
+      expect(endpoint.phase.value).toBe("unsaved");
+    });
+
+    it("an unsaved workflow may create when the selected org makes the user an admin", async () => {
+      const { endpoint } = await mountEndpoint({ id: null });
+
+      expect(orgConfig).toHaveBeenCalledWith("acme");
+      expect(endpoint.canTurnOn.value).toBe(true);
+    });
+
+    it("the login-time role does not decide for the selected org; OpenFGA allows", async () => {
+      store.state.currentuser = { role: "admin" };
+      orgConfig.mockResolvedValue({ data: { is_org_admin: false } } as never);
+      const { endpoint } = await mountEndpoint({ id: null });
+      expect(endpoint.canTurnOn.value).toBe(false);
+
+      store.state.zoConfig = { ...store.state.zoConfig, rbac_enabled: true };
+      await nextTick();
+      expect(endpoint.canTurnOn.value).toBe(true);
+    });
+
+    it("a 403 on create after the draft save keeps the draft and names the reason", async () => {
+      api.putHttpTrigger.mockRejectedValue({
+        response: { status: 403, data: { message: "Admin or Root role required to create" } },
+      });
+      const beforeCreate = vi.fn(async (id: Ref<string | null>) => {
+        id.value = "wf9";
+        return true;
+      });
+      const { endpoint, workflowId } = await mountEndpoint({ id: null, beforeCreate });
+
+      const err = await endpoint.turnOn().catch((e: unknown) => e);
+
+      expect(err).toBeInstanceOf(HttpEndpointError);
+      expect((err as HttpEndpointError).key).toBe("workflow.http.createForbidden");
+      expect(workflowId.value).toBe("wf9");
+      expect(api.deleteHttpTrigger).not.toHaveBeenCalled();
+    });
+
+    it("creating needs reveal permission; switching back on needs only edit", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        absent({ permissions: { edit: true, test: true, reveal: false } }),
+      );
+      const create = await mountEndpoint();
+      expect(create.endpoint.canTurnOn.value).toBe(false);
+
+      queryClient.clear();
+      api.getHttpTrigger.mockResolvedValue(
+        config({ enabled: false, permissions: { edit: true, test: true, reveal: false } }),
+      );
+      const reopen = await mountEndpoint();
+      expect(reopen.endpoint.canTurnOn.value).toBe(true);
+    });
+  });
+
+  describe("mode, limits, off and delete", () => {
+    it("turning off keeps the mode and sends enabled false", async () => {
+      api.putHttpTrigger.mockResolvedValue({ ...config({ enabled: false }), secret: null });
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.turnOff();
+
+      expect(api.putHttpTrigger).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        payload: { enabled: false, auth_mode: "token" },
+      });
+    });
+
+    it("turning a configured endpoint back on keeps its mode and reveals nothing", async () => {
+      api.getHttpTrigger.mockResolvedValue(config({ enabled: false, auth_mode: "signature" }));
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: null });
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.turnOn("token");
+
+      expect(api.putHttpTrigger).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        payload: { enabled: true, auth_mode: "signature" },
+      });
+      expect(endpoint.endpointExists.value).toBe(false);
+      expect(endpoint.revealedSecret.value).toBeNull();
+    });
+
+    it("switching mode reveals the new secret and drops revealed rows of the old kind", async () => {
+      api.revealHttpCredentialSecret.mockResolvedValue({ ...credential(), secret: ROW_VALUE });
+      api.putHttpTrigger.mockResolvedValue({
+        ...config({ auth_mode: "signature" }),
+        secret: "whsec_NEW",
+      });
+      const { endpoint } = await mountEndpoint();
+      await endpoint.revealCredential("c1");
+
+      await endpoint.switchMode("signature");
+
+      expect(api.putHttpTrigger).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        payload: { enabled: true, auth_mode: "signature" },
+      });
+      expect(endpoint.revealedSecret.value).toBe("whsec_NEW");
+      expect(endpoint.revealKind.value).toBe("switched");
+      expect(endpoint.revealedCredentials.value).toEqual({});
+      expect(cachesHold("whsec_NEW")).toBe(false);
+    });
+
+    it("switching to the current mode does nothing", async () => {
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.switchMode("token");
+
+      expect(api.putHttpTrigger).not.toHaveBeenCalled();
+    });
+
+    it("saving limits sends them with the current state", async () => {
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: null });
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.saveLimits({ max_body_bytes: 4096, rate_limit_per_minute: 10 });
+
+      expect(api.putHttpTrigger).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        payload: {
+          enabled: true,
+          auth_mode: "token",
+          max_body_bytes: 4096,
+          rate_limit_per_minute: 10,
+        },
+      });
+    });
+
+    it("delete removes the endpoint and every value held in memory", async () => {
+      api.revealHttpCredentialSecret.mockResolvedValue({ ...credential(), secret: ROW_VALUE });
+      api.deleteHttpTrigger.mockResolvedValue(undefined);
+      const { endpoint } = await mountEndpoint();
+      await endpoint.revealCredential("c1");
+      api.getHttpTrigger.mockResolvedValue(absent());
+
+      await endpoint.deleteEndpoint();
+      await flushPromises();
+
+      expect(api.deleteHttpTrigger).toHaveBeenCalledWith({ org_identifier: "acme", id: "wf1" });
+      expect(endpoint.revealedCredentials.value).toEqual({});
+      expect(endpoint.status.value).toBe("not_configured");
+    });
+  });
+
+  describe("rotate and revoke", () => {
+    it("rotate reveals the new secret and keeps it out of the caches", async () => {
+      api.rotateHttpCredential.mockResolvedValue({ ...credential({ id: "c2" }), secret: TOKEN });
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.rotate(86400);
+
+      expect(api.rotateHttpCredential).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        overlap_seconds: 86400,
+      });
+      expect(endpoint.revealedSecret.value).toBe(TOKEN);
+      expect(endpoint.revealKind.value).toBe("rotated");
+      expect(cachesHold(TOKEN)).toBe(false);
+    });
+
+    it("rotate is blocked while a credential is retiring", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        config({
+          credentials: [
+            credential({ id: "c2" }),
+            credential({ state: "retiring", expires_at: Date.now() * 1000 + HOUR_US }),
+          ],
+        }),
+      );
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.rotateBlocked.value).toBe(true);
+      expect(endpoint.canRotate.value).toBe(false);
+      await expect(endpoint.rotate(0)).rejects.toMatchObject({
+        key: "workflow.http.rotateBlocked",
+      });
+      expect(api.rotateHttpCredential).not.toHaveBeenCalled();
+    });
+
+    it("a retiring credential alone does not block rotate", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        config({
+          credentials: [
+            credential({ id: "c1", state: "revoked" }),
+            credential({ id: "c0", state: "retiring", expires_at: Date.now() * 1000 + HOUR_US }),
+          ],
+        }),
+      );
+      api.rotateHttpCredential.mockResolvedValue({ ...credential({ id: "c2" }), secret: TOKEN });
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.rotateBlocked.value).toBe(false);
+      expect(endpoint.canRotate.value).toBe(true);
+      await endpoint.rotate(0);
+      expect(endpoint.rotateReplaced.value).toBe("none");
+    });
+
+    it("rotate records whether the active credential was kept or revoked", async () => {
+      api.rotateHttpCredential.mockResolvedValue({ ...credential({ id: "c2" }), secret: TOKEN });
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.rotate(0);
+      expect(endpoint.rotateReplaced.value).toBe("revoked");
+      endpoint.endReveal();
+      expect(endpoint.rotateReplaced.value).toBeNull();
+    });
+
+    it("rotate with no live credential mints a new one", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        config({ credentials: [credential({ state: "revoked" })] }),
+      );
+      api.rotateHttpCredential.mockResolvedValue({ ...credential({ id: "c2" }), secret: TOKEN });
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.activeCredential.value).toBeUndefined();
+      expect(endpoint.canRotate.value).toBe(true);
+      await endpoint.rotate(0);
+
+      expect(api.rotateHttpCredential).toHaveBeenCalledTimes(1);
+      expect(endpoint.revealedSecret.value).toBe(TOKEN);
+    });
+
+    it("rotate without an endpoint fails with a translated reason", async () => {
+      api.getHttpTrigger.mockResolvedValue(absent());
+      const { endpoint } = await mountEndpoint();
+
+      await expect(endpoint.rotate(0)).rejects.toMatchObject({
+        key: "workflow.http.errorNotConfigured",
+      });
+    });
+
+    it("a retiring credential past its expiry no longer blocks rotate and is not live", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        config({
+          credentials: [
+            credential({ id: "c2" }),
+            credential({ state: "retiring", expires_at: Date.now() * 1000 - HOUR_US }),
+          ],
+        }),
+      );
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.rotateBlocked.value).toBe(false);
+      expect(endpoint.liveCredentials.value.map((c) => c.id)).toEqual(["c2"]);
+    });
+
+    it("rotate needs reveal permission", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        config({ permissions: { edit: true, test: true, reveal: false } }),
+      );
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.canRotate.value).toBe(false);
+    });
+
+    it("revoke calls the route and forgets that row's value", async () => {
+      api.revealHttpCredentialSecret.mockResolvedValue({ ...credential(), secret: ROW_VALUE });
+      api.revokeHttpCredential.mockResolvedValue(undefined);
+      const { endpoint } = await mountEndpoint();
+      await endpoint.revealCredential("c1");
+
+      await endpoint.revoke("c1");
+
+      expect(api.revokeHttpCredential).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        credential_id: "c1",
+      });
+      expect(endpoint.revealedCredentials.value).toEqual({});
+    });
+  });
+
+  describe("row Show / Copy", () => {
+    beforeEach(() => {
+      api.revealHttpCredentialSecret.mockResolvedValue({ ...credential(), secret: ROW_VALUE });
+    });
+
+    it("a revealed row value is not in the mutation cache", async () => {
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.revealCredential("c1");
+
+      expect(api.revealHttpCredentialSecret).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        credential_id: "c1",
+      });
+      expect(endpoint.revealedCredentials.value).toEqual({ c1: ROW_VALUE });
+      expect(cachesHold(ROW_VALUE)).toBe(false);
+    });
+
+    it("hide, refetch, org switch and unmount drop revealed values", async () => {
+      const { endpoint, wrapper } = await mountEndpoint();
+
+      await endpoint.revealCredential("c1");
+      endpoint.hideCredential("c1");
+      expect(endpoint.revealedCredentials.value).toEqual({});
+
+      await endpoint.revealCredential("c1");
+      await endpoint.refresh();
+      await flushPromises();
+      expect(endpoint.revealedCredentials.value).toEqual({});
+
+      await endpoint.revealCredential("c1");
+      store.state.selectedOrganization = { ...store.state.selectedOrganization, identifier: "b" };
+      await nextTick();
+      expect(endpoint.revealedCredentials.value).toEqual({});
+
+      store.state.selectedOrganization = {
+        ...store.state.selectedOrganization,
+        identifier: "acme",
+      };
+      await flushPromises();
+      await endpoint.revealCredential("c1");
+      wrapper.unmount();
+      expect(endpoint.revealedCredentials.value).toEqual({});
+    });
+
+    it("Done drops revealed row values too", async () => {
+      const { endpoint } = await mountEndpoint();
+      await endpoint.revealCredential("c1");
+
+      endpoint.endReveal();
+
+      expect(endpoint.revealedCredentials.value).toEqual({});
+    });
+
+    it("copy without show hands the clipboard the pending fetch inside the click", async () => {
+      const { endpoint } = await mountEndpoint();
+
+      const copying = endpoint.copyCredential("c1");
+
+      expect(copyPendingText).toHaveBeenCalledTimes(1);
+      await expect(copying).resolves.toBe(true);
+      await expect(vi.mocked(copyPendingText).mock.calls[0][0]).resolves.toBe(ROW_VALUE);
+      expect(copyToClipboard).not.toHaveBeenCalled();
+      expect(api.revealHttpCredentialSecret).toHaveBeenCalledTimes(1);
+      expect(endpoint.revealedCredentials.value).toEqual({});
+      expect(cachesHold(ROW_VALUE)).toBe(false);
+    });
+
+    it("copy without show rejects when the fetch fails and returns false when the copy fails", async () => {
+      const { endpoint } = await mountEndpoint();
+      api.revealHttpCredentialSecret.mockRejectedValueOnce({
+        response: { status: 403, data: { message: "denied" } },
+      });
+      await expect(endpoint.copyCredential("c1")).rejects.toBeTruthy();
+
+      vi.mocked(copyPendingText).mockImplementationOnce(async (text) => {
+        await text;
+        return false;
+      });
+      await expect(endpoint.copyCredential("c1")).resolves.toBe(false);
+    });
+
+    it("copy of a shown value copies it without fetching again", async () => {
+      const { endpoint } = await mountEndpoint();
+      await endpoint.revealCredential("c1");
+
+      await endpoint.copyCredential("c1");
+
+      expect(api.revealHttpCredentialSecret).toHaveBeenCalledTimes(1);
+      expect(vi.mocked(copyToClipboard).mock.calls[0][0]).toBe(ROW_VALUE);
+    });
+
+    it("a failed reveal records the row error and a 404 refetches the table", async () => {
+      api.revealHttpCredentialSecret.mockRejectedValue({
+        response: { status: 404, data: { message: "No live credential with this id" } },
+      });
+      const { endpoint } = await mountEndpoint();
+      const reads = api.getHttpTrigger.mock.calls.length;
+
+      await endpoint.revealCredential("c1");
+      await flushPromises();
+
+      expect(endpoint.revealError.value).toEqual({ c1: "No live credential with this id" });
+      expect(endpoint.revealing.value).toBeNull();
+      expect(api.getHttpTrigger.mock.calls.length).toBe(reads + 1);
+    });
+
+    it("a failure without a server message reads as an unknown error", async () => {
+      api.revealHttpCredentialSecret.mockRejectedValue({ response: { status: 500, data: {} } });
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.revealCredential("c1");
+
+      expect(endpoint.revealError.value).toEqual({ c1: "Unknown error" });
+    });
+
+    it("without reveal permission Show does not call the route", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        config({ permissions: { edit: true, test: true, reveal: false } }),
+      );
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.revealCredential("c1");
+
+      expect(api.revealHttpCredentialSecret).not.toHaveBeenCalled();
+    });
+  });
+
+  describe("example request copy", () => {
+    beforeEach(() => {
+      api.revealHttpCredentialSecret.mockResolvedValue({ ...credential(), secret: ROW_VALUE });
+    });
+
+    it("copies the curl call with the real secret through the audited reveal fetch", async () => {
+      const { endpoint } = await mountEndpoint();
+
+      const copying = endpoint.copyExample();
+
+      expect(copyPendingText).toHaveBeenCalledTimes(1);
+      await expect(copying).resolves.toBe(true);
+      const text = await vi.mocked(copyPendingText).mock.calls[0][0];
+      expect(text).toContain(`Authorization: Bearer ${ROW_VALUE}`);
+      expect(text).toContain(config().url);
+      expect(text).toContain('"service":"checkout"');
+      expect(api.revealHttpCredentialSecret).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        credential_id: "c1",
+      });
+      expect(endpoint.revealedCredentials.value).toEqual({});
+      expect(cachesHold(ROW_VALUE)).toBe(false);
+    });
+
+    it.each(["mode", "rotate", "revoke"] as const)(
+      "rejects a pending example copy after %s changes the credential",
+      async (change) => {
+        let resolveSecret!: (value: HttpCredential & { secret: string }) => void;
+        api.revealHttpCredentialSecret.mockImplementationOnce(
+          () =>
+            new Promise((resolve) => {
+              resolveSecret = resolve;
+            }),
+        );
+        const { endpoint } = await mountEndpoint();
+        const copying = endpoint.copyExample();
+        const rejected = expect(copying).rejects.toMatchObject({
+          key: "workflow.http.copyCredentialChanged",
+        });
+        api.getHttpTrigger.mockResolvedValue(
+          config(
+            change === "mode"
+              ? { auth_mode: "signature" }
+              : {
+                  credentials: [
+                    credential(change === "rotate" ? { id: "c2" } : { state: "revoked" }),
+                  ],
+                },
+          ),
+        );
+        await endpoint.refresh();
+        await flushPromises();
+        resolveSecret({ ...credential(), secret: ROW_VALUE });
+        await rejected;
+        expect(copyToClipboard).not.toHaveBeenCalled();
+        expect(endpoint.revealedCredentials.value).toEqual({});
+      },
+    );
+
+    it("signs with the real secret in signed mode", async () => {
+      api.getHttpTrigger.mockResolvedValue(config({ auth_mode: "signature" }));
+      const { endpoint } = await mountEndpoint();
+
+      await endpoint.copyExample();
+
+      const text = await vi.mocked(copyPendingText).mock.calls[0][0];
+      expect(text).toContain(`SECRET='${ROW_VALUE}'`);
+      expect(text).toContain("openssl dgst -sha256");
+    });
+
+    it("reuses a shown value without fetching again", async () => {
+      const { endpoint } = await mountEndpoint();
+      await endpoint.revealCredential("c1");
+
+      await endpoint.copyExample();
+
+      expect(api.revealHttpCredentialSecret).toHaveBeenCalledTimes(1);
+      expect(vi.mocked(copyToClipboard).mock.calls[0][0]).toContain(`Bearer ${ROW_VALUE}`);
+    });
+
+    it("without reveal permission copies placeholders and never calls the reveal route", async () => {
+      api.getHttpTrigger.mockResolvedValue(
+        config({ permissions: { edit: true, test: true, reveal: false } }),
+      );
+      const { endpoint } = await mountEndpoint();
+
+      await expect(endpoint.copyExample()).resolves.toBe(true);
+
+      expect(api.revealHttpCredentialSecret).not.toHaveBeenCalled();
+      expect(copyPendingText).not.toHaveBeenCalled();
+      expect(vi.mocked(copyToClipboard).mock.calls[0][0]).toContain("$O2_HOOK_TOKEN");
+    });
+
+    it("rejects when the reveal fetch fails, so the caller can say why", async () => {
+      api.revealHttpCredentialSecret.mockRejectedValueOnce({
+        response: { status: 403, data: { message: "denied" } },
+      });
+      const { endpoint } = await mountEndpoint();
+
+      await expect(endpoint.copyExample()).rejects.toBeTruthy();
+    });
+  });
+
+  describe("send test request", () => {
+    it("dry-runs the public URL with the revealed token", async () => {
+      api.getHttpTrigger.mockResolvedValueOnce(absent());
+      api.putHttpTrigger.mockResolvedValue({ ...config(), secret: TOKEN });
+      vi.mocked(dryRunHook).mockResolvedValue({
+        status: 200,
+        reason: null,
+        input: null,
+        bodyBytes: 2,
+      });
+      const { endpoint } = await mountEndpoint();
+      await endpoint.turnOn();
+      await flushPromises();
+
+      await endpoint.sendTest("{}");
+
+      expect(dryRunHook).toHaveBeenCalledWith({
+        url: "https://o2.example.com/api/v2/default/workflows/hooks/t1",
+        token: TOKEN,
+        body: "{}",
+        contentType: "application/json",
+      });
+    });
+
+    it("refuses a signed endpoint without calling the hook", async () => {
+      api.putHttpTrigger.mockResolvedValue({
+        ...config({ auth_mode: "signature" }),
+        secret: "whsec_NEW",
+      });
+      const { endpoint } = await mountEndpoint();
+      await endpoint.switchMode("signature");
+
+      await expect(endpoint.sendTest("{}")).rejects.toMatchObject({
+        key: "workflow.http.sendTestSigned",
+      });
+      expect(dryRunHook).not.toHaveBeenCalled();
+    });
+
+    it("never fetches a signing secret for a test request", async () => {
+      api.getHttpTrigger.mockResolvedValue(config({ auth_mode: "signature" }));
+      const { endpoint } = await mountEndpoint();
+
+      await expect(endpoint.sendTest("{}")).rejects.toMatchObject({
+        key: "workflow.http.sendTestSigned",
+      });
+      expect(api.revealHttpCredentialSecret).not.toHaveBeenCalled();
+      expect(dryRunHook).not.toHaveBeenCalled();
+    });
+
+    it("without a revealed value it fetches the active credential and keeps nothing", async () => {
+      api.revealHttpCredentialSecret.mockResolvedValue({ ...credential(), secret: ROW_VALUE });
+      vi.mocked(dryRunHook).mockResolvedValue({
+        status: 403,
+        reason: "workflow_not_published",
+        input: null,
+        bodyBytes: 2,
+      });
+      const { endpoint } = await mountEndpoint();
+
+      const result = await endpoint.sendTest("{}");
+
+      expect(result.reason).toBe("workflow_not_published");
+      expect(api.revealHttpCredentialSecret).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        credential_id: "c1",
+      });
+      expect(endpoint.revealedCredentials.value).toEqual({});
+      expect(cachesHold(ROW_VALUE)).toBe(false);
+    });
+  });
+
+  describe("run test", () => {
+    const lastCall = { run_id: "r9", status: "succeeded" as const, received_at: 1_700_000_000 };
+
+    it("Run test without an HTTP call opens the Test dialog with the generated sample", async () => {
+      const { endpoint } = await mountEndpoint();
+
+      expect(endpoint.canRunTest.value).toBe(true);
+      expect(endpoint.runTestHint.value).toBe("workflow.http.runTestHint");
+      expect(await endpoint.runTest("t1")).toEqual({
+        kind: "open_test",
+        seed: buildHttpRequestSample({ trigger_id: "test" }),
+      });
+      expect(api.getWorkflowRun).not.toHaveBeenCalled();
+    });
+
+    it("seeds the Test dialog with the latest HTTP run's trigger input", async () => {
+      const records = [
+        { meta: { trigger_source: "http", query: { env: "a" } }, data: [{ id: 7 }] },
+      ];
+      api.getHttpTrigger.mockResolvedValue(config({ last_call: lastCall }));
+      api.getWorkflowRun.mockResolvedValue({
+        data: { data: { output_map: { t1: records }, input_map: { t1: [{ other: 1 }] } } },
+      } as never);
+      const { endpoint } = await mountEndpoint();
+
+      expect(await endpoint.runTest("t1")).toEqual({
+        kind: "open_test",
+        seed: records,
+        runAt: lastCall.received_at,
+      });
+      expect(api.getWorkflowRun).toHaveBeenCalledWith({
+        org_identifier: "acme",
+        id: "wf1",
+        run_id: "r9",
+      });
+    });
+
+    it("falls back to the sample when the run holds no input or cannot be read", async () => {
+      const sample = { kind: "open_test", seed: buildHttpRequestSample({ trigger_id: "test" }) };
+      api.getHttpTrigger.mockResolvedValue(config({ last_call: lastCall }));
+      api.getWorkflowRun.mockResolvedValueOnce({ data: { data: { output_map: {} } } } as never);
+      const { endpoint } = await mountEndpoint();
+      expect(await endpoint.runTest("t1")).toEqual(sample);
+
+      api.getWorkflowRun.mockRejectedValueOnce({ response: { status: 404 } });
+      expect(await endpoint.runTest("t1")).toEqual(sample);
+      expect(await endpoint.runTest(undefined)).toEqual(sample);
+    });
+
+    it("list context replaces Run test with Open the workflow", async () => {
+      const { endpoint } = await mountEndpoint({ context: "list" });
+
+      expect(endpoint.runTestHint.value).toBe("workflow.http.runTestHintList");
+      expect(await endpoint.runTest("t1")).toEqual({
+        kind: "open_workflow",
+        hint: "workflow.http.runTestHintList",
+      });
+    });
+
+    it("Run test needs an endpoint and edit and test permission", async () => {
+      api.getHttpTrigger.mockResolvedValueOnce(absent());
+      const off = await mountEndpoint();
+      expect(off.endpoint.canRunTest.value).toBe(false);
+
+      api.getHttpTrigger.mockResolvedValueOnce(
+        config({ permissions: { edit: false, test: true, reveal: false } }),
+      );
+      const readOnly = await mountEndpoint({ id: "wf2" });
+      expect(readOnly.endpoint.canRunTest.value).toBe(false);
+
+      api.getHttpTrigger.mockResolvedValueOnce(
+        config({ permissions: { edit: true, test: false, reveal: true } }),
+      );
+      const noTest = await mountEndpoint({ id: "wf3" });
+      expect(noTest.endpoint.canRunTest.value).toBe(false);
+    });
+
+    it("no endpoint and no live credential fail with translated reasons", async () => {
+      api.getHttpTrigger.mockResolvedValueOnce(absent());
+      const off = await mountEndpoint();
+      await expect(off.endpoint.sendTest("{}")).rejects.toMatchObject({
+        key: "workflow.http.errorNotConfigured",
+      });
+
+      api.getHttpTrigger.mockResolvedValueOnce(
+        config({ credentials: [credential({ state: "revoked" })] }),
+      );
+      const none = await mountEndpoint({ id: "wf2" });
+      await expect(none.endpoint.sendTest("{}")).rejects.toMatchObject({
+        key: "workflow.http.errorNoLiveCredential",
+      });
+    });
+
+    it("error text is the server message, a translated reason, or the unknown-error copy", () => {
+      const t = i18n.global.t as unknown as Parameters<typeof httpErrorText>[1];
+      expect(String(httpErrorText({ response: { data: { message: "boom" } } }, t))).toBe("boom");
+      expect(
+        String(httpErrorText(new HttpEndpointError("workflow.http.errorNotConfigured"), t)),
+      ).toBe(i18n.global.t("workflow.http.errorNotConfigured"));
+      expect(String(httpErrorText(new Error("Failed to fetch"), t))).toBe(
+        i18n.global.t("common.unknownError"),
+      );
+    });
+
+    it("both run test hints exist in en-US", async () => {
+      const en = (await import("@/locales/languages/en-US.json")).default;
+      expect(en.workflow.http.runTestHint).toBe(
+        "Runs the steps with a sample HTTP payload; doesn't call the URL",
+      );
+      expect(en.workflow.http.runTestHintList).toBe("Open the workflow to run a test");
+    });
+  });
+});
diff --git a/web/src/plugins/workflows/useWorkflowHttpEndpoint.ts b/web/src/plugins/workflows/useWorkflowHttpEndpoint.ts
new file mode 100644
index 0000000000..b1b022d48f
--- /dev/null
+++ b/web/src/plugins/workflows/useWorkflowHttpEndpoint.ts
@@ -0,0 +1,479 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import {
+  computed,
+  nextTick,
+  onScopeDispose,
+  readonly,
+  ref,
+  watch,
+  type ComputedRef,
+  type Ref,
+} from "vue";
+import { useMutation, useQuery, useQueryClient } from "@tanstack/vue-query";
+import { useStore } from "vuex";
+import { useOrgId } from "@/composables/query/useOrgId";
+import { gt, type I18nKey } from "@/types/i18n";
+import { copyPendingText, copyToClipboard } from "@/utils/clipboard";
+import { configFullQuery } from "@/services/config.queries";
+import workflowService, {
+  dryRunHook,
+  type DryRunResult,
+  type HttpAuthMode,
+  type HttpCredential,
+  type HttpTriggerConfig,
+  type HttpTriggerPermissions,
+  type HttpTriggerState,
+  type OverlapSeconds,
+  type PutHttpTriggerPayload,
+} from "@/services/workflows";
+import {
+  deleteHttpTriggerMutation,
+  httpTriggerSecretMutationKey,
+  putHttpTriggerMutation,
+  revealHttpCredentialSecretMutation,
+  revokeHttpCredentialMutation,
+  rotateHttpCredentialMutation,
+  workflowHttpTriggerQuery,
+} from "@/services/workflows.queries";
+import { DEFAULT_SAMPLE_BODY, buildSnippet } from "./httpSnippets";
+import { buildHttpRequestSample } from "./httpRequestSample";
+import { HttpEndpointError } from "./httpEndpointUi";
+
+export type EndpointPhase = "loading" | "error" | "off" | "unsaved" | "revealing" | "steady";
+
+/** Where the endpoint stands for the panel and the header chip. */
+export type EndpointStatus = "unsaved" | "not_configured" | "off" | "draft" | "paused" | "on";
+
+export type RevealKind = "created" | "rotated" | "switched";
+/** What a rotate did to the credential that was active: kept until expiry, revoked, or none existed. */
+export type RotateReplaced = "retiring" | "revoked" | "none";
+
+/** Where the panel is open: the editor runs tests on its canvas, the list cannot. */
+export type EndpointContext = "editor" | "list";
+
+/** What the panel does on Run test: the editor closes it and opens Test with `seed`; `runAt` (µs) marks a seed taken from the latest HTTP run. */
+export type RunTestAction =
+  { kind: "open_test"; seed: unknown[]; runAt?: number } | { kind: "open_workflow"; hint: I18nKey };
+
+export interface UseWorkflowHttpEndpointArgs {
+  workflowId: Ref<string | null>;
+  isDraftOnly: Ref<boolean>;
+  /** A paused workflow refuses calls; omit when the caller does not know. */
+  workflowEnabled?: Ref<boolean>;
+  context?: EndpointContext;
+  /** Unsaved workflow (no id): called before PUT; the editor passes `persistDraft`. */
+  beforeCreate?: () => Promise<boolean>;
+}
+
+interface RunDetailBody {
+  data?: { output_map?: Record<string, unknown>; input_map?: Record<string, unknown> };
+}
+
+const NO_PERMISSIONS: HttpTriggerPermissions = { edit: false, test: false, reveal: false };
+
+const errorMessage = (err: unknown): string =>
+  (err as { response?: { data?: { message?: string } } } | null)?.response?.data?.message ??
+  gt("common.unknownError");
+
+const errorStatus = (err: unknown): number | undefined =>
+  (err as { response?: { status?: number } } | null)?.response?.status;
+
+const without = (record: Record<string, string>, key: string): Record<string, string> =>
+  Object.fromEntries(Object.entries(record).filter(([k]) => k !== key));
+
+/** A revoked row is never live; a retiring one only until `expires_at` (µs). */
+export const isLiveCredential = (c: HttpCredential, nowUs = Date.now() * 1000): boolean =>
+  c.state === "active" || (c.state === "retiring" && (c.expires_at ?? 0) > nowUs);
+
+/** Drives the endpoint panel; every secret it reveals lives only in its own refs, never in a cache. */
+export function useWorkflowHttpEndpoint(args: UseWorkflowHttpEndpointArgs) {
+  const { workflowId, isDraftOnly, workflowEnabled, beforeCreate, context = "editor" } = args;
+  const store = useStore();
+  const queryClient = useQueryClient();
+  const orgId = useOrgId();
+  const id = computed(() => workflowId.value ?? "");
+
+  const trigger = useQuery(() => workflowHttpTriggerQuery(orgId.value, id.value));
+  const put = useMutation(() => putHttpTriggerMutation(orgId.value, id.value));
+  const remove = useMutation(() => deleteHttpTriggerMutation(orgId.value, id.value));
+  const rotation = useMutation(() => rotateHttpCredentialMutation(orgId.value, id.value));
+  const revocation = useMutation(() => revokeHttpCredentialMutation(orgId.value, id.value));
+  const reveal = useMutation(() => revealHttpCredentialSecretMutation(orgId.value, id.value));
+
+  const revealedSecret = ref<string | null>(null);
+  const revealedMode = ref<HttpAuthMode | null>(null);
+  const revealKind = ref<RevealKind | null>(null);
+  const rotateReplaced = ref<RotateReplaced | null>(null);
+  const endpointExists = ref(false);
+  const revealedCredentials = ref<Record<string, string>>({});
+  const revealing = ref<string | null>(null);
+  const revealError = ref<Record<string, string>>({});
+  const revoking = ref<string | null>(null);
+
+  const state: ComputedRef<HttpTriggerState | undefined> = computed(() => trigger.data.value);
+  const config = computed<HttpTriggerConfig | undefined>(() =>
+    state.value?.configured ? state.value : undefined,
+  );
+  const permissions = computed(() => state.value?.permissions ?? NO_PERMISSIONS);
+  const credentials = computed(() => config.value?.credentials ?? []);
+  const liveCredentials = computed(() => credentials.value.filter((c) => isLiveCredential(c)));
+  const activeCredential = computed(() => liveCredentials.value.find((c) => c.state === "active"));
+  const retiringCredential = computed(() =>
+    liveCredentials.value.find((c) => c.state === "retiring"),
+  );
+
+  // An unsaved workflow has no id to ask the server with, so the selected org's admin flag decides (request/organization/mod.rs).
+  const orgAdmin = useQuery(() => ({
+    ...configFullQuery(orgId.value),
+    enabled: !workflowId.value && !!orgId.value,
+    select: (data: { is_org_admin?: boolean } | undefined) => data?.is_org_admin === true,
+  }));
+  const mayCreateCredentials = computed(
+    () => store.state.zoConfig?.rbac_enabled === true || orgAdmin.data.value === true,
+  );
+
+  const status = computed<EndpointStatus | undefined>(() => {
+    if (!workflowId.value) return "unsaved";
+    if (!state.value) return undefined;
+    if (!config.value) return "not_configured";
+    if (!config.value.enabled) return "off";
+    if (isDraftOnly.value) return "draft";
+    if (workflowEnabled?.value === false) return "paused";
+    return "on";
+  });
+
+  const phase = computed<EndpointPhase>(() => {
+    if (!workflowId.value) return "unsaved";
+    if (revealedSecret.value !== null) return "revealing";
+    if (!state.value) return trigger.isError.value ? "error" : "loading";
+    return config.value?.enabled ? "steady" : "off";
+  });
+
+  const chip = computed<"success" | "warning" | null>(() => {
+    if (status.value === "on") return "success";
+    if (status.value === "draft" || status.value === "paused") return "warning";
+    return null;
+  });
+
+  const canTurnOn = computed(() => {
+    if (!workflowId.value) return mayCreateCredentials.value;
+    if (config.value) return permissions.value.edit;
+    return permissions.value.edit && permissions.value.reveal;
+  });
+
+  const canRunTest = computed(
+    () => !!config.value && permissions.value.edit && permissions.value.test,
+  );
+
+  const runTestHint = computed<I18nKey>(() =>
+    context === "list" ? "workflow.http.runTestHintList" : "workflow.http.runTestHint",
+  );
+
+  const rotateBlocked = computed(() => !!retiringCredential.value && !!activeCredential.value);
+  // No live credential is still a valid rotate: the server mints a new one.
+  const canRotate = computed(
+    () => permissions.value.edit && permissions.value.reveal && !rotateBlocked.value,
+  );
+
+  // reset() alone leaves the settled mutation, data included, in the MutationCache until its gcTime.
+  const dropSecretMutations = () => {
+    const cache = queryClient.getMutationCache();
+    for (const m of cache.findAll({
+      mutationKey: httpTriggerSecretMutationKey(orgId.value, id.value),
+    })) {
+      if (m.state.status !== "pending") cache.remove(m);
+    }
+  };
+
+  const takeSecret = (
+    secret: string | null,
+    mode: HttpAuthMode,
+    kind: RevealKind,
+    reset: () => void,
+  ) => {
+    reset();
+    dropSecretMutations();
+    if (secret === null) return;
+    revealedSecret.value = secret;
+    revealedMode.value = mode;
+    revealKind.value = kind;
+    rotateReplaced.value = null;
+  };
+
+  const forgetRows = () => {
+    revealedCredentials.value = {};
+    revealError.value = {};
+  };
+
+  const endReveal = () => {
+    revealedSecret.value = null;
+    revealedMode.value = null;
+    revealKind.value = null;
+    rotateReplaced.value = null;
+    endpointExists.value = false;
+    forgetRows();
+  };
+
+  const fetchSecret = async (credentialId: string): Promise<string> => {
+    try {
+      return (await reveal.mutateAsync({ credential_id: credentialId })).secret;
+    } finally {
+      reveal.reset();
+      dropSecretMutations();
+    }
+  };
+
+  /** Refetches the endpoint; false when the read failed (the last good data stays on screen). */
+  const refresh = async (): Promise<boolean> => {
+    const result = await trigger.refetch();
+    return !result.isError;
+  };
+
+  const revealCredential = async (credentialId: string) => {
+    if (!permissions.value.reveal) return;
+    revealing.value = credentialId;
+    revealError.value = without(revealError.value, credentialId);
+    try {
+      const value = await fetchSecret(credentialId);
+      revealedCredentials.value = { ...revealedCredentials.value, [credentialId]: value };
+    } catch (err) {
+      revealError.value = { ...revealError.value, [credentialId]: errorMessage(err) };
+      if (errorStatus(err) === 404) void refresh();
+    } finally {
+      revealing.value = null;
+    }
+  };
+
+  const hideCredential = (credentialId: string) => {
+    revealedCredentials.value = without(revealedCredentials.value, credentialId);
+  };
+
+  /** Copies the shown value, else starts the fetch inside the click and keeps nothing; the caller toasts. */
+  const copyCredential = (credentialId: string): Promise<boolean> => {
+    const shown = revealedCredentials.value[credentialId];
+    if (shown !== undefined) return copyToClipboard(shown, gt, { silent: true });
+    return copyPendingText(fetchSecret(credentialId));
+  };
+
+  const copyExample = (): Promise<boolean> => {
+    const current = config.value;
+    if (!current) return Promise.resolve(false);
+    const build = (secret: string | null) =>
+      buildSnippet("curl", {
+        url: current.url,
+        mode: current.auth_mode,
+        secret,
+        sampleBody: DEFAULT_SAMPLE_BODY,
+      });
+    const active = activeCredential.value;
+    if (!permissions.value.reveal || !active) {
+      return copyToClipboard(build(null), gt, { silent: true });
+    }
+    const shown = revealedCredentials.value[active.id];
+    if (shown !== undefined) return copyToClipboard(build(shown), gt, { silent: true });
+    const mode = current.auth_mode;
+    return copyPendingText(
+      fetchSecret(active.id).then((secret) => {
+        if (config.value?.auth_mode !== mode || activeCredential.value?.id !== active.id) {
+          throw new HttpEndpointError("workflow.http.copyCredentialChanged");
+        }
+        return build(secret);
+      }),
+    );
+  };
+
+  const putAndReveal = async (payload: PutHttpTriggerPayload, kind: RevealKind) => {
+    const result = await put.mutateAsync(payload);
+    takeSecret(result.secret, payload.auth_mode, kind, put.reset);
+    return result;
+  };
+
+  const turnOn = async (mode: HttpAuthMode = "token") => {
+    if (!workflowId.value) {
+      if (!beforeCreate || !(await beforeCreate())) return;
+      // Lets the mutation options pick up the id the editor assigned while saving the draft.
+      await nextTick();
+      if (!workflowId.value) return;
+    }
+    const existing = config.value;
+    try {
+      const result = await putAndReveal(
+        { enabled: true, auth_mode: existing?.auth_mode ?? mode },
+        "created",
+      );
+      endpointExists.value = !existing && result.secret === null;
+    } catch (err) {
+      if (!existing && errorStatus(err) === 403) {
+        throw new HttpEndpointError("workflow.http.createForbidden");
+      }
+      throw err;
+    }
+  };
+
+  const turnOff = async () => {
+    const current = config.value;
+    if (!current) return;
+    await putAndReveal({ enabled: false, auth_mode: current.auth_mode }, "created");
+  };
+
+  const switchMode = async (mode: HttpAuthMode) => {
+    const current = config.value;
+    if (!current || current.auth_mode === mode) return;
+    forgetRows();
+    await putAndReveal({ enabled: current.enabled, auth_mode: mode }, "switched");
+  };
+
+  const saveLimits = async (limits: { max_body_bytes: number; rate_limit_per_minute: number }) => {
+    const current = config.value;
+    if (!current) return;
+    await putAndReveal(
+      { enabled: current.enabled, auth_mode: current.auth_mode, ...limits },
+      "created",
+    );
+  };
+
+  const rotate = async (overlapSeconds: OverlapSeconds) => {
+    const current = config.value;
+    if (!current) throw new HttpEndpointError("workflow.http.errorNotConfigured");
+    if (rotateBlocked.value) {
+      throw new HttpEndpointError(
+        current.auth_mode === "signature"
+          ? "workflow.http.rotateBlockedSigned"
+          : "workflow.http.rotateBlocked",
+      );
+    }
+    if (!canRotate.value) throw new HttpEndpointError("workflow.http.errorNotAllowed");
+    let replaced: RotateReplaced = "none";
+    if (activeCredential.value) replaced = overlapSeconds > 0 ? "retiring" : "revoked";
+    const result = await rotation.mutateAsync({ overlap_seconds: overlapSeconds });
+    takeSecret(result.secret, current.auth_mode, "rotated", rotation.reset);
+    rotateReplaced.value = replaced;
+  };
+
+  const revoke = async (credentialId: string) => {
+    revoking.value = credentialId;
+    try {
+      await revocation.mutateAsync({ credential_id: credentialId });
+      hideCredential(credentialId);
+    } finally {
+      revoking.value = null;
+    }
+  };
+
+  const deleteEndpoint = async () => {
+    await remove.mutateAsync();
+    endReveal();
+  };
+
+  /** Dry run from the browser with the token on screen, else the active one fetched for this call only. */
+  const sendTest = async (body: string = DEFAULT_SAMPLE_BODY): Promise<DryRunResult> => {
+    const current = config.value;
+    if (!current) throw new HttpEndpointError("workflow.http.errorNotConfigured");
+    const mode =
+      revealedSecret.value === null ? current.auth_mode : (revealedMode.value ?? current.auth_mode);
+    // The signing secret never goes into browser code, so signed endpoints test with the example script.
+    if (mode !== "token") throw new HttpEndpointError("workflow.http.sendTestSigned");
+    let token = revealedSecret.value;
+    if (token === null) {
+      const active = activeCredential.value;
+      if (!active) throw new HttpEndpointError("workflow.http.errorNoLiveCredential");
+      token = revealedCredentials.value[active.id] ?? (await fetchSecret(active.id));
+    }
+    return dryRunHook({ url: current.url, token, body, contentType: "application/json" });
+  };
+
+  /** The trigger step's records of a stored run; null when the run holds none or cannot be read. */
+  const runTriggerInput = async (runId: string, nodeId: string): Promise<unknown[] | null> => {
+    try {
+      const res = await workflowService.getWorkflowRun({
+        org_identifier: orgId.value,
+        id: id.value,
+        run_id: runId,
+      });
+      const body: RunDetailBody | undefined = res.data;
+      const records = body?.data?.output_map?.[nodeId] ?? body?.data?.input_map?.[nodeId];
+      return Array.isArray(records) && records.length > 0 ? records : null;
+    } catch {
+      return null;
+    }
+  };
+
+  /** The Test dialog always runs the in-memory graph, so the seed is the latest HTTP run's input or the sample. */
+  const runTest = async (triggerNodeId?: string): Promise<RunTestAction> => {
+    if (context === "list") return { kind: "open_workflow", hint: runTestHint.value };
+    const call = config.value?.last_call;
+    const input = call && triggerNodeId ? await runTriggerInput(call.run_id, triggerNodeId) : null;
+    if (call && input) return { kind: "open_test", seed: input, runAt: call.received_at };
+    return { kind: "open_test", seed: buildHttpRequestSample({ trigger_id: "test" }) };
+  };
+
+  watch(orgId, endReveal);
+  watch(workflowId, endReveal);
+  // Keyed on the fetch settling, not dataUpdatedAt, which a refetch in the same millisecond leaves unchanged.
+  watch(trigger.isFetching, (fetching, wasFetching) => {
+    if (wasFetching && !fetching) revealedCredentials.value = {};
+  });
+  onScopeDispose(endReveal);
+
+  return {
+    state,
+    config,
+    phase,
+    status,
+    chip,
+    permissions,
+    credentials,
+    liveCredentials,
+    activeCredential,
+    retiringCredential,
+    storageWarning: computed(() => state.value?.secrets_encrypted_at_rest === false),
+    canTurnOn,
+    canRotate,
+    canRunTest,
+    runTestHint,
+    rotateBlocked,
+    endpointExists: readonly(endpointExists),
+    revealedSecret: readonly(revealedSecret),
+    revealKind: readonly(revealKind),
+    rotateReplaced: readonly(rotateReplaced),
+    revealActive: computed(() => revealedSecret.value !== null),
+    revealedCredentials: readonly(revealedCredentials),
+    revealing: readonly(revealing),
+    revealError: readonly(revealError),
+    revoking: readonly(revoking),
+    saving: put.isPending,
+    rotating: rotation.isPending,
+    deleting: remove.isPending,
+    loading: trigger.isPending,
+    fetching: trigger.isFetching,
+    revealCredential,
+    hideCredential,
+    copyCredential,
+    copyExample,
+    turnOn,
+    turnOff,
+    switchMode,
+    rotate,
+    revoke,
+    saveLimits,
+    deleteEndpoint,
+    sendTest,
+    runTest,
+    endReveal,
+    refresh,
+  };
+}
diff --git a/web/src/services/fleet.mock.ts b/web/src/services/fleet.mock.ts
index 085130bffe..d3d7fd804a 100644
--- a/web/src/services/fleet.mock.ts
+++ b/web/src/services/fleet.mock.ts
@@ -31,6 +31,7 @@ import type {
   FleetSettings,
   FleetToken,
 } from "./fleet";
+import { AUDIT_MODULES, auditKind } from "@/components/fleet/auditKind";
 
 /** The one switch for the in-memory Fleet backend; delete this file once the server serves every endpoint. */
 export const FLEET_MOCK = import.meta.env.VITE_FLEET_MOCK === "true";
@@ -413,6 +414,11 @@ function fail(status: number, message: string, extra: Record<string, unknown> =
   return new Promise<never>((_, reject) => setTimeout(() => reject(err), LATENCY_MS));
 }
 
+function auditModule(action: string) {
+  const kind = auditKind(action);
+  return kind === "other" ? null : AUDIT_MODULES[kind];
+}
+
 function audit(action: string, target: string) {
   store.audit.unshift({
     id: `a${store.seq++}`,
@@ -786,7 +792,22 @@ export const fleetMock: FleetApi = {
     store.configs = store.configs.filter((x) => x.id !== id);
     return reply(undefined as unknown);
   },
-  listAudit: () => reply({ items: store.audit }),
+  listAudit: (_org, params = {}) => {
+    const from = params.from ?? Date.now() - 30 * DAY;
+    const keyword = params.q?.trim().toLowerCase();
+    const matching = store.audit.filter(
+      (e) =>
+        e.at >= from &&
+        e.at < (params.to ?? Infinity) &&
+        (!params.module || auditModule(e.action) === params.module) &&
+        (!keyword || [e.actor, e.target].some((s) => s.toLowerCase().includes(keyword))),
+    );
+    const offset = params.offset ?? 0;
+    return reply({
+      total: matching.length,
+      items: matching.slice(offset, offset + (params.limit ?? 100)),
+    });
+  },
   listRollouts: () => reply({ items: store.rollouts, total: store.rollouts.length }),
   getRollout: (_org, id) => {
     const r = store.rollouts.find((x) => x.id === id);
diff --git a/web/src/services/fleet.queries.ts b/web/src/services/fleet.queries.ts
index 81f11925ac..b3383a08ab 100644
--- a/web/src/services/fleet.queries.ts
+++ b/web/src/services/fleet.queries.ts
@@ -16,6 +16,7 @@
 import { mutationOptions, queryOptions } from "@tanstack/vue-query";
 import fleet, {
   type FleetAuditList,
+  type FleetAuditParams,
   type FleetCollector,
   type FleetConfigDetail,
   type FleetConfigIssues,
@@ -45,7 +46,7 @@ import {
   type CollectorMetricValues,
 } from "@/components/fleet/collectorMetrics";
 import { LIVE_STALE_TIME } from "@/composables/query/cachePolicy";
-import { queryClient } from "@/composables/query/queryClient";
+import { quantizeRange, queryClient, stableFilters } from "@/composables/query/queryClient";
 
 // Delivery and rollout state move without any write from this tab, so the views poll while they do.
 const DELIVERY_POLL_MS = 5000;
@@ -257,16 +258,23 @@ export const fleetConfigVersionQuery = (org: string, id: string, version: number
     staleTime: Infinity,
   });
 
-export const fleetAuditQuery = (org: string) =>
-  queryOptions({
-    queryKey: fleetKeys.audit(org),
+export const fleetAuditQuery = (org: string, params: FleetAuditParams = {}) => {
+  const sent = stableFilters(params);
+  // A preset period starts at Date.now(), so the key rounds it to the minute to let a remount hit.
+  const keyed = stableFilters({
+    ...sent,
+    from: sent.from === undefined ? undefined : quantizeRange(sent.from, sent.from).start,
+  });
+  return queryOptions({
+    queryKey: [...fleetKeys.audit(org), keyed],
     queryFn: async (): Promise<FleetAuditList> => {
-      const list = (await fleet.listAudit(org)).data;
+      const list = (await fleet.listAudit(org, sent)).data;
       if (!Array.isArray(list?.items)) throw new Error("Malformed fleet audit response");
       return list;
     },
     staleTime: LIVE_STALE_TIME,
   });
+};
 
 export const fleetSettingsQuery = (org: string) =>
   queryOptions({
diff --git a/web/src/services/fleet.spec.ts b/web/src/services/fleet.spec.ts
index d5638045a4..3f8f6a98a2 100644
--- a/web/src/services/fleet.spec.ts
+++ b/web/src/services/fleet.spec.ts
@@ -267,9 +267,12 @@ describe("fleet service", () => {
     }
   });
 
-  it("listAudit() calls GET /api/{org}/fleet/audit", () => {
-    fleet.listAudit("acme");
-    expect(mockClient.get).toHaveBeenCalledWith("/api/acme/fleet/audit");
+  it("listAudit() calls GET /api/{org}/fleet/audit with the page and filters as params", () => {
+    const params = { offset: 50, limit: 50, fleet: "prod", module: "configs" };
+    fleet.listAudit("acme", { ...params, from: 1, to: 2 } as any);
+    expect(mockClient.get).toHaveBeenCalledWith("/api/acme/fleet/audit", {
+      params: { ...params, from: 1, to: 2 },
+    });
   });
 
   it("getPipelines() calls GET /api/{org}/fleet/pipelines with the window as a param", () => {
@@ -557,13 +560,34 @@ describe("fleet queries", () => {
   );
 
   it("returns the audit envelope and fails on a malformed one", async () => {
-    const list = { items: [{ id: "a1" }], audit_disabled: false };
+    const list = { total: 1, items: [{ id: "a1" }], audit_disabled: false };
     mockClient.get.mockResolvedValueOnce({ data: list });
     expect(await (fleetAuditQuery("acme").queryFn as any)()).toEqual(list);
     mockClient.get.mockResolvedValueOnce({ data: {} });
     await expect((fleetAuditQuery("acme").queryFn as any)()).rejects.toThrow();
   });
 
+  it("keys each audit page and filter under the audit prefix the writes invalidate", () => {
+    const prefix = fleetKeys.audit("acme");
+    const first = fleetAuditQuery("acme", { offset: 0, limit: 50 }).queryKey;
+    const next = fleetAuditQuery("acme", { offset: 50, limit: 50 }).queryKey;
+    const tokens = fleetAuditQuery("acme", { offset: 0, limit: 50, module: "tokens" }).queryKey;
+    for (const key of [first, next, tokens]) expect(key.slice(0, prefix.length)).toEqual(prefix);
+    expect(new Set([first, next, tokens].map((k) => JSON.stringify(k))).size).toBe(3);
+  });
+
+  it("rounds the audit period start in the key but sends it exactly", async () => {
+    const at = 1_700_000_000_000;
+    const a = fleetAuditQuery("acme", { from: at + 1_000, fleet: undefined });
+    const b = fleetAuditQuery("acme", { from: at + 2_000 });
+    expect(a.queryKey).toEqual(b.queryKey);
+    mockClient.get.mockResolvedValueOnce({ data: { total: 0, items: [] } });
+    await (a.queryFn as any)();
+    expect(mockClient.get).toHaveBeenLastCalledWith("/api/acme/fleet/audit", {
+      params: { from: at + 1_000 },
+    });
+  });
+
   it("keys the settings under the fleet scope and returns their body as is", async () => {
     const scope = fleetKeys.all("acme");
     expect(fleetKeys.settings("acme").slice(0, scope.length)).toEqual(scope);
diff --git a/web/src/services/fleet.ts b/web/src/services/fleet.ts
index 0d5c6f587c..6902b2ae39 100644
--- a/web/src/services/fleet.ts
+++ b/web/src/services/fleet.ts
@@ -257,7 +257,25 @@ export interface FleetAuditEvent {
   outcome: string;
 }
 
