chore: simplify PR template and add agent rules

- replace the multi-section PR template with four concise headings - add .claude/rules/ covering comments (repo-wide, Go, Python) and pull requests - ignore .dev/ and .claude/worktrees/ in .gitignore
chore(deps): bump clickhouse-sql-parser to v0.5.5 (#12454 )
2026-08-07 13:40:40 +01:00 · 2026-08-07 16:44:54 +05:30 · 2026-08-07 10:39:21 +00:00 · 2026-08-07 10:07:32 +00:00 · 2026-08-06 22:31:33 +00:00 · 2026-08-06 15:28:41 +00:00
60 changed files with 5528 additions and 632 deletions
--- a/.claude/rules/comments.md
+++ b/.claude/rules/comments.md
@@ -0,0 +1,11 @@
+# Comments
+
+Applies to everything in the repo — code, config, workflows.
+
+- **No unnecessary comments.** Do not comment where the code is self-explanatory; never restate what the code already says.
+- **Document only** non-obvious behavior, constraints, formats, and edge cases.
+- **Rationale goes in prose, not source.** Why a version is pinned, why a job exists, how a subsystem fits together — that belongs in the README or the PR.
+- **Never remove pre-existing comments** when editing code. The bar above applies to comments you write, not comments already there.
+- **Never talk to the reviewer.** No comments about where a change came from, what was changed, or why the change is correct — that belongs in the PR description and is noise the moment it merges.
+
+Language rules build on this one: [`go-comments`](go-comments.md), [`py-comments`](py-comments.md).
--- a/.claude/rules/go-comments.md
+++ b/.claude/rules/go-comments.md
@@ -0,0 +1,12 @@
+---
+paths:
+  - "**/*.go"
+---
+
+# Go comments
+
+The bar is the [`comments`](comments.md) rule: nothing where the code is self-explanatory.
+
+- **Names carry the meaning.** Make function, type, and variable names self-explanatory so the comment is unnecessary in the first place. If a comment is needed to explain what a function does, fix the name, not the comment.
+- **Godoc**: Skip comments that merely restate the identifier. Document only non-obvious behavior, constraints, formats, and edge cases.
+- **Generated code**: If the comment is emitted by an external codegen tool, leave it as-is — do not add or trim comments in generated files.
--- a/.claude/rules/pull-requests.md
+++ b/.claude/rules/pull-requests.md
@@ -0,0 +1,7 @@
+# Pull requests
+
+- **Follow the template** (`.github/pull_request_template.md`): fill in its headings (Description / Issues closed by this PR / Screenshots / Additional Information). Don't add sections the template doesn't have.
+- **Keep only the headings that apply.** Delete every heading that has nothing under it, along with its `<!--...-->` placeholder comment. The body must never contain an empty heading — if only Description applies, the body has exactly that one heading.
+- **Keep the description concise and human-readable.** A few plain bullets saying what changed and why, for a reviewer skimming it — not a wall of text, not a restatement of the diff, not generated boilerplate.
+- **Reference issues with `Closes #issue-number`** under "Issues closed by this PR" so they auto-close on merge. This goes in the PR description only — never in commit messages.
+- **AI assistance in commits may optionally be disclosed with an `Assisted-by:` trailer** naming the model (e.g. `Assisted-by: Claude Opus 4.5`) — do NOT use a `Co-authored-by:` trailer for this.
--- a/.claude/rules/py-comments.md
+++ b/.claude/rules/py-comments.md
@@ -0,0 +1,13 @@
+---
+paths:
+  - "**/*.py"
+---
+
+# Python comments
+
+The bar is the [`comments`](comments.md) rule: nothing where the code is self-explanatory.
+
+- **Names carry the meaning.** Make function and variable names self-explanatory so the comment or docstring is unnecessary in the first place. If a docstring is needed to explain what a function does, fix the name, not the docstring.
+- **No file-level docstring.** The filename says what the module is for — `tool_bin.py` gets the tool binary. A module docstring restating that is noise, and a paragraph of design prose at the top of a file goes stale where nobody is looking. A constraint belongs next to the code it constrains, not in a preamble.
+- **Docstrings**: only when they say something the name and signature don't — drop them otherwise. Keep them short. A contract that genuinely needs a few lines (interacting flags, retry semantics, an edge case) is fine; a narrative is not.
+- **No song and dance.** Comment the constraint or the edge case. Not the narrative, not the rationale, not what the next line does.
--- a/.github/pull_request_template.md
+++ b/.github/pull_request_template.md
@@ -1,85 +1,13 @@
-## Pull Request
-
---
-
-### 📄 Summary
-> Why does this change exist?  
-> What problem does it solve, and why is this the right approach?
-
-
-
-#### Screenshots / Screen Recordings (if applicable)
-> Include screenshots or screen recordings that clearly show the behavior before the change and the result after the change. This helps reviewers quickly understand the impact and verify the update.
-
+<!--A few plain bullets saying what changed and why, for a reviewer skimming it - not a wall of text, not a restatement of the diff, not generated boilerplate.-->
+#### Description

+<!--Reference issues using `Closes #issue-number` to enable automatic closure on merge. -->
 #### Issues closed by this PR
-> Reference issues using `Closes #issue-number` to enable automatic closure on merge.

---
+<!--If applicable, include screenshots or screen recordings that clearly show the behavior before the change and the result after the change. -->
+#### Screenshots / Screen Recordings

-### ✅ Change Type
-_Select all that apply_
+<!--Anything reviewers should keep in mind while reviewing -->
+#### Additional Information

- [ ] ✨ Feature
- [ ] 🐛 Bug fix
- [ ] ♻️ Refactor
- [ ] 🛠️ Infra / Tooling
- [ ] 🧪 Test-only
-
---
-
-### 🐛 Bug Context
-> Required if this PR fixes a bug
-
-#### Root Cause
-> What caused the issue?  
-> Regression, faulty assumption, edge case, refactor, etc.
-
-#### Fix Strategy
-> How does this PR address the root cause?
-
---
-
-### 🧪 Testing Strategy
-> How was this change validated?
-
- Tests added/updated:
- Manual verification:
- Edge cases covered:
-
---
-
-### ⚠️ Risk & Impact Assessment
-> What could break? How do we recover?
-
- Blast radius:
- Potential regressions:
- Rollback plan:
-
---
-
-### 📝 Changelog
-> Fill only if this affects users, APIs, UI, or documented behavior  
-> Use **N/A** for internal or non-user-facing changes
-
-| Field | Value |
-|------|-------|
-| Deployment Type | Cloud / OSS / Enterprise |
-| Change Type | Feature / Bug Fix / Maintenance |
-| Description | User-facing summary |
-
---
-
-### 📋 Checklist
- [ ] Tests added or explicitly not required
- [ ] Manually tested
- [ ] Breaking changes documented
- [ ] Backward compatibility considered
-
---
-
-## 👀 Notes for Reviewers
-
-<!-- Anything reviewers should keep in mind while reviewing -->
-
---
+<!--Please delete paragraphs that you did not use before submitting.-->
--- a/.gitignore
+++ b/.gitignore
@@ -90,8 +90,6 @@ queries.active
 .devenv/**/tmp/**
 .qodo

-.dev
-
 ### Python ###
 # Byte-compiled / optimized / DLL files
 __pycache__/
@@ -231,4 +229,6 @@ cython_debug/
 # LSP config files
 pyrightconfig.json

-
+# dev
+.dev/
+.claude/worktrees/
--- a/docs/api/openapi.yml
+++ b/docs/api/openapi.yml
@@ -10247,9 +10247,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - dashboard:update
      - tokenizer:
-        - ADMIN
+        - dashboard:update
      summary: Delete public dashboard
      tags:
      - dashboard
@@ -10298,9 +10298,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - dashboard:read
      - tokenizer:
-        - ADMIN
+        - dashboard:read
      summary: Get public dashboard
      tags:
      - dashboard
@@ -10355,9 +10355,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - dashboard:update
      - tokenizer:
-        - ADMIN
+        - dashboard:update
      summary: Create public dashboard
      tags:
      - dashboard
@@ -10399,9 +10399,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - ADMIN
+        - dashboard:update
      - tokenizer:
-        - ADMIN
+        - dashboard:update
      summary: Update public dashboard
      tags:
      - dashboard
@@ -14739,9 +14739,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - dashboard:list
      - tokenizer:
-        - VIEWER
+        - dashboard:list
      summary: List dashboard saved views
      tags:
      - dashboard
@@ -14796,9 +14796,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:list
      - tokenizer:
-        - EDITOR
+        - dashboard:list
      summary: Create dashboard saved view
      tags:
      - dashboard
@@ -14849,9 +14849,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:list
      - tokenizer:
-        - EDITOR
+        - dashboard:list
      summary: Delete dashboard saved view
      tags:
      - dashboard
@@ -14917,9 +14917,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:list
      - tokenizer:
-        - EDITOR
+        - dashboard:list
      summary: Update dashboard saved view
      tags:
      - dashboard
@@ -14994,9 +14994,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - dashboard:list
      - tokenizer:
-        - VIEWER
+        - dashboard:list
      summary: List dashboards (v2)
      tags:
      - dashboard
@@ -15051,9 +15051,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:create
      - tokenizer:
-        - EDITOR
+        - dashboard:create
      summary: Create dashboard (v2)
      tags:
      - dashboard
@@ -15104,9 +15104,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:delete
      - tokenizer:
-        - EDITOR
+        - dashboard:delete
      summary: Delete dashboard (v2)
      tags:
      - dashboard
@@ -15167,9 +15167,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - dashboard:read
      - tokenizer:
-        - VIEWER
+        - dashboard:read
      summary: Get dashboard (v2)
      tags:
      - dashboard
@@ -15241,9 +15241,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:update
      - tokenizer:
-        - EDITOR
+        - dashboard:update
      summary: Patch dashboard (v2)
      tags:
      - dashboard
@@ -15310,9 +15310,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:update
      - tokenizer:
-        - EDITOR
+        - dashboard:update
      summary: Update dashboard (v2)
      tags:
      - dashboard
@@ -15378,9 +15378,11 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:read
+        - dashboard:create
      - tokenizer:
-        - EDITOR
+        - dashboard:read
+        - dashboard:create
      summary: Clone dashboard (v2)
      tags:
      - dashboard
@@ -15431,9 +15433,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:update
      - tokenizer:
-        - EDITOR
+        - dashboard:update
      summary: Unlock dashboard (v2)
      tags:
      - dashboard
@@ -15483,9 +15485,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:update
      - tokenizer:
-        - EDITOR
+        - dashboard:update
      summary: Lock dashboard (v2)
      tags:
      - dashboard
@@ -15549,9 +15551,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - EDITOR
+        - dashboard:update
      - tokenizer:
-        - EDITOR
+        - dashboard:update
      summary: Migrate dashboard to v2
      tags:
      - dashboard
@@ -23695,9 +23697,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - dashboard:list
      - tokenizer:
-        - VIEWER
+        - dashboard:list
      summary: List dashboards for the current user (v2)
      tags:
      - dashboard
@@ -23742,9 +23744,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - dashboard:list
      - tokenizer:
-        - VIEWER
+        - dashboard:list
      summary: Unpin a dashboard for the current user (v2)
      tags:
      - dashboard
@@ -23801,9 +23803,9 @@ paths:
          description: Internal Server Error
      security:
      - api_key:
-        - VIEWER
+        - dashboard:list
      - tokenizer:
-        - VIEWER
+        - dashboard:list
      summary: Pin a dashboard for the current user (v2)
      tags:
      - dashboard
--- a/docs/contributing/prometheus.md
+++ b/docs/contributing/prometheus.md
@@ -1,123 +1,377 @@
 # PromQL Serving — clickhouseprometheusv2

-This document is the subsystem context for `pkg/prometheus/clickhouseprometheusv2`,
-the second-generation ClickHouse-backed Prometheus provider. It explains why the
-package exists, the correctness constraints that shaped it, and how each fetch
-reduction is proven not to change results. Any change to the provider must keep
-these invariants; if a change would violate one, it must be flagged and
-discussed.
+This document gives the context for `pkg/prometheus/clickhouseprometheusv2`.
+This package is the second-generation ClickHouse-backed Prometheus provider.
+The document tells you why the package exists. It tells you the correctness
+rules that shaped it. It shows how we prove that each construct does not
+change results. Keep these invariants when you change the provider. If your
+change breaks an invariant, flag it and discuss it first.

 ---

 ## Why a second provider

-The v1 provider (`pkg/prometheus/clickhouseprometheus`) serves the promql engine
-through the remote-read protobuf adapter: every raw sample of a query's union
-window is fetched, serialized, and handed to the engine. The cost is a function
-of ingested data, not of the question asked — which is how a dashboard of PromQL
-panels can take an instance down.
+The v1 provider (`pkg/prometheus/clickhouseprometheus`) serves the promql
+engine through the remote-read protobuf adapter. It fetches every raw sample
+of a query's union window. It serializes all of them and gives them to the
+engine. The cost follows the ingested data, not the question. This is how a
+dashboard of PromQL panels can take an instance down.

-In v2 the stock promql engine evaluates over a native `storage.Querier`: no
-translation layer, per-selector fetch windows, and fetch reductions that are
-provably invisible to the engine.
+In v2, each query runs in one of two ways. The classifier decides per query:

-**The core constraint: every reduction either preserves engine semantics exactly
-or is not performed.** A PromQL result that differs from upstream Prometheus is
-a lost user. The conformance suite
+- **Transpiled**: ClickHouse evaluates the query. Only final (or near-final)
+  per-group grid arrays come back. The statements use the
+  `timeSeries*ToGrid` aggregate functions. The supported ClickHouse floor is
+  25.6 or later, so these functions are assumed available.
+- **Engine**: the stock promql engine evaluates over this package's native
+  `storage.Querier`. Every shape that does not transpile takes this path.
+
+**The core rule: a PromQL result that differs from upstream Prometheus is a
+lost user. A construct that cannot reproduce engine semantics exactly falls
+back. It does not approximate.** The conformance suite
 (`tests/integration/tests/promqlconformance/`) replays Prometheus' own test
-corpus against both providers and is the arbiter.
+corpus against both providers. It is the arbiter. The classification golden
+(`testdata/classification_golden.json`) freezes the route of each corpus
+expression. The rest of this document is the PromQL-to-SQL story. That
+mapping is where correctness is won or lost.

 ---

+## The evaluation model the SQL must reproduce
+
+A PromQL range query is an instant query evaluated at each grid point
+`t_i = start + i*step`, for `i = 0..(end-start)/step`. At each `t_i`:
+
+- An instant selector resolves to the latest sample in the left-open
+  lookback window `(t_i - lookback, t_i]`. If that latest sample is a stale
+  marker, the selector resolves to nothing. Older real samples in the window
+  do not change this.
+- A range selector `[r]` collects every sample in `(t_i - r, t_i]`. Stale
+  markers are excluded.
+- `offset d` shifts both windows to `(t_i - d - w, t_i - d]`.
+
+The transpilation invariant follows from this model. Each transpiled
+construct produces one array per output series. The array has exactly one
+slot per grid point. Slot `i` holds the value at `t_i`. NULL means absent.
+This makes composition correct, not only convenient. The engine evaluates
+these operators independently per `t_i`. A representation that gets every
+slot right gets the whole query right. Spatial aggregation over arrays is
+sound because it combines values that belong to the same `t_i` by
+construction. Scan time maps slot `i` back to `t_i = start + i*step`
+(`toMatrix`). The sections below fill those slots with exactly the numbers
+the engine computes. We validated each equivalence against the vendored
+engine on live data before its shape entered the allowlist. An unproven
+shape stays on the engine path.
+
+## Classification: finding what a statement can answer
+
+`classify` walks the parsed AST and looks for "core units". A core unit is a
+maximal subtree of this shape:
+
+	[agg by/without (...)] [fn(] selector[range] [offset d] [)] [op scalar]...
+
+`classifyCore` peels that chain from the outside in. It takes an optional
+sum/min/max/avg/count aggregation. It then takes one allowlisted function or
+a bare instant selector. It then takes the selector with its offset. On the
+way out, it collects number-literal arithmetic, comparisons (including
+`bool`), and unary minus into a scalar-op pipeline. A node qualifies only if
+its type, arguments, and children are in the proven set. This is an
+allowlist. An overlooked construct becomes a fallback, not a wrong number.
+
+Three unit kinds come out. Each kind has its own SQL form:
+
+- `unitRange`: rate, irate, increase, delta, idelta over a range selector.
+- `unitInstant`: instant vector selection, bare or comparison-filtered.
+- `unitOverTime`: avg/min/max/sum/count/last `_over_time`.
+
+If the whole tree is one unit, the plan is "full". The statement's rows are
+the query result. Otherwise, `rewrite` cuts out each maximal unit and puts a
+synthetic selector `__signoz_transpiled_N__` in its place. The engine then
+runs the rewritten expression over the units' materialized results. This is
+a "hybrid" plan. `histogram_quantile`, `topk`, `or`/`and`/`unless`, and
+vector matching keep exact engine semantics. Their expensive inputs were
+aggregated server-side.
+
+Classification refuses a shape when it cannot guarantee exact semantics
+server-side:
+
+- The `@` modifier, anywhere.
+- Default-resolution subqueries. Their resolution is a server runtime
+  setting that the transpiler cannot see.
+- Duration expressions (`offset step()`, `[range()]`, ...), anywhere. The
+  engine resolves them into the selector's static fields only at evaluation
+  time. At classification time those fields hold zero values. A transpile
+  would silently use the wrong offset or range.
+- Steps or ranges that are not whole seconds. The grid functions take
+  whole-second parameters.
+- Grouping by `__name__`, or matching on it, in hybrid plans. The synthetic
+  name would leak into results.
+- Name-keeping units in hybrid plans. Bare and comparison-filtered instant
+  selectors and `last_over_time` keep their real `__name__` (`keepsName`).
+  Substitution would replace that name. These units transpile only as full
+  plans.
+- Every function outside the allowlist: changes, resets,
+  quantile_over_time, absent, native-histogram functions, and more.
+
+Units inside a fixed-resolution subquery evaluate on the subquery's own
+grid, not the query grid. That grid is the set of epoch-aligned multiples of
+the resolution strictly after `outerStart - offset - range`, ending at
+`outer end - offset`. This is the exact derivation the engine uses. A grid
+shifted by one step changes which samples every window sees.
+
+## From one unit to one statement
+
+`buildUnitSQL` renders each unit as one statement. For
+`sum by (pod) (rate(m{job="api"}[5m]))` the skeleton is:
+
+	SELECT g0, sumForEach(grid) AS grid FROM (
+	    SELECT any(series.g0) AS g0,
+	           timeSeriesRateToGrid(<start>, <end>, <step>, <range>)(fromUnixTimestamp64Milli(unix_milli), value) AS grid
+	    FROM signoz_metrics.distributed_samples_v4 AS points
+	    INNER JOIN (
+	        SELECT fingerprint, JSONExtractString(labels, 'pod') AS g0
+	        FROM signoz_metrics.time_series_v4
+	        WHERE <series predicates>
+	        GROUP BY fingerprint, g0
+	    ) AS series ON points.fingerprint = series.fingerprint
+	    WHERE metric_name = ? AND temporality IN ['Cumulative', 'Unspecified']
+	      AND unix_milli > <start - range> AND unix_milli <= <end>
+	      AND bitAnd(flags, 1) = 0
+	    GROUP BY points.fingerprint
+	) GROUP BY g0
+	SETTINGS allow_experimental_ts_to_grid_aggregate_function = 1
+
+Read it from the inside out.
+
+**The time window** is the selector's semantics, verbatim. Strict `>` on the
+lower bound and `<=` on the upper bound is the left-open `(t - w, t]` rule.
+The offset shifts the whole window. `bitAnd(flags, 1) = 0` drops stale
+markers. PromQL excludes them from range vectors.
+
+**The inner GROUP BY** computes one grid array per series.
+`timeSeriesRateToGrid(start, end, step, range)` is a parametric aggregate.
+It takes (timestamp, value) pairs and produces `Array(Nullable(Float64))`
+with one slot per grid point. It is correct because it implements the
+engine's `extrapolatedRate`, decision for decision: counter resets, the
+zero-point clamp, the extrapolation thresholds, the two-samples rule, and
+the left-open window. We verified this: we fed identical samples to both and
+compared slot for slot. The only observed difference is the last bit.
+ClickHouse's C++ and Go round the same formula differently. That is the
+floating-point floor, not a semantic gap. irate/delta/idelta map to their
+own `timeSeries*ToGrid` functions, with the same verification. `increase`
+has no function of its own. We emit
+`arrayMap(x -> x * <range seconds>, <rate expr>)`. This is exact by
+definition: `extrapolatedRate` computes the same extrapolated delta for both
+and divides by the range only when `isRate`. The multiplication reverses it
+exactly. The grid parameters render as literals, not bound args. They are
+aggregate-function parameters. The experimental gate rides as a SETTINGS
+clause on the statement itself, so telemetrystore hooks cannot remove it.
+
+The group key is functionally dependent on the fingerprint: one fingerprint
+is the hash of one labelset. So the inner query groups by the fingerprint
+alone and reads the key columns with `any()`. This is exact, and it makes
+the per-row hash key smaller.
+
+**The join** gives each series its group key, in one of two forms.
+`by (...)` extracts each listed label as a plain column
+(`JSONExtractString(labels, 'pod') AS g0`) and groups on the columns. The
+projection is a known short list, and the label names live in Go. To build,
+sort, and stringify every label pair per row would be waste. This is correct
+because column-tuple equality is label-set equality on the projection. An
+extracted `''` means the label is absent. That is Prometheus semantics for
+`by()` over missing labels. The empties are skipped when the columns turn
+back into labels. `without` and no-aggregation project a label set that
+varies per series. They get the canonical key: `toJSONString` of the sorted
+[label, value] pairs that the unit projects. `without` excludes the listed
+labels plus `__name__`. No-aggregation keeps everything; the name comes off
+in Go, per the engine's name-dropping rules. Here the sort is load-bearing.
+Stored JSON key order is not canonical across fingerprints. Two orderings of
+the same labels must land in one group. Empty values are filtered for the
+same absent-label reason. The same string parses back into the output label
+set (`labelsFromGroupKey`).
+
+**The outer GROUP BY** is the spatial aggregation. sum/min/max/avg/count
+by/without become the `-ForEach` combinators. Element-wise aggregation over
+grid arrays is the engine's per-`t_i` aggregation: slot `i` of every input
+array refers to the same `t_i`. The combinators skip NULLs. That is the
+engine aggregating only the series present at `t_i`. An index where every
+series is absent stays NULL. Two edges need explicit handling. First,
+`countForEach` wraps in a map of 0 back to NULL. A count over an all-absent
+index is an absent point, not 0. Second, a unit without aggregation still
+passes through `maxForEach`. That is the identity for the common
+one-fingerprint group. It is a deterministic NULL-skipping merge when a
+regex `__name__` selector collapses distinct metrics onto one projected
+label set. One caveat is inherent: the summation order over series differs
+from the engine's. Spatial aggregates can differ in the last ULP. Float
+addition is not associative. No ordering reproduces the engine's result
+bit-exactly from inside a GROUP BY.
+
+## Instant selectors: staleness needs two aggregates
+
+`unitInstant` uses window = lookback. It must reproduce the shadowing rule:
+the point is absent when the latest in-window sample is a stale marker.
+`timeSeriesLastToGrid` alone cannot express that. To skip stale rows in
+WHERE would resurrect the older real sample that the marker buried. So stale
+rows stay in the scan for this kind only. The grid expression compares three
+aggregates per slot:
+
+	arrayMap((tall, tok, vok) -> if(tall IS NULL OR tok IS NULL OR tall != tok, NULL, vok),
+	         timeSeriesLastToGrid(...)(ts, toFloat64(unix_milli)),                           -- last sample overall
+	         timeSeriesLastToGridIf(...)(ts, toFloat64(unix_milli), bitAnd(flags, 1) = 0),   -- last non-stale, its timestamp
+	         timeSeriesLastToGridIf(...)(ts, value, bitAnd(flags, 1) = 0))                   -- last non-stale, its value
+
+This is correct by cases on a slot's window. No samples at all: both
+timestamp aggregates are NULL, so the slot is NULL. That is absent, as the
+engine says. Latest sample non-stale: it is the latest overall and the
+latest non-stale. The timestamps agree. The slot takes its value. That is
+the engine's pick. Latest sample stale: the last-overall timestamp is the
+marker's. The last-non-stale timestamp is older, or NULL when the window
+holds only markers. They disagree. The slot is NULL. The marker shadows,
+exactly as the engine's rule says. Timestamps are unique per series (ingest
+dedups). So timestamp equality identifies "the same sample" without
+ambiguity. We probed the `-If` combinator against these experimental
+aggregates before we trusted it.
+
+## Windowed *_over_time: whole buckets instead of a grid function
+
+avg/min/max/sum/count `_over_time` aggregate every raw sample in the window.
+No `timeSeries*ToGrid` function computes them. (`last_over_time` is the
+exception. The last sample of a range vector is exactly
+`timeSeriesLastToGrid`. PromQL excludes stale markers from range vectors; we
+exclude them in WHERE.) These shapes transpile only when the range is a
+whole multiple of the step. Then the window needs no per-sample fan-out.
+With `W = range/step`, the window `(t_k - range, t_k]` is exactly the union
+of W step buckets. Both are left-open on the same boundaries. So bucket
+membership fully determines window membership. Each sample lands in exactly
+one bucket:
+
+	intDiv(unix_milli - <start> + <range> - 1, <step>)
+
+This is `ceil((ts - start)/step)` shifted by W-1, so the earliest in-window
+sample sits at 0. Slot k's window is buckets in `[k, k+W-1]`. The
+alternative fans each sample into all W windows that cover it. That
+multiplies rows by W. For a long range over a short step, that is a row
+explosion measured in billions. The bucketed form's row count is
+series × buckets: the size of the output, for any W.
+
+Each series aggregates in one group. The `-Resample` combinator
+(`sumResample`, `countResample`) holds the dense per-bucket partials inside
+one group state: a bucket count, plus the function's value aggregate (sum
+for sum/avg, min, max). An earlier form grouped by (series, bucket) and
+assembled with `groupArrayInsertAt`. At scale that made 37M hash groups, and
+per-thread partials scaled memory with the thread count. The slide then
+combines each slot's at-most-W bucket partials by direct aggregation
+(`arraySum(arraySlice(...))`). Window sums are added the way the engine adds
+them. There is no prefix-sum differencing: its large-minus-large
+cancellation would drift past the shadow tolerance on counter-sized values.
+This is correct per slot because the bucket union is the exact window
+multiset, and avg/min/max/sum/count are order-insensitive on a multiset
+(sum/avg up to summation order; see the float caveat above). A slot with
+zero window count is absent. min/max filter their slices on the bucket
+counts. An empty bucket's default can never look like a value: a real sample
+can legitimately be +Inf.
+
+Two shapes fall back to the engine path, which is exact: a range that does
+not divide the step, and a window wider than `maxWindowBuckets` buckets (the
+slide costs W combines per slot). A range narrower than the step needs
+neither gate: the windows are pairwise disjoint, one bucket per slot, no
+slide. That form is exact only together with the window-sliver predicate
+below.
+
+## Scalar ops, full plans, hybrid plans
+
+The scalar-op pipeline runs in Go on the returned arrays
+(`applyScalarOps`), slot by slot. Arithmetic operators compute. Comparisons
+filter: the slot keeps the vector-side value or becomes NULL. Under `bool`
+they return 0/1. This is trivially correct. It is the same float64 operation
+the engine applies, to the same slot value, in the same operator order the
+AST dictates. Go instead of another SQL layer changes where, not what.
+
+A full plan's arrays map straight to the result matrix. A hybrid plan
+materializes each unit's arrays as synthetic series under its
+`__signoz_transpiled_N__` name. The engine evaluates the rewritten
+expression over a storage that serves synthetic names from memory and
+everything else live. Substitution is sound because a unit's output is a
+plain instant vector to the engine: same values at same timestamps, under a
+different name. The name cannot matter. Plans that group by or match on
+`__name__` were refused at classification. Name-keeping units are never
+substituted. One subtlety makes it exact: we write stale markers at absent
+grid points. Without them, the engine's lookback would resurrect a point
+from up to `lookback` earlier. The marker encodes "absent here" the way the
+engine itself encodes it. Units evaluate concurrently. Each unit is one
+series lookup plus one grid statement. A step of 0 is an instant query: a
+single evaluation at `end`.
+
+A note on the window sliver: when the window is narrower than the step, the
+grid windows cover only `window/step` of the timeline. A sample in a gap
+belongs to no window. It cannot move any grid point, but the grid aggregate
+would buffer it. A WHERE predicate keeps only the in-window rows:
+`positiveModulo(selStart - unix_milli, step) < window`, with the scan capped
+at the last grid point. The lattice anchors at the selector start, because
+the end can sit off-lattice on unaligned grids. This cut a 36k-series
+one-week rate from 74s/28GiB to 16s/4.3GiB on fleet data. Over slivered
+rows, `timeSeriesLastToGrid`'s window widening is harmless, so instant
+selectors and `last_over_time` transpile at window < step too.
+
 ## Series lookup

-Matchers resolve to series once per selector (`selectSeries`) against the series
-tables, which hold one row per (fingerprint, bucket) at 1h/6h/1d/1w
-granularities. Table selection and window rounding delegate to the shared
-metrics schema package (`pkg/telemetryschema/metricstelemetryschema`); the
-window start rounds down to the bucket boundary so a window beginning mid-bucket
-still matches the bucket's row.
+Both paths resolve matchers the same way, once per selector
+(`selectSeries`). The series tables hold one row per (fingerprint, bucket)
+at 1h/6h/1d/1w granularities. The shared schema package
+(`pkg/telemetryschema/metricstelemetryschema`) picks the table whose bucket
+fits the window. It rounds the window start down to the bucket boundary, so
+a window that begins mid-bucket still matches the bucket's row. How matchers
+become SQL, and why regexes are anchored, is documented at
+`applySeriesConditions`. Empty-valued labels come off at this boundary. An
+empty value means "label absent" in Prometheus, but stored attribute JSON
+can carry them.

-How matchers become SQL is documented at `applySeriesConditions`. The rules that
-carry semantics:
+## The engine path

- `__name__` matchers (all four types) translate to the `metric_name` column.
- Every other matcher becomes a `JSONExtractString` condition on the labels
-  column. An equality matcher against `""` matches series *without* the label,
-  mirroring PromQL, because `JSONExtractString` returns `""` for missing keys.
- Regexes are anchored (`^(?:...)$`) before they reach `match()`: PromQL
-  matchers match the whole value, ClickHouse `match()` searches for a
-  substring.
- The series-lookup upper bound is inclusive (`unix_milli <= end`) because the
-  exporter floors registration rows to the bucket start: a series first
-  registered in the bucket beginning exactly at `end` would otherwise be
-  invisible while its samples are in range.
-
-Empty-valued labels come off at this boundary: an empty value means "label
-absent" in Prometheus, but stored attribute JSON can carry them.
-
---
-
-## Sample fetch
-
-Samples are fetched per selector using the engine's per-selector hints, not the
-query-wide union window — `foo / foo offset 1d` reads two narrow windows
-instead of the widest one twice.
-
-**Last-sample-per-step reduction.** Instant selectors of subquery-free queries
-fetch only the last sample per step bucket. The engine resolves an instant
-selector at each grid timestamp `t` to the latest sample in the left-open
-lookback window `(t − lookback, t]`. Buckets anchor at the selector's first
-evaluation timestamp — recovered from the hints as
-`hints.Start + lookback − 1ms`, the inverse of how the engine derives
-`hints.Start` — so bucket boundaries coincide with evaluation timestamps, and a
-non-final sample of a bucket can never be the latest sample in
-`(t − lookback, t]` for any grid `t`. Real timestamps are preserved, so the
-engine's own lookback and staleness handling stay exact.
-
-Range selectors always fetch raw — every sample feeds the range function. The
-subquery-free proof travels in the context as `prometheus.QueryTraits`, because
-subquery selectors evaluate at the subquery's step while the hints carry the
-top-level step; call sites that do not attach traits get the conservative raw
-fetch.
-
-**Row assembly** maps stale flags to the engine's `StaleNaN` and merges series
-with identical label sets (`sortAndMerge`) — the engine assumes storages never
-emit duplicates. Duplicate timestamps pass through as stored: uniqueness is
-ingest's job, and v1 feeds them to the engine as-is over the same data.
-
-**The fingerprint filter is a shard-local semi-join.** The samples query
-restricts to the matched series by re-running the series predicates as an
-`IN (SELECT fingerprint FROM <local series table> ...)` subquery, not a GLOBAL
-broadcast of the matched set. ClickHouse materializes the subquery's set per
-shard before the scan, so it still engages the fingerprint primary-key column.
-Because the subquery re-executes the predicates after the lookup ran, it can
-match series registered in between; sample rows whose fingerprint the lookup
-never saw are skipped — the lookup is the read snapshot.
-
---
+Queries that do not transpile run in the stock engine over this package's
+`storage.Querier`. This is still not the v1 path. Samples are fetched per
+selector with the engine's per-selector hints, not the query-wide union
+window. So `foo / foo offset 1d` reads two narrow windows, not the widest
+one twice. Instant selectors of subquery-free queries fetch only the last
+sample per step bucket (`lastSamplePerStep`). Buckets anchor at the
+selector's first evaluation timestamp. The code recovers it from the hints
+as `hints.Start + lookback - 1ms`, the inverse of how the engine derives
+`hints.Start`. Bucket boundaries then coincide with evaluation timestamps.
+A non-final sample of a bucket can never be the latest sample in
+`(t - lookback, t]` for any grid `t`. Real timestamps are preserved, so the
+engine's own lookback and staleness handling stay exact. Range selectors
+always fetch raw: every sample feeds the range function. The subquery-free
+proof travels in the context as `prometheus.QueryTraits`. Subquery selectors
+evaluate at the subquery's step, while the hints carry the top-level step.
+Row assembly maps stale flags to the engine's StaleNaN. It merges series
+with identical label sets (`sortAndMerge`): the engine assumes storages
+never emit duplicates.

 ## Sharding

-`samples_v4` and `time_series_v4` (and all their rollups) shard on the same key
-— `cityHash64(env, temporality, metric_name, fingerprint)` — so a series'
-samples and catalog rows live on the same shard. The semi-join above exploits
-that: each shard filters by its own series rows, which are exactly the series
-of that shard's samples.
-
-The temporality filter on every samples statement
-(`temporality IN ['Cumulative', 'Unspecified']`) is a semantic no-op — the
-matched fingerprints already come from those temporalities — that engages the
-leading samples primary-key column.
-
-Delta-temporality series stay invisible to PromQL exactly as they are in v1:
-the rollout gate is parity with v1, and a Delta stream fed to `rate()`
+`samples_v4` and `time_series_v4` (and all their rollups) shard on the same
+key: `cityHash64(env, temporality, metric_name, fingerprint)`. So a series'
+samples and catalog rows live on the same shard. The transpiled statement
+exploits that. The distributed samples table at the top-level FROM makes
+ClickHouse rewrite the whole inner query per shard. The join against the
+shard-local series table and the per-series grid aggregation run next to
+the data. The initiator only merges aggregate states and applies the
+spatial `-ForEach` step. This is the same layout as the telemetrymetrics
+statement builder. The group-key join alone restricts the transpiled scan
+to the matched series. The engine path's samples fetch restricts by the
+same predicates as a shard-local semi-join, not a GLOBAL broadcast of the
+matched set. The temporality filter on every samples statement is a
+semantic no-op: the matched fingerprints already come from those
+temporalities. It engages the leading samples primary-key column.
+Delta-temporality series stay invisible to PromQL here, exactly as in v1.
+The rollout gate is parity with v1. To make Delta visible is its own change
+with its own semantics to design. A Delta stream fed to `rate()`
 as-if-cumulative would be wrong, not just new.