+/** `settings` is the org-level fleet settings. */
+export type FleetAuditModule =
+  "collectors" | "tokens" | "fleets" | "rollouts" | "configs" | "settings";
+
+/** `from`/`to` are epoch ms, `[from, to)`; the server defaults to the 30 days before `to` (now). */
+export type FleetAuditParams = {
+  /** Matches the actor or the target, ignoring case. */
+  q?: string;
+  offset?: number;
+  limit?: number;
+  fleet?: string;
+  module?: FleetAuditModule;
+  from?: number;
+  to?: number;
+};
+
+/** One page of the audit trail, newest first; `total` counts every event the filters match. */
 export interface FleetAuditList {
+  total: number;
   items: FleetAuditEvent[];
   /** The trail is the server's audit stream, which `O2_AUDIT_ENABLED=false` turns off. */
   audit_disabled?: boolean;
@@ -506,7 +524,8 @@ const api = {
   validateConfig: (orgId: string, body: { yaml: string }) =>
     http().post<{ issues: FleetConfigIssues }>(`/api/${orgId}/fleet/configs/validate`, body),
   deleteConfig: (orgId: string, id: string) => http().delete(configPath(orgId, id)),
-  listAudit: (orgId: string) => http().get<FleetAuditList>(`/api/${orgId}/fleet/audit`),
+  listAudit: (orgId: string, params: FleetAuditParams = {}) =>
+    http().get<FleetAuditList>(`/api/${orgId}/fleet/audit`, { params }),
   listRollouts: (orgId: string, page?: FleetPage) =>
     http().get<{ items: FleetRollout[]; total: number }>(
       paged(`/api/${orgId}/fleet/rollouts`, page),
diff --git a/web/src/services/gen-ai-data-health.service.ts b/web/src/services/gen-ai-data-health.service.ts
new file mode 100644
index 0000000000..108fbb38f8
--- /dev/null
+++ b/web/src/services/gen-ai-data-health.service.ts
@@ -0,0 +1,85 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import http from "./http";
+
+export type DataHealthCheckId =
+  "unpriced_models" | "missing_agent_identity" | "zero_duration_spans" | "missing_session_id";
+
+export type DataHealthStatus = "pass" | "warning" | "error";
+
+/** Mirrors the backend `ModelUsage` (`gen_ai_health.rs`). */
+export interface DataHealthModelUsage {
+  /** Null for spans that carry no model name. */
+  model: string | null;
+  spans: number;
+  tokens: number;
+}
+
+/** Mirrors the backend `HealthCheck`; field names are snake_case on the wire. */
+export interface DataHealthCheck {
+  id: DataHealthCheckId;
+  status: DataHealthStatus;
+  affected: number;
+  total: number;
+  /** Unpriced check only: the 20 models with the most unpriced tokens. */
+  models?: DataHealthModelUsage[];
+  /** Unpriced check only: every distinct model behind the unpriced spans, uncapped. */
+  model_count?: number;
+  /** Unpriced check only: tokens on every unpriced span, uncapped. */
+  unpriced_tokens?: number;
+  /** Unpriced check only: `models` leaves some of the `model_count` models out. */
+  models_truncated?: boolean;
+  /** Sample trace ids; present only when requested with `include_samples`. */
+  samples?: string[];
+}
+
+export interface DataHealthResponse {
+  /** When the checks ran, epoch microseconds (the server caches ~1 min). */
+  checked_at: number;
+  checks: DataHealthCheck[];
+}
+
+export interface DataHealthParams {
+  stream_name: string;
+  start_time: number;
+  end_time: number;
+  /** Agent name; the server matches on `agent_id` instead when one is given. */
+  agent?: string | null;
+  agent_id?: string | null;
+  env?: string | null;
+  version?: string | null;
+  refresh?: boolean;
+  /** Also return sample trace ids per failing check (each costs a window-wide query). */
+  include_samples?: boolean;
+}
+
+/** GET /api/{org}/gen_ai/data_health — AI data health checks for one stream and window. */
+export const getDataHealth = (orgId: string, params: DataHealthParams) => {
+  const query: Record<string, string | number | boolean> = {
+    stream_name: params.stream_name,
+    start_time: params.start_time,
+    end_time: params.end_time,
+  };
+  if (params.agent) query.agent = params.agent;
+  if (params.agent_id) query.agent_id = params.agent_id;
+  if (params.env) query.env = params.env;
+  if (params.version) query.version = params.version;
+  if (params.refresh) query.refresh = true;
+  if (params.include_samples) query.include_samples = true;
+  return http().get<DataHealthResponse>(`/api/${encodeURIComponent(orgId)}/gen_ai/data_health`, {
+    params: query,
+  });
+};
diff --git a/web/src/services/llm-datasets.service.ts b/web/src/services/llm-datasets.service.ts
index 1802824079..91b36dd2b1 100644
--- a/web/src/services/llm-datasets.service.ts
+++ b/web/src/services/llm-datasets.service.ts
@@ -36,8 +36,12 @@ export interface LlmDataset {
   orgId?: string;
   name: string;
   description: string | null;
-  /** Dataset-wide MVCC sequence — bumped on every item insert/edit/delete. */
+  /** Per-row MVCC counter — every stored item row takes the next one. This is
+   *  the value an experiment pins; never display it. */
   globalVersion: number;
+  /** The version shown for the dataset: one per write request (a batch upsert
+   *  or import is one version, whatever its item count). */
+  writeVersion: number;
   /** Count of live (non-deleted) items. Derived server-side per read; the
    *  Dataset row stores no counter, so this cannot drift. */
   itemCount: number;
@@ -82,8 +86,11 @@ export interface LlmDatasetItem {
   rawExpectedOutput: unknown;
   source: LlmDatasetItemSource;
   tags: string[];
-  /** Dataset-wide MVCC sequence this row was written at (server-owned). */
+  /** Dataset-wide MVCC sequence this row was written at (server-owned). Orders
+   *  an item's history; not for display. */
   version: number;
+  /** The dataset version of the write that stored this row — what to display. */
+  writeVersion: number;
   /** Free-form dimensions stored on the item — what subset filters read. */
   metadata: Record<string, unknown> | null;
   /** Lineage — the trace id a telemetry-pushed golden was distilled from. */
@@ -159,6 +166,7 @@ function normalize(d: any): LlmDataset {
     name: d.name,
     description: d.description ?? null,
     globalVersion: d.global_version ?? d.globalVersion ?? 0,
+    writeVersion: d.write_version ?? d.writeVersion ?? 0,
     itemCount: d.item_count ?? d.itemCount ?? 0,
     tags: Array.isArray(d.tags) ? d.tags : [],
     sources: {
@@ -247,6 +255,7 @@ function normalizeItem(d: any): LlmDatasetItem {
     source: (d.source ?? "manual") as LlmDatasetItemSource,
     tags: Array.isArray(d.tags) ? d.tags : [],
     version: Number(d.globalVersion ?? d.global_version ?? 0),
+    writeVersion: Number(d.writeVersion ?? d.write_version ?? 0),
     metadata: objectOrNull(d.metadata),
     // Lineage stays as FOUR separate pointers: an annotation push carries both a
     // trace ref and a review submission, so collapsing them loses half the story.
diff --git a/web/src/services/llm-experiments.service.ts b/web/src/services/llm-experiments.service.ts
index e10cc051a5..592aec44ff 100644
--- a/web/src/services/llm-experiments.service.ts
+++ b/web/src/services/llm-experiments.service.ts
@@ -170,6 +170,9 @@ export interface LlmExperiment extends ExperimentCreatePayload {
   orgId: string;
   /** Resolved server-side from the pinned dataset; null when it was deleted. */
   datasetName: string | null;
+  /** What the pinned `datasetVersion` shows as — the dataset's write version.
+   *  Display this; `datasetVersion` is the pin key. */
+  datasetWriteVersion: number;
   scorers: PinnedExperimentScorer[];
   /** Consolidated execution + scoring lifecycle when summary data is available. */
   status: ExperimentStatus;
@@ -230,7 +233,7 @@ export interface ExperimentExecution {
 
 export interface ExperimentRowDetail {
   experimentId: string;
-  snapshot: { datasetId: string; datasetVersion: number };
+  snapshot: { datasetId: string; datasetVersion: number; datasetWriteVersion: number };
   navigation: {
     rowIndex: number;
     totalRows: number;
@@ -262,6 +265,8 @@ export interface ExperimentResultRow {
   output: unknown | null;
   scoreSummaries: ExperimentScoreSummary[];
   p50LatencyMs: number | null;
+  /** First line of the most common error across the row's failed trials. */
+  errorMessage: string | null;
   dispersion: ExperimentRowDispersion | null;
 }
 
@@ -350,6 +355,18 @@ export interface ExperimentAggregateSummary {
   incompleteTaskSlots: number;
   incompleteScoreDimensions: number;
   errorTaskSlots: number;
+  /** Errored slots grouped by kind (or first message line when kindless), largest first (top 3). */
+  failureCauses: ExperimentFailureCause[];
+  /** Distinct causes across every errored slot, including those beyond the top 3. */
+  failureCauseCount: number;
+}
+
+export interface ExperimentFailureCause {
+  /** Shared taxonomy (`provider_auth`, `timeout`, …); null when the producer did not classify the failure. */
+  kind: string | null;
+  /** First line of the error message. */
+  message: string;
+  slotCount: number;
 }
 
 export interface ExperimentProgress {
@@ -657,6 +674,7 @@ function normalizeExperiment(input: any): LlmExperiment {
     datasetId: value(input, "datasetId", "dataset_id", ""),
     datasetName: value(input, "datasetName", "dataset_name", null),
     datasetVersion: Number(value(input, "datasetVersion", "dataset_version", 0)),
+    datasetWriteVersion: Number(value(input, "datasetWriteVersion", "dataset_write_version", 0)),
     datasetFilter: value(input, "datasetFilter", "dataset_filter", null),
     task: input.task,
     scorers: (input.scorers ?? []).map((scorer: any) => ({
@@ -760,6 +778,16 @@ function normalizeAggregateSummary(aggregateSummary: any): ExperimentAggregateSu
       value(aggregateSummary, "incompleteScoreDimensions", "incomplete_score_dimensions", 0),
     ),
     errorTaskSlots: Number(value(aggregateSummary, "errorTaskSlots", "error_task_slots", 0)),
+    failureCauses: (
+      value<any[]>(aggregateSummary, "failureCauses", "failure_causes", []) ?? []
+    ).map((cause) => ({
+      kind: value<string | null>(cause, "kind", "kind", null),
+      message: String(value(cause, "message", "message", "")),
+      slotCount: Number(value(cause, "slotCount", "slot_count", 0)),
+    })),
+    failureCauseCount: Number(
+      value(aggregateSummary, "failureCauseCount", "failure_cause_count", 0),
+    ),
   };
 }
 
@@ -951,6 +979,7 @@ export function normalizeExperimentResultRowPage(input: any): ExperimentResultRo
         normalizeScoreSummary,
       ),
       p50LatencyMs: numberOrNull(value(row, "p50LatencyMs", "p50_latency_ms", null)),
+      errorMessage: value<string | null>(row, "errorMessage", "error_message", null),
       dispersion: row?.dispersion ? normalizeRowDispersion(row.dispersion) : null,
     })),
     pagination: {
@@ -970,6 +999,9 @@ export function normalizeExperimentRowDetail(input: any): ExperimentRowDetail {
     snapshot: {
       datasetId: value(snapshot, "datasetId", "dataset_id", ""),
       datasetVersion: Number(value(snapshot, "datasetVersion", "dataset_version", 0)),
+      datasetWriteVersion: Number(
+        value(snapshot, "datasetWriteVersion", "dataset_write_version", 0),
+      ),
     },
     navigation: {
       rowIndex: Number(value(navigation, "rowIndex", "row_index", 0)),
diff --git a/web/src/services/llm-playground.service.spec.ts b/web/src/services/llm-playground.service.spec.ts
index 512a3246c2..a25c2ffdab 100644
--- a/web/src/services/llm-playground.service.spec.ts
+++ b/web/src/services/llm-playground.service.spec.ts
@@ -264,6 +264,17 @@ describe("runPlayground — live adapter", () => {
     expect(fetchMock.mock.calls[0][0]).toBe("http://api.test/api/org/playground/run");
   });
 
+  it("sends every sampling param verbatim, and no temperature the caller left unset", async () => {
+    const fetchMock = stubFetch(
+      streamingResponse([frame({ type: "done", latencyMs: 1, usage: {} })]),
+    );
+    const params = { max_tokens: 256, top_p: 0.9, stop: ["###"], seed: 7 };
+
+    await runPlayground("org", request({ params }), { onDelta: () => {} });
+
+    expect(sentBody(fetchMock).column.params).toEqual(params);
+  });
+
   it("preserves a tool call and its linked result in the request body", async () => {
     const fetchMock = stubFetch(streamingResponse([]));
 
diff --git a/web/src/services/llm-playground.service.ts b/web/src/services/llm-playground.service.ts
index c1ff6e18dd..e186c50cbb 100644
--- a/web/src/services/llm-playground.service.ts
+++ b/web/src/services/llm-playground.service.ts
@@ -55,7 +55,8 @@ export interface PlaygroundRunRequest {
   /** Already rendered: `{{tokens}}` are substituted client-side, so the server
    *  binds nothing and `row` is omitted from the request. */
   messages: PlaygroundRequestMessage[];
-  params: { temperature?: number; maxTokens?: number };
+  /** Sampling parameters sent verbatim; keys beyond `temperature`/`max_tokens` pass through. */
+  params: Record<string, unknown>;
   /** Definitions only. The Playground never executes a tool — see `toolCall`. */
   tools?: PlaygroundRequestTool[];
   responseSchema?: unknown | null;
@@ -291,10 +292,7 @@ function wireBody(request: PlaygroundRunRequest): Record<string, unknown> {
       ...(message.toolCalls?.length ? { toolCalls: message.toolCalls } : {}),
       ...(message.toolCallId ? { toolCallId: message.toolCallId } : {}),
     })),
-    params: {
-      temperature: request.params.temperature ?? 0,
-      ...(request.params.maxTokens ? { max_tokens: request.params.maxTokens } : {}),
-    },
+    params: { ...request.params },
   };
 
   // An empty model would fail the server's model validation; omitting it lets
diff --git a/web/src/services/model_pricing.queries.ts b/web/src/services/model_pricing.queries.ts
index 0fd41eb6c3..61c87ee5ea 100644
--- a/web/src/services/model_pricing.queries.ts
+++ b/web/src/services/model_pricing.queries.ts
@@ -14,9 +14,12 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { mutationOptions, queryOptions } from "@tanstack/vue-query";
-import modelPricing from "./model_pricing";
+import modelPricing, {
+  type BuiltInPricingResponse,
+  type UnpricedModelsResponse,
+} from "./model_pricing";
 import { modelPricingKeys } from "./model_pricing.querykeys";
-import { NORMAL_STALE_TIME } from "@/composables/query/cachePolicy";
+import { MEDIUM_STALE_TIME, NORMAL_STALE_TIME } from "@/composables/query/cachePolicy";
 
 export const modelPricingQuery = (org: string) =>
   queryOptions({
@@ -25,6 +28,30 @@ export const modelPricingQuery = (org: string) =>
     staleTime: NORMAL_STALE_TIME,
   });
 
+/** The built-in price list with its seed date and last online sync time. */
+export const builtInPricingQuery = (org: string, metadataOnly = false) =>
+  queryOptions({
+    queryKey: modelPricingKeys.builtIn(org, metadataOnly),
+    queryFn: async (): Promise<BuiltInPricingResponse | null> =>
+      (await modelPricing.getBuiltIn(org, undefined, metadataOnly))?.data ?? null,
+    staleTime: NORMAL_STALE_TIME,
+  });
+
+/** Models in a stream's spans between the µs bounds that have no price or an approximate one. */
+export const unpricedModelsQuery = (org: string, stream: string, start: number, end: number) =>
+  queryOptions({
+    queryKey: modelPricingKeys.unpriced(org, stream, start, end),
+    queryFn: async (): Promise<UnpricedModelsResponse> =>
+      (
+        await modelPricing.listUnpriced(org, {
+          stream_name: stream,
+          start_time: start,
+          end_time: end,
+        })
+      )?.data ?? { models: [], model_count: 0, tokens: 0, models_truncated: false },
+    staleTime: MEDIUM_STALE_TIME,
+  });
+
 // ── Writes ──────────────────────────────────────────────────────────────────
 
 /** The list is an hour-long cached read, so the editor would otherwise route back to a pre-write copy. */
diff --git a/web/src/services/model_pricing.querykeys.ts b/web/src/services/model_pricing.querykeys.ts
index 0adce98166..0ec02e864f 100644
--- a/web/src/services/model_pricing.querykeys.ts
+++ b/web/src/services/model_pricing.querykeys.ts
@@ -25,4 +25,8 @@ import { orgKey } from "@/composables/query/keys";
 export const modelPricingKeys = {
   all: (org: string) => orgKey(org, "settings", "modelPricing"),
   list: (org: string) => orgKey(org, "settings", "modelPricing"),
+  builtIn: (org: string, metadataOnly = false) =>
+    orgKey(org, "settings", "modelPricing", "builtIn", metadataOnly),
+  unpriced: (org: string, stream: string, start: number, end: number) =>
+    orgKey(org, "settings", "modelPricing", "unpriced", stream, start, end),
 };
diff --git a/web/src/services/model_pricing.ts b/web/src/services/model_pricing.ts
index c329644609..4c55a2268c 100644
--- a/web/src/services/model_pricing.ts
+++ b/web/src/services/model_pricing.ts
@@ -15,6 +15,71 @@
 
 import http from "./http";
 
+/** One pricing tier in its wire shape: per-token prices keyed by usage type. */
+export interface PricingTier {
+  name: string;
+  condition?: { usage_key: string; operator: string; value: number } | null;
+  prices: Record<string, number>;
+  utc_windows?: { start_minute: number; end_minute: number }[];
+  rules?: { keys: string[]; op: string; values?: string[]; value?: number }[];
+}
+
+/** A price definition as the pricing API returns it. */
+export interface PricingMatch {
+  name: string;
+  match_pattern: string;
+  source: "built_in" | "meta_org" | "org";
+  tiers: PricingTier[];
+}
+
+/** The body the create endpoint takes for an org price definition. */
+export interface NewPricingDefinition {
+  name: string;
+  match_pattern: string;
+  enabled: boolean;
+  tiers: PricingTier[];
+  description: string;
+}
+
+/** A model seen in spans that matched no price, or only part of a pattern. */
+export interface UnpricedModel {
+  /** Null for spans that carry tokens but no model name: nothing to price. */
+  model: string | null;
+  status: "unpriced" | "approximate";
+  spans: number;
+  tokens: number;
+  cost: number;
+  /** Up to 10 agent names that sent the model. */
+  agents: string[];
+  /** Distinct agent names behind the row, including those past the list cap. */
+  agent_count: number;
+  /** True when an exact definition covers new spans, but recorded costs still have a gap. */
+  priced_now?: boolean;
+  /** The pricing definition the model resolves to today, if any. */
+  matched: PricingMatch | null;
+}
+
+/** GET /llm/models/unpriced: the listed models and the uncapped totals behind them. */
+export interface UnpricedModelsResponse {
+  /** Models with historical pricing gaps; priced_now marks an exact price for new spans. */
+  models: UnpricedModel[];
+  /** Distinct models ingest marked in the window, before today's prices apply. */
+  model_count: number;
+  /** Tokens on every span ingest marked in the window. */
+  tokens: number;
+  /** The server listed only the models with the most tokens. */
+  models_truncated: boolean;
+}
+
+export interface BuiltInPricingResponse {
+  models: PricingMatch[];
+  source_url: string;
+  /** Unix seconds of this server's last successful online sync; 0 = none since startup. */
+  last_updated: number;
+  /** Date (YYYY-MM-DD) of the seed price list compiled into the binary. */
+  seed_date: string;
+}
+
 const modelPricing = {
   list: (org_identifier: string) => {
     return http().get(`/api/${org_identifier}/llm/models`);
@@ -31,9 +96,21 @@ const modelPricing = {
   delete: (org_identifier: string, model_id: string) => {
     return http().delete(`/api/${org_identifier}/llm/models/${model_id}`);
   },
-  getBuiltIn: (org_identifier: string, search?: string) => {
-    const params = search ? `?search=${encodeURIComponent(search)}` : "";
-    return http().get(`/api/${org_identifier}/llm/models/built-in${params}`);
+  getBuiltIn: (org_identifier: string, search?: string, metadataOnly = false) => {
+    const params = new URLSearchParams();
+    if (search) params.set("search", search);
+    if (metadataOnly) params.set("metadata_only", "true");
+    const query = params.size ? `?${params}` : "";
+    return http().get<BuiltInPricingResponse>(`/api/${org_identifier}/llm/models/built-in${query}`);
+  },
+  /** Models in `stream_name` spans between the µs bounds that have no price or an approximate one. */
+  listUnpriced: (
+    org_identifier: string,
+    params: { stream_name: string; start_time: number; end_time: number },
+  ) => {
+    return http().get<UnpricedModelsResponse>(`/api/${org_identifier}/llm/models/unpriced`, {
+      params,
+    });
   },
   refreshBuiltIn: (org_identifier: string) => {
     return http().post(`/api/${org_identifier}/llm/models/refresh-built-in`, {});
diff --git a/web/src/services/oncall.queries.ts b/web/src/services/oncall.queries.ts
index 4218ff6fc1..d025418b7c 100644
--- a/web/src/services/oncall.queries.ts
+++ b/web/src/services/oncall.queries.ts
@@ -721,6 +721,13 @@ export const snoozeResponseMutation = (org: string) =>
     meta: { invalidates: responseWriteScopes(org), silentError: true },
   });
 
+export const unsnoozeResponseMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (responseId: string) =>
+      oncallService.unsnoozeResponse({ org_identifier: org, response_id: responseId }),
+    meta: { invalidates: responseWriteScopes(org), silentError: true },
+  });
+
 export const resolveResponseMutation = (org: string) =>
   mutationOptions({
     mutationFn: ({
diff --git a/web/src/services/oncall.ts b/web/src/services/oncall.ts
index 5341af330b..e5c223c653 100644
--- a/web/src/services/oncall.ts
+++ b/web/src/services/oncall.ts
@@ -511,6 +511,18 @@ const oncall = {
       { minutes },
     ),
 
+  /// Ends a snooze now; the ladder continues from the step it paused on.
+  unsnoozeResponse: ({
+    org_identifier,
+    response_id,
+  }: {
+    org_identifier: string;
+    response_id: string;
+  }) =>
+    http().post<OnCallResponse>(
+      `/api/${org_identifier}/oncall/responses/${encodeURIComponent(response_id)}/unsnooze`,
+    ),
+
   addNote: ({
     org_identifier,
     response_id,
diff --git a/web/src/services/online-evals.service.queries.spec.ts b/web/src/services/online-evals.service.queries.spec.ts
new file mode 100644
index 0000000000..28185a536f
--- /dev/null
+++ b/web/src/services/online-evals.service.queries.spec.ts
@@ -0,0 +1,159 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// The four Evaluations lists are cached per org for minutes, and every page that
+// reads one (Evaluations, Playground, Experiment detail, trace score chips) reads
+// the cache without forcing. So a write that does not invalidate leaves the next
+// read serving the pre-write list. These tests pin that every write path drops it.
+
+import { beforeEach, describe, expect, it, vi } from "vitest";
+import { MutationObserver, type MutationObserverOptions } from "@tanstack/vue-query";
+import type { EvalJobPayload } from "./online-evals.service";
+
+const server = vi.hoisted(() => ({
+  rows: {} as Record<string, Array<Record<string, unknown>>>,
+}));
+
+vi.mock("./product_analytics", () => ({ default: { track: vi.fn() } }));
+
+vi.mock("@/services/http", () => {
+  const collection = (url: string) => url.split("/")[3];
+  return {
+    default: () => ({
+      get: vi.fn(async (url: string) => ({
+        data: { list: [...(server.rows[collection(url)] ?? [])] },
+      })),
+      post: vi.fn(async (url: string, body: Record<string, unknown>) => {
+        const [, , , name, id, action] = url.split("/");
+        if (action) {
+          const row = server.rows[name].find((r) => r.id === id)!;
+          row.status = action === "activate" ? "active" : "paused";
+          return { data: row };
+        }
+        const row = { id: `${name}-${server.rows[name].length + 1}`, ...body };
+        server.rows[name].push(row);
+        return { data: row };
+      }),
+      put: vi.fn(async (url: string, body: Record<string, unknown>) => {
+        const [, , , name, id] = url.split("/");
+        const row = server.rows[name].find((r) => r.id === id)!;
+        Object.assign(row, body);
+        return { data: row };
+      }),
+      delete: vi.fn(async (url: string) => {
+        const [, , , name, id] = url.split("/");
+        server.rows[name] = server.rows[name].filter((r) => r.id !== id);
+        return {};
+      }),
+    }),
+  };
+});
+
+import { queryClient } from "@/composables/query/queryClient";
+import {
+  deleteEvalEntityMutation,
+  evalJobsQuery,
+  saveEvalJobMutation,
+  saveProviderMutation,
+  saveScoreConfigMutation,
+  saveScorerMutation,
+  scoreConfigsQuery,
+  scorersQuery,
+  providersQuery,
+  setJobActiveMutation,
+} from "./online-evals.service.queries";
+
+const ORG = "acme";
+
+// Runs a declared write the way `useMutation` does, so the client's shared
+// `meta.invalidates` handling applies exactly as it does in the app.
+function write<TData, V>(options: MutationObserverOptions<TData, Error, V>, vars: V) {
+  return new MutationObserver(queryClient, options).mutate(vars);
+}
+
+beforeEach(() => {
+  server.rows = {
+    providers: [{ id: "providers-1", name: "openai" }],
+    scorers: [{ id: "scorers-1", name: "helpfulness" }],
+    score_configs: [{ id: "score_configs-1", name: "quality", healthyThreshold: 0.5 }],
+    eval_jobs: [{ id: "eval_jobs-1", name: "nightly", status: "draft" }],
+  };
+});
+
+describe("Evaluations list cache after a write", () => {
+  it("a scorer created from the form or an import is in the next scorers read", async () => {
+    expect(await queryClient.fetchQuery(scorersQuery(ORG))).toHaveLength(1);
+
+    await write(saveScorerMutation(ORG), { payload: { name: "faithfulness" } });
+
+    const rows = await queryClient.fetchQuery(scorersQuery(ORG));
+    expect(rows.map((r) => r.name)).toEqual(["helpfulness", "faithfulness"]);
+  });
+
+  it("a score config edit reaches the next score-config read", async () => {
+    await queryClient.fetchQuery(scoreConfigsQuery(ORG));
+
+    await write(saveScoreConfigMutation(ORG), {
+      id: "score_configs-1",
+      payload: { healthyThreshold: 0.8 },
+    });
+
+    const [config] = await queryClient.fetchQuery(scoreConfigsQuery(ORG));
+    expect(config.healthyThreshold).toBe(0.8);
+  });
+
+  it("a job created and activated from the form reads back as active", async () => {
+    await queryClient.fetchQuery(evalJobsQuery(ORG));
+
+    // The fake server stores whatever it is sent; only the name matters to the assertion.
+    const payload = { name: "hourly" } as unknown as EvalJobPayload;
+    const created = await write(saveEvalJobMutation(ORG), { payload });
+    await write(setJobActiveMutation(ORG), { id: created.id, active: true });
+
+    const rows = await queryClient.fetchQuery(evalJobsQuery(ORG));
+    expect(rows.find((r) => r.id === created.id)?.status).toBe("active");
+  });
+
+  it("a delete drops the row from the next read", async () => {
+    await queryClient.fetchQuery(scorersQuery(ORG));
+
+    await write(deleteEvalEntityMutation(ORG), { tab: "scorers", id: "scorers-1" });
+
+    expect(await queryClient.fetchQuery(scorersQuery(ORG))).toEqual([]);
+  });
+
+  it("a provider saved in Settings is in the providers list Playground and Evaluations read", async () => {
+    await queryClient.fetchQuery(providersQuery(ORG));
+
+    await write(
+      saveProviderMutation(
+        ORG,
+        () => false,
+        () => "",
+      ),
+      { name: "anthropic" },
+    );
+
+    const rows = await queryClient.fetchQuery(providersQuery(ORG));
+    expect(rows.map((r) => r.name)).toEqual(["openai", "anthropic"]);
+  });
+
+  it("an unchanged list is served from the cache, not refetched", async () => {
+    await queryClient.fetchQuery(scorersQuery(ORG));
+    server.rows.scorers.push({ id: "scorers-2", name: "written-behind-the-cache" });
+
+    expect(await queryClient.fetchQuery(scorersQuery(ORG))).toHaveLength(1);
+  });
+});
diff --git a/web/src/services/online-evals.service.queries.ts b/web/src/services/online-evals.service.queries.ts
index 0eb86abc95..1563090d99 100644
--- a/web/src/services/online-evals.service.queries.ts
+++ b/web/src/services/online-evals.service.queries.ts
@@ -15,6 +15,7 @@
 
 import { mutationOptions, queryOptions } from "@tanstack/vue-query";
 import onlineEvalsService, {
+  type EvalJobPayload,
   type QualityConfigSummary,
   type QualityListParams,
   type QualityScorePage,
@@ -134,6 +135,34 @@ export const deleteEvalEntityMutation = (org: string) =>
     meta: { invalidates: [onlineEvalKeys.all(org)], silentError: true },
   });
 
+/** Create when `id` is absent, else update; each form and import goes through one of these so no write skips the invalidation. */
+export const saveScorerMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (vars: { id?: string; payload: Record<string, any> }) =>
+      vars.id
+        ? onlineEvalsService.scorers.update(org, vars.id, vars.payload)
+        : onlineEvalsService.scorers.create(org, vars.payload),
+    meta: { invalidates: [onlineEvalKeys.all(org)], silentError: true },
+  });
+
+export const saveScoreConfigMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (vars: { id?: string; payload: Record<string, any> }) =>
+      vars.id
+        ? onlineEvalsService.scoreConfigs.update(org, vars.id, vars.payload)
+        : onlineEvalsService.scoreConfigs.create(org, vars.payload),
+    meta: { invalidates: [onlineEvalKeys.all(org)], silentError: true },
+  });
+
+export const saveEvalJobMutation = (org: string) =>
+  mutationOptions({
+    mutationFn: (vars: { id?: string; payload: EvalJobPayload }) =>
+      vars.id
+        ? onlineEvalsService.jobs.update(org, vars.id, vars.payload)
+        : onlineEvalsService.jobs.create(org, vars.payload),
+    meta: { invalidates: [onlineEvalKeys.all(org)], silentError: true },
+  });
+
 /** Drops the whole online-evals scope: scorers and jobs name their provider, so a rename or delete reaches them too. */
 export const saveProviderMutation = (org: string, isUpdate: () => boolean, id: () => string) =>
   mutationOptions({
diff --git a/web/src/services/online-evals.service.ts b/web/src/services/online-evals.service.ts
index f8acaf570d..a14c09c68c 100644
--- a/web/src/services/online-evals.service.ts
+++ b/web/src/services/online-evals.service.ts
@@ -398,13 +398,6 @@ const unwrapList = <T>(response: any, key = "list"): T[] => {
   return [];
 };
 
-// Score Configs change far less often than the pages that merely read them
-// get visited — a session-lived cache keyed by org avoids re-fetching the
-// whole list on every page mount. Callers that just mutated a config (create,
-// update, delete) must keep using `scoreConfigs.list` directly for
-// guaranteed-fresh data; this cache is for read-only consumers only.
-const scoreConfigsCache = new Map<string, Promise<ScoreConfig[]>>();
-
 const onlineEvalsService = {
   providers: {
     list: async (orgId: string): Promise<Provider[]> =>
@@ -436,18 +429,6 @@ const onlineEvalsService = {
   scoreConfigs: {
     list: async (orgId: string): Promise<ScoreConfig[]> =>
       unwrapList<ScoreConfig>(await http().get(`/api/${orgId}/score_configs`)),
-    // Read-only, cached-per-org variant of `list` — for pages that only need
-    // Score Configs as reference data (e.g. looking up a scorer's configured
-    // healthy value) and would otherwise refetch the whole list on every visit.
-    listCached: async (orgId: string): Promise<ScoreConfig[]> => {
-      let pending = scoreConfigsCache.get(orgId);
-      if (!pending) {
-        pending = onlineEvalsService.scoreConfigs.list(orgId);
-        pending.catch(() => scoreConfigsCache.delete(orgId));
-        scoreConfigsCache.set(orgId, pending);
-      }
-      return pending;
-    },
     create: async (orgId: string, payload: Record<string, any>): Promise<ScoreConfig> =>
       (await http().post(`/api/${orgId}/score_configs`, payload)).data,
     update: async (
diff --git a/web/src/services/sessions.ts b/web/src/services/sessions.ts
index 83737cf775..7f548480e9 100644
--- a/web/src/services/sessions.ts
+++ b/web/src/services/sessions.ts
@@ -48,6 +48,10 @@ export interface SessionApiHit {
   gen_ai_usage_cost_estimated_without_cache?: number;
   gen_ai_usage_cost_cache_read_savings?: number;
   gen_ai_usage_cost_net_cache_impact?: number;
+  /** Tokens on spans whose model has no price (absent on servers without the unpriced marker). */
+  gen_ai_unpriced_tokens?: number;
+  /** Models of those unpriced spans. */
+  gen_ai_unpriced_models?: string[];
   /** Number of error spans across all traces in this session. */
   error_count: number;
   user_ids?: string[];
diff --git a/web/src/services/workflows.queries.spec.ts b/web/src/services/workflows.queries.spec.ts
new file mode 100644
index 0000000000..8e07ecdd54
--- /dev/null
+++ b/web/src/services/workflows.queries.spec.ts
@@ -0,0 +1,210 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { queryClient } from "@/composables/query/queryClient";
+import { NORMAL_STALE_TIME } from "@/composables/query/cachePolicy";
+import http from "@/services/http";
+import * as declarations from "./workflows.queries";
+import {
+  deleteHttpTriggerMutation,
+  putHttpTriggerMutation,
+  revealHttpCredentialSecretMutation,
+  revokeHttpCredentialMutation,
+  rotateHttpCredentialMutation,
+  workflowHttpTriggerQuery,
+} from "./workflows.queries";
+import { workflowKeys } from "./workflows.querykeys";
+
+vi.mock("@/services/product_analytics", () => ({ default: { track: vi.fn() } }));
+vi.mock("@/services/http", () => ({ default: vi.fn() }));
+
+const org = "acme";
+const id = "wf1";
+const permissions = { edit: true, test: true, reveal: true };
+
+const runMutation = async (options: any, variables: unknown) => {
+  const mutation = queryClient.getMutationCache().build(queryClient, options);
+  return mutation.execute(variables);
+};
+
+const invalidatedKeys = (spy: ReturnType<typeof vi.spyOn>) =>
+  spy.mock.calls.map(([filters]: any[]) => filters?.queryKey);
+
+describe("workflow HTTP endpoint declarations", () => {
+  let api: Record<"get" | "post" | "put" | "delete", ReturnType<typeof vi.fn>>;
+
+  beforeEach(() => {
+    api = { get: vi.fn(), post: vi.fn(), put: vi.fn(), delete: vi.fn() };
+    (http as any).mockReturnValue(api);
+  });
+
+  afterEach(() => {
+    vi.restoreAllMocks();
+  });
+
+  it("workflowHttpTriggerQuery is keyed under workflowKeys.all", () => {
+    const options = workflowHttpTriggerQuery(org, id);
+
+    expect(options.queryKey.slice(0, workflowKeys.all(org).length)).toEqual([
+      ...workflowKeys.all(org),
+    ]);
+    expect(options.queryKey).toEqual(workflowKeys.httpTrigger(org, id));
+    expect(options.staleTime).toBe(NORMAL_STALE_TIME);
+  });
+
+  it("refetches on every mount, so a reopened panel never shows an old last call", () => {
+    expect(workflowHttpTriggerQuery(org, id).refetchOnMount).toBe("always");
+  });
+
+  it("is enabled only when org and id are set", () => {
+    expect(workflowHttpTriggerQuery("", id).enabled).toBe(false);
+    expect(workflowHttpTriggerQuery(org, "").enabled).toBe(false);
+    expect(workflowHttpTriggerQuery(org, id).enabled).toBe(true);
+  });
+
+  it("a 404 not_configured resolves to configured:false", async () => {
+    api.get.mockRejectedValue({
+      response: {
+        status: 404,
+        data: {
+          error_detail: "not_configured",
+          permissions,
+          org_rate_limit_per_minute: 600,
+          secrets_encrypted_at_rest: true,
+        },
+      },
+    });
+
+    await expect(queryClient.fetchQuery(workflowHttpTriggerQuery(org, id))).resolves.toEqual({
+      configured: false,
+      permissions,
+      org_rate_limit_per_minute: 600,
+      secrets_encrypted_at_rest: true,
+    });
+  });
+
+  it("a remount within the tier makes 0 calls", async () => {
+    api.get.mockResolvedValue({ data: { id: "t1", permissions } });
+
+    await queryClient.fetchQuery(workflowHttpTriggerQuery(org, id));
+    await queryClient.fetchQuery(workflowHttpTriggerQuery(org, id));
+
+    expect(api.get).toHaveBeenCalledTimes(1);
+  });
+
+  it("putHttpTrigger invalidates the trigger and the list", async () => {
+    api.put.mockResolvedValue({ data: { id: "t1", secret: null } });
+    const spy = vi.spyOn(queryClient, "invalidateQueries");
+
+    await runMutation(putHttpTriggerMutation(org, id), { enabled: true, auth_mode: "token" });
+
+    expect(invalidatedKeys(spy)).toEqual(
+      expect.arrayContaining([workflowKeys.httpTrigger(org, id), workflowKeys.list(org)]),
+    );
+  });
+
+  it("putHttpTrigger also expires every folder and search list the list page reads", async () => {
+    api.put.mockResolvedValue({ data: { id: "t1", secret: null } });
+    const spy = vi.spyOn(queryClient, "invalidateQueries");
+
+    await runMutation(putHttpTriggerMutation(org, id), { enabled: false, auth_mode: "token" });
+
+    expect(invalidatedKeys(spy)).toEqual(
+      expect.arrayContaining([workflowKeys.folders(org), workflowKeys.searches(org)]),
+    );
+    expect(workflowKeys.folder(org, "f1").slice(0, 4)).toEqual([...workflowKeys.folders(org)]);
+    expect(workflowKeys.search(org, "x").slice(0, 4)).toEqual([...workflowKeys.searches(org)]);
+  });
+
+  it("deleteHttpTrigger invalidates the trigger and the list", async () => {
+    api.delete.mockResolvedValue({ data: null });
+    const spy = vi.spyOn(queryClient, "invalidateQueries");
+
+    await runMutation(deleteHttpTriggerMutation(org, id), undefined);
+
+    expect(api.delete).toHaveBeenCalledWith("/api/acme/workflows/wf1/http_trigger");
+    expect(invalidatedKeys(spy)).toEqual(
+      expect.arrayContaining([workflowKeys.httpTrigger(org, id), workflowKeys.list(org)]),
+    );
+  });
+
+  it("rotate and revoke invalidate only the trigger", () => {
+    expect(rotateHttpCredentialMutation(org, id).meta?.invalidates).toEqual([
+      workflowKeys.httpTrigger(org, id),
+    ]);
+    expect(revokeHttpCredentialMutation(org, id).meta?.invalidates).toEqual([
+      workflowKeys.httpTrigger(org, id),
+    ]);
+  });
+
+  it("declares no HTTP trigger test mutation; the Test dialog runs /workflows/test", () => {
+    expect(Object.keys(declarations)).not.toContain("testHttpTriggerMutation");
+  });
+
+  it("the writes the section renders a failure for are silent", () => {
+    for (const options of [
+      putHttpTriggerMutation(org, id),
+      deleteHttpTriggerMutation(org, id),
+      rotateHttpCredentialMutation(org, id),
+      revokeHttpCredentialMutation(org, id),
+      revealHttpCredentialSecretMutation(org, id),
+    ]) {
+      expect(options.meta?.silentError).toBe(true);
+    }
+  });
+
+  it("reveal is a mutation with no persister and no invalidation", async () => {
+    api.get.mockResolvedValue({ data: { id: "c1", secret: "o2wh_value" } });
+    const options = revealHttpCredentialSecretMutation(org, id);
+    const spy = vi.spyOn(queryClient, "invalidateQueries");
+
+    await expect(runMutation(options, { credential_id: "c1" })).resolves.toEqual({
+      id: "c1",
+      secret: "o2wh_value",
+    });
+
+    expect(options.meta?.invalidates).toBeUndefined();
+    expect(options).not.toHaveProperty("persister");
+    expect(spy).not.toHaveBeenCalled();
+    expect(Object.keys(declarations).filter((name) => /reveal/i.test(name))).toEqual([
+      "revealHttpCredentialSecretMutation",
+    ]);
+  });
+
+  it("no HTTP endpoint declaration has a persister", () => {
+    for (const options of [
+      workflowHttpTriggerQuery(org, id),
+      putHttpTriggerMutation(org, id),
+      deleteHttpTriggerMutation(org, id),
+      rotateHttpCredentialMutation(org, id),
+      revokeHttpCredentialMutation(org, id),
+      revealHttpCredentialSecretMutation(org, id),
+    ]) {
+      expect(options).not.toHaveProperty("persister");
+      expect(options).not.toHaveProperty("gcTime");
+    }
+  });
+
+  it("every new key starts with the org root", () => {
+    for (const key of [
+      workflowKeys.httpTrigger(org, id),
+      workflowKeys.folders(org),
+      workflowKeys.searches(org),
+    ]) {
+      expect(key.slice(0, 3)).toEqual(["org", org, "workflows"]);
+    }
+  });
+});
diff --git a/web/src/services/workflows.queries.ts b/web/src/services/workflows.queries.ts
index 620aa09836..9788e02e6e 100644
--- a/web/src/services/workflows.queries.ts
+++ b/web/src/services/workflows.queries.ts
@@ -13,8 +13,12 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { queryOptions } from "@tanstack/vue-query";
-import workflows from "./workflows";
+import { mutationOptions, queryOptions } from "@tanstack/vue-query";
+import workflows, {
+  type HttpTriggerState,
+  type OverlapSeconds,
+  type PutHttpTriggerPayload,
+} from "./workflows";
 import { workflowKeys } from "./workflows.querykeys";
 import { NORMAL_STALE_TIME } from "@/composables/query/cachePolicy";
 import { quantizeRange } from "@/composables/query/queryClient";
@@ -70,3 +74,68 @@ export const workflowRunsQuery = (
     staleTime: NORMAL_STALE_TIME,
   });
 };
+
+export const workflowHttpTriggerQuery = (org: string, id: string) =>
+  queryOptions<HttpTriggerState>({
+    queryKey: workflowKeys.httpTrigger(org, id),
+    queryFn: () => workflows.getHttpTrigger({ org_identifier: org, id }),
+    staleTime: NORMAL_STALE_TIME,
+    // Last call, Last used and rejections change while the panel is closed.
+    refetchOnMount: "always",
+    enabled: !!org && !!id,
+  });
+
+/** Secret-bearing writes share this key, so a reader can drop their settled entries from the MutationCache. */
+export const httpTriggerSecretMutationKey = (org: string, id: string) =>
+  [...workflowKeys.httpTrigger(org, id), "secret"] as const;
+
+// The list page reads the folder and search lists, not `list`, so all three carry the endpoint flag.
+const listScopes = (org: string) => [
+  workflowKeys.list(org),
+  workflowKeys.folders(org),
+  workflowKeys.searches(org),
+];
+
+export const putHttpTriggerMutation = (org: string, id: string) =>
+  mutationOptions({
+    mutationKey: httpTriggerSecretMutationKey(org, id),
+    mutationFn: (payload: PutHttpTriggerPayload) =>
+      workflows.putHttpTrigger({ org_identifier: org, id, payload }),
+    meta: {
+      invalidates: [workflowKeys.httpTrigger(org, id), ...listScopes(org)],
+      silentError: true,
+    },
+  });
+
+export const deleteHttpTriggerMutation = (org: string, id: string) =>
+  mutationOptions({
+    mutationFn: () => workflows.deleteHttpTrigger({ org_identifier: org, id }),
+    meta: {
+      invalidates: [workflowKeys.httpTrigger(org, id), ...listScopes(org)],
+      silentError: true,
+    },
+  });
+
+export const rotateHttpCredentialMutation = (org: string, id: string) =>
+  mutationOptions({
+    mutationKey: httpTriggerSecretMutationKey(org, id),
+    mutationFn: (vars: { overlap_seconds: OverlapSeconds }) =>
+      workflows.rotateHttpCredential({ org_identifier: org, id, ...vars }),
+    meta: { invalidates: [workflowKeys.httpTrigger(org, id)], silentError: true },
+  });
+
+export const revokeHttpCredentialMutation = (org: string, id: string) =>
+  mutationOptions({
+    mutationFn: (vars: { credential_id: string }) =>
+      workflows.revokeHttpCredential({ org_identifier: org, id, ...vars }),
+    meta: { invalidates: [workflowKeys.httpTrigger(org, id)], silentError: true },
+  });
+
+// No meta.invalidates, no persister; the composable reads the value and calls reset() at once (AC-WEB-10).
+export const revealHttpCredentialSecretMutation = (org: string, id: string) =>
+  mutationOptions({
+    mutationKey: httpTriggerSecretMutationKey(org, id),
+    mutationFn: (vars: { credential_id: string }) =>
+      workflows.revealHttpCredentialSecret({ org_identifier: org, id, ...vars }),
+    meta: { silentError: true },
+  });
diff --git a/web/src/services/workflows.querykeys.ts b/web/src/services/workflows.querykeys.ts
index 1c7cd5c26d..068547b450 100644
--- a/web/src/services/workflows.querykeys.ts
+++ b/web/src/services/workflows.querykeys.ts
@@ -25,9 +25,12 @@ import { orgKey } from "@/composables/query/keys";
 export const workflowKeys = {
   all: (org: string) => orgKey(org, "workflows"),
   list: (org: string) => orgKey(org, "workflows", "list"),
+  folders: (org: string) => orgKey(org, "workflows", "folder"),
   folder: (org: string, folderId: string) => orgKey(org, "workflows", "folder", folderId),
+  searches: (org: string) => orgKey(org, "workflows", "search"),
   search: (org: string, term: string) => orgKey(org, "workflows", "search", term),
   runsOf: (org: string, workflowId: string) => orgKey(org, "workflows", "runs", workflowId),
   runs: (org: string, workflowId: string, start: number, end: number) =>
     orgKey(org, "workflows", "runs", workflowId, `${start}-${end}`),
+  httpTrigger: (org: string, id: string) => orgKey(org, "workflows", "httpTrigger", id),
 };
diff --git a/web/src/services/workflows.spec.ts b/web/src/services/workflows.spec.ts
index dd9501d849..801488180d 100644
--- a/web/src/services/workflows.spec.ts
+++ b/web/src/services/workflows.spec.ts
@@ -13,8 +13,8 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { describe, expect, it, beforeEach, vi } from "vitest";
-import workflows from "@/services/workflows";
+import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
+import workflows, { dryRunHook } from "@/services/workflows";
 import http from "@/services/http";
 import analytics from "@/services/product_analytics";
 
@@ -706,16 +706,22 @@ describe("workflows service", () => {
   });
 
   describe("service surface", () => {
-    it("exposes exactly the 10 workflow endpoints", () => {
+    it("exposes exactly the 17 workflow endpoints", () => {
       expect(Object.keys(workflows).sort()).toEqual([
         "createWorkflow",
+        "deleteHttpTrigger",
         "deleteWorkflow",
         "enableWorkflow",
+        "getHttpTrigger",
         "getWorkflowHistory",
         "getWorkflowRun",
         "listWorkflows",
         "promoteWorkflow",
+        "putHttpTrigger",
         "retryWorkflow",
+        "revealHttpCredentialSecret",
+        "revokeHttpCredential",
+        "rotateHttpCredential",
         "testWorkflow",
         "updateWorkflow",
       ]);
@@ -817,3 +823,216 @@ describe("workflows service", () => {
     });
   });
 });
+
+describe("workflows HTTP endpoint transport", () => {
+  let api: Record<"get" | "post" | "put" | "patch" | "delete", ReturnType<typeof vi.fn>>;
+  const target = { org_identifier: "acme", id: "wf1" };
+  const permissions = { edit: true, test: true, reveal: false };
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    api = { get: vi.fn(), post: vi.fn(), put: vi.fn(), patch: vi.fn(), delete: vi.fn() };
+    (http as any).mockReturnValue(api);
+  });
+
+  afterEach(() => {
+    vi.unstubAllGlobals();
+    vi.restoreAllMocks();
+  });
+
+  it("calls the http_trigger routes with the right verbs and paths", async () => {
+    api.get.mockResolvedValue({ data: { id: "t1" } });
+    api.put.mockResolvedValue({ data: { id: "t1", secret: "o2wh_x" } });
+    api.delete.mockResolvedValue({ data: null });
+    api.post.mockResolvedValue({ data: { id: "c2", secret: "o2wh_y" } });
+
+    await workflows.getHttpTrigger(target);
+    await workflows.putHttpTrigger({ ...target, payload: { enabled: true, auth_mode: "token" } });
+    await workflows.deleteHttpTrigger(target);
+    await workflows.rotateHttpCredential({ ...target, overlap_seconds: 3600 });
+    await workflows.revokeHttpCredential({ ...target, credential_id: "c1" });
+    await workflows.revealHttpCredentialSecret({ ...target, credential_id: "c1" });
+
+    expect(api.get.mock.calls).toEqual([
+      ["/api/acme/workflows/wf1/http_trigger"],
+      ["/api/acme/workflows/wf1/http_trigger/credentials/c1/secret"],
+    ]);
+    expect(api.put.mock.calls).toEqual([
+      ["/api/acme/workflows/wf1/http_trigger", { enabled: true, auth_mode: "token" }],
+    ]);
+    expect(api.delete.mock.calls).toEqual([
+      ["/api/acme/workflows/wf1/http_trigger"],
+      ["/api/acme/workflows/wf1/http_trigger/credentials/c1"],
+    ]);
+    expect(api.post.mock.calls).toEqual([
+      ["/api/acme/workflows/wf1/http_trigger/credentials", { overlap_seconds: 3600 }],
+    ]);
+  });
+
+  it("unwraps a 200 body and marks it configured", async () => {
+    api.get.mockResolvedValue({ data: { id: "t1", enabled: true } });
+
+    await expect(workflows.getHttpTrigger(target)).resolves.toEqual({
+      id: "t1",
+      enabled: true,
+      configured: true,
+    });
+  });
+
+  it("a 404 not_configured resolves to configured:false with what the caller may do", async () => {
+    api.get.mockRejectedValue({
+      response: {
+        status: 404,
+        data: {
+          code: 404,
+          message: "No HTTP endpoint is configured for this workflow",
+          error_detail: "not_configured",
+          permissions,
+          org_rate_limit_per_minute: 1200,
+          secrets_encrypted_at_rest: false,
+        },
+      },
+    });
+
+    await expect(workflows.getHttpTrigger(target)).resolves.toEqual({
+      configured: false,
+      permissions,
+      org_rate_limit_per_minute: 1200,
+      secrets_encrypted_at_rest: false,
+    });
+  });
+
+  it("any other 404 still rejects", async () => {
+    const err = { response: { status: 404, data: { error_detail: "workflow_not_found" } } };
+    api.get.mockRejectedValue(err);
+
+    await expect(workflows.getHttpTrigger(target)).rejects.toBe(err);
+  });
+
+  it("putHttpTrigger keeps the flattened secret beside the config", async () => {
+    api.put.mockResolvedValue({ data: { id: "t1", enabled: true, secret: "o2wh_abc" } });
+
+    await expect(
+      workflows.putHttpTrigger({ ...target, payload: { enabled: true, auth_mode: "token" } }),
+    ).resolves.toEqual({ id: "t1", enabled: true, secret: "o2wh_abc", configured: true });
+  });
+
+  const jsonResponse = (status: number, body: unknown) =>
+    ({ status, text: async () => JSON.stringify(body) }) as unknown as Response;
+
+  it("dryRunHook uses fetch with credentials omitted, not the app client", async () => {
+    const input = { meta: { trigger_source: "http" }, data: [{ a: 1 }] };
+    const fetchMock = vi
+      .fn()
+      .mockResolvedValue(jsonResponse(200, { dry_run: true, accepted: true, input }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    const result = await dryRunHook({
+      url: "https://o2.example.com/api/v2/acme/workflows/hooks/t1",
+      token: "o2wh_secret",
+      body: '{"a":1}',
+      contentType: "application/json",
+    });
+
+    expect(http).not.toHaveBeenCalled();
+    expect(fetchMock).toHaveBeenCalledTimes(1);
+    const [url, init] = fetchMock.mock.calls[0];
+    expect(url).toBe("https://o2.example.com/api/v2/acme/workflows/hooks/t1?dry_run=true");
+    expect(init).toMatchObject({ method: "POST", credentials: "omit", body: '{"a":1}' });
+    expect(init.headers).toEqual({
+      "Content-Type": "application/json",
+      Authorization: "Bearer o2wh_secret",
+    });
+    expect(result).toEqual({ status: 200, reason: null, input, bodyBytes: 7 });
+  });
+
+  it("a 401 from dryRunHook does not dispatch logout", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi
+        .fn()
+        .mockResolvedValue(
+          jsonResponse(401, { code: 401, message: "Unauthorized", error_detail: "unauthorized" }),
+        ),
+    );
+
+    const result = await dryRunHook({
+      url: "/api/v2/acme/workflows/hooks/t1",
+      token: "o2wh_wrong",
+      body: "{}",
+      contentType: "application/json",
+    });
+
+    expect(http).not.toHaveBeenCalled();
+    expect(result).toEqual({ status: 401, reason: "unauthorized", input: null, bodyBytes: 2 });
+  });
+
+  it("dryRunHook maps a refusal reason and counts the body in bytes", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue(jsonResponse(403, { error_detail: "workflow_not_published" })),
+    );
+
+    const result = await dryRunHook({
+      url: "/h",
+      token: "o2wh_t",
+      body: '{"name":"é"}',
+      contentType: "application/json",
+    });
+
+    expect(result).toEqual({
+      status: 403,
+      reason: "workflow_not_published",
+      input: null,
+      bodyBytes: 13,
+    });
+  });
+
+  it("dryRunHook leaves an unknown reason or a non-JSON body as no reason", async () => {
+    vi.stubGlobal(
+      "fetch",
+      vi.fn().mockResolvedValue({ status: 502, text: async () => "<html>bad gateway</html>" }),
+    );
+
+    const result = await dryRunHook({
+      url: "/h",
+      token: "o2wh_t",
+      body: "{}",
+      contentType: "application/json",
+    });
+
+    expect(result).toEqual({ status: 502, reason: null, input: null, bodyBytes: 2 });
+  });
+
+  it("dryRunHook appends the dry-run flag to a URL that already has a query", async () => {
+    const fetchMock = vi.fn().mockResolvedValue(jsonResponse(200, { input: null }));
+    vi.stubGlobal("fetch", fetchMock);
+
+    await dryRunHook({
+      url: "/h?env=prod",
+      token: "o2wh_t",
+      body: "{}",
+      contentType: "application/json",
+    });
+
+    expect(fetchMock.mock.calls[0][0]).toBe("/h?env=prod&dry_run=true");
+  });
+
+  it("dryRunHook never logs the token", async () => {
+    vi.stubGlobal("fetch", vi.fn().mockResolvedValue(jsonResponse(401, {})));
+    const spies = (["log", "info", "warn", "error", "debug"] as const).map((level) =>
+      vi.spyOn(console, level).mockImplementation(() => {}),
+    );
+
+    await dryRunHook({
+      url: "/h",
+      token: "o2wh_never_logged",
+      body: "{}",
+      contentType: "application/json",
+    });
+
+    for (const spy of spies) {
+      expect(JSON.stringify(spy.mock.calls)).not.toContain("o2wh_never_logged");
+    }
+  });
+});
diff --git a/web/src/services/workflows.ts b/web/src/services/workflows.ts
index 2178b69043..9700a19a7a 100644
--- a/web/src/services/workflows.ts
+++ b/web/src/services/workflows.ts
@@ -16,6 +16,240 @@
 import http from "./http";
 import analytics from "./product_analytics";
 