---
-
 ## Observability

 Every statement carries a `log_comment` with
-`code.namespace=clickhouse-prometheus-v2` and `code.function.name` naming the
-call site, so this provider's work is attributable in `system.query_log`.
+`code.namespace=clickhouse-prometheus-v2` and `code.function.name` naming
+the call site (`selectSeries`, `selectSamples`, `transpiledUnit`,
+`LabelValues`, `LabelNames`). This provider's work is attributable in
+`system.query_log` without guessing from query text.
--- a/frontend/src/AppRoutes/index.tsx
+++ b/frontend/src/AppRoutes/index.tsx
@@ -354,6 +354,16 @@ function App(): JSX.Element {
 					tunnel: window.signozBootData.settings.sentry.tunnel,
 					environment: process.env.ENVIRONMENT,
 					release: process.env.VERSION,
+					// A tab that outlived a deploy requests hashed assets the new build no longer
+					// has. `lazyRetry` recovers by reloading once, so this class is not worth
+					// reporting. The stylesheet message is Vite's own; the module ones are the
+					// same failure worded differently by Chromium, Firefox and Safari.
+					ignoreErrors: [
+						/Unable to preload CSS for/,
+						/Failed to fetch dynamically imported module/,
+						/error loading dynamically imported module/,
+						/Importing a module script failed/,
+					],
 					integrations: [
 						// Kept for the `transaction` tag used in routing, even though
 						// tracing is disabled. Ref: https://github.com/SigNoz/platform-pod/issues/2393#issuecomment-4603658055
--- a/frontend/src/assets/Logos/amazon-bedrock.svg
+++ b/frontend/src/assets/Logos/amazon-bedrock.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="currentColor" fill-rule="evenodd" style="flex:none;line-height:1" viewBox="0 0 24 24"><title>AWS</title><path d="M6.763 11.212q.002.446.088.71c.064.176.144.368.256.576.04.063.056.127.056.183q.002.12-.152.24l-.503.335a.4.4 0 0 1-.208.072q-.12-.002-.239-.112a2.5 2.5 0 0 1-.287-.375 6 6 0 0 1-.248-.471q-.934 1.101-2.347 1.101c-.67 0-1.205-.191-1.596-.574-.39-.384-.59-.894-.59-1.533 0-.678.24-1.23.726-1.644.487-.415 1.133-.623 1.955-.623.272 0 .551.024.846.064.296.04.6.104.918.176v-.583q-.001-.908-.375-1.277c-.255-.248-.686-.367-1.3-.367-.28 0-.568.031-.863.103s-.583.16-.862.272a2 2 0 0 1-.28.104.5.5 0 0 1-.127.023q-.168.002-.168-.247v-.391c0-.128.016-.224.056-.28a.6.6 0 0 1 .224-.167 4.6 4.6 0 0 1 1.005-.36 4.8 4.8 0 0 1 1.246-.151c.95 0 1.644.216 2.091.647q.661.646.662 1.963v2.586zm-3.24 1.214c.263 0 .534-.048.822-.144a1.8 1.8 0 0 0 .758-.51 1.3 1.3 0 0 0 .272-.512c.047-.191.08-.423.08-.694v-.335a7 7 0 0 0-.735-.136 6 6 0 0 0-.75-.048c-.535 0-.926.104-1.19.32-.263.215-.39.518-.39.917 0 .375.095.655.295.846.191.2.47.296.838.296m6.41.862c-.144 0-.24-.024-.304-.08-.064-.048-.12-.16-.168-.311L7.586 6.726a1.4 1.4 0 0 1-.072-.32c0-.128.064-.2.191-.2h.783q.227-.001.31.08c.065.048.113.16.16.312l1.342 5.284 1.245-5.284q.058-.24.151-.312a.55.55 0 0 1 .32-.08h.638c.152 0 .256.025.32.08.063.048.12.16.151.312l1.261 5.348 1.381-5.348q.074-.24.16-.312a.52.52 0 0 1 .311-.08h.743c.127 0 .2.065.2.2 0 .04-.009.08-.017.128a1 1 0 0 1-.056.2l-1.923 6.17q-.072.24-.168.311a.5.5 0 0 1-.303.08h-.687c-.15 0-.255-.024-.32-.08-.063-.056-.119-.16-.15-.32L12.32 7.747l-1.23 5.14c-.04.16-.087.264-.15.32-.065.056-.177.08-.32.08zm10.256.215c-.415 0-.83-.048-1.229-.143-.399-.096-.71-.2-.918-.32-.128-.071-.215-.151-.247-.223a.6.6 0 0 1-.048-.224v-.407c0-.167.064-.247.183-.247q.072 0 .144.024c.048.016.12.048.2.08q.408.181.878.279c.32.064.63.096.95.096.502 0 .894-.088 1.165-.264a.86.86 0 0 0 .415-.758.78.78 0 0 0-.215-.559c-.144-.151-.416-.287-.807-.415l-1.157-.36c-.583-.183-1.014-.454-1.277-.813a1.9 1.9 0 0 1-.4-1.158q0-.502.216-.886c.144-.255.335-.479.575-.654.24-.184.51-.32.83-.415.32-.096.655-.136 1.006-.136.175 0 .36.008.535.032.183.024.35.056.518.088q.24.058.455.127.216.072.336.144a.7.7 0 0 1 .24.2.43.43 0 0 1 .071.263v.375q-.002.254-.184.256a.8.8 0 0 1-.303-.096 3.65 3.65 0 0 0-1.532-.311c-.455 0-.815.071-1.062.223s-.375.383-.375.71c0 .224.08.416.24.567.16.152.454.304.877.44l1.134.358c.574.184.99.44 1.237.767s.367.702.367 1.117c0 .343-.072.655-.207.926a2.2 2.2 0 0 1-.583.703c-.248.2-.543.343-.886.447-.36.111-.734.167-1.142.167"/><path fill="#f90" d="M.378 15.475c3.384 1.963 7.56 3.153 11.877 3.153 2.914 0 6.114-.607 9.06-1.852.44-.2.814.287.383.607-2.626 1.94-6.442 2.969-9.722 2.969-4.598 0-8.74-1.7-11.87-4.526-.247-.223-.024-.527.272-.351m23.531-.2c.287.36-.08 2.826-1.485 4.007-.215.184-.423.088-.327-.151l.175-.439c.343-.88.802-2.198.52-2.555-.336-.43-2.22-.207-3.074-.103-.255.032-.295-.192-.063-.36 1.5-1.053 3.967-.75 4.254-.399"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" width="1em" height="1em" fill="#9CA3AF" fill-rule="evenodd" style="flex:none;line-height:1" viewBox="0 0 24 24"><title>AWS</title><path d="M6.763 11.212q.002.446.088.71c.064.176.144.368.256.576.04.063.056.127.056.183q.002.12-.152.24l-.503.335a.4.4 0 0 1-.208.072q-.12-.002-.239-.112a2.5 2.5 0 0 1-.287-.375 6 6 0 0 1-.248-.471q-.934 1.101-2.347 1.101c-.67 0-1.205-.191-1.596-.574-.39-.384-.59-.894-.59-1.533 0-.678.24-1.23.726-1.644.487-.415 1.133-.623 1.955-.623.272 0 .551.024.846.064.296.04.6.104.918.176v-.583q-.001-.908-.375-1.277c-.255-.248-.686-.367-1.3-.367-.28 0-.568.031-.863.103s-.583.16-.862.272a2 2 0 0 1-.28.104.5.5 0 0 1-.127.023q-.168.002-.168-.247v-.391c0-.128.016-.224.056-.28a.6.6 0 0 1 .224-.167 4.6 4.6 0 0 1 1.005-.36 4.8 4.8 0 0 1 1.246-.151c.95 0 1.644.216 2.091.647q.661.646.662 1.963v2.586zm-3.24 1.214c.263 0 .534-.048.822-.144a1.8 1.8 0 0 0 .758-.51 1.3 1.3 0 0 0 .272-.512c.047-.191.08-.423.08-.694v-.335a7 7 0 0 0-.735-.136 6 6 0 0 0-.75-.048c-.535 0-.926.104-1.19.32-.263.215-.39.518-.39.917 0 .375.095.655.295.846.191.2.47.296.838.296m6.41.862c-.144 0-.24-.024-.304-.08-.064-.048-.12-.16-.168-.311L7.586 6.726a1.4 1.4 0 0 1-.072-.32c0-.128.064-.2.191-.2h.783q.227-.001.31.08c.065.048.113.16.16.312l1.342 5.284 1.245-5.284q.058-.24.151-.312a.55.55 0 0 1 .32-.08h.638c.152 0 .256.025.32.08.063.048.12.16.151.312l1.261 5.348 1.381-5.348q.074-.24.16-.312a.52.52 0 0 1 .311-.08h.743c.127 0 .2.065.2.2 0 .04-.009.08-.017.128a1 1 0 0 1-.056.2l-1.923 6.17q-.072.24-.168.311a.5.5 0 0 1-.303.08h-.687c-.15 0-.255-.024-.32-.08-.063-.056-.119-.16-.15-.32L12.32 7.747l-1.23 5.14c-.04.16-.087.264-.15.32-.065.056-.177.08-.32.08zm10.256.215c-.415 0-.83-.048-1.229-.143-.399-.096-.71-.2-.918-.32-.128-.071-.215-.151-.247-.223a.6.6 0 0 1-.048-.224v-.407c0-.167.064-.247.183-.247q.072 0 .144.024c.048.016.12.048.2.08q.408.181.878.279c.32.064.63.096.95.096.502 0 .894-.088 1.165-.264a.86.86 0 0 0 .415-.758.78.78 0 0 0-.215-.559c-.144-.151-.416-.287-.807-.415l-1.157-.36c-.583-.183-1.014-.454-1.277-.813a1.9 1.9 0 0 1-.4-1.158q0-.502.216-.886c.144-.255.335-.479.575-.654.24-.184.51-.32.83-.415.32-.096.655-.136 1.006-.136.175 0 .36.008.535.032.183.024.35.056.518.088q.24.058.455.127.216.072.336.144a.7.7 0 0 1 .24.2.43.43 0 0 1 .071.263v.375q-.002.254-.184.256a.8.8 0 0 1-.303-.096 3.65 3.65 0 0 0-1.532-.311c-.455 0-.815.071-1.062.223s-.375.383-.375.71c0 .224.08.416.24.567.16.152.454.304.877.44l1.134.358c.574.184.99.44 1.237.767s.367.702.367 1.117c0 .343-.072.655-.207.926a2.2 2.2 0 0 1-.583.703c-.248.2-.543.343-.886.447-.36.111-.734.167-1.142.167"/><path fill="#f90" d="M.378 15.475c3.384 1.963 7.56 3.153 11.877 3.153 2.914 0 6.114-.607 9.06-1.852.44-.2.814.287.383.607-2.626 1.94-6.442 2.969-9.722 2.969-4.598 0-8.74-1.7-11.87-4.526-.247-.223-.024-.527.272-.351m23.531-.2c.287.36-.08 2.826-1.485 4.007-.215.184-.423.088-.327-.151l.175-.439c.343-.88.802-2.198.52-2.555-.336-.43-2.22-.207-3.074-.103-.255.032-.295-.192-.063-.36 1.5-1.053 3.967-.75 4.254-.399"/></svg>
--- a/frontend/src/assets/Logos/apache-druid.svg
+++ b/frontend/src/assets/Logos/apache-druid.svg
@@ -1,3 +1,3 @@
 <svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-  <path fill="currentColor" d="M8.932 20.806c-.369 0-.738.007-1.109 0-.35-.007-.587-.206-.623-.5a.587.587 0 0 1 .53-.636c.79-.062 1.582-.063 2.372-.003a.548.548 0 0 1 .522.602c-.024.326-.253.526-.616.54zM1.792 8.345c-.392 0-.782.008-1.173.002-.327-.006-.577-.22-.614-.512-.037-.293.146-.544.499-.615.192-.032.388-.045.583-.039a81.515 81.515 0 0 1 1.597 0c.163 0 .325.019.483.056.288.073.445.318.411.617-.034.298-.214.477-.515.487-.424.014-.848.004-1.272.004zm7.588 8.417H4.292a2.464 2.464 0 0 1-.326-.007c-.294-.04-.48-.209-.508-.506-.029-.298.11-.501.391-.606.179-.065.365-.051.549-.051 3.347 0 6.695.005 10.042-.006 1.174-.004 2.187-.439 2.993-1.3.69-.738 1.053-1.63 1.16-2.635.085-.788-.027-1.513-.516-2.156-.544-.718-1.28-1.078-2.163-1.082-3.163-.013-6.328-.005-9.487-.01-.336 0-.673-.027-1.007-.058-.29-.027-.45-.201-.469-.492-.021-.317.141-.545.429-.6a1.55 1.55 0 0 1 .29-.015h10.177c1.71.004 3.187 1.038 3.726 2.654.383 1.147.246 2.304-.182 3.416-.824 2.135-2.762 3.448-5.055 3.454-1.652.005-3.304 0-4.956 0zm2.906-13.568c1.533 0 3.066-.008 4.598 0 2.935.018 5.629 1.892 6.653 4.626.442 1.181.538 2.403.412 3.657-.185 1.842-.735 3.552-1.776 5.084-1.608 2.365-3.873 3.68-6.679 4.118-.95.148-1.905.13-2.86.13-.397 0-.61-.181-.633-.51-.025-.351.196-.621.587-.645.434-.026.87-.004 1.305-.016 2.641-.072 4.928-.982 6.74-2.935 1.269-1.37 1.912-3.039 2.13-4.878.151-1.275.135-2.544-.37-3.752-.773-1.85-2.159-2.983-4.068-3.509-.74-.204-1.5-.243-2.26-.247-2.837-.017-5.675-.007-8.511-.007-.12 0-.24.004-.359-.006a.57.57 0 0 1-.517-.536.557.557 0 0 1 .456-.557c.13-.018.261-.024.392-.019h4.762Z"/>
+  <path fill="#29F1FB" d="M8.932 20.806c-.369 0-.738.007-1.109 0-.35-.007-.587-.206-.623-.5a.587.587 0 0 1 .53-.636c.79-.062 1.582-.063 2.372-.003a.548.548 0 0 1 .522.602c-.024.326-.253.526-.616.54zM1.792 8.345c-.392 0-.782.008-1.173.002-.327-.006-.577-.22-.614-.512-.037-.293.146-.544.499-.615.192-.032.388-.045.583-.039a81.515 81.515 0 0 1 1.597 0c.163 0 .325.019.483.056.288.073.445.318.411.617-.034.298-.214.477-.515.487-.424.014-.848.004-1.272.004zm7.588 8.417H4.292a2.464 2.464 0 0 1-.326-.007c-.294-.04-.48-.209-.508-.506-.029-.298.11-.501.391-.606.179-.065.365-.051.549-.051 3.347 0 6.695.005 10.042-.006 1.174-.004 2.187-.439 2.993-1.3.69-.738 1.053-1.63 1.16-2.635.085-.788-.027-1.513-.516-2.156-.544-.718-1.28-1.078-2.163-1.082-3.163-.013-6.328-.005-9.487-.01-.336 0-.673-.027-1.007-.058-.29-.027-.45-.201-.469-.492-.021-.317.141-.545.429-.6a1.55 1.55 0 0 1 .29-.015h10.177c1.71.004 3.187 1.038 3.726 2.654.383 1.147.246 2.304-.182 3.416-.824 2.135-2.762 3.448-5.055 3.454-1.652.005-3.304 0-4.956 0zm2.906-13.568c1.533 0 3.066-.008 4.598 0 2.935.018 5.629 1.892 6.653 4.626.442 1.181.538 2.403.412 3.657-.185 1.842-.735 3.552-1.776 5.084-1.608 2.365-3.873 3.68-6.679 4.118-.95.148-1.905.13-2.86.13-.397 0-.61-.181-.633-.51-.025-.351.196-.621.587-.645.434-.026.87-.004 1.305-.016 2.641-.072 4.928-.982 6.74-2.935 1.269-1.37 1.912-3.039 2.13-4.878.151-1.275.135-2.544-.37-3.752-.773-1.85-2.159-2.983-4.068-3.509-.74-.204-1.5-.243-2.26-.247-2.837-.017-5.675-.007-8.511-.007-.12 0-.24.004-.359-.006a.57.57 0 0 1-.517-.536.557.557 0 0 1 .456-.557c.13-.018.261-.024.392-.019h4.762Z"/>
 </svg>
--- a/frontend/src/assets/Logos/apache.svg
+++ b/frontend/src/assets/Logos/apache.svg
@@ -0,0 +1,3 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <path fill="#D22128" d="M17.805 2.197v.066h.156v.44h.072v-.44h.156v-.066zm.9 0l-.175.353-.172-.353h-.087v.506h.067V2.3l.172.35h.045l.172-.35v.404h.066v-.506zm-4.257 1c-.204.31-.424.66-.66 1.06l-.04.062a44.457 44.457 0 00-1.265 2.29c-.187.36-.38.742-.577 1.146l2.267-.25c.66-.302.955-.578 1.242-.976a15.5 15.5 0 00.23-.342c.23-.363.46-.763.663-1.16.197-.386.37-.767.505-1.11.083-.22.15-.422.198-.6.042-.158.074-.307.1-.45-.884.15-1.965.295-2.668.33zM11.894 7.78l-.077.16c-.078.16-.157.32-.236.488-.086.18-.172.364-.26.552l-.132.287a75.265 75.265 0 00-1.427 3.3c-.163.397-.327.807-.493 1.23-.15.38-.297.765-.45 1.164l-.02.06c-.15.396-.3.802-.453 1.22l-.01.027.72-.08a.213.213 0 01-.042-.006c.863-.106 2.01-.75 2.75-1.547.342-.367.652-.8.94-1.306.213-.377.413-.795.604-1.258.168-.405.328-.843.48-1.318-.196.105-.423.18-.673.235a2.184 2.184 0 01-.273.046c.806-.31 1.314-.905 1.683-1.64a2.816 2.816 0 01-.968.428c-.06.012-.116.022-.174.03l-.043.006h.002c.278-.118.514-.248.718-.403a2.571 2.571 0 00.637-.698l.063-.104.077-.154a8.107 8.107 0 00.367-.85l.03-.088a3.04 3.04 0 00.123-.463.733.733 0 01-.094.065c-.243.145-.66.277-.996.34l.663-.074-.664.073h-.017l-.1.017c.006-.003.01-.006.017-.008l-2.265.25-.013.022zM8.27 16.45c-.117.323-.236.654-.355.992l-.005.015c-.016.046-.032.094-.05.142-.08.227-.15.432-.31.9.264.12.475.435.675.793a1.44 1.44 0 00-.466-.99c1.293.06 2.41-.27 2.99-1.217.05-.084.096-.173.14-.268-.26.333-.59.474-1.2.44 0 0-.004 0-.005.002l.004-.002c.9-.404 1.354-.79 1.754-1.433.094-.153.186-.32.28-.503-.788.81-1.702 1.04-2.664.865l-.72.078a6.43 6.43 0 00-.067.183zM15.42.112c-.376.222-1 .85-1.748 1.763l.686 1.294c.48-.687.97-1.307 1.462-1.836l.058-.062c-.02.02-.04.04-.057.062-.16.176-.644.74-1.375 1.863.703-.035 1.784-.18 2.666-.33.262-1.47-.258-2.142-.258-2.142s-.66-1.07-1.436-.61zm-3.084 6.402a40.253 40.253 0 011.306-2.26l.04-.064c.224-.352.45-.693.677-1.02l-.685-1.293-.157.192c-.197.245-.403.51-.613.79a39.853 39.853 0 00-2.016 2.97l-.022.038.893 1.763c.19-.378.38-.752.575-1.118zm-3.73 8.32c.158-.406.319-.81.483-1.225.156-.394.32-.79.484-1.19a91.133 91.133 0 011.6-3.604l.205-.424c.12-.243.237-.485.36-.724a.125.125 0 01.02-.04l-.895-1.763-.044.07c-.207.34-.414.687-.617 1.042a38.056 38.056 0 00-1.092 2.04l-.094.193a24.573 24.573 0 00-1.258 3.087 18.492 18.492 0 00-.52 1.997l.896 1.77c.117-.317.24-.638.364-.963zm-1.376-.476a13.38 13.38 0 00-.234 1.692c0 .02-.004.04-.005.06-.28-.45-1.03-.888-1.026-.884.537.778.944 1.55 1.005 2.31-.29.058-.684-.027-1.14-.195.475.436.83.556.97.588-.434.03-.89.328-1.346.67.668-.27 1.21-.38 1.596-.29-.61 1.74-1.23 3.655-1.843 5.69a.538.538 0 00.364-.354c.11-.368.84-2.786 1.978-5.965l.097-.27.028-.078c.12-.332.246-.672.374-1.02l.09-.237v-.004L7.24 14.3c-.003.02-.01.04-.012.06z"/>
+</svg>
--- a/frontend/src/assets/Logos/auth0.svg
+++ b/frontend/src/assets/Logos/auth0.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill="#EB5424" d="M21.98 7.448 19.62 0H4.347L2.02 7.448c-1.352 4.312.03 9.206 3.815 12.015L12.007 24l6.157-4.552c3.755-2.81 5.182-7.688 3.815-12.015l-6.16 4.58 2.343 7.45-6.157-4.597-6.158 4.58 2.358-7.433-6.188-4.55 7.63-.045L12.008 0l2.356 7.404 7.615.044z"/></svg>
--- a/frontend/src/assets/Logos/baseten.svg
+++ b/frontend/src/assets/Logos/baseten.svg
@@ -1,3 +1,3 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="currentColor" height="34" viewBox="0 0 131 34">
-  <path fill="currentColor" d="M.36 8.6h16.7v5.6H6.04c-.2 0-.35.16-.35.35v4.9c0 .2.16.35.35.35h11.02v5.6h-5.33c-.2 0-.35.16-.35.35v4.9c0 .2.16.35.35.35h4.98c.2 0 .35-.15.35-.35V25.4h5.34c.2 0 .35-.16.35-.35v-4.9c0-.2-.16-.35-.35-.35h-5.34v-5.6h5.34c.2 0 .35-.16.35-.35v-4.9c0-.2-.16-.35-.35-.35h-5.34V3.35c0-.2-.16-.35-.35-.35H.36c-.2 0-.36.16-.36.35v4.9c0 .2.16.35.36.35ZM44.41 14.7c-.5-.5-1.1-.9-1.76-1.18a5.62 5.62 0 0 0-4.6.17c-.73.37-1.32.91-1.75 1.62h-.17V8.59H34.1v16.83h2.04v-1.81h.17c.21.36.47.67.77.94.31.25.65.48 1.01.67.37.18.77.31 1.18.39a6.2 6.2 0 0 0 3.39-.24 5.36 5.36 0 0 0 3.02-3.1c.29-.75.44-1.62.44-2.6v-.47c0-.96-.16-1.83-.47-2.58-.3-.75-.7-1.4-1.23-1.9v-.01Zm-5.87.66a3.9 3.9 0 0 1 4.34.84c.36.35.64.8.83 1.3.2.5.3 1.07.3 1.7v.47c0 .64-.1 1.23-.3 1.74a3.75 3.75 0 0 1-2.06 2.15 4.27 4.27 0 0 1-3.12-.03 3.86 3.86 0 0 1-2.09-2.2c-.2-.52-.3-1.11-.3-1.75v-.29c0-.62.1-1.2.3-1.7v-.01c.21-.53.5-.99.84-1.36.36-.37.78-.66 1.26-.86ZM97.04 8.59H95v4.86h-2.94v1.86H95v8.17c0 .56.17 1.03.53 1.4.37.35.84.54 1.4.54h4.18v-1.87h-3.5c-.2 0-.33-.05-.43-.15-.1-.1-.14-.27-.14-.49v-7.6h4.65v-1.86h-4.65V8.59ZM114.61 15a5.48 5.48 0 0 0-1.8-1.33 5.6 5.6 0 0 0-2.57-.56 6.17 6.17 0 0 0-4.26 1.7 5.6 5.6 0 0 0-1.72 4.2v.57c0 .9.15 1.75.44 2.5a5.58 5.58 0 0 0 5.5 3.67c1.55 0 2.8-.35 3.72-1.04a5.35 5.35 0 0 0 1.91-2.73l.03-.07-1.94-.52-.02.07c-.11.33-.27.64-.46.94-.17.27-.4.52-.7.74-.28.22-.63.39-1.04.51-.41.13-.9.19-1.46.19a3.8 3.8 0 0 1-2.84-1.05 4.07 4.07 0 0 1-1.1-2.7h9.68v-1.6c0-.54-.11-1.12-.34-1.75a5.04 5.04 0 0 0-1.03-1.74Zm-8.25 3.21a3.8 3.8 0 0 1 1.22-2.25 4.19 4.19 0 0 1 3.99-.7c.44.16.83.38 1.17.66.34.27.62.62.82 1.02.21.38.34.8.38 1.27h-7.58ZM129.09 14.42a4.47 4.47 0 0 0-3.37-1.3c-.93 0-1.73.2-2.4.59-.64.39-1.15.97-1.52 1.74h-.17v-2h-2.04v11.97h2.04v-6.23c0-1.26.32-2.28.95-3.02a3.31 3.31 0 0 1 2.65-1.14c.94 0 1.7.3 2.24.9.56.6.83 1.52.83 2.74v6.75h2.04v-7.13c0-1.71-.42-3.02-1.25-3.87ZM88.1 15a5.48 5.48 0 0 0-1.78-1.33 5.6 5.6 0 0 0-2.58-.56 6.17 6.17 0 0 0-4.27 1.7 5.59 5.59 0 0 0-1.71 4.2v.56c0 .92.14 1.76.44 2.51a5.6 5.6 0 0 0 5.5 3.67c1.55 0 2.8-.35 3.72-1.04a5.36 5.36 0 0 0 1.91-2.73l.03-.07-1.94-.52-.03.07c-.1.32-.26.64-.45.94-.17.27-.4.52-.7.74-.29.21-.64.39-1.05.51-.4.12-.9.19-1.45.19a3.8 3.8 0 0 1-2.85-1.05 4.07 4.07 0 0 1-1.09-2.7h9.68v-1.61c0-.53-.12-1.12-.34-1.74A5.03 5.03 0 0 0 88.1 15Zm-8.24 3.21a3.83 3.83 0 0 1 1.22-2.25 4.2 4.2 0 0 1 3.99-.7c.44.16.83.38 1.16.66.35.27.62.62.83 1.02.2.38.33.8.37 1.27h-7.57ZM73.65 19.42a6.11 6.11 0 0 0-3.23-1.02 6.63 6.63 0 0 1-2.68-.58c-.47-.3-.7-.7-.7-1.25 0-.27.08-.5.21-.7.14-.2.33-.38.56-.52a4.05 4.05 0 0 1 1.78-.42c.85 0 1.54.21 2.06.63.53.41.83 1 .91 1.73l.01.1 1.95-.47-.01-.07c-.07-.45-.22-.91-.45-1.36a3.46 3.46 0 0 0-.94-1.2 4.6 4.6 0 0 0-1.52-.84 6.05 6.05 0 0 0-2.1-.34c-.58 0-1.13.07-1.65.22-.52.14-1 .36-1.43.65-.41.3-.74.66-.99 1.1a2.9 2.9 0 0 0-.37 1.49v.14c0 1.06.38 1.87 1.14 2.42a6.2 6.2 0 0 0 3.24.97c1.18.08 2.04.26 2.56.54.5.28.75.72.75 1.36 0 .6-.25 1.06-.78 1.4-.52.32-1.22.48-2.1.48a3.68 3.68 0 0 1-2.46-.79 3.13 3.13 0 0 1-1.04-2.14v-.09l-1.93.46h-.02v.07a4.4 4.4 0 0 0 3.1 4c.7.24 1.52.36 2.46.36.7 0 1.35-.09 1.93-.27.6-.16 1.12-.4 1.53-.72A3.38 3.38 0 0 0 74.8 22v-.14c0-1.07-.39-1.9-1.14-2.44ZM60.25 23.4c-.1-.1-.14-.27-.14-.49v-9.46h-2.05v1.85h-.16a3.78 3.78 0 0 0-1.61-1.63 4.62 4.62 0 0 0-2.26-.56c-.77 0-1.5.14-2.19.41a5.27 5.27 0 0 0-3.02 3.12c-.29.75-.44 1.63-.44 2.6v.38c0 .99.15 1.87.44 2.63.3.75.7 1.4 1.2 1.93a5.48 5.48 0 0 0 4.05 1.57c.8 0 1.51-.2 2.2-.58.69-.38 1.24-.97 1.63-1.75h.16v.06c0 .56.18 1.03.53 1.4.37.35.85.54 1.41.54h1.36v-1.87h-.68c-.2 0-.34-.05-.43-.15Zm-4.46.13c-.46.2-.97.3-1.52.3a3.68 3.68 0 0 1-2.75-1.09 4.42 4.42 0 0 1-1.05-3.12v-.38c0-.62.1-1.2.29-1.71a3.65 3.65 0 0 1 5-2.17c.47.2.88.49 1.21.86.35.37.62.83.8 1.36.2.5.3 1.08.3 1.7v.3c0 .63-.1 1.23-.3 1.76-.18.5-.45.96-.78 1.33-.33.37-.73.66-1.2.86Z"/>
+<svg xmlns="http://www.w3.org/2000/svg" fill="#9CA3AF" height="34" viewBox="0 0 131 34">
+  <path fill="#9CA3AF" d="M.36 8.6h16.7v5.6H6.04c-.2 0-.35.16-.35.35v4.9c0 .2.16.35.35.35h11.02v5.6h-5.33c-.2 0-.35.16-.35.35v4.9c0 .2.16.35.35.35h4.98c.2 0 .35-.15.35-.35V25.4h5.34c.2 0 .35-.16.35-.35v-4.9c0-.2-.16-.35-.35-.35h-5.34v-5.6h5.34c.2 0 .35-.16.35-.35v-4.9c0-.2-.16-.35-.35-.35h-5.34V3.35c0-.2-.16-.35-.35-.35H.36c-.2 0-.36.16-.36.35v4.9c0 .2.16.35.36.35ZM44.41 14.7c-.5-.5-1.1-.9-1.76-1.18a5.62 5.62 0 0 0-4.6.17c-.73.37-1.32.91-1.75 1.62h-.17V8.59H34.1v16.83h2.04v-1.81h.17c.21.36.47.67.77.94.31.25.65.48 1.01.67.37.18.77.31 1.18.39a6.2 6.2 0 0 0 3.39-.24 5.36 5.36 0 0 0 3.02-3.1c.29-.75.44-1.62.44-2.6v-.47c0-.96-.16-1.83-.47-2.58-.3-.75-.7-1.4-1.23-1.9v-.01Zm-5.87.66a3.9 3.9 0 0 1 4.34.84c.36.35.64.8.83 1.3.2.5.3 1.07.3 1.7v.47c0 .64-.1 1.23-.3 1.74a3.75 3.75 0 0 1-2.06 2.15 4.27 4.27 0 0 1-3.12-.03 3.86 3.86 0 0 1-2.09-2.2c-.2-.52-.3-1.11-.3-1.75v-.29c0-.62.1-1.2.3-1.7v-.01c.21-.53.5-.99.84-1.36.36-.37.78-.66 1.26-.86ZM97.04 8.59H95v4.86h-2.94v1.86H95v8.17c0 .56.17 1.03.53 1.4.37.35.84.54 1.4.54h4.18v-1.87h-3.5c-.2 0-.33-.05-.43-.15-.1-.1-.14-.27-.14-.49v-7.6h4.65v-1.86h-4.65V8.59ZM114.61 15a5.48 5.48 0 0 0-1.8-1.33 5.6 5.6 0 0 0-2.57-.56 6.17 6.17 0 0 0-4.26 1.7 5.6 5.6 0 0 0-1.72 4.2v.57c0 .9.15 1.75.44 2.5a5.58 5.58 0 0 0 5.5 3.67c1.55 0 2.8-.35 3.72-1.04a5.35 5.35 0 0 0 1.91-2.73l.03-.07-1.94-.52-.02.07c-.11.33-.27.64-.46.94-.17.27-.4.52-.7.74-.28.22-.63.39-1.04.51-.41.13-.9.19-1.46.19a3.8 3.8 0 0 1-2.84-1.05 4.07 4.07 0 0 1-1.1-2.7h9.68v-1.6c0-.54-.11-1.12-.34-1.75a5.04 5.04 0 0 0-1.03-1.74Zm-8.25 3.21a3.8 3.8 0 0 1 1.22-2.25 4.19 4.19 0 0 1 3.99-.7c.44.16.83.38 1.17.66.34.27.62.62.82 1.02.21.38.34.8.38 1.27h-7.58ZM129.09 14.42a4.47 4.47 0 0 0-3.37-1.3c-.93 0-1.73.2-2.4.59-.64.39-1.15.97-1.52 1.74h-.17v-2h-2.04v11.97h2.04v-6.23c0-1.26.32-2.28.95-3.02a3.31 3.31 0 0 1 2.65-1.14c.94 0 1.7.3 2.24.9.56.6.83 1.52.83 2.74v6.75h2.04v-7.13c0-1.71-.42-3.02-1.25-3.87ZM88.1 15a5.48 5.48 0 0 0-1.78-1.33 5.6 5.6 0 0 0-2.58-.56 6.17 6.17 0 0 0-4.27 1.7 5.59 5.59 0 0 0-1.71 4.2v.56c0 .92.14 1.76.44 2.51a5.6 5.6 0 0 0 5.5 3.67c1.55 0 2.8-.35 3.72-1.04a5.36 5.36 0 0 0 1.91-2.73l.03-.07-1.94-.52-.03.07c-.1.32-.26.64-.45.94-.17.27-.4.52-.7.74-.29.21-.64.39-1.05.51-.4.12-.9.19-1.45.19a3.8 3.8 0 0 1-2.85-1.05 4.07 4.07 0 0 1-1.09-2.7h9.68v-1.61c0-.53-.12-1.12-.34-1.74A5.03 5.03 0 0 0 88.1 15Zm-8.24 3.21a3.83 3.83 0 0 1 1.22-2.25 4.2 4.2 0 0 1 3.99-.7c.44.16.83.38 1.16.66.35.27.62.62.83 1.02.2.38.33.8.37 1.27h-7.57ZM73.65 19.42a6.11 6.11 0 0 0-3.23-1.02 6.63 6.63 0 0 1-2.68-.58c-.47-.3-.7-.7-.7-1.25 0-.27.08-.5.21-.7.14-.2.33-.38.56-.52a4.05 4.05 0 0 1 1.78-.42c.85 0 1.54.21 2.06.63.53.41.83 1 .91 1.73l.01.1 1.95-.47-.01-.07c-.07-.45-.22-.91-.45-1.36a3.46 3.46 0 0 0-.94-1.2 4.6 4.6 0 0 0-1.52-.84 6.05 6.05 0 0 0-2.1-.34c-.58 0-1.13.07-1.65.22-.52.14-1 .36-1.43.65-.41.3-.74.66-.99 1.1a2.9 2.9 0 0 0-.37 1.49v.14c0 1.06.38 1.87 1.14 2.42a6.2 6.2 0 0 0 3.24.97c1.18.08 2.04.26 2.56.54.5.28.75.72.75 1.36 0 .6-.25 1.06-.78 1.4-.52.32-1.22.48-2.1.48a3.68 3.68 0 0 1-2.46-.79 3.13 3.13 0 0 1-1.04-2.14v-.09l-1.93.46h-.02v.07a4.4 4.4 0 0 0 3.1 4c.7.24 1.52.36 2.46.36.7 0 1.35-.09 1.93-.27.6-.16 1.12-.4 1.53-.72A3.38 3.38 0 0 0 74.8 22v-.14c0-1.07-.39-1.9-1.14-2.44ZM60.25 23.4c-.1-.1-.14-.27-.14-.49v-9.46h-2.05v1.85h-.16a3.78 3.78 0 0 0-1.61-1.63 4.62 4.62 0 0 0-2.26-.56c-.77 0-1.5.14-2.19.41a5.27 5.27 0 0 0-3.02 3.12c-.29.75-.44 1.63-.44 2.6v.38c0 .99.15 1.87.44 2.63.3.75.7 1.4 1.2 1.93a5.48 5.48 0 0 0 4.05 1.57c.8 0 1.51-.2 2.2-.58.69-.38 1.24-.97 1.63-1.75h.16v.06c0 .56.18 1.03.53 1.4.37.35.85.54 1.41.54h1.36v-1.87h-.68c-.2 0-.34-.05-.43-.15Zm-4.46.13c-.46.2-.97.3-1.52.3a3.68 3.68 0 0 1-2.75-1.09 4.42 4.42 0 0 1-1.05-3.12v-.38c0-.62.1-1.2.29-1.71a3.65 3.65 0 0 1 5-2.17c.47.2.88.49 1.21.86.35.37.62.83.8 1.36.2.5.3 1.08.3 1.7v.3c0 .63-.1 1.23-.3 1.76-.18.5-.45.96-.78 1.33-.33.37-.73.66-1.2.86Z"/>
 </svg>
--- a/frontend/src/assets/Logos/cohere.svg
+++ b/frontend/src/assets/Logos/cohere.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20"><path fill="#355146" fill-rule="evenodd" d="M6.82 11.908c.525 0 1.57-.03 3.013-.639 1.682-.71 5.029-2 7.443-3.323 1.689-.926 2.429-2.151 2.429-3.8 0-2.29-1.81-4.146-4.043-4.146H6.307C3.1 0 .5 2.666.5 5.954s2.434 5.954 6.32 5.954" clip-rule="evenodd"/><path fill="#d18ee2" fill-rule="evenodd" d="M8.402 16.01c0-1.611.947-3.064 2.399-3.682l2.946-1.254c2.98-1.268 6.26.977 6.26 4.286 0 2.563-2.027 4.64-4.527 4.64l-3.19-.002c-2.147 0-3.888-1.785-3.888-3.987" clip-rule="evenodd"/><path fill="#ff7759" d="M3.848 12.691C1.998 12.691.5 14.228.5 16.124v.444C.5 18.464 1.999 20 3.848 20s3.347-1.536 3.347-3.432v-.444c0-1.896-1.499-3.433-3.347-3.433"/></svg>
--- a/frontend/src/assets/Logos/dbos.svg
+++ b/frontend/src/assets/Logos/dbos.svg
@@ -1,9 +1,9 @@
 <svg width="109" height="24" viewBox="0 0 109 24" fill="none" xmlns="http://www.w3.org/2000/svg">
 <g clip-path="url(#clip0_125_22125)">
-<path d="M0 -2.08616e-07V24H17.9352C22.9911 24 26.0999 21.0858 26.0999 17.04V6.96C26.0999 2.91432 22.9911 -2.08616e-07 17.9352 -2.08616e-07H0ZM6.76413 5.82864H19.1992V18.1714H6.76413V5.82864Z" fill="currentColor"/>
-<path d="M46.7659 18.6172H35.0824V14.16H46.7659V18.6172ZM46.595 5.38296V9.5658H35.0824V5.38296H46.595ZM50.2846 12.1373V11.5886C52.5734 10.5258 53.7008 8.8458 53.7008 6.13728C53.7008 2.64012 50.9337 0.000116183 45.5361 0.000116183H28.3184V24H45.7752C51.1728 24 53.9399 21.8401 53.9399 18.0685C53.9399 15.0172 52.6418 13.2001 50.2846 12.1373Z" fill="currentColor"/>
-<path d="M62.397 18.1714H74.8319V5.82864H62.397V18.1714ZM63.6609 24C58.6049 24 55.4961 21.0858 55.4961 17.04V6.96012C55.4961 2.91432 58.6049 0.000116183 63.6609 0.000116183H73.568C78.6238 0.000116183 81.7326 2.91432 81.7326 6.96012V17.04C81.7326 21.0858 78.6238 24 73.568 24H63.6609Z" fill="currentColor"/>
-<path d="M101.66 15.12L90.8995 14.3658C85.5361 13.9886 83.418 11.1772 83.418 7.47432V6.96012C83.418 2.91432 86.5266 0.000116183 91.5827 0.000116183H100.157C105.214 0.000116183 108.323 2.91432 108.323 6.96012V7.98864H101.968V5.14284H90.2504V8.43432L100.601 9.18864C105.999 9.56568 108.493 12.8572 108.493 16.5257V17.04C108.493 20.7428 105.384 24 100.328 24H91.5827C86.5266 24 83.418 20.7428 83.418 17.04V16.0115H89.7722V18.8572H101.66V15.12Z" fill="currentColor"/>
+<path d="M0 -2.08616e-07V24H17.9352C22.9911 24 26.0999 21.0858 26.0999 17.04V6.96C26.0999 2.91432 22.9911 -2.08616e-07 17.9352 -2.08616e-07H0ZM6.76413 5.82864H19.1992V18.1714H6.76413V5.82864Z" fill="#9CA3AF"/>
+<path d="M46.7659 18.6172H35.0824V14.16H46.7659V18.6172ZM46.595 5.38296V9.5658H35.0824V5.38296H46.595ZM50.2846 12.1373V11.5886C52.5734 10.5258 53.7008 8.8458 53.7008 6.13728C53.7008 2.64012 50.9337 0.000116183 45.5361 0.000116183H28.3184V24H45.7752C51.1728 24 53.9399 21.8401 53.9399 18.0685C53.9399 15.0172 52.6418 13.2001 50.2846 12.1373Z" fill="#9CA3AF"/>
+<path d="M62.397 18.1714H74.8319V5.82864H62.397V18.1714ZM63.6609 24C58.6049 24 55.4961 21.0858 55.4961 17.04V6.96012C55.4961 2.91432 58.6049 0.000116183 63.6609 0.000116183H73.568C78.6238 0.000116183 81.7326 2.91432 81.7326 6.96012V17.04C81.7326 21.0858 78.6238 24 73.568 24H63.6609Z" fill="#9CA3AF"/>
+<path d="M101.66 15.12L90.8995 14.3658C85.5361 13.9886 83.418 11.1772 83.418 7.47432V6.96012C83.418 2.91432 86.5266 0.000116183 91.5827 0.000116183H100.157C105.214 0.000116183 108.323 2.91432 108.323 6.96012V7.98864H101.968V5.14284H90.2504V8.43432L100.601 9.18864C105.999 9.56568 108.493 12.8572 108.493 16.5257V17.04C108.493 20.7428 105.384 24 100.328 24H91.5827C86.5266 24 83.418 20.7428 83.418 17.04V16.0115H89.7722V18.8572H101.66V15.12Z" fill="#9CA3AF"/>
 </g>
 <defs>
 <clipPath id="clip0_125_22125">
--- a/frontend/src/assets/Logos/dspy.svg
+++ b/frontend/src/assets/Logos/dspy.svg
@@ -0,0 +1,9 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <g fill="none" stroke="#EF4136" stroke-width="1.1" stroke-linecap="round" stroke-linejoin="round">
+    <rect x="2.2" y="2.2" width="19.6" height="19.6" rx="0.6"/>
+    <path d="M12 2.2V4.7a1.75 1.75 0 1 0 0 3.5V12"/>
+    <path d="M12 12v2.5a1.75 1.75 0 1 1 0 3.5v3.8"/>
+    <path d="M2.2 12h2.5a1.75 1.75 0 1 0 3.5 0H12"/>
+    <path d="M12 12h2.8a1.75 1.75 0 1 1 3.5 0h3.5"/>
+  </g>
+</svg>
--- a/frontend/src/assets/Logos/elasticsearch.svg
+++ b/frontend/src/assets/Logos/elasticsearch.svg
@@ -0,0 +1,3 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <path fill="#00BFB3" d="M13.394 0C8.683 0 4.609 2.716 2.644 6.667h15.641a4.77 4.77 0 0 0 3.073-1.11c.446-.375.864-.785 1.247-1.243l.001-.002A11.974 11.974 0 0 0 13.394 0zM1.804 8.889a12.009 12.009 0 0 0 0 6.222h14.7a3.111 3.111 0 1 0 0-6.222zm.84 8.444C4.61 21.283 8.684 24 13.395 24c3.701 0 7.011-1.677 9.212-4.312l-.001-.002a9.958 9.958 0 0 0-1.247-1.243 4.77 4.77 0 0 0-3.073-1.11z"/>
+</svg>
--- a/frontend/src/assets/Logos/groq.svg
+++ b/frontend/src/assets/Logos/groq.svg
@@ -1 +1 @@
-<svg fill="currentColor" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Groq</title><path d="M12.036 2c-3.853-.035-7 3-7.036 6.781-.035 3.782 3.055 6.872 6.908 6.907h2.42v-2.566h-2.292c-2.407.028-4.38-1.866-4.408-4.23-.029-2.362 1.901-4.298 4.308-4.326h.1c2.407 0 4.358 1.915 4.365 4.278v6.305c0 2.342-1.944 4.25-4.323 4.279a4.375 4.375 0 01-3.033-1.252l-1.851 1.818A7 7 0 0012.029 22h.092c3.803-.056 6.858-3.083 6.879-6.816v-6.5C18.907 4.963 15.817 2 12.036 2z"></path></svg>
+<svg fill="#F55036" fill-rule="evenodd" height="1em" style="flex:none;line-height:1" viewBox="0 0 24 24" width="1em" xmlns="http://www.w3.org/2000/svg"><title>Groq</title><path d="M12.036 2c-3.853-.035-7 3-7.036 6.781-.035 3.782 3.055 6.872 6.908 6.907h2.42v-2.566h-2.292c-2.407.028-4.38-1.866-4.408-4.23-.029-2.362 1.901-4.298 4.308-4.326h.1c2.407 0 4.358 1.915 4.365 4.278v6.305c0 2.342-1.944 4.25-4.323 4.279a4.375 4.375 0 01-3.033-1.252l-1.851 1.818A7 7 0 0012.029 22h.092c3.803-.056 6.858-3.083 6.879-6.816v-6.5C18.907 4.963 15.817 2 12.036 2z"></path></svg>
--- a/frontend/src/assets/Logos/haproxy.svg
+++ b/frontend/src/assets/Logos/haproxy.svg
@@ -0,0 +1,74 @@
+<svg role="img" viewBox="0 0 102.04 102.04" xmlns="http://www.w3.org/2000/svg">
+  <rect x="45.34" y="23.92" width=".41" height="15.95" transform="translate(-9.7 38.24) rotate(-41.55)" fill="#106DA9"/>
+  <rect x="32.04" y="45.06" width="11.92" height="11.92" transform="translate(-13.28 88.67) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="45.04" y="32.06" width="11.92" height="11.92" transform="translate(12.63 88.76) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="45.04" y="58.06" width="11.92" height="11.92" transform="translate(-13.37 114.58) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="58.04" y="45.06" width="11.92" height="11.92" transform="translate(12.54 114.67) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="57.03" y="22.05" width="7.94" height="7.94" transform="translate(34.56 86.84) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="36.03" y="22.05" width="7.94" height="7.94" transform="translate(13.7 65.84) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="22.03" y="37.05" width="7.94" height="7.94" transform="translate(-15.2 66.73) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="22.03" y="58.05" width="7.94" height="7.94" transform="translate(-36.2 87.59) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="72.03" y="58.05" width="7.94" height="7.94" transform="translate(13.45 137.58) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="72.03" y="37.05" width="7.94" height="7.94" transform="translate(34.45 116.73) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="15.02" y="26.04" width="5.96" height="5.96" transform="translate(-11.15 46.82) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="25.02" y="14.04" width="5.96" height="5.96" transform="translate(10.79 44.9) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="40.02" y="9.04" width="5.96" height="5.96" transform="translate(30.68 54.94) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="11.02" y="41.04" width="5.96" height="5.96" transform="translate(-30.12 57.71) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="81.98" y="26" width="5.04" height="5.04" transform="translate(-.2 .59) rotate(-.4)" fill="#106DA9"/>
+  <rect x="70.98" y="15" width="5.04" height="5.04" transform="translate(-.12 .51) rotate(-.4)" fill="#106DA9"/>
+  <rect x="55.98" y="9" width="5.04" height="5.04" transform="translate(-.08 .41) rotate(-.4)" fill="#106DA9"/>
+  <rect x="84.98" y="41" width="5.04" height="5.03" transform="translate(-.3 .6) rotate(-.4)" fill="#106DA9"/>
+  <rect x="36.03" y="72.05" width="7.94" height="7.94" transform="translate(-36.3 115.49) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="57.03" y="72.05" width="7.94" height="7.94" transform="translate(-15.44 136.49) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="81.02" y="70.04" width="5.96" height="5.96" transform="translate(10.39 156.51) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="70.02" y="82.04" width="5.96" height="5.96" transform="translate(-12.52 157.43) rotate(-89.6)" fill="#106DA9"/>
+  <rect x="56.02" y="87.04" width="5.96" height="5.96" transform="translate(-31.44 148.37) rotate(-89.59)" fill="#106DA9"/>
+  <rect x="84.02" y="55.04" width="5.96" height="5.96" transform="translate(28.35 144.6) rotate(-89.59)" fill="#106DA9"/>
+  <rect x="14.98" y="71" width="5.04" height="5.04" transform="translate(-.51 .12) rotate(-.4)" fill="#106DA9"/>
+  <rect x="25.98" y="82" width="5.03" height="5.04" transform="translate(-.61 .21) rotate(-.41)" fill="#106DA9"/>
+  <rect x="40.98" y="87" width="5.04" height="5.04" transform="translate(-.62 .3) rotate(-.4)" fill="#106DA9"/>
+  <rect x="11.98" y="55" width="5.04" height="5.04" transform="translate(-.4 .1) rotate(-.4)" fill="#106DA9"/>
+  <rect x="18.01" y="12.03" width="2.98" height="2.98" transform="translate(5.85 32.93) rotate(-89.61)" fill="#106DA9"/>
+  <rect x=".01" y="45.03" width="2.98" height="2.98" transform="translate(-45.03 47.71) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="2.01" y="35.03" width="2.98" height="2.98" transform="translate(-33.04 39.77) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="35.01" y="2.03" width="2.98" height="2.98" transform="translate(32.73 40) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="6.01" y="26.03" width="2.98" height="2.98" transform="translate(-20.07 34.83) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="11.01" y="18.03" width="2.98" height="2.98" transform="translate(-7.11 31.89) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="25.99" y="6.01" width="3.02" height="3.02" transform="translate(-.05 .19) rotate(-.39)" fill="#106DA9"/>
+  <rect x="44.01" y=".03" width="2.98" height="2.98" transform="translate(0 .31) rotate(-.39)" fill="#106DA9"/>
+  <rect x="93.01" y="26.03" width="2.98" height="2.98" transform="translate(66.34 121.83) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="97.01" y="35.03" width="2.98" height="2.98" transform="translate(61.31 134.77) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="88.01" y="18.03" width="2.98" height="2.98" transform="translate(69.37 108.89) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="98.01" y="45.03" width="2.98" height="2.98" transform="translate(52.3 145.7) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="53.99" y=".01" width="3.02" height="3.02" transform="translate(53.6 57.01) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="64.01" y="2.03" width="2.98" height="2.98" transform="translate(61.53 69) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="18.01" y="12.03" width="2.98" height="2.98" transform="translate(5.85 32.93) rotate(-89.61)" fill="#106DA9"/>
+  <rect x=".01" y="45.03" width="2.98" height="2.98" transform="translate(-45.03 47.71) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="81.01" y="12.03" width="2.98" height="2.98" transform="translate(68.42 95.93) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="2.01" y="35.03" width="2.98" height="2.98" transform="translate(-33.04 39.77) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="35.01" y="2.03" width="2.98" height="2.98" transform="translate(32.73 40) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="6.01" y="26.03" width="2.98" height="2.98" transform="translate(-20.07 34.83) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="11.01" y="18.03" width="2.98" height="2.98" transform="translate(-7.11 31.89) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="25.99" y="6.01" width="3.02" height="3.02" transform="translate(-.05 .19) rotate(-.39)" fill="#106DA9"/>
+  <rect x="44.01" y=".03" width="2.98" height="2.98" transform="translate(0 .31) rotate(-.39)" fill="#106DA9"/>
+  <rect x="73.01" y="6.03" width="2.98" height="2.98" transform="translate(66.47 81.97) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="98.01" y="45.03" width="2.98" height="2.98" transform="translate(52.3 145.7) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="53.99" y=".01" width="3.02" height="3.02" transform="translate(53.6 57.01) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="64.01" y="2.03" width="2.98" height="2.98" transform="translate(61.53 69) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="81.01" y="88.03" width="2.98" height="2.98" transform="translate(-7.58 171.41) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="98.01" y="54.03" width="2.98" height="2.98" transform="translate(43.31 154.64) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="18.01" y="88.03" width="2.98" height="2.98" transform="translate(-70.15 108.42) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="97.01" y="64.03" width="2.98" height="2.98" transform="translate(32.32 163.58) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="64.01" y="97.04" width="2.97" height="2.97" transform="translate(-33.67 163.03) rotate(-89.43)" fill="#106DA9"/>
+  <rect x="93.01" y="73.03" width="2.98" height="2.98" transform="translate(19.31 168.49) rotate(-89.59)" fill="#106DA9"/>
+  <rect x="88.01" y="81.03" width="2.98" height="2.98" transform="translate(6.37 171.45) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="72.99" y="93.01" width="3.02" height="3.02" transform="translate(-.65 .51) rotate(-.39)" fill="#106DA9"/>
+  <rect x="53.99" y="99.01" width="3.02" height="3.02" transform="translate(-.68 .38) rotate(-.39)" fill="#106DA9"/>
+  <rect x="26.01" y="93.03" width="2.98" height="2.98" transform="translate(-67.21 121.37) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="6.01" y="73.03" width="2.98" height="2.98" transform="translate(-67.07 81.51) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="2.01" y="64.03" width="2.98" height="2.98" transform="translate(-62.04 68.57) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="11.01" y="81.03" width="2.98" height="2.98" transform="translate(-70.1 94.46) rotate(-89.61)" fill="#106DA9"/>
+  <rect x=".01" y="54.03" width="2.98" height="2.98" transform="translate(-54.03 56.65) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="45.01" y="99.03" width="2.98" height="2.98" transform="translate(-54.33 146.34) rotate(-89.61)" fill="#106DA9"/>
+  <rect x="35.01" y="97.03" width="2.98" height="2.98" transform="translate(-62.27 134.34) rotate(-89.61)" fill="#106DA9"/>
+</svg>
--- a/frontend/src/assets/Logos/hcp-vault.svg
+++ b/frontend/src/assets/Logos/hcp-vault.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill="#FFEC6E" d="m0 0 11.955 24L24 0zm13.366 4.827h1.393v1.38h-1.393zm-2.77 5.569H9.22V8.993h1.389zm0-2.087H9.22V6.906h1.389zm0-2.086H9.22V4.819h1.389zm2.087 6.263h-1.377V11.08h1.388zm0-2.09h-1.377V8.993h1.388zm0-2.087h-1.377V6.906h1.388zm0-2.086h-1.377V4.819h1.388zm.683.683h1.393v1.389h-1.393zm0 3.475V8.993h1.389v1.388Z"/></svg>
--- a/frontend/src/assets/Logos/langflow.svg
+++ b/frontend/src/assets/Logos/langflow.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill="#9CA3AF" d="M9.755 1.52h-.001c-.31 0-.608.124-.828.343L4.037 6.752a1.17 1.17 0 0 1-.827.343H1.17A1.17 1.17 0 0 0 0 8.295l.052 1.984a1.17 1.17 0 0 0 1.17 1.14h2.37c.31 0 .607-.124.827-.344l4.93-4.93c.22-.22.517-.343.827-.343h2.874a1.17 1.17 0 0 0 1.17-1.17V2.69a1.17 1.17 0 0 0-1.17-1.17zm9.78 2.503c-.31 0-.608.123-.828.343l-4.889 4.889a1.17 1.17 0 0 1-.827.342h-2.756c-.31 0-.608.124-.827.344L4.15 15.197a1.17 1.17 0 0 1-.827.343H1.32a1.17 1.17 0 0 0-1.17 1.17v1.996c0 .646.524 1.17 1.17 1.17h2.017c.302 0 .592-.116.81-.325l5.535-5.304a1.17 1.17 0 0 1 .81-.326h2.88c.31 0 .607-.123.827-.342l4.93-4.93c.22-.22.517-.344.827-.344h2.873A1.17 1.17 0 0 0 24 7.135V5.193a1.17 1.17 0 0 0-1.17-1.17h-3.294zm0 8.559c-.31 0-.608.123-.828.343l-4.889 4.889a1.17 1.17 0 0 1-.827.343h-2.04a1.17 1.17 0 0 0-1.17 1.2l.052 1.984a1.17 1.17 0 0 0 1.17 1.14h2.37c.31 0 .607-.124.827-.343l4.93-4.93c.22-.22.517-.343.827-.343h2.873a1.17 1.17 0 0 0 1.17-1.17v-1.943a1.17 1.17 0 0 0-1.17-1.17h-3.294Z"/></svg>
--- a/frontend/src/assets/Logos/open-webui.svg
+++ b/frontend/src/assets/Logos/open-webui.svg
@@ -0,0 +1,5 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <rect x="2.34" y="2.34" width="19.27" height="19.27" rx="4.69" fill="#fff"/>
+  <circle cx="10.41" cy="11.95" r="2.77" fill="none" stroke="#000" stroke-width="1.36"/>
+  <rect x="15" y="8.53" width="1.36" height="6.94" fill="#000"/>
+</svg>
--- a/frontend/src/assets/Logos/planetscale.svg
+++ b/frontend/src/assets/Logos/planetscale.svg
@@ -1 +1 @@
-<svg xmlns="http://www.w3.org/2000/svg" fill="currentColor" viewBox="0 0 24 24"><title>PlanetScale</title><path d="M0 12C0 5.373 5.373 0 12 0c4.873 0 9.067 2.904 10.947 7.077l-15.87 15.87a12 12 0 0 1-1.935-1.099L14.99 12H12l-8.485 8.485A11.96 11.96 0 0 1 0 12m12.004 12L24 12.004C23.998 18.628 18.628 23.998 12.004 24"/></svg>
+<svg xmlns="http://www.w3.org/2000/svg" fill="#9CA3AF" viewBox="0 0 24 24"><title>PlanetScale</title><path d="M0 12C0 5.373 5.373 0 12 0c4.873 0 9.067 2.904 10.947 7.077l-15.87 15.87a12 12 0 0 1-1.935-1.099L14.99 12H12l-8.485 8.485A11.96 11.96 0 0 1 0 12m12.004 12L24 12.004C23.998 18.628 18.628 23.998 12.004 24"/></svg>
--- a/frontend/src/assets/Logos/rabbitmq.svg
+++ b/frontend/src/assets/Logos/rabbitmq.svg
@@ -0,0 +1,3 @@
+<svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
+  <path fill="#FF6600" d="M23.035 9.601h-7.677a.956.956 0 01-.962-.962V.962a.956.956 0 00-.962-.956H10.56a.956.956 0 00-.962.956V8.64a.956.956 0 01-.962.962H5.762a.956.956 0 01-.961-.962V.962A.956.956 0 003.839 0H.959a.956.956 0 00-.956.962v22.076A.956.956 0 00.965 24h22.07a.956.956 0 00.962-.962V10.58a.956.956 0 00-.962-.98zm-3.86 8.152a1.437 1.437 0 01-1.437 1.443h-1.924a1.437 1.437 0 01-1.436-1.443v-1.917a1.437 1.437 0 011.436-1.443h1.924a1.437 1.437 0 011.437 1.443z"/>
+</svg>
--- a/frontend/src/assets/Logos/railway.svg
+++ b/frontend/src/assets/Logos/railway.svg
@@ -1,3 +1,3 @@
 <svg role="img" viewBox="0 0 24 24" xmlns="http://www.w3.org/2000/svg">
-  <path fill="currentColor" d="M.113 10.27A13.026 13.026 0 000 11.48h18.23c-.064-.125-.15-.237-.235-.347-3.117-4.027-4.793-3.677-7.19-3.78-.8-.034-1.34-.048-4.524-.048-1.704 0-3.555.005-5.358.01-.234.63-.459 1.24-.567 1.737h9.342v1.216H.113v.002zm18.26 2.426H.009c.02.326.05.645.094.961h16.955c.754 0 1.179-.429 1.315-.96zm-17.318 4.28s2.81 6.902 10.93 7.024c4.855 0 9.027-2.883 10.92-7.024H1.056zM11.988 0C7.5 0 3.593 2.466 1.531 6.108l4.75-.005v-.002c3.71 0 3.849.016 4.573.047l.448.016c1.563.052 3.485.22 4.996 1.364.82.621 2.007 1.99 2.712 2.965.654.902.842 1.94.396 2.934-.408.914-1.289 1.458-2.353 1.458H.391s.099.42.249.886h22.748A12.026 12.026 0 0024 12.005C24 5.377 18.621 0 11.988 0z"/>
+  <path fill="#9CA3AF" d="M.113 10.27A13.026 13.026 0 000 11.48h18.23c-.064-.125-.15-.237-.235-.347-3.117-4.027-4.793-3.677-7.19-3.78-.8-.034-1.34-.048-4.524-.048-1.704 0-3.555.005-5.358.01-.234.63-.459 1.24-.567 1.737h9.342v1.216H.113v.002zm18.26 2.426H.009c.02.326.05.645.094.961h16.955c.754 0 1.179-.429 1.315-.96zm-17.318 4.28s2.81 6.902 10.93 7.024c4.855 0 9.027-2.883 10.92-7.024H1.056zM11.988 0C7.5 0 3.593 2.466 1.531 6.108l4.75-.005v-.002c3.71 0 3.849.016 4.573.047l.448.016c1.563.052 3.485.22 4.996 1.364.82.621 2.007 1.99 2.712 2.965.654.902.842 1.94.396 2.934-.408.914-1.289 1.458-2.353 1.458H.391s.099.42.249.886h22.748A12.026 12.026 0 0024 12.005C24 5.377 18.621 0 11.988 0z"/>
 </svg>
--- a/frontend/src/assets/Logos/scala.svg
+++ b/frontend/src/assets/Logos/scala.svg
@@ -1,13 +1,13 @@
 <svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 590 270">
-<path d="M30.36,109.14v.48h0A3.73,3.73,0,0,1,30.36,109.14Z" fill="currentColor" fill-rule="evenodd"/>
+<path d="M30.36,109.14v.48h0A3.73,3.73,0,0,1,30.36,109.14Z" fill="#de3423" fill-rule="evenodd"/>
 <path d="M138.66,28.78C107.2,37.87,57.29,43,30.4,43h0V94.35a.8.8,0,0,0,.19.48c18.35,0,75-6,109.18-15.4a129,129,0,0,0,17.49-5.81c4.18-1.88,6.88-3.86,6.88-5.92V15.91C164.1,20.79,151.39,25.11,138.66,28.78Z" fill="#de3423" fill-rule="evenodd"/>
 <path d="M138.66,95.37c-18.83,5.43-44.24,9.47-67.39,11.83-15.54,1.59-30.06,2.42-40.87,2.42h0v51.31a.8.8,0,0,0,.19.48c18.35,0,75-6,109.18-15.39a130.38,130.38,0,0,0,17.49-5.81c4.18-1.89,6.88-3.86,6.88-5.92V82.5C164.1,87.37,151.39,91.69,138.66,95.37Z" fill="#de3423" fill-rule="evenodd"/>
 <path d="M138.66,162c-18.83,5.43-44.24,9.46-67.39,11.83-15.56,1.59-30.1,2.42-40.91,2.42V228c18.16,0,75.1-5.95,109.37-15.39,12.63-3.48,24.37-7.44,24.37-11.74V149.08C164.1,154,151.39,158.28,138.66,162Z" fill="#de3423" fill-rule="evenodd"/>
-<path d="M30.55,94.83C32.4,97.38,48,102.19,71.27,107.2c23.27,4.46,47.47,22.07,66.29,16.64,12.73-3.68,26.54-36.47,26.54-41.34V82c0-3.4-2.55-6.13-6.88-8.4-17.75-9.07-21.11-12.41-27.69-10.6C95.37,72.43,35.06,67.61,30.55,94.83Z" fill="currentColor" fill-rule="evenodd"/>
-<path d="M30.55,161.41C32.4,164,48,168.77,71.27,173.79c26,4.74,48.61,20.19,67.44,14.75,12.73-3.68,25.39-34.58,25.39-39.46v-.48c0-3.39-2.55-6.13-6.88-8.39-13.54-7.2-31.43-15.13-38-13.32C85,136.3,39.26,138.37,30.55,161.41Z" fill="currentColor" fill-rule="evenodd"/>
-<path d="M200.7,142.39c6,11.79,15.6,17.6,29.05,17.6,14.44,0,19.59-7.64,19.59-15.11,0-5.15-1.83-8.63-6.64-11.79-4.82-3.32-8.3-4.81-16.93-8-10.63-4-16.77-7-23.41-12.29-6.64-5.48-9.79-13-9.79-22.74a28.28,28.28,0,0,1,10.29-22.58c7-5.81,15.44-8.63,25.56-8.63,15.77,0,27.72,6.31,35.69,18.76L249.34,87.78c-4.48-6.81-11.29-10.3-20.59-10.3-9.13,0-15.77,5.15-15.77,12.29,0,4.81,2,7.14,4.82,10,1.82,1.33,6.47,3.32,8.63,4.48l6,2.32,6.8,2.66c11,4.48,18.76,9.3,23.57,14.44s7.31,12.12,7.31,20.75c0,20.42-14.11,34.2-40.51,34.2-21.41,0-37.18-10-44.48-26.4Z" fill="currentColor"/>
-<path d="M354.25,104.71,342,117.49a28.14,28.14,0,0,0-21.24-9.13,25,25,0,0,0-18.43,7.47,27.76,27.76,0,0,0,0,37.52,25,25,0,0,0,18.43,7.47A28.14,28.14,0,0,0,342,151.69l12.29,12.78c-9,9.63-20.09,14.44-33.53,14.44-12.79,0-23.58-4.15-32.37-12.62s-13.12-19.09-13.12-31.7,4.32-23.08,13.12-31.54,19.58-12.78,32.37-12.78C334.16,90.27,345.28,95.08,354.25,104.71Z" fill="currentColor"/>
-<path d="M393.88,125.62C408,124.3,413,122.47,413,116c0-5.15-4.64-9.13-13.94-9.13q-13.44,0-22.41,10.95l-12.28-10.46c8.13-11.45,19.58-17.09,34.36-17.09,20.75,0,33.7,10,33.7,27.05v37c0,5.81,2.15,6.48,7,6.48h.5v15.43c-2,1.17-5.15,1.83-9.3,1.83-4.48,0-8-1.33-10.62-4a14.06,14.06,0,0,1-3-5.48c-5.81,6.8-15.27,10.29-28.39,10.29-18.42,0-30.87-10.13-30.87-25.4C357.7,136.41,369.15,127.78,393.88,125.62ZM391.56,162c13.28,0,21.41-6,21.41-16.6v-9.3a9.75,9.75,0,0,1-4.14,2.49c-3.82,1.33-6.31,1.66-14.28,2.49-11.62,1.33-17.43,5-17.43,10.79C377.12,158.33,382.43,162,391.56,162Z" fill="currentColor"/>
-<path d="M444.84,60.88h19.92V149.2c0,8.13,2.66,11.62,10,11.62a21.15,21.15,0,0,0,6-.67v17.76a35.56,35.56,0,0,1-9.47,1c-17.59,0-26.39-9-26.39-27.06Z" fill="currentColor"/>
-<path d="M521.71,125.62c14.11-1.32,19.09-3.15,19.09-9.62,0-5.15-4.64-9.13-13.94-9.13q-13.44,0-22.41,10.95l-12.28-10.46c8.13-11.45,19.58-17.09,34.36-17.09,20.75,0,33.7,10,33.7,27.05v37c0,5.81,2.15,6.48,7,6.48h.5v15.43c-2,1.17-5.15,1.83-9.3,1.83-4.48,0-8-1.33-10.62-4a13.94,13.94,0,0,1-3-5.48c-5.81,6.8-15.27,10.29-28.39,10.29-18.42,0-30.87-10.13-30.87-25.4C485.53,136.41,497,127.78,521.71,125.62ZM519.39,162c13.28,0,21.41-6,21.41-16.6v-9.3a9.73,9.73,0,0,1-4.15,2.49c-3.81,1.33-6.3,1.66-14.27,2.49-11.62,1.33-17.43,5-17.43,10.79C505,158.33,510.26,162,519.39,162Z" fill="currentColor"/>
+<path d="M30.55,94.83C32.4,97.38,48,102.19,71.27,107.2c23.27,4.46,47.47,22.07,66.29,16.64,12.73-3.68,26.54-36.47,26.54-41.34V82c0-3.4-2.55-6.13-6.88-8.4-17.75-9.07-21.11-12.41-27.69-10.6C95.37,72.43,35.06,67.61,30.55,94.83Z" fill="#de3423" fill-rule="evenodd"/>
+<path d="M30.55,161.41C32.4,164,48,168.77,71.27,173.79c26,4.74,48.61,20.19,67.44,14.75,12.73-3.68,25.39-34.58,25.39-39.46v-.48c0-3.39-2.55-6.13-6.88-8.39-13.54-7.2-31.43-15.13-38-13.32C85,136.3,39.26,138.37,30.55,161.41Z" fill="#de3423" fill-rule="evenodd"/>
+<path d="M200.7,142.39c6,11.79,15.6,17.6,29.05,17.6,14.44,0,19.59-7.64,19.59-15.11,0-5.15-1.83-8.63-6.64-11.79-4.82-3.32-8.3-4.81-16.93-8-10.63-4-16.77-7-23.41-12.29-6.64-5.48-9.79-13-9.79-22.74a28.28,28.28,0,0,1,10.29-22.58c7-5.81,15.44-8.63,25.56-8.63,15.77,0,27.72,6.31,35.69,18.76L249.34,87.78c-4.48-6.81-11.29-10.3-20.59-10.3-9.13,0-15.77,5.15-15.77,12.29,0,4.81,2,7.14,4.82,10,1.82,1.33,6.47,3.32,8.63,4.48l6,2.32,6.8,2.66c11,4.48,18.76,9.3,23.57,14.44s7.31,12.12,7.31,20.75c0,20.42-14.11,34.2-40.51,34.2-21.41,0-37.18-10-44.48-26.4Z" fill="#de3423"/>
+<path d="M354.25,104.71,342,117.49a28.14,28.14,0,0,0-21.24-9.13,25,25,0,0,0-18.43,7.47,27.76,27.76,0,0,0,0,37.52,25,25,0,0,0,18.43,7.47A28.14,28.14,0,0,0,342,151.69l12.29,12.78c-9,9.63-20.09,14.44-33.53,14.44-12.79,0-23.58-4.15-32.37-12.62s-13.12-19.09-13.12-31.7,4.32-23.08,13.12-31.54,19.58-12.78,32.37-12.78C334.16,90.27,345.28,95.08,354.25,104.71Z" fill="#de3423"/>
+<path d="M393.88,125.62C408,124.3,413,122.47,413,116c0-5.15-4.64-9.13-13.94-9.13q-13.44,0-22.41,10.95l-12.28-10.46c8.13-11.45,19.58-17.09,34.36-17.09,20.75,0,33.7,10,33.7,27.05v37c0,5.81,2.15,6.48,7,6.48h.5v15.43c-2,1.17-5.15,1.83-9.3,1.83-4.48,0-8-1.33-10.62-4a14.06,14.06,0,0,1-3-5.48c-5.81,6.8-15.27,10.29-28.39,10.29-18.42,0-30.87-10.13-30.87-25.4C357.7,136.41,369.15,127.78,393.88,125.62ZM391.56,162c13.28,0,21.41-6,21.41-16.6v-9.3a9.75,9.75,0,0,1-4.14,2.49c-3.82,1.33-6.31,1.66-14.28,2.49-11.62,1.33-17.43,5-17.43,10.79C377.12,158.33,382.43,162,391.56,162Z" fill="#de3423"/>
+<path d="M444.84,60.88h19.92V149.2c0,8.13,2.66,11.62,10,11.62a21.15,21.15,0,0,0,6-.67v17.76a35.56,35.56,0,0,1-9.47,1c-17.59,0-26.39-9-26.39-27.06Z" fill="#de3423"/>
+<path d="M521.71,125.62c14.11-1.32,19.09-3.15,19.09-9.62,0-5.15-4.64-9.13-13.94-9.13q-13.44,0-22.41,10.95l-12.28-10.46c8.13-11.45,19.58-17.09,34.36-17.09,20.75,0,33.7,10,33.7,27.05v37c0,5.81,2.15,6.48,7,6.48h.5v15.43c-2,1.17-5.15,1.83-9.3,1.83-4.48,0-8-1.33-10.62-4a13.94,13.94,0,0,1-3-5.48c-5.81,6.8-15.27,10.29-28.39,10.29-18.42,0-30.87-10.13-30.87-25.4C485.53,136.41,497,127.78,521.71,125.62ZM519.39,162c13.28,0,21.41-6,21.41-16.6v-9.3a9.73,9.73,0,0,1-4.15,2.49c-3.81,1.33-6.3,1.66-14.27,2.49-11.62,1.33-17.43,5-17.43,10.79C505,158.33,510.26,162,519.39,162Z" fill="#de3423"/>
 </svg>
--- a/frontend/src/container/DashboardContainer/visualization/charts/ChartWrapper/ChartWrapper.tsx
+++ b/frontend/src/container/DashboardContainer/visualization/charts/ChartWrapper/ChartWrapper.tsx
@@ -37,6 +37,7 @@ export default function ChartWrapper({
 	groupByPerQuery,
 	customTooltip,
 	pinnedTooltipElement,
+	tooltipPortalRoot,
 	'data-testid': testId,
 }: ChartProps): JSX.Element {
 	const plotInstanceRef = useRef<uPlot | null>(null);
@@ -118,6 +119,7 @@ export default function ChartWrapper({
 								syncMetadata={syncMetadata}
 								render={renderTooltipCallback}
 								pinnedTooltipElement={pinnedTooltipElement}
+								portalRoot={tooltipPortalRoot}
 							/>
 						)}
 					</UPlotChart>
--- a/frontend/src/container/DashboardContainer/visualization/charts/types.ts
+++ b/frontend/src/container/DashboardContainer/visualization/charts/types.ts
@@ -30,6 +30,7 @@ interface BaseChartProps {
 	pinnedTooltipElement?: (clickData: ChartClickData) => React.ReactNode;
 	renderTooltipFooter?: (args: IRenderTooltipFooterArgs) => React.ReactNode;
 	customTooltip?: (props: TooltipRenderArgs) => React.ReactNode;
+	tooltipPortalRoot?: HTMLElement | null;
 	'data-testid'?: string;
 }
 interface UPlotBasedChartProps {
--- a/frontend/src/container/InfraMonitoringHostsV2/Hosts.tsx
+++ b/frontend/src/container/InfraMonitoringHostsV2/Hosts.tsx
@@ -140,6 +140,7 @@ function Hosts(): JSX.Element {
 					records: data.records,
 					total: data.total,
 					endTimeBeforeRetention: data.endTimeBeforeRetention,
+					warning: data.warning,
 				};
 			} catch (error) {
 				return {
--- a/frontend/src/container/InfraMonitoringK8sV2/Base/K8sBaseDetails.tsx
+++ b/frontend/src/container/InfraMonitoringK8sV2/Base/K8sBaseDetails.tsx
@@ -40,6 +40,9 @@ export type {