+// HTTP endpoint shapes mirror src/core/src/workflows/http_trigger/manage.rs and request/workflows/{http_trigger,mod}.rs.
+export type HttpAuthMode = "token" | "signature";
+export type HttpCredentialKind = "token" | "signing_secret";
+export type HttpCredentialState = "active" | "retiring" | "revoked";
+export type HookRunStatus = "queued" | "running" | "succeeded" | "failed" | "expired";
+export type HookReasonCode =
+  | "invalid_token"
+  | "invalid_signature"
+  | "stale_timestamp"
+  | "credential_in_url"
+  | "endpoint_disabled"
+  | "workflow_disabled"
+  | "workflow_not_published"
+  | "payload_too_large"
+  | "invalid_idempotency_key"
+  | "idempotency_key_reused"
+  | "rate_limited"
+  | "queue_full"
+  | "worker_unavailable";
+
+export interface HttpTriggerPermissions {
+  edit: boolean;
+  test: boolean;
+  /** PUT on the workflow and credential access (Admin/Root when OpenFGA is off). */
+  reveal: boolean;
+}
+
+/** Times are Unix microseconds. */
+export interface HttpCredential {
+  id: string;
+  kind: HttpCredentialKind;
+  display_prefix: string;
+  state: HttpCredentialState;
+  expires_at: number | null;
+  created_by: string;
+  creator_in_org: boolean;
+  created_at: number;
+  last_used_at: number | null;
+}
+
+export interface HttpRejection {
+  count_24h: number;
+  last_at: number;
+  last_ip: string;
+  window_start: number;
+}
+
+export interface HttpLastCall {
+  run_id: string;
+  status: HookRunStatus;
+  received_at: number;
+}
+
+export interface HttpTriggerConfig {
+  configured: true;
+  id: string;
+  url: string;
+  region_host: string | null;
+  enabled: boolean;
+  auth_mode: HttpAuthMode;
+  max_body_bytes: number;
+  rate_limit_per_minute: number;
+  org_rate_limit_per_minute: number;
+  created_by: string;
+  created_at: number;
+  updated_at: number;
+  last_invoked_at: number | null;
+  last_call: HttpLastCall | null;
+  secrets_encrypted_at_rest: boolean;
+  rejections: Partial<Record<HookReasonCode, HttpRejection>>;
+  credentials: HttpCredential[];
+  permissions: HttpTriggerPermissions;
+}
+
+export interface HttpTriggerAbsent {
+  configured: false;
+  org_rate_limit_per_minute: number;
+  secrets_encrypted_at_rest: boolean;
+  permissions: HttpTriggerPermissions;
+}
+
+export type HttpTriggerState = HttpTriggerConfig | HttpTriggerAbsent;
+
+export interface PutHttpTriggerPayload {
+  enabled: boolean;
+  auth_mode: HttpAuthMode;
+  max_body_bytes?: number;
+  rate_limit_per_minute?: number;
+}
+
+/** The server flattens `SecretResponse` (`#[serde(flatten)]`), so the secret sits beside the body. */
+export type WithSecret<T> = T & { secret: string | null };
+
+export interface HttpCredentialSecret {
+  id: string;
+  kind: HttpCredentialKind;
+  display_prefix: string;
+  state: HttpCredentialState;
+  expires_at: number | null;
+  secret: string;
+}
+
+export interface HttpRequestFacts {
+  credential_prefix: string;
+  caller_ip: string;
+  idempotency_key: string | null;
+  content_type: string | null;
+  body_bytes: number;
+  status: HookRunStatus;
+  error: string | null;
+}
+
+/** One history row; `status` is normalised by the server, `error` is display text only. */
+export interface WorkflowHistoryRow {
+  _timestamp: number;
+  org: string;
+  start_time: number;
+  end_time: number;
+  evaluation_took_in_secs: number;
+  source_node: string;
+  key: string;
+  error: string | null;
+  /** `WorkflowTriggerType` name: AlertFired, IncidentEvent, Webhook, Manual, Test, Retry, … */
+  event_type: string;
+  source_id: string;
+  run_id: string;
+  status: HookRunStatus;
+  http_request?: HttpRequestFacts;
+}
+
+/** The list API's per-row endpoint flag; false whenever hooks are off on the server. */
+export interface WorkflowListHttpFields {
+  http_endpoint_enabled?: boolean;
+}
+
+export interface DryRunResult {
+  status: number;
+  reason: HookReasonCode | "unauthorized" | null;
+  input: { meta: Record<string, unknown>; data: unknown[] } | null;
+  bodyBytes: number;
+}
+
+export type OverlapSeconds = 0 | 3600 | 86400 | 604800;
+
+export interface HttpTriggerRef {
+  org_identifier: string;
+  id: string;
+}
+
+export interface WorkflowHttpTriggerApi {
+  getHttpTrigger(args: HttpTriggerRef): Promise<HttpTriggerState>;
+  putHttpTrigger(
+    args: HttpTriggerRef & { payload: PutHttpTriggerPayload },
+  ): Promise<WithSecret<HttpTriggerConfig>>;
+  deleteHttpTrigger(args: HttpTriggerRef): Promise<void>;
+  rotateHttpCredential(
+    args: HttpTriggerRef & { overlap_seconds: OverlapSeconds },
+  ): Promise<WithSecret<HttpCredential>>;
+  revokeHttpCredential(args: HttpTriggerRef & { credential_id: string }): Promise<void>;
+  revealHttpCredentialSecret(
+    args: HttpTriggerRef & { credential_id: string },
+  ): Promise<HttpCredentialSecret>;
+}
+
+const HOOK_REASON_CODES: ReadonlySet<string> = new Set<HookReasonCode | "unauthorized">([
+  "unauthorized",
+  "invalid_token",
+  "invalid_signature",
+  "stale_timestamp",
+  "credential_in_url",
+  "endpoint_disabled",
+  "workflow_disabled",
+  "workflow_not_published",
+  "payload_too_large",
+  "invalid_idempotency_key",
+  "idempotency_key_reused",
+  "rate_limited",
+  "queue_full",
+  "worker_unavailable",
+]);
+
+const triggerUrl = ({ org_identifier, id }: HttpTriggerRef) =>
+  `/api/${org_identifier}/workflows/${id}/http_trigger`;
+
+const asRecord = (value: unknown): Record<string, unknown> | null =>
+  value !== null && typeof value === "object" ? (value as Record<string, unknown>) : null;
+
+// The 404 body still carries what the caller may do, so the off state can render without a second read.
+const notConfigured = (err: unknown): HttpTriggerAbsent | null => {
+  const response = asRecord(asRecord(err)?.response);
+  const data = asRecord(response?.data);
+  if (response?.status !== 404 || data?.error_detail !== "not_configured") return null;
+  return {
+    configured: false,
+    permissions: data.permissions as HttpTriggerPermissions,
+    org_rate_limit_per_minute: data.org_rate_limit_per_minute as number,
+    secrets_encrypted_at_rest: data.secrets_encrypted_at_rest as boolean,
+  };
+};
+
+const httpTriggerApi: WorkflowHttpTriggerApi = {
+  // A 200 body is `TriggerView`, which has no `configured` field of its own.
+  getHttpTrigger: async (target) => {
+    try {
+      const res = await http().get(triggerUrl(target));
+      return { ...res.data, configured: true };
+    } catch (err) {
+      const absent = notConfigured(err);
+      if (absent) return absent;
+      throw err;
+    }
+  },
+
+  putHttpTrigger: async ({ payload, ...target }) => {
+    const res = await http().put(triggerUrl(target), payload);
+    return { ...res.data, configured: true };
+  },
+
+  deleteHttpTrigger: async (target) => {
+    await http().delete(triggerUrl(target));
+  },
+
+  rotateHttpCredential: async ({ overlap_seconds, ...target }) =>
+    (await http().post(`${triggerUrl(target)}/credentials`, { overlap_seconds })).data,
+
+  revokeHttpCredential: async ({ credential_id, ...target }) => {
+    await http().delete(`${triggerUrl(target)}/credentials/${credential_id}`);
+  },
+
+  // Sent with `Cache-Control: no-store`; callers read it once and drop it (AC-WEB-10).
+  revealHttpCredentialSecret: async ({ credential_id, ...target }) =>
+    (await http().get(`${triggerUrl(target)}/credentials/${credential_id}/secret`)).data,
+};
+
 const workflows = {
   // List the org's workflows in one folder. Omitting `folder` lets the backend
   // fall back to the default folder, which is what pre-folders clients sent.
@@ -233,6 +467,44 @@ const workflows = {
         return res;
       });
   },
+
+  ...httpTriggerApi,
 };
 
+/** Calls the public hook URL with `dry_run=true`; plain fetch, so a 401/403 never reaches the app client's logout, refresh or 403 toast. */
+export async function dryRunHook(args: {
+  url: string;
+  token: string;
+  body: string;
+  contentType: string;
+}): Promise<DryRunResult> {
+  const res = await fetch(`${args.url}${args.url.includes("?") ? "&" : "?"}dry_run=true`, {
+    method: "POST",
+    headers: { "Content-Type": args.contentType, Authorization: `Bearer ${args.token}` },
+    body: args.body,
+    credentials: "omit",
+  });
+  let parsed: Record<string, unknown> | null = null;
+  try {
+    parsed = asRecord(JSON.parse(await res.text()));
+  } catch {
+    parsed = null;
+  }
+  const ok = res.status >= 200 && res.status < 300;
+  const detail = parsed?.error_detail;
+  const input = asRecord(parsed?.input);
+  return {
+    status: res.status,
+    reason:
+      !ok && typeof detail === "string" && HOOK_REASON_CODES.has(detail)
+        ? (detail as DryRunResult["reason"])
+        : null,
+    input:
+      ok && input && Array.isArray(input.data)
+        ? { meta: asRecord(input.meta) ?? {}, data: input.data }
+        : null,
+    bodyBytes: new TextEncoder().encode(args.body).length,
+  };
+}
+
 export default workflows;
diff --git a/web/src/test/unit/helpers/workflowHttp.ts b/web/src/test/unit/helpers/workflowHttp.ts
new file mode 100644
index 0000000000..d8de1bb8c6
--- /dev/null
+++ b/web/src/test/unit/helpers/workflowHttp.ts
@@ -0,0 +1,127 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { nextTick } from "vue";
+import type {
+  HttpCredential,
+  HttpTriggerAbsent,
+  HttpTriggerConfig,
+  HttpTriggerPermissions,
+} from "@/services/workflows";
+
+export const HTTP_TOKEN = "o2wh_FRESHLYMINTEDTOKENVALUE0000001";
+export const HTTP_SECRET = "whsec_FRESHLYMINTEDSECRETVALUE00001";
+export const HTTP_ROW_VALUE = "o2wh_ROWVALUEREVEALEDFROMTHETABLE01";
+export const HOUR_US = 3_600_000_000;
+
+export const fullPermissions = (): HttpTriggerPermissions => ({
+  edit: true,
+  test: true,
+  reveal: true,
+});
+
+export const httpCredential = (over: Partial<HttpCredential> = {}): HttpCredential => ({
+  id: "c1",
+  kind: "token",
+  display_prefix: "o2wh_4fK9…oI4k",
+  state: "active",
+  expires_at: null,
+  created_by: "a@example.com",
+  creator_in_org: true,
+  created_at: 1_792_575_542_000_000,
+  last_used_at: null,
+  ...over,
+});
+
+export const httpConfig = (over: Partial<HttpTriggerConfig> = {}): HttpTriggerConfig => ({
+  configured: true,
+  id: "t1",
+  url: "https://o2.example.com/api/v2/default/workflows/hooks/t1",
+  region_host: null,
+  enabled: true,
+  auth_mode: "token",
+  max_body_bytes: 1_048_576,
+  rate_limit_per_minute: 60,
+  org_rate_limit_per_minute: 1200,
+  created_by: "a@example.com",
+  created_at: 1,
+  updated_at: 1,
+  last_invoked_at: null,
+  last_call: null,
+  secrets_encrypted_at_rest: true,
+  rejections: {},
+  credentials: [httpCredential()],
+  permissions: fullPermissions(),
+  ...over,
+});
+
+export const httpAbsent = (over: Partial<HttpTriggerAbsent> = {}): HttpTriggerAbsent => ({
+  configured: false,
+  org_rate_limit_per_minute: 1200,
+  secrets_encrypted_at_rest: true,
+  permissions: fullPermissions(),
+  ...over,
+});
+
+/** Renders the trigger and, while open, the content in place; a trigger click asks to toggle. */
+export const OPopoverStub = {
+  name: "OPopover",
+  props: ["open", "side", "align", "ariaLabel", "contentClass"],
+  emits: ["update:open"],
+  template: `<div class="o-popover-stub">
+    <span class="o-popover-trigger" @click="$emit('update:open', !open)"><slot name="trigger" /></span>
+    <div v-if="open" class="o-popover-content"><slot /></div>
+  </div>`,
+};
+
+export const OSwitchStub = {
+  name: "OSwitch",
+  props: ["modelValue", "label", "disabled", "size"],
+  emits: ["update:modelValue"],
+  template: `<button class="o-switch" v-bind="$attrs" :disabled="disabled" :data-value="String(!!modelValue)"
+    @click="$emit('update:modelValue', !modelValue)" />`,
+};
+
+export const ODrawerStub = {
+  name: "ODrawer",
+  props: ["open", "size", "title", "subTitle", "side", "persistent"],
+  emits: ["update:open"],
+  template: `<div class="o-drawer" v-bind="$attrs" :data-open="String(open)">
+    <button class="o-drawer-close" @click="$emit('update:open', false)" />
+    <slot v-if="open" />
+  </div>`,
+};
+
+export const RouterLinkStub = {
+  name: "RouterLink",
+  props: ["to"],
+  template: `<a class="router-link" :data-to="JSON.stringify(to)"><slot /></a>`,
+};
+
+/** Hover the element the way an entering pointer does, then wait past the tooltip's 700 ms open delay. */
+export const hoverAndWait = async (el: Element) => {
+  el.dispatchEvent(new MouseEvent("mouseenter"));
+  el.dispatchEvent(new MouseEvent("pointermove", { bubbles: true }));
+  await new Promise((r) => setTimeout(r, 800));
+  await nextTick();
+};
+
+/** The real tooltip mounts its bubble only on hover; the stub keeps it in the DOM with its text. */
+export const OTooltipStub = {
+  name: "OTooltip",
+  props: ["content", "side", "align", "maxWidth"],
+  inheritAttrs: false,
+  template: `<span class="o-tooltip-stub" v-bind="$attrs" :data-content="content"><slot /></span>`,
+};
diff --git a/web/src/test/unit/mockData/traces.ts b/web/src/test/unit/mockData/traces.ts
index a1f99c0b6e..e92b183cb2 100644
--- a/web/src/test/unit/mockData/traces.ts
+++ b/web/src/test/unit/mockData/traces.ts
@@ -40,6 +40,8 @@ const treeSpan = (
 export const patternTraceTrees = {
   // Baseline: single root, root service calls one downstream service
   singleRoot: [treeSpan("a1", "scheduler", "", [treeSpan("q1", "querier", "a1", [], 80)], 100)],
+  // Root span with a measured duration of 0 calling a 10 ms downstream service
+  zeroDurationRoot: [treeSpan("a1", "scheduler", "", [treeSpan("q1", "querier", "a1", [], 10)], 0)],
   // Two root spans with distinct services, each with its own downstream call
   multiRootDistinctServices: [
     treeSpan("a1", "scheduler", "", [treeSpan("q1", "querier", "a1", [], 80)], 100),
@@ -62,6 +64,55 @@ export const patternTraceTrees = {
   ],
   // Single root span, single service, no relationships at all
   singleServiceOnly: [treeSpan("a1", "scheduler", "", [], 100)],
+  // Two callers reach the same intermediate service, which calls the same leaf on each branch
+  sharedLeafTwoBranches: [
+    treeSpan(
+      "f1",
+      "frontend",
+      "",
+      [
+        treeSpan("m1", "catalog-rpc", "f1", [treeSpan("l1", "product-catalog", "m1", [], 3)], 8),
+        treeSpan(
+          "c1",
+          "checkout",
+          "f1",
+          [
+            treeSpan(
+              "m2",
+              "catalog-rpc",
+              "c1",
+              [
+                { ...treeSpan("l2", "product-catalog", "m2", [], 1), spanStatus: "ERROR" },
+                treeSpan("l3", "product-catalog", "m2", [], 2),
+              ],
+              4,
+            ),
+          ],
+          20,
+        ),
+      ],
+      100,
+    ),
+  ],
+  // One service called by two parents: a clean 15ms call and a failing 10ms call
+  sharedChildTwoParents: [
+    treeSpan(
+      "f1",
+      "frontend",
+      "",
+      [
+        treeSpan("o1", "order-service", "f1", [treeSpan("d1", "database", "o1", [], 15)], 40),
+        treeSpan(
+          "v1",
+          "inventory-service",
+          "f1",
+          [{ ...treeSpan("d2", "database", "v1", [], 10), spanStatus: "ERROR" }],
+          30,
+        ),
+      ],
+      100,
+    ),
+  ],
 };
 
 export default {
diff --git a/web/src/ts/interfaces/oncall.ts b/web/src/ts/interfaces/oncall.ts
index b2b2d6b0a1..338b3400a1 100644
--- a/web/src/ts/interfaces/oncall.ts
+++ b/web/src/ts/interfaces/oncall.ts
@@ -1005,7 +1005,7 @@ export interface EscalationProgress {
   next_targets: string[];
   next_at?: number | null;
   exhausted: boolean;
-  /** Set when the ladder is not climbing: acknowledged, snoozed, resolved. */
+  /** Set when the ladder is not climbing: acknowledged, snoozed, resolved, unrouted, team deleted, or exhausted (check `exhausted`). */
   stopped_because?: string | null;
   /** While the first page is held for AI triage, when the hold ends (micros). */
   held_until_micros?: number | null;
diff --git a/web/src/types/vue-router.d.ts b/web/src/types/vue-router.d.ts
index 869a60c94f..e4fb2437f4 100644
--- a/web/src/types/vue-router.d.ts
+++ b/web/src/types/vue-router.d.ts
@@ -22,5 +22,7 @@ declare module "vue-router" {
     accessResource?: string;
     /** Query keys naming the item this route shows; access denials are remembered per item. */
     accessScopeQuery?: string[];
+    /** API exists only with online evaluations on, else the shell renders the disabled state. */
+    requiresOnlineEvals?: boolean;
   }
 }
diff --git a/web/src/utils/alerts/alertCondition.spec.ts b/web/src/utils/alerts/alertCondition.spec.ts
index 762edb1ae1..12781593b7 100644
--- a/web/src/utils/alerts/alertCondition.spec.ts
+++ b/web/src/utils/alerts/alertCondition.spec.ts
@@ -62,6 +62,39 @@ describe("alertConditionText", () => {
     expect(alertConditionText({ query_condition: { sql: "SELECT 1" } })).toBe("SELECT 1");
   });
 
+  /// R12, L1: every stored shape of a Builder rule reads as its conditions and its row-count threshold.
+  it("renders a custom alert's stored conditions and its count threshold", () => {
+    const leaf = { column: "body", operator: "contains", value: "ERROR" };
+    const group = {
+      filterType: "group",
+      logicalOperator: "AND",
+      conditions: [{ filterType: "condition", ...leaf, logicalOperator: "AND" }],
+    };
+    const trigger_condition = { operator: ">=", threshold: 1, period: 5, frequency: 1 };
+    const cases: [string, unknown][] = [
+      [
+        "v2 wrapper, as GET /api/v2/{org}/alerts/{id} returns it",
+        { version: 2, conditions: group },
+      ],
+      ["v2 wrapper with a string version", { version: "2", conditions: group }],
+      ["bare v2 group", group],
+      ["v1 tree", { and: [leaf] }],
+      ["v0 flat list", [leaf]],
+    ];
+    for (const [name, conditions] of cases) {
+      expect(
+        alertConditionText({
+          query_condition: { type: "custom", aggregation: null, conditions },
+          trigger_condition,
+        }),
+        name,
+      ).toBe("body contains 'ERROR' · count >= 1");
+    }
+    expect(alertConditionText({ query_condition: { type: "custom" }, trigger_condition })).toBe(
+      "count >= 1",
+    );
+  });
+
   /// A page outlives the rule it came from, so "no alert" is a real input.
   it("says nothing rather than throwing on a missing alert", () => {
     expect(alertConditionText(null)).toBe("—");
diff --git a/web/src/utils/alerts/alertCondition.ts b/web/src/utils/alerts/alertCondition.ts
index b54eac3a01..24aab27f16 100644
--- a/web/src/utils/alerts/alertCondition.ts
+++ b/web/src/utils/alerts/alertCondition.ts
@@ -22,7 +22,12 @@
  * trusting either.
  */
 
-import { isUnaryOperator } from "@/utils/alerts/conditionsFormatter";
+import {
+  convertV0ToV2,
+  convertV1BEToV2,
+  detectConditionsVersion,
+} from "@/utils/alerts/alertDataTransforms";
+import { buildConditionsString, isUnaryOperator } from "@/utils/alerts/conditionsFormatter";
 
 const EMPTY = "—";
 
@@ -33,10 +38,7 @@ function queryConditionOf(alert: any) {
   return alert?.query_condition || alert?.condition;
 }
 
-/**
- * The critical condition — `avg(latency) > 500`, a PromQL comparison, or the
- * raw SQL of a non-Builder rule with no aggregation. `—` when the alert is unknown.
- */
+/** The critical condition as one line; `—` when the alert is unknown. */
 export function alertConditionText(alert: any): string {
   const qc = queryConditionOf(alert);
   // PromQL keeps its threshold on `promql_condition`; the expression itself is
@@ -48,13 +50,34 @@ export function alertConditionText(alert: any): string {
   }
   const agg = qc?.aggregation;
   // A Builder alert can still store SQL from another mode; it never runs.
-  if (!agg) return qc?.type === "custom" ? EMPTY : qc?.sql || EMPTY;
+  if (!agg)
+    return qc?.type === "custom"
+      ? countConditionText(qc, alert?.trigger_condition)
+      : qc?.sql || EMPTY;
   const fn = agg.function || "";
   const col = agg.having?.column || "";
   const op = agg.having?.operator || "";
   return `${fn}(${col}) ${op} ${agg.having?.value}`;
 }
 
+/** A Builder rule with no aggregation fires on how many rows match: `body contains 'ERROR' · count >= 1`. */
+function countConditionText(qc: any, trigger: any): string {
+  const group = storedConditionsGroup(qc?.conditions);
+  const filters = group ? buildConditionsString(group) : "";
+  const threshold = isBlank(trigger?.threshold)
+    ? ""
+    : `count ${trigger.operator || ""} ${trigger.threshold}`.replace(/\s+/g, " ");
+  return [filters, threshold].filter(Boolean).join(" · ") || EMPTY;
+}
+
+/** A stored condition tree as a v2 group: the `{version: 2}` wrapper the API returns, a bare group, a v1 tree or a v0 list. */
+function storedConditionsGroup(stored: any): any {
+  if (!stored) return null;
+  if (String(stored.version) === "2") return stored.conditions ?? null;
+  if (Array.isArray(stored)) return convertV0ToV2(stored);
+  return detectConditionsVersion(stored) === 1 ? convertV1BEToV2(stored) : stored;
+}
+
 /** The warning condition, or `—` when the alert has only a critical one. */
 export function alertWarningConditionText(alert: any): string {
   const qc = queryConditionOf(alert);
diff --git a/web/src/utils/alerts/alertSourceRegistry.ts b/web/src/utils/alerts/alertSourceRegistry.ts
index cb54a782ff..3b2a919ad0 100644
--- a/web/src/utils/alerts/alertSourceRegistry.ts
+++ b/web/src/utils/alerts/alertSourceRegistry.ts
@@ -141,6 +141,15 @@ export const ALERT_SOURCES: Record<string, AlertSourceDefinition> = {
     defaultThreshold: "count",
     showQueryPreview: true,
   },
+  traces: {
+    id: "traces",
+    labelKey: "alerts.prefill.sources.traces.label",
+    toastKey: "alerts.prefill.sources.traces.toast",
+    icon: "shield-alert-outline",
+    // Each metric carries its threshold in HAVING, so any returned row fires.
+    defaultThreshold: "count",
+    showQueryPreview: true,
+  },
 };
 
 export const getAlertSource = (id: string | undefined): AlertSourceDefinition => {
diff --git a/web/src/utils/alerts/prefill/conformance.spec.ts b/web/src/utils/alerts/prefill/conformance.spec.ts
index 51080c87de..1dd52d5f0a 100644
--- a/web/src/utils/alerts/prefill/conformance.spec.ts
+++ b/web/src/utils/alerts/prefill/conformance.spec.ts
@@ -34,6 +34,7 @@ import type { AlertLibraryEntry, AlertLibraryFile } from "@/types/alertLibrary";
 import { buildDbmPrefill } from "./fromDbm";
 import { buildDbmLockPrefill } from "./fromDbmLocks";
 import { buildPrefillFromRumFunnel } from "./fromRumFunnel";
+import { buildPrefillFromTraces } from "./fromTraces";
 
 interface AdapterCase {
   /** Registered source id. */
@@ -202,6 +203,25 @@ const ADAPTERS: AdapterCase[] = [
         belowPct: Number.NaN,
       }),
   },
+  {
+    name: "traces",
+    healthy: () =>
+      buildPrefillFromTraces(
+        {
+          streamName: "default",
+          filter: "service_name = 'api'",
+          view: "spans",
+          metric: "errors",
+          datetime: { type: "relative", relativeTimePeriod: "15m" },
+        },
+        12,
+      ),
+    degenerate: () =>
+      buildPrefillFromTraces(
+        { streamName: "", filter: "", view: "spans", metric: "matches" },
+        null,
+      ),
+  },
 ];
 
 describe.each(ADAPTERS)("contract conformance — $name adapter", (adapterCase) => {
diff --git a/web/src/utils/alerts/prefill/fromTraces.spec.ts b/web/src/utils/alerts/prefill/fromTraces.spec.ts
new file mode 100644
index 0000000000..5cc97ae878
--- /dev/null
+++ b/web/src/utils/alerts/prefill/fromTraces.spec.ts
@@ -0,0 +1,413 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { beforeAll, describe, expect, it } from "vitest";
+import i18n from "@/locales";
+import {
+  ERROR_RATIO_MIN_SPANS,
+  ERROR_RATIO_MIN_TRACES,
+  buildPrefillFromTraces,
+  buildTracesSeedQuery,
+  tracesAlertPeriod,
+  type TracesPrefillInput,
+} from "./fromTraces";
+import { isPrefillBlocked, normalizePrefill } from "../alertPrefill";
+import { getAlertSource } from "../alertSourceRegistry";
+import { resolveTracesFilter } from "@/utils/traces/resolveTracesFilter";
+
+const base = (over: Partial<TracesPrefillInput> = {}): TracesPrefillInput => ({
+  streamName: "default",
+  filter: "service_name = 'api'",
+  view: "spans",
+  metric: "matches",
+  datetime: { type: "relative", relativeTimePeriod: "15m" },
+  ...over,
+});
+
+const warningKeys = (input: TracesPrefillInput, seed: number | null) =>
+  buildPrefillFromTraces(input, seed).warnings.map((w) => w.key);
+
+describe("buildTracesSeedQuery", () => {
+  it("counts matching spans with no HAVING", () => {
+    expect(buildTracesSeedQuery(base())).toEqual({
+      sql: `SELECT count(*) AS matches FROM "default" WHERE service_name = 'api'`,
+      valueColumn: "matches",
+    });
+  });
+
+  it("counts spans for rate in the Spans view", () => {
+    expect(buildTracesSeedQuery(base({ metric: "rate" })).sql).toBe(
+      `SELECT count(*) AS spans FROM "default" WHERE service_name = 'api'`,
+    );
+  });
+
+  it("counts distinct traces for rate in the Traces view", () => {
+    expect(buildTracesSeedQuery(base({ metric: "rate", view: "traces" }))).toEqual({
+      sql: `SELECT approx_distinct(trace_id) AS traces FROM "default" WHERE service_name = 'api'`,
+      valueColumn: "traces",
+    });
+  });
+
+  it("adds the error predicate to the filter for errors", () => {
+    expect(buildTracesSeedQuery(base({ metric: "errors" })).sql).toBe(
+      `SELECT count(*) AS errors FROM "default" WHERE (service_name = 'api') AND span_status = 'ERROR'`,
+    );
+    expect(buildTracesSeedQuery(base({ metric: "errors", view: "traces" })).sql).toBe(
+      `SELECT approx_distinct(trace_id) AS errors FROM "default" WHERE (service_name = 'api') AND span_status = 'ERROR'`,
+    );
+  });
+
+  it("reads the chosen percentile and the span count for duration", () => {
+    expect(buildTracesSeedQuery(base({ metric: "duration", percentile: 0.99 }))).toEqual({
+      sql: `SELECT approx_percentile_cont(duration, 0.99) AS p99_duration, count(*) AS spans FROM "default" WHERE service_name = 'api'`,
+      valueColumn: "p99_duration",
+    });
+  });
+
+  it("defaults duration to p95", () => {
+    expect(buildTracesSeedQuery(base({ metric: "duration" })).valueColumn).toBe("p95_duration");
+  });
+
+  it("reads the error percentage and the span count for error_ratio in the Spans view", () => {
+    expect(buildTracesSeedQuery(base({ metric: "error_ratio" }))).toEqual({
+      sql: `SELECT CAST(SUM(CASE WHEN span_status = 'ERROR' THEN 1 ELSE 0 END) AS DOUBLE) * 100 / count(*) AS error_rate, count(*) AS spans FROM "default" WHERE service_name = 'api'`,
+      valueColumn: "error_rate",
+    });
+  });
+
+  it("reads the error-trace percentage over distinct traces in the Traces view", () => {
+    expect(buildTracesSeedQuery(base({ metric: "error_ratio", view: "traces" })).sql).toBe(
+      `SELECT CAST(approx_distinct(CASE WHEN span_status = 'ERROR' THEN trace_id END) AS DOUBLE) * 100 / approx_distinct(trace_id) AS error_rate, approx_distinct(trace_id) AS traces FROM "default" WHERE service_name = 'api'`,
+    );
+  });
+
+  it("drops WHERE for an empty filter, keeping only the error predicate", () => {
+    expect(buildTracesSeedQuery(base({ filter: "  " })).sql).toBe(
+      `SELECT count(*) AS matches FROM "default"`,
+    );
+    expect(buildTracesSeedQuery(base({ filter: "", metric: "errors" })).sql).toBe(
+      `SELECT count(*) AS errors FROM "default" WHERE span_status = 'ERROR'`,
+    );
+  });
+
+  it("escapes double quotes in the stream name", () => {
+    expect(buildTracesSeedQuery(base({ streamName: 'we"ird', filter: "" })).sql).toBe(
+      `SELECT count(*) AS matches FROM "we""ird"`,
+    );
+  });
+});
+
+describe("buildPrefillFromTraces", () => {
+  it("puts the threshold at 1.5× the seed, rounded up, inside HAVING", () => {
+    const p = buildPrefillFromTraces(base(), 721);
+    expect(p.sql).toBe(
+      `SELECT count(*) AS matches FROM "default" WHERE service_name = 'api' HAVING count(*) > 1082`,
+    );
+    expect(p.meta).toMatchObject({ seed: 721, threshold: 1082, metric: "matches" });
+  });
+
+  it("thresholds rate in the Traces view on distinct traces", () => {
+    expect(buildPrefillFromTraces(base({ metric: "rate", view: "traces" }), 100).sql).toBe(
+      `SELECT approx_distinct(trace_id) AS traces FROM "default" WHERE service_name = 'api' HAVING approx_distinct(trace_id) > 150`,
+    );
+  });
+
+  it("thresholds rate in the Spans view on spans", () => {
+    expect(buildPrefillFromTraces(base({ metric: "rate" }), 100).sql).toBe(
+      `SELECT count(*) AS spans FROM "default" WHERE service_name = 'api' HAVING count(*) > 150`,
+    );
+  });
+
+  it("thresholds errors per view", () => {
+    expect(buildPrefillFromTraces(base({ metric: "errors" }), 720).sql).toBe(
+      `SELECT count(*) AS errors FROM "default" WHERE (service_name = 'api') AND span_status = 'ERROR' HAVING count(*) > 1080`,
+    );
+    expect(buildPrefillFromTraces(base({ metric: "errors", view: "traces" }), 10).sql).toBe(
+      `SELECT approx_distinct(trace_id) AS errors FROM "default" WHERE (service_name = 'api') AND span_status = 'ERROR' HAVING approx_distinct(trace_id) > 15`,
+    );
+  });
+
+  it("thresholds duration in µs with a minimum-traffic guard", () => {
+    const p = buildPrefillFromTraces(base({ metric: "duration", percentile: 0.95 }), 176976);
+    expect(p.sql).toBe(
+      `SELECT approx_percentile_cont(duration, 0.95) AS p95_duration, count(*) AS spans FROM "default" WHERE service_name = 'api' HAVING approx_percentile_cont(duration, 0.95) > 265464 AND count(*) >= 20`,
+    );
+  });
+
+  it("thresholds error_ratio in percent with a span-traffic guard", () => {
+    expect(ERROR_RATIO_MIN_SPANS).toBe(100);
+    const p = buildPrefillFromTraces(base({ metric: "error_ratio" }), 2);
+    expect(p.sql).toBe(
+      `SELECT CAST(SUM(CASE WHEN span_status = 'ERROR' THEN 1 ELSE 0 END) AS DOUBLE) * 100 / count(*) AS error_rate, count(*) AS spans FROM "default" WHERE service_name = 'api' HAVING CAST(SUM(CASE WHEN span_status = 'ERROR' THEN 1 ELSE 0 END) AS DOUBLE) * 100 / count(*) > 3 AND count(*) >= 100`,
+    );
+    expect(p.meta).toMatchObject({
+      metric: "error_ratio",
+      valueColumn: "error_rate",
+      threshold: 3,
+    });
+    expect(p.name).toBe("traces_default_error_rate");
+  });
+
+  it("thresholds error_ratio on distinct traces with a trace-traffic guard", () => {
+    expect(ERROR_RATIO_MIN_TRACES).toBe(20);
+    const sql = buildPrefillFromTraces(base({ metric: "error_ratio", view: "traces" }), 4).sql;
+    expect(sql).toMatch(
+      / HAVING CAST\(approx_distinct\(CASE WHEN span_status = 'ERROR' THEN trace_id END\) AS DOUBLE\) \* 100 \/ approx_distinct\(trace_id\) > 6 AND approx_distinct\(trace_id\) >= 20$/,
+    );
+  });
+
+  it("caps the error_ratio threshold below 100 percent so the alert can still fire", () => {
+    const p = buildPrefillFromTraces(base({ metric: "error_ratio" }), 80);
+    expect(p.meta?.threshold).toBe(99);
+    expect(p.sql).toContain("> 99 AND count(*) >= 100");
+  });
+
+  it("seeds error_ratio 0 as threshold 0, still behind the traffic guard", () => {
+    const p = buildPrefillFromTraces(base({ metric: "error_ratio" }), 0);
+    expect(p.sql).toMatch(/ > 0 AND count\(\*\) >= 100$/);
+    expect(p.warnings.map((w) => w.key)).toContain("tracesNoMatches");
+  });
+
+  it("states the error_ratio seed in percent and notes the traffic guard", () => {
+    const p = buildPrefillFromTraces(base({ metric: "error_ratio" }), 2);
+    expect(p.warnings).toContainEqual({
+      key: "tracesSeedErrorRatio",
+      level: "info",
+      params: { minutes: 15, threshold: "3.0", current: "2.0" },
+    });
+    expect(p.warnings).toContainEqual({
+      key: "tracesErrorRatioMinSpans",
+      level: "info",
+      params: { minimum: 100 },
+    });
+    expect(
+      buildPrefillFromTraces(base({ metric: "error_ratio", view: "traces" }), 2).warnings,
+    ).toContainEqual({ key: "tracesErrorRatioMinTraces", level: "info", params: { minimum: 20 } });
+  });
+
+  it("uses the same SQL in both views for duration", () => {
+    const spans = buildPrefillFromTraces(base({ metric: "duration", percentile: 0.5 }), 1000);
+    const traces = buildPrefillFromTraces(
+      base({ metric: "duration", percentile: 0.5, view: "traces" }),
+      1000,
+    );
+    expect(traces.sql).toBe(spans.sql);
+    expect(spans.sql).toContain("approx_percentile_cont(duration, 0.5) AS p50_duration");
+  });
+
+  it("carries a duration filter resolved to µs by the shared helper", async () => {
+    const mod = await import("@openobserve/node-sql-parser/build/datafusionsql");
+    const parser = new mod.default.Parser();
+    const filter = resolveTracesFilter("duration > '500ms'", parser, "default");
+    const p = buildPrefillFromTraces(base({ filter }), 4);
+    expect(p.sql).toBe(
+      `SELECT count(*) AS matches FROM "default" WHERE duration > 500000 HAVING count(*) > 6`,
+    );
+  });
+
+  it("omits WHERE for an empty filter", () => {
+    expect(buildPrefillFromTraces(base({ filter: "" }), 2).sql).toBe(
+      `SELECT count(*) AS matches FROM "default" HAVING count(*) > 3`,
+    );
+  });
+
+  it("seeds 0 as threshold 0 and says no spans match yet", () => {
+    const p = buildPrefillFromTraces(base({ metric: "errors" }), 0);
+    expect(p.sql).toMatch(/HAVING count\(\*\) > 0$/);
+    expect(p.warnings).toContainEqual({ key: "tracesNoMatches", level: "info" });
+  });
+
+  it("treats a missing seed as 0 and warns that it could not be read", () => {
+    const p = buildPrefillFromTraces(base(), null);
+    expect(p.sql).toMatch(/HAVING count\(\*\) > 0$/);
+    expect(p.warnings.map((w) => w.key)).toContain("tracesSeedUnavailable");
+    expect(p.warnings.map((w) => w.key)).not.toContain("tracesNoMatches");
+  });
+
+  it("states the seed in the chart's terms", () => {
+    expect(buildPrefillFromTraces(base({ metric: "errors" }), 720).warnings).toContainEqual({
+      key: "tracesSeedErrorSpans",
+      level: "info",
+      params: { minutes: 15, threshold: "1,080", current: "720" },
+    });
+    expect(warningKeys(base({ metric: "errors", view: "traces" }), 5)).toContain(
+      "tracesSeedErrorTraces",
+    );
+    expect(warningKeys(base({ metric: "rate", view: "traces" }), 5)).toContain("tracesSeedTraces");
+    expect(warningKeys(base({ metric: "rate" }), 5)).toContain("tracesSeedSpans");
+    expect(warningKeys(base(), 5)).toContain("tracesSeedMatches");
+  });
+
+  it("states a duration seed in milliseconds", () => {
+    const p = buildPrefillFromTraces(base({ metric: "duration", percentile: 0.95 }), 176976);
+    expect(p.warnings).toContainEqual({
+      key: "tracesSeedDuration",
+      level: "info",
+      params: { percentile: "p95", minutes: 15, threshold: "265", current: "177" },
+    });
+  });
+
+  it("keeps sub-10 ms durations to two decimals", () => {
+    const p = buildPrefillFromTraces(base({ metric: "duration", percentile: 0.5 }), 1500);
+    expect(p.warnings).toContainEqual(
+      expect.objectContaining({
+        key: "tracesSeedDuration",
+        params: { percentile: "p50", minutes: 15, threshold: "2.25", current: "1.5" },
+      }),
+    );
+  });
+
+  it("always notes that counts are of stored spans", () => {
+    expect(warningKeys(base(), 5)).toContain("tracesStoredSpans");
+  });
+
+  it("fills the alert schedule and fires on one returned row", () => {
+    const p = buildPrefillFromTraces(base(), 5);
+    expect(p).toMatchObject({
+      source: "traces",
+      streamType: "traces",
+      streamName: "default",
+      queryType: "sql",
+      periodMinutes: 15,
+      frequencyMinutes: 5,
+      silenceMinutes: 10,
+      thresholdShape: "count",
+      triggerThreshold: 1,
+      triggerOperator: ">=",
+    });
+    expect(p.name).toBe("traces_default_matches");
+  });
+
+  it("never selects *", () => {
+    for (const metric of ["matches", "rate", "errors", "duration", "error_ratio"] as const) {
+      expect(buildPrefillFromTraces(base({ metric }), 3).sql).not.toMatch(/select\s+\*/i);
+    }
+  });
+
+  it("blocks without a stream instead of throwing", () => {
+    const p = normalizePrefill(buildPrefillFromTraces(base({ streamName: "" }), 3));
+    expect(isPrefillBlocked(p)).toBe(true);
+  });
+
+  it("produces an unblocked prefill for a healthy input", () => {
+    expect(isPrefillBlocked(normalizePrefill(buildPrefillFromTraces(base(), 3)))).toBe(false);
+  });
+});
+
+describe("tracesAlertPeriod", () => {
+  it("uses the page range when it is an hour or less", () => {
+    expect(tracesAlertPeriod({ type: "relative", relativeTimePeriod: "30m" })).toEqual({
+      minutes: 30,
+      warnings: [],
+    });
+  });
+
+  it("raises a window shorter than the run frequency to the frequency", () => {
+    expect(tracesAlertPeriod({ type: "relative", relativeTimePeriod: "1m" })).toEqual({
+      minutes: 5,
+      warnings: [],
+    });
+  });
+
+  it("states the raised window for a short absolute range", () => {
+    const { minutes, warnings } = tracesAlertPeriod({
+      type: "absolute",
+      startTime: 60 * 60 * 1_000_000,
+      endTime: 62 * 60 * 1_000_000,
+    });
+    expect(minutes).toBe(5);
+    expect(warnings).toEqual([
+      { key: "absoluteToRolling", level: "warning", params: { minutes: 5 } },
+    ]);
+  });
+
+  it("caps the window at 60 minutes and warns", () => {
+    const { minutes, warnings } = tracesAlertPeriod({
+      type: "relative",
+      relativeTimePeriod: "24h",
+    });
+    expect(minutes).toBe(60);
+    expect(warnings).toEqual([
+      { key: "tracesPeriodCapped", level: "warning", params: { minutes: 60 } },
+    ]);
+  });
+
+  it("states the capped window for an absolute range", () => {
+    const hour = 60 * 60 * 1_000_000;
+    const { minutes, warnings } = tracesAlertPeriod({
+      type: "absolute",
+      startTime: hour,
+      endTime: 4 * hour,
+    });
+    expect(minutes).toBe(60);
+    expect(warnings).toContainEqual({
+      key: "absoluteToRolling",
+      level: "warning",
+      params: { minutes: 60 },
+    });
+    expect(warnings.map((w) => w.key)).toContain("tracesPeriodCapped");
+  });
+
+  it("feeds the capped window into the prefill", () => {
+    const p = buildPrefillFromTraces(
+      base({ datetime: { type: "relative", relativeTimePeriod: "7d" } }),
+      1,
+    );
+    expect(p.periodMinutes).toBe(60);
+    expect(p.warnings.map((w) => w.key)).toContain("tracesPeriodCapped");
+  });
+});
+
+describe("traces alert source and text", () => {
+  let t: (key: string) => string;
+  beforeAll(() => {
+    t = (key) => i18n.global.t(key);
+  });
+
+  it("is registered with a count threshold", () => {
+    const source = getAlertSource("traces");
+    expect(source.id).toBe("traces");
+    expect(source.defaultThreshold).toBe("count");
+    expect(t(source.labelKey)).toBe("Create alert");
+    expect(t(source.toastKey)).toBe("Query imported from your traces search");
+  });
+
+  it("has English text for every warning it emits", () => {
+    const keys = new Set<string>();
+    const inputs: [TracesPrefillInput, number | null][] = [
+      [base(), 0],
+      [base(), null],
+      [base({ metric: "rate" }), 1],
+      [base({ metric: "rate", view: "traces" }), 1],
+      [base({ metric: "errors" }), 1],
+      [base({ metric: "errors", view: "traces" }), 1],
+      [base({ metric: "error_ratio" }), 1],
+      [base({ metric: "error_ratio", view: "traces" }), 1],
+      [base({ metric: "duration", datetime: { type: "relative", relativeTimePeriod: "2h" } }), 1],
+    ];
+    for (const [input, seed] of inputs) {
+      buildPrefillFromTraces(input, seed).warnings.forEach((w) => keys.add(w.key));
+    }
+    for (const key of keys) {
+      const path = `alerts.prefill.warnings.${key}`;
+      expect(t(path), key).not.toBe(path);
+    }
+  });
+
+  it("has a pick-a-stream reason", () => {
+    const path = "alerts.prefill.sources.traces.noStream";
+    expect(t(path)).toBe("Pick a stream first");
+  });
+});
diff --git a/web/src/utils/alerts/prefill/fromTraces.ts b/web/src/utils/alerts/prefill/fromTraces.ts
new file mode 100644
index 0000000000..d880bb87af
--- /dev/null
+++ b/web/src/utils/alerts/prefill/fromTraces.ts
@@ -0,0 +1,250 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import {
+  ALERT_PREFILL_VERSION,
+  type AlertPrefill,
+  type AlertPrefillWarning,
+} from "@/ts/interfaces/alertPrefill";
+import {
+  periodMinutesFromRange,
+  sanitizeAlertNamePart,
+  warn,
+  type PrefillTimeRange,
+} from "../alertPrefill";
+
+export type TracesAlertMetric = "matches" | "rate" | "errors" | "duration" | "error_ratio";
+export type TracesAlertPercentile = 0.5 | 0.95 | 0.99;
+
+export interface TracesPrefillInput {
+  streamName: string;
+  /** WHERE fragment already resolved by resolveTracesFilter (µs durations, numeric span kinds). */
+  filter: string;
+  view: "traces" | "spans";
+  metric: TracesAlertMetric;
+  /** Duration only; defaults to 0.95. */
+  percentile?: TracesAlertPercentile;
+  datetime?: PrefillTimeRange | null;
+}
+
+export interface TracesSeedQuery {
+  /** The metric without its threshold, to read the current value. */
+  sql: string;
+  /** Column of the seed row that holds the value to pass to buildPrefillFromTraces. */
+  valueColumn: string;
+}
+
+/** A longer window turns every evaluation into a long percentile scan. */
+export const TRACES_ALERT_MAX_PERIOD_MINUTES = 60;
+
+const FREQUENCY_MINUTES = 5;
+const SILENCE_MINUTES = 10;
+const MIN_DURATION_SPANS = 20;
+/** A quiet window where 1 of 2 spans failed must not fire an error-rate alert. */
+export const ERROR_RATIO_MIN_SPANS = 100;
+export const ERROR_RATIO_MIN_TRACES = 20;
+// The alert fires on `>`, so a 100 % threshold could never be exceeded.
+const ERROR_RATIO_MAX_THRESHOLD = 99;
+const SEED_HEADROOM = 1.5;
+
+interface MetricShape {
+  expr: string;
+  alias: string;
+  where: string;
+  extraSelect: string;
+  extraHaving: string;
+}
+
+const quoteStream = (name: string): string => `"${name.replace(/"/g, '""')}"`;
+
+const metricShape = (input: TracesPrefillInput): MetricShape => {
+  const filter = input.filter?.trim() ?? "";
+  const distinctTraces = input.view === "traces";
+  const counter = distinctTraces ? "approx_distinct(trace_id)" : "count(*)";
+  const plain = { where: filter, extraSelect: "", extraHaving: "" };
+
+  switch (input.metric) {
+    case "rate":
+      return { ...plain, expr: counter, alias: distinctTraces ? "traces" : "spans" };
+    case "errors": {
+      const errorOnly = "span_status = 'ERROR'";
+      return {
+        ...plain,
+        expr: counter,
+        alias: "errors",
+        where: filter ? `(${filter}) AND ${errorOnly}` : errorOnly,
+      };
+    }
+    case "error_ratio": {
+      const errors = distinctTraces
+        ? "approx_distinct(CASE WHEN span_status = 'ERROR' THEN trace_id END)"
+        : "SUM(CASE WHEN span_status = 'ERROR' THEN 1 ELSE 0 END)";
+      const total = distinctTraces ? "traces" : "spans";
+      const minimum = distinctTraces ? ERROR_RATIO_MIN_TRACES : ERROR_RATIO_MIN_SPANS;
+      return {
+        where: filter,
+        expr: `CAST(${errors} AS DOUBLE) * 100 / ${counter}`,
+        alias: "error_rate",
+        extraSelect: `, ${counter} AS ${total}`,
+        extraHaving: ` AND ${counter} >= ${minimum}`,
+      };
+    }
+    case "duration": {
+      const p = input.percentile ?? 0.95;
+      return {
+        where: filter,
+        expr: `approx_percentile_cont(duration, ${p})`,
+        alias: `p${Math.round(p * 100)}_duration`,
+        extraSelect: ", count(*) AS spans",
+        extraHaving: ` AND count(*) >= ${MIN_DURATION_SPANS}`,
+      };
+    }
+    default:
+      return { ...plain, expr: "count(*)", alias: "matches" };
+  }
+};
+
+const selectSql = (input: TracesPrefillInput, shape: MetricShape): string => {
+  const where = shape.where ? ` WHERE ${shape.where}` : "";
+  return `SELECT ${shape.expr} AS ${shape.alias}${shape.extraSelect} FROM ${quoteStream(input.streamName ?? "")}${where}`;
+};
+
+export const buildTracesSeedQuery = (input: TracesPrefillInput): TracesSeedQuery => {
+  const shape = metricShape(input);
+  return { sql: selectSql(input, shape), valueColumn: shape.alias };
+};
+
+/** The page range as the alert window, between the run frequency and TRACES_ALERT_MAX_PERIOD_MINUTES. */
+export const tracesAlertPeriod = (
+  datetime: PrefillTimeRange | null | undefined,
+): { minutes: number; warnings: AlertPrefillWarning[] } => {
+  const range = periodMinutesFromRange(datetime);
+  const capped = range.minutes > TRACES_ALERT_MAX_PERIOD_MINUTES;
+  // A window shorter than the run frequency would leave minutes between runs unchecked.
+  const minutes = capped
+    ? TRACES_ALERT_MAX_PERIOD_MINUTES
+    : Math.max(range.minutes, FREQUENCY_MINUTES);
+  const warnings = range.warnings
+    .filter((w) => w.key !== "periodClamped")
+    .map((w) => (w.params?.minutes === undefined ? w : { ...w, params: { ...w.params, minutes } }));
+  if (capped) warnings.push(warn("tracesPeriodCapped", "warning", { minutes }));
+  return { minutes, warnings };
+};
+
+const formatCount = (value: number): string =>
+  new Intl.NumberFormat("en-US", { maximumFractionDigits: 0 }).format(value);
+
+const formatMs = (micros: number): string => {
+  const ms = micros / 1000;
+  return new Intl.NumberFormat("en-US", { maximumFractionDigits: ms < 10 ? 2 : 0 }).format(ms);
+};
+
+const formatPercent = (value: number): string =>
+  new Intl.NumberFormat("en-US", { minimumFractionDigits: 1, maximumFractionDigits: 1 }).format(
+    value,
+  );
+
+const seedWarning = (
+  input: TracesPrefillInput,
+  minutes: number,
+  seed: number,
+  threshold: number,
+): AlertPrefillWarning => {
+  if (input.metric === "duration") {
+    return warn("tracesSeedDuration", "info", {
+      percentile: `p${Math.round((input.percentile ?? 0.95) * 100)}`,
+      minutes,
+      threshold: formatMs(threshold),
+      current: formatMs(seed),
+    });
+  }
+  if (input.metric === "error_ratio") {
+    return warn("tracesSeedErrorRatio", "info", {
+      minutes,
+      threshold: formatPercent(threshold),
+      current: formatPercent(seed),
+    });
+  }
+  const traces = input.view === "traces";
+  const keyByMetric: Record<Exclude<TracesAlertMetric, "duration" | "error_ratio">, string> = {
+    matches: "tracesSeedMatches",
+    rate: traces ? "tracesSeedTraces" : "tracesSeedSpans",
+    errors: traces ? "tracesSeedErrorTraces" : "tracesSeedErrorSpans",
+  };
+  return warn(keyByMetric[input.metric], "info", {
+    minutes,
+    threshold: formatCount(threshold),
+    current: formatCount(seed),
+  });
+};
+
+/** Pure; `seed` is the valueColumn read from buildTracesSeedQuery, or null when that read failed. */
+export const buildPrefillFromTraces = (
+  input: TracesPrefillInput,
+  seed: number | null | undefined,
+): AlertPrefill => {
+  const warnings: AlertPrefillWarning[] = [];
+  const streamName = input.streamName?.trim() ?? "";
+  if (!streamName) warnings.push(warn("noStream", "blocking"));
+
+  const known = typeof seed === "number" && Number.isFinite(seed) && seed >= 0;
+  const current = known ? seed : 0;
+  const ratio = input.metric === "error_ratio";
+  const headroom = Math.ceil(current * SEED_HEADROOM);
+  const threshold = ratio ? Math.min(headroom, ERROR_RATIO_MAX_THRESHOLD) : headroom;
+
+  const { minutes, warnings: periodWarnings } = tracesAlertPeriod(input.datetime);
+  warnings.push(...periodWarnings);
+
+  if (!known) warnings.push(warn("tracesSeedUnavailable", "warning"));
+  else if (current === 0) warnings.push(warn("tracesNoMatches", "info"));
+  warnings.push(seedWarning(input, minutes, current, threshold));
+  if (ratio && input.view === "traces") {
+    warnings.push(warn("tracesErrorRatioMinTraces", "info", { minimum: ERROR_RATIO_MIN_TRACES }));
+  } else if (ratio) {
+    warnings.push(warn("tracesErrorRatioMinSpans", "info", { minimum: ERROR_RATIO_MIN_SPANS }));
+  }
+  warnings.push(warn("tracesStoredSpans", "info"));
+
+  const shape = metricShape(input);
+  const sql = `${selectSql(input, shape)} HAVING ${shape.expr} > ${threshold}${shape.extraHaving}`;
+
+  return {
+    version: ALERT_PREFILL_VERSION,
+    source: "traces",
+    sourceLabel: streamName || "traces",
+    name: `traces_${sanitizeAlertNamePart(streamName, "stream")}_${shape.alias}`,
+    streamType: "traces",
+    streamName,
+    queryType: "sql",
+    sql,
+    periodMinutes: minutes,
+    frequencyMinutes: FREQUENCY_MINUTES,
+    silenceMinutes: SILENCE_MINUTES,
+    thresholdShape: "count",
+    // The threshold lives in HAVING, so one returned row means it was crossed.
+    triggerThreshold: 1,
+    triggerOperator: ">=",
+    warnings,
+    meta: {
+      metric: input.metric,
+      view: input.view,
+      percentile: input.metric === "duration" ? (input.percentile ?? 0.95) : null,
+      valueColumn: shape.alias,
+      seed: known ? seed : null,
+      threshold,
+    },
+  };
+};
diff --git a/web/src/utils/clipboard.spec.ts b/web/src/utils/clipboard.spec.ts
index 3ded0f31d0..f74ac10d5e 100644
--- a/web/src/utils/clipboard.spec.ts
+++ b/web/src/utils/clipboard.spec.ts
@@ -2,7 +2,7 @@
 // @vitest-environment jsdom
 
 import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
-import { copyToClipboard } from "@/utils/clipboard";
+import { copyPendingText, copyToClipboard } from "@/utils/clipboard";
 import { raw } from "@/types/i18n";
 import { toast } from "@/lib/feedback/Toast/useToast";
 import {
@@ -285,3 +285,110 @@ describe("copyToClipboard in-place confirmation", () => {
     });
   });
 });
+
+class FakeClipboardItem {
+  constructor(public items: Record<string, Promise<Blob>>) {}
+}
+
+// The test setup defines navigator.clipboard writable but not configurable.
+const setupClipboard = navigator.clipboard;
+const setClipboard = (clipboard: Partial<Clipboard> | undefined) =>
+  Object.assign(navigator, { clipboard });
+
+describe("clipboard", () => {
+  let execCommand: ReturnType<typeof vi.fn>;
+
+  beforeEach(() => {
+    execCommand = vi.fn(() => true);
+    Object.defineProperty(document, "execCommand", { value: execCommand, configurable: true });
+  });
+
+  afterEach(() => {
+    setClipboard(setupClipboard);
+    vi.unstubAllGlobals();
+  });
+
+  it("the DOM fallback textarea is masked from session replay", async () => {
+    setClipboard({ writeText: vi.fn().mockRejectedValue(new Error("denied")) });
+    let privacy: string | null = null;
+    execCommand.mockImplementation(() => {
+      privacy = document.activeElement?.getAttribute("data-o2-privacy") ?? null;
+      return true;
+    });
+
+    await expect(copyToClipboard("o2wh_SECRET", t, { silent: true })).resolves.toBe(true);
+
+    expect(privacy).toBe("mask");
+    expect(document.querySelector("textarea")).toBeNull();
+  });
+
+  it("copyPendingText writes a ClipboardItem before the value resolves", async () => {
+    vi.stubGlobal("ClipboardItem", FakeClipboardItem);
+    const write = vi.fn(async (items: FakeClipboardItem[]) => {
+      await items[0].items["text/plain"];
+    });
+    setClipboard({ write: write as unknown as Clipboard["write"], writeText: vi.fn() });
+    let resolve!: (v: string) => void;
+    const value = new Promise<string>((r) => (resolve = r));
+
+    const copying = copyPendingText(value);
+
+    expect(write).toHaveBeenCalledTimes(1);
+    resolve("o2wh_SECRET");
+    await expect(copying).resolves.toBe(true);
+    const blob = await write.mock.calls[0][0][0].items["text/plain"];
+    expect(blob.type).toBe("text/plain");
+    const text = await new Promise((resolveText) => {
+      const reader = new FileReader();
+      reader.onload = () => resolveText(reader.result);
+      reader.readAsText(blob);
+    });
+    expect(text).toBe("o2wh_SECRET");
+  });
+
+  it("copyPendingText falls back to writeText when ClipboardItem is refused or missing", async () => {
+    vi.stubGlobal("ClipboardItem", FakeClipboardItem);
+    const writeText = vi.fn().mockResolvedValue(undefined);
+    setClipboard({ write: vi.fn().mockRejectedValue(new Error("NotAllowed")), writeText });
+    await expect(copyPendingText(Promise.resolve("a"))).resolves.toBe(true);
+    expect(writeText).toHaveBeenCalledWith("a");
+
+    vi.unstubAllGlobals();
+    await expect(copyPendingText(Promise.resolve("b"))).resolves.toBe(true);
+    expect(writeText).toHaveBeenCalledWith("b");
+  });
+
+  it("copyPendingText leaves no unhandled rejection when the item is refused before reading", async () => {
+    vi.stubGlobal(
+      "ClipboardItem",
+      class {
+        constructor() {
+          throw new Error("unsupported");
+        }
+      },
+    );
+    setClipboard({ write: vi.fn(), writeText: vi.fn() });
+    const unhandled = vi.fn();
+    process.on("unhandledRejection", unhandled);
+    try {
+      await expect(copyPendingText(Promise.reject(new Error("fetch failed")))).rejects.toThrow(
+        "fetch failed",
+      );
+      await new Promise((r) => setTimeout(r, 0));
+      expect(unhandled).not.toHaveBeenCalled();
+    } finally {
+      process.off("unhandledRejection", unhandled);
+      vi.unstubAllGlobals();
+    }
+  });
+
+  it("copyPendingText rethrows the value's failure and returns false when no copy works", async () => {
+    setClipboard({ writeText: vi.fn().mockRejectedValue(new Error("denied")) });
+    await expect(copyPendingText(Promise.reject(new Error("fetch failed")))).rejects.toThrow(
+      "fetch failed",
+    );
+
+    execCommand.mockReturnValue(false);
+    await expect(copyPendingText(Promise.resolve("x"))).resolves.toBe(false);
+  });
+});
diff --git a/web/src/utils/clipboard.ts b/web/src/utils/clipboard.ts
index e551d198d1..73778f6cc5 100644
--- a/web/src/utils/clipboard.ts
+++ b/web/src/utils/clipboard.ts
@@ -42,6 +42,8 @@ async function writeClipboard(text: string): Promise<void> {
   textarea.value = text;
   textarea.style.cssText = "position:fixed;top:0;left:0;opacity:0;pointer-events:none;";
   textarea.setAttribute("readonly", "");
+  // Callers copy tokens and secrets; session replay records any unmasked DOM insert.
+  textarea.setAttribute("data-o2-privacy", "mask");
   container.appendChild(textarea);
   textarea.focus();
   textarea.select();
@@ -59,6 +61,28 @@ async function writeClipboard(text: string): Promise<void> {
   }
 }
 
+/** Copies text that is still loading: the ClipboardItem write starts inside the click, before any await; false when no copy path works, a rejection of `text` rethrows. */
+export async function copyPendingText(text: Promise<string>): Promise<boolean> {
+  if (typeof ClipboardItem !== "undefined" && typeof navigator.clipboard?.write === "function") {
+    try {
+      const blob = text.then((value) => new Blob([value], { type: "text/plain" }));
+      // The fallback below rethrows the same failure from `text`, so this copy of it is dropped.
+      blob.catch(() => undefined);
+      await navigator.clipboard.write([new ClipboardItem({ "text/plain": blob })]);
+      return true;
+    } catch {
+      // Refused or unsupported item: fall back to writing the resolved text.
+    }
+  }
+  const value = await text;
+  try {
+    await writeClipboard(value);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export async function copyToClipboard(
   text: string,
   t: TranslateFn,
diff --git a/web/src/utils/dashboard/annotationSources.spec.ts b/web/src/utils/dashboard/annotationSources.spec.ts
index 54aedcffcd..81b85298dd 100644
--- a/web/src/utils/dashboard/annotationSources.spec.ts
+++ b/web/src/utils/dashboard/annotationSources.spec.ts
@@ -112,6 +112,17 @@ describe("renderAnnotationTemplate", () => {
     ).toEqual({ text: "prod/us, eu: x", missing: [] });
   });
 
+  it("prints a date variable in its format, or the placeholder's", () => {
+    const variables = [
+      { name: "from", type: "date", value: "2026-03-08", dateFormat: "dmy" },
+      { name: "note", type: "textbox", value: "2026-03-08" },
+    ];
+    expect(
+      renderAnnotationTemplate("$from | ${from:epoch} | ${note:dmy} | [{a}]", { a: "1" }, variables)
+        .text,
+    ).toBe("08/03/2026 | 1772928000 | 2026-03-08 | [1]");
+  });
+
   it("leaves an unknown $name as written and does not read it as a field", () => {
     expect(renderAnnotationTemplate("cost $5 {a}", { a: "1" }).text).toBe("cost $5 1");
   });
diff --git a/web/src/utils/dashboard/annotationSources.ts b/web/src/utils/dashboard/annotationSources.ts
index 9c2b6c36e7..a0160a4ff2 100644
--- a/web/src/utils/dashboard/annotationSources.ts
+++ b/web/src/utils/dashboard/annotationSources.ts
@@ -21,6 +21,7 @@ import type {
 } from "@/ts/interfaces/dashboard";
 import { SELECT_ALL_VALUE } from "@/utils/dashboard/constants";
 import {
+  formatDateVariable,
   normalizeVariableSyntax,
   replaceVariablePlaceholders,
 } from "@/utils/dashboard/variables/variablesUtils";
@@ -67,6 +68,9 @@ export type AnnotationRow = Record<string, unknown>;
 export interface AnnotationVariable {
   name: string;
   value: unknown;
+  /** Only read for `date` variables. */
+  type?: string;
+  dateFormat?: string;
 }
 
 export const defaultAnnotationSourceColor = (index: number): string =>
@@ -104,9 +108,9 @@ export const renderAnnotationTemplate = (
   variables: AnnotationVariable[] = [],
 ): RenderedTemplate => {
   if (!template) return { text: "", missing: [] };
-  const byName = new Map<string, unknown>();
+  const byName = new Map<string, AnnotationVariable>();
   variables.forEach((variable) => {
-    if (variable?.name && !byName.has(variable.name)) byName.set(variable.name, variable.value);
+    if (variable?.name && !byName.has(variable.name)) byName.set(variable.name, variable);
   });
   const missing: string[] = [];
   // {field} is resolved against the template itself so a variable's value can't be mistaken for one.
@@ -118,9 +122,10 @@ export const renderAnnotationTemplate = (
       return "";
     },
   );
-  const text = replaceVariablePlaceholders(withFields, byName.keys(), ({ name }) =>
-    variableDisplayValue(byName.get(name)),
-  );
+  const text = replaceVariablePlaceholders(withFields, byName.keys(), ({ name, format }) => {
+    const variable = byName.get(name);
+    return formatDateVariable(variable, format) ?? variableDisplayValue(variable?.value);
+  });
   return { text: text.trim(), missing };
 };
 
diff --git a/web/src/utils/dashboard/variableSuggestions.spec.ts b/web/src/utils/dashboard/variableSuggestions.spec.ts
index d0767f1723..7362d49a8a 100644
--- a/web/src/utils/dashboard/variableSuggestions.spec.ts
+++ b/web/src/utils/dashboard/variableSuggestions.spec.ts
@@ -39,6 +39,23 @@ describe("getVariableSuggestions", () => {
     ]);
   });
 
+  it("adds every date format, with an example, for a date variable only", () => {
+    expect(suggest([{ name: "from", type: "date" }])).toEqual([
+      { name: "from", description: "Date" },
+      { name: "from:iso", description: "Date (YYYY-MM-DD): 2026-03-08" },
+      { name: "from:dmy", description: "Day first (DD/MM/YYYY): 08/03/2026" },
+      { name: "from:mdy", description: "Month first (MM/DD/YYYY): 03/08/2026" },
+      { name: "from:epochms", description: "Epoch milliseconds: 1772928000000" },
+      { name: "from:epochus", description: "Epoch microseconds: 1772928000000000" },
+      { name: "from:epoch", description: "Epoch seconds: 1772928000" },
+    ]);
+    const others = suggest([
+      { name: "q", type: "textbox" },
+      { name: "rack", type: "query_values", multiSelect: true },
+    ]).map((s) => s.name);
+    expect(others.some((name) => /:(iso|dmy|mdy|epoch)/.test(name))).toBe(false);
+  });
+
   it("adds every list format the resolver supports for a multi-select variable", () => {
     expect(suggest([{ name: "rack", type: "query_values", multiSelect: true }])).toEqual([
       { name: "rack", description: "Query values · a, b" },
diff --git a/web/src/utils/dashboard/variableSuggestions.ts b/web/src/utils/dashboard/variableSuggestions.ts
index 6385182cde..d9e4dbf89a 100644
--- a/web/src/utils/dashboard/variableSuggestions.ts
+++ b/web/src/utils/dashboard/variableSuggestions.ts
@@ -13,7 +13,12 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { VARIABLE_FORMATS, type VariableFormat } from "@/utils/dashboard/variables/variablesUtils";
+import {
+  DATE_VARIABLE_FORMATS,
+  LIST_VARIABLE_FORMATS,
+  formatDateVariableValue,
+  type DateVariableFormat,
+} from "@/utils/dashboard/variables/variablesUtils";
 import { raw, type I18nText, type TranslateFn } from "@/types/i18n";
 import type { TemplateSuggestion } from "@/lib/forms/TemplateInput/OTemplateInput.types";
 
@@ -23,17 +28,25 @@ export interface VariableSuggestionContext {
 }
 
 // Ad hoc filters hold filter objects, not a printable value.
-const TEXT_VARIABLE_TYPES = ["query_values", "custom", "constant", "textbox"] as const;
+const TEXT_VARIABLE_TYPES = ["query_values", "custom", "constant", "textbox", "date"] as const;
 
 const LIST_EXAMPLE = raw("a, b");
 
-const FORMAT_EXAMPLES: Record<VariableFormat, I18nText> = {
+type ListVariableFormat = (typeof LIST_VARIABLE_FORMATS)[number];
+
+// Fixed day, so every example reads the same whatever the date variable holds.
+const DATE_EXAMPLE = "2026-03-08";
+
+const FORMAT_EXAMPLES: Record<ListVariableFormat, I18nText> = {
   csv: raw("a,b"),
   pipe: raw("a|b"),
   doublequote: raw('"a","b"'),
   singlequote: raw("'a','b'"),
 };
 
+const dateExample = (format: DateVariableFormat): I18nText =>
+  raw(formatDateVariableValue(DATE_EXAMPLE, format) ?? DATE_EXAMPLE);
+
 const isVisibleIn = (variable: any, context?: VariableSuggestionContext): boolean => {
   if (!context) return true;
   if (variable?.scope === "tabs") return (variable.tabs ?? []).includes(context.tabId);
@@ -41,7 +54,7 @@ const isVisibleIn = (variable: any, context?: VariableSuggestionContext): boolea
   return true;
 };
 
-/** Variables a text field can reference, as `$` suggestions: every name, plus one per list format for multi-select variables. */
+/** Variables a text field can reference, as `$` suggestions: every name, plus one per list format for multi-select variables and one per date format for date variables. */
 export const getVariableSuggestions = (
   variables: any[] | null | undefined,
   t: TranslateFn,
@@ -52,8 +65,9 @@ export const getVariableSuggestions = (
     custom: t("panel.variableSuggestion.custom"),
     constant: t("panel.variableSuggestion.constant"),
     textbox: t("panel.variableSuggestion.textbox"),
+    date: t("panel.variableSuggestion.date"),
   };
-  const formatLabels: Record<VariableFormat, I18nText> = {
+  const formatLabels: Record<ListVariableFormat, I18nText> = {
     csv: t("panel.variableSuggestion.csv", { example: FORMAT_EXAMPLES.csv }),
     pipe: t("panel.variableSuggestion.pipe", { example: FORMAT_EXAMPLES.pipe }),
     doublequote: t("panel.variableSuggestion.doublequote", {
@@ -63,6 +77,14 @@ export const getVariableSuggestions = (
       example: FORMAT_EXAMPLES.singlequote,
     }),
   };
+  const dateFormatLabels: Record<DateVariableFormat, I18nText> = {
+    iso: t("panel.variableSuggestion.dateIso", { example: dateExample("iso") }),
+    dmy: t("panel.variableSuggestion.dateDmy", { example: dateExample("dmy") }),
+    mdy: t("panel.variableSuggestion.dateMdy", { example: dateExample("mdy") }),
+    epoch: t("panel.variableSuggestion.dateEpoch", { example: dateExample("epoch") }),
+    epochms: t("panel.variableSuggestion.dateEpochms", { example: dateExample("epochms") }),
+    epochus: t("panel.variableSuggestion.dateEpochus", { example: dateExample("epochus") }),
+  };
   const seen = new Set<string>();
   return (variables ?? []).flatMap((variable: any): TemplateSuggestion[] => {
     const name = variable?.name;
@@ -71,6 +93,15 @@ export const getVariableSuggestions = (
     if (!isVisibleIn(variable, context)) return [];
     seen.add(name);
     const typeLabel = typeLabels[type];
+    if (type === "date") {
+      return [
+        { name, description: typeLabel },
+        ...DATE_VARIABLE_FORMATS.map((format) => ({
+          name: `${name}:${format}`,
+          description: dateFormatLabels[format],
+        })),
+      ];
+    }
     const isList = variable.multiSelect === true && (type === "query_values" || type === "custom");
     if (!isList) return [{ name, description: typeLabel }];
     return [
@@ -78,7 +109,7 @@ export const getVariableSuggestions = (
         name,
         description: t("panel.variableSuggestion.list", { type: typeLabel, example: LIST_EXAMPLE }),
       },
-      ...VARIABLE_FORMATS.map((format) => ({
+      ...LIST_VARIABLE_FORMATS.map((format) => ({
         name: `${name}:${format}`,
         description: formatLabels[format],
       })),
diff --git a/web/src/utils/dashboard/variables/variablesUtils.spec.ts b/web/src/utils/dashboard/variables/variablesUtils.spec.ts
index 2e735ce94a..b97ed6fa82 100644
--- a/web/src/utils/dashboard/variables/variablesUtils.spec.ts
+++ b/web/src/utils/dashboard/variables/variablesUtils.spec.ts
@@ -15,6 +15,9 @@
 
 import { describe, expect, it } from "vitest";
 import {
+  DATE_VARIABLE_FORMATS,
+  formatDateVariable,
+  formatDateVariableValue,
   formatInterval,
   getTimeInSecondsBasedOnUnit,
   formatRateInterval,
@@ -990,4 +993,154 @@ describe("Variables Utils", () => {
       );
     });
   });
+
+  describe("formatDateVariableValue", () => {
+    it("formats the six named formats", () => {
+      expect(formatDateVariableValue("2026-03-08", "iso")).toBe("2026-03-08");
+      expect(formatDateVariableValue("2026-03-08", "dmy")).toBe("08/03/2026");
+      expect(formatDateVariableValue("2026-03-08", "mdy")).toBe("03/08/2026");
+      expect(formatDateVariableValue("2026-03-08", "epoch")).toBe("1772928000");
+      expect(formatDateVariableValue("2026-03-08", "epochms")).toBe("1772928000000");
+      expect(formatDateVariableValue("2026-03-08", "epochus")).toBe("1772928000000000");
+    });
+
+    it("lists every format and tries the longer epoch names first", () => {
+      expect([...DATE_VARIABLE_FORMATS]).toEqual([
+        "iso",
+        "dmy",
+        "mdy",
+        "epochms",
+        "epochus",
+        "epoch",
+      ]);
+    });
+
+    it("gives 00:00 UTC of the date for every epoch format", () => {
+      expect(formatDateVariableValue("2026-07-01", "epoch")).toBe("1782864000");
+      expect(formatDateVariableValue("2026-07-01", "epochms")).toBe("1782864000000");
+      expect(formatDateVariableValue("2026-07-01", "epochus")).toBe("1782864000000000");
+      expect(formatDateVariableValue("1969-12-31", "epoch")).toBe("-86400");
+    });
+
+    it("returns undefined for empty, malformed or impossible dates", () => {
+      for (const bad of [
+        "",
+        null,
+        undefined,
+        5,
+        "2026-3-8",
+        "2026-02-30",
+        "2026-13-01",
+        " 2026-03-08",
+        "2026-03-08T00:00",
+      ]) {
+        expect(formatDateVariableValue(bad, "iso")).toBeUndefined();
+      }
+      expect(formatDateVariableValue("2028-02-29", "iso")).toBe("2028-02-29");
+      expect(formatDateVariableValue("2026-02-29", "iso")).toBeUndefined();
+    });
+  });
+
+  describe("formatDateVariable", () => {
+    const date = { type: "date", value: "2026-03-08", dateFormat: "dmy" };
+
+    it("uses the variable's dateFormat, defaulting to iso", () => {
+      expect(formatDateVariable(date)).toBe("08/03/2026");
+      expect(formatDateVariable({ ...date, dateFormat: undefined })).toBe("2026-03-08");
+      expect(formatDateVariable({ ...date, dateFormat: "bogus" })).toBe("2026-03-08");
+    });
+
+    it("lets a date format on the placeholder override the default", () => {
+      expect(formatDateVariable(date, "epochus")).toBe("1772928000000000");
+      expect(formatDateVariable(date, "mdy")).toBe("03/08/2026");
+    });
+
+    it("formats with the default for any other placeholder format", () => {
+      expect(formatDateVariable(date, "csv")).toBe("08/03/2026");
+      expect(formatDateVariable(date, "percentencode")).toBe("08/03/2026");
+    });
+
+    it("returns undefined for a non-date variable or an unusable value", () => {
+      expect(formatDateVariable({ type: "textbox", value: "2026-03-08" }, "dmy")).toBeUndefined();
+      expect(formatDateVariable({ ...date, value: "" })).toBeUndefined();
+      expect(formatDateVariable({ ...date, value: "nope" })).toBeUndefined();
+      expect(formatDateVariable(null)).toBeUndefined();
+    });
+  });
+
+  describe("date formats in placeholders", () => {
+    it("parses date formats in all three placeholder styles", () => {
+      const resolve = (p: { name: string; format?: string }) => `${p.name}/${p.format ?? "-"}`;
+      expect(
+        replaceVariablePlaceholders("$d ${d:epochus} {{d:dmy}} ${ d : epoch }", ["d"], resolve),
+      ).toBe("d/- d/epochus d/dmy d/epoch");
+      expect(
+        replaceVariablePlaceholders(normalizeVariableSyntax("${ d : epochms }"), ["d"], resolve),
+      ).toBe("d/epochms");
+    });
+
+    it("matches format names case-sensitively", () => {
+      expect(replaceVariablePlaceholders("${d:EPOCH}", ["d"], () => "x")).toBe("${d:EPOCH}");
+    });
+
+    it("counts a placeholder with a date format as a reference", () => {
+      expect([...getReferencedVariableNames(["x ${d:epochus}"], ["d", "e"])]).toEqual(["d"]);
+    });
+  });
+
+  describe("processVariableContent with date variables", () => {
+    const data = (extra: Record<string, unknown> = {}) => ({
+      values: [
+        { name: "d", type: "date", value: "2026-03-08", scope: "global", ...extra },
+        { name: "t", type: "textbox", value: "2026-03-08", scope: "global" },
+      ],
+    });
+
+    it("prints the variable's default format", () => {
+      expect(processVariableContent("$d", data({ dateFormat: "dmy" }))).toBe("08/03/2026");
+      expect(processVariableContent("$d", data())).toBe("2026-03-08");
+    });
+
+    it("lets the placeholder override the default", () => {
+      expect(processVariableContent("${d:epoch}", data({ dateFormat: "dmy" }))).toBe("1772928000");
+      expect(processVariableContent("{{d:epochms}}", data())).toBe("1772928000000");
+    });
+
+    it("applies the formatted text to the other placeholder formats", () => {
+      expect(processVariableContent("?q=${d:percentencode}", data({ dateFormat: "dmy" }))).toBe(
+        "?q=08%2F03%2F2026",
+      );
+      expect(processVariableContent("${d:csv}", data({ dateFormat: "mdy" }))).toBe("03/08/2026");
+    });
+
+    it("ignores a date format on a non-date variable", () => {
+      expect(processVariableContent("${t:epochus} $t", data())).toBe("2026-03-08 2026-03-08");
+    });
+
+    it("renders an empty or malformed date as before", () => {
+      expect(
+        processVariableContent("$d", { values: [{ name: "d", type: "date", value: "" }] }),
+      ).toBe("");
+      expect(
+        processVariableContent("${d:dmy}", { values: [{ name: "d", type: "date", value: "x" }] }),
+      ).toBe("x");
+    });
+
+    it("uses the scope-resolved value", () => {
+      const scoped = {
+        values: [
+          { name: "d", type: "date", scope: "global", value: "2026-03-08", dateFormat: "dmy" },
+          {
+            name: "d",
+            type: "date",
+            scope: "tabs",
+            tabId: "t1",
+            value: "2026-04-01",
+            dateFormat: "dmy",
+          },
+        ],
+      };
+      expect(processVariableContent("$d", scoped, { tabId: "t1" })).toBe("01/04/2026");
+    });
+  });
 });
diff --git a/web/src/utils/dashboard/variables/variablesUtils.ts b/web/src/utils/dashboard/variables/variablesUtils.ts
index e65a967d8f..dd269f2e32 100644
--- a/web/src/utils/dashboard/variables/variablesUtils.ts
+++ b/web/src/utils/dashboard/variables/variablesUtils.ts
@@ -1,6 +1,16 @@
 import { SELECT_ALL_VALUE } from "@/utils/dashboard/constants";
 
-export const VARIABLE_FORMATS = ["csv", "pipe", "doublequote", "singlequote"] as const;
+/** List formats, for multi-value variables. */
+export const LIST_VARIABLE_FORMATS = ["csv", "pipe", "doublequote", "singlequote"] as const;
+
+/** Date formats, for `date` variables. Longer epoch names first so the placeholder regex tries them before `epoch`. */
+export const DATE_VARIABLE_FORMATS = ["iso", "dmy", "mdy", "epochms", "epochus", "epoch"] as const;
+
+export type DateVariableFormat = (typeof DATE_VARIABLE_FORMATS)[number];
+
+export const DEFAULT_DATE_VARIABLE_FORMAT: DateVariableFormat = "iso";
+
+export const VARIABLE_FORMATS = [...LIST_VARIABLE_FORMATS, ...DATE_VARIABLE_FORMATS] as const;
 
 const HTML_ENTITIES: Record<string, string> = {
   "&": "&amp;",
@@ -35,6 +45,65 @@ export interface VariablePlaceholder<F extends string = VariableFormat> {
   offset: number;
 }
 
+export const isDateVariableFormat = (format: unknown): format is DateVariableFormat =>
+  (DATE_VARIABLE_FORMATS as readonly unknown[]).includes(format);
+
+const DATE_VALUE_RE = /^(\d{4})-(\d{2})-(\d{2})$/;
+
+/** Formats a stored `YYYY-MM-DD` value; the epoch formats are 00:00 UTC of that day. Undefined when the value is not a real calendar date. */
+export const formatDateVariableValue = (
+  value: unknown,
+  format: DateVariableFormat | string | undefined,
+): string | undefined => {
+  if (typeof value !== "string") return undefined;
+  const match = DATE_VALUE_RE.exec(value);
+  if (!match) return undefined;
+  const [year, month, day] = [Number(match[1]), Number(match[2]), Number(match[3])];
+  const check = new Date(Date.UTC(year, month - 1, day));
+  // Date.UTC rolls 02-30 over to March, so compare the parts back
+  if (
+    check.getUTCFullYear() !== year ||
+    check.getUTCMonth() !== month - 1 ||
+    check.getUTCDate() !== day
+  ) {
+    return undefined;
+  }
+
+  switch (format) {
+    case "dmy":
+      return `${match[3]}/${match[2]}/${match[1]}`;
+    case "mdy":
+      return `${match[2]}/${match[3]}/${match[1]}`;
+    case "epoch":
+    case "epochms":
+    case "epochus": {
+      const ms = check.getTime();
+      if (format === "epoch") return String(Math.floor(ms / 1000));
+      return format === "epochms" ? String(ms) : String(ms * 1000);
+    }
+    default:
+      return value;
+  }
+};
+
+/**
+ * The text a date variable prints at a placeholder, or undefined when it is not a date variable
+ * or its value is empty or malformed (callers then render the value as they always did).
+ * A date format on the placeholder wins; any other placeholder format uses the variable's own `dateFormat`.
+ */
+export const formatDateVariable = (
+  variable: { type?: string; value?: unknown; dateFormat?: string } | null | undefined,
+  placeholderFormat?: string,
+): string | undefined => {
+  if (variable?.type !== "date") return undefined;
+  const format = isDateVariableFormat(placeholderFormat)
+    ? placeholderFormat
+    : isDateVariableFormat(variable.dateFormat)
+      ? variable.dateFormat
+      : DEFAULT_DATE_VARIABLE_FORMAT;
+  return formatDateVariableValue(variable.value, format);
+};
+
 export const formatInterval = (interval: any) => {
   switch (true) {
     // 0.01s
@@ -430,8 +499,10 @@ export const processVariableContent = (
   const resolvedVariables = resolveVariablesWithPrecedence(variablesData, context);
 
   const valuesByName = new Map<string, any>();
+  const variablesByName = new Map<string, any>();
   variablesData.values.forEach((variable: any) => {
     if (!variable.name || valuesByName.has(variable.name)) return;
+    variablesByName.set(variable.name, variable);
     valuesByName.set(
       variable.name,
       context && Object.prototype.hasOwnProperty.call(resolvedVariables, variable.name)
@@ -446,6 +517,8 @@ export const processVariableContent = (
     valuesByName.keys(),
     ({ name, format, offset }) => {
       let value = valuesByName.get(name);
+      // a date variable prints in its effective format, then the rest applies to that text
+      value = formatDateVariable({ ...variablesByName.get(name), value }, format) ?? value;
       const isUrlFormat = format === "percentencode" || format === "queryparam";
       const inQueryValue = QUERY_VALUE_PREFIX.test(
         processedContent.slice(Math.max(0, offset - 256), offset),
diff --git a/web/src/utils/dbm/breakdown.spec.ts b/web/src/utils/dbm/breakdown.spec.ts
index 361aa03d04..936d06eb46 100644
--- a/web/src/utils/dbm/breakdown.spec.ts
+++ b/web/src/utils/dbm/breakdown.spec.ts
@@ -17,7 +17,13 @@ import { describe, expect, it } from "vitest";
 
 import type { QueryStatsRow } from "@/services/db_monitoring";
 
-import { buildDatabaseBreakdown, rowNamespace, rowService, SHORTFALL_FLOOR } from "./breakdown";
+import {
+  buildDatabaseBreakdown,
+  namesNoSchema,
+  rowNamespace,
+  rowService,
+  SHORTFALL_FLOOR,
+} from "./breakdown";
 
 /**
  * The lab shape, verbatim from the live endpoint: the merged rows carry
@@ -55,6 +61,25 @@ describe("rowNamespace", () => {
   });
 });
 
+describe("namesNoSchema", () => {
+  it("tells a row with no schema from one spanning several", () => {
+    expect(namesNoSchema(row())).toBe(true);
+    expect(namesNoSchema(row({ namespaces: ["", ""] }))).toBe(true);
+    expect(namesNoSchema(row({ namespaces: ["a", "b"] }))).toBe(false);
+    expect(namesNoSchema(row({ namespaces: ["a"] }))).toBe(false);
+  });
+
+  it("keeps a multi-schema row out of the unnamed services", () => {
+    const result = buildDatabaseBreakdown([
+      row({ fingerprint: "m", namespaces: ["a", "b"], services: ["multi"] }),
+      row({ fingerprint: "n", services: ["noschema"], total_time_ns: 400 }),
+    ]);
+    expect(result.unnamed.map((node) => [node.name, node.totalTimeNs, node.share])).toEqual([
+      ["noschema", 400, 1],
+    ]);
+  });
+});
+
 describe("rowService", () => {
   it("prefers service_name", () => {
     expect(rowService(row({ service_name: "checkout", services: ["cart"] }))).toBe("checkout");
diff --git a/web/src/utils/dbm/breakdown.ts b/web/src/utils/dbm/breakdown.ts
index 0d1d0ea778..4ce6dc175e 100644
--- a/web/src/utils/dbm/breakdown.ts
+++ b/web/src/utils/dbm/breakdown.ts
@@ -85,6 +85,8 @@ export interface DbmBreakdown {
   levels: DbmBreakdownNode[];
   /** No row named a schema, so the schema tier was dropped as empty. */
   collapsed: boolean;
+  /** Services of the rows that named no schema at all; a row spanning several schemas is in none. */
+  unnamed: DbmBreakdownNode[];
   /** Time the fingerprint rows account for, nanoseconds. */
   attributedNs: number;
   /** The database row's own exact total, nanoseconds — `null` when unknown. */
@@ -113,6 +115,10 @@ export const rowNamespace = (row: QueryStatsRow): string | null => {
   return list.length === 1 ? list[0] : null;
 };
 
+/** Whether a row named no schema at all, as distinct from naming several. */
+export const namesNoSchema = (row: QueryStatsRow): boolean =>
+  !row.db_namespace && !(row.namespaces ?? []).some(Boolean);
+
 /**
  * The service that issued a row.
  *
@@ -245,6 +251,13 @@ export const buildDatabaseBreakdown = (
           return node;
         });
 
+  const schemaless = rows.filter(namesNoSchema);
+  const unnamed = serviceNodes(
+    schemaless,
+    schemaless.reduce((acc, row) => acc + num(row.total_time_ns), 0),
+    "service::",
+  );
+
   // Only a gap big enough to change how a share reads is worth a sentence; the
   // two grains are computed by different code paths and drift by rounding.
   const missing =
@@ -253,5 +266,5 @@ export const buildDatabaseBreakdown = (
       : null;
   const shortfall = missing !== null && missing >= SHORTFALL_FLOOR ? missing : null;
 
-  return { levels, collapsed, attributedNs, databaseTotalNs, shortfall };
+  return { levels, collapsed, unnamed, attributedNs, databaseTotalNs, shortfall };
 };
diff --git a/web/src/utils/dbm/breakdownRows.ts b/web/src/utils/dbm/breakdownRows.ts
index 98bbbec52d..c46e5a9249 100644
--- a/web/src/utils/dbm/breakdownRows.ts
+++ b/web/src/utils/dbm/breakdownRows.ts
@@ -36,8 +36,10 @@
  *    row would be a nesting level whose only content is a missing fact.
  */
 
-import type { DbmBreakdown, DbmBreakdownNode } from "@/utils/dbm/breakdown";
+import { SHORTFALL_FLOOR, type DbmBreakdown, type DbmBreakdownNode } from "@/utils/dbm/breakdown";
+import type { DbTotalsRow } from "@/services/db_monitoring";
 import { errorRate } from "@/utils/dbm/format";
+import { worstPercentile } from "@/utils/dbm/instanceRows";
 
 /**
  * Which tier of the split a child row came from.
@@ -190,6 +192,94 @@ export const toBreakdownRows = (
   });
 };
 
+/** The exact per-schema totals a schema row is built from. */
+export type DbmSchemaTotals = Pick<
+  DbTotalsRow,
+  "db_namespace" | "calls" | "errors" | "total_time_ns" | "p50_ns" | "p95_ns" | "p99_ns"
+>;
+
+const UNATTRIBUTED_KEY = "schema:\u0000none";
+
+const schemaRow = (
+  name: string | null,
+  rows: DbmSchemaTotals[],
+  services: DbmBreakdownNode[],
+  serverTotal: number,
+  parentKey: string,
+): DbmBreakdownRow => {
+  const key = `${parentKey}/${name === null ? UNATTRIBUTED_KEY : `schema:${name}`}`;
+  const calls = rows.reduce((acc, row) => acc + (row.calls ?? 0), 0);
+  const errors = rows.reduce((acc, row) => acc + (row.errors ?? 0), 0);
+  const time = rows.reduce((acc, row) => acc + (row.total_time_ns ?? 0), 0);
+  return {
+    rowKey: key,
+    kind: "schema",
+    name,
+    namespace: name,
+    service: null,
+    calls,
+    errors,
+    errorRate: errorRate(errors, calls),
+    total_time_ns: time,
+    share: serverTotal > 0 ? time / serverTotal : 0,
+    p50_ns: worstPercentile(rows, (row) => row.p50_ns) ?? null,
+    p95_ns: worstPercentile(rows, (row) => row.p95_ns) ?? null,
+    p99_ns: worstPercentile(rows, (row) => row.p99_ns) ?? null,
+    queryCount: services.reduce((acc, service) => acc + service.queryCount, 0),
+    status: null,
+    children: services.map((child) => serviceRow(child, name, key)),
+  };
+};
+
+/** A server's children from its exact schema totals, plus one row for its unnamed totals. */
+export const toSchemaRows = (
+  state: DbmBreakdownState | undefined,
+  schemas: DbmSchemaTotals[],
+  parentKey: string,
+): DbmBreakdownRow[] => {
+  const named = schemas.filter((schema) => !!schema.db_namespace);
+  if (!named.length) return toBreakdownRows(state, parentKey);
+  if (!state || state.loading) return [statusRow("loading", parentKey)];
+
+  const nodes = new Map<string, DbmBreakdownNode>();
+  if (!state.failed) {
+    for (const node of state.breakdown.collapsed ? [] : state.breakdown.levels) {
+      if (node.name) nodes.set(node.name, node);
+    }
+  }
+  const unnamed = schemas.filter((schema) => !schema.db_namespace);
+  const serverTotal = schemas.reduce((acc, schema) => acc + (schema.total_time_ns ?? 0), 0);
+
+  const rows = named.map((schema) => {
+    const name = schema.db_namespace as string;
+    return schemaRow(name, [schema], nodes.get(name)?.children ?? [], serverTotal, parentKey);
+  });
+  // A multi-schema statement's time sits in its schemas' totals, so listing it here would count it twice.
+  if (unnamed.length) {
+    const services = state.failed ? [] : state.breakdown.unnamed;
+    rows.push(schemaRow(null, unnamed, services, serverTotal, parentKey));
+  }
+  if (state.failed) rows.push(statusRow("error", parentKey));
+  return rows;
+};
+
+/** The share of the parent's time its children leave unaccounted, above the rounding floor. */
+export const childShortfall = (
+  children: DbmBreakdownRow[],
+  parentTotalNs: number | null | undefined,
+): number | null => {
+  if (!parentTotalNs || parentTotalNs <= 0) return null;
+  // A status row has no figures, so a split that is not in yet has no gap to state.
+  if (!children.some((child) => child.kind !== "status")) return null;
+  const covered = children.reduce((acc, child) => acc + child.total_time_ns, 0);
+  const missing = (parentTotalNs - covered) / parentTotalNs;
+  return missing >= SHORTFALL_FLOOR ? missing : null;
+};
+
+/** A schema row's own uncovered share; `null` on any other row and when nothing was attributed. */
+export const schemaShortfall = (row: DbmBreakdownRow): number | null =>
+  row.kind === "schema" ? childShortfall(row.children, row.total_time_ns) : null;
+
 /**
  * Whether this database's split may carry the coverage caveat.
  *
diff --git a/web/src/utils/dbm/fleetRows.spec.ts b/web/src/utils/dbm/fleetRows.spec.ts
index 95b9ad20db..f6fed12b4d 100644
--- a/web/src/utils/dbm/fleetRows.spec.ts
+++ b/web/src/utils/dbm/fleetRows.spec.ts
@@ -475,6 +475,33 @@ describe("unionFleetRows with server-vantage instances", () => {
     );
     expect(withOption).toEqual(without);
   });
+
+  it("adds no trafficless or engine-only row under a Schema filter", () => {
+    const rows = unionFleetRows(
+      [totalsRow({ db_instance: "pgprod-1", db_namespace: "orders" })],
+      new Map([
+        ["postgresql|pgprod-1", metrics()],
+        ["postgresql|idle-replica", metrics()],
+      ]),
+      {
+        namespace: "orders",
+        serverInstances: [
+          { db_system: "postgresql", db_instance: "pg-reporting" },
+          { db_system: "mysql", db_instance: null },
+        ],
+      },
+    );
+    expect(rows.map((r) => [r.db_instance, r.trafficless])).toEqual([["pgprod-1", false]]);
+    expect(rows[0].metrics?.state).toBe("matched");
+  });
+
+  it("leaves nothing to render when the Schema filter matched no traffic", () => {
+    const rows = unionFleetRows([], new Map([["postgresql|idle-replica", metrics()]]), {
+      namespace: "stale-schema",
+      serverInstances: [{ db_system: "postgresql", db_instance: "pg-reporting" }],
+    });
+    expect(rows).toEqual([]);
+  });
 });
 
 // ── the server-vantage ref dedupe ────────────────────────────────────────────
diff --git a/web/src/utils/dbm/fleetRows.ts b/web/src/utils/dbm/fleetRows.ts
index 0ac5c10678..9ec5b33740 100644
--- a/web/src/utils/dbm/fleetRows.ts
+++ b/web/src/utils/dbm/fleetRows.ts
@@ -175,6 +175,8 @@ export const unionFleetRows = (
   metricsByKey: Map<string, DbmInstanceMetricSet>,
   context: DbmMergeContext & {
     system?: string | null;
+    /** The Schema filter; only query traffic can show a server holds that schema. */
+    namespace?: string | null;
     /** Instances `_o2_dbm_server` rows name — the second discovery source. */
     serverInstances?: readonly DbmServerInstanceRef[];
   } = {},
@@ -194,16 +196,15 @@ export const unionFleetRows = (
     if (aliasKey) claimed.add(aliasKey);
     return {
       ...row,
-      // The client grain includes the NAMESPACE — one host serving two
-      // databases is two rows — while an instance identity does not. Keying a
-      // client row on the identity would collapse those two onto one id and
-      // render one of them twice.
+      // Namespace included, so per-schema input rows on one instance never share an id.
       rowKey: clientRowKey(row),
       trafficless: false,
       metrics: resolveRowMetrics(row.db_system, row.db_instance, metricsByKey, context),
     };
   });
 