 // TODO(H4ad): Improve this on component level
 const DRAWER_TRANSITION = { duration: 0.3, ease: [0.25, 0.1, 0.25, 1] };
+// Be careful when changing these props, this must be animated with transform but later
+// replaced with none, otherwise, the tooltip of the chart will be not positioned correctly
+// due to how the tooltip positioning calculation works
 const DRAWER_MOTION_PROPS = {
 	onOpenAutoFocus: (e: Event): void => e.preventDefault(),
 	initial: { opacity: 0, transform: 'translateX(100%)' },
@@ -47,6 +50,7 @@ const DRAWER_MOTION_PROPS = {
 		opacity: 1,
 		transform: 'translateX(0%)',
 		transition: DRAWER_TRANSITION,
+		transitionEnd: { transform: 'none' },
 	},
 	exit: {
 		opacity: 0,
--- a/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/ChartTooltipFooter.module.scss
+++ b/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/ChartTooltipFooter.module.scss
@@ -0,0 +1,38 @@
+.footer {
+	display: flex;
+	align-items: center;
+	justify-content: space-between;
+	gap: var(--spacing-5);
+	padding: var(--spacing-4) var(--spacing-6);
+	border-top: 1px dashed var(--l2-border);
+	background: var(--l1-background);
+	border-radius: 0 0 6px 6px;
+}
+
+.hintList {
+	display: flex;
+	flex-direction: column;
+	gap: var(--spacing-4);
+	padding: var(--spacing-2) var(--spacing-8);
+	margin: 0;
+}
+
+.hint {
+	--typography-text-display: flex;
+	align-items: center;
+	gap: var(--spacing-3);
+	position: relative;
+
+	&[data-active='false']::before {
+		content: '';
+		position: absolute;
+		top: 50%;
+		left: -12px;
+		transform: translateY(-50%);
+		width: 4px;
+		height: 4px;
+		border-radius: 50%;
+		background: var(--l2-foreground);
+		opacity: 0.5;
+	}
+}
--- a/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/ChartTooltipFooter.tsx
+++ b/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/ChartTooltipFooter.tsx
@@ -0,0 +1,82 @@
+import { MousePointerClick, X } from '@signozhq/icons';
+import { Button } from '@signozhq/ui/button';
+import { Kbd } from '@signozhq/ui/kbd';
+import logEvent from 'api/common/logEvent';
+import { Events } from 'constants/events';
+import { DEFAULT_PIN_TOOLTIP_KEY } from 'lib/uPlotV2/plugins/TooltipPlugin/types';
+
+import styles from './ChartTooltipFooter.module.scss';
+import { Typography } from '@signozhq/ui/typography';
+
+interface ChartTooltipFooterProps {
+	id: string;
+	pinKey?: string;
+	isPinned: boolean;
+	canSelectTimeRange?: boolean;
+	dismiss: () => void;
+}
+
+export default function ChartTooltipFooter({
+	id,
+	pinKey = DEFAULT_PIN_TOOLTIP_KEY,
+	isPinned,
+	canSelectTimeRange = true,
+	dismiss,
+}: ChartTooltipFooterProps): JSX.Element {
+	const handleUnpinClick = (): void => {
+		void logEvent(Events.TOOLTIP_UNPINNED, {
+			id,
+		});
+		dismiss();
+	};
+
+	return (
+		<output className={styles.footer} data-testid="entity-chart-tooltip-footer">
+			<div>
+				{isPinned ? (
+					<Typography.Text className={styles.hint} size="small">
+						<span>Press</span>
+						<Kbd active>{pinKey.toUpperCase()}</Kbd>
+						<span>or</span>
+						<Kbd active>Esc</Kbd>
+						<span>to unpin</span>
+					</Typography.Text>
+				) : (
+					<div className={styles.hintList}>
+						{canSelectTimeRange && (
+							<Typography.Text
+								className={styles.hint}
+								size="small"
+								data-active="false"
+							>
+								<Kbd>
+									<MousePointerClick size={12} />
+								</Kbd>
+								<span>Click and drag to zoom into a time range</span>
+							</Typography.Text>
+						)}
+						<Typography.Text className={styles.hint} size="small" data-active="false">
+							<span>Press</span>
+							<Kbd>{pinKey.toUpperCase()}</Kbd>
+							<span>to pin the tooltip</span>
+						</Typography.Text>
+					</div>
+				)}
+			</div>
+
+			{isPinned && (
+				<Button
+					variant="outlined"
+					color="secondary"
+					size="sm"
+					onClick={handleUnpinClick}
+					aria-label="Unpin tooltip"
+					data-testid="entity-chart-tooltip-unpin"
+				>
+					<X size={10} />
+					<span>Unpin</span>
+				</Button>
+			)}
+		</output>
+	);
+}
--- a/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/EntityMetrics.tsx
+++ b/frontend/src/container/InfraMonitoringK8sV2/EntityDetailsUtils/EntityMetrics/EntityMetrics.tsx
@@ -1,11 +1,14 @@
-import { useCallback, useMemo, useRef } from 'react';
+import { useCallback, useMemo, useRef, useState } from 'react';
 import { UseQueryResult } from 'react-query';
 import { Skeleton } from 'antd';
 import cx from 'classnames';
 import { InfraMonitoringEvents } from 'constants/events';
 import { PANEL_TYPES } from 'constants/queryBuilder';
 import TimeSeries from 'container/DashboardContainer/visualization/charts/TimeSeries/TimeSeries';
-import { LegendPosition } from 'lib/uPlotV2/components/types';
+import {
+	IRenderTooltipFooterArgs,
+	LegendPosition,
+} from 'lib/uPlotV2/components/types';
 import {
 	InfraMonitoringEntity,
 	VIEW_TYPES,
@@ -33,6 +36,7 @@ import { isKeyNotFoundError } from '../utils';
 import styles from './EntityMetrics.module.scss';
 import { MetricsTable } from './MetricsTable';
 import { logInfraExplorerNavigatedEvent } from 'container/InfraMonitoringK8sV2/Base/events';
+import ChartTooltipFooter from './ChartTooltipFooter';