+  if (context.namespace) return clientRows;
+
   // Both non-client vantages, folded onto one identity key so an instance
   // they both report appears exactly once — with the metric set when the
   // metrics read has one, and `null` when only a `_o2_dbm_server` row names it.
diff --git a/web/src/utils/dbm/instanceRows.spec.ts b/web/src/utils/dbm/instanceRows.spec.ts
new file mode 100644
index 0000000000..71eb0ae97d
--- /dev/null
+++ b/web/src/utils/dbm/instanceRows.spec.ts
@@ -0,0 +1,461 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, expect, it } from "vitest";
+
+import type { DbTotalsRow, QueryStatsRow } from "@/services/db_monitoring";
+import { buildDatabaseBreakdown } from "@/utils/dbm/breakdown";
+import { childShortfall, schemaShortfall, toSchemaRows } from "@/utils/dbm/breakdownRows";
+import {
+  drowningInstanceKeys,
+  foldByInstance,
+  hasWorstOfPercentiles,
+  instanceKey,
+  isCriticalServer,
+  serverRowKey,
+} from "@/utils/dbm/instanceRows";
+
+const totals = (over: Partial<DbTotalsRow> = {}): DbTotalsRow => ({
+  db_system: "postgresql",
+  db_instance: "o2dev",
+  ...over,
+});
+
+/** The shape the live O2-introspection org returned: one host, many databases. */
+const o2dev = [
+  totals({
+    db_namespace: "o2dev",
+    calls: 300,
+    errors: 3,
+    total_time_ns: 9_000,
+    p95_ns: 30,
+    max_ns: 50,
+    qps: 0.3,
+    calling_services: ["o2-dbm-agent"],
+  }),
+  totals({
+    db_namespace: "postgres",
+    calls: 100,
+    total_time_ns: 1_000,
+    p95_ns: 10,
+    max_ns: 90,
+    qps: 0.1,
+    calling_services: ["o2-dbm-agent", "pgbouncer"],
+  }),
+  totals({ db_instance: "valkey-cart", db_system: "redis", db_namespace: "", calls: 5 }),
+  totals({ db_namespace: "o2alpha", calls: 0, total_time_ns: 5_000 }),
+];
+
+describe("foldByInstance", () => {
+  it("returns one row per (system, instance), whatever the schema count", () => {
+    const folded = foldByInstance(o2dev);
+    expect(folded.map((row) => row.db_instance)).toEqual(["o2dev", "valkey-cart"]);
+  });
+
+  it("sums the additive figures exactly and keeps the worst max", () => {
+    const [server] = foldByInstance(o2dev);
+    expect(server.calls).toBe(400);
+    expect(server.errors).toBe(3);
+    expect(server.total_time_ns).toBe(15_000);
+    expect(server.qps).toBeCloseTo(0.4);
+    expect(server.max_ns).toBe(90);
+  });
+
+  it("takes the worst schema's percentile, never a mean of them", () => {
+    const [server] = foldByInstance(o2dev);
+    expect(server.p95_ns).toBe(30);
+    expect(server.p50_ns).toBeUndefined();
+  });
+
+  it("unions the calling services", () => {
+    const [server] = foldByInstance(o2dev);
+    expect(server.calling_services).toEqual(["o2-dbm-agent", "pgbouncer"]);
+  });
+
+  it("names no namespace for a multi-schema server, and keeps the only one otherwise", () => {
+    const [server, redis] = foldByInstance(o2dev);
+    expect(server.db_namespace).toBeUndefined();
+    expect(redis.db_namespace).toBe("");
+  });
+
+  it("lists the named schemas, so one named schema beside unnamed traffic is still named", () => {
+    const [server] = foldByInstance(o2dev);
+    expect(server.namedSchemas).toEqual(["o2dev", "o2alpha", "postgres"]);
+    const [mixed] = foldByInstance([
+      totals({ db_namespace: "orders", calls: 10, total_time_ns: 100 }),
+      totals({ db_namespace: "", calls: 4, total_time_ns: 40 }),
+    ]);
+    expect(mixed.db_namespace).toBeUndefined();
+    expect(mixed.namedSchemas).toEqual(["orders"]);
+  });
+
+  it("keys a server row on its identity alone, whatever schemas fold into it", () => {
+    const [all] = foldByInstance(o2dev);
+    const [one] = foldByInstance(o2dev, "postgres");
+    expect(serverRowKey(all)).toBe(serverRowKey(one));
+    expect(serverRowKey(all)).not.toBe(serverRowKey(foldByInstance(o2dev)[1]));
+  });
+
+  it("keeps the schemas heaviest first", () => {
+    const [server] = foldByInstance(o2dev);
+    expect(server.schemas.map((row) => row.db_namespace)).toEqual(["o2dev", "o2alpha", "postgres"]);
+  });
+
+  it("narrows to one schema under the Schema filter and drops servers without it", () => {
+    const folded = foldByInstance(o2dev, "postgres");
+    expect(folded).toHaveLength(1);
+    expect(folded[0].db_namespace).toBe("postgres");
+    expect(folded[0].calls).toBe(100);
+    expect(folded[0].p95_ns).toBe(10);
+  });
+});
+
+describe("toSchemaRows", () => {
+  const split: QueryStatsRow[] = [
+    {
+      fingerprint: "a",
+      db_system: "postgresql",
+      db_instance: "o2dev",
+      db_namespace: "o2dev",
+      service_name: "o2-dbm-agent",
+      calls: 10,
+      total_time_ns: 4_000,
+    },
+  ];
+  const state = (rows: QueryStatsRow[]) => ({
+    breakdown: buildDatabaseBreakdown(rows),
+    loading: false,
+    failed: false,
+  });
+
+  it("builds one schema child per schema from the exact totals", () => {
+    const [server] = foldByInstance(o2dev);
+    const children = toSchemaRows(state(split), server.schemas, "p");
+    expect(children.map((child) => [child.kind, child.name, child.calls])).toEqual([
+      ["schema", "o2dev", 300],
+      ["schema", "o2alpha", 0],
+      ["schema", "postgres", 100],
+    ]);
+    expect(children[0].share).toBeCloseTo(9_000 / 15_000);
+  });
+
+  it("hangs the split's services under their own schema only", () => {
+    const [server] = foldByInstance(o2dev);
+    const [o2devRow, o2alpha] = toSchemaRows(state(split), server.schemas, "p");
+    expect(o2devRow.children.map((child) => child.name)).toEqual(["o2-dbm-agent"]);
+    expect(o2devRow.queryCount).toBe(1);
+    expect(o2alpha.children).toEqual([]);
+  });
+
+  it("keeps the schemas and says the split failed when it did", () => {
+    const [server] = foldByInstance(o2dev);
+    const children = toSchemaRows({ ...state([]), failed: true }, server.schemas, "p");
+    expect(children.map((child) => [child.kind, child.status])).toEqual([
+      ["schema", null],
+      ["schema", null],
+      ["schema", null],
+      ["status", "error"],
+    ]);
+    expect(children[3].rowKey).toBe("p/status");
+  });
+
+  it("adds one trailing child for traffic no single schema owns, so the children add up", () => {
+    const schemas = [
+      totals({ db_namespace: "orders", calls: 600, total_time_ns: 6_000, p95_ns: 40 }),
+      totals({ db_namespace: "", calls: 200, errors: 2, total_time_ns: 3_000, p95_ns: 90 }),
+      totals({ db_namespace: "billing", calls: 100, total_time_ns: 1_000, p95_ns: 20 }),
+    ];
+    const [server] = foldByInstance(schemas);
+    const splitRows: QueryStatsRow[] = [
+      {
+        fingerprint: "f1",
+        db_system: "postgresql",
+        db_instance: "o2dev",
+        db_namespace: "orders",
+        service_name: "checkout",
+        calls: 500,
+        total_time_ns: 5_000,
+      },
+      {
+        fingerprint: "f2",
+        db_system: "postgresql",
+        db_instance: "o2dev",
+        namespaces: ["orders", "billing"],
+        service_name: "healthcheck",
+        calls: 50,
+        total_time_ns: 500,
+      },
+      {
+        fingerprint: "f3",
+        db_system: "postgresql",
+        db_instance: "o2dev",
+        service_name: "migrator",
+        calls: 150,
+        total_time_ns: 2_500,
+      },
+    ];
+    const children = toSchemaRows(state(splitRows), server.schemas, "p");
+    expect(children.map((child) => [child.name, child.calls])).toEqual([
+      ["orders", 600],
+      ["billing", 100],
+      [null, 200],
+    ]);
+    const unattributed = children[2];
+    expect(unattributed.kind).toBe("schema");
+    expect(unattributed.errors).toBe(2);
+    expect(unattributed.p95_ns).toBe(90);
+    expect(unattributed.children.map((child) => child.name)).toEqual(["migrator"]);
+    const time = children.reduce((acc, child) => acc + child.total_time_ns, 0);
+    expect(time).toBe(server.total_time_ns);
+    expect(children.reduce((acc, child) => acc + child.share, 0)).toBeCloseTo(1);
+    expect(childShortfall(children, server.total_time_ns)).toBeNull();
+  });
+
+  it("counts a multi-schema statement once: no unattributed child without unnamed totals", () => {
+    const [server] = foldByInstance([
+      totals({ db_namespace: "orders", calls: 600, total_time_ns: 6_000, p95_ns: 40 }),
+      totals({ db_namespace: "billing", calls: 100, total_time_ns: 1_000, p95_ns: 20 }),
+    ]);
+    const children = toSchemaRows(
+      state([
+        {
+          fingerprint: "f1",
+          db_system: "postgresql",
+          db_instance: "o2dev",
+          db_namespace: "orders",
+          service_name: "checkout",
+          calls: 500,
+          total_time_ns: 5_000,
+        },
+        {
+          fingerprint: "f2",
+          db_system: "postgresql",
+          db_instance: "o2dev",
+          namespaces: ["orders", "billing"],
+          service_name: "healthcheck",
+          calls: 50,
+          total_time_ns: 500,
+        },
+      ]),
+      server.schemas,
+      "p",
+    );
+    expect(children.map((child) => child.name)).toEqual(["orders", "billing"]);
+    expect(children.reduce((acc, child) => acc + child.total_time_ns, 0)).toBe(
+      server.total_time_ns,
+    );
+    expect(children.reduce((acc, child) => acc + child.calls, 0)).toBe(server.calls);
+  });
+
+  it("takes the unattributed figures from unnamed totals, never a multi-schema statement's", () => {
+    const [server] = foldByInstance([
+      totals({ db_namespace: "orders", calls: 600, total_time_ns: 6_000 }),
+      totals({ db_namespace: "", calls: 40, errors: 1, total_time_ns: 400, p99_ns: 70 }),
+    ]);
+    const children = toSchemaRows(
+      state([
+        {
+          fingerprint: "f9",
+          db_system: "postgresql",
+          db_instance: "o2dev",
+          namespaces: ["orders", "reports"],
+          service_name: "healthcheck",
+          calls: 900,
+          total_time_ns: 9_000,
+          p99_ns: 999,
+        },
+      ]),
+      server.schemas,
+      "p",
+    );
+    const unattributed = children[1];
+    expect([unattributed.name, unattributed.calls, unattributed.errors]).toEqual([null, 40, 1]);
+    expect(unattributed.total_time_ns).toBe(400);
+    expect(unattributed.p99_ns).toBe(70);
+    expect(unattributed.children).toEqual([]);
+    expect(children.reduce((acc, child) => acc + child.total_time_ns, 0)).toBe(
+      server.total_time_ns,
+    );
+  });
+
+  it("states the shortfall when the children do not cover the parent", () => {
+    const children = toSchemaRows(
+      state(split),
+      [totals({ db_namespace: "o2dev", calls: 300, total_time_ns: 9_000 })],
+      "p",
+    );
+    expect(childShortfall(children, 9_000)).toBeNull();
+    expect(childShortfall(children, 12_000)).toBeCloseTo(0.25);
+  });
+
+  describe("a server with one named schema beside unnamed traffic", () => {
+    const [server] = foldByInstance([
+      totals({ db_namespace: "app", calls: 100, total_time_ns: 100, p95_ns: 5 }),
+      totals({ db_namespace: "", calls: 10, total_time_ns: 10, p95_ns: 50 }),
+    ]);
+    const split: QueryStatsRow[] = [
+      {
+        fingerprint: "a",
+        db_system: "postgresql",
+        db_instance: "o2dev",
+        namespaces: ["app", "billing"],
+        service_name: "multi",
+        calls: 60,
+        total_time_ns: 60,
+      },
+      {
+        fingerprint: "b",
+        db_system: "postgresql",
+        db_instance: "o2dev",
+        service_name: "noschema",
+        calls: 10,
+        total_time_ns: 10,
+      },
+      {
+        fingerprint: "c",
+        db_system: "postgresql",
+        db_instance: "o2dev",
+        db_namespace: "app",
+        service_name: "appsvc",
+        calls: 30,
+        total_time_ns: 30,
+      },
+    ];
+    const children = toSchemaRows(
+      {
+        breakdown: buildDatabaseBreakdown(split, server.total_time_ns),
+        loading: false,
+        failed: false,
+      },
+      server.schemas,
+      "k",
+    );
+
+    it("lists only schema-less statements under the unnamed child", () => {
+      const unnamed = children[1];
+      expect([unnamed.name, unnamed.total_time_ns]).toEqual([null, 10]);
+      expect(unnamed.children.map((child) => [child.name, child.total_time_ns])).toEqual([
+        ["noschema", 10],
+      ]);
+    });
+
+    it("states a schema's own shortfall when its services cover less than its total", () => {
+      const [app, unnamed] = children;
+      expect(app.children.map((child) => child.name)).toEqual(["appsvc"]);
+      expect(schemaShortfall(app)).toBeCloseTo(0.7);
+      expect(schemaShortfall(unnamed)).toBeNull();
+      expect(schemaShortfall(app.children[0])).toBeNull();
+    });
+
+    it("states no shortfall for a schema nothing was attributed to", () => {
+      const [, empty] = toSchemaRows(
+        { breakdown: buildDatabaseBreakdown(split), loading: false, failed: false },
+        [...server.schemas, totals({ db_namespace: "reports", calls: 4, total_time_ns: 40 })],
+        "k",
+      );
+      expect([empty.name, empty.children]).toEqual(["reports", []]);
+      expect(schemaShortfall(empty)).toBeNull();
+    });
+
+    it("states no shortfall while the split is still loading", () => {
+      const loading = toSchemaRows(
+        { breakdown: buildDatabaseBreakdown(split), loading: true, failed: false },
+        server.schemas,
+        "k",
+      );
+      expect(childShortfall(loading, server.total_time_ns)).toBeNull();
+      expect(childShortfall(toSchemaRows(undefined, server.schemas, "k"), 110)).toBeNull();
+    });
+
+    it("counts the server's speeds as a worst-of over its rows", () => {
+      expect(hasWorstOfPercentiles([server])).toBe(true);
+      expect(
+        hasWorstOfPercentiles(foldByInstance([totals({ db_namespace: "app", calls: 1 })])),
+      ).toBe(false);
+    });
+  });
+
+  it("shows a loading placeholder until the split is filed", () => {
+    const [server] = foldByInstance(o2dev);
+    expect(toSchemaRows(undefined, server.schemas, "p")[0].kind).toBe("status");
+  });
+
+  it("drops straight to services when no schema was named", () => {
+    const redis = foldByInstance(o2dev)[1];
+    const children = toSchemaRows(
+      state([
+        {
+          fingerprint: "r",
+          db_system: "redis",
+          db_instance: "valkey-cart",
+          service_name: "cart",
+          calls: 5,
+          total_time_ns: 10,
+        },
+      ]),
+      redis.schemas,
+      "r",
+    );
+    expect(children.map((child) => [child.kind, child.name])).toEqual([["service", "cart"]]);
+  });
+});
+
+describe("drowningInstanceKeys", () => {
+  const slow = 400_000_000;
+  const normal = 100_000_000;
+  const now = [
+    totals({ db_namespace: "orders", calls: 5_000, total_time_ns: 9e12, p95_ns: 500_000_000 }),
+    totals({ db_namespace: "reports", calls: 200, total_time_ns: 1e11, p95_ns: slow }),
+    totals({ db_instance: "pg-billing", db_namespace: "billing", calls: 900, p95_ns: normal }),
+  ];
+  const before = [
+    totals({ db_namespace: "orders", calls: 5_000, total_time_ns: 9e12, p95_ns: 500_000_000 }),
+    totals({ db_namespace: "reports", calls: 200, total_time_ns: 1e10, p95_ns: normal }),
+    totals({ db_instance: "pg-billing", db_namespace: "billing", calls: 900, p95_ns: normal }),
+  ];
+
+  it("flags the server when one schema slows down, though its worst p95 did not move", () => {
+    expect([...drowningInstanceKeys(now, before)]).toEqual([instanceKey(now[0])]);
+  });
+
+  it("compares schema to schema even when the server's schema count changed", () => {
+    expect([...drowningInstanceKeys(now, before.slice(1))]).toEqual([instanceKey(now[0])]);
+  });
+
+  it("honours the Schema filter", () => {
+    expect(drowningInstanceKeys(now, before, "orders").size).toBe(0);
+    expect(drowningInstanceKeys(now, before, "reports").size).toBe(1);
+  });
+});
+
+describe("isCriticalServer", () => {
+  it("is critical when one schema fails critically, even if the server's rate is diluted", () => {
+    const [server] = foldByInstance([
+      totals({ db_namespace: "orders", calls: 1_000, errors: 5 }),
+      totals({ db_namespace: "reports", calls: 30, errors: 3 }),
+    ]);
+    expect(isCriticalServer(server)).toBe(true);
+  });
+
+  it("keeps the server rule", () => {
+    const [server] = foldByInstance([
+      totals({ db_namespace: "orders", calls: 15, errors: 1 }),
+      totals({ db_namespace: "reports", calls: 15, errors: 1 }),
+    ]);
+    expect(isCriticalServer(server)).toBe(true);
+    const [calm] = foldByInstance([totals({ db_namespace: "orders", calls: 1_000, errors: 1 })]);
+    expect(isCriticalServer(calm)).toBe(false);
+  });
+});
diff --git a/web/src/utils/dbm/instanceRows.ts b/web/src/utils/dbm/instanceRows.ts
new file mode 100644
index 0000000000..f8546af560
--- /dev/null
+++ b/web/src/utils/dbm/instanceRows.ts
@@ -0,0 +1,131 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+// db_totals arrives per schema, but the reader's unit is the server, so rows fold here.
+
+import type { DbTotalsRow } from "@/services/db_monitoring";
+import { detectDrowningDatabases, isCriticalErrorRate } from "@/utils/dbm/insights";
+
+/** A server row, with the per-schema rows it was folded from. */
+export interface DbmInstanceTotals extends DbTotalsRow {
+  /** The per-namespace rows, heaviest first. Always at least one. */
+  schemas: DbTotalsRow[];
+  /** The schemas that carry a name, heaviest first. */
+  namedSchemas: string[];
+}
+
+const num = (value: number | undefined | null): number =>
+  typeof value === "number" && Number.isFinite(value) ? value : 0;
+
+/** NUL-separated, like `totalsKey`: no host or engine name can contain it. */
+export const instanceKey = (row: Pick<DbTotalsRow, "db_system" | "db_instance">): string =>
+  `${row.db_system}\u0000${row.db_instance}`;
+
+/** The table identity of a server row; it must not move when the schema count or filter does. */
+export const serverRowKey = (row: Pick<DbTotalsRow, "db_system" | "db_instance">): string =>
+  `db\u0000${instanceKey(row)}`;
+
+/** Whether a namespace-grain row falls inside the Schema filter. */
+export const inSchema = (row: Pick<DbTotalsRow, "db_namespace">, namespace?: string | null) =>
+  !namespace || (row.db_namespace ?? "") === namespace;
+
+/** Percentiles cannot be pooled, so a group reports its worst; `undefined` when none reported. */
+export const worstPercentile = <T>(
+  rows: T[],
+  pick: (row: T) => number | null | undefined,
+): number | undefined => {
+  const values = rows
+    .map(pick)
+    .filter((v): v is number => typeof v === "number" && Number.isFinite(v));
+  return values.length ? Math.max(...values) : undefined;
+};
+
+const optionalSum = (
+  rows: DbTotalsRow[],
+  pick: (row: DbTotalsRow) => number | undefined,
+): number | undefined =>
+  rows.some((row) => typeof pick(row) === "number")
+    ? rows.reduce((acc, row) => acc + num(pick(row)), 0)
+    : undefined;
+
+const foldOne = (rows: DbTotalsRow[]): DbmInstanceTotals => {
+  const [first] = rows;
+  const schemas = [...rows].sort((a, b) => num(b.total_time_ns) - num(a.total_time_ns));
+  const names = [...new Set(rows.map((row) => row.db_namespace ?? ""))];
+  return {
+    db_system: first.db_system,
+    db_instance: first.db_instance,
+    // A server row stands for all its schemas, so it names one only when it holds exactly one.
+    db_namespace: names.length === 1 ? first.db_namespace : undefined,
+    statements: optionalSum(rows, (row) => row.statements),
+    calls: optionalSum(rows, (row) => row.calls),
+    errors: optionalSum(rows, (row) => row.errors),
+    total_time_ns: optionalSum(rows, (row) => row.total_time_ns),
+    traces: optionalSum(rows, (row) => row.traces),
+    qps: optionalSum(rows, (row) => row.qps),
+    p50_ns: worstPercentile(rows, (row) => row.p50_ns),
+    p95_ns: worstPercentile(rows, (row) => row.p95_ns),
+    p99_ns: worstPercentile(rows, (row) => row.p99_ns),
+    max_ns: worstPercentile(rows, (row) => row.max_ns),
+    trace_stream_name: first.trace_stream_name,
+    calling_services: [
+      ...new Set(rows.flatMap((row) => row.calling_services ?? []).filter(Boolean)),
+    ],
+    schemas,
+    namedSchemas: [
+      ...new Set(schemas.map((row) => row.db_namespace).filter((name): name is string => !!name)),
+    ],
+  };
+};
+
+/** One row per (system, instance); under the Schema filter a server without it drops out. */
+export const foldByInstance = (
+  rows: DbTotalsRow[],
+  namespace?: string | null,
+): DbmInstanceTotals[] => {
+  const groups = new Map<string, DbTotalsRow[]>();
+  for (const row of rows) {
+    if (!inSchema(row, namespace)) continue;
+    const key = instanceKey(row);
+    const group = groups.get(key);
+    if (group) group.push(row);
+    else groups.set(key, [row]);
+  }
+  return [...groups.values()].map(foldOne);
+};
+
+/** Whether any server's speeds are the worst of several db_totals rows rather than its own. */
+export const hasWorstOfPercentiles = (rows: { schemas?: DbTotalsRow[] }[]): boolean =>
+  rows.some((row) => (row.schemas?.length ?? 0) > 1);
+
+/** The servers with a schema slowing against its own baseline, by `instanceKey`. */
+export const drowningInstanceKeys = (
+  rows: DbTotalsRow[],
+  previousRows: DbTotalsRow[],
+  namespace?: string | null,
+): Set<string> =>
+  new Set(
+    detectDrowningDatabases(
+      rows.filter((row) => inSchema(row, namespace)),
+      previousRows.filter((row) => inSchema(row, namespace)),
+    ).map((found) => instanceKey(found.row)),
+  );
+
+/** A server is critical on its own rate, or when any one schema's rate is critical. */
+export const isCriticalServer = (
+  row: Pick<DbTotalsRow, "errors" | "calls"> & { schemas?: DbTotalsRow[] },
+): boolean =>
+  isCriticalErrorRate(row.errors, row.calls) ||
+  (row.schemas ?? []).some((schema) => isCriticalErrorRate(schema.errors, schema.calls));
diff --git a/web/src/utils/oncall.spec.ts b/web/src/utils/oncall.spec.ts
index 97c07f0b95..1145c8ffbe 100644
--- a/web/src/utils/oncall.spec.ts
+++ b/web/src/utils/oncall.spec.ts
@@ -48,6 +48,7 @@ import {
   isShiftRuleValid,
   isSnoozed,
   isDeletedTeam,
+  ladderStopped,
   pagePhrase,
   reachedStepOf,
   pageState,
@@ -519,6 +520,36 @@ describe("isDeletedTeam", () => {
   });
 });
 
+describe("ladderStopped", () => {
+  const progress = (exhausted: boolean, stopped_because: string | null) =>
+    ({ fired: [], next_targets: [], next_at: null, exhausted, stopped_because }) as any;
+
+  it.each([
+    [
+      "an exhausted ladder",
+      progress(true, "the ladder is exhausted — nobody acknowledged"),
+      false,
+      false,
+    ],
+    [
+      "a ladder stopped for another reason",
+      progress(false, "the owning team was deleted"),
+      false,
+      true,
+    ],
+    ["a climbing ladder", progress(false, null), false, false],
+    [
+      "a deleted team, even with an exhausted ladder",
+      progress(true, "the ladder is exhausted — nobody acknowledged"),
+      true,
+      true,
+    ],
+    ["a deleted team with no progress loaded", undefined, true, true],
+  ])("%s", (_name, ladder, teamDeleted, expected) => {
+    expect(ladderStopped(ladder, teamDeleted)).toBe(expected);
+  });
+});
+
 describe("reachedStepOf", () => {
   it("names the 1-based step a recorded rung delay matches, or nothing", () => {
     const steps = [{ after_micros: 900 }, { after_micros: 0 }, { after_micros: 300 }];
@@ -618,6 +649,35 @@ describe("pagePhrase", () => {
         { kind: "paging", step: 2, total: 3, who: [] },
       ],
       ["not paged", {}, { progress: ladder() }, { kind: "notPaged" }],
+      [
+        "the first rung is due but not sent yet (after an unack restarts the ladder)",
+        {},
+        { progress: ladder({ next_at: NOW - SEC }) },
+        { kind: "paging", step: 1, total: 3, who: [] },
+      ],
+      [
+        "the first rung is still to come",
+        {},
+        { progress: ladder({ next_at: NOW + 60 * SEC }) },
+        { kind: "notPaged" },
+      ],
+      [
+        "its team was deleted, with no progress loaded",
+        {},
+        { reachedStep: 2, teamDeleted: true },
+        { kind: "nobodyPaged" },
+      ],
+      [
+        "the ladder stopped (its team was deleted)",
+        {},
+        {
+          progress: ladder({
+            fired: [rung(["ana@o2.ai"]), rung(["bo@o2.ai"]), rung(["cy@o2.ai"])],
+            stopped_because: "the owning team was deleted",
+          }),
+        },
+        { kind: "nobodyPaged" },
+      ],
       [
         "empty ladder on a list without progress, where the record says it ran out",
         { exhausted_at: NOW },
diff --git a/web/src/utils/oncall.ts b/web/src/utils/oncall.ts
index e7f26f8e95..7eaf90f1bc 100644
--- a/web/src/utils/oncall.ts
+++ b/web/src/utils/oncall.ts
@@ -303,12 +303,21 @@ export function isDeletedTeam(
   return !!teamId && knownTeamIds !== null && !knownTeamIds.includes(teamId);
 }
 
+/** A ringing page whose ladder stopped, or whose team was deleted, pages nobody; a ladder that ran out also sets `stopped_because` but is still paging. [pure] */
+export function ladderStopped(
+  progress: EscalationProgress | null | undefined,
+  teamDeleted: boolean,
+): boolean {
+  return teamDeleted || (!!progress?.stopped_because && !progress?.exhausted);
+}
+
 /** What is happening to a page, as one phrase: the Pages list, Recent pages and the page header all say this. */
 export type PagePhrase =
   | { kind: "resolved"; afterMicros: number | null }
   | { kind: "acknowledged"; by: string }
   | { kind: "snoozed"; until: number }
   | { kind: "nobodyAnswered" }
+  | { kind: "nobodyPaged" }
   | { kind: "held"; secondsLeft: number }
   | { kind: "pagesNobody" }
   | { kind: "unknown" }
@@ -332,6 +341,7 @@ export function pagePhrase(input: {
   progressLoaded: boolean;
   totalRungs?: number | null;
   reachedStep?: number | null;
+  teamDeleted?: boolean;
   nowMicros: number;
 }): PagePhrase {
   const { record, progress, nowMicros } = input;
@@ -347,6 +357,7 @@ export function pagePhrase(input: {
   // Before the exhausted check: the server flags an empty ladder exhausted, and nobody can fail to answer it.
   if (input.totalRungs === 0) return { kind: "pagesNobody" };
   if (pageState(record, progress) === "exhausted") return { kind: "nobodyAnswered" };
+  if (ladderStopped(progress, !!input.teamDeleted)) return { kind: "nobodyPaged" };
   const heldUntil = progress?.held_until_micros;
   if (heldUntil && heldUntil > nowMicros) {
     return { kind: "held", secondsLeft: Math.ceil((heldUntil - nowMicros) / 1_000_000) };
@@ -358,8 +369,10 @@ export function pagePhrase(input: {
     return { kind: "unknown" };
   }
   const step = progress ? progress.fired.length : (input.reachedStep ?? 0);
-  if (!step) return { kind: "notPaged" };
   const total = input.totalRungs ?? null;
+  // A restarted ladder's first rung is due before the scheduler sends it; that is paging, not "not paged".
+  const due = !!progress?.next_at && progress.next_at <= nowMicros;
+  if (!step) return due ? { kind: "paging", step: 1, total, who: [] } : { kind: "notPaged" };
   const last = progress?.fired[progress.fired.length - 1];
   if (last?.reached_nobody) return { kind: "reachedNobody", step, total };
   return { kind: "paging", step, total, who: last?.reached ?? [] };
@@ -1094,6 +1107,12 @@ export function offsetAnchor(rule: ShiftRule, shifts: number, timezone: string):
   return shiftBoundary(rule, -shifts, timezone) ?? rule.anchor_micros - shifts * rule.shift_micros;
 }
 
+/** How many shifts before `rule`'s anchor the shift containing `nowMicros` starts; zero or negative once the anchor has passed. [pure] */
+export function shiftsBackToNow(rule: ShiftRule, nowMicros: number, timezone: string): number {
+  if (!rule.shift_micros || rule.shift_micros <= 0) return 0;
+  return -localShiftIndex(rule, nowMicros, timezone);
+}
+
 /** Whether `rule` has people and a positive turn length, so its shifts can be counted. [pure] */
 function isCountable(rule: ShiftRule): boolean {
   return !!rule.members?.length && !!rule.shift_micros && rule.shift_micros > 0;
diff --git a/web/src/utils/synthetics/format.spec.ts b/web/src/utils/synthetics/format.spec.ts
new file mode 100644
index 0000000000..c3687eed03
--- /dev/null
+++ b/web/src/utils/synthetics/format.spec.ts
@@ -0,0 +1,56 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { describe, it, expect } from "vitest";
+import { errorHeadline } from "./format";
+
+describe("errorHeadline", () => {
+  it("cuts dead-letter messages before their open '(phase' group", () => {
+    expect(
+      errorHeadline(
+        "probe did not respond after 3 dispatch attempts (phase: claimed, no result before the lease ran out); the probe may be unable to reach the callback endpoint http://localhost:5080",
+      ),
+    ).toBe("probe did not respond after 3 dispatch attempts");
+    expect(
+      errorHeadline(
+        "probe held the check but did not respond before its schedule window closed (phase: claimed, lease expired without a result; after 1 dispatch attempt(s)); the probe may be unable to reach the callback endpoint http://localhost:5080; the next scheduled run will retry",
+      ),
+    ).toBe("probe held the check but did not respond before its schedule window closed");
+    expect(
+      errorHeadline(
+        "no probe claimed the check for this location before its schedule window closed (phase: never claimed; 0 dispatch attempt(s)); a probe may be unable to reach the callback endpoint http://localhost:5080",
+      ),
+    ).toBe("no probe claimed the check for this location before its schedule window closed");
+  });
+
+  it("trims trailing punctuation left before the cut", () => {
+    expect(errorHeadline("lease lost, (phase: claimed)")).toBe("lease lost");
+  });
+
+  it("keeps the text before the first colon for every other shape", () => {
+    const messages = [
+      "TimeoutError: page.waitForSelector: Timeout 30000ms exceeded.",
+      "page.goto: net::ERR_NAME_NOT_RESOLVED at https://app.test/",
+      "locator.click: Timeout 30000ms exceeded.\nCall log:\n  - waiting for getByRole('button', { name: 'Sign in' })",
+      "config: this check needs up to 4 per run, which is over the 3 check budget.",
+      "Error: expect(locator).toBeVisible() failed",
+      "waiting for locator('a:visible') to be attached",
+      "navigation failed (net error) after retry",
+      "the organization's included synthetics steps are exhausted, so this run was skipped",
+      "(phase: claimed)",
+    ];
+    for (const m of messages) expect(errorHeadline(m)).toBe(m.split(":")[0]);
+  });
+});
diff --git a/web/src/utils/synthetics/format.ts b/web/src/utils/synthetics/format.ts
index eb6b7a53c7..5a61035539 100644
--- a/web/src/utils/synthetics/format.ts
+++ b/web/src/utils/synthetics/format.ts
@@ -43,3 +43,15 @@ export function locationDisplayLabel(name: string, region: string | undefined |
   if (!r || r.toLowerCase() === name.trim().toLowerCase()) return name;
   return `${name} (${r})`;
 }
+
+/** Text before the first ":" of a run error, cut before a " (" group that the colon left unclosed. */
+export function errorHeadline(message: string): string {
+  const head = message.split(":")[0];
+  const open: number[] = [];
+  for (let i = 0; i < head.length; i++) {
+    if (head[i] === "(") open.push(i);
+    else if (head[i] === ")") open.pop();
+  }
+  if (!open.length || !/\s/.test(head.charAt(open[0] - 1))) return head;
+  return head.slice(0, open[0]).replace(/[\s.,;-]+$/, "") || head;
+}
diff --git a/web/src/utils/traces/patternDetection.spec.ts b/web/src/utils/traces/patternDetection.spec.ts
index 9eb1fb55aa..a4412d6672 100644
--- a/web/src/utils/traces/patternDetection.spec.ts
+++ b/web/src/utils/traces/patternDetection.spec.ts
@@ -14,7 +14,7 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { describe, expect, it } from "vitest";
-import { buildPatternConsolidatedTree } from "./patternDetection";
+import { buildPathPatterns, buildPatternConsolidatedTree } from "./patternDetection";
 
 const span = (id: string, service: string, durationMs: number, children: any[] = []) => ({
   spanId: id,
@@ -53,3 +53,46 @@ describe("buildPatternConsolidatedTree", () => {
     expect(patterns.get("a→c")!.metrics).toMatchObject({ count: 1, min: 30, max: 30 });
   });
 });
+
+describe("buildPathPatterns", () => {
+  it("keys spans by their service ancestor path, merging consecutive spans of one service", () => {
+    const tree = [
+      span("f1", "frontend", 100, [
+        span("f2", "frontend", 90, [span("l1", "leaf", 3)]),
+        span("c1", "checkout", 20, [span("l2", "leaf", 1), span("l3", "leaf", 2)]),
+      ]),
+    ];
+    const patterns = buildPathPatterns(tree);
+    expect([...patterns.keys()].sort()).toEqual([
+      "frontend",
+      "frontend→checkout",
+      "frontend→checkout→leaf",
+      "frontend→leaf",
+    ]);
+    expect(patterns.get("frontend")?.metrics.count).toBe(2);
+    expect(patterns.get("frontend→leaf")?.metrics.avg).toBe(3);
+    expect(patterns.get("frontend→checkout→leaf")?.metrics.count).toBe(2);
+    expect(patterns.get("frontend→checkout→leaf")?.metrics.avg).toBe(1.5);
+  });
+
+  it("stops tracking a path once it revisits a service", () => {
+    const tree = [
+      span("a1", "a", 10, [span("b1", "b", 5, [span("a2", "a", 2, [span("c1", "c", 1)])])]),
+    ];
+    expect([...buildPathPatterns(tree).keys()].sort()).toEqual(["a", "a→b"]);
+  });
+
+  it("handles a 20,000-level chain alternating two services", () => {
+    const root: any = span("s0", "a", 20_000);
+    let tail = root;
+    for (let i = 1; i < 20_000; i++) {
+      const next = span(`s${i}`, i % 2 ? "b" : "a", 20_000 - i);
+      tail.spans = [next];
+      tail = next;
+    }
+    const patterns = buildPathPatterns([root]);
+    expect(patterns.size).toBe(2);
+    expect(patterns.get("a")?.metrics.count).toBe(1);
+    expect(patterns.get("a→b")?.metrics.count).toBe(1);
+  });
+});
diff --git a/web/src/utils/traces/patternDetection.ts b/web/src/utils/traces/patternDetection.ts
index d3e184a8ee..80a096914f 100644
--- a/web/src/utils/traces/patternDetection.ts
+++ b/web/src/utils/traces/patternDetection.ts
@@ -199,43 +199,59 @@ export function buildPatternConsolidatedTree(traceTree: any[]): Map<string, Call
   // would incorrectly show child durations. Self-patterns fix this by capturing
   // each service's own span metrics directly from allServices.
   allServices.forEach((serviceInfo, serviceName) => {
-    const durations = serviceInfo.spans.map((s: any) => s.durationMs || 0);
-    const errorCount = serviceInfo.errorCount;
-
-    patterns.set(serviceName, {
-      pathSignature: serviceName,
-      instances: serviceInfo.spans.map((span: any) => ({
-        spanId: span.span_id || span.spanId || "",
-        duration: span.durationMs || 0,
-        isError: isSpanError(span),
-        timestamp: span.start_time || 0,
-        attributes: span.attributes || {},
-        serviceName,
-        operationName: span.operationName || span.operation_name || "",
-      })),
-      metrics: {
-        count: serviceInfo.spans.length,
-        avg: calculateAverage(durations),
-        min: durations.length > 0 ? durations.reduce((m, d) => Math.min(m, d), Infinity) : 0,
-        max: durations.length > 0 ? durations.reduce((m, d) => Math.max(m, d), -Infinity) : 0,
-        p75: calculatePercentile(durations, 75),
-        p95: calculatePercentile(durations, 95),
-        p99: calculatePercentile(durations, 99),
-        totalDuration: durations.reduce((sum, d) => sum + d, 0),
-        errorRate: serviceInfo.spans.length > 0 ? (errorCount / serviceInfo.spans.length) * 100 : 0,
-        errorCount,
-        traceTimePercent:
-          totalTraceDuration > 0 && durations.length > 0
-            ? (calculateAverage(durations) / totalTraceDuration) * 100
-            : 0,
-      },
-      spanIds: serviceInfo.spans.map((span: any) => span.span_id || span.spanId || ""),
-    });
+    patterns.set(
+      serviceName,
+      spansToPattern(serviceName, serviceName, serviceInfo.spans, totalTraceDuration),
+    );
   });
 
   return patterns;
 }
 
+/** Groups spans by their service ancestor path ("frontend→checkout→database"), so each branch keeps its own metrics. */
+export function buildPathPatterns(traceTree: any[]): Map<string, CallPattern> {
+  const patterns = new Map<string, CallPattern>();
+  if (!traceTree || traceTree.length === 0) return patterns;
+
+  const totalTraceDuration = traceTree.reduce(
+    (max, rootSpan) => Math.max(max, rootSpan.durationMs || 0),
+    0,
+  );
+  const spansByPath = new Map<string, { serviceName: string; spans: any[] }>();
+  // A path that revisits a service is never a Tree View node (the tree drops cycles), so it stops being tracked; this keeps keys short on deep alternating chains.
+  type Frame = [span: any, key: string | null, service: string, seen: Set<string> | null];
+  const stack: Frame[] = [];
+  for (let i = traceTree.length - 1; i >= 0; i--) stack.push([traceTree[i], "", "", new Set()]);
+  while (stack.length) {
+    const [span, parentKey, parentService, parentSeen] = stack.pop()!;
+    const serviceName = span.resolvedIdentity || span.serviceName || "unknown";
+    let key = parentKey;
+    let seen = parentSeen;
+    if (parentKey !== null && parentSeen && serviceName !== parentService) {
+      if (parentSeen.has(serviceName)) {
+        key = null;
+        seen = null;
+      } else {
+        key = parentKey ? `${parentKey}→${serviceName}` : serviceName;
+        seen = new Set(parentSeen).add(serviceName);
+      }
+    }
+    if (key !== null) {
+      if (!spansByPath.has(key)) spansByPath.set(key, { serviceName, spans: [] });
+      spansByPath.get(key)!.spans.push(span);
+    }
+    const children = span.spans ?? [];
+    for (let i = children.length - 1; i >= 0; i--) {
+      stack.push([children[i], key, serviceName, seen]);
+    }
+  }
+
+  spansByPath.forEach(({ serviceName, spans }, key) => {
+    patterns.set(key, spansToPattern(key, serviceName, spans, totalTraceDuration));
+  });
+  return patterns;
+}
+
 /**
  * Check if a span represents an error
  */
@@ -259,6 +275,45 @@ export function isSpanError(span: any): boolean {
   return false;
 }
 
+function spansToPattern(
+  signature: string,
+  serviceName: string,
+  spans: any[],
+  totalTraceDuration: number,
+): CallPattern {
+  const durations = spans.map((s: any) => s.durationMs || 0);
+  const errorCount = spans.filter((span: any) => isSpanError(span)).length;
+  return {
+    pathSignature: signature,
+    instances: spans.map((span: any) => ({
+      spanId: span.span_id || span.spanId || "",
+      duration: span.durationMs || 0,
+      isError: isSpanError(span),
+      timestamp: span.start_time || 0,
+      attributes: span.attributes || {},
+      serviceName,
+      operationName: span.operationName || span.operation_name || "",
+    })),
+    metrics: {
+      count: spans.length,
+      avg: calculateAverage(durations),
+      min: durations.length > 0 ? durations.reduce((m, d) => Math.min(m, d), Infinity) : 0,
+      max: durations.length > 0 ? durations.reduce((m, d) => Math.max(m, d), -Infinity) : 0,
+      p75: calculatePercentile(durations, 75),
+      p95: calculatePercentile(durations, 95),
+      p99: calculatePercentile(durations, 99),
+      totalDuration: durations.reduce((sum, d) => sum + d, 0),
+      errorRate: spans.length > 0 ? (errorCount / spans.length) * 100 : 0,
+      errorCount,
+      traceTimePercent:
+        totalTraceDuration > 0 && durations.length > 0
+          ? (calculateAverage(durations) / totalTraceDuration) * 100
+          : 0,
+    },
+    spanIds: spans.map((span: any) => span.span_id || span.spanId || ""),
+  };
+}
+
 /**
  * Calculate average of an array of numbers
  */
diff --git a/web/src/utils/traces/resolveTracesFilter.spec.ts b/web/src/utils/traces/resolveTracesFilter.spec.ts
new file mode 100644
index 0000000000..b73821a89c
--- /dev/null
+++ b/web/src/utils/traces/resolveTracesFilter.spec.ts
@@ -0,0 +1,59 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { beforeAll, describe, expect, it } from "vitest";
+import { resolveTracesFilter } from "./resolveTracesFilter";
+
+describe("resolveTracesFilter", () => {
+  let parser: unknown;
+
+  beforeAll(async () => {
+    const mod = await import("@openobserve/node-sql-parser/build/datafusionsql");
+    parser = new mod.default.Parser();
+  });
+
+  it("returns an empty string for blank or missing text", () => {
+    expect(resolveTracesFilter("", parser, "default")).toBe("");
+    expect(resolveTracesFilter("   ", parser, "default")).toBe("");
+    expect(resolveTracesFilter(undefined, parser, "default")).toBe("");
+  });
+
+  it("turns a duration with a unit into microseconds", () => {
+    expect(resolveTracesFilter("duration > '500ms'", parser, "default")).toBe("duration > 500000");
+    expect(resolveTracesFilter("duration > '1.50ms'", parser, "default")).toBe("duration > 1500");
+  });
+
+  it("turns span kind labels into their numeric keys", () => {
+    expect(resolveTracesFilter("span_kind = 'Server'", parser, "default")).toBe("span_kind = '2'");
+  });
+
+  it("resolves duration and span kind in one filter", () => {
+    expect(
+      resolveTracesFilter("duration >= '2s' AND span_kind = 'Client'", parser, "default"),
+    ).toBe("duration >= 2000000 AND span_kind = '3'");
+  });
+
+  it("keeps the trimmed text when the duration unit is unknown", () => {
+    expect(resolveTracesFilter("  duration > '5parsecs'  ", parser, "default")).toBe(
+      "duration > '5parsecs'",
+    );
+  });
+
+  it("passes the text through untouched without a parser", () => {
+    expect(resolveTracesFilter(" service_name = 'api' ", null, "default")).toBe(
+      "service_name = 'api'",
+    );
+  });
+});
diff --git a/web/src/utils/traces/resolveTracesFilter.ts b/web/src/utils/traces/resolveTracesFilter.ts
new file mode 100644
index 0000000000..6807af2acf
--- /dev/null
+++ b/web/src/utils/traces/resolveTracesFilter.ts
@@ -0,0 +1,32 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { parseDurationWhereClause } from "@/composables/useDurationPercentiles";
+import { parseSpanKindWhereClause } from "@/utils/traces/constants";
+
+/** Turns Traces editor text into a runnable WHERE fragment: durations in µs, span kinds as numeric keys. */
+export const resolveTracesFilter = (
+  text: string | undefined,
+  parser: unknown,
+  streamName: string,
+): string => {
+  const trimmed = text?.trim() ?? "";
+  const durationResolved = parseDurationWhereClause(trimmed, parser, streamName);
+  return parseSpanKindWhereClause(
+    typeof durationResolved === "string" ? durationResolved : trimmed,
+    parser,
+    streamName,
+  );
+};
diff --git a/web/src/utils/traces/treeVisualizationEngine.spec.ts b/web/src/utils/traces/treeVisualizationEngine.spec.ts
index cbaf4e63ea..66fb835d3b 100644
--- a/web/src/utils/traces/treeVisualizationEngine.spec.ts
+++ b/web/src/utils/traces/treeVisualizationEngine.spec.ts
@@ -15,6 +15,7 @@
 
 import { describe, expect, it, beforeEach, afterEach, vi } from "vitest";
 import { createTreeVisualizationEngine } from "./treeVisualizationEngine";
+import { CHART_ZOOM_MAX, CHART_ZOOM_MIN } from "@/composables/traces/useChartZoom";
 
 // Mock useStore
 const mockStore = {
@@ -132,11 +133,10 @@ describe("createTreeVisualizationEngine tooltip system", () => {
     const cleanup = setupTraceNodeTooltips(mockChart, mockData, false);
 
     // Simulate mouseover event that hits the test node
-    // The handler receives ECharts params and looks up the node by name
     const mouseMoveHandler = mockChart.on.mock.calls.find((call) => call[0] === "mouseover")[1];
 
     const mockParams = {
-      data: { name: "Test Node" },
+      data: { name: "Test Node", treePath: [0] },
       event: { offsetX: 100, offsetY: 200 },
     };
     mouseMoveHandler(mockParams);
@@ -146,6 +146,50 @@ describe("createTreeVisualizationEngine tooltip system", () => {
     cleanup();
   });
 
+  it("shows each copy of a repeated service its own tooltip", () => {
+    const { generateEChartsOptions, setupTraceNodeTooltips } = createTreeVisualizationEngine();
+
+    const frontendCatalog = { id: "product-catalog", name: "product-catalog", value: 0.31 };
+    const checkoutCatalog = { id: "product-catalog", name: "product-catalog", value: 0.26 };
+    const treeData = [
+      {
+        id: "frontend",
+        name: "frontend",
+        value: 5,
+        children: [
+          frontendCatalog,
+          { id: "checkout", name: "checkout", value: 2, children: [checkoutCatalog] },
+        ],
+      },
+    ];
+    const mockData = {
+      treeData,
+      getNodeLabel: () => "",
+      getNodeTooltip: vi.fn().mockReturnValue("<div></div>"),
+      getNodeErrorRate: () => 0,
+    };
+    const options = generateEChartsOptions(mockData, {
+      layoutType: "horizontal",
+      isDarkMode: false,
+      nodeSize: "fixed",
+    });
+    const root = options.series[0].data[0];
+    const frontendDatum = root.children[0];
+    const checkoutDatum = root.children[1].children[0];
+
+    const cleanup = setupTraceNodeTooltips(mockChart, mockData, false);
+    const onMouseOver = mockChart.on.mock.calls.find((call) => call[0] === "mouseover")[1];
+
+    onMouseOver({ data: checkoutDatum, event: { offsetX: 10, offsetY: 10 } });
+    expect(mockData.getNodeTooltip).toHaveBeenLastCalledWith(checkoutCatalog);
+
+    onMouseOver({ data: frontendDatum, event: { offsetX: 10, offsetY: 10 } });
+    expect(mockData.getNodeTooltip).toHaveBeenLastCalledWith(frontendCatalog);
+    expect(mockData.getNodeTooltip).toHaveBeenCalledTimes(2);
+
+    cleanup();
+  });
+
   it("should hide tooltip on mouse leave", () => {
     const { setupTraceNodeTooltips } = createTreeVisualizationEngine();
 
@@ -197,7 +241,7 @@ describe("createTreeVisualizationEngine tooltip system", () => {
     // Simulate mouse near edge that should trigger repositioning
     // mouseover handler receives ECharts params object with event coordinates
     const mockParams = {
-      data: { name: "Test Node" },
+      data: { name: "Test Node", treePath: [0] },
       event: { offsetX: 750, offsetY: 550 },
     };
     mouseMoveHandler(mockParams);
@@ -392,3 +436,19 @@ describe("createTreeVisualizationEngine node detection with ECharts hit detectio
     expect(nullResult).toBeNull();
   });
 });
+
+describe("createTreeVisualizationEngine generateEChartsOptions", () => {
+  it("bounds wheel zoom with the same limits as the zoom buttons", () => {
+    const { generateEChartsOptions } = createTreeVisualizationEngine();
+    const options = generateEChartsOptions(
+      {
+        treeData: [{ id: "a", name: "a", value: 1 }],
+        getNodeLabel: () => "a",
+        getNodeTooltip: () => "",
+        getNodeErrorRate: () => 0,
+      },
+      { layoutType: "horizontal", isDarkMode: false, nodeSize: "fixed" },
+    );
+    expect(options.series[0].scaleLimit).toEqual({ min: CHART_ZOOM_MIN, max: CHART_ZOOM_MAX });
+  });
+});
diff --git a/web/src/utils/traces/treeVisualizationEngine.ts b/web/src/utils/traces/treeVisualizationEngine.ts
index 1ddddd29c7..51aa3beb72 100644
--- a/web/src/utils/traces/treeVisualizationEngine.ts
+++ b/web/src/utils/traces/treeVisualizationEngine.ts
@@ -16,6 +16,7 @@
 import type { I18nText } from "@/types/i18n";
 
 import { getServiceColorHex } from "@/utils/traces/traceColors";
+import { CHART_ZOOM_MAX, CHART_ZOOM_MIN } from "@/composables/traces/useChartZoom";
 
 /**
  * Tree node interface for tree visualization with coordinate support
@@ -85,8 +86,9 @@ export function createTreeVisualizationEngine() {
     };
 
     // Convert TreeNode format to ECharts tree format
-    const convertToEChartsFormat = (nodes: TreeNode[]): any[] => {
-      return nodes.map((node) => {
+    const convertToEChartsFormat = (nodes: TreeNode[], parentPath: number[] = []): any[] => {
+      return nodes.map((node, index) => {
+        const treePath = [...parentPath, index];
         const errorCount = getNodeErrorRate(node);
         const serviceColor =
           data.getNodeServiceColor?.(node) ||
@@ -103,6 +105,8 @@ export function createTreeVisualizationEngine() {
         return {
           name: node.name,
           value: node.value,
+          // Repeated services share name and id, so the tooltip resolves the node by position.
+          treePath,
           symbol: getCircleSvg(fillColor, borderColor, 4),
           symbolSize:
             nodeSize === "dynamic"
@@ -181,7 +185,7 @@ export function createTreeVisualizationEngine() {
               },
             },
           },
-          children: node.children ? convertToEChartsFormat(node.children) : undefined,
+          children: node.children ? convertToEChartsFormat(node.children, treePath) : undefined,
         };
       });
     };
@@ -221,6 +225,8 @@ export function createTreeVisualizationEngine() {
           initialTreeDepth: -1,
           symbolSize: symbolSize,
           roam: true, // Enable panning and zooming
+          // Same bounds as the zoom buttons, so wheel and buttons agree.
+          scaleLimit: { min: CHART_ZOOM_MIN, max: CHART_ZOOM_MAX },
           selectedMode: "single", // Enable single node selection
           label: {
             position: layoutType === "vertical" ? "bottom" : "right",
@@ -305,26 +311,15 @@ export function createTreeVisualizationEngine() {
     }
   };
 
-  /**
-   * Helper to find tree node by name (more reliable than index)
-   * Traverses the tree data to find the node with matching name
-   */
-  const findNodeByName = (nodes: TreeNode[], targetName: string): TreeNode | null => {
-    const traverse = (nodeList: TreeNode[]): TreeNode | null => {
-      for (const node of nodeList) {
-        if (node.name === targetName || node.id === targetName) {
-          return node;
-        }
-
-        if (node.children && node.children.length > 0) {
-          const found = traverse(node.children);
-          if (found) return found;
-        }
-      }
-      return null;
-    };
-
-    return traverse(nodes);
+  const findNodeByPath = (nodes: TreeNode[], treePath: number[]): TreeNode | null => {
+    let level: TreeNode[] | undefined = nodes;
+    let node: TreeNode | null = null;
+    for (const index of treePath) {
+      node = level?.[index] ?? null;
+      if (!node) return null;
+      level = node.children;
+    }
+    return node;
   };
 
   /**
@@ -387,7 +382,7 @@ export function createTreeVisualizationEngine() {
     chartDom.appendChild(tooltipEl);
 
     let hideTimer: ReturnType<typeof setTimeout> | null = null;
-    let activeNodeId: string | null = null;
+    let activeNode: TreeNode | null = null;
 
     // Positioning logic from Service Graph with proper dimension measurement
     const positionTooltip = (mouseX: number, mouseY: number) => {
@@ -433,23 +428,22 @@ export function createTreeVisualizationEngine() {
 
     const hideTooltip = () => {
       tooltipEl.style.display = "none";
-      activeNodeId = null;
+      activeNode = null;
     };
 
     // ECharts event handling - use built-in hover events directly on chart elements
     const onNodeMouseOver = (params: any) => {
-      if (!params || !params.data) return;
+      if (!params?.data?.treePath) return;
 
-      // Use node name to find matching TreeNode instead of unreliable dataIndex
-      const hoveredNode = findNodeByName(data.treeData, params.data.name);
-      if (hoveredNode && hoveredNode.id !== activeNodeId) {
+      const hoveredNode = findNodeByPath(data.treeData, params.data.treePath);
+      if (hoveredNode && hoveredNode !== activeNode) {
         // Clear any existing timer to prevent race conditions
         if (hideTimer) {
           clearTimeout(hideTimer);
           hideTimer = null;
         }
 
-        activeNodeId = hoveredNode.id;
+        activeNode = hoveredNode;
 
         // Use event pixel coordinates if available, otherwise use chart center
         const mouseX = params.event?.offsetX || chartDom.clientWidth / 2;
@@ -460,7 +454,7 @@ export function createTreeVisualizationEngine() {
     };
 
     const onNodeMouseOut = () => {
-      if (activeNodeId) {
+      if (activeNode) {
         // Clear existing timer before setting new one
         if (hideTimer) {
           clearTimeout(hideTimer);
@@ -499,7 +493,6 @@ export function createTreeVisualizationEngine() {
     generateEChartsOptions,
     setupTraceNodeTooltips,
     findNodeAtPoint, // Export for testing
-    findNodeByName, // Export helper for testing
     findNodeByIndex, // Export helper for testing
     getHealthColor,
   };
diff --git a/web/src/views/AIObservability/PromptDetailDrawer.spec.ts b/web/src/views/AIObservability/PromptDetailDrawer.spec.ts
index 91511f7e61..6f21407f3a 100644
--- a/web/src/views/AIObservability/PromptDetailDrawer.spec.ts
+++ b/web/src/views/AIObservability/PromptDetailDrawer.spec.ts
@@ -62,7 +62,7 @@ const ODialogStub = {
   template: "<div v-if='open'><slot /></div>",
 };
 
-function mountDrawer(initialVersion = 1, initialTab = "labels") {
+function mountDrawer(initialVersion = 1, initialTab = "labels", showPlayground?: boolean) {
   return shallowMount(PromptDetailDrawer, {
     props: {
       open: true,
@@ -71,6 +71,7 @@ function mountDrawer(initialVersion = 1, initialTab = "labels") {
       initialTab,
       initialVersion,
       protectedLabels: ["production"],
+      ...(showPlayground === undefined ? {} : { showPlayground }),
     },
     global: {
       stubs: {
@@ -195,3 +196,17 @@ describe("prompt detail navigation and labels", () => {
     expect(wrapper.findComponent(PromptVersionDiff).props("left").version).toBe(3);
   });
 });
+
+describe("prompt detail Playground entry", () => {
+  it("shows the Playground action by default", async () => {
+    const wrapper = mountDrawer();
+    await flushPromises();
+    expect(wrapper.find('[data-test="prompt-detail-playground"]').exists()).toBe(true);
+  });
+
+  it("hides the Playground action when Playground is unavailable", async () => {
+    const wrapper = mountDrawer(1, "labels", false);
+    await flushPromises();
+    expect(wrapper.find('[data-test="prompt-detail-playground"]').exists()).toBe(false);
+  });
+});
diff --git a/web/src/views/AIObservability/PromptDetailDrawer.vue b/web/src/views/AIObservability/PromptDetailDrawer.vue
index 11f91cb31e..4ddb3d8cf9 100644
--- a/web/src/views/AIObservability/PromptDetailDrawer.vue
+++ b/web/src/views/AIObservability/PromptDetailDrawer.vue
@@ -45,6 +45,7 @@
         </div>
         <div class="flex items-center gap-2 max-lg:w-full">
           <OButton
+            v-if="showPlayground"
             variant="outline"
             size="sm"
             icon-left="play-arrow"
@@ -422,8 +423,14 @@ const props = withDefaults(
     initialVersion?: number | null;
     initialTab?: string;
     protectedLabels?: string[];
+    showPlayground?: boolean;
   }>(),
-  { initialVersion: null, initialTab: "configuration", protectedLabels: () => [] },
+  {
+    initialVersion: null,
+    initialTab: "configuration",
+    protectedLabels: () => [],
+    showPlayground: true,
+  },
 );
 
 const moveLabelMutation = useMutation(() => movePromptLabelMutation(props.orgId));
@@ -521,7 +528,7 @@ const payloadText = (payload: unknown) =>
   typeof payload === "string" ? payload : JSON.stringify(payload, null, 2);
 const jsonText = (value: unknown) => (value == null ? "—" : JSON.stringify(value, null, 2));
 
-const versionColumns: OTableColumnDef<PromptVersion>[] = [
+const allVersionColumns: OTableColumnDef<PromptVersion>[] = [
   {
     id: "version",
     accessorKey: "version",
@@ -556,6 +563,12 @@ const versionColumns: OTableColumnDef<PromptVersion>[] = [
   },
   { id: "actions", isAction: true, header: raw(""), accessorKey: "id", size: 56 },
 ];
+// The actions column holds only the Playground button.
+const versionColumns = computed(() =>
+  props.showPlayground
+    ? allVersionColumns
+    : allVersionColumns.filter((column) => column.id !== "actions"),
+);
 
 function viewVersion(version: number) {
   selectedVersion.value = version;
diff --git a/web/src/views/AIObservability/PromptEditorPage.evalsGate.spec.ts b/web/src/views/AIObservability/PromptEditorPage.evalsGate.spec.ts
new file mode 100644
index 0000000000..195d8bef87
--- /dev/null
+++ b/web/src/views/AIObservability/PromptEditorPage.evalsGate.spec.ts
@@ -0,0 +1,126 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { h, nextTick } from "vue";
+import { createStore } from "vuex";
+import { RouterView, createMemoryHistory, createRouter } from "vue-router";
+import i18n from "@/locales";
+import OForm from "@/lib/forms/Form/OForm.vue";
+import llmPromptsService from "@/services/llm-prompts.service";
+import onlineEvalsService from "@/services/online-evals.service";
+import { byTest } from "@/test/unit/helpers/draftDom";
+import { fillField } from "@/test/unit/helpers/fillField";
+import PromptEditorPage from "./PromptEditorPage.vue";
+
+vi.mock("@/services/llm-prompts.service", () => ({
+  default: {
+    get: vi.fn(),
+    getVersion: vi.fn(),
+    match: vi.fn(),
+    create: vi.fn(),
+    createVersion: vi.fn(),
+  },
+}));
+vi.mock("@/services/online-evals.service", () => ({
+  default: { providers: { list: vi.fn() } },
+}));
+vi.mock("@/aws-exports", () => ({ default: { isEnterprise: "true", isCloud: "false" } }));
+
+interface FormApi {
+  setFieldValue: (field: string, value: unknown) => void;
+  handleSubmit: () => Promise<void>;
+}
+
+const store = createStore({
+  state: {
+    theme: "light",
+    selectedOrganization: { identifier: "test-org" },
+    userInfo: { email: "me@x.io" },
+    timezone: "UTC",
+    zoConfig: {} as Record<string, unknown>,
+  },
+});
+
+const blank = { render: () => h("div") };
+let wrapper: VueWrapper | null = null;
+
+const mountEditor = async (onlineEvalsEnabled: boolean) => {
+  store.state.zoConfig = { version: "v1", online_evals_enabled: onlineEvalsEnabled };
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      { path: "/ai/prompts", name: "aiPrompts", component: blank },
+      { path: "/ai/prompts/new", name: "aiPromptCreate", component: PromptEditorPage },
+      { path: "/ai/playground", name: "aiPlayground", component: blank },
+    ],
+  });
+  await router.push("/ai/prompts/new");
+  wrapper = mount(
+    { render: () => h(RouterView) },
+    { attachTo: document.body, global: { plugins: [router, store, i18n] } },
+  );
+  await flushPromises();
+};
+
+const form = () => (wrapper!.findComponent(OForm).vm as unknown as { form: FormApi }).form;
+
+describe("PromptEditorPage with online evaluations gate", () => {
+  beforeEach(() => {
+    localStorage.clear();
+    sessionStorage.clear();
+    vi.clearAllMocks();
+    vi.mocked(llmPromptsService.match).mockResolvedValue([]);
+    vi.mocked(llmPromptsService.create).mockResolvedValue({
+      prompt: { entityId: "pr-new" },
+      version: { entityId: "pr-new", version: 1 },
+    } as never);
+    vi.mocked(onlineEvalsService.providers.list).mockResolvedValue([
+      { name: "openai", availableModels: ["gpt-4o"] },
+    ] as never);
+  });
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+  });
+
+  it("skips the providers request, hides Playground and saves a typed model when evals are off", async () => {
+    await mountEditor(false);
+
+    expect(onlineEvalsService.providers.list).not.toHaveBeenCalled();
+    expect(byTest("prompt-editor-test-btn")).toBeNull();
+
+    await fillField("prompt-editor-name", "summarise");
+    await fillField("prompt-editor-text", "Summarise {{ doc }}");
+    await fillField("prompt-editor-model", "my-custom-model");
+    form().setFieldValue("commitMessage", "first");
+    await nextTick();
+    await form().handleSubmit();
+    await flushPromises();
+
+    expect(llmPromptsService.create).toHaveBeenCalledTimes(1);
+    const input = vi.mocked(llmPromptsService.create).mock.calls[0][1];
+    expect(input.config?.model).toBe("my-custom-model");
+  });
+
+  it("loads providers and shows Playground when evals are on", async () => {
+    await mountEditor(true);
+
+    expect(onlineEvalsService.providers.list).toHaveBeenCalledWith("test-org");
+    expect(byTest("prompt-editor-test-btn")).not.toBeNull();
+  });
+});
diff --git a/web/src/views/AIObservability/PromptEditorPage.vue b/web/src/views/AIObservability/PromptEditorPage.vue
index f295a2bf10..db2bb9558e 100644
--- a/web/src/views/AIObservability/PromptEditorPage.vue
+++ b/web/src/views/AIObservability/PromptEditorPage.vue
@@ -137,7 +137,7 @@
                 </p>
               </div>
               <OFormSelect
-                v-if="enterpriseMode"
+                v-if="providersAvailable"
                 name="model"
                 :label="t('aiObservability.promptManagement.model')"
                 :options="modelOptions"
@@ -258,6 +258,7 @@
         class="bg-surface-base border-border-default sticky bottom-0 z-1 flex shrink-0 items-center justify-end gap-2 border-t px-5.5 py-3"
       >
         <OButton
+          v-if="playgroundAvailable"
           type="button"
           variant="outline"
           size="sm-action"
@@ -308,6 +309,7 @@ import { useMutation, useQuery } from "@tanstack/vue-query";
 import onlineEvalsService from "@/services/online-evals.service";
 import { onlineEvalKeys } from "@/services/online-evals.service.querykeys";
 import { MEDIUM_STALE_TIME } from "@/composables/query/cachePolicy";
+import { hidesOnlineEvalEntries } from "@/composables/shared/useOnlineEvalsGate";
 import {
   createPromptMutation,
   createPromptVersionMutation,
@@ -376,6 +378,10 @@ const typeOptions = [
   { label: t("aiObservability.promptManagement.chat"), value: "chat" },
 ];
 const enterpriseMode = config.isEnterprise === "true" || config.isCloud === "true";
+/** Playground is hidden only when the server reports online evaluations off. */
+const playgroundAvailable = computed(() => !hidesOnlineEvalEntries(store.state.zoConfig));
+/** The providers API exists only on enterprise builds with online evaluations on. */
+const providersAvailable = computed(() => enterpriseMode && playgroundAvailable.value);
 const form = useOForm<PromptEditorForm>({
   defaultValues: promptEditorDefaults(),
   schema: makePromptEditorSchema(t),
@@ -399,7 +405,7 @@ const providerQuery = useQuery(() => ({
   queryKey: onlineEvalKeys.providers(orgId.value),
   queryFn: () => onlineEvalsService.providers.list(orgId.value),
   staleTime: MEDIUM_STALE_TIME,
-  enabled: enterpriseMode && Boolean(orgId.value),
+  enabled: providersAvailable.value && Boolean(orgId.value),
 }));
 const providers = computed(() => providerQuery.data.value ?? []);
 const variableValues = reactive<Record<string, string>>({});
diff --git a/web/src/views/AIObservability/PromptsPage.evalsGate.spec.ts b/web/src/views/AIObservability/PromptsPage.evalsGate.spec.ts
new file mode 100644
index 0000000000..fa19632169
--- /dev/null
+++ b/web/src/views/AIObservability/PromptsPage.evalsGate.spec.ts
@@ -0,0 +1,101 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { h } from "vue";
+import { createStore } from "vuex";
+import { createMemoryHistory, createRouter } from "vue-router";
+import { queryClient } from "@/composables/query/queryClient";
+import llmPromptsService from "@/services/llm-prompts.service";
+import PromptsPage from "./PromptsPage.vue";
+import PromptDetailDrawer from "./PromptDetailDrawer.vue";
+
+vi.mock("@/services/llm-prompts.service", () => ({
+  default: { list: vi.fn(), getSettings: vi.fn(), archive: vi.fn(), get: vi.fn() },
+}));
+vi.mock("@/utils/commons", () => ({ getFoldersListByType: vi.fn(async () => []) }));
+vi.mock("@/composables/useConfirmDialog", () => ({
+  useConfirmDialog: () => ({ confirm: vi.fn(async () => true) }),
+}));
+vi.mock("@/aws-exports", () => ({ default: { isEnterprise: "true", isCloud: "false" } }));
+
+const store = createStore({
+  state: {
+    theme: "light",
+    selectedOrganization: { identifier: "test-org" },
+    userInfo: { email: "me@x.io", role: "admin" },
+    timezone: "UTC",
+    zoConfig: {} as Record<string, unknown>,
+  },
+});
+
+let wrapper: VueWrapper | null = null;
+
+const mountPage = async (onlineEvalsEnabled: boolean) => {
+  store.state.zoConfig = { version: "v1", online_evals_enabled: onlineEvalsEnabled };
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [{ path: "/ai/prompts", name: "aiPrompts", component: { render: () => h("div") } }],
+  });
+  await router.push("/ai/prompts");
+  wrapper = mount(PromptsPage, {
+    global: {
+      plugins: [router, store],
+      stubs: {
+        OPageLayout: { template: `<main><slot name="actions" /><slot /></main>` },
+        FolderList: true,
+        PromptDetailDrawer: true,
+        PromptSettingsDrawer: true,
+        SelectFolderDropDown: true,
+      },
+    },
+  });
+  await flushPromises();
+};
+
+const playgroundShown = () => wrapper!.findComponent(PromptDetailDrawer).props("showPlayground");
+
+describe("PromptsPage Playground entry with online evaluations gate", () => {
+  beforeEach(() => {
+    queryClient.clear();
+    vi.mocked(llmPromptsService.list).mockResolvedValue([]);
+    vi.mocked(llmPromptsService.getSettings).mockResolvedValue({
+      protectedLabels: ["production"],
+    } as never);
+  });
+
+  afterEach(() => {
+    wrapper?.unmount();
+    wrapper = null;
+  });
+
+  it("hides Playground actions when evals are off", async () => {
+    await mountPage(false);
+    expect(playgroundShown()).toBe(false);
+  });
+
+  it("offers Playground actions when evals are on", async () => {
+    await mountPage(true);
+    expect(playgroundShown()).toBe(true);
+  });
+
+  it("hides Playground actions as soon as evals turn off", async () => {
+    await mountPage(true);
+    store.state.zoConfig = { version: "v1", online_evals_enabled: false };
+    await flushPromises();
+    expect(playgroundShown()).toBe(false);
+  });
+});
diff --git a/web/src/views/AIObservability/PromptsPage.vue b/web/src/views/AIObservability/PromptsPage.vue
index afb558a670..f5b16d846d 100644
--- a/web/src/views/AIObservability/PromptsPage.vue
+++ b/web/src/views/AIObservability/PromptsPage.vue
@@ -246,6 +246,7 @@
       :initial-version="routeVersion"
       :initial-tab="detailTab"
       :protected-labels="protectedLabels"
+      :show-playground="!hidesOnlineEvalEntries(store.state.zoConfig)"
       @update:open="closeDetail"
       @updated="replacePrompt"
       @edit="openEditorForVersion"
@@ -348,6 +349,7 @@ import { storePromptPlaygroundHandoff } from "./promptPlaygroundHandoff";
 import EditorDraftDot from "@/components/common/drafts/EditorDraftDot.vue";
 import { useEditorDraftIds } from "@/composables/useEditorDraft";
 import { deleteEditorDraftsFor } from "@/utils/drafts/editorDraftStore";
+import { hidesOnlineEvalEntries } from "@/composables/shared/useOnlineEvalsGate";
 
 const store = useStore();
 const { t } = useI18nTyped();
diff --git a/web/src/views/AIObservability/SaveAsPromptDialog.spec.ts b/web/src/views/AIObservability/SaveAsPromptDialog.spec.ts
index 2ba46be5f4..ae48f07925 100644
--- a/web/src/views/AIObservability/SaveAsPromptDialog.spec.ts
+++ b/web/src/views/AIObservability/SaveAsPromptDialog.spec.ts
@@ -8,7 +8,6 @@ const mocks = vi.hoisted(() => ({
   match: vi.fn(),
   create: vi.fn(),
   get: vi.fn(),
-  getVersion: vi.fn(),
   createVersion: vi.fn(),
   confirm: vi.fn(),
 }));
@@ -48,7 +47,6 @@ beforeEach(() => {
   mocks.match.mockResolvedValue([]);
   mocks.create.mockResolvedValue({ prompt });
   mocks.get.mockResolvedValue(prompt);
-  mocks.getVersion.mockResolvedValue({ version: 3, contentHash: "head-3" });
   mocks.createVersion.mockResolvedValue({ prompt: { ...prompt, latestVersion: 4 } });
 });
 
@@ -79,7 +77,7 @@ describe("save as prompt", () => {
     expect(wrapper.emitted("saved")).toHaveLength(1);
   });
 
-  it("appends to the freshly read head rather than the cached selector version", async () => {
+  it("appends to the freshly read head with baseVersion and ifHead, never baseHash", async () => {
     const wrapper = mountSave();
     const form = wrapper.findComponent(OForm).props("form");
     form.setFieldValue("mode", "append");
@@ -87,16 +85,19 @@ describe("save as prompt", () => {
     form.setFieldValue("commitMessage", "Updated content");
     await flushPromises();
     await form.handleSubmit();
-    expect(mocks.createVersion).toHaveBeenCalledWith(
-      "org",
-      "prompt-1",
-      expect.objectContaining({
-        baseVersion: 3,
-        baseHash: "head-3",
-        commitMessage: "Updated content",
-      }),
-      expect.objectContaining({ ifHead: 3 }),
-    );
+    expect(mocks.createVersion).toHaveBeenCalledTimes(1);
+    const [orgId, entityId, input, options] = mocks.createVersion.mock.calls[0];
+    expect([orgId, entityId]).toEqual(["org", "prompt-1"]);
+    // The server rejects baseVersion and baseHash together.
+    expect(input).toEqual({
+      payload: "Summarize this",
+      config,
+      commitMessage: "Updated content",
+      source: "ui",
+      baseVersion: 3,
+    });
+    expect(input).not.toHaveProperty("baseHash");
+    expect(options).toEqual(expect.objectContaining({ ifHead: 3 }));
   });
 
   it("keeps the form open when the selected prompt was archived", async () => {
diff --git a/web/src/views/AIObservability/SaveAsPromptDialog.vue b/web/src/views/AIObservability/SaveAsPromptDialog.vue
index a267bdd06f..ae835270e6 100644
--- a/web/src/views/AIObservability/SaveAsPromptDialog.vue
+++ b/web/src/views/AIObservability/SaveAsPromptDialog.vue
@@ -227,8 +227,7 @@ async function save(value: SaveAsPromptForm) {
       if (currentGeneration !== generation) return;
       if (target.status !== "active" || target.type !== content.type)
         throw new Error(t("aiObservability.promptManagement.selectActivePrompt"));
-      const base = await llmPromptsService.getVersion(orgId, target.entityId, target.latestVersion);
-      if (currentGeneration !== generation) return;
+      // baseVersion and baseHash are exclusive; ifHead turns a concurrent append into a conflict.
       const result = await createVersion.mutateAsync({
         entityId: target.entityId,
         input: {
@@ -236,8 +235,7 @@ async function save(value: SaveAsPromptForm) {
           config: content.config,
           commitMessage: value.commitMessage.trim(),
           source,
-          baseVersion: base.version,
-          baseHash: base.contentHash,
+          baseVersion: target.latestVersion,
         },
         ifHead: target.latestVersion,
         idempotencyKey: crypto.randomUUID(),
diff --git a/web/src/views/Dashboards/PublicDashboard.spec.ts b/web/src/views/Dashboards/PublicDashboard.spec.ts
index 232db6412c..7425bf6467 100644
--- a/web/src/views/Dashboards/PublicDashboard.spec.ts
+++ b/web/src/views/Dashboards/PublicDashboard.spec.ts
@@ -837,6 +837,42 @@ describe("PublicDashboard viewer", () => {
     expect(title).toBe("A (error)");
   });
 
+  it("keeps a date variable a read-only date, so a panel title formats it as the dashboard does", async () => {
+    vi.mocked(service.getConfig).mockResolvedValue({
+      data: {
+        ...panelsConfig([{ id: "p1", title: "On $day / ${day:epoch}" }]),
+        variables: [
+          {
+            name: "day",
+            label: "Day",
+            value: "2026-10-30",
+            type: "date",
+            date_format: "dmy",
+          },
+        ],
+      },
+      status: 200,
+    } as never);
+    vi.mocked(service.getData).mockResolvedValue(okSnapshot([]) as never);
+    const w = buildWrapper();
+    await flushPromises();
+    const { tabs, variables } = grid(w).props("dashboardData");
+    expect(variables.list[0]).toMatchObject({
+      type: "date",
+      value: "2026-10-30",
+      dateFormat: "dmy",
+      readOnly: true,
+    });
+    expect(variables.list[0]).not.toHaveProperty("timezone");
+    const title = getPanelDisplayTitle(
+      tabs[0].panels[0].title,
+      { values: variables.list },
+      { tabId: "t1", panelId: "p1" },
+      "All",
+    );
+    expect(title).toBe("On 30/10/2026 / 1793318400");
+  });
+
   it("shows a typed-in value without the picker's custom marker", async () => {
     vi.mocked(service.getConfig).mockResolvedValue({
       data: {
diff --git a/web/src/views/Dashboards/PublicDashboard.vue b/web/src/views/Dashboards/PublicDashboard.vue
index b227c1bc5a..d42fcafc6f 100644
--- a/web/src/views/Dashboards/PublicDashboard.vue
+++ b/web/src/views/Dashboards/PublicDashboard.vue
@@ -299,6 +299,8 @@ type PublicVariable = {
   value: unknown;
   tab_id?: string;
   panel_id?: string;
+  type?: string;
+  date_format?: string;
 };
 
 type ViewState =
@@ -392,16 +394,21 @@ const frozenVariables = computed(() => {
     : Array.isArray(config.value?.variables)
       ? config.value.variables
       : [];
-  return all.map((v, i) => ({
-    // Panel titles substitute by name; a result stored before names were sent falls back to a unique one.
-    name: v.name || `public_var_${i}`,
-    label: v.label,
-    type: "constant",
-    value: variableValue(v.value),
-    scope: v.tab_id ? "tabs" : v.panel_id ? "panels" : "global",
-    ...(v.tab_id ? { tabs: [v.tab_id] } : {}),
-    ...(v.panel_id ? { panels: [v.panel_id] } : {}),
-  }));
+  return all.map((v, i) => {
+    const isDate = v.type === "date";
+    return {
+      // Panel titles substitute by name; a result stored before names were sent falls back to a unique one.
+      name: v.name || `public_var_${i}`,
+      label: v.label,
+      // A date stays a date so titles and text format it as the dashboard does; it is read-only here.
+      type: isDate ? "date" : "constant",
+      value: isDate ? (typeof v.value === "string" ? v.value : "") : variableValue(v.value),
+      ...(isDate ? { dateFormat: v.date_format, readOnly: true } : {}),
+      scope: v.tab_id ? "tabs" : v.panel_id ? "panels" : "global",
+      ...(v.tab_id ? { tabs: [v.tab_id] } : {}),
+      ...(v.panel_id ? { panels: [v.panel_id] } : {}),
+    };
+  });
 });
 
 const dashboardData = computed(() => ({
diff --git a/web/src/views/Dashboards/RenderDashboardCharts.spec.ts b/web/src/views/Dashboards/RenderDashboardCharts.spec.ts
index 410e9ac6e8..e0a84fd669 100644
--- a/web/src/views/Dashboards/RenderDashboardCharts.spec.ts
+++ b/web/src/views/Dashboards/RenderDashboardCharts.spec.ts
@@ -1618,4 +1618,70 @@ describe("RenderDashboardCharts", () => {
       expect(wrapper.emitted("panelsValues")?.at(-1)).toEqual([true]);
     });
   });
+
+  describe("explore actions pass-through", () => {
+    let io: ReturnType<typeof installFakeIntersectionObserver>;
+
+    const PanelContainerStub = {
+      name: "PanelContainer",
+      props: ["data", "viewOnly", "exploreActions"],
+      emits: ["exploreCreateAlert", "exploreAddToDashboard"],
+      template: '<div data-test="panel-container-stub"></div>',
+    };
+    const panelSchema = {
+      id: "P1",
+      title: "Errors",
+      type: "line",
+      layout: { x: 0, y: 0, w: 6, h: 4, i: "P1" },
+      queries: [],
+    };
+
+    const mountWith = async (props: Record<string, any>) => {
+      wrapper = shallowMount(RenderDashboardCharts, {
+        props: {
+          ...defaultProps,
+          dashboardData: {
+            ...defaultProps.dashboardData,
+            tabs: [{ tabId: "default", name: "Default Tab", panels: [panelSchema] }],
+          },
+          ...props,
+        },
+        global: {
+          plugins: [i18n, store, router],
+          stubs: { ODialog: ODialogStub, PanelContainer: PanelContainerStub },
+        },
+      });
+      await flushPromises();
+      await vi.waitFor(() => expect(wrapper.vm.shouldMountPanel("P1")).toBe(true));
+      await flushPromises();
+    };
+    const panel = () => wrapper.findComponent({ name: "PanelContainer" });
+
+    beforeEach(() => {
+      io = installFakeIntersectionObserver({ autoVisible: true });
+    });
+
+    afterEach(() => {
+      io.restore();
+    });
+
+    it("passes exploreActions to the panel, off by default", async () => {
+      await mountWith({ viewOnly: true });
+      expect(panel().props("exploreActions")).toBe(false);
+      wrapper.unmount();
+
+      await mountWith({ viewOnly: true, exploreActions: true });
+      expect(panel().props("exploreActions")).toBe(true);
+    });
+
+    it("re-emits the panel's explore events with the panel schema", async () => {
+      await mountWith({ viewOnly: true, exploreActions: true });
+
+      panel().vm.$emit("exploreCreateAlert", panelSchema);
+      panel().vm.$emit("exploreAddToDashboard", panelSchema);
+
+      expect(wrapper.emitted("exploreCreateAlert")).toEqual([[panelSchema]]);
+      expect(wrapper.emitted("exploreAddToDashboard")).toEqual([[panelSchema]]);
+    });
+  });
 });
diff --git a/web/src/views/Dashboards/RenderDashboardCharts.vue b/web/src/views/Dashboards/RenderDashboardCharts.vue
index e38340dacd..1d0c8c3f33 100644
--- a/web/src/views/Dashboards/RenderDashboardCharts.vue
+++ b/web/src/views/Dashboards/RenderDashboardCharts.vue
@@ -114,6 +114,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             @onDeletePanel="onDeletePanel"
             @onViewPanel="onViewPanel"
             :viewOnly="viewOnly"
+            :exploreActions="exploreActions"
             :kiosk="kiosk"
             :layoutMode="layoutMode"
             :data="panels[0] || {}"
@@ -149,6 +150,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             @onEditLayout="openEditLayout"
             @contextmenu="$emit('chart:contextmenu', $event)"
             @send-to-ai-chat="(value, append) => $emit('sendToAiChat', value, append)"
+            @exploreCreateAlert="$emit('exploreCreateAlert', $event)"
+            @exploreAddToDashboard="$emit('exploreAddToDashboard', $event)"
           />
         </div>
         <div
@@ -217,6 +220,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   @onDeletePanel="onDeletePanel"
                   @onViewPanel="onViewPanel"
                   :viewOnly="viewOnly"
+                  :exploreActions="exploreActions"
                   :kiosk="kiosk"
                   :layoutMode="layoutMode"
                   :data="item"
@@ -256,6 +260,8 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   @update:runId="updateRunId"
                   @contextmenu="$emit('chart:contextmenu', $event)"
                   @send-to-ai-chat="(value, append) => $emit('sendToAiChat', value, append)"
+                  @exploreCreateAlert="$emit('exploreCreateAlert', $event)"
+                  @exploreAddToDashboard="$emit('exploreAddToDashboard', $event)"
                 >
                   <!-- Panel-Level Variables (shown below drag-allow section) -->
                   <template #panel-variables>
@@ -427,6 +433,8 @@ export default defineComponent({
     "variablesManagerReady",
     "sendToAiChat",
     "layoutChange",
+    "exploreCreateAlert",
+    "exploreAddToDashboard",
   ],
   props: {
     viewOnly: {},
@@ -514,6 +522,11 @@ export default defineComponent({
       type: Boolean,
       default: false,
     },
+    /** Adds a Create alert / Add to dashboard menu to each panel; only takes effect with viewOnly. */
+    exploreActions: {
+      type: Boolean,
+      default: false,
+    },
   },
 
   components: {
diff --git a/web/src/views/DatabaseMonitoring/DatabasesPage.vue b/web/src/views/DatabaseMonitoring/DatabasesPage.vue
index 545e599fb5..2d908346d6 100644
--- a/web/src/views/DatabaseMonitoring/DatabasesPage.vue
+++ b/web/src/views/DatabaseMonitoring/DatabasesPage.vue
@@ -109,6 +109,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
               :top-n-subset="topNSubset"
               :error-count="errorCount"
               exact-percentiles
+              :slowest-schema-speeds="showsSlowestSchemaSpeeds"
               data-test="dbm-databases-coverage"
             />
           </DbmTableToolbar>
@@ -205,9 +206,21 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             </span>
             <div class="text-text-secondary text-3xs flex min-w-0 items-center gap-1">
               <OTag type="dbSystem" :value="row.db_system" size="xs" />
-              <template v-if="row.db_namespace">
+              <template v-if="namedSchemaCount(row) === 1">
                 <span class="opacity-45">·</span>
-                <OTruncatedText>{{ row.db_namespace }}</OTruncatedText>
+                <OTruncatedText>{{ row.namedSchemas?.[0] }}</OTruncatedText>
+              </template>
+              <template v-else-if="namedSchemaCount(row) > 1">
+                <span class="opacity-45">·</span>
+                <span class="shrink-0" data-test="dbm-databases-schema-count">
+                  {{
+                    t(
+                      "dbm.databases.schemaCount",
+                      { count: namedSchemaCount(row) },
+                      namedSchemaCount(row),
+                    )
+                  }}
+                </span>
               </template>
               <!-- The receiver can reach it, no application asked it anything.
                    That is a finding, not an absence — an idle replica is what
@@ -441,7 +454,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
 // silently drop the page from the cache and bring back the refetch-on-return.
 defineOptions({ name: "DbmDatabasesPage" });
 
-import { computed, ref, watch, shallowRef } from "vue";
+import { computed, onActivated, ref, watch, shallowRef } from "vue";
 import { useRoute, useRouter } from "vue-router";
 import { useStore } from "vuex";
 
@@ -478,13 +491,22 @@ import { tabCountProps } from "@/composables/dbm/useDbmTabCounts";
 import { useDbmListPage } from "@/composables/dbm/useDbmListPage";
 import { useDbmOwnFilterSync } from "@/composables/dbm/useDbmScopeFilters";
 import { createDbmContextProvider } from "@/composables/contextProviders";
-import { buildDatabaseBreakdown, type DbmBreakdown } from "@/utils/dbm/breakdown";
+import { buildDatabaseBreakdown, rowNamespace, type DbmBreakdown } from "@/utils/dbm/breakdown";
 import {
   isBreakdownRow,
+  schemaShortfall,
   showsShortfall,
-  toBreakdownRows,
+  toSchemaRows,
   type DbmBreakdownRow,
 } from "@/utils/dbm/breakdownRows";
+import {
+  drowningInstanceKeys,
+  foldByInstance,
+  hasWorstOfPercentiles,
+  instanceKey,
+  isCriticalServer,
+  serverRowKey,
+} from "@/utils/dbm/instanceRows";
 import {
   computeQps,
   errorRate,
@@ -501,7 +523,6 @@ import type { DbmInstanceMetricSet, DbmRowMetrics } from "@/utils/dbm/instanceMe
 import { unionFleetRows, type DbmServerInstanceRef } from "@/utils/dbm/fleetRows";
 import { healthScalar, healthSortValue } from "@/utils/dbm/healthScalar";
 import { APP_SOURCE_QUALIFIER } from "@/utils/dbm/overlapMetrics";
-import { detectDrowningDatabases, isCriticalErrorRate, totalsKey } from "@/utils/dbm/insights";
 import DbmOverlapValue from "@/components/dbm/DbmOverlapValue.vue";
 import { hasDbmTraceVantage } from "@/composables/dbm/useDbmTraceVantage";
 import { buildDbmPrefill } from "@/utils/alerts/prefill/fromDbm";
@@ -553,16 +574,32 @@ const permissionOk = ref(true);
 // still return staging merged with prod — a filter that lies is worse than no
 // filter. Top queries is the grain that genuinely accepts `env`.
 const systemFilter = ref<string | null>((route.query.system as string) ?? null);
+// Client-side: the endpoint takes no namespace, and every schema is already in the response.
+const namespaceFilter = ref<string | null>((route.query.namespace as string) ?? null);
+
+// A schema row's hand-off scopes the page it opened; the tabs carrying it back must not filter this one.
+let handedOffSchema: string | null = null;
+const returnsWithHandedOffSchema = () =>
+  handedOffSchema !== null && route.query.namespace === handedOffSchema;
 
 // This page is kept alive, so the seeds above run ONCE per session — a filter
 // set (or cleared) on a sibling tab would otherwise never reach these refs,
 // leaving the chips and the next read disagreeing with the URL. Re-read on
 // activation, the same moment the range sync uses.
 useDbmOwnFilterSync(
-  () => route.query,
-  { system: systemFilter },
+  () =>
+    returnsWithHandedOffSchema()
+      ? { ...route.query, namespace: namespaceFilter.value ?? undefined }
+      : route.query,
+  { system: systemFilter, namespace: namespaceFilter },
   () => void load(),
 );
+// Registered after the re-seed above, which still needs the hand-off to tell it apart.
+onActivated(() => {
+  const returned = returnsWithHandedOffSchema();
+  handedOffSchema = null;
+  if (returned) void syncUrl();
+});
 /** Kept so the empty state can say "we haven't finished counting" rather than "no data". */
 const neverAggregated = ref(false);
 /**
@@ -586,6 +623,10 @@ const failedMetricStreams = ref<string[]>([]);
  * when it lands without refetching them.
  */
 const clientHits = shallowRef<DbTotalsRow[]>([]);
+/** The previous window's rows, so a Schema filter change re-derives drowning without a refetch. */
+const baselineHits = shallowRef<DbTotalsRow[]>([]);
+const baselineReadFailed = ref(false);
+/** Drowning servers, by `instanceKey`. */
 const drowningKeys = ref<Set<string>>(new Set());
 
 /** At most this many service chips per row before the cell collapses the rest. */
@@ -594,8 +635,12 @@ const MAX_VISIBLE_SERVICES = 3;
 interface DatabaseRow extends Partial<DbTotalsRow> {
   db_system: string;
   db_instance: string;
-  /** OTable needs a stable identity; the grain is (system, instance, namespace). */
+  /** OTable needs a stable identity; the grain is (system, instance). */
   rowKey: string;
+  /** The per-schema rows this server row was folded from — its schema children. */
+  schemas?: DbTotalsRow[];
+  /** The named schemas among them, heaviest first. */
+  namedSchemas?: string[];
   share: number;
   errorRate: number | null;
   /**
@@ -700,7 +745,8 @@ const summaryStats = computed<StatItem[]>(() => {
 });
 
 const isFiltered = computed(
-  () => !!search.value || !!systemFilter.value || statFilter.value !== null,
+  () =>
+    !!search.value || !!systemFilter.value || !!namespaceFilter.value || statFilter.value !== null,
 );
 
 // Every filter change publishes the scope to the URL BEFORE reloading — the
@@ -710,6 +756,20 @@ const filterEntry = createDbmFilterEntry(() => {
   load();
 });
 
+// The Schema filter narrows rows already in memory, so a refetch would only reset the open rows.
+const schemaFilterEntry = createDbmFilterEntry(async () => {
+  // The shell re-keys the badges on the URL, and drops a count published before it did.
+  await syncUrl();
+  if (error.value) {
+    load();
+    return;
+  }
+  if (loading.value) return;
+  breakdowns.value = {};
+  deriveRows();
+  fillOpenBreakdowns();
+});
+
 /**
  * The same popover-and-chips control Top queries uses. Only the dimensions this
  * endpoint actually accepts are offered — a select that silently did nothing
@@ -723,6 +783,14 @@ const dimensionFilters = computed<DbmScopeFilter[]>(() => [
     options: optionsFrom(rows.value.map((r) => r.db_system)),
     model: systemFilter,
   }),
+  // From the unfolded response, so the selected schema stays among the options.
+  schemaFilterEntry({
+    key: "namespace",
+    dimension: t("dbm.filters.dimension.namespace"),
+    placeholder: t("dbm.filters.allNamespaces"),
+    options: optionsFrom(clientHits.value.map((r) => r.db_namespace)),
+    model: namespaceFilter,
+  }),
 ]);
 
 /**
@@ -736,12 +804,19 @@ const visibleRows = computed(() => {
     statFilter.value === "failed" ? rows.value.filter((row) => (row.errors ?? 0) > 0) : rows.value;
   if (!needle) return scoped;
   return scoped.filter((row) =>
-    [row.db_instance, row.db_namespace, row.db_system, ...(row.calling_services ?? [])]
+    [
+      row.db_instance,
+      row.db_system,
+      ...(row.schemas ?? []).map((schema) => schema.db_namespace),
+      ...(row.calling_services ?? []),
+    ]
       .filter(Boolean)
       .some((field) => String(field).toLowerCase().includes(needle)),
   );
 });
 
+const showsSlowestSchemaSpeeds = computed(() => hasWorstOfPercentiles(visibleRows.value));
+
 // ── the in-place breakdown ──────────────────────────────────────────────────
 //
 // The split renders as TREE CHILD ROWS of this table, not as a panel with a
@@ -800,8 +875,9 @@ const treeRows = computed<TableRow[]>(() =>
       // chevron onto a fetch that can only ever come back empty.
       children: row.trafficless
         ? []
-        : toBreakdownRows(
+        : toSchemaRows(
             state && { breakdown: state.breakdown, loading: state.loading, failed: !!state.error },
+            row.schemas ?? [],
             row.rowKey,
           ),
     };
@@ -921,35 +997,28 @@ const onSortChange = ({ column, order }: { column: string; order: "asc" | "desc"
   sortOrder.value = order;
 };
 
-/**
- * Whether this database's split falls short of its own total. Only an open
- * database can have one — OTable renders the warning row between a parent and
- * its children, which is exactly where the gap is readable.
- *
- * `showsShortfall` owns the rule, and the case it excludes is the one that made
- * this caveat repeat verbatim under all four databases: nothing attributed puts
- * every row's shortfall at exactly 1, and the `empty` placeholder child already
- * says that better.
- */
-const hasShortfall = (row: TableRow): boolean => {
-  if (isBreakdownRow(row)) return false;
+// Zero attribution is left to the `empty` placeholder, so one 100% caveat never repeats under every row.
+const shortfallOf = (row: TableRow): number | null => {
+  if (isBreakdownRow(row)) return schemaShortfall(row);
+  // Schema children are exact totals that add up to the server, so its gap shows on each schema row.
+  if (namedSchemaCount(row) > 0) return null;
   const state = breakdowns.value[row.rowKey];
   return showsShortfall(
     state && { breakdown: state.breakdown, loading: state.loading, failed: !!state.error },
-  );
+  )
+    ? breakdownFor(row).breakdown.shortfall
+    : null;
 };
 
+const hasShortfall = (row: TableRow): boolean => shortfallOf(row) !== null;
+
 /**
  * What the shortfall means for the rows below it, with the number attached. A
  * caveat carrying a figure is a disclosure; one without is a disclaimer nobody
  * reads — the rule the coverage line above the table already follows.
  */
 const shortfallLine = (row: TableRow): I18nText =>
-  isBreakdownRow(row)
-    ? raw("")
-    : t("dbm.breakdown.shortfall", {
-        percent: formatPercent(breakdownFor(row).breakdown.shortfall ?? 0, 0),
-      });
+  t("dbm.breakdown.shortfall", { percent: formatPercent(shortfallOf(row) ?? 0, 0) });
 
 /**
  * What the placeholder child says. The failure keeps the server's own wording
@@ -979,15 +1048,7 @@ const statusLine = (row: DbmBreakdownRow): I18nText => {
 const instanceBreakdowns = shallowRef<Record<string, QueryStatsRow[]> | null>(null);
 const breakdownFailed = ref(false);
 
-/**
- * File one database's split from what the last load returned.
- *
- * The row's own exact total rides along so the aggregation can report its
- * shortfall rather than presenting a sum that silently does not reconcile. The
- * split is keyed by INSTANCE, and that is the grain it always had: the
- * per-row request scoped on `instance` alone, so two namespace rows on one
- * instance received the same response then and read the same entry now.
- */
+// The row's exact total rides along so the split reports its shortfall instead of a sum that does not add up.
 const fileBreakdown = (row: DatabaseRow) => {
   const section = instanceBreakdowns.value;
   if (!section || breakdownFailed.value) {
@@ -1007,7 +1068,12 @@ const fileBreakdown = (row: DatabaseRow) => {
       // An instance with no rows in the split is an EMPTY breakdown, not a
       // failure: nothing was attributable, which the `empty` placeholder
       // already says better than an error would.
-      breakdown: buildDatabaseBreakdown(section[row.db_instance] ?? [], row.total_time_ns),
+      breakdown: buildDatabaseBreakdown(
+        (section[row.db_instance] ?? []).filter(
+          (entry) => !namespaceFilter.value || rowNamespace(entry) === namespaceFilter.value,
+        ),
+        row.total_time_ns,
+      ),
       loading: false,
       error: null,
     },
@@ -1073,13 +1139,14 @@ watch(serverKnownInstances, () => {
  * an idle replica.
  */
 const applyInstanceMetrics = () => {
-  const hits = clientHits.value;
+  const hits = foldByInstance(clientHits.value, namespaceFilter.value);
   const total = hits.reduce((acc, row) => acc + (row.total_time_ns ?? 0), 0);
   // With no metrics the union is the identity over the client rows, which is
   // exactly the page as it shipped.
   rows.value = unionFleetRows(hits, instanceMetrics.value, {
     failedStreams: failedMetricStreams.value,
     system: systemFilter.value,
+    namespace: namespaceFilter.value,
     // The instances the SERVER vantage knows, from data the shell already
     // fetched for the tab badges. This is what keeps the overview honest for
     // the user who wired up collector recipes but has no APM: their fleet is
@@ -1090,15 +1157,23 @@ const applyInstanceMetrics = () => {
     const idle = row.trafficless;
     return {
       ...row,
+      rowKey: idle ? row.rowKey : serverRowKey(row),
       share: !idle && total > 0 ? (row.total_time_ns ?? 0) / total : 0,
       errorRate: idle ? null : errorRate(row.errors, row.calls),
-      drowning: !idle && drowningKeys.value.has(totalsKey(row as DbTotalsRow)),
-      critical: !idle && isCriticalErrorRate(row.errors, row.calls),
+      drowning: !idle && drowningKeys.value.has(instanceKey(row)),
+      critical: !idle && isCriticalServer(row),
       chips: idle ? [] : databaseChips(row as DbTotalsRow),
     };
   });
 };
 
+const deriveRows = () => {
+  drowningKeys.value = baselineReadFailed.value
+    ? new Set()
+    : drowningInstanceKeys(clientHits.value, baselineHits.value, namespaceFilter.value);
+  applyInstanceMetrics();
+};
+
 const { getStreams } = useStreams(t);
 
 /**
@@ -1193,17 +1268,12 @@ const load = () =>
       topNSubset.value = data.top_n_subset;
       neverAggregated.value = data.freshness?.data_through === 0;
 
-      const drowning = data.baseline_read_failed
-        ? new Set<string>()
-        : new Set(
-            detectDrowningDatabases(hits, data.baseline_hits ?? []).map((d) => totalsKey(d.row)),
-          );
-
       clientHits.value = hits;
-      drowningKeys.value = drowning;
+      baselineHits.value = data.baseline_hits ?? [];
+      baselineReadFailed.value = !!data.baseline_read_failed;
       instanceBreakdowns.value = data.breakdown ?? null;
       breakdownFailed.value = !!data.breakdown_read_failed;
-      applyInstanceMetrics();
+      deriveRows();
       // Rows that were open before the reload need their split re-filed for
       // the new window; the watcher only fires when the open SET changes.
       fillOpenBreakdowns();
@@ -1282,6 +1352,10 @@ const databaseChips = (row: DbTotalsRow): DbmRowChip[] =>
 const missing = (value: number | null | undefined): boolean =>
   value === null || value === undefined;
 
+/** How many named schemas a server row was folded from; 0 on a child row. */
+const namedSchemaCount = (row: TableRow): number =>
+  isBreakdownRow(row) ? 0 : (row.namedSchemas?.length ?? 0);
+
 /** The placeholder standing in for a split that has not arrived — no figures. */
 const isStatusRow = (row: TableRow): boolean => isBreakdownRow(row) && row.kind === "status";
 
@@ -1413,14 +1487,7 @@ const onRowAction = (id: string, row: DatabaseRow) => {
   );
 };
 
-/**
- * Columns. Sorting is client-side over the complete set, so every numeric
- * column can be sorted honestly — unlike the Top queries table, where the
- * server owns the order and only whitelisted keys may claim to be sortable.
- *
- * The percentile headers say what they mean. These are exact per-database
- * figures, so unlike the query grain they need no qualifier.
- */
+// Percentiles cannot be pooled, so a server spanning several schemas shows its worst schema's.
 const allColumns = computed<OTableColumnDef<TableRow>[]>(() => [
   {
     id: "instance",
@@ -1615,6 +1682,7 @@ const defaultColumnVisibility = {};
 
 const clearScope = () => {
   systemFilter.value = null;
+  namespaceFilter.value = null;
   statFilter.value = null;
   // Clear the SEARCH too, the way every sibling tab's clear does
   // (TableHealthPage, SamplesPage, QueriesPage). Leaving it set makes "clear"
@@ -1642,7 +1710,7 @@ const clearScope = () => {
  * from `route.query`, leaving them in the URL means a "cleared" section is
  * still filtered the moment the reader switches tabs.
  */
-const syncUrl = ({ clearAllScope = false }: { clearAllScope?: boolean } = {}) => {
+const syncUrl = ({ clearAllScope = false }: { clearAllScope?: boolean } = {}) =>
   router
     .replace({
       name: route.name as string,
@@ -1650,6 +1718,7 @@ const syncUrl = ({ clearAllScope = false }: { clearAllScope?: boolean } = {}) =>
         ...route.query,
         ...queryParams.value,
         system: systemFilter.value ?? undefined,
+        namespace: namespaceFilter.value ?? undefined,
         ...(clearAllScope
           ? {
               instance: undefined,
@@ -1662,7 +1731,6 @@ const syncUrl = ({ clearAllScope = false }: { clearAllScope?: boolean } = {}) =>
       },
     })
     .catch(() => {});
-};
 
 /**
  * Every cause resolves to an action, including `not-instrumented` — the default
@@ -1688,6 +1756,13 @@ const onEmptyAction = (cause: DbmEmptyCauseId) => {
   }
 };
 
+/** A server row hands off the overview's Schema filter, never the one schema it happens to hold. */
+const handOffSchema = (schema?: string | null): string | null => {
+  const namespace = schema ?? namespaceFilter.value;
+  handedOffSchema = namespace !== namespaceFilter.value ? namespace : null;
+  return namespace;
+};
+
 /**
  * The overview's job is to hand off — a row click carries its scope along, so
  * the Top queries tab opens already filtered to the database the user clicked
@@ -1695,12 +1770,12 @@ const onEmptyAction = (cause: DbmEmptyCauseId) => {
  *
  * `target` is what a breakdown leaf adds: the schema and service the reader
  * picked, so every node of the split is a filter into the query grain rather
- * than a dead end. Its schema wins over the row's, because the leaf is the
+ * than a dead end. Its schema wins over the Schema filter's, because the leaf is the
  * narrower and more recent statement of what the reader wants.
  */
 /** The Metrics tab, scoped to this database — window and filters carry. */
 const openMetrics = (row: DatabaseRow, namespaceOverride?: string | null) => {
-  const namespace = namespaceOverride ?? row.db_namespace;
+  const namespace = handOffSchema(namespaceOverride);
   router
     .push({
       name: "dbmMetrics",
@@ -1710,7 +1785,7 @@ const openMetrics = (row: DatabaseRow, namespaceOverride?: string | null) => {
         ...queryParams.value,
         system: row.db_system,
         instance: row.db_instance,
-        ...(namespace ? { namespace } : {}),
+        namespace: namespace ?? undefined,
       },
     })
     .catch(() => {});
@@ -1720,7 +1795,7 @@ const openQueries = (
   row: DatabaseRow,
   target?: { namespace: string | null; service: string | null },
 ) => {
-  const namespace = target?.namespace ?? row.db_namespace;
+  const namespace = handOffSchema(target?.namespace);
   router
     .push({
       name: "dbmQueries",
@@ -1730,7 +1805,7 @@ const openQueries = (
         ...queryParams.value,
         system: row.db_system,
         instance: row.db_instance,
-        ...(namespace ? { namespace } : {}),
+        namespace: namespace ?? undefined,
         ...(target?.service ? { service: target.service } : {}),
       },
     })
@@ -1775,6 +1850,7 @@ const dbmContext = createDbmContextProvider(
       endTime: current.value.endTime,
       period: range.value.relativeTimePeriod,
       system: systemFilter.value,
+      namespace: namespaceFilter.value,
     },
   }),
   store,
diff --git a/web/src/views/DatabaseMonitoring/dbmDatabasesSchemaScope.spec.ts b/web/src/views/DatabaseMonitoring/dbmDatabasesSchemaScope.spec.ts
new file mode 100644
index 0000000000..24b14eaa70
--- /dev/null
+++ b/web/src/views/DatabaseMonitoring/dbmDatabasesSchemaScope.spec.ts
@@ -0,0 +1,439 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { flushPromises, mount, type VueWrapper } from "@vue/test-utils";
+import { defineComponent, h, type PropType } from "vue";
+import { createMemoryHistory, createRouter, RouterView, type Router } from "vue-router";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
+
+import type { DatabasesResponse, QueryStatsRow } from "@/services/db_monitoring";
+import type { DbmScopeFilter } from "@/components/dbm/DbmScopeFilters.vue";
+import type { DbmRowAction } from "@/components/dbm/DbmRowActions.vue";
+
+vi.mock("vuex", () => ({
+  useStore: () => ({
+    state: {
+      selectedOrganization: { identifier: "acme" },
+      zoConfig: { database_monitoring_enabled: true },
+      theme: "light",
+    },
+    dispatch: vi.fn(),
+  }),
+}));
+
+vi.mock("@/services/db_monitoring", () => ({
+  default: {
+    getBadges: vi.fn(),
+    getDatabases: vi.fn(),
+    getInstanceMetrics: vi.fn(),
+  },
+}));
+
+vi.mock("@/composables/useStreams", () => ({
+  default: () => ({ getStreams: vi.fn().mockResolvedValue({ list: [] }) }),
+}));
+
+const { default: dbMonitoringService } = await import("@/services/db_monitoring");
+const { queryClient } = await import("@/composables/query/queryClient");
+const { contextRegistry } = await import("@/composables/contextProviders");
+const { default: DbmShell } = await import("./DbmShell.vue");
+const { default: DatabasesPage } = await import("./DatabasesPage.vue");
+
+const service = dbMonitoringService as unknown as Record<string, ReturnType<typeof vi.fn>>;
+
+const SECOND = 1_000_000_000;
+
+/** `/databases` as the server answers it: one row per (system, instance, namespace). */
+const databasesResponse = (): DatabasesResponse => ({
+  hits: [
+    {
+      db_system: "postgresql",
+      db_instance: "pg-orders",
+      db_namespace: "orders",
+      calls: 800,
+      errors: 0,
+      total_time_ns: 8 * SECOND,
+      p95_ns: 4_000_000,
+      calling_services: ["checkout"],
+    },
+    {
+      db_system: "postgresql",
+      db_instance: "pg-billing",
+      db_namespace: "billing",
+      calls: 400,
+      errors: 0,
+      total_time_ns: 2 * SECOND,
+      p95_ns: 9_000_000,
+      calling_services: ["invoice"],
+    },
+    {
+      db_system: "postgresql",
+      db_instance: "pg-billing",
+      db_namespace: "ledger",
+      calls: 100,
+      errors: 0,
+      total_time_ns: 1 * SECOND,
+      p95_ns: 3_000_000,
+      calling_services: ["ledger-svc"],
+    },
+    {
+      db_system: "mysql",
+      db_instance: "my-cart",
+      db_namespace: "",
+      calls: 50,
+      errors: 0,
+      total_time_ns: 1 * SECOND,
+      p95_ns: 2_000_000,
+      calling_services: ["cart"],
+    },
+    {
+      db_system: "redis",
+      db_instance: "valkey-cart",
+      db_namespace: "",
+      calls: 30,
+      errors: 0,
+      total_time_ns: 1 * SECOND,
+      p95_ns: 1_000_000,
+      calling_services: ["cart"],
+    },
+  ],
+  baseline_hits: [],
+  breakdown: {
+    // `invoice` covers half of `billing`; `ledger-svc` covers all of `ledger`.
+    "pg-billing": [
+      stat("pg-billing", "billing", "invoice", SECOND),
+      stat("pg-billing", "ledger", "ledger-svc", SECOND),
+    ],
+    "pg-orders": [stat("pg-orders", "orders", "checkout", 8 * SECOND)],
+    // Schemaless engine: 60% of its time attributed to a service.
+    "my-cart": [stat("my-cart", null, "cart", 0.6 * SECOND, "mysql")],
+    // Nothing attributed at all: the `empty` placeholder speaks, not a caveat.
+    "valkey-cart": [],
+  },
+  freshness: { data_through: 1_700_000_000_000_000 },
+});
+
+function stat(
+  instance: string,
+  namespace: string | null,
+  serviceName: string,
+  totalTimeNs: number,
+  system = "postgresql",
+): QueryStatsRow {
+  return {
+    fingerprint: `${instance}-${serviceName}`,
+    db_system: system,
+    db_instance: instance,
+    ...(namespace ? { db_namespace: namespace } : {}),
+    service_name: serviceName,
+    calls: 10,
+    errors: 0,
+    total_time_ns: totalTimeNs,
+    p95_ns: 1_000_000,
+  } as QueryStatsRow;
+}
+
+/** `/badges`: the client vantage names two postgres servers; activity knows a replica too. */
+const badgesEnvelope = () => ({
+  databases: databasesResponse(),
+  queries: { total: 12, hits: [] },
+  activity: {
+    by_state: [{ state: "active", sessions: 1 }],
+    hits: [{ db_system: "postgresql", db_instance: "pg-replica" }],
+  },
+  deadlocks: { total: 0 },
+  blocking: { total: 0 },
+  table_health: { total: 0 },
+});
+
+interface TreeRow {
+  rowKey: string;
+  db_instance?: string;
+  namespace?: string | null;
+  children?: TreeRow[];
+}
+
+const OTableStub = defineComponent({
+  name: "OTable",
+  props: {
+    data: { type: Array as PropType<TreeRow[]>, default: () => [] },
+    getRowWarning: { type: Function as PropType<(row: TreeRow) => boolean>, default: null },
+    expandedIds: { type: Array as PropType<string[]>, default: () => [] },
+  },
+  emits: ["row-click", "update:expandedIds", "sort-change"],
+  setup(props, { slots }) {
+    const walk = (rows: TreeRow[]): TreeRow[] =>
+      rows.flatMap((row) => [
+        row,
+        ...(props.expandedIds.includes(row.rowKey) ? walk(row.children ?? []) : []),
+      ]);
+    return () =>
+      h("div", [
+        slots.toolbar?.(),
+        ...walk(props.data).map((row) =>
+          h("div", { key: row.rowKey }, [
+            props.getRowWarning?.(row) ? slots["tree-warning"]?.({ row }) : null,
+            slots["cell-actions"]?.({ row }),
+          ]),
+        ),
+      ]);
+  },
+});
+
+const DbmPageChromeStub = defineComponent({
+  name: "DbmPageChrome",
+  props: { tabCounts: { type: Object, default: () => ({}) } },
+  setup:
+    (_, { slots }) =>
+    () =>
+      h("div", slots.default?.()),
+});
+
+const DbmTableToolbarStub = defineComponent({
+  name: "DbmTableToolbar",
+  setup:
+    (_, { slots }) =>
+    () =>
+      h("div", slots.filters?.()),
+});
+
+const DbmScopeFiltersStub = defineComponent({
+  name: "DbmScopeFilters",
+  props: { filters: { type: Array as PropType<DbmScopeFilter[]>, default: () => [] } },
+  setup: () => () => h("div"),
+});
+
+const DbmRowActionsStub = defineComponent({
+  name: "DbmRowActions",
+  props: { actions: { type: Array as PropType<DbmRowAction[]>, default: () => [] } },
+  emits: ["action"],
+  setup: () => () => h("div"),
+});
+
+const stubs = {
+  OTable: OTableStub,
+  DbmPageChrome: DbmPageChromeStub,
+  DbmTableToolbar: DbmTableToolbarStub,
+  DbmScopeFilters: DbmScopeFiltersStub,
+  DbmRowActions: DbmRowActionsStub,
+  DbmCoverageLine: true,
+  DbmEmptyState: true,
+  DbmInstanceHealthCell: true,
+  DbmRowChips: true,
+  DbmServiceList: true,
+  DbmSubheaderBand: true,
+  DbmOverlapValue: true,
+  DateTime: true,
+  ORefreshButton: true,
+  OEmptyState: true,
+  OTag: true,
+  OTruncatedText: true,
+  OIcon: true,
+  OStatStrip: true,
+  OTooltip: true,
+};
+
+const Elsewhere = defineComponent({ name: "DbmElsewhere", render: () => h("div") });
+
+let wrapper: VueWrapper | null = null;
+
+const settle = async () => {
+  for (let i = 0; i < 5; i += 1) await flushPromises();
+};
+
+const mountOverview = async (query: Record<string, string> = {}) => {
+  const router = createRouter({
+    history: createMemoryHistory(),
+    routes: [
+      {
+        path: "/dbm",
+        component: DbmShell,
+        children: [
+          { path: "databases", name: "dbmDatabases", component: DatabasesPage },
+          { path: "metrics", name: "dbmMetrics", component: Elsewhere },
+          { path: "queries", name: "dbmQueries", component: Elsewhere },
+        ],
+      },
+    ],
+  });
+  await router.push({ name: "dbmDatabases", query: { org_identifier: "acme", ...query } });
+  await router.isReady();
+  wrapper = mount(defineComponent({ render: () => h(RouterView) }), {
+    global: { plugins: [router], stubs },
+  });
+  await settle();
+  return { router, wrapper };
+};
+
+const chrome = () => wrapper!.findComponent(DbmPageChromeStub);
+const table = () => wrapper!.findComponent(OTableStub);
+const badge = () => (chrome().props("tabCounts") as { databaseCount: unknown }).databaseCount;
+const topRows = () => table().props("data") as TreeRow[];
+const serverRow = (instance: string) => topRows().find((row) => row.db_instance === instance)!;
+
+const setSchema = async (value: string | null) => {
+  const filters = wrapper!.findComponent(DbmScopeFiltersStub).props("filters") as DbmScopeFilter[];
+  filters.find((filter) => filter.key === "namespace")!.onChange(value as string);
+  await settle();
+};
+
+const expand = async (instance: string) => {
+  table().vm.$emit("update:expandedIds", [serverRow(instance).rowKey]);
+  await settle();
+};
+
+beforeEach(() => {
+  vi.clearAllMocks();
+  queryClient.clear();
+  service.getDatabases.mockImplementation(() => Promise.resolve({ data: databasesResponse() }));
+  service.getBadges.mockImplementation(() => Promise.resolve({ data: badgesEnvelope() }));
+  service.getInstanceMetrics.mockResolvedValue({ data: { hits: [], streams: [] } });
+});
+
+afterEach(() => {
+  wrapper?.unmount();
+  wrapper = null;
+});
+
+describe("the Schema filter republishes the fleet count under the scope it narrowed", () => {
+  it("publishes the server count, trafficless replica included", async () => {
+    await mountOverview();
+    expect(topRows().map((row) => row.db_instance)).toHaveLength(5);
+    expect(badge()).toBe(5);
+  });
+
+  it("narrows the badge to the servers holding the schema", async () => {
+    await mountOverview();
+    await setSchema("ledger");
+    expect(topRows().map((row) => row.db_instance)).toEqual(["pg-billing"]);
+    expect(badge()).toBe(1);
+  });
+
+  // The cached unfiltered fan-out replaces the snapshot on re-key, so a count published first is lost.
+  it("keeps the page's own count once the cleared filter's URL has settled", async () => {
+    const { router } = await mountOverview();
+    await setSchema("ledger");
+    await setSchema(null);
+    expect(router.currentRoute.value.query.namespace).toBeUndefined();
+    expect(topRows()).toHaveLength(5);
+    expect(badge(), "the fan-out's 4 must not stand over the page's exact union").toBe(5);
+  });
+});
+
+describe("the coverage caveat follows the shared shortfall rule at runtime", () => {
+  const caveats = () =>
+    wrapper!
+      .findAll('[data-test^="dbm-databases-shortfall-"]')
+      .map((node) => [node.attributes("data-test"), node.text()]);
+
+  it("states a schema row's own gap, not its server's", async () => {
+    await mountOverview();
+    await expand("pg-billing");
+    const parent = serverRow("pg-billing").rowKey;
+    expect(caveats()).toEqual([
+      [`dbm-databases-shortfall-${parent}/schema:billing`, expect.stringContaining("50%")],
+    ]);
+  });
+
+  it("states a schemaless server's gap against its total", async () => {
+    await mountOverview();
+    await expand("my-cart");
+    expect(caveats()).toEqual([
+      [`dbm-databases-shortfall-${serverRow("my-cart").rowKey}`, expect.stringContaining("40%")],
+    ]);
+  });
+
+  it("stays silent when nothing was attributed", async () => {
+    await mountOverview();
+    await expand("valkey-cart");
+    expect(caveats()).toEqual([]);
+  });
+});
+
+describe("a hand-off from the overview scopes the target, not the overview", () => {
+  const pushed = (router: Router) => router.currentRoute.value;
+
+  it("opens Metrics for a single-schema server without naming its schema", async () => {
+    const { router } = await mountOverview();
+    table().vm.$emit("row-click", serverRow("pg-orders"));
+    await settle();
+    expect(pushed(router).name).toBe("dbmMetrics");
+    expect(pushed(router).query.instance).toBe("pg-orders");
+    expect(pushed(router).query.namespace).toBeUndefined();
+  });
+
+  it("opens Top queries for a single-schema server without naming its schema", async () => {
+    const { router } = await mountOverview();
+    const index = topRows().findIndex((row) => row.db_instance === "pg-orders");
+    wrapper!.findAllComponents(DbmRowActionsStub)[index].vm.$emit("action", "open");
+    await settle();
+    expect(pushed(router).name).toBe("dbmQueries");
+    expect(pushed(router).query.instance).toBe("pg-orders");
+    expect(pushed(router).query.namespace).toBeUndefined();
+  });
+
+  it("carries the active Schema filter on a server hand-off", async () => {
+    const { router } = await mountOverview();
+    await setSchema("ledger");
+    table().vm.$emit("row-click", serverRow("pg-billing"));
+    await settle();
+    expect(pushed(router).name).toBe("dbmMetrics");
+    expect(pushed(router).query.namespace).toBe("ledger");
+  });
+
+  it("keeps the overview unfiltered when the Overview tab carries a child's schema back", async () => {
+    const { router } = await mountOverview();
+    await expand("pg-billing");
+    const ledger = serverRow("pg-billing").children!.find((row) => row.namespace === "ledger")!;
+    table().vm.$emit("row-click", ledger);
+    await settle();
+    expect(pushed(router).name).toBe("dbmMetrics");
+    expect(pushed(router).query.namespace).toBe("ledger");
+
+    // What DbmSectionTabs' Overview link carries: the current query, unchanged.
+    await router.push({ name: "dbmDatabases", query: { ...pushed(router).query } });
+    await settle();
+    expect(topRows()).toHaveLength(5);
+    expect(pushed(router).query.namespace).toBeUndefined();
+  });
+
+  it("adopts a different schema the reader picked on the target page", async () => {
+    const { router } = await mountOverview();
+    await expand("pg-billing");
+    const ledger = serverRow("pg-billing").children!.find((row) => row.namespace === "ledger")!;
+    table().vm.$emit("row-click", ledger);
+    await settle();
+    await router.push({
+      name: "dbmDatabases",
+      query: { ...pushed(router).query, namespace: "orders" },
+    });
+    await settle();
+    expect(topRows().map((row) => row.db_instance)).toEqual(["pg-orders"]);
+  });
+});
+
+describe("the AI assistant sees the Schema filter", () => {
+  it("puts the active schema in the page context", async () => {
+    await mountOverview({ namespace: "ledger" });
+    const context = await contextRegistry.getActiveContext();
+    expect(context?.db_namespace).toBe("ledger");
+  });
+
+  it("names no schema when the filter is off", async () => {
+    await mountOverview();
+    const context = await contextRegistry.getActiveContext();
+    expect(context?.db_namespace).toBeUndefined();
+  });
+});
diff --git a/web/src/views/DatabaseMonitoring/dbmSectionTabCounts.spec.ts b/web/src/views/DatabaseMonitoring/dbmSectionTabCounts.spec.ts
index fcffacaf74..b03d22651e 100644
--- a/web/src/views/DatabaseMonitoring/dbmSectionTabCounts.spec.ts
+++ b/web/src/views/DatabaseMonitoring/dbmSectionTabCounts.spec.ts
@@ -73,7 +73,13 @@ const ok = (data: unknown) => Promise.resolve({ data });
 const fullEnvelope = () => ({
   // One row deliberately carries no `calls` — legal per the response contract
   // (an idle instance's row omits it); the fold treats it as 0.
-  databases: { hits: [{ calls: 800 }, { calls: 400 }, {}] },
+  databases: {
+    hits: [
+      { db_system: "postgresql", db_instance: "pg-orders", db_namespace: "orders", calls: 800 },
+      { db_system: "postgresql", db_instance: "pg-billing", db_namespace: "billing", calls: 400 },
+      { db_system: "redis", db_instance: "valkey-cart", db_namespace: "" },
+    ],
+  },
   queries: { total: 42 },
   activity: { by_state: [{ state: "active", sessions: 7 }], hits: [{ session_pid: 1 }] },
   deadlocks: { total: 90, truncated: true },
@@ -581,8 +587,8 @@ describe("no page re-fetches the badges the shell already owns", () => {
 /**
  * The coverage caveat under each open database.
  *
- * `showsShortfall` is unit-tested in breakdownRows.spec.ts; what is pinned here
- * is that the page ASKS it. The defect was never in the arithmetic — the
+ * `showsShortfall` is unit-tested in breakdownRows.spec.ts; dbmDatabasesSchemaScope.spec.ts
+ * pins that the page ASKS it. The defect was never in the arithmetic — the
  * per-row percentages were always distinct — it was that the page gated the
  * caveat on `shortfall !== null` directly, which is true even when nothing was
  * attributed and every row therefore reported the identical 100%.
@@ -590,11 +596,6 @@ describe("no page re-fetches the badges the shell already owns", () => {
 describe("DatabasesPage gates the coverage caveat on the shared rule", () => {
   const source = read("DatabasesPage.vue");
 