 interface EntityMetricsProps<T> {
 	entity: T;
@@ -78,6 +82,10 @@ function EntityMetrics<T>({
 		category,
 	});

+	const [tooltipPortalEl, setTooltipPortalEl] = useState<HTMLDivElement | null>(
+		null,
+	);
+
 	const isDarkMode = useIsDarkMode();
 	const { timezone } = useTimezone();
 	const graphRef = useRef<HTMLDivElement>(null);
@@ -171,6 +179,18 @@ function EntityMetrics<T>({
 							height={dimensions.height}
 							timezone={timezone}
 							yAxisUnit={entityWidgetInfo[idx].yAxisUnit}
+							canPinTooltip
+							tooltipPortalRoot={tooltipPortalEl ?? undefined}
+							renderTooltipFooter={({
+								isPinned,
+								dismiss,
+							}: IRenderTooltipFooterArgs) => (
+								<ChartTooltipFooter
+									id={configs[idx]?.getId() || idx.toString()}
+									isPinned={isPinned}
+									dismiss={dismiss}
+								/>
+							)}
 						/>
 					)
 				)}
@@ -180,6 +200,8 @@ function EntityMetrics<T>({

 	return (
 		<>
+			<div ref={setTooltipPortalEl} style={{ display: 'contents' }} />
+
 			<div className={styles.metricsHeader}>
 				<EntityDateTimeSelector
 					eventEntity={eventEntity}
--- a/frontend/src/container/OnboardingV2Container/onboarding-configs/onboarding-config-with-links.ts
+++ b/frontend/src/container/OnboardingV2Container/onboarding-configs/onboarding-config-with-links.ts
@@ -5,9 +5,11 @@ import androidJavaMonitoringUrl from '@/assets/Logos/android-java-monitoring.svg
 import androidKotlinMonitoringUrl from '@/assets/Logos/android-kotlin-monitoring.svg';
 import anthropicApiMonitoringUrl from '@/assets/Logos/anthropic-api-monitoring.svg';
 import apacheDruidUrl from '@/assets/Logos/apache-druid.svg';
+import apacheUrl from '@/assets/Logos/apache.svg';
 import apiGatewayUrl from '@/assets/Logos/api-gateway.svg';
 import argocdUrl from '@/assets/Logos/argocd.svg';
 import aspnetUrl from '@/assets/Logos/aspnet.svg';
+import auth0Url from '@/assets/Logos/auth0.svg';
 import autogenUrl from '@/assets/Logos/autogen.svg';
 import awsAlbUrl from '@/assets/Logos/aws-alb.svg';
 import azureAppServiceUrl from '@/assets/Logos/azure-app-service.svg';
@@ -27,6 +29,7 @@ import claudeCodeUrl from '@/assets/Logos/claude-code.svg';
 import clickhouseUrl from '@/assets/Logos/clickhouse.svg';
 import cloudflareUrl from '@/assets/Logos/cloudflare.svg';
 import cloudwatchLogsUrl from '@/assets/Logos/cloudwatch-logs.svg';
+import cohereUrl from '@/assets/Logos/cohere.svg';
 import confluentKafkaUrl from '@/assets/Logos/confluent-kafka.svg';
 import convexLogoUrl from '@/assets/Logos/convex-logo.svg';
 import cppUrl from '@/assets/Logos/cpp.svg';
@@ -39,11 +42,13 @@ import denoUrl from '@/assets/Logos/deno.svg';
 import dockerUrl from '@/assets/Logos/docker.svg';
 import documentLoadUrl from '@/assets/Logos/document-load.svg';
 import dotnetUrl from '@/assets/Logos/dotnet.svg';
+import dspyUrl from '@/assets/Logos/dspy.svg';
 import dynamodbUrl from '@/assets/Logos/dynamodb.svg';
 import ec2Url from '@/assets/Logos/ec2.svg';
 import ecsUrl from '@/assets/Logos/ecs.svg';
 import eksUrl from '@/assets/Logos/eks.svg';
 import elasticacheUrl from '@/assets/Logos/elasticache.svg';
+import elasticsearchUrl from '@/assets/Logos/elasticsearch.svg';
 import elbUrl from '@/assets/Logos/elb.svg';
 import elixirUrl from '@/assets/Logos/elixir.svg';
 import elkUrl from '@/assets/Logos/elk.svg';
@@ -73,8 +78,10 @@ import grafanaUrl from '@/assets/Logos/grafana.svg';
 import graphqlUrl from '@/assets/Logos/graphql.svg';
 import grokUrl from '@/assets/Logos/grok.svg';
 import groqUrl from '@/assets/Logos/groq.svg';
+import haproxyUrl from '@/assets/Logos/haproxy.svg';
 import hasuraUrl from '@/assets/Logos/hasura.svg';
 import haystackUrl from '@/assets/Logos/haystack.svg';
+import hcpVaultUrl from '@/assets/Logos/hcp-vault.svg';
 import herokuUrl from '@/assets/Logos/heroku.svg';
 import honeycombUrl from '@/assets/Logos/honeycomb.svg';
 import hostmetricsUrl from '@/assets/Logos/hostmetrics.svg';
@@ -92,6 +99,7 @@ import kafkaUrl from '@/assets/Logos/kafka.svg';
 import kubernetesUrl from '@/assets/Logos/kubernetes.svg';
 import lambdaUrl from '@/assets/Logos/lambda.svg';
 import langchainUrl from '@/assets/Logos/langchain.svg';
+import langflowUrl from '@/assets/Logos/langflow.svg';
 import langtraceUrl from '@/assets/Logos/langtrace.svg';
 import litellmUrl from '@/assets/Logos/litellm.svg';
 import livekitUrl from '@/assets/Logos/livekit.svg';
@@ -117,6 +125,7 @@ import ollamaUrl from '@/assets/Logos/ollama.svg';
 import openaiUrl from '@/assets/Logos/openai.svg';
 import openclawUrl from '@/assets/Logos/openclaw.svg';
 import opencodeUrl from '@/assets/Logos/opencode.svg';
+import openWebuiUrl from '@/assets/Logos/open-webui.svg';
 import openlitUrl from '@/assets/Logos/openlit.svg';
 import openrouterUrl from '@/assets/Logos/openrouter.svg';
 import opentelemetryUrl from '@/assets/Logos/opentelemetry.svg';
@@ -131,6 +140,7 @@ import pythonUrl from '@/assets/Logos/python.svg';
 import quarkusUrl from '@/assets/Logos/quarkus.svg';
 import quickstartUrl from '@/assets/Logos/quickstart.svg';
 import qwenUrl from '@/assets/Logos/qwen.svg';
+import rabbitmqUrl from '@/assets/Logos/rabbitmq.svg';
 import railwayUrl from '@/assets/Logos/railway.svg';
 import rdsUrl from '@/assets/Logos/rds.svg';
 import reactjsUrl from '@/assets/Logos/reactjs.svg';
@@ -3937,6 +3947,58 @@ const onboardingConfigWithLinks = [
 		],
 		link: '/docs/claude-code-monitoring/',
 	},
+	{
+		dataSource: 'cohere',
+		label: 'Cohere',
+		imgUrl: cohereUrl,
+		tags: ['LLM Monitoring'],
+		module: 'apm',
+		relatedSearchKeywords: [
+			'cohere',
+			'cohere api',
+			'cohere logs',
+			'cohere metrics',
+			'cohere monitoring',
+			'cohere observability',
+			'cohere traces',
+			'llm',
+			'llm monitoring',
+			'logging',
+			'logs',
+			'metrics',
+			'monitoring',
+			'observability',
+			'otel cohere integration',
+			'telemetry',
+		],
+		link: '/docs/cohere-monitoring/',
+	},
+	{
+		dataSource: 'langflow',
+		label: 'Langflow',
+		imgUrl: langflowUrl,
+		tags: ['LLM Monitoring'],
+		module: 'apm',
+		relatedSearchKeywords: [
+			'langflow',
+			'langflow logs',
+			'langflow metrics',
+			'langflow monitoring',
+			'langflow observability',
+			'langflow traces',
+			'llm',
+			'llm monitoring',
+			'logging',
+			'logs',
+			'low code ai',
+			'metrics',
+			'monitoring',
+			'observability',
+			'otel langflow integration',
+			'telemetry',
+		],
+		link: '/docs/langflow-observability/',
+	},
 	{
 		dataSource: 'deepseek-api',
 		label: 'DeepSeek API',
@@ -5483,12 +5545,32 @@ const onboardingConfigWithLinks = [
 		relatedSearchKeywords: [
 			'infrastructure',
 			'traefik',
+			'traefik access logs',
+			'traefik logs',
 			'traefik metrics',
 			'traefik monitoring',
 			'traefik observability',
 			'traefik tracing',
 		],
 		link: '/docs/tutorial/traefik-observability/',
+		question: {
+			desc: 'Which Traefik signals do you want to send to SigNoz?',
+			type: 'select',
+			options: [
+				{
+					key: 'traefik-metrics-traces',
+					label: 'Metrics & Traces',
+					imgUrl: opentelemetryUrl,
+					link: '/docs/tutorial/traefik-observability/',
+				},
+				{
+					key: 'traefik-logs',
+					label: 'Access Logs',
+					imgUrl: opentelemetryUrl,
+					link: '/docs/integrations/opentelemetry-traefik/',
+				},
+			],
+		},
 	},
 	{
 		dataSource: 'mongodb-atlas',
@@ -5518,11 +5600,32 @@ const onboardingConfigWithLinks = [
 		relatedSearchKeywords: [
 			'database',
 			'mysql',
+			'mysql error log',
+			'mysql logs',
 			'mysql metrics',
 			'mysql monitoring',
 			'mysql observability',
+			'mysql slow query log',
 		],
 		link: '/docs/metrics-management/mysql-metrics/',
+		question: {
+			desc: 'Which MySQL signals do you want to send to SigNoz?',
+			type: 'select',
+			options: [
+				{
+					key: 'mysql-metrics',
+					label: 'Metrics',
+					imgUrl: opentelemetryUrl,
+					link: '/docs/metrics-management/mysql-metrics/',
+				},
+				{
+					key: 'mysql-logs',
+					label: 'Logs',
+					imgUrl: opentelemetryUrl,
+					link: '/docs/integrations/opentelemetry-mysql/',
+				},
+			],
+		},
 	},
 	{
 		dataSource: 'jmx',
@@ -6467,6 +6570,30 @@ const onboardingConfigWithLinks = [
 		id: 'cert-manager',
 		link: '/docs/infrastructure-monitoring/cert-manager/',
 	},
+	{
+		dataSource: 'pgbouncer',
+		label: 'PgBouncer',
+		imgUrl: postgresqlUrl,
+		tags: ['infrastructure monitoring', 'metrics'],
+		module: 'metrics',
+		relatedSearchKeywords: [
+			'connection pooler',
+			'connection pooling',
+			'database',
+			'metrics',
+			'monitoring',
+			'observability',
+			'opentelemetry pgbouncer',
+			'pgbouncer',
+			'pgbouncer metrics',
+			'pgbouncer monitoring',
+			'pgbouncer observability',
+			'postgres',
+			'postgresql',
+		],
+		id: 'pgbouncer',
+		link: '/docs/metrics-management/opentelemetry-pgbouncer/',
+	},
 	{
 		dataSource: 'graphql',
 		label: 'GraphQL',
@@ -6491,6 +6618,28 @@ const onboardingConfigWithLinks = [
 		id: 'graphql',
 		link: '/docs/instrumentation/javascript/opentelemetry-graphql/',
 	},
+	{
+		dataSource: 'opentelemetry-ebpf',
+		label: 'OpenTelemetry eBPF (OBI)',
+		imgUrl: opentelemetryUrl,
+		tags: ['apm/traces'],
+		module: 'apm',
+		relatedSearchKeywords: [
+			'auto instrumentation',
+			'ebpf',
+			'obi',
+			'opentelemetry ebpf',
+			'opentelemetry obi',
+			'otel ebpf',
+			'zero code instrumentation',
+			'monitoring',
+			'observability',
+			'traces',
+			'tracing',
+		],
+		id: 'opentelemetry-ebpf',
+		link: '/docs/instrumentation/opentelemetry-ebpf/',
+	},
 	{
 		dataSource: 'railway',
 		label: 'Railway',
@@ -6513,6 +6662,54 @@ const onboardingConfigWithLinks = [
 		id: 'railway',
 		link: '/docs/integrations/outposts/railway/',
 	},
+	{
+		dataSource: 'hcp-vault',
+		label: 'HCP Vault',
+		imgUrl: hcpVaultUrl,
+		tags: ['logs'],
+		module: 'logs',
+		relatedSearchKeywords: [
+			'hashicorp',
+			'hashicorp vault',
+			'hcp',
+			'hcp vault',
+			'hcp vault logs',
+			'hcp vault monitoring',
+			'hcp vault observability',
+			'log forwarding',
+			'logging',
+			'logs',
+			'monitoring',
+			'observability',
+			'secrets management',
+			'vault',
+		],
+		id: 'hcp-vault',
+		link: '/docs/integrations/outposts/hcp-vault/',
+	},
+	{
+		dataSource: 'auth0',
+		label: 'Auth0',
+		imgUrl: auth0Url,
+		tags: ['logs'],
+		module: 'logs',
+		relatedSearchKeywords: [
+			'auth0',
+			'auth0 logs',
+			'auth0 monitoring',
+			'auth0 observability',
+			'authentication',
+			'authorization',
+			'identity',
+			'log forwarding',
+			'logging',
+			'logs',
+			'monitoring',
+			'observability',
+		],
+		id: 'auth0',
+		link: '/docs/integrations/outposts/auth0/',
+	},
 	{
 		dataSource: 'aspnet-core-metrics',
 		label: 'ASP.NET Core Metrics',
@@ -6632,5 +6829,164 @@ const onboardingConfigWithLinks = [
 		id: 'apache-druid',
 		link: '/docs/integrations/opentelemetry-apache-druid/',
 	},
+	{
+		dataSource: 'apache',
+		label: 'Apache HTTP Server',
+		imgUrl: apacheUrl,
+		tags: ['infrastructure monitoring', 'metrics', 'logs'],
+		module: 'metrics',
+		relatedSearchKeywords: [
+			'apache',
+			'apache access logs',
+			'apache error logs',
+			'apache http server',
+			'apache httpd',
+			'apache logs',
+			'apache metrics',
+			'apache monitoring',
+			'apache observability',
+			'httpd',
+			'infrastructure monitoring',
+			'logs',
+			'metrics',
+			'mod_status',
+			'monitoring',
+			'observability',
+			'opentelemetry apache',
+			'web server',
+		],
+		id: 'apache',
+		link: '/docs/integrations/opentelemetry-apache/',
+	},
+	{
+		dataSource: 'haproxy',
+		label: 'HAProxy',
+		imgUrl: haproxyUrl,
+		tags: ['infrastructure monitoring', 'metrics', 'logs'],
+		module: 'metrics',
+		relatedSearchKeywords: [
+			'haproxy',
+			'haproxy logs',
+			'haproxy metrics',
+			'haproxy monitoring',
+			'haproxy observability',
+			'infrastructure monitoring',
+			'load balancer',
+			'logs',
+			'metrics',
+			'monitoring',
+			'observability',
+			'opentelemetry haproxy',
+			'proxy',
+			'reverse proxy',
+			'syslog',
+		],
+		id: 'haproxy',
+		link: '/docs/integrations/opentelemetry-haproxy/',
+	},
+	{
+		dataSource: 'elasticsearch',
+		label: 'Elasticsearch',
+		imgUrl: elasticsearchUrl,
+		tags: ['database'],
+		module: 'metrics',
+		relatedSearchKeywords: [
+			'cluster health',
+			'database',
+			'elastic',
+			'elasticsearch',
+			'elasticsearch logs',
+			'elasticsearch metrics',
+			'elasticsearch monitoring',
+			'elasticsearch observability',
+			'logs',
+			'metrics',
+			'monitoring',
+			'observability',
+			'opentelemetry elasticsearch',
+			'search engine',
+		],
+		id: 'elasticsearch',
+		link: '/docs/integrations/opentelemetry-elasticsearch/',
+	},
+	{
+		dataSource: 'rabbitmq',
+		label: 'RabbitMQ',
+		imgUrl: rabbitmqUrl,
+		tags: ['Messaging Queues'],
+		module: 'metrics',
+		relatedSearchKeywords: [
+			'amqp',
+			'broker',
+			'logs',
+			'messaging',
+			'messaging queues',
+			'metrics',
+			'monitoring',
+			'observability',
+			'opentelemetry rabbitmq',
+			'queues',
+			'rabbitmq',
+			'rabbitmq logs',
+			'rabbitmq metrics',
+			'rabbitmq monitoring',
+			'rabbitmq observability',
+		],
+		id: 'rabbitmq',
+		link: '/docs/integrations/opentelemetry-rabbitmq/',
+	},
+	{
+		dataSource: 'open-webui',
+		label: 'Open WebUI',
+		imgUrl: openWebuiUrl,
+		tags: ['LLM Monitoring'],
+		module: 'apm',
+		relatedSearchKeywords: [
+			'llm',
+			'llm monitoring',
+			'logs',
+			'metrics',
+			'monitoring',
+			'observability',
+			'open webui',
+			'open webui logs',
+			'open webui metrics',
+			'open webui monitoring',
+			'open webui observability',
+			'open webui traces',
+			'openlit',
+			'openwebui',
+			'otel open webui integration',
+			'self hosted chat ui',
+			'traces',
+			'tracing',
+		],
+		id: 'open-webui',
+		link: '/docs/open-webui-monitoring/',
+	},
+	{
+		dataSource: 'dspy',
+		label: 'DSPy',
+		imgUrl: dspyUrl,
+		tags: ['LLM Monitoring'],
+		module: 'apm',
+		relatedSearchKeywords: [
+			'dspy',
+			'dspy monitoring',
+			'dspy observability',
+			'dspy traces',
+			'llm',
+			'llm monitoring',
+			'monitoring',
+			'observability',
+			'openinference',
+			'otel dspy integration',
+			'prompt optimization',
+			'traces',
+			'tracing',
+		],
+		id: 'dspy',
+		link: '/docs/dspy-observability/',
+	},
 ];
 export default onboardingConfigWithLinks;
--- a/frontend/src/lib/uPlotV2/plugins/TooltipPlugin/TooltipPlugin.tsx
+++ b/frontend/src/lib/uPlotV2/plugins/TooltipPlugin/TooltipPlugin.tsx
@@ -51,6 +51,7 @@ export default function TooltipPlugin({
 	canPinTooltip = false,
 	pinKey = DEFAULT_PIN_TOOLTIP_KEY,
 	onClick,
+	portalRoot: portalRootProp,
 }: TooltipPluginProps): JSX.Element | null {
 	const containerRef = useRef<HTMLDivElement>(null);
 	const rafId = useRef<number | null>(null);
@@ -59,7 +60,9 @@ export default function TooltipPlugin({
 	const renderRef = useRef(render);
 	renderRef.current = render;
 	const [portalRoot, setPortalRoot] = useState<HTMLElement>(
-		(document.fullscreenElement as HTMLElement) ?? document.body,
+		portalRootProp ??
+			(document.fullscreenElement as HTMLElement) ??
+			document.body,
 	);