-  it("asks showsShortfall rather than reading shortfall itself", () => {
-    expect(source).toContain('from "@/utils/dbm/breakdownRows"');
-    expect(source).toMatch(/const hasShortfall[\s\S]{0,400}showsShortfall\(/);
-  });
-
   it("no longer gates the caveat on a bare non-null shortfall", () => {
     expect(source).not.toMatch(/hasShortfall[\s\S]{0,200}breakdown\.shortfall !== null/);
   });
diff --git a/web/src/views/Infrastructure/kubernetes2/__fixtures__/flattenSchemas.ts b/web/src/views/Infrastructure/kubernetes2/__fixtures__/flattenSchemas.ts
new file mode 100644
index 0000000000..889665370e
--- /dev/null
+++ b/web/src/views/Infrastructure/kubernetes2/__fixtures__/flattenSchemas.ts
@@ -0,0 +1,84 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+const BASE = ["_timestamp", "event_name", "k8s_cluster", "k8s_namespace_name", "k8s_resource_name"];
+
+export const LEVEL3_COLUMNS = [
+  ...BASE,
+  "body_type",
+  "body_object_kind",
+  "body_object_type",
+  "body_object_reason",
+  "body_object_note",
+  "body_object_regarding",
+  "body_object_reportingcontroller",
+  "body_object_reportinginstance",
+  "body_object_series",
+  "body_object_deprecatedcount",
+  "body_object_eventtime",
+  "body_object_metadata",
+  "body_object_spec",
+  "body_object_status",
+];
+
+export const LEVEL0_COLUMNS = [
+  ...BASE,
+  "body_type",
+  "body_object_kind",
+  "body_object_type",
+  "body_object_reason",
+  "body_object_note",
+  "body_object_regarding_kind",
+  "body_object_regarding_name",
+  "body_object_regarding_namespace",
+  "body_object_regarding_uid",
+  "body_object_reportingcontroller",
+  "body_object_reportinginstance",
+  "body_object_series_count",
+  "body_object_series_lastobservedtime",
+  "body_object_deprecatedcount",
+  "body_object_eventtime",
+  "body_object_metadata_uid",
+  "body_object_metadata_name",
+  "body_object_metadata_creationtimestamp",
+  "body_object_status_conditions",
+  "body_object_status_containerstatuses",
+  "body_object_status_qosclass",
+  "body_object_spec_unschedulable",
+];
+
+export const LEVEL2_COLUMNS = [...BASE, "body_type", "body_object"];
+
+export const LEVEL1_COLUMNS = [...BASE, "body"];
+
+export const MIXED_3_2_COLUMNS = [...LEVEL3_COLUMNS, "body_object"];
+
+export const MIXED_3_0_COLUMNS = [...new Set([...LEVEL3_COLUMNS, ...LEVEL0_COLUMNS])];
+
+export const SCHEMAS: Record<string, string[]> = {
+  "level 3": LEVEL3_COLUMNS,
+  "level 0": LEVEL0_COLUMNS,
+  "level 2": LEVEL2_COLUMNS,
+  "level 1": LEVEL1_COLUMNS,
+  "mixed 3+2": MIXED_3_2_COLUMNS,
+  "mixed 3+0": MIXED_3_0_COLUMNS,
+};
+
+// Stream columns a query reads that the schema lacks; aliases it defines itself are not stream columns.
+export function missingColumns(sql: string, schema: string[]): string[] {
+  const aliases = new Set([...sql.matchAll(/ AS (\w+)/g)].map((m) => m[1]));
+  const refs = new Set(sql.match(/\bbody(?:_object\w*|_type)?\b(?!')/g) ?? []);
+  return [...refs].filter((r) => !schema.includes(r) && !aliases.has(r));
+}
diff --git a/web/src/views/Infrastructure/kubernetes2/kubernetesEvents.spec.ts b/web/src/views/Infrastructure/kubernetes2/kubernetesEvents.spec.ts
index dc18292777..35a0870794 100644
--- a/web/src/views/Infrastructure/kubernetes2/kubernetesEvents.spec.ts
+++ b/web/src/views/Infrastructure/kubernetes2/kubernetesEvents.spec.ts
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it } from "vitest";
 import {
   clusterFallbackSql,
   detailEventsSql,
@@ -27,6 +27,8 @@ import {
 } from "./kubernetesEvents";
 import { buildInventory, type Series, type WarningEvent } from "./kubernetesModel";
 import type { QueryId } from "./kubernetesQueries";
+import { setStreamColumns } from "./kubernetesFlatten";
+import { SCHEMAS, missingColumns } from "./__fixtures__/flattenSchemas";
 
 // Catches a quadratic blow-up (seconds), not machine speed: CI runs this slower, under coverage.
 const GROUPING_BUDGET_MS = 250;
@@ -435,3 +437,59 @@ describe("event counts", () => {
     expect(parseEventCounts(undefined)).toBeNull();
   });
 });
+
+describe("flatten-level aware SQL", () => {
+  afterEach(() => setStreamColumns(null));
+  const build = () => ({
+    W: warningSql({ cluster: "prod", namespaces: ["data"] }, "Pod", true),
+    EC: eventCountsSql("prod"),
+    E: eventsSql({ cluster: "prod", namespaces: ["data"] }, 10),
+    DE: detailEventsSql("prod", { kind: "pod", namespace: "data", name: "x", uid: "u1" }),
+  });
+
+  for (const [level, schema] of Object.entries(SCHEMAS)) {
+    it(`reads only columns that exist at ${level}`, () => {
+      setStreamColumns(schema);
+      for (const [id, sql] of Object.entries(build())) {
+        expect(missingColumns(sql, schema), id).toEqual([]);
+      }
+    });
+  }
+
+  it("leaves the level 3 SQL identical to the schema-less SQL", () => {
+    const before = build();
+    setStreamColumns(SCHEMAS["level 3"]);
+    expect(build()).toEqual(before);
+  });
+
+  it("filters Events with COALESCE over existing columns on a mixed 3+2 schema", () => {
+    setStreamColumns(SCHEMAS["mixed 3+2"]);
+    const sql = eventsSql({ cluster: "prod", namespaces: [] }, 10);
+    expect(sql).toContain("COALESCE(body_object_kind,json_get_str(body_object,'kind'))");
+    expect(missingColumns(sql, SCHEMAS["mixed 3+2"])).toEqual([]);
+  });
+
+  it("selects the nested event fields from body_object at level 2", () => {
+    setStreamColumns(SCHEMAS["level 2"]);
+    const sql = eventsSql({ cluster: "prod", namespaces: [] }, 10);
+    expect(sql).toContain("json_get_str(body_object,'type') AS body_object_type");
+    expect(sql).toContain("json_get_json(body_object,'regarding') AS body_object_regarding");
+  });
+
+  it("parses flattened regarding and series columns at level 0", () => {
+    const [row] = parseEvents([
+      {
+        event_name: "x.1",
+        body_object_regarding_kind: "Pod",
+        body_object_regarding_name: "x",
+        body_object_regarding_namespace: "data",
+        body_object_regarding_uid: "u",
+        body_object_series_count: 4,
+        body_object_series_lastobservedtime: "2026-10-06T10:00:00Z",
+      },
+    ]);
+    expect(row.object).toEqual({ kind: "Pod", name: "x", namespace: "data", uid: "u" });
+    expect(row.count).toBe(4);
+    expect(row.lastSeen).toBe(Date.parse("2026-10-06T10:00:00Z") * 1000);
+  });
+});
diff --git a/web/src/views/Infrastructure/kubernetes2/kubernetesEvents.ts b/web/src/views/Infrastructure/kubernetes2/kubernetesEvents.ts
index 463ead647b..ea3e9e7c85 100644
--- a/web/src/views/Infrastructure/kubernetes2/kubernetesEvents.ts
+++ b/web/src/views/Infrastructure/kubernetes2/kubernetesEvents.ts
@@ -16,6 +16,7 @@
 import { escapeSingleQuotes } from "@/utils/zincutils";
 import type { I18nKey } from "@/types/i18n";
 import { EVENTS_STREAM, KIND_INFO, type DetailKind } from "./kubernetesQueries";
+import { col, selectAs, selectObject } from "./kubernetesFlatten";
 import { inScope, type Inventory, type PodRow, type WarningEvent } from "./kubernetesModel";
 
 export interface InvolvedObject {
@@ -54,10 +55,15 @@ export interface EventScope {
 
 export const W_ROW_LIMIT = 20000;
 
-const EK =
-  "COALESCE(json_get_str(body_object_metadata,'uid'), k8s_namespace_name || '/' || event_name)";
+const EK = () => `COALESCE(${col(["metadata", "uid"])}, k8s_namespace_name || '/' || event_name)`;
 
-const REGARDING = (field: string) => `json_get_str(body_object_regarding,'${field}')`;
+const REGARDING_FIELDS = ["kind", "name", "namespace", "uid"];
+
+const SERIES_FIELDS = ["count", "lastObservedTime"];
+
+const REGARDING = (field: string) => col(["regarding", field]);
+
+const KIND_IS_EVENT = () => `${col(["kind"])} = 'Event'`;
 
 const q = (value: string) => `'${escapeSingleQuotes(value)}'`;
 
@@ -66,20 +72,19 @@ const clusterTerm = (cluster: string | null) => (cluster ? ` AND k8s_cluster = $
 const eventNsFilter = (namespaces: string[]) =>
   namespaces.length ? ` AND ${REGARDING("namespace")} IN (${namespaces.map(q).join(", ")})` : "";
 
-const EVENT_COLUMNS = [
-  "event_name",
-  "body_object_type",
-  "body_object_reason",
-  "body_object_note",
-  "body_object_regarding",
-  "body_object_reportingcontroller",
-  "body_object_reportinginstance",
-  "body_object_series",
-  "body_object_deprecatedcount",
-  "body_object_eventtime",
-  "k8s_namespace_name",
-  "_timestamp",
-].join(", ");
+const eventColumns = () =>
+  [
+    "event_name",
+    ...["type", "reason", "note"].map((f) => selectAs(col([f]), `body_object_${f}`)),
+    ...selectObject(["regarding"], "body_object_regarding", REGARDING_FIELDS),
+    ...["reportingcontroller", "reportinginstance"].map((f) =>
+      selectAs(col([f]), `body_object_${f}`),
+    ),
+    ...selectObject(["series"], "body_object_series", SERIES_FIELDS),
+    ...["deprecatedcount", "eventtime"].map((f) => selectAs(col([f]), `body_object_${f}`)),
+    "k8s_namespace_name",
+    "_timestamp",
+  ].join(", ");
 
 const KIND_BY_NAME = new Map(
   Object.entries(KIND_INFO).map(([kind, info]) => [info.kind, kind as DetailKind]),
@@ -104,9 +109,9 @@ export function warningSql(scope: EventScope, kind: string | null, namespaced: b
     "first_value(note ORDER BY last_seen DESC) AS note FROM (" +
     `SELECT ${REGARDING("kind")} AS kind, ${REGARDING("name")} AS name, ` +
     `${REGARDING("namespace")} AS namespace, ${REGARDING("uid")} AS uid, ` +
-    "body_object_reason AS reason, body_object_note AS note, _timestamp AS last_seen, " +
-    `ROW_NUMBER() OVER (PARTITION BY ${EK} ORDER BY _timestamp DESC) AS rn ` +
-    `FROM "${EVENTS_STREAM}" WHERE body_object_kind = 'Event' AND body_object_type = 'Warning'` +
+    `${selectAs(col(["reason"]), "reason")}, ${selectAs(col(["note"]), "note")}, _timestamp AS last_seen, ` +
+    `ROW_NUMBER() OVER (PARTITION BY ${EK()} ORDER BY _timestamp DESC) AS rn ` +
+    `FROM "${EVENTS_STREAM}" WHERE ${KIND_IS_EVENT()} AND ${col(["type"])} = 'Warning'` +
     `${clusterTerm(scope.cluster)}${nsFilter}${kindFilter}` +
     ") WHERE rn = 1 GROUP BY kind, name, namespace, uid ORDER BY last_seen DESC"
   );
@@ -115,8 +120,8 @@ export function warningSql(scope: EventScope, kind: string | null, namespaced: b
 export function eventCountsSql(cluster: string) {
   return (
     "SELECT count(*) AS total, count(CASE WHEN type = 'Warning' THEN 1 END) AS warnings FROM (" +
-    `SELECT body_object_type AS type, ROW_NUMBER() OVER (PARTITION BY ${EK} ORDER BY _timestamp DESC) AS rn ` +
-    `FROM "${EVENTS_STREAM}" WHERE body_object_kind = 'Event'${clusterTerm(cluster)}` +
+    `SELECT ${selectAs(col(["type"]), "type")}, ROW_NUMBER() OVER (PARTITION BY ${EK()} ORDER BY _timestamp DESC) AS rn ` +
+    `FROM "${EVENTS_STREAM}" WHERE ${KIND_IS_EVENT()}${clusterTerm(cluster)}` +
     ") WHERE rn = 1"
   );
 }
@@ -170,8 +175,14 @@ export function parseWarnings(
 
 export function parseEvents(hits: any[]): EventRow[] {
   return hits.map((h) => {
-    const regarding = parseJson(h.body_object_regarding);
-    const series = parseJson(h.body_object_series);
+    const regarding = {
+      ...flatChildren(h, "regarding", REGARDING_FIELDS),
+      ...parseJson(h.body_object_regarding),
+    };
+    const series = {
+      ...flatChildren(h, "series", SERIES_FIELDS),
+      ...parseJson(h.body_object_series),
+    };
     const seriesCount = Number(series.count);
     const deprecated = Number(h.body_object_deprecatedcount);
     const source = [h.body_object_reportingcontroller, h.body_object_reportinginstance]
@@ -297,13 +308,22 @@ function keepPodEvent(event: WarningEvent, podsByName: Map<string, PodRow[]>) {
 
 function eventsQuery(terms: string, limit: number) {
   return (
-    `SELECT * FROM (SELECT ${EVENT_COLUMNS}, ` +
-    `ROW_NUMBER() OVER (PARTITION BY ${EK} ORDER BY _timestamp DESC) AS rn ` +
-    `FROM "${EVENTS_STREAM}" WHERE body_object_kind = 'Event'${terms}` +
+    `SELECT * FROM (SELECT ${eventColumns()}, ` +
+    `ROW_NUMBER() OVER (PARTITION BY ${EK()} ORDER BY _timestamp DESC) AS rn ` +
+    `FROM "${EVENTS_STREAM}" WHERE ${KIND_IS_EVENT()}${terms}` +
     `) WHERE rn = 1 ORDER BY _timestamp DESC LIMIT ${limit}`
   );
 }
 
+function flatChildren(hit: any, parent: string, fields: string[]) {
+  const out: Record<string, any> = {};
+  for (const f of fields) {
+    const v = hit[`body_object_${parent}_${f.toLowerCase()}`];
+    if (v != null) out[f] = v;
+  }
+  return out;
+}
+
 function parseJson(value: unknown): Record<string, any> {
   if (value && typeof value === "object") return value as Record<string, any>;
   if (typeof value !== "string" || !value) return {};
diff --git a/web/src/views/Infrastructure/kubernetes2/kubernetesFlatten.spec.ts b/web/src/views/Infrastructure/kubernetes2/kubernetesFlatten.spec.ts
new file mode 100644
index 0000000000..81d2b272ab
--- /dev/null
+++ b/web/src/views/Infrastructure/kubernetes2/kubernetesFlatten.spec.ts
@@ -0,0 +1,97 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { afterEach, describe, expect, it } from "vitest";
+import { col, selectAs, selectObject, setStreamColumns } from "./kubernetesFlatten";
+import { SCHEMAS } from "./__fixtures__/flattenSchemas";
+
+describe("kubernetesFlatten col", () => {
+  afterEach(() => setStreamColumns(null));
+
+  it("emits the level 3 form while the schema is unknown", () => {
+    expect(col(["type"])).toBe("body_object_type");
+    expect(col(["metadata", "uid"])).toBe("json_get_str(body_object_metadata,'uid')");
+    expect(col(["spec", "template", "spec", "nodeSelector"], "json")).toBe(
+      "json_get_json(body_object_spec,'template','spec','nodeSelector')",
+    );
+  });
+
+  it("emits the level 3 form on a level 3 schema", () => {
+    setStreamColumns(SCHEMAS["level 3"]);
+    expect(col(["status", "qosClass"])).toBe("json_get_str(body_object_status,'qosClass')");
+    expect(col(["metadata"], "json")).toBe("body_object_metadata");
+  });
+
+  it("is NULL on a level 3 stream that lacks an optional column", () => {
+    setStreamColumns(SCHEMAS["level 3"].filter((c) => c !== "body_object_series"));
+    expect(col(["series"], "json")).toBe("NULL");
+    expect(selectObject(["series"], "body_object_series", ["count"])).toEqual([
+      "NULL AS body_object_series",
+    ]);
+  });
+
+  it("prefers a flattened column at level 0 and lowercases its name", () => {
+    setStreamColumns(SCHEMAS["level 0"]);
+    expect(col(["status", "qosClass"])).toBe("body_object_status_qosclass");
+    expect(col(["spec", "unschedulable"], "bool")).toBe("body_object_spec_unschedulable");
+  });
+
+  it("is NULL at level 0 for a nested value with no flattened column", () => {
+    setStreamColumns(SCHEMAS["level 0"]);
+    expect(col(["metadata", "labels"], "json")).toBe("NULL");
+  });
+
+  it("walks to body_object at level 2 and body at level 1", () => {
+    setStreamColumns(SCHEMAS["level 2"]);
+    expect(col(["metadata", "uid"])).toBe("json_get_str(body_object,'metadata','uid')");
+    expect(col(["kind"])).toBe("json_get_str(body_object,'kind')");
+    setStreamColumns(SCHEMAS["level 1"]);
+    expect(col(["metadata", "uid"])).toBe("json_get_str(body,'object','metadata','uid')");
+  });
+
+  it("escapes quotes in path segments", () => {
+    setStreamColumns(SCHEMAS["level 2"]);
+    expect(col(["a'b"])).toBe("json_get_str(body_object,'a''b')");
+  });
+
+  it("aliases only when the expression differs from the alias", () => {
+    expect(selectAs("body_object_type", "body_object_type")).toBe("body_object_type");
+    expect(selectAs("x", "y")).toBe("x AS y");
+  });
+
+  it("coalesces the level 3 and level 2 layouts on a mixed 3+2 schema", () => {
+    setStreamColumns(SCHEMAS["mixed 3+2"]);
+    expect(col(["kind"])).toBe("COALESCE(body_object_kind,json_get_str(body_object,'kind'))");
+    expect(col(["metadata", "uid"])).toBe(
+      "COALESCE(json_get_str(body_object_metadata,'uid'),json_get_str(body_object,'metadata','uid'))",
+    );
+  });
+
+  it("coalesces the level 3 and level 0 layouts on a mixed 3+0 schema", () => {
+    setStreamColumns(SCHEMAS["mixed 3+0"]);
+    expect(col(["kind"])).toBe("body_object_kind");
+    expect(col(["metadata", "uid"])).toBe(
+      "COALESCE(body_object_metadata_uid,json_get_str(body_object_metadata,'uid'))",
+    );
+  });
+
+  it("selects the flattened children of an object column at level 0", () => {
+    setStreamColumns(SCHEMAS["level 0"]);
+    expect(selectObject(["regarding"], "body_object_regarding", ["kind", "uid"])).toEqual([
+      "body_object_regarding_kind",
+      "body_object_regarding_uid",
+    ]);
+  });
+});
diff --git a/web/src/views/Infrastructure/kubernetes2/kubernetesFlatten.ts b/web/src/views/Infrastructure/kubernetes2/kubernetesFlatten.ts
new file mode 100644
index 0000000000..7453a3390e
--- /dev/null
+++ b/web/src/views/Infrastructure/kubernetes2/kubernetesFlatten.ts
@@ -0,0 +1,67 @@
+// Copyright 2026 OpenObserve Inc.
+//
+// This program is free software: you can redistribute it and/or modify
+// it under the terms of the GNU Affero General Public License as published by
+// the Free Software Foundation, either version 3 of the License, or
+// (at your option) any later version.
+//
+// This program is distributed in the hope that it will be useful
+// but WITHOUT ANY WARRANTY; without even the implied warranty of
+// MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+// GNU Affero General Public License for more details.
+//
+// You should have received a copy of the GNU Affero General Public License
+// along with this program.  If not, see <http://www.gnu.org/licenses/>.
+
+import { escapeSingleQuotes } from "@/utils/zincutils";
+
+export type JsonKind = "str" | "json" | "bool";
+
+let known: ReadonlySet<string> | null = null;
+
+export const setStreamColumns = (names: Iterable<string> | null) => {
+  known = names ? new Set(names) : null;
+};
+
+const seg = (s: string) => s.toLowerCase().replace(/[^a-z0-9_]/g, "_");
+
+const flatName = (path: string[]) => `body_object_${path.map(seg).join("_")}`;
+
+const jsonGet = (kind: JsonKind, column: string, path: string[]) =>
+  `json_get_${kind}(${column},${path.map((s) => `'${escapeSingleQuotes(s)}'`).join(",")})`;
+
+/** SQL for the logical field body.object.<path>, resolved against the stream's actual columns. */
+export function col(path: string[], kind: JsonKind = "str"): string {
+  const level3 = () =>
+    path.length === 1 ? flatName(path) : jsonGet(kind, flatName(path.slice(0, 1)), path.slice(1));
+  if (!known) return level3();
+  const found: string[] = [];
+  for (let n = path.length; n >= 1; n--) {
+    const name = flatName(path.slice(0, n));
+    if (known.has(name)) found.push(n === path.length ? name : jsonGet(kind, name, path.slice(n)));
+  }
+  if (known.has("body_object")) found.push(jsonGet(kind, "body_object", path));
+  if (known.has("body")) found.push(jsonGet(kind, "body", ["object", ...path]));
+  // A re-levelled stream keeps old and new columns side by side, so rows of either layout must resolve.
+  if (found.length === 1) return found[0];
+  if (found.length > 1) return `COALESCE(${found.join(",")})`;
+  return known.has("body_object_kind") ? "NULL" : level3();
+}
+
+/** SQL for body_type, which sits beside body.object. */
+export function bodyTypeCol(): string {
+  return known && !known.has("body_type") && known.has("body")
+    ? jsonGet("str", "body", ["type"])
+    : "body_type";
+}
+
+export const selectAs = (expr: string, alias: string) =>
+  expr === alias ? expr : `${expr} AS ${alias}`;
+
+/** Select items for a JSON-object field, falling back to its flattened children when the parent column is gone. */
+export function selectObject(path: string[], alias: string, children: string[]): string[] {
+  const parent = col(path, "json");
+  if (parent !== "NULL") return [selectAs(parent, alias)];
+  const flat = children.map((c) => flatName([...path, c])).filter((n) => known?.has(n));
+  return flat.length ? flat : [selectAs("NULL", alias)];
+}
diff --git a/web/src/views/Infrastructure/kubernetes2/kubernetesObjects.spec.ts b/web/src/views/Infrastructure/kubernetes2/kubernetesObjects.spec.ts
index fa5deb595c..0721c5e131 100644
--- a/web/src/views/Infrastructure/kubernetes2/kubernetesObjects.spec.ts
+++ b/web/src/views/Infrastructure/kubernetes2/kubernetesObjects.spec.ts
@@ -13,10 +13,14 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { describe, expect, it } from "vitest";
+import { afterEach, describe, expect, it } from "vitest";
 import { buildInventory, type Series } from "./kubernetesModel";
 import type { QueryId } from "./kubernetesQueries";
+import { setStreamColumns } from "./kubernetesFlatten";
+import { SCHEMAS, missingColumns } from "./__fixtures__/flattenSchemas";
 import {
+  LIST_OBJECT_KINDS,
+  MAP_COLUMNS,
   OVERVIEW_COLUMNS,
   joinObjects,
   objectDetailSql,
@@ -271,3 +275,46 @@ describe("object join", () => {
     expect(inventory.cronjobs[0].lastSchedule).toBe(Date.parse("2026-10-06T02:00:00Z") * 1000);
   });
 });
+
+describe("flatten-level aware object SQL", () => {
+  afterEach(() => setStreamColumns(null));
+  const build = () => ({
+    ...Object.fromEntries(
+      LIST_OBJECT_KINDS.map((k) => [`list ${k}`, objectListSql(k, "prod", ["data"])]),
+    ),
+    mapPod: objectListSql("pod", "prod", [], MAP_COLUMNS.pod),
+    mapNode: objectListSql("node", "prod", [], MAP_COLUMNS.node),
+    overviewPod: objectListSql("pod", "prod", [], OVERVIEW_COLUMNS.pod),
+    detail: objectDetailSql("pod", "prod", { namespace: "data", name: "x", uid: "u1" }),
+  });
+
+  for (const [level, schema] of Object.entries(SCHEMAS)) {
+    it(`reads only columns that exist at ${level}`, () => {
+      setStreamColumns(schema);
+      for (const [id, sql] of Object.entries(build())) {
+        expect(missingColumns(sql, schema), id).toEqual([]);
+      }
+    });
+  }
+
+  it("leaves the level 3 SQL identical to the schema-less SQL", () => {
+    const before = build();
+    setStreamColumns(SCHEMAS["level 3"]);
+    expect(build()).toEqual(before);
+  });
+
+  it("reads json parents from body_object at level 2 and keeps the aliases", () => {
+    setStreamColumns(SCHEMAS["level 2"]);
+    const sql = objectDetailSql("pod", "prod", { namespace: "data", name: "x", uid: null });
+    expect(sql).toContain("json_get_json(body_object,'metadata') AS body_object_metadata");
+    expect(sql).toContain("json_get_str(body_object,'metadata','uid') AS uid");
+  });
+
+  it("uses the flattened column at level 0 and a null for what cannot be rebuilt", () => {
+    setStreamColumns(SCHEMAS["level 0"]);
+    const sql = objectListSql("pod", "prod", []);
+    expect(sql).toContain("body_object_status_qosclass AS qos_class");
+    expect(sql).toContain("body_object_metadata_uid AS uid");
+    expect(sql).toContain("body_object_metadata_creationtimestamp AS created");
+  });
+});
diff --git a/web/src/views/Infrastructure/kubernetes2/kubernetesObjects.ts b/web/src/views/Infrastructure/kubernetes2/kubernetesObjects.ts
index b4ff11648b..4f4a2ae9ec 100644
--- a/web/src/views/Infrastructure/kubernetes2/kubernetesObjects.ts
+++ b/web/src/views/Infrastructure/kubernetes2/kubernetesObjects.ts
@@ -14,6 +14,7 @@
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
 import { escapeSingleQuotes } from "@/utils/zincutils";
+import { bodyTypeCol, col, selectAs, type JsonKind } from "./kubernetesFlatten";
 import { EVENTS_STREAM, KIND_INFO, type DetailKind } from "./kubernetesQueries";
 import {
   INVENTORY_KEY,
@@ -32,35 +33,39 @@ export interface ObjectRecord {
   object: K8sObject;
 }
 
+type ColumnRef = { kind: JsonKind; path: string[] };
+
+const ref = (kind: JsonKind, ...path: string[]): ColumnRef => ({ kind, path });
+
+const LABELS = ref("json", "metadata", "labels");
+
+const CONDITIONS = ref("json", "status", "conditions");
+
 // Each list variant reads only what its list renders (§7.3), plus the creation time for Age.
-const LIST_COLUMNS: Partial<Record<DetailKind, Record<string, string>>> = {
-  pod: { qos_class: "json_get_str(body_object_status,'qosClass')" },
-  node: {
-    labels: "json_get_json(body_object_metadata,'labels')",
-    unschedulable: "json_get_bool(body_object_spec,'unschedulable')",
-  },
-  deployment: { conditions: "json_get_json(body_object_status,'conditions')" },
-  daemonset: { node_selector: "json_get_json(body_object_spec,'template','spec','nodeSelector')" },
-  cronjob: { last_schedule: "json_get_str(body_object_status,'lastScheduleTime')" },
-  namespace: { labels: "json_get_json(body_object_metadata,'labels')" },
+const LIST_COLUMNS: Partial<Record<DetailKind, Record<string, ColumnRef>>> = {
+  pod: { qos_class: ref("str", "status", "qosClass") },
+  node: { labels: LABELS, unschedulable: ref("bool", "spec", "unschedulable") },
+  deployment: { conditions: CONDITIONS },
+  daemonset: { node_selector: ref("json", "spec", "template", "spec", "nodeSelector") },
+  cronjob: { last_schedule: ref("str", "status", "lastScheduleTime") },
+  namespace: { labels: LABELS },
 };
 
 // The map variant reads only what the map filters or groups on.
-export const MAP_COLUMNS: Record<"pod" | "node", Record<string, string>> = {
-  pod: { ...LIST_COLUMNS.pod, labels: "json_get_json(body_object_metadata,'labels')" },
+export const MAP_COLUMNS: Record<"pod" | "node", Record<string, ColumnRef>> = {
+  pod: { ...LIST_COLUMNS.pod, labels: LABELS },
   node: { ...LIST_COLUMNS.node },
 };
 
 // The overview variant reads only what "for 2h" on Needs attention is derived from.
-export const OVERVIEW_COLUMNS: Record<"pod" | "node", Record<string, string>> = {
-  pod: {
-    conditions: "json_get_json(body_object_status,'conditions')",
-    container_statuses: "json_get_json(body_object_status,'containerStatuses')",
-  },
-  node: { conditions: "json_get_json(body_object_status,'conditions')" },
+export const OVERVIEW_COLUMNS: Record<"pod" | "node", Record<string, ColumnRef>> = {
+  pod: { conditions: CONDITIONS, container_statuses: ref("json", "status", "containerStatuses") },
+  node: { conditions: CONDITIONS },
 };
 
-const CREATED = "json_get_str(body_object_metadata,'creationTimestamp')";
+const CREATED = ref("str", "metadata", "creationTimestamp");
+
+const BODY_PARTS = ["metadata", "spec", "status"];
 
 const OBJECT_LIST_LIMIT = 5000;
 
@@ -74,7 +79,9 @@ export function objectListSql(
   namespaces: string[],
   variant = LIST_COLUMNS[kind],
 ) {
-  const columns = Object.entries({ ...variant, created: CREATED });
+  const columns = Object.entries({ ...variant, created: CREATED }).map(
+    ([alias, c]) => [alias, col(c.path, c.kind)] as const,
+  );
   const nsTerm =
     KIND_INFO[kind].namespaced && namespaces.length
       ? ` AND k8s_namespace_name IN (${namespaces.map(q).join(", ")})`
@@ -97,10 +104,11 @@ export function objectDetailSql(
   let terms = ` AND event_name = ${q(target.name)}`;
   if (KIND_INFO[kind].namespaced) terms += ` AND k8s_namespace_name = ${q(target.namespace)}`;
   if (kind === "pod" && target.uid) {
-    terms += ` AND json_get_str(body_object_metadata,'uid') = ${q(target.uid)}`;
+    terms += ` AND ${col(["metadata", "uid"])} = ${q(target.uid)}`;
   }
-  const bodies = "body_object_metadata, body_object_spec, body_object_status";
-  return objectSql(kind, cluster, bodies, bodies, terms, 1);
+  const inner = BODY_PARTS.map((p) => selectAs(col([p], "json"), `body_object_${p}`)).join(", ");
+  const outer = BODY_PARTS.map((p) => `body_object_${p}`).join(", ");
+  return objectSql(kind, cluster, inner, outer, terms, 1);
 }
 
 export function parseObjects(hits: any[]): ObjectRecord[] {
@@ -248,8 +256,8 @@ function objectSql(
 ) {
   return (
     `SELECT uid, event_name, k8s_namespace_name, body_type, ${outerColumns}, _timestamp FROM (` +
-    "SELECT json_get_str(body_object_metadata,'uid') AS uid, event_name, k8s_namespace_name, " +
-    `body_type, ${innerColumns}, _timestamp, ` +
+    `SELECT ${selectAs(col(["metadata", "uid"]), "uid")}, event_name, k8s_namespace_name, ` +
+    `${selectAs(bodyTypeCol(), "body_type")}, ${innerColumns}, _timestamp, ` +
     "ROW_NUMBER() OVER (PARTITION BY k8s_cluster, k8s_resource_name, " +
     "COALESCE(k8s_namespace_name, ''), event_name ORDER BY _timestamp DESC) AS rn " +
     `FROM "${EVENTS_STREAM}" WHERE k8s_resource_name = ${q(KIND_INFO[kind].resource)} ` +
diff --git a/web/src/views/Infrastructure/kubernetes2/useKubernetesInventory.spec.ts b/web/src/views/Infrastructure/kubernetes2/useKubernetesInventory.spec.ts
index a4eb304c94..044e1c867b 100644
--- a/web/src/views/Infrastructure/kubernetes2/useKubernetesInventory.spec.ts
+++ b/web/src/views/Infrastructure/kubernetes2/useKubernetesInventory.spec.ts
@@ -13,7 +13,7 @@
 // You should have received a copy of the GNU Affero General Public License
 // along with this program.  If not, see <http://www.gnu.org/licenses/>.
 
-import { beforeEach, describe, expect, it, vi } from "vitest";
+import { afterEach, beforeEach, describe, expect, it, vi } from "vitest";
 import { ref } from "vue";
 import * as objects from "./kubernetesObjects";
 import searchService from "@/services/search";
@@ -21,6 +21,7 @@ import { queryClient } from "@/composables/query/queryClient";
 import * as queries from "@/services/kubernetes.queries";
 import { useKubernetesInventory, type K8sTime } from "./useKubernetesInventory";
 import { CLUSTER_QUERIES, QUERY_STREAM, queryText, type QueryId } from "./kubernetesQueries";
+import { col, setStreamColumns } from "./kubernetesFlatten";
 import { parseUrlState, type K8sUrlState } from "./kubernetesUrlState";
 
 const getStreams = vi.fn();
@@ -117,6 +118,8 @@ const setup = async (
 };
 
 describe("useKubernetesInventory", () => {
+  afterEach(() => setStreamColumns(null));
+
   beforeEach(() => {
     vi.clearAllMocks();
     queryClient.clear();
@@ -378,6 +381,19 @@ describe("useKubernetesInventory", () => {
       await inv.load();
       expect(search).not.toHaveBeenCalled();
     });
+
+    it("clears the previous column set when a later stream load fails", async () => {
+      await setup({ view: "events" }, { eventFields: ["k8s_cluster", "body"] });
+      expect(col(["kind"])).toBe("json_get_str(body,'object','kind')");
+      getStreams.mockRejectedValue(new Error("down"));
+      const inv = useKubernetesInventory(
+        () => parseUrlState({ view: "events" }),
+        () => ({ start: START, end: END, relative: true }),
+        () => "org2",
+      );
+      await inv.loadStreams();
+      expect(col(["kind"])).toBe("body_object_kind");
+    });
   });
 
   describe("map object queries (AC 81)", () => {
@@ -525,6 +541,20 @@ describe("useKubernetesInventory", () => {
       expect(sentSql()[0]).toMatchObject({ start_time: START, end_time: END });
     });
 
+    it("builds the events SQL from the stream's actual columns at flatten level 2", async () => {
+      const { inv } = await setup(
+        { view: "events" },
+        { eventFields: ["k8s_cluster", "body_object", "body_type"] },
+      );
+      await inv.load();
+      const events = sentSql().filter((q: any) => q.sql.includes("k8s_events"));
+      expect(events.length).toBeGreaterThan(0);
+      for (const q of events) {
+        expect(q.sql).toContain("json_get_str(body_object,'kind')");
+        expect(q.sql).not.toContain("body_object_kind");
+      }
+    });
+
     it("marks all of 1,200 affected objects, and banners a truncated W", async () => {
       const pods = Array.from({ length: 1200 }, (_, i) => `p${i}`);
       fixture = {
diff --git a/web/src/views/Infrastructure/kubernetes2/useKubernetesInventory.ts b/web/src/views/Infrastructure/kubernetes2/useKubernetesInventory.ts
index 36d99c3f96..47dfd0a2ca 100644
--- a/web/src/views/Infrastructure/kubernetes2/useKubernetesInventory.ts
+++ b/web/src/views/Infrastructure/kubernetes2/useKubernetesInventory.ts
@@ -74,6 +74,7 @@ import {
   parseObjects,
   type ObjectRecord,
 } from "./kubernetesObjects";
+import { setStreamColumns } from "./kubernetesFlatten";
 import { encodeDetails, type DetailsRef, type K8sUrlState } from "./kubernetesUrlState";
 
 export type Detection = "unknown" | "error" | "undetected" | "detected";
@@ -232,14 +233,15 @@ export function useKubernetesInventory(
       ]);
       const logNames = new Set(((logs?.list ?? []) as Array<{ name: string }>).map((s) => s.name));
       let scoped = false;
+      let columns: string[] | null = null;
       if (logNames.has(EVENTS_STREAM)) {
         // A failed lookup must not read as "no k8s_cluster field", which would run events unscoped.
         const schema: any = await getStream(EVENTS_STREAM, "logs", true);
-        scoped = ((schema?.schema ?? []) as Array<{ name: string }>).some(
-          (f) => f.name === "k8s_cluster",
-        );
+        columns = ((schema?.schema ?? []) as Array<{ name: string }>).map((f) => f.name);
+        scoped = columns.includes("k8s_cluster");
       }
       if (gen !== streamsGeneration) return;
+      setStreamColumns(columns);
       metricStreams.value = new Set(
         ((metrics?.list ?? []) as Array<{ name: string }>).map((s) => s.name),
       );
@@ -248,6 +250,7 @@ export function useKubernetesInventory(
       streamsError.value = false;
     } catch {
       if (gen !== streamsGeneration) return;
+      setStreamColumns(null);
       metricStreams.value = null;
       logStreams.value = null;
       streamsError.value = true;
@@ -260,6 +263,7 @@ export function useKubernetesInventory(
     countsGeneration++;
     detailsTarget = undefined;
     streamsGeneration++;
+    setStreamColumns(null);
     metricStreams.value = null;
     logStreams.value = null;
     eventsScoped.value = false;
diff --git a/web/src/views/OnCall/OnCallResponseDetail.spec.ts b/web/src/views/OnCall/OnCallResponseDetail.spec.ts
index d03c716933..b083a6c66f 100644
--- a/web/src/views/OnCall/OnCallResponseDetail.spec.ts
+++ b/web/src/views/OnCall/OnCallResponseDetail.spec.ts
@@ -39,6 +39,7 @@ vi.mock("@/services/oncall", () => ({
     unacknowledgeResponse: vi.fn(),
     confirmRecovery: vi.fn(),
     snoozeResponse: vi.fn(),
+    unsnoozeResponse: vi.fn(),
     addNote: vi.fn(),
     handoffResponse: vi.fn(),
     resolveResponse: vi.fn(),
@@ -761,6 +762,29 @@ describe("OnCallResponseDetail", () => {
     expect(lapsed.find('[data-test="oncall-response-snoozed-banner"]').exists()).toBe(false);
   });
 
+  /// Snooze means paused, then continues; while it is paused the same control continues it now.
+  it("swaps Snooze for Unsnooze while snoozed, and the banner offers it too", async () => {
+    const wrapper = await renderWith({ snoozed_until: (Date.now() + 30 * 60_000) * 1000 });
+    service.unsnoozeResponse.mockResolvedValue({ data: {} } as any);
+
+    expect(wrapper.find('[data-test="oncall-response-snooze-btn"]').exists()).toBe(false);
+    for (const button of [
+      "oncall-response-unsnooze-btn",
+      "oncall-response-snoozed-banner-unsnooze",
+    ]) {
+      service.unsnoozeResponse.mockClear();
+      toastSpy.mockClear();
+      await wrapper.find(`[data-test="${button}"]`).trigger("click");
+      await flushPromises();
+      expect(service.unsnoozeResponse).toHaveBeenCalledWith(
+        expect.objectContaining({ response_id: "resp_1" }),
+      );
+      expect(toastSpy).toHaveBeenCalledWith(
+        expect.objectContaining({ message: "Snooze ended · paging continues" }),
+      );
+    }
+  });
+
   it("adds a note and clears the box", async () => {
     const wrapper = await renderWith();
     service.addNote.mockResolvedValue({ data: {} } as any);
@@ -1516,6 +1540,520 @@ describe("OnCallResponseDetail — what the payload already knew", () => {
     expect(wrapper.text()).not.toContain("Paged up to");
   });
 
+  /// "Escalated" alone is a claim. The person who pressed it wants to know
+  /// which phone is ringing, and the 200 body says.
+  describe("what Escalate reports back", () => {
+    it("names who the rung reached", async () => {
+      const wrapper = await renderWith();
+      service.escalateNow.mockResolvedValue({
+        data: {
+          escalated_to: "rung",
+          rung_micros: 300_000_000,
+          recipients: ["ana@o2.ai"],
+          chased: true,
+          deduplicated: false,
+          response: {},
+        },
+      } as any);
+
+      await wrapper.find('[data-test="oncall-response-escalate-btn"]').trigger("click");
+      await flushPromises();
+
+      const message = String(toastSpy.mock.calls.at(-1)![0].message);
+      expect(message).toContain("ana@o2.ai");
+    });
+
+    /// A rung that resolved to nobody is a real outcome, and the one worth
+    /// saying loudest: the ladder moved and no phone rang.
+    it("says so when the rung reached nobody", async () => {
+      const wrapper = await renderWith();
+      service.escalateNow.mockResolvedValue({
+        data: {
+          escalated_to: "rung",
+          rung_micros: 0,
+          recipients: [],
+          chased: false,
+          deduplicated: true,
+          response: {},
+        },
+      } as any);
+
+      await wrapper.find('[data-test="oncall-response-escalate-btn"]').trigger("click");
+      await flushPromises();
+
+      expect(String(toastSpy.mock.calls.at(-1)![0].message)).toContain("reached nobody");
+    });
+
+    /// `ladder_exhausted` is a 200 on purpose — "there is nobody above you" is
+    /// an answer, not a failure. Reporting it as an error reads as though the
+    /// press failed and invites a second one — but it isn't a success either,
+    /// since nothing advanced, so it gets its own `info` treatment rather than
+    /// the green checkmark a real escalation earns.
+    it("reports an exhausted ladder as an answer, not a success or a failure", async () => {
+      const wrapper = await renderWith();
+      service.escalateNow.mockResolvedValue({
+        data: { escalated_to: "ladder_exhausted", response: {} },
+      } as any);
+
+      await wrapper.find('[data-test="oncall-response-escalate-btn"]').trigger("click");
+      await flushPromises();
+
+      const call = toastSpy.mock.calls.at(-1)![0];
+      expect(call.variant).toBe("info");
+      expect(String(call.message)).toContain("last step");
+    });
+  });
+
+  /// R13, L2: the phrase keeps a readable floor and truncates past it, and the header keeps the title's floor.
+  it("keeps the escalation phrase readable and the title floored", async () => {
+    for (const lgUp of [true, false]) {
+      mockViewport.lgUp = lgUp;
+      const wrapper = await renderWith();
+      const classes = wrapper.find('[data-test="oncall-response-phrase"]').classes();
+      expect(classes, `lg ${lgUp}`).toEqual(expect.arrayContaining(["min-w-32", "truncate"]));
+      expect(classes, `lg ${lgUp}`).not.toContain("min-w-0");
+      expect(wrapper.findComponent({ name: "OPageLayout" }).attributes()).toHaveProperty(
+        "title-min-width",
+      );
+      wrapper.unmount();
+    }
+    mockViewport.lgUp = true;
+  });
+
+  /// Seven header buttons wrap to three rows on a tablet or phone, so everything but claiming and closing shares one menu.
+  describe("below the laptop breakpoint", () => {
+    beforeEach(() => {
+      mockViewport.lgUp = false;
+    });
+
+    afterEach(() => {
+      mockViewport.mdUp = true;
+      mockViewport.lgUp = true;
+    });
+
+    it("keeps acknowledge and resolve on the row and folds the rest into one menu", async () => {
+      const wrapper = await renderWith();
+
+      for (const kept of ["ack-btn", "resolve-btn", "more-btn"]) {
+        expect(wrapper.find(`[data-test="oncall-response-${kept}"]`).exists()).toBe(true);
+      }
+      for (const folded of ["escalate-btn", "handoff-btn", "promote-btn"]) {
+        expect(wrapper.find(`[data-test="oncall-response-${folded}"]`).exists()).toBe(false);
+        expect(wrapper.find(`[data-test="oncall-response-${folded}-menu"]`).exists()).toBe(true);
+      }
+      expect(wrapper.find('[data-test="oncall-response-snooze-btn"]').exists()).toBe(false);
+      expect(wrapper.find('[data-test="oncall-response-snooze-30-menu"]').exists()).toBe(true);
+    });
+
+    it("snoozes from the menu", async () => {
+      const wrapper = await renderWith();
+      service.snoozeResponse.mockResolvedValue({ data: {} } as any);
+
+      await wrapper.find('[data-test="oncall-response-snooze-30-menu"]').trigger("click");
+      await flushPromises();
+
+      expect(service.snoozeResponse).toHaveBeenCalledWith(
+        expect.objectContaining({ response_id: "resp_1" }),
+      );
+    });
+
+    it("unsnoozes from the menu while snoozed", async () => {
+      const wrapper = await renderWith({ snoozed_until: (Date.now() + 30 * 60_000) * 1000 });
+      service.unsnoozeResponse.mockResolvedValue({ data: {} } as any);
+
+      expect(wrapper.find('[data-test="oncall-response-snooze-30-menu"]').exists()).toBe(false);
+      await wrapper.find('[data-test="oncall-response-unsnooze-btn-menu"]').trigger("click");
+      await flushPromises();
+
+      expect(service.unsnoozeResponse).toHaveBeenCalledWith(
+        expect.objectContaining({ response_id: "resp_1" }),
+      );
+    });
+
+    it("opens the hand-off drawer from the menu", async () => {
+      const wrapper = await renderWith();
+
+      await wrapper.find('[data-test="oncall-response-handoff-btn-menu"]').trigger("click");
+
+      expect(wrapper.find('[data-test="oncall-handoff-submit"]').exists()).toBe(true);
+    });
+
+    /// A greyed-out verb has no tooltip to explain it on touch, so the reason is printed on the item.
+    it("says on the item why escalate is unavailable", async () => {
+      service.escalationProgress.mockResolvedValue({
+        data: { fired: [], next_targets: [], next_at: null, exhausted: true },
+      } as any);
+      const wrapper = await renderWith();
+
+      const item = wrapper.find('[data-test="oncall-response-escalate-btn-menu"]');
+      expect(item.attributes("disabled")).toBeDefined();
+      expect(item.text()).toContain("nobody left to page");
+    });
+
+    it("drops the menu when a closed page is already tied to an incident", async () => {
+      const wrapper = await renderWith({
+        state: "resolved",
+        closed_at: 1_700_000_100_000_000,
+        incident_id: "inc_9",
+      });
+
+      expect(wrapper.find('[data-test="oncall-response-more-btn"]').exists()).toBe(false);
+    });
+
+    it("applies on a phone too", async () => {
+      mockViewport.mdUp = false;
+      const wrapper = await renderWith();
+
+      expect(wrapper.find('[data-test="oncall-response-more-btn"]').exists()).toBe(true);
+      expect(wrapper.find('[data-test="oncall-response-meta"]').exists()).toBe(true);
+    });
+  });
+});
+
+/// Responding to a page (#3090): what the screen says when the ladder ran out,
+/// while triage holds the first page, and when it cannot load.
+describe("OnCallResponseDetail — responding", () => {
+  const NOW = () => Date.now() * 1000;
+
+  beforeEach(() => {
+    vi.clearAllMocks();
+    queryClient.clear();
+    service.getTeam.mockResolvedValue({ data: { name: "Platform" } } as any);
+    service.listMembers.mockResolvedValue({ data: [] } as any);
+    service.priorCauses.mockResolvedValue({ data: [] } as any);
+    service.responseHistory.mockResolvedValue({ data: [] } as any);
+    service.listTeams.mockResolvedValue({ data: [{ id: "team_1", name: "Platform" }] } as any);
+    service.listDeliveries.mockResolvedValue({ data: { total: 0, deliveries: [] } } as any);
+    service.escalationProgress.mockResolvedValue({
+      data: { fired: [], next_targets: [], next_at: null, exhausted: false },
+    } as any);
+    service.whoIsOnCall.mockResolvedValue({ data: [] } as any);
+    service.getPolicy.mockResolvedValue({ data: null } as any);
+    service.teamReachability.mockResolvedValue({ data: { smtp_configured: true } } as any);
+    service.resolvedSchedule.mockResolvedValue({ data: [] } as any);
+    alerts.get_by_alert_id.mockResolvedValue({ data: {} } as any);
+  });
+
+  describe("a page nobody answered", () => {
+    /// The ladder's own progress decides it, the same signal the Pages list reads.
+    const ranOut = (lastAt: number) =>
+      service.escalationProgress.mockResolvedValue({
+        data: {
+          fired: [
+            { after_micros: 0, at: lastAt - 300_000_000, targets: [], reached: ["a@o2.ai"] },
+            { after_micros: 300_000_000, at: lastAt, targets: [], reached: ["b@o2.ai"] },
+          ],
+          next_targets: [],
+          next_at: null,
+          exhausted: true,
+        },
+      } as any);
+
+    it("tags it and says when the last step ran, before the record's flag lands", async () => {
+      ranOut(1_700_000_000_000_000 + HOUR_MICROS);
+      const wrapper = await renderWith({ exhausted_at: null });
+
+      expect(
+        wrapper
+          .find(
+            '[data-test="oncall-response-phrase"] [data-test="oncall-escalation-cell-exhausted"]',
+          )
+          .exists(),
+      ).toBe(true);
+      const banner = wrapper.find('[data-test="oncall-response-exhausted-banner"]');
+      expect(banner.text()).toMatch(
+        /^Nobody answered\. Every step ran by [A-Z][a-z]{2} \d{1,2}, \d{4}, \d{2}:\d{2}\. Acknowledge to take it, or hand it off\.$/,
+      );
+      expect(wrapper.text()).not.toContain("Triggered");
+    });
+
+    it("drops the date when the ladder ran out today", async () => {
+      ranOut(NOW() - 60_000_000);
+      const wrapper = await renderWith();
+
+      expect(wrapper.find('[data-test="oncall-response-exhausted-banner"]').text()).toMatch(
+        /^Nobody answered\. Every step ran by \d{2}:\d{2}\. Acknowledge/,
+      );
+    });
+
+    it("says nothing of the sort once somebody owns it", async () => {
+      ranOut(NOW());
+      const wrapper = await renderWith({
+        state: "acknowledged",
+        acked_by: "engineer@example.com",
+        acked_at: 1_700_000_000_000_000 + HOUR_MICROS,
+        exhausted_at: 1_700_000_000_000_000,
+      });
+
+      expect(wrapper.find('[data-test="oncall-response-acked-by"]').text()).toContain(
+        "Acknowledged by",
+      );
+      expect(wrapper.find('[data-test="oncall-response-exhausted-banner"]').exists()).toBe(false);
+    });
+  });
+
+  /// R14: a restarted ladder's due first rung is not "Not paged yet", and shows once sent.
+  describe("a rung that is due", () => {
+    const due = () =>
+      service.escalationProgress.mockResolvedValue({
+        data: {
+          fired: [],
+          next_targets: ["engineer@example.com"],
+          next_at: Date.now() * 1000 - 1_000_000,
+          exhausted: false,
+        },
+      } as any);
+    const phrase = (wrapper: any) =>
+      wrapper
+        .find('[data-test="oncall-response-phrase"] [data-test="oncall-escalation-cell-level"]')
+        .text();
+
+    afterEach(() => vi.useRealTimers());
+
+    it("reads as paging step 1, and re-reads until the rung is sent", async () => {
+      vi.useFakeTimers({ toFake: ["setInterval", "clearInterval"] });
+      due();
+      const wrapper = await renderWith();
+      expect(phrase(wrapper)).toMatch(/^Paging step 1 /);
+
+      service.escalationProgress.mockResolvedValue({
+        data: {
+          fired: [{ after_micros: 0, at: Date.now() * 1000, targets: [], reached: ["ana@o2.ai"] }],
+          next_targets: [],
+          next_at: null,
+          exhausted: false,
+        },
+      } as any);
+      vi.advanceTimersByTime(10_000);
+      await flushPromises();
+      expect(phrase(wrapper)).toMatch(/^Paging step 1 · ana@o2\.ai/);
+
+      const reads = service.escalationProgress.mock.calls.length;
+      for (let tick = 0; tick < 6; tick++) {
+        vi.advanceTimersByTime(10_000);
+        await flushPromises();
+      }
+      expect(service.escalationProgress.mock.calls.length, "stops once the rung appears").toBe(
+        reads,
+      );
+      wrapper.unmount();
+    });
+
+    /// L3: once the re-read sees the rung sent, the activity reads the record again.
+    it("re-reads the record when the rung is sent, so the activity agrees", async () => {
+      vi.useFakeTimers({ toFake: ["setInterval", "clearInterval"] });
+      due();
+      const wrapper = await renderWith();
+
+      const sentAt = Date.now() * 1000;
+      service.getResponse.mockResolvedValue({
+        data: {
+          response: record({ reached_rung_micros: 0 }),
+          events: [
+            {
+              kind: "page",
+              at: sentAt,
+              actor: "system",
+              body: "paged ana@o2.ai",
+              rung_micros: 0,
+              ladder_run: 2,
+            },
+          ],
+        },
+      } as any);
+      service.escalationProgress.mockResolvedValue({
+        data: {
+          fired: [{ after_micros: 0, at: sentAt, targets: [], reached: ["ana@o2.ai"] }],
+          next_targets: [],
+          next_at: null,
+          exhausted: false,
+        },
+      } as any);
+      vi.advanceTimersByTime(10_000);
+      await flushPromises();
+
+      expect(wrapper.findComponent({ name: "OnCallActivityTimeline" }).props("events")).toEqual([
+        expect.objectContaining({ kind: "page", ladder_run: 2 }),
+      ]);
+      wrapper.unmount();
+    });
+
+    const sent = (at: number) => ({ after_micros: 0, at, targets: [], reached: ["ana@o2.ai"] });
+    const sentProgress = (at: number) =>
+      service.escalationProgress.mockResolvedValue({
+        data: { fired: [sent(at)], next_targets: [], next_at: null, exhausted: false },
+      } as any);
+
+    /// F1: a rung of a new ladder run is new even when the run has fewer rungs than the last one.
+    it("re-reads the record for a rung sent in a new ladder run", async () => {
+      vi.useFakeTimers({ toFake: ["setInterval", "clearInterval"] });
+      const now = Date.now() * 1000;
+      service.escalationProgress.mockResolvedValue({
+        data: {
+          fired: [
+            sent(now - 600_000_000),
+            { ...sent(now - 300_000_000), after_micros: 300_000_000 },
+          ],
+          next_targets: ["engineer@example.com"],
+          next_at: now - 1_000_000,
+          exhausted: false,
+        },
+      } as any);
+      const wrapper = await renderWith();
+      const reads = service.getResponse.mock.calls.length;
+
+      sentProgress(now);
+      vi.advanceTimersByTime(10_000);
+      await flushPromises();
+
+      expect(service.getResponse.mock.calls.length).toBeGreaterThan(reads);
+      wrapper.unmount();
+    });
+
+    /// F2: a failed re-read of the record says so, as the view's other read failures do.
+    it("says so when the record cannot be re-read after a rung is sent", async () => {
+      vi.useFakeTimers({ toFake: ["setInterval", "clearInterval"] });
+      due();
+      const wrapper = await renderWith();
+      toastSpy.mockClear();
+
+      service.getResponse.mockRejectedValue({ response: { status: 500, data: {} } });
+      sentProgress(Date.now() * 1000);
+      vi.advanceTimersByTime(10_000);
+      await flushPromises();
+
+      expect(toastSpy.mock.calls.at(-1)?.[0]).toEqual(
+        expect.objectContaining({ variant: "error" }),
+      );
+      wrapper.unmount();
+    });
+
+    /// F3: a background re-read of the record keeps what is typed into the open Promote dialog.
+    it("keeps the Promote dialog's typed title through a background re-read", async () => {
+      vi.useFakeTimers({ toFake: ["setInterval", "clearInterval"] });
+      due();
+      const wrapper = await renderWith({ title: "checkout down" });
+      await wrapper.find('[data-test="oncall-response-promote-btn"]').trigger("click");
+      await wrapper.find('[data-test="oncall-promote-title"]').setValue("payments outage");
+
+      service.getResponse.mockResolvedValue({
+        data: { response: record({ title: "checkout down", reached_rung_micros: 0 }), events: [] },
+      } as any);
+      sentProgress(Date.now() * 1000);
+      vi.advanceTimersByTime(10_000);
+      await flushPromises();
+
+      expect(service.getResponse).toHaveBeenCalledTimes(2);
+      expect(
+        (wrapper.find('[data-test="oncall-promote-title"]').element as HTMLInputElement).value,
+      ).toBe("payments outage");
+      wrapper.unmount();
+    });
+
+    it("stops re-reading a rung that never appears after a bounded number of tries", async () => {
+      vi.useFakeTimers({ toFake: ["setInterval", "clearInterval"] });
+      due();
+      const wrapper = await renderWith();
+      const reads = service.escalationProgress.mock.calls.length;
+
+      for (let tick = 0; tick < 10; tick++) {
+        vi.advanceTimersByTime(10_000);
+        await flushPromises();
+      }
+
+      expect(service.escalationProgress.mock.calls.length).toBe(reads + 6);
+      expect(phrase(wrapper)).not.toContain("Not paged yet");
+      wrapper.unmount();
+    });
+  });
+
+  describe("the AI triage hold", () => {
+    const held = (heldUntil: number | null) =>
+      service.escalationProgress.mockResolvedValue({
+        data: {
+          fired: [],
+          next_targets: [],
+          next_at: null,
+          exhausted: false,
+          held_until_micros: heldUntil,
+        },
+      } as any);
+
+    it("counts down to the first page and offers to page now", async () => {
+      held(NOW() + 54_500_000);
+      const wrapper = await renderWith();
+
+      const banner = wrapper.find('[data-test="oncall-response-hold-banner"]');
+      expect(banner.text()).toMatch(/^AI triage is checking first · paging within \d+s Page now$/);
+    });
+
+    it("pages rung 1 through the existing escalate action", async () => {
+      held(NOW() + 54_000_000);
+      service.escalateNow.mockResolvedValue({
+        data: { escalated_to: "rung", recipients: ["engineer@example.com"] },
+      } as any);
+      const wrapper = await renderWith();
+
+      await wrapper.find('[data-test="oncall-response-hold-page-now"]').trigger("click");
+      await flushPromises();
+
+      expect(service.escalateNow).toHaveBeenCalledTimes(1);
+    });
+
+    /// Triage can answer before the deadline, so the banner must not outlive the page it promised.
+    it("re-reads the progress while held, and drops the banner once paging started", async () => {
+      vi.useFakeTimers({ toFake: ["setInterval", "clearInterval"] });
+      held(NOW() + 80_000_000);
+      const wrapper = await renderWith();
+      expect(wrapper.find('[data-test="oncall-response-hold-banner"]').exists()).toBe(true);
+      const reads = service.escalationProgress.mock.calls.length;
+
+      held(null);
+      vi.advanceTimersByTime(10_000);
+      await flushPromises();
+
+      expect(service.escalationProgress.mock.calls.length).toBe(reads + 1);
+      expect(wrapper.find('[data-test="oncall-response-hold-banner"]').exists()).toBe(false);
+      wrapper.unmount();
+      vi.useRealTimers();
+    });
+
+    /// A failed re-read is not the hold ending: the last good progress stays and the next tick retries.
+    it("keeps the banner and retries when a re-read while held fails", async () => {
+      vi.useFakeTimers({ toFake: ["setInterval", "clearInterval"] });
+      held(NOW() + 80_000_000);
+      const wrapper = await renderWith();
+      const reads = service.escalationProgress.mock.calls.length;
+
+      service.escalationProgress.mockRejectedValueOnce({ response: { status: 500, data: {} } });
+      vi.advanceTimersByTime(10_000);
+      await flushPromises();
+      expect(wrapper.find('[data-test="oncall-response-hold-banner"]').exists()).toBe(true);
+      expect(wrapper.find('[data-test="oncall-response-hold-page-now"]').exists()).toBe(true);
+
+      held(null);
+      vi.advanceTimersByTime(10_000);
+      await flushPromises();
+
+      expect(service.escalationProgress.mock.calls.length).toBe(reads + 2);
+      expect(wrapper.find('[data-test="oncall-response-hold-banner"]').exists()).toBe(false);
+      wrapper.unmount();
+      vi.useRealTimers();
+    });
+
+    it("is gone once the deadline has passed or the field is absent", async () => {
+      held(NOW() - 1_000_000);
+      const lapsed = await renderWith();
+      expect(lapsed.find('[data-test="oncall-response-hold-banner"]').exists()).toBe(false);
+      lapsed.unmount();
+
+      queryClient.clear();
+      held(null);
+      const absent = await renderWith();
+      expect(absent.find('[data-test="oncall-response-hold-banner"]').exists()).toBe(false);
+    });
+  });
+
   describe("a page that cannot be loaded", () => {
     it("shows the error with a retry instead of an empty page", async () => {
       service.getResponse.mockRejectedValueOnce({ response: { status: 500, data: {} } });
@@ -1562,6 +2100,43 @@ describe("OnCallResponseDetail — what the payload already knew", () => {
       await flushPromises();
     });
 
+    /// N2: a linked page closes the Promote dialog, so its submit cannot promote the new page with the old title.
+    it("closes the Promote dialog when the view moves to a linked page", async () => {
+      const { reactive } = await import("vue");
+      const wrapper = await renderWith({ id: "resp_1", title: "First page" });
+      await wrapper.find('[data-test="oncall-response-promote-btn"]').trigger("click");
+      expect(wrapper.find('[data-test="oncall-promote-title"]').exists()).toBe(true);
+      service.getResponse.mockImplementationOnce(() => new Promise(() => {}));
+
+      reactive(routeState).params.responseId = "resp_next";
+      await flushPromises();
+
+      expect(wrapper.find('[data-test="oncall-promote-title"]').exists()).toBe(false);
+      reactive(routeState).params.responseId = "resp_1";
+      await flushPromises();
+    });
+
+    /// N1: a record re-read that fails after the view moved on says nothing on the new page.
+    it("drops a failed re-read of the page the view has left", async () => {
+      const { reactive } = await import("vue");
+      const wrapper = await renderWith({ id: "resp_1", title: "First page" });
+      let fail: (e: unknown) => void = () => {};
+      service.getResponse.mockImplementationOnce(() => new Promise((_, reject) => (fail = reject)));
+      const pending = (wrapper.vm as any).refreshRecord();
+      service.getResponse.mockImplementationOnce(() => new Promise(() => {}));
+      reactive(routeState).params.responseId = "resp_next";
+      await flushPromises();
+      toastSpy.mockClear();
+
+      fail({ response: { status: 500, data: {} } });
+      await pending;
+      await flushPromises();
+
+      expect(toastSpy).not.toHaveBeenCalled();
+      reactive(routeState).params.responseId = "resp_1";
+      await flushPromises();
+    });
+
     it("says a linked page is gone instead of keeping the page it came from", async () => {
       const { reactive } = await import("vue");
       const wrapper = await renderWith({ id: "resp_1", title: "First page" });
diff --git a/web/src/views/OnCall/OnCallResponseDetail.vue b/web/src/views/OnCall/OnCallResponseDetail.vue
index d6c5acb6bb..1d8f25a537 100644
--- a/web/src/views/OnCall/OnCallResponseDetail.vue
+++ b/web/src/views/OnCall/OnCallResponseDetail.vue
@@ -3,6 +3,7 @@
     bleed
     data-test="oncall-response-detail-page"
     :title="title"
+    title-min-width
     icon="notifications-active"
     tabs-below
     :back="{
@@ -83,7 +84,7 @@
     <template #title-trail>
       <!-- Below lg the title row has room for the alert's name or its tags, not both; there the tags lead the body instead. -->
       <template v-if="response && lgUp">
-        <!-- The title is the one that ellipsises; the state facts beside it never shrink under it. -->
+        <!-- The state facts never shrink; the long paging phrase gives way first. -->
         <span class="inline-flex shrink-0" data-test="oncall-response-state-tag">
           <OTag type="oncallResponseState" :value="response.state" size="sm" />
           <OTooltip v-if="closedAfter" :content="closedAfter" />
@@ -92,7 +93,7 @@
         <!-- A closed page's state tag already says it, and an acknowledged one names its holder in the subtitle. -->
         <span
           v-if="isOpenState && response.state !== 'acknowledged'"
-          class="shrink-0"
+          class="flex min-w-32 shrink-[1000] truncate"
           data-test="oncall-response-phrase"
         >
           <OnCallEscalationCell
@@ -102,6 +103,7 @@
             :total-rungs="totalRungs"
             :progress-loaded="escalationLoaded"
             :reached-step="headerReachedStep"
+            :team-deleted="teamDeleted"
           />
         </span>
         <!-- Why this team is looking at somebody else's outage, said where the
@@ -212,7 +214,18 @@
         </template>
 
         <!-- A menu of durations, not a panel that pushes the page down. -->
-        <ODropdown v-if="canSnooze && lgUp">
+        <OButton
+          v-if="canUnsnooze && lgUp"
+          variant="outline"
+          size="sm"
+          :loading="snoozing"
+          data-test="oncall-response-unsnooze-btn"
+          @click="unsnoozeRecord"
+        >
+          <OTooltip :content="t('oncall.unsnoozeHint')" />
+          <OIcon name="notifications-active" size="sm" />{{ t("oncall.unsnooze") }}
+        </OButton>
+        <ODropdown v-else-if="canSnooze && lgUp">
           <template #trigger>
             <OButton
               variant="outline"
@@ -316,7 +329,15 @@
             data-test="oncall-response-more-btn"
           />
         </template>
-        <ODropdownGroup v-if="canSnooze" :label="t('oncall.snoozeFor')">
+        <ODropdownItem
+          v-if="canUnsnooze"
+          icon-left="notifications-active"
+          data-test="oncall-response-unsnooze-btn-menu"
+          @select="unsnoozeRecord"
+        >
+          {{ t("oncall.unsnooze") }}
+        </ODropdownItem>
+        <ODropdownGroup v-else-if="canSnooze" :label="t('oncall.snoozeFor')">
           <ODropdownItem
             v-for="opt in snoozeOptions"
             :key="opt.minutes"
@@ -373,7 +394,11 @@
             <OTooltip v-if="closedAfter" :content="closedAfter" />
           </span>
           <OTag type="alertPriority" :value="`p${response.priority}`" size="sm" />
-          <span v-if="isOpenState" data-test="oncall-response-phrase">
+          <span
+            v-if="isOpenState"
+            class="flex min-w-32 shrink-[1000] truncate"
+            data-test="oncall-response-phrase"
+          >
             <OnCallEscalationCell
               :response-id="response.id"
               :record="response"
@@ -381,6 +406,7 @@
               :total-rungs="totalRungs"
               :progress-loaded="escalationLoaded"
               :reached-step="headerReachedStep"
+              :team-deleted="teamDeleted"
             />
           </span>
           <OTag
@@ -426,6 +452,17 @@
           data-test="oncall-response-snoozed-banner"
         >
           {{ t("oncall.snoozedUntil", { time: snoozedUntilLabel }) }}
+          <template v-if="canUnsnooze" #actions>
+            <OButton
+              variant="outline"
+              size="sm"
+              :loading="snoozing"
+              data-test="oncall-response-snoozed-banner-unsnooze"
+              @click="unsnoozeRecord"
+            >
+              <OIcon name="notifications-active" size="sm" />{{ t("oncall.unsnooze") }}
+            </OButton>
+          </template>
         </OBanner>
 
         <!-- D-21. This record exists because somebody else's failure reaches
@@ -895,6 +932,7 @@ import {
   responseQuery,
   responseReportQuery,
   snoozeResponseMutation,
+  unsnoozeResponseMutation,
   teamMembersQuery,
   teamPolicyQuery,
   teamReachabilityQuery,
@@ -942,6 +980,8 @@ import { formatMicrosDuration } from "@/utils/formatters";
 import { formatTimestampInTimezone } from "@/utils/date";
 
 const HOLD_RECHECK_MS = 10_000;
+/// Re-reads of a lapsed rung before giving up: a minute at HOLD_RECHECK_MS.
+const LAPSE_RECHECKS = 6;
 
 const { t } = useI18nTyped();
 const { nameOf, tooltipOf } = useOrgUserNames();
@@ -1015,15 +1055,11 @@ const severityOptions = computed(() =>
 /// The record's own severity is the default: the wire derives exactly this
 /// when no severity is sent, so the picker opens on the answer rather than on
 /// an empty box somebody has to fill in mid-incident.
-watch(
-  [response, promoteOpen],
-  () => {
-    if (!promoteOpen.value || !response.value) return;
-    promoteTitle.value = response.value.title || "";
-    promoteSeverity.value = promoteSeverityFloor(response.value.priority);
-  },
-  { immediate: true },
-);
+watch(promoteOpen, (open) => {
+  if (!open || !response.value) return;
+  promoteTitle.value = response.value.title || "";
+  promoteSeverity.value = promoteSeverityFloor(response.value.priority);
+});
 
 /// Makes an incident out of a page that turned out to be one. The refusal path
 /// matters as much as the success one: a 409 means somebody else promoted this
@@ -1091,6 +1127,7 @@ const subjectAlert = ref<{
   stream_type?: string;
   query_condition?: any;
   condition?: any;
+  trigger_condition?: any;
 } | null>(null);
 /// True once the alert lookup answers 404: the page outlived its alert, and the server can no longer release it.
 const subjectAlertMissing = ref(false);
@@ -1153,6 +1190,7 @@ const ackWords = computed(() =>
   ),
 );
 const snoozeWrite = useMutation(() => snoozeResponseMutation(orgId.value));
+const unsnoozeWrite = useMutation(() => unsnoozeResponseMutation(orgId.value));
 const noteWrite = useMutation(() => addResponseNoteMutation(orgId.value));
 const handoffWrite = useMutation(() => handoffResponseMutation(orgId.value));
 const recoveryWrite = useMutation(() => confirmRecoveryMutation(orgId.value));
@@ -1313,6 +1351,7 @@ const snoozedUntilLabel = computed(() => {
   if (!r || !isSnoozed(r)) return "";
   return formatOnCallInstant(r.snoozed_until as number, nowMicros.value, store.state.timezone);
 });
+const canUnsnooze = computed(() => canSnooze.value && !!snoozedUntilLabel.value);
 
 /// Cache-first; a force expires the entry first, so it costs one request, not two.
 async function read<T>(
@@ -1543,6 +1582,22 @@ async function snoozeRecord(minutes: number) {
   }
 }
 
+async function unsnoozeRecord() {
+  snoozing.value = true;
+  try {
+    await unsnoozeWrite.mutateAsync(responseId.value);
+    toast({ variant: "success", message: t("oncall.unsnoozed") });
+    await fetchResponse();
+  } catch (err: any) {
+    toast({
+      variant: "error",
+      message: raw(err?.response?.data?.message) || t("oncall.unsnoozeFailed"),
+    });
+  } finally {
+    snoozing.value = false;
+  }
+}
+
 async function addNote() {
   const body = noteBody.value.trim();
   if (!body) return;
@@ -1876,8 +1931,28 @@ async function fetchEscalation(force = false) {
   }
 }
 
+/// Re-reads the record and its events, so the rung card and activity agree with a newer progress.
+async function refreshRecord() {
+  const id = responseId.value;
+  try {
+    const data = await read<{ response: OnCallResponse; events: OnCallResponseEvent[] } | null>(
+      responseQuery(orgId.value, id),
+      true,
+    );
+    if (!data?.response || id !== responseId.value) return;
+    response.value = data.response;
+    events.value = data.events ?? [];
+  } catch (err: any) {
+    if (id !== responseId.value) return;
+    toast({
+      variant: "error",
+      message: raw(err?.response?.data?.message) || t("oncall.loadResponseFailed"),
+    });
+  }
+}
+
 /// A failed re-read keeps the last good progress, so the hold banner and its polling survive until the next tick.
-async function recheckHold() {
+async function recheckProgress() {
   try {
     escalation.value = await read<EscalationProgress | null>(
       responseProgressQuery(orgId.value, responseId.value),
@@ -1900,16 +1975,38 @@ function openResponse(id: string) {
   });
 }
 
-// The ladder's countdown lapses while the entry is still fresh, so this one forces.
+// A lapsed rung is sent a little later, so a few forced re-reads follow until next_at moves.
+let lapseRecheck: ReturnType<typeof setInterval> | null = null;
+function stopLapseRecheck() {
+  if (lapseRecheck !== null) clearInterval(lapseRecheck);
+  lapseRecheck = null;
+}
 watch(
   () => {
     const at = escalation.value?.next_at;
     return !!at && nowMicros.value >= at;
   },
   (lapsed) => {
-    if (lapsed) fetchEscalation(true);
+    stopLapseRecheck();
+    if (!lapsed) return;
+    fetchEscalation(true);
+    let triesLeft = LAPSE_RECHECKS;
+    lapseRecheck = setInterval(() => {
+      if (triesLeft-- <= 0) return stopLapseRecheck();
+      recheckProgress();
+    }, HOLD_RECHECK_MS);
   },
 );
+onBeforeUnmount(stopLapseRecheck);
+
+// The newest rung sent in any ladder run; a run restart resets the count but never moves this back.
+const lastSentAt = computed(() =>
+  escalation.value ? Math.max(0, ...escalation.value.fired.map((rung) => rung.at)) : undefined,
+);
+// A rung the progress saw sent is on the record and its activity too, which this view read earlier.
+watch(lastSentAt, (sent, before) => {
+  if (sent !== undefined && before !== undefined && sent > before) refreshRecord();
+});
 
 // Triage may release the first page before the deadline, so the progress is re-read while held.
 let holdRecheck: ReturnType<typeof setInterval> | null = null;
@@ -1921,7 +2018,7 @@ watch(
   () => holdSecondsLeft.value > 0,
   (held) => {
     stopHoldRecheck();
-    if (held) holdRecheck = setInterval(recheckHold, HOLD_RECHECK_MS);
+    if (held) holdRecheck = setInterval(recheckProgress, HOLD_RECHECK_MS);
   },
 );
 onBeforeUnmount(stopHoldRecheck);
@@ -1959,6 +2056,7 @@ watch(
     priorCauses.value = [];
     firingHistory.value = [];
     report.value = null;
+    promoteOpen.value = false;
     fetchResponse();
   },
   { immediate: true },
diff --git a/web/src/views/OnCall/OnCallResponses.spec.ts b/web/src/views/OnCall/OnCallResponses.spec.ts
index b23fc8ae5b..e7213b4714 100644
--- a/web/src/views/OnCall/OnCallResponses.spec.ts
+++ b/web/src/views/OnCall/OnCallResponses.spec.ts
@@ -43,6 +43,7 @@ vi.mock("@/services/oncall", () => ({
     acknowledgeResponse: vi.fn(),
     resolveResponse: vi.fn(),
     snoozeResponse: vi.fn(),
+    unsnoozeResponse: vi.fn(),
     getPolicy: vi.fn(),
     getSchedule: vi.fn(),
     escalationProgress: vi.fn(),
@@ -394,6 +395,29 @@ describe("OnCallResponses", () => {
     ]);
   });
 
+  // C13: the table pages only the visible tab, so a later page cannot hide its rows.
+  it("hands the table only the rows of the visible tab", async () => {
+    const wrapper = await withPages([
+      page({ id: "a", acked_by: "engineer@example.com", state: "acknowledged" }),
+      page({ id: "c" }, "al_ord"),
+    ]);
+    const table = () => wrapper.findComponent({ name: "OTable" });
+    expect(table().props("data")).toHaveLength(2);
+
+    wrapper
+      .findAllComponents({ name: "OSelect" })
+      .find((c) => c.attributes("data-test") === "oncall-responses-filter-tabs")!
+      .vm.$emit("update:modelValue", "ringing");
+    await flushPromises();
+
+    expect(
+      table()
+        .props("data")
+        .map((row: any) => row.latest.id),
+    ).toEqual(["c"]);
+    expect(sections(wrapper)).toEqual({ ringing: 1 });
+  });
+
   /// Snoozed rows recede rather than shouting; the loud treatment is reserved
   /// for something you must act on now.
   it("mutes a snoozed row", async () => {
@@ -567,6 +591,9 @@ describe("OnCallResponses", () => {
 
       expect(sections(wrapper)).toEqual({ ringing: 1 });
       expect(wrapper.find('[data-test^="oncall-row-ack-"]').exists()).toBe(true);
+      const header = wrapper.find("[data-test='oncall-section-header-ringing']").text();
+      expect(header).not.toContain("not being paged");
+      expect(wrapper.find("[data-test='oncall-section-hint-stopped']").exists()).toBe(false);
     });
 
     /// A priority with no rungs configured (P4, by design) never starts a
@@ -598,6 +625,45 @@ describe("OnCallResponses", () => {
       );
     });
 
+    /// R11: a page whose ladder stopped has a team but pages nobody, so it is not counted as paging.
+    it("does not count a page whose ladder stopped as still paging", async () => {
+      service.escalationProgress.mockImplementation((({ response_id }: { response_id: string }) =>
+        Promise.resolve({
+          data: {
+            fired: [{ after_micros: 0, at: 1, targets: [], reached: ["ana@o2.ai"] }],
+            next_targets: [],
+            next_at: null,
+            exhausted: false,
+            stopped_because: response_id === "b" ? "the owning team was deleted" : undefined,
+          },
+        })) as any);
+      const wrapper = await withPages([page({ id: "a" }), page({ id: "b" }, "al_pay")]);
+
+      const text = wrapper.find(ringingHeader).text();
+      expect(text).toContain(
+        "nobody has acknowledged — 1 of these is still paging·1 is not being paged",
+      );
+      expect(wrapper.find('[data-test="oncall-escalation-cell-b"]').text()).toContain(
+        "Nobody is being paged",
+      );
+    });
+
+    /// F4: a deleted team pages nobody, so a page past the progress cap is counted and phrased as such.
+    it("counts and phrases a page whose team was deleted as not paged, without its progress", async () => {
+      service.escalationProgress.mockRejectedValue({ response: { status: 500, data: {} } });
+      const wrapper = await withPages([
+        page({ id: "a" }),
+        page({ id: "b", team_id: "team_gone" }, "al_pay"),
+      ]);
+
+      expect(wrapper.find(ringingHeader).text()).toContain(
+        "nobody has acknowledged — 1 of these is still paging·1 is not being paged",
+      );
+      expect(wrapper.find('[data-test="oncall-escalation-cell-b"]').text()).toContain(
+        "Nobody is being paged",
+      );
+    });
+
     it("adds no caption when every ringing page has a team", async () => {
       const wrapper = await withPages([page({ id: "a" }), page({ id: "b" }, "al_pay")]);
 
@@ -833,6 +899,29 @@ describe("OnCallResponses", () => {
       expect(cell.querySelectorAll('[aria-hidden="true"]').length).toBeGreaterThan(0);
     });
 
+    it("offers unsnooze instead of snooze on a snoozed row", async () => {
+      const wrapper = await withPages([page({ snoozed_until: (Date.now() + 60_000) * 1000 })]);
+      service.unsnoozeResponse.mockResolvedValue({ data: {} } as any);
+
+      expect(wrapper.find('[data-test^="oncall-row-snooze-"]').exists()).toBe(false);
+      await wrapper.find('[data-test^="oncall-row-unsnooze-"]').trigger("click");
+      await flushPromises();
+
+      expect(service.unsnoozeResponse).toHaveBeenCalledWith(
+        expect.objectContaining({ response_id: "resp_1" }),
+      );
+    });
+
+    it("keeps snooze for the awake firing of a row whose other firing is snoozed", async () => {
+      const wrapper = await withPages([
+        page({ id: "a", snoozed_until: (Date.now() + 60_000) * 1000 }),
+        page({ id: "b" }),
+      ]);
+
+      expect(wrapper.find('[data-test^="oncall-row-unsnooze-"]').exists()).toBe(true);
+      expect(wrapper.find('[data-test^="oncall-row-snooze-"]').exists()).toBe(true);
+    });
+
     /// Snoozing only makes sense while the ladder is still climbing, so a
     /// handled row's menu must not offer it.
     it("offers no snooze once nothing is escalating", async () => {
@@ -1041,6 +1130,32 @@ describe("OnCallResponses", () => {
       expect(checklist.props("compact")).toBe(true);
       expect(wrapper.find('[data-test="oncall-responses-table"]').exists()).toBe(true);
     });
+
+    // C4: a server-side filter that matches nothing is a filtered empty list, not an unpaged org.
+    it.each([
+      ["team", "oncall-responses-team-filter", "team_1"],
+      ["cause", "oncall-responses-cause-filter", "genuine_defect"],
+    ])("keeps the list when the %s filter matches nothing", async (_, test, value) => {
+      service.listResponses.mockImplementation(((params: any) =>
+        Promise.resolve({ data: params.team_id || params.cause ? [] : [page()] })) as any);
+      const wrapper = render();
+      await flushPromises();
+      expect(wrapper.find('[data-test="oncall-setup-banner"]').exists()).toBe(true);
+
+      wrapper
+        .findAllComponents({ name: "OSelect" })
+        .find((c: any) => c.attributes("data-test") === test)!
+        .vm.$emit("update:modelValue", value);
+      await flushPromises();
+
+      expect(wrapper.find('[data-test="oncall-setup-checklist"]').exists()).toBe(false);
+      expect(wrapper.find('[data-test="oncall-responses-table"]').exists()).toBe(true);
+      expect(wrapper.findComponent({ name: "OEmptyState" }).props("filtered")).toBe(true);
+
+      wrapper.findComponent({ name: "OEmptyState" }).vm.$emit("action", "clear-filters");
+      await flushPromises();
+      expect(wrapper.findComponent({ name: "OTable" }).props("data")).toHaveLength(1);
+    });
   });
 
   /// §G.8.1: the entry fetch is the capability probe — 404 (feature off) and
diff --git a/web/src/views/OnCall/OnCallResponses.vue b/web/src/views/OnCall/OnCallResponses.vue
index 92effa9fac..8a2f0533a8 100644
--- a/web/src/views/OnCall/OnCallResponses.vue
+++ b/web/src/views/OnCall/OnCallResponses.vue
@@ -75,7 +75,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       :has-staffed-rotation="setup.hasStaffedRotation"
       :has-policy="setup.hasPolicy"
       :has-routing="setup.hasRouting"
-      :compact="hasPages"
+      :compact="!setupOnly"
       :dismissible="hasPages"
       :can-configure="canConfigure"
       :first-team-id="teams[0]?.id ?? null"
@@ -92,7 +92,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       v-if="!unavailable && !setupOnly"
       ref="oTableRef"
       :frame="false"
-      :data="tableRows"
+      :data="visibleRows"
       :columns="columns"
       row-key="rowKey"
       :loading="loading || !setupLoaded"
@@ -114,7 +114,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       data-test="oncall-responses-table"
       :row-tone="rowTone"
       :row-rail-tone="rowRailTone"
-      :row-section="visibleRowSection"
+      :row-section="rowSection"
       :section-order="SECTION_ORDER"
       selection="multiple"
       v-model:selected-ids="selectedIds"
@@ -335,18 +335,34 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           <OTag variant="default-soft" size="sm" :data-test="`oncall-section-count-${sectionKey}`">
             {{ raw(String(sectionCounts[sectionKey] ?? 0)) }}
           </OTag>
-          <template v-if="sectionKey === 'ringing' && unroutedRinging > 0">
+          <template v-if="sectionKey === 'ringing' && unroutedRinging + stoppedRinging > 0">
             <OText v-if="routedRinging > 0" variant="meta" data-test="oncall-section-hint-routed">
               {{ t("oncall.sectionHint_ringingRouted", { count: routedRinging }, routedRinging) }}
             </OText>
             <OText v-if="routedRinging > 0" variant="meta" aria-hidden="true">
               {{ raw("·") }}
             </OText>
-            <OText variant="meta" data-test="oncall-section-hint-unrouted">
+            <OText
+              v-if="unroutedRinging > 0"
+              variant="meta"
+              data-test="oncall-section-hint-unrouted"
+            >
               {{
                 t("oncall.sectionHint_ringingUnrouted", { count: unroutedRinging }, unroutedRinging)
               }}
             </OText>
+            <OText
+              v-if="unroutedRinging > 0 && stoppedRinging > 0"
+              variant="meta"
+              aria-hidden="true"
+            >
+              {{ raw("·") }}
+            </OText>
+            <OText v-if="stoppedRinging > 0" variant="meta" data-test="oncall-section-hint-stopped">
+              {{
+                t("oncall.sectionHint_ringingStopped", { count: stoppedRinging }, stoppedRinging)
+              }}
+            </OText>
           </template>
         </div>
       </template>
@@ -463,6 +479,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           :progress-loaded="progressAnswered.has(row.latest.id)"
           :total-rungs="totalRungsFor(row.latest)"
           :reached-step="reachedStepFor(row.latest)"
+          :team-deleted="teamIsDeleted(row.latest.team_id)"
         />
       </template>
 
@@ -729,8 +746,20 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
             >
               {{ t("oncall.rowCopyLink") }}
             </ODropdownItem>
+            <ODropdownItem
+              v-if="row.latest.team_id && canAcknowledge(row) && snoozedFirings(row).length"
+              icon-left="notifications-active"
+              :data-test="`oncall-row-unsnooze-${row.rowKey}`"
+              @select="unsnoozeRow(row)"
+            >
+              {{ t("oncall.unsnooze") }}
+            </ODropdownItem>
             <ODropdownGroup
-              v-if="row.latest.team_id && canAcknowledge(row)"
+              v-if="
+                row.latest.team_id &&
+                canAcknowledge(row) &&
+                snoozedFirings(row).length < row.escalating.length
+              "
               :label="t('oncall.snoozeFor')"
             >
               <ODropdownItem
@@ -862,6 +891,7 @@ import {
   responseProgressQuery,
   responseQuery,
   snoozeResponseMutation,
+  unsnoozeResponseMutation,
   teamPolicyQuery,
   teamScheduleQuery,
   whoIsOnCallQuery,
@@ -902,6 +932,7 @@ import {
   isEscalating,
   isOnCallUnavailable,
   isDeletedTeam,
+  ladderStopped,
   isSnoozed,
   reachedStepOf,
   nextHandover,
@@ -1147,6 +1178,7 @@ const isFiltered = computed(
     teamFilter.value !== "all" ||
     priorityFilter.value !== "all" ||
     mineScope.value ||
+    !!causeFilter.value ||
     activeFilter.value !== "all",
 );
 
@@ -1174,6 +1206,9 @@ const showChecklist = computed(
     ),
 );
 
+/// Team and cause narrow the fetch itself, so an empty answer says nothing about whether the org has pages.
+const serverFiltered = computed(() => teamFilter.value !== "all" || !!causeFilter.value);
+
 /// Whether this org has ever paged anybody — read from what was FETCHED, not
 /// from the filtered rows, so narrowing the table to nothing does not swap the
 /// page's whole shape underneath the reader.
@@ -1193,7 +1228,7 @@ const hasPages = computed(
 /// under it would only offer "no pages yet" as if that were healthy. Once a
 /// single page exists the checklist has to give the screen back — it becomes
 /// one bar over a live list.
-const setupOnly = computed(() => showChecklist.value && !hasPages.value);
+const setupOnly = computed(() => showChecklist.value && !hasPages.value && !serverFiltered.value);
 
 const columns = computed<OTableColumnDef<PageRow>[]>(() => [
   {
@@ -1397,8 +1432,10 @@ function toRows(records: OnCallResponse[]): PageRow[] {
 /// header controls alone.
 const rows = computed(() => toRows(scopedResponses.value));
 
-/// Only the tab's sections reach the table, so its pager counts what is on screen rather than every fetched row.
-const tableRows = computed(() => rows.value.filter((row) => visibleRowSection(row) !== null));
+/// The visible tab's rows, filtered before the table pages them, so the footer count and pages describe that tab.
+const visibleRows = computed(() =>
+  rows.value.filter((row) => sectionVisibility.value[rowSection(row)]),
+);
 
 const causeOptions = computed(() => [
   { label: t("oncall.causeFilterAny"), value: "" },
@@ -1562,6 +1599,7 @@ function ackTooltip(row: PageRow): I18nText {
 /// One list writes to many rows, so the id rides in the variables, not the setup.
 const ackWrite = useMutation(() => acknowledgeResponseMutation(orgId.value));
 const snoozeWrite = useMutation(() => snoozeResponseMutation(orgId.value));
+const unsnoozeWrite = useMutation(() => unsnoozeResponseMutation(orgId.value));
 const resolveWrite = useMutation(() => resolveResponseMutation(orgId.value));
 const handoffWrite = useMutation(() => handoffResponseMutation(orgId.value));
 const noteWrite = useMutation(() => addResponseNoteMutation(orgId.value));
@@ -1595,6 +1633,28 @@ async function snoozeRow(row: PageRow, minutes: number) {
   }
 }
 
+function snoozedFirings(row: PageRow): OnCallResponse[] {
+  return row.escalating.filter((r) => isSnoozed(r));
+}
+
+/// Ends the snooze on every quiet firing the row stands for, so they all continue now.
+async function unsnoozeRow(row: PageRow) {
+  busyId.value = row.rowKey;
+  try {
+    const results = await Promise.allSettled(
+      snoozedFirings(row).map((r) => unsnoozeWrite.mutateAsync(r.id)),
+    );
+    if (results.some((r) => r.status === "rejected")) {
+      toast({ variant: "error", message: t("oncall.unsnoozeFailed") });
+    } else {
+      toast({ variant: "success", message: t("oncall.unsnoozed") });
+    }
+    await fetchResponses();
+  } finally {
+    busyId.value = "";
+  }
+}
+
 async function resolveRow(row: PageRow) {
   busyId.value = row.rowKey;
   try {
@@ -1731,15 +1791,6 @@ function rowSection(row: PageRow): SectionKey {
   return "handled";
 }
 
-/// What `OTable` groups by. Unlike `rowSection`, a section the filters
-/// dropdown unchecked returns null here — `OTable` drops a row entirely when
-/// its section is null, which is how "hide Handled" hides Handled rows
-/// without touching `rows`, `sectionCounts`, or anything counted off it.
-function visibleRowSection(row: PageRow): SectionKey | null {
-  const section = rowSection(row);
-  return sectionVisibility.value[section] ? section : null;
-}
-
 /// Counted over the filtered set, not the page: a heading reading "3" on page
 /// one of five would be describing the pagination rather than the state.
 const sectionCounts = computed<Record<string, number>>(() => {
@@ -1757,7 +1808,20 @@ const unroutedRinging = computed(
         !row.escalating.some((r) => r.team_id && !r.acked_by && !isSnoozed(r)),
     ).length,
 );
-const routedRinging = computed(() => (sectionCounts.value.ringing ?? 0) - unroutedRinging.value);
+const stoppedRinging = computed(
+  () =>
+    rows.value.filter((row) => {
+      if (rowSection(row) !== "ringing") return false;
+      const live = row.escalating.filter((r) => r.team_id && !r.acked_by && !isSnoozed(r));
+      return (
+        live.length > 0 &&
+        live.every((r) => ladderStopped(progressById.value[r.id], teamIsDeleted(r.team_id)))
+      );
+    }).length,
+);
+const routedRinging = computed(
+  () => (sectionCounts.value.ringing ?? 0) - unroutedRinging.value - stoppedRinging.value,
+);
 
 /// Only the run that needs somebody gets colour. Snoozed is deliberately
 /// inert and handled and resolved are both finished, so all three stay in the
@@ -2114,11 +2178,15 @@ async function copyRowLink(row: PageRow) {
 
 function onEmptyAction(id?: string) {
   if (id === "clear-filters") {
+    const refetch = serverFiltered.value;
     search.value = "";
     teamFilter.value = "all";
     priorityFilter.value = "all";
+    causeFilter.value = "";
     setMineOnly(false);
     selectFilterTab("all");
+    // The loaded rows are the filtered server answer, so clearing team or cause must ask again.
+    if (refetch) void fetchResponses();
   }
 }
 
diff --git a/web/src/views/synthetics/RunDetail.spec.ts b/web/src/views/synthetics/RunDetail.spec.ts
index 04056b7123..028238c36c 100644
--- a/web/src/views/synthetics/RunDetail.spec.ts
+++ b/web/src/views/synthetics/RunDetail.spec.ts
@@ -341,6 +341,35 @@ describe("RunDetail", () => {
 
       w.unmount();
     });
+
+    it("shows no status badge while the run loads, then the loaded run's status", async () => {
+      // Reassign the shared wrapper so afterEach unmounts it even when an assertion fails.
+      wrapper.unmount();
+      mockRunDetailRef.value = null;
+      let finishFetch!: () => void;
+      mockFetchRun.mockImplementationOnce(
+        () =>
+          new Promise<void>((resolve) => {
+            finishFetch = resolve;
+          }),
+      );
+
+      wrapper = mountComponent();
+      await flushPromises();
+
+      expect(wrapper.find('[data-test="synthetics-run-detail-info-skeleton"]').exists()).toBe(true);
+      expect(wrapper.find('[data-test="synthetics-run-detail-status-badge"]').exists()).toBe(false);
+      expect(wrapper.text()).not.toContain("synthetics.results.passed");
+
+      mockRunDetailRef.value = { ...mockRunDetail, status: "failed" };
+      mockLoading.value = false;
+      finishFetch();
+      await flushPromises();
+
+      const badge = wrapper.find('[data-test="synthetics-run-detail-status-badge"]');
+      expect(badge.exists()).toBe(true);
+      expect(badge.text()).toBe("synthetics.results.failed");
+    });
   });
 });
 
@@ -569,6 +598,25 @@ describe("RunDetail — id-less error override (quota / reaper rows)", () => {
     expect(w.find('[data-test="synthetics-run-detail-error-desc"]').exists()).toBe(false);
   });
 
+  it("headlines a dead-letter message without its cut '(phase' group", async () => {
+    mockRunDetailRef.value = null;
+    w = mountComponent({
+      drawerMode: true,
+      overrideMonitorType: "browser",
+      overrideError: {
+        ...overrideError,
+        errorSource: "dispatch",
+        message:
+          "no probe claimed the check for this location before its schedule window closed (phase: never claimed; 0 dispatch attempt(s)); a probe may be unable to reach the callback endpoint http://localhost:5080",
+      },
+    });
+    await flushPromises();
+
+    expect(w.find('[data-test="synthetics-run-detail-error-type"]').text()).toBe(
+      "no probe claimed the check for this location before its schedule window closed",
+    );
+  });
+
   it("renders the error view even for a protocol monitor type (skips ProtocolRunSummary)", async () => {
     mockRunDetailRef.value = null;
     w = mountComponent({ drawerMode: true, overrideMonitorType: "http", overrideError });
diff --git a/web/src/views/synthetics/RunDetail.vue b/web/src/views/synthetics/RunDetail.vue
index 5c75404dad..0de8ae7c56 100644
--- a/web/src/views/synthetics/RunDetail.vue
+++ b/web/src/views/synthetics/RunDetail.vue
@@ -52,6 +52,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
       >
         <template #title-trail>
           <OBadge
+            v-if="hasRunStatus"
             :variant="statusBadgeVariant"
             size="sm"
             :icon="statusIcon"
@@ -59,6 +60,7 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
           >
             {{ statusLabel }}
           </OBadge>
+          <OSkeleton v-else-if="loading" type="text" class="h-6 w-16" />
           <OBadge
             v-if="currentRun.url"
             variant="default"
@@ -249,7 +251,10 @@ along with this program.  If not, see <http://www.gnu.org/licenses/>.
                   <OIcon name="error" class="text-status-error-text shrink-0" size="md" />
                   <div class="min-w-0 flex-1">
                     <div class="flex flex-wrap items-center gap-2">
-                      <span class="text-status-error-text text-sm font-bold">
+                      <span
+                        class="text-status-error-text text-sm font-bold"
+                        data-test="synthetics-run-detail-error-type"
+                      >
                         {{ currentRun.errorType }}
                       </span>
                       <OBadge
@@ -672,7 +677,7 @@ import { useListBackNavigation } from "@/composables/useListBackNavigation";
 import { useStore } from "vuex";
 import syntheticsService from "@/services/synthetics";
 import { timestampToTimezoneDate } from "@/utils/timezone";
-import { locationDisplayLabel } from "@/utils/synthetics/format";
+import { errorHeadline, locationDisplayLabel } from "@/utils/synthetics/format";
 import { syntheticsResultsRoute } from "@/utils/synthetics/routes";
 import OCard from "@/lib/core/Card/OCard.vue";
 import OCardSection from "@/lib/core/Card/OCardSection.vue";
@@ -1224,7 +1229,7 @@ function toDisplayRun(detail: SyntheticRunDetail | null): DisplayRun {
     hasReplay: false,
     ...(hasIssue
       ? {
-          errorType: detail.error ? detail.error.split(":")[0] : t("synthetics.results.error"),
+          errorType: detail.error ? errorHeadline(detail.error) : t("synthetics.results.error"),
           errorReason: detail.error || "",
           errorStack: detail.error || "",
           errorSource: detail.errorSource,
@@ -1254,7 +1259,7 @@ function errorToDisplayRun(o: OverrideError): DisplayRun {
     timestamp: fmtTimestamp(o.timestamp),
     url: "",
     hasReplay: false,
-    errorType: o.message ? o.message.split(":")[0] : t("synthetics.results.error"),
+    errorType: o.message ? errorHeadline(o.message) : t("synthetics.results.error"),
     errorReason: o.message || "",
     errorStack: o.message || "",
     errorSource: o.errorSource,
@@ -1451,6 +1456,8 @@ const currentRun = computed<DisplayRun>(() => {
   if (props.overrideError) return errorToDisplayRun(props.overrideError);
   return toDisplayRun(null);
 });
+// The empty display run defaults to "pass", so only real run data may drive the status badge.
+const hasRunStatus = computed(() => !!synthetics.runDetail.value || !!props.overrideError);
 
 const isFailed = computed(
   () => currentRun.value.status === "fail" || currentRun.value.status === "error",