 	// React-managed snapshot of what should be rendered. The controller
@@ -464,8 +467,12 @@ export default function TooltipPlugin({
 	}, [config]);

 	const resolvePortalRoot = useCallback((): void => {
-		setPortalRoot((document.fullscreenElement as HTMLElement) ?? document.body);
-	}, []);
+		setPortalRoot(
+			portalRootProp ??
+				(document.fullscreenElement as HTMLElement) ??
+				document.body,
+		);
+	}, [portalRootProp]);

 	useLayoutEffect((): (() => void) => {
 		resolvePortalRoot();
--- a/frontend/src/lib/uPlotV2/plugins/TooltipPlugin/types.ts
+++ b/frontend/src/lib/uPlotV2/plugins/TooltipPlugin/types.ts
@@ -67,6 +67,7 @@ export interface TooltipPluginProps {
 	pinnedTooltipElement?: (clickData: ChartClickData) => ReactNode;
 	maxWidth?: number;
 	maxHeight?: number;
+	portalRoot?: HTMLElement | null;
 }

 export interface ChartClickData {
--- a/frontend/src/utils/tests/queryContextUtils.test.ts
+++ b/frontend/src/utils/tests/queryContextUtils.test.ts
@@ -648,3 +648,176 @@ describe('getQueryContextAtCursor - trailing dot in key/value', () => {
 		expect(ctx.keyToken).toBe('k8s.namespace');
 	});
 });
+
+describe('getQueryContextAtCursor - partial operator', () => {
+	it('treats text after an incomplete key as an operator prefix', () => {
+		const q = 'service.name c';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.isInKey).toBe(false);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('c');
+		expect(ctx.currentPair).toStrictEqual(
+			expect.objectContaining({
+				key: 'service.name',
+				operator: 'c',
+				position: expect.objectContaining({
+					operatorStart: 13,
+					operatorEnd: 13,
+				}),
+			}),
+		);
+	});
+
+	it('keeps the operator context while completing contains', () => {
+		const q = 'service.name cont';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('cont');
+	});
+
+	it('treats cursor mid-token as operator context', () => {
+		const q = 'service.name cont';
+		// cursor sits between "con" and "t" — user still typing the operator
+		const ctx = getQueryContextAtCursor(q, 15);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.isInKey).toBe(false);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('cont');
+	});
+
+	it('keeps operator context when an AND conjunction precedes the pair', () => {
+		const q = 'a = 1 AND service.name c';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.isInKey).toBe(false);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('c');
+		expect(ctx.currentPair).toStrictEqual(
+			expect.objectContaining({
+				key: 'service.name',
+				operator: 'c',
+				position: expect.objectContaining({
+					operatorStart: 23,
+					operatorEnd: 23,
+				}),
+			}),
+		);
+	});
+
+	it('keeps operator context when an open parenthesis precedes the pair', () => {
+		const q = '(service.name c';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.isInKey).toBe(false);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('c');
+	});
+
+	it('re-glues a partial operator that follows a NOT negation', () => {
+		const q = 'service.name NOT c';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.isInKey).toBe(false);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('NOT c');
+		// operatorStart points at the partial operator (post-NOT), not at the
+		// negation — so suggestion selection only replaces the partial, never
+		// the user's typed NOT.
+		expect(ctx.currentPair).toStrictEqual(
+			expect.objectContaining({
+				key: 'service.name',
+				operator: 'NOT c',
+				hasNegation: true,
+				position: expect.objectContaining({
+					negationStart: 13,
+					negationEnd: 15,
+					operatorStart: 17,
+					operatorEnd: 17,
+				}),
+			}),
+		);
+	});
+
+	it('re-glues a multi-character partial operator after NOT', () => {
+		const q = 'service.name NOT lik';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('NOT lik');
+		expect(ctx.currentPair?.hasNegation).toBe(true);
+	});
+
+	it('re-glues an uppercase partial operator after NOT', () => {
+		const q = 'service.name NOT EXI';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('NOT EXI');
+		expect(ctx.currentPair?.hasNegation).toBe(true);
+	});
+
+	it('preserves original NOT casing in the operator text', () => {
+		const q = 'service.name not c';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('not c');
+		expect(ctx.currentPair?.hasNegation).toBe(true);
+	});
+
+	it('tolerates extra whitespace between NOT and the partial operator', () => {
+		const q = 'service.name NOT  c';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.keyToken).toBe('service.name');
+		// Display text uses a canonical single space between NOT and the
+		// partial, regardless of how many spaces the user typed.
+		expect(ctx.operatorToken).toBe('NOT c');
+		expect(ctx.currentPair?.hasNegation).toBe(true);
+	});
+
+	it('keeps operator context for NOT-prefixed partial inside parentheses', () => {
+		const q = '(service.name NOT c';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('NOT c');
+		expect(ctx.currentPair?.hasNegation).toBe(true);
+	});
+
+	it('keeps operator context for NOT-prefixed partial after an AND conjunction', () => {
+		const q = 'a = 1 AND service.name NOT c';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.keyToken).toBe('service.name');
+		expect(ctx.operatorToken).toBe('NOT c');
+		expect(ctx.currentPair?.hasNegation).toBe(true);
+	});
+
+	it('re-glues the most recent incomplete pair when three partial tokens are typed', () => {
+		// Pins documented behavior: with two trailing partial pairs (`c` and
+		// `k`), the heuristic pairs the most recent two — `c` becomes the
+		// key, `k` becomes the partial operator. The earlier `service.name`
+		// is dropped from the current pair view.
+		const q = 'service.name c k';
+		const ctx = getQueryContextAtCursor(q, q.length);
+
+		expect(ctx.isInOperator).toBe(true);
+		expect(ctx.keyToken).toBe('c');
+		expect(ctx.operatorToken).toBe('k');
+	});
+});
--- a/frontend/src/utils/lazyWithRetries.ts
+++ b/frontend/src/utils/lazyWithRetries.ts
@@ -16,9 +16,14 @@ export const lazyRetry = (componentImport: ComponentImport): Promise<any> =>
 				resolve(component);
 			})
 			.catch((error: Error) => {
-				if (!hasRefreshed) {
-					setSessionStorageApi(SESSIONSTORAGE.RETRY_LAZY_REFRESHED, 'true');
-
+				// A stale chunk reference right after a deploy self-heals: one reload pulls a
+				// fresh index.html with the new hashed asset names. That reload is only
+				// once-only if the flag persists, so a failed write (sessionStorage blocked in
+				// an iframe, storage disabled) must not reload at all — it would loop forever.
+				if (
+					!hasRefreshed &&
+					setSessionStorageApi(SESSIONSTORAGE.RETRY_LAZY_REFRESHED, 'true')
+				) {
 					window.location.reload();
 				}

--- a/frontend/src/utils/queryContextUtils.ts
+++ b/frontend/src/utils/queryContextUtils.ts
@@ -605,6 +605,98 @@ export function getQueryContextAtCursor(
 			queryPairs,
 		);

+		// Re-glue a partial operator that ANTLR has lexed as a second key.
+		//
+		// When the user types `service.name c` (or `service.name NOT c`), the
+		// lexer sees two KEY tokens (`service.name`, `c`) instead of a key +
+		// partial operator, so `extractQueryPairs` emits two consecutive
+		// key-only incomplete pairs. Downstream, that makes the dropdown
+		// suggest keys when it should be suggesting operators.
+		//
+		// Detect that pattern — a previous incomplete key-only pair followed
+		// by another incomplete key-only `currentPair`, separated only by
+		// whitespace (or by a negation token attached to the previous pair) —
+		// and rebuild a single synthetic pair where the previous pair's key
+		// is the key and the current pair's key is treated as the partial
+		// operator. The synthetic pair inherits the previous pair's negation
+		// flag and positions via the spread, so `NOT <partial>` propagates
+		// correctly to consumers.
+		const previousIncompletePair = queryPairs
+			.filter(
+				(pair) =>
+					!pair.isComplete &&
+					!!pair.key &&
+					!pair.operator &&
+					pair.position.keyEnd < (currentPair?.position.keyStart ?? cursorIndex),
+			)
+			.sort((a, b) => b.position.keyEnd - a.position.keyEnd)[0];
+
+		if (
+			previousIncompletePair &&
+			currentPair &&
+			currentPair !== previousIncompletePair &&
+			!currentPair.operator &&
+			currentPair.position.keyStart > previousIncompletePair.position.keyEnd
+		) {
+			const negationStart = previousIncompletePair.position.negationStart ?? 0;
+			const negationEnd = previousIncompletePair.position.negationEnd ?? 0;
+			const negationAfterKey =
+				previousIncompletePair.hasNegation &&
+				negationStart > previousIncompletePair.position.keyEnd;
+			const gapStart = negationAfterKey
+				? negationEnd + 1
+				: previousIncompletePair.position.keyEnd + 1;
+			const textBetweenPairs = query.slice(
+				gapStart,
+				currentPair.position.keyStart,
+			);
+
+			if (textBetweenPairs.trim() === '') {
+				// The replacement range (operatorStart/operatorEnd) must point
+				// at the partial operator only, NOT the leading negation.
+				// Consumers like QuerySearch use it to splice the chosen
+				// suggestion in-place, so including the negation would let a
+				// `NOT lik` -> `LIKE` selection erase the user's typed `NOT`.
+				// Matches the convention used for complete pairs in
+				// extractQueryPairs, where operatorStart starts after the
+				// negation token.
+				const operatorStart = currentPair.position.keyStart;
+				const operatorEnd = currentPair.position.keyEnd;
+				const partialOperator = query.slice(operatorStart, operatorEnd + 1);
+				const operatorText = negationAfterKey
+					? `${query.slice(negationStart, negationEnd + 1)} ${partialOperator}`
+					: partialOperator;
+
+				return {
+					tokenType: -1,
+					text: '',
+					start: cursorIndex,
+					stop: cursorIndex,
+					currentToken: operatorText,
+					isInKey: false,
+					isInNegation: false,
+					isInOperator: true,
+					isInValue: false,
+					isInConjunction: false,
+					isInFunction: false,
+					isInParenthesis: false,
+					isInBracketList: false,
+					keyToken: previousIncompletePair.key,
+					operatorToken: operatorText,
+					queryPairs,
+					currentPair: {
+						...previousIncompletePair,
+						operator: operatorText,
+						position: {
+							...previousIncompletePair.position,
+							operatorStart,
+							operatorEnd,
+						},
+					},
+				};
+			}
+		}
+
 		// Check if cursor is within any of the specific context boundaries
 		// FIXED: Include the case where the cursor is exactly at the end of a boundary
 		const isInKeyBoundary =
--- a/go.mod
+++ b/go.mod
@@ -4,7 +4,7 @@ go 1.25.7

 require (
 	dario.cat/mergo v1.0.2
-	github.com/AfterShip/clickhouse-sql-parser v0.5.4
+	github.com/AfterShip/clickhouse-sql-parser v0.5.5
 	github.com/ClickHouse/clickhouse-go/v2 v2.44.0
 	github.com/DATA-DOG/go-sqlmock v1.5.2
 	github.com/SigNoz/clickhouse-go-mock v0.14.0
@@ -223,7 +223,7 @@ require (
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/golang/snappy v1.0.0 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/cel-go v0.28.0 // indirect
+	github.com/google/cel-go v0.29.0 // indirect
 	github.com/google/s2a-go v0.1.9 // indirect
 	github.com/googleapis/enterprise-certificate-proxy v0.3.14 // indirect
 	github.com/googleapis/gax-go/v2 v2.18.0 // indirect
@@ -392,9 +392,9 @@ require (
 	golang.org/x/sys v0.45.0 // indirect
 	golang.org/x/time v0.15.0 // indirect
 	golang.org/x/tools v0.44.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d
-	google.golang.org/grpc v1.80.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478
+	google.golang.org/grpc v1.82.1 // indirect
 	gopkg.in/telebot.v3 v3.3.8 // indirect
 	k8s.io/client-go v0.35.3 // indirect
 	k8s.io/klog/v2 v2.140.0 // indirect
--- a/go.sum
+++ b/go.sum
@@ -66,8 +66,8 @@ dario.cat/mergo v1.0.2/go.mod h1:E/hbnu0NxMFBjpMIE34DRGLWqDy0g5FuKDhCb31ngxA=
 dmitri.shuralyov.com/gpu/mtl v0.0.0-20190408044501-666a987793e9/go.mod h1:H6x//7gZCb22OMCxBHrMx7a5I7Hp++hsVxbQ4BYO7hU=
 filippo.io/edwards25519 v1.2.0 h1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=
 filippo.io/edwards25519 v1.2.0/go.mod h1:xzAOLCNug/yB62zG1bQ8uziwrIqIuxhctzJT18Q77mc=
-github.com/AfterShip/clickhouse-sql-parser v0.5.4 h1:yiCQaMq8EO+dpKdnpP9YYd/ne6MSuOXgsMsNL33NiTI=
-github.com/AfterShip/clickhouse-sql-parser v0.5.4/go.mod h1:Qi3qvPTfZb/aFwI5V4WFOahgjsLJa4MzVijIAfwOhDw=
+github.com/AfterShip/clickhouse-sql-parser v0.5.5 h1:LCA23yAA4GgF73PoYXb67yzCdC4sXsj4geQz1Oij3U8=
+github.com/AfterShip/clickhouse-sql-parser v0.5.5/go.mod h1:Qi3qvPTfZb/aFwI5V4WFOahgjsLJa4MzVijIAfwOhDw=
 github.com/Azure/azure-sdk-for-go v68.0.0+incompatible h1:fcYLmCpyNYRnvJbPerq7U0hS+6+I79yEDJBqVNcqUzU=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0 h1:fou+2+WFTib47nS+nz/ozhEBnvU96bKHy6LjRsY4E28=
 github.com/Azure/azure-sdk-for-go/sdk/azcore v1.21.0/go.mod h1:t76Ruy8AHvUAC8GfMWJMa0ElSbuIcO03NLpynfbgsPA=
@@ -247,8 +247,8 @@ github.com/cncf/xds/go v0.0.0-20210805033703-aa0b78936158/go.mod h1:eXthEFrGJvWH
 github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
 github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 h1:6xNmx7iTtyBRev0+D/Tv1FZd4SCg8axKApyNyRsAt/w=
-github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5/go.mod h1:KdCmV+x/BuvyMxRnYBlmVaq4OLiKW6iRQfvC62cvdkI=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2 h1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=
+github.com/cncf/xds/go v0.0.0-20260202195803-dba9d589def2/go.mod h1:qwXFYgsP6T7XnJtbKlf1HP8AjxZZyzxMmc+Lq5GjlU4=
 github.com/coder/quartz v0.3.0 h1:bUoSEJ77NBfKtUqv6CPSC0AS8dsjqAqqAv7bN02m1mg=
 github.com/coder/quartz v0.3.0/go.mod h1:BgE7DOj/8NfvRgvKw0jPLDQH/2Lya2kxcTaNJ8X0rZk=
 github.com/containerd/errdefs v1.0.0 h1:tg5yIfIlQIrxYtu9ajqY42W3lpS19XqdxRQeEwYG8PI=
@@ -507,8 +507,8 @@ github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Z
 github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
 github.com/google/btree v1.1.3 h1:CVpQJjYgC4VbzxeGVHfvZrv1ctoYCAI8vbl07Fcxlyg=
 github.com/google/btree v1.1.3/go.mod h1:qOPhT0dTNdNzV6Z/lhRX0YXUafgPLFUh+gZMl761Gm4=
-github.com/google/cel-go v0.28.0 h1:KjSWstCpz/MN5t4a8gnGJNIYUsJRpdi/r97xWDphIQc=
-github.com/google/cel-go v0.28.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
+github.com/google/cel-go v0.29.0 h1:fEG+Ja3YRwNOqnQxTyJwoByAUAvTuxUGiro/jhrm4F4=
+github.com/google/cel-go v0.29.0/go.mod h1:X0bD6iVNR8pkROSOoHVdgTkzmRcosof7WQqCD6wcMc8=
 github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
 github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
 github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
@@ -1856,10 +1856,10 @@ google.golang.org/genproto v0.0.0-20220505152158-f39f71e6c8f3/go.mod h1:RAyBrSAP
 google.golang.org/genproto v0.0.0-20220519153652-3a47de7e79bd/go.mod h1:RAyBrSAP7Fh3Nc84ghnVLDPuV51xc9agzmm4Ph6i0Q4=
 google.golang.org/genproto v0.0.0-20260217215200-42d3e9bedb6d h1:vsOm753cOAMkt76efriTCDKjpCbK18XGHMJHo0JUKhc=
 google.golang.org/genproto v0.0.0-20260217215200-42d3e9bedb6d/go.mod h1:0oz9d7g9QLSdv9/lgbIjowW1JoxMbxmBVNe8i6tORJI=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 h1:VPWxll4HlMw1Vs/qXtN7BvhZqsS9cdAittCNvVENElA=
-google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9/go.mod h1:7QBABkRtR8z+TEnmXTqIqwJLlzrZKVfAUm7tY3yGv0M=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d h1:wT2n40TBqFY6wiwazVK9/iTWbsQrgk5ZfCSVFLO9LQA=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478 h1:yQugLulqltosq0B/f8l4w9VryjV+N/5gcW0jQ3N8Qec=
+google.golang.org/genproto/googleapis/api v0.0.0-20260414002931-afd174a4e478/go.mod h1:C6ADNqOxbgdUUeRTU+LCHDPB9ttAMCTff6auwCVa4uc=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8=
 google.golang.org/grpc v1.14.0/go.mod h1:yo6s7OP7yaDglbqo1J04qKzAhqBH6lvTonzMVmEdcZw=
 google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
 google.golang.org/grpc v1.20.1/go.mod h1:10oTOabMzJvdu6/UiuZezV6QK5dSlG84ov/aaiqXj38=
@@ -1892,8 +1892,8 @@ google.golang.org/grpc v1.44.0/go.mod h1:k+4IHHFw41K8+bbowsex27ge2rCb65oeWqe4jJ5
 google.golang.org/grpc v1.45.0/go.mod h1:lN7owxKUQEqMfSyQikvvk5tf/6zMPsrK+ONuO11+0rQ=
 google.golang.org/grpc v1.46.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
 google.golang.org/grpc v1.46.2/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/grpc v1.80.0 h1:Xr6m2WmWZLETvUNvIUmeD5OAagMw3FiKmMlTdViWsHM=
-google.golang.org/grpc v1.80.0/go.mod h1:ho/dLnxwi3EDJA4Zghp7k2Ec1+c2jqup0bFkw07bwF4=
+google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=
+google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA=
 google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.1.0/go.mod h1:6Kw0yEErY5E/yWrBtf03jp27GLLJujG4z/JK95pnjjw=
 google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
 google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
--- a/pkg/apiserver/signozapiserver/dashboard.go
+++ b/pkg/apiserver/signozapiserver/dashboard.go
@@ -14,371 +14,592 @@ import (
 )

 func (provider *provider) addDashboardRoutes(router *mux.Router) error {
-	if err := router.Handle("/api/v2/dashboards", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.ListV2), handler.OpenAPIDef{
-		ID:                  "ListDashboardsV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "List dashboards (v2)",
-		Description:         "Returns a page of v2-shape dashboards for the org. This is the pure, user-independent list — it carries no pin state. Use ListDashboardsForUserV2 for the personalized, pin-aware list. Supports a filter DSL (`query`), sort (`updated_at`/`created_at`/`name`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`).",
-		Request:             nil,
-		RequestQuery:        new(dashboardtypes.ListDashboardsV2Params),
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.ListableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.ListV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDashboardsV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "List dashboards (v2)",
+			Description:         "Returns a page of v2-shape dashboards for the org. This is the pure, user-independent list — it carries no pin state. Use ListDashboardsForUserV2 for the personalized, pin-aware list. Supports a filter DSL (`query`), sort (`updated_at`/`created_at`/`name`), order (`asc`/`desc`), and offset-based pagination (`limit`/`offset`).",
+			Request:             nil,
+			RequestQuery:        new(dashboardtypes.ListDashboardsV2Params),
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.ListableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/users/me/dashboards", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.ListForUserV2), handler.OpenAPIDef{
-		ID:                  "ListDashboardsForUserV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "List dashboards for the current user (v2)",
-		Description:         "Same as ListDashboardsV2 but personalized for the calling user: each dashboard carries the caller's `pinned` state, and pinned dashboards float to the top of the requested ordering. Supports the same filter DSL, sort, order, and pagination.",
-		Request:             nil,
-		RequestQuery:        new(dashboardtypes.ListDashboardsV2Params),
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.ListableDashboardForUserV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/me/dashboards", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.ListForUserV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDashboardsForUserV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "List dashboards for the current user (v2)",
+			Description:         "Same as ListDashboardsV2 but personalized for the calling user: each dashboard carries the caller's `pinned` state, and pinned dashboards float to the top of the requested ordering. Supports the same filter DSL, sort, order, and pagination.",
+			Request:             nil,
+			RequestQuery:        new(dashboardtypes.ListDashboardsV2Params),
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.ListableDashboardForUserV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.CreateV2), handler.OpenAPIDef{
-		ID:                  "CreateDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Create dashboard (v2)",
-		Description:         "This endpoint creates a dashboard in the v2 format that follows Perses spec.",
-		Request:             new(dashboardtypes.PostableDashboardV2),
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		// TODO: add http.StatusConflict once the dashboard name unique index is added.
-		ErrorStatusCodes: []int{http.StatusBadRequest},
-		Deprecated:       false,
-		SecuritySchemes:  newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.CreateV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Create dashboard (v2)",
+			Description:         "This endpoint creates a dashboard in the v2 format that follows Perses spec.",
+			Request:             new(dashboardtypes.PostableDashboardV2),
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			// TODO: add http.StatusConflict once the dashboard name unique index is added.
+			ErrorStatusCodes: []int{http.StatusBadRequest},
+			Deprecated:       false,
+			SecuritySchemes:  newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbCreate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbCreate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.ResponseJSONPath("data.id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards/{id}/clone", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.CloneV2), handler.OpenAPIDef{
-		ID:                  "CloneDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Clone dashboard (v2)",
-		Description:         "This endpoint clones an existing v2-shape dashboard. User and integration dashboards can be cloned; system dashboards are rejected. The clone keeps the source's display name, panels, and tags, but gets a freshly generated unique internal name and is always created as an unlocked user dashboard owned by the caller.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	// Two defs: the clone reads the source dashboard and creates a new one, so
+	// both read on the source id and create on the collection are checked.
+	if err := router.Handle("/api/v2/dashboards/{id}/clone", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.CloneV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CloneDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Clone dashboard (v2)",
+			Description:         "This endpoint clones an existing v2-shape dashboard. User and integration dashboards can be cloned; system dashboards are rejected. The clone keeps the source's display name, panels, and tags, but gets a freshly generated unique internal name and is always created as an unlocked user dashboard owned by the caller.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes: newScopedSecuritySchemes([]string{
+				coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbRead),
+				coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbCreate),
+			}),
+		},
+		handler.WithResourceDefs(
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceDashboard,
+				Verb:     coretypes.VerbRead,
+				Category: coretypes.ActionCategoryDataAccess,
+				ID:       coretypes.PathParam("id"),
+				Selector: coretypes.IDSelector,
+			},
+			handler.BasicResourceDef{
+				Resource: coretypes.ResourceMetaResourceDashboard,
+				Verb:     coretypes.VerbCreate,
+				Category: coretypes.ActionCategoryConfigurationChange,
+				ID:       coretypes.ResponseJSONPath("data.id"),
+				Selector: coretypes.WildcardSelector,
+			},
+		),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards/{id}/migrate", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.MigrateV2), handler.OpenAPIDef{
-		ID:                  "MigrateDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Migrate dashboard to v2",
-		Description:         "This endpoint retries the v1→v2 (Perses) migration on a dashboard still stored in the v1 schema and returns the v2-shape result. It is idempotent: a dashboard already in the v2 schema is returned unchanged.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}/migrate", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.MigrateV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "MigrateDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Migrate dashboard to v2",
+			Description:         "This endpoint retries the v1→v2 (Perses) migration on a dashboard still stored in the v1 schema and returns the v2-shape result. It is idempotent: a dashboard already in the v2 schema is returned unchanged.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.GetV2), handler.OpenAPIDef{
-		ID:                  "GetDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Get dashboard (v2)",
-		Description:         "This endpoint returns a v2-shape dashboard.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.GetV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Get dashboard (v2)",
+			Description:         "This endpoint returns a v2-shape dashboard.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.UpdateV2), handler.OpenAPIDef{
-		ID:                  "UpdateDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Update dashboard (v2)",
-		Description:         "This endpoint updates a v2-shape dashboard's metadata, data, and tag set. Locked dashboards are rejected.",
-		Request:             new(dashboardtypes.UpdatableDashboardV2),
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UpdateV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Update dashboard (v2)",
+			Description:         "This endpoint updates a v2-shape dashboard's metadata, data, and tag set. Locked dashboards are rejected.",
+			Request:             new(dashboardtypes.UpdatableDashboardV2),
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.PatchV2), handler.OpenAPIDef{
-		ID:          "PatchDashboardV2",
-		Tags:        []string{"dashboard"},
-		Summary:     "Patch dashboard (v2)",
-		Description: "This endpoint applies an RFC 6902 JSON Patch to a v2-shape dashboard. The patch is applied against the postable view of the dashboard (metadata, data, tags), so individual panels, queries, variables, layouts, or tags can be updated without re-sending the rest of the dashboard. Apply is lenient: `remove` on a missing path is a no-op (idempotent) and `add` creates any missing parent objects, rather than failing as strict RFC 6902 would. The resulting dashboard is still validated. Locked dashboards are rejected.",
-		Request:     new(dashboardtypes.PatchableDashboardV2),
-		// Strictly per RFC 6902 the content type is `application/json-patch+json`,
-		// but our OpenAPI generator only reflects schemas for content types it
-		// understands (application/json, form-urlencoded, multipart) — anything
-		// else degrades to `type: string`. Declaring application/json here keeps
-		// the array-of-ops schema visible to spec consumers; the runtime decoder
-		// parses JSON regardless of the request's actual Content-Type header.
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.GettableDashboardV2),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPatch).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.PatchV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:          "PatchDashboardV2",
+			Tags:        []string{"dashboard"},
+			Summary:     "Patch dashboard (v2)",
+			Description: "This endpoint applies an RFC 6902 JSON Patch to a v2-shape dashboard. The patch is applied against the postable view of the dashboard (metadata, data, tags), so individual panels, queries, variables, layouts, or tags can be updated without re-sending the rest of the dashboard. Apply is lenient: `remove` on a missing path is a no-op (idempotent) and `add` creates any missing parent objects, rather than failing as strict RFC 6902 would. The resulting dashboard is still validated. Locked dashboards are rejected.",
+			Request:     new(dashboardtypes.PatchableDashboardV2),
+			// Strictly per RFC 6902 the content type is `application/json-patch+json`,
+			// but our OpenAPI generator only reflects schemas for content types it
+			// understands (application/json, form-urlencoded, multipart) — anything
+			// else degrades to `type: string`. Declaring application/json here keeps
+			// the array-of-ops schema visible to spec consumers; the runtime decoder
+			// parses JSON regardless of the request's actual Content-Type header.
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.GettableDashboardV2),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPatch).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.DeleteV2), handler.OpenAPIDef{
-		ID:                  "DeleteDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Delete dashboard (v2)",
-		Description:         "This endpoint deletes a v2-shape dashboard along with its tag relations. Locked dashboards are rejected.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.DeleteV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Delete dashboard (v2)",
+			Description:         "This endpoint deletes a v2-shape dashboard along with its tag relations. Locked dashboards are rejected.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbDelete)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbDelete,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards/{id}/lock", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.LockV2), handler.OpenAPIDef{
-		ID:                  "LockDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Lock dashboard (v2)",
-		Description:         "This endpoint locks a v2-shape dashboard. Only the dashboard's creator or an org admin may lock or unlock.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}/lock", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.LockV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "LockDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Lock dashboard (v2)",
+			Description:         "This endpoint locks a v2-shape dashboard. Only the dashboard's creator or an org admin may lock or unlock.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboards/{id}/lock", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.UnlockV2), handler.OpenAPIDef{
-		ID:                  "UnlockDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Unlock dashboard (v2)",
-		Description:         "This endpoint unlocks a v2-shape dashboard. Only the dashboard's creator or an org admin may lock or unlock.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboards/{id}/lock", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UnlockV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UnlockDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Unlock dashboard (v2)",
+			Description:         "This endpoint unlocks a v2-shape dashboard. Only the dashboard's creator or an org admin may lock or unlock.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

-	// ViewAccess: pinning only mutates the calling user's pin list, not the
-	// dashboard itself — anyone who can view a dashboard can bookmark it.
-	if err := router.Handle("/api/v2/users/me/dashboards/{id}/pins", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.PinV2), handler.OpenAPIDef{
-		ID:                  "PinDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Pin a dashboard for the current user (v2)",
-		Description:         "Pins the dashboard for the calling user. A user can pin at most 10 dashboards; pinning when at the limit returns 409. Re-pinning an already-pinned dashboard is a no-op success.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound, http.StatusConflict},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	// Pinning mutates the calling user's pin list, not the dashboard, so it rides
+	// on the collection-level list permission rather than a per-dashboard check.
+	// The id is still extracted, for audit.
+	if err := router.Handle("/api/v2/users/me/dashboards/{id}/pins", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.PinV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "PinDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Pin a dashboard for the current user (v2)",
+			Description:         "Pins the dashboard for the calling user. A user can pin at most 10 dashboards; pinning when at the limit returns 409. Re-pinning an already-pinned dashboard is a no-op success.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound, http.StatusConflict},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/users/me/dashboards/{id}/pins", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.UnpinV2), handler.OpenAPIDef{
-		ID:                  "UnpinDashboardV2",
-		Tags:                []string{"dashboard"},
-		Summary:             "Unpin a dashboard for the current user (v2)",
-		Description:         "Removes the pin for the calling user. Idempotent — unpinning a dashboard that wasn't pinned still returns 204.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/users/me/dashboards/{id}/pins", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UnpinV2, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UnpinDashboardV2",
+			Tags:                []string{"dashboard"},
+			Summary:             "Unpin a dashboard for the current user (v2)",
+			Description:         "Removes the pin for the calling user. Idempotent — unpinning a dashboard that wasn't pinned still returns 204.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboard_views", handler.New(provider.authzMiddleware.ViewAccess(provider.dashboardHandler.ListViews), handler.OpenAPIDef{
-		ID:                  "ListDashboardViews",
-		Tags:                []string{"dashboard"},
-		Summary:             "List dashboard saved views",
-		Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.ListableDashboardView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleViewer),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	// Saved views hold dashboard listing state (query, sort, order) rather than any
+	// one dashboard, so all four ride on the collection-level list permission.
+	if err := router.Handle("/api/v2/dashboard_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.ListViews, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "ListDashboardViews",
+			Tags:                []string{"dashboard"},
+			Summary:             "List dashboard saved views",
+			Description:         "Returns every saved view in the calling user's org. Saved views are shared org-wide.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.ListableDashboardView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryDataAccess,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboard_views", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.CreateView), handler.OpenAPIDef{
-		ID:                  "CreateDashboardView",
-		Tags:                []string{"dashboard"},
-		Summary:             "Create dashboard saved view",
-		Description:         "Persists the calling user's dashboard listing state (query, sort, order) as a named, reusable view shared across the org.",
-		Request:             new(dashboardtypes.PostableDashboardView),
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.DashboardView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{http.StatusBadRequest},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboard_views", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.CreateView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreateDashboardView",
+			Tags:                []string{"dashboard"},
+			Summary:             "Create dashboard saved view",
+			Description:         "Persists the calling user's dashboard listing state (query, sort, order) as a named, reusable view shared across the org.",
+			Request:             new(dashboardtypes.PostableDashboardView),
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.DashboardView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{http.StatusBadRequest},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboard_views/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.UpdateView), handler.OpenAPIDef{
-		ID:                  "UpdateDashboardView",
-		Tags:                []string{"dashboard"},
-		Summary:             "Update dashboard saved view",
-		Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
-		Request:             new(dashboardtypes.UpdatableDashboardView),
-		RequestContentType:  "application/json",
-		Response:            new(dashboardtypes.DashboardView),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboard_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UpdateView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdateDashboardView",
+			Tags:                []string{"dashboard"},
+			Summary:             "Update dashboard saved view",
+			Description:         "Replaces a saved view's name and data. Saved views are shared org-wide.",
+			Request:             new(dashboardtypes.UpdatableDashboardView),
+			RequestContentType:  "application/json",
+			Response:            new(dashboardtypes.DashboardView),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v2/dashboard_views/{id}", handler.New(provider.authzMiddleware.EditAccess(provider.dashboardHandler.DeleteView), handler.OpenAPIDef{
-		ID:                  "DeleteDashboardView",
-		Tags:                []string{"dashboard"},
-		Summary:             "Delete dashboard saved view",
-		Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleEditor),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v2/dashboard_views/{id}", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.DeleteView, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeleteDashboardView",
+			Tags:                []string{"dashboard"},
+			Summary:             "Delete dashboard saved view",
+			Description:         "Removes a saved view. Saved views are shared org-wide. Deleting a non-existent view returns 404.",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{http.StatusBadRequest, http.StatusNotFound},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbList)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbList,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			Selector: coretypes.WildcardSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(provider.authzMiddleware.AdminAccess(provider.dashboardHandler.CreatePublic), handler.OpenAPIDef{
-		ID:                  "CreatePublicDashboard",
-		Tags:                []string{"dashboard"},
-		Summary:             "Create public dashboard",
-		Description:         "This endpoint creates public sharing config and enables public sharing of the dashboard",
-		Request:             new(dashboardtypes.PostablePublicDashboard),
-		RequestContentType:  "",
-		Response:            new(types.Identifiable),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusCreated,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPost).GetError(); err != nil {
+	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.CreatePublic, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "CreatePublicDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Create public dashboard",
+			Description:         "This endpoint creates public sharing config and enables public sharing of the dashboard",
+			Request:             new(dashboardtypes.PostablePublicDashboard),
+			RequestContentType:  "",
+			Response:            new(types.Identifiable),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusCreated,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPost).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(provider.authzMiddleware.AdminAccess(provider.dashboardHandler.GetPublic), handler.OpenAPIDef{
-		ID:                  "GetPublicDashboard",
-		Tags:                []string{"dashboard"},
-		Summary:             "Get public dashboard",
-		Description:         "This endpoint returns public sharing config for a dashboard",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            new(dashboardtypes.GettablePublicDasbhboard),
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusOK,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodGet).GetError(); err != nil {
+	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.GetPublic, authtypes.SigNozAdminRoleName, authtypes.SigNozEditorRoleName, authtypes.SigNozViewerRoleName),
+		handler.OpenAPIDef{
+			ID:                  "GetPublicDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Get public dashboard",
+			Description:         "This endpoint returns public sharing config for a dashboard",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            new(dashboardtypes.GettablePublicDasbhboard),
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusOK,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbRead)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbRead,
+			Category: coretypes.ActionCategoryDataAccess,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodGet).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(provider.authzMiddleware.AdminAccess(provider.dashboardHandler.UpdatePublic), handler.OpenAPIDef{
-		ID:                  "UpdatePublicDashboard",
-		Tags:                []string{"dashboard"},
-		Summary:             "Update public dashboard",
-		Description:         "This endpoint updates the public sharing config for a dashboard",
-		Request:             new(dashboardtypes.UpdatablePublicDashboard),
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodPut).GetError(); err != nil {
+	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.UpdatePublic, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "UpdatePublicDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Update public dashboard",
+			Description:         "This endpoint updates the public sharing config for a dashboard",
+			Request:             new(dashboardtypes.UpdatablePublicDashboard),
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodPut).GetError(); err != nil {
 		return err
 	}

-	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(provider.authzMiddleware.AdminAccess(provider.dashboardHandler.DeletePublic), handler.OpenAPIDef{
-		ID:                  "DeletePublicDashboard",
-		Tags:                []string{"dashboard"},
-		Summary:             "Delete public dashboard",
-		Description:         "This endpoint deletes the public sharing config and disables the public sharing of a dashboard",
-		Request:             nil,
-		RequestContentType:  "",
-		Response:            nil,
-		ResponseContentType: "application/json",
-		SuccessStatusCode:   http.StatusNoContent,
-		ErrorStatusCodes:    []int{},
-		Deprecated:          false,
-		SecuritySchemes:     newSecuritySchemes(types.RoleAdmin),
-	})).Methods(http.MethodDelete).GetError(); err != nil {
+	if err := router.Handle("/api/v1/dashboards/{id}/public", handler.New(
+		provider.authzMiddleware.CheckResources(provider.dashboardHandler.DeletePublic, authtypes.SigNozAdminRoleName),
+		handler.OpenAPIDef{
+			ID:                  "DeletePublicDashboard",
+			Tags:                []string{"dashboard"},
+			Summary:             "Delete public dashboard",
+			Description:         "This endpoint deletes the public sharing config and disables the public sharing of a dashboard",
+			Request:             nil,
+			RequestContentType:  "",
+			Response:            nil,
+			ResponseContentType: "application/json",
+			SuccessStatusCode:   http.StatusNoContent,
+			ErrorStatusCodes:    []int{},
+			Deprecated:          false,
+			SecuritySchemes:     newScopedSecuritySchemes([]string{coretypes.ResourceMetaResourceDashboard.Scope(coretypes.VerbUpdate)}),
+		},
+		handler.WithResourceDefs(handler.BasicResourceDef{
+			Resource: coretypes.ResourceMetaResourceDashboard,
+			Verb:     coretypes.VerbUpdate,
+			Category: coretypes.ActionCategoryConfigurationChange,
+			ID:       coretypes.PathParam("id"),
+			Selector: coretypes.IDSelector,
+		}),
+	)).Methods(http.MethodDelete).GetError(); err != nil {
 		return err
 	}

--- a/pkg/prometheus/clickhouseprometheusv2/classification_golden_test.go
+++ b/pkg/prometheus/clickhouseprometheusv2/classification_golden_test.go
@@ -0,0 +1,162 @@
+package clickhouseprometheusv2
+
+import (
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"sort"
+	"strings"
+	"testing"
+
+	"github.com/prometheus/prometheus/promql/parser"
+	"github.com/stretchr/testify/require"
+)
+
+var updateGolden = flag.Bool("update", false, "rewrite the classification golden file")
+
+const goldenFile = "testdata/classification_golden.json"
+
+// corpusFile is the conformance corpus that the integration suite replays.
+// The golden freezes the route of every expression in it.
+const corpusFile = "../../../tests/integration/testdata/promqltestcorpus/corpus.json"
+
+// TestClassificationGolden freezes the route of every conformance-corpus
+// expression: "full", "hybrid(<units>)", or "fallback: <reason>". The route
+// is a correctness surface of its own. A change that silently sends a shape
+// to the engine loses the pushdown. A change that silently transpiles an
+// unproven shape risks wrong numbers. Both must show as a diff of this file.
+// The corpus suite's clickhousev2 leg then judges the numbers.
+//
+// The golden keys on the expression alone. The corpus evaluates each
+// expression on several grids, and the test requires the route to be the
+// same on all of them. If a classifier change ever makes the route depend
+// on the grid, this test fails and the key must grow.
+//
+// Regenerate after an intended classifier change:
+//
+//	go test ./pkg/prometheus/clickhouseprometheusv2 -run TestClassificationGolden -update
+func TestClassificationGolden(t *testing.T) {
+	raw, err := os.ReadFile(corpusFile)
+	require.NoError(t, err)
+
+	var corpus struct {
+		Cases []struct {
+			Expr    string `json:"expr"`
+			StartMs int64  `json:"start_ms"`
+			EndMs   int64  `json:"end_ms"`
+			StepMs  int64  `json:"step_ms"`
+		} `json:"cases"`
+	}
+	require.NoError(t, json.Unmarshal(raw, &corpus))
+	require.NotEmpty(t, corpus.Cases)
+
+	promParser := parser.NewParser(parser.Options{})
+	routes := map[string]string{}
+	for _, c := range corpus.Cases {
+		expr, err := promParser.ParseExpr(c.Expr)
+		require.NoError(t, err, "corpus expression must parse: %q", c.Expr)
+
+		var route string
+		plan, ok := classify(expr, gridContext{startMs: c.StartMs, endMs: c.EndMs, stepMs: c.StepMs})
+		switch {
+		case ok && plan.full:
+			route = "full"
+		case ok:
+			route = fmt.Sprintf("hybrid(%d)", len(plan.units))
+		default:
+			route = "fallback: " + fallbackShape(expr)
+		}
+
+		if prev, seen := routes[c.Expr]; seen {
+			require.Equal(t, prev, route,
+				"route differs between grids for %q — the golden key must grow to include the grid", c.Expr)
+			continue
+		}
+		routes[c.Expr] = route
+	}
+
+	// json.MarshalIndent sorts map keys: the file is deterministic.
+	got, err := json.MarshalIndent(routes, "", "  ")
+	require.NoError(t, err)
+	got = append(got, '\n')
+
+	if *updateGolden {
+		require.NoError(t, os.MkdirAll(filepath.Dir(goldenFile), 0o755))
+		require.NoError(t, os.WriteFile(goldenFile, got, 0o644))
+		return
+	}
+
+	want, err := os.ReadFile(goldenFile)
+	require.NoError(t, err, "golden missing — generate it with -update")
+	require.Equal(t, string(want), string(got),
+		"classification route changed; if intended, regenerate with -update and explain the diff in review")
+}
+
+// fallbackShape buckets a non-transpilable query by why it stays on the engine
+// path, to separate "already served well" (instant selectors on the last-sample-per-step
+// path) from genuine compiler gaps.
+func fallbackShape(expr parser.Expr) string {
+	var hasMatrix, hasSubquery, hasAt, hasDurationExpr, overTime bool
+	rangeFns := map[string]bool{"rate": true, "increase": true, "delta": true, "irate": true, "idelta": true}
+	var unsupportedFns []string
+	parser.Inspect(expr, func(node parser.Node, _ []parser.Node) error {
+		switch n := node.(type) {
+		case *parser.MatrixSelector:
+			hasMatrix = true
+			if n.RangeExpr != nil {
+				hasDurationExpr = true
+			}
+		case *parser.SubqueryExpr:
+			hasSubquery = true
+			if n.RangeExpr != nil || n.StepExpr != nil || n.OriginalOffsetExpr != nil {
+				hasDurationExpr = true
+			}
+		case *parser.VectorSelector:
+			if n.Timestamp != nil || n.StartOrEnd != 0 {
+				hasAt = true
+			}
+			if n.OriginalOffsetExpr != nil {
+				hasDurationExpr = true
+			}
+		case *parser.Call:
+			if strings.HasSuffix(n.Func.Name, "_over_time") {
+				overTime = true
+			} else if !rangeFns[n.Func.Name] {
+				unsupportedFns = append(unsupportedFns, n.Func.Name)
+			}
+		}
+		return nil
+	})
+
+	switch {
+	case hasDurationExpr:
+		return "duration expression (resolved only at evaluation time)"
+	case hasSubquery:
+		return "subquery"
+	case hasAt:
+		return "@ modifier"
+	case overTime:
+		return "*_over_time range function"
+	case !hasMatrix:
+		return "instant-selector shape (last-sample-per-step engine path)"
+	case len(unsupportedFns) > 0:
+		return fmt.Sprintf("range shape with unsupported function(s): %s", strings.Join(dedupe(unsupportedFns), ",")) //nolint:makezero
+	default:
+		return "other range shape"
+	}
+}
+
+func dedupe(in []string) []string {
+	seen := map[string]bool{}
+	var out []string
+	for _, s := range in {
+		if !seen[s] {
+			seen[s] = true
+			out = append(out, s)
+		}
+	}
+	sort.Strings(out)
+	return out
+}
--- a/pkg/prometheus/clickhouseprometheusv2/provider.go
+++ b/pkg/prometheus/clickhouseprometheusv2/provider.go
@@ -2,27 +2,27 @@ package clickhouseprometheusv2

 import (
 	"context"
+	"time"

 	"github.com/SigNoz/signoz/pkg/factory"
 	"github.com/SigNoz/signoz/pkg/prometheus"
 	"github.com/SigNoz/signoz/pkg/telemetrystore"
+	"github.com/prometheus/prometheus/promql"
 	"github.com/prometheus/prometheus/storage"
 )

-// provider ties the package together: its own engine and parser, and the
-// ClickHouse client behind the native storage.Querier. It stays unexported:
-// callers hold the prometheus.Prometheus interface, which is the boundary
-// between the two provider implementations.
 type provider struct {
 	settings factory.ScopedProviderSettings
 	engine   *prometheus.Engine
 	parser   prometheus.Parser
 	client   *client
+	executor *executor
 }

 var (
 	_ prometheus.Prometheus        = (*provider)(nil)
 	_ prometheus.StatementCapturer = (*provider)(nil)
+	_ prometheus.RangeExecutor     = (*provider)(nil)
 )

 func NewFactory(telemetryStore telemetrystore.TelemetryStore) factory.ProviderFactory[prometheus.Prometheus, prometheus.Config] {
@@ -43,9 +43,14 @@ func New(_ context.Context, providerSettings factory.ProviderSettings, config pr
 		engine:   engine,
 		parser:   parser,
 		client:   client,
+		executor: &executor{client: client, engine: engine, parser: parser},
 	}, nil
 }

+func (p *provider) TryExecuteRange(ctx context.Context, query string, start, end time.Time, step time.Duration) (promql.Matrix, bool, error) {
+	return p.executor.TryExecuteRange(ctx, query, start, end, step)
+}
+
 func (p *provider) Engine() *prometheus.Engine {
 	return p.engine
 }
--- a/pkg/prometheus/clickhouseprometheusv2/testdata/classification_golden.json
+++ b/pkg/prometheus/clickhouseprometheusv2/testdata/classification_golden.json
@@ -0,0 +1,319 @@
+{
+  "(metric1_total offset 2) ^ 2": "full",
+  "-metric_a or -metric_b": "hybrid(2)",
+  "-metric_total": "full",
+  "-{job=\"api\"}": "full",
+  "10 atan2 20": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "10 atan2 NaN": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "AVG(http_requests) BY (job)": "full",
+  "COUNT(http_requests) BY (job)": "full",
+  "MAX(http_requests) BY (job)": "full",
+  "MIN(http_requests) BY (job)": "full",
+  "SUM BY (group) (((http_requests{job=\"api-server\"})))": "full",
+  "SUM BY (group) (http_requests{job=\"api-server\"})": "full",
+  "SUM(http_requests)": "full",
+  "SUM(http_requests) BY (job)": "full",
+  "SUM(http_requests) BY (job, group)": "full",
+  "SUM(http_requests) BY (job, nonexistent)": "full",
+  "SUM(http_requests{instance=\"0\"}) BY(job)": "full",
+  "abs(-1 * http_requests{group=\"production\",job=\"api-server\"})": "hybrid(1)",
+  "acos(trig - 10.1)": "hybrid(1)",
+  "acosh(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "asin(trig - 10.1)": "hybrid(1)",
+  "asinh(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "atan(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "atanh(trig - 10.1)": "hybrid(1)",
+  "avg by (group) (data{test=\"nan\"})": "full",
+  "avg by (group) (data{test=\"neg_inf\"})": "full",
+  "avg by (group) (data{test=\"pos_inf\"})": "full",
+  "avg by (group) (http_requests{job=\"api-server\"})": "full",
+  "avg(data)": "full",
+  "avg(data{test=\"-big\"})": "full",
+  "avg(data{test=\"-inf\"})": "full",
+  "avg(data{test=\"-inf2\"})": "full",
+  "avg(data{test=\"-inf3\"})": "full",
+  "avg(data{test=\"big\"})": "full",
+  "avg(data{test=\"bigzero\"})": "full",
+  "avg(data{test=\"inf\"})": "full",
+  "avg(data{test=\"inf2\"})": "full",
+  "avg(data{test=\"inf3\"})": "full",
+  "avg(data{test=\"inf_inf\"})": "full",
+  "avg(data{test=\"nan\"})": "full",
+  "avg(data{test=\"ten\"})": "full",
+  "avg(foo) - 52": "full",
+  "avg(foo) == 52": "full",
+  "avg(topk(10, foo)) - 52": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "avg(topk(10, foo)) == 52": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "avg(topk(11, foo)) - 52": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "avg(topk(11, foo)) == 52": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "avg(topk(8, foo)) - 52": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "avg(topk(8, foo)) == 52": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "avg(topk(9, foo)) - 52": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "avg(topk(9, foo)) == 52": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "avg_over_time(foo[100s]) - 52": "full",
+  "avg_over_time(foo[100s]) == 52": "full",
+  "avg_over_time(foo[110s]) - 52": "full",
+  "avg_over_time(foo[110s]) == 52": "full",
+  "avg_over_time(foo[120s]) - 52": "full",
+  "avg_over_time(foo[120s]) == 52": "full",
+  "avg_over_time(foo[130s]) - 52": "full",
+  "avg_over_time(foo[130s]) == 52": "full",
+  "avg_over_time(metric10[1m])": "full",
+  "avg_over_time(metric11[1m])": "full",
+  "avg_over_time(metric1[1m])": "full",
+  "avg_over_time(metric2[1m])": "full",
+  "avg_over_time(metric3[1m])": "full",
+  "avg_over_time(metric4[1m])": "full",
+  "avg_over_time(metric5[1m])": "full",
+  "avg_over_time(metric6[1m])": "full",
+  "avg_over_time(metric7[1m])": "full",
+  "avg_over_time(metric8[1m])": "full",
+  "avg_over_time(metric9[1m])": "full",
+  "avg_over_time(metric[2m])": "full",
+  "avg_over_time(rate(http_requests_total[1m])[1m:1s])": "hybrid(1)",
+  "ceil(0.004 * http_requests{group=\"production\",job=\"api-server\"})": "hybrid(1)",
+  "changes(http_requests[1800])": "fallback: range shape with unsupported function(s): changes",
+  "changes(http_requests[30m])": "fallback: range shape with unsupported function(s): changes",
+  "changes(metric[1m])": "fallback: range shape with unsupported function(s): changes",
+  "changes(metric[5m])": "fallback: range shape with unsupported function(s): changes",
+  "changes(x[20m])": "fallback: range shape with unsupported function(s): changes",
+  "clamp(metric_total, 0, 100)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "cos(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "cosh(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "count by (group) (http_requests{job=\"api-server\"})": "full",
+  "count by(namespace, pod, cpu) (node_cpu_seconds_total{cpu=~\".*\",job=\"node-exporter\",mode=\"idle\",namespace=\"observability\",pod=\"node-exporter-l454v\"}) * on(namespace, pod) group_left(node) node_namespace_pod:kube_pod_info:{namespace=\"observability\",pod=\"node-exporter-l454v\"}": "hybrid(1)",
+  "count_over_time(metric1_total[range()])": "fallback: duration expression (resolved only at evaluation time)",
+  "count_over_time(metric1_total[step()])": "fallback: duration expression (resolved only at evaluation time)",
+  "count_over_time(metric[10])": "full",
+  "count_over_time(metric[10s])": "full",
+  "count_over_time(metric[1m])": "full",
+  "count_over_time(metric[1s])": "full",
+  "count_over_time(metric[20])": "full",
+  "count_over_time(metric[20s])": "full",
+  "deg(trig - 10)": "hybrid(1)",
+  "deg(trig - 20)": "hybrid(1)",
+  "deg(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "delta(metric[1m])": "full",
+  "floor(0.004 * http_requests{group=\"production\",job=\"api-server\"})": "hybrid(1)",
+  "foo \u003e 2 or bar": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "http_requests_total{foo!=\"bar\", job=\"api-server\"}": "full",
+  "http_requests_total{foo!=\"bar\"}": "full",
+  "http_requests_total{foo!~\"bar\", job=\"api-server\", instance=\"1\", x!=\"y\", z=\"\", group!=\"\"}": "full",
+  "http_requests_total{foo!~\"bar\", job=\"api-server\"}": "full",
+  "http_requests_total{group!=\"canary\"}": "full",
+  "http_requests_total{group=\"production\",job=\"api-server\"} offset 5m": "full",
+  "http_requests_total{group=\"production\",job=~\"api-.+\"}": "full",
+  "http_requests_total{job!~\"api-.+\",group!=\"canary\"}": "full",
+  "http_requests_total{job=~\".+-server\",group!=\"canary\"}": "full",
+  "increase(http_requests_total[100m])": "full",
+  "increase(http_requests_total[30m])": "full",
+  "increase(http_requests_total[50m])": "full",
+  "increase(metric[1m])": "full",
+  "increase(metric[5m])": "full",
+  "label_join(series, \"idx\", \",\", \"label\", \"label\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace((((testmetric))), ((\"dst\")), ((\"value-$1\")), ((\"src\")), ((\"non-matching-regex\")))": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace(series, \"idx\", \"replaced\", \"idx\", \".*\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace(sum by (__name__) (rate(metric_total{env=\"2\"}[5m])), \"__name__\", \"$1\", \"__name__\", \"(.+)\")": "fallback: range shape with unsupported function(s): label_replace",
+  "label_replace(testmetric, \"dst\", \"\", \"dst\", \".*\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace(testmetric, \"dst\", \"$1-value-$2\", \"src\", \"(.*)-value-(.*)\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace(testmetric, \"dst\", \"destination-value-$1\", \"src\", \"source-value-(.*)\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace(testmetric, \"dst\", \"destination-value-$1\", \"src\", \"value-(.*)\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace(testmetric, \"dst\", \"value-$1\", \"nonexistent-src\", \"(.*)\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace(testmetric, \"dst\", \"value-$1\", \"nonexistent-src\", \"source-value-(.*)\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "label_replace(testmetric, \"dst\", \"value-$1\", \"src\", \"non-matching-regex\")": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "last_over_time(metric_total{env=\"1\"}[10m])": "full",
+  "max_over_time(metric_total{env=\"1\"}[10m])": "full",
+  "metric": "full",
+  "metric1 offset 15m or metric2 offset 45m": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "metric1_total offset +min(step(), 1s)^0": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset -(min(step(), 1s))+8000": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset -min(step(), 1s)+8000": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset -min(step(), 1s)^0": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset -step()*2": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset 100 + 2": "full",
+  "metric1_total offset 2 ^ 2": "full",
+  "metric1_total offset STEP()": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset max(3s,min(step(), 1s))+8000": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset min(range(), 8s)": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset min(step(), 1s)": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset min(step(), 1s)+8000": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset min(step(), 1s)^0": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset range()": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset step()": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset step()*0": "fallback: duration expression (resolved only at evaluation time)",
+  "metric1_total offset step()^0": "fallback: duration expression (resolved only at evaluation time)",
+  "metricA + ignoring() metricB": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "metricA + metricB": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "metric_total * 2": "full",
+  "metric_total + another_metric_total": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "metric_total \u003c= another_metric_total": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "metric_total \u003c= bool another_metric_total": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "metric_total{env=\"1\"}": "full",
+  "min_over_time(metric_total[10s])": "full",
+  "min_over_time(metric_total[15s:10s])": "fallback: subquery",
+  "min_over_time(rate(metric_total[5m])[20m:1m])": "hybrid(1)",
+  "node_cpu % 2": "full",
+  "node_cpu * 2": "full",
+  "node_cpu * ignoring (role, mode) group_left (role) node_role": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "node_cpu * on (instance) group_left (role) node_role": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "node_cpu + 2": "full",
+  "node_cpu + on(dummy) group_left(foo) random*0": "hybrid(1)",
+  "node_cpu - 2": "full",
+  "node_cpu / 2": "full",
+  "node_cpu / ignoring (mode) group_left sum without (mode)(node_cpu)": "hybrid(1)",
+  "node_cpu / ignoring (mode) group_left(dummy) sum without (mode)(node_cpu)": "hybrid(1)",
+  "node_cpu / on (instance) group_left sum by (instance,job)(node_cpu)": "hybrid(1)",
+  "node_cpu \u003e on(job, instance) group_left(target) (threshold or on (job, instance) (sum by (job, instance)(node_cpu) * 0 + 1))": "hybrid(1)",
+  "node_cpu \u003e on(job, instance) group_left(target) threshold": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "node_cpu ^ 2": "full",
+  "node_role * ignoring (role) group_right (role) node_var": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "node_role * on (instance) group_right (role) node_var": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "node_var * ignoring (role) group_left (role) node_role": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "node_var * on (instance) group_left (role) node_role": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "other + fill": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "present_over_time(http_requests_total[10m])": "fallback: *_over_time range function",
+  "present_over_time(http_requests_total[16m])": "fallback: *_over_time range function",
+  "present_over_time(http_requests_total[5m])": "fallback: *_over_time range function",
+  "present_over_time(http_requests_total[6m])": "fallback: *_over_time range function",
+  "present_over_time(httpd_handshake_failures_total[1m])": "fallback: *_over_time range function",
+  "present_over_time(httpd_log_lines_total[30s])": "fallback: *_over_time range function",
+  "present_over_time(rate(http_requests_total[5m])[5m:1m])": "hybrid(1)",
+  "present_over_time({instance=\"127.0.0.1\"}[5m:5s])": "fallback: subquery",
+  "present_over_time({instance=\"127.0.0.1\"}[5m])": "fallback: *_over_time range function",
+  "present_over_time({job=\"grok\"}[20m])": "fallback: *_over_time range function",
+  "present_over_time({job=\"ingress\"}[4m])": "fallback: *_over_time range function",
+  "rad(trig - 10)": "hybrid(1)",
+  "rad(trig - 20)": "hybrid(1)",
+  "rad(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "random + on() metricA": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "rate(calculate_rate_offset_total[10m] offset 5m)": "full",
+  "rate(calculate_rate_window_total[50m])": "full",
+  "rate(http_requests_total[1m])": "full",
+  "rate(http_requests_total[40s]) - rate(http_requests_total[1m] offset 10000s)": "hybrid(2)",
+  "rate(http_requests_total{group=~\"((?i)PRO).*\"}[1m])": "full",
+  "rate(http_requests_total{group=~\"(?i:PRO).*\"}[1m])": "full",
+  "rate(http_requests_total{group=~\"(?i:PRODUCTION)\"}[1m])": "full",
+  "rate(http_requests_total{group=~\".*((?i)DUC).*\"}[1m])": "full",
+  "rate(http_requests_total{group=~\".*((?i)TION)\"}[1m])": "full",
+  "rate(http_requests_total{group=~\".*(?i:C).*\"}[1m])": "full",
+  "rate(http_requests_total{group=~\".*(?i:DUC).*\"}[1m])": "full",
+  "rate(http_requests_total{group=~\".*(?i:TION)\"}[1m])": "full",
+  "rate(http_requests_total{group=~\".*(?i:TION).*?\"}[1m])": "full",
+  "rate(http_requests_total{group=~\".*?(?i:PRO).*\"}[1m])": "full",
+  "rate(http_requests_total{group=~\".*ry\", instance=\"1\"}[1m])": "full",
+  "rate(http_requests_total{group=~\"pro.*\"}[1m:10s])": "fallback: subquery",
+  "rate(http_requests_total{group=~\"pro.*\"}[1m])": "full",
+  "rate(http_requests_total{instance!=\"3\"}[1m] offset 10000s)": "full",
+  "rate(metric_total[1m1s:10s])": "fallback: subquery",
+  "rate(metric_total[1m500ms:10s])": "fallback: subquery",
+  "rate(metric_total[1m])": "full",
+  "rate(metric_total[20s:10s])": "fallback: subquery",
+  "rate(metric_total[20s:5s])": "fallback: subquery",
+  "rate(metric_total{env=\"1\"}[10m])": "full",
+  "rate(sum_over_time((metric1_total+metric2_total+metric3_total)[30s:10s])[30s:10s])": "fallback: subquery",
+  "rate(sum_over_time(metric1_total[30s:10s])[50s:10s])": "fallback: subquery",
+  "rate(sum_over_time(metric2_total[30s:10s])[50s:10s])": "fallback: subquery",
+  "rate(sum_over_time(metric3_total[30s:10s])[50s:10s])": "fallback: subquery",
+  "rate(testcounter_reset_end_total[5m])": "full",
+  "rate(testcounter_reset_end_total[6m])": "full",
+  "rate(testcounter_reset_middle_total[50m])": "full",
+  "rate(testcounter_zero_cutoff_total[20m])": "full",
+  "requests * 2": "full",
+  "resets(metric[1m])": "fallback: range shape with unsupported function(s): resets",
+  "resets(metric[5m])": "fallback: range shape with unsupported function(s): resets",
+  "round(-1 * (0.004 * http_requests{group=\"production\",job=\"api-server\"}))": "hybrid(1)",
+  "round(-1 * (0.005 * http_requests{group=\"production\",job=\"api-server\"}))": "hybrid(1)",
+  "round(-1 * (1 + 0.005 * http_requests{group=\"production\",job=\"api-server\"}))": "hybrid(1)",
+  "round(-1 * (5.2 + 0.0005 * http_requests{group=\"production\",job=\"api-server\"}), 0.1)": "hybrid(1)",
+  "round(0.0005 * http_requests{group=\"production\",job=\"api-server\"}, 0.1)": "hybrid(1)",
+  "round(0.004 * http_requests{group=\"production\",job=\"api-server\"})": "hybrid(1)",
+  "round(0.005 * http_requests{group=\"production\",job=\"api-server\"})": "hybrid(1)",
+  "round(0.025 * http_requests{group=\"production\",job=\"api-server\"}, 5)": "hybrid(1)",
+  "round(0.045 * http_requests{group=\"production\",job=\"api-server\"}, 5)": "hybrid(1)",
+  "round(1 + 0.005 * http_requests{group=\"production\",job=\"api-server\"})": "hybrid(1)",
+  "round(2.1 + 0.0005 * http_requests{group=\"production\",job=\"api-server\"}, 0.1)": "hybrid(1)",
+  "round(5.2 + 0.0005 * http_requests{group=\"production\",job=\"api-server\"}, 0.1)": "hybrid(1)",
+  "round(metric_total)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "sin(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "sinh(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stddev (series)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stddev by (instance)(http_requests)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stddev by (label) (series)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stddev(http_requests)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stddev(series)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stddev_over_time(metric[1m])": "fallback: *_over_time range function",
+  "stdvar (series)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stdvar by (instance)(http_requests)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stdvar by (label) (series)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stdvar(http_requests)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stdvar(series)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "stdvar_over_time(metric[1m])": "fallback: *_over_time range function",
+  "sum by () (http_requests{job=\"api-server\"})": "full",
+  "sum by (__name__) (metric_total{env=\"1\"} or rate(metric_total{env=\"2\"}[5m]))": "fallback: other range shape",
+  "sum by (__name__) (metric_total{env=\"1\"})": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "sum by (__name__) (metric_total{env=\"3\"} or rate(metric_total{env=\"2\"}[5m]))": "fallback: other range shape",
+  "sum by (__name__) (rate(metric_total{env=\"2\"}[5m]) or metric_total{env=\"1\"})": "fallback: other range shape",
+  "sum by (__name__) (rate(metric_total{env=\"2\"}[5m]))": "fallback: other range shape",
+  "sum by (__name__) (rate(metric_total{env=\"3\"}[5m]) or metric_total{env=\"1\"})": "fallback: other range shape",
+  "sum by (__name__, env) (metric_total{env=\"1\"})": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "sum by (group) (data{test=\"nan\"})": "full",
+  "sum by (group) (data{test=\"neg_inf\"})": "full",
+  "sum by (group) (data{test=\"pos_inf\"})": "full",
+  "sum by (group) (http_requests{job=\"api-server\"})": "full",
+  "sum by (mode, job)(node_cpu) / on (job) group_left sum by (job)(node_cpu)": "hybrid(2)",
+  "sum without () (http_requests{job=\"api-server\",group=\"production\"})": "full",
+  "sum without (instance) (http_requests{job=\"api-server\"} or foo)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "sum without (instance) (http_requests{job=\"api-server\"})": "full",
+  "sum without (instance)(node_cpu) / ignoring (mode) group_left sum without (instance, mode)(node_cpu)": "hybrid(2)",
+  "sum(data{test=\"inf_inf\"})": "full",
+  "sum(data{test=\"ten\"})": "full",
+  "sum(http_requests) by (job) + min(http_requests) by (job) + max(http_requests) by (job) + avg(http_requests) by (job)": "hybrid(4)",
+  "sum(http_requests{job=\"api-server\"})": "full",
+  "sum(label_grouping_test) by (a, b)": "full",
+  "sum(sum by (group) (http_requests{job=\"api-server\"})) by (job)": "hybrid(1)",
+  "sum(sum by (mode, job)(node_cpu) / on (job) group_left sum by (job)(node_cpu))": "hybrid(2)",
+  "sum(sum without (instance)(node_cpu) / ignoring (mode) group_left sum without (instance, mode)(node_cpu))": "hybrid(2)",
+  "sum_over_time((metric1_total)[30:10] offset 3)": "fallback: subquery",
+  "sum_over_time((metric1_total)[30:10] offset 3s)": "fallback: subquery",
+  "sum_over_time((metric1_total)[30:10s] offset 3s)": "fallback: subquery",
+  "sum_over_time((metric1_total)[30s:10s] offset 3s)": "fallback: subquery",
+  "sum_over_time(bar[30s])": "full",
+  "sum_over_time(metric1_total[30:10] offset 3)": "fallback: subquery",
+  "sum_over_time(metric1_total[30s:10s] offset 10s)": "fallback: subquery",
+  "sum_over_time(metric1_total[30s:10s] offset 3s)": "fallback: subquery",
+  "sum_over_time(metric1_total[30s:10s] offset 5s)": "fallback: subquery",
+  "sum_over_time(metric1_total[30s:10s] offset 7s)": "fallback: subquery",
+  "sum_over_time(metric1_total[30s:10s] offset 9s)": "fallback: subquery",
+  "sum_over_time(metric1_total[30s:10s])": "fallback: subquery",
+  "sum_over_time(metric1_total[30s:5s])": "fallback: subquery",
+  "sum_over_time(metric[1000ms])": "full",
+  "sum_over_time(metric[1001ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric[1002ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric[1003ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric[2000ms])": "full",
+  "sum_over_time(metric[2001ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric[2002ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric[2003ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric[2m])": "full",
+  "sum_over_time(metric[3000ms])": "full",
+  "sum_over_time(metric[3001ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric[3002ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric[3003ms])": "fallback: *_over_time range function",
+  "sum_over_time(metric_total[50s:10s])": "fallback: subquery",
+  "sum_over_time(metric_total[50s:5s])": "fallback: subquery",
+  "sum_over_time(metric_total[60s:10s])": "fallback: subquery",
+  "tan(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "tanh(trig)": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "test_total \u003c bool test_smaller": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "test_total \u003c test_smaller": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "test_total \u003e bool test_smaller": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "test_total \u003e test_smaller": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "testmetric": "full",
+  "topk(10, sum by (__name__, env) (metric_total{env=\"1\"}))": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "topk(10, sum by (__name__, env) (rate(metric_total{env=\"1\"}[10m])))": "fallback: other range shape",
+  "trigy atan2 trigNaN": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "trigy atan2 trigx": "fallback: instant-selector shape (last-sample-per-step engine path)",
+  "x{y=\"testvalue\"}": "full",
+  "{__name__=~\".+\"}": "full",
+  "{job=~\".+-server\", job!~\"api-.+\"}": "full"
+}
--- a/pkg/prometheus/clickhouseprometheusv2/transpiler.go
+++ b/pkg/prometheus/clickhouseprometheusv2/transpiler.go
@@ -0,0 +1,470 @@
+package clickhouseprometheusv2
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/prometheus/prometheus/model/labels"
+	"github.com/prometheus/prometheus/promql/parser"
+)
+
+// The transpiler turns allowlisted PromQL subtrees into single ClickHouse
+// statements on the timeSeries*ToGrid aggregate functions. Every other
+// shape falls back to the engine over this package's querier. See
+// docs/contributing/prometheus.md for the model, the allowlist, and the
+// correctness argument of each form.
+
+type rangeFn string
+
+const (
+	fnRate     rangeFn = "rate"
+	fnIncrease rangeFn = "increase"
+	fnDelta    rangeFn = "delta"
+	fnIRate    rangeFn = "irate"
+	fnIDelta   rangeFn = "idelta"
+)
+
+var gridFunction = map[rangeFn]string{
+	fnRate:     "timeSeriesRateToGrid",
+	fnIncrease: "timeSeriesRateToGrid", // increase == rate * range seconds, exactly (same factor algebra)
+	fnDelta:    "timeSeriesDeltaToGrid",
+	fnIRate:    "timeSeriesInstantRateToGrid",
+	fnIDelta:   "timeSeriesInstantDeltaToGrid",
+}
+
+// scalarOp runs in Go during assembly, with the same float64 operations
+// the engine uses.
+type scalarOp struct {
+	op           parser.ItemType
+	scalar       float64
+	scalarOnLeft bool
+	returnBool   bool
+}
+
+// Comparisons preserve the metric name; arithmetic drops it.
+func (o scalarOp) isComparison() bool {
+	return o.op.IsComparisonOperator()
+}
+
+type unitKind int
+
+const (
+	// unitRange: rate/increase/delta/irate/idelta over a matrix selector.
+	unitRange unitKind = iota
+	// unitInstant: a plain vector selector resolved per grid point with
+	// lookback and stale-marker shadowing.
+	unitInstant
+	// unitOverTime: avg/min/max/sum/count/last_over_time over a matrix
+	// selector (aggregation over the window's samples, stale rows excluded).
+	unitOverTime
+)
+
+// coreUnit is one transpilable subtree: selector [-> range function] ->
+// optional aggregation -> scalar-op pipeline.
+type coreUnit struct {
+	kind     unitKind
+	matchers []*labels.Matcher
+	offsetMs int64
+	fn       rangeFn // unitRange
+	overFn   string  // unitOverTime: avg|min|max|sum|count|last
+	rangeMs  int64   // unitRange/unitOverTime window
+
+	hasAgg   bool
+	aggOp    parser.ItemType // SUM MIN MAX AVG COUNT
+	by       bool
+	grouping []string
+
+	ops []scalarOp
+}
+
+// keepsName reports whether the unit's output series keep their real
+// __name__. Bare and comparison-filtered instant selectors keep it, and so
+// does last_over_time: they return the raw sample, name included. Range
+// functions, the other *_over_time functions, aggregations, arithmetic, and
+// bool comparisons all drop it. A bool comparison returns 0/1, not the
+// sample, so the engine drops the name there too. A unit that keeps the
+// name cannot become a synthetic series in a hybrid plan: the synthetic
+// name would replace the real one. It transpiles fine as a full plan, where
+// assembly emits the real names.
+func (u *coreUnit) keepsName() bool {
+	nameKeepingSelector := u.kind == unitInstant || (u.kind == unitOverTime && u.overFn == "last")
+	if !nameKeepingSelector || u.hasAgg {
+		return false
+	}
+	for _, op := range u.ops {
+		if !op.isComparison() || op.returnBool {
+			return false
+		}
+	}
+	return true
+}
+
+// gridContext is the evaluation grid a unit computes on. The query grid for
+// top-level units; for units inside subqueries, the subquery's own grid:
+// epoch-aligned multiples of its resolution covering the subquery window,
+// exactly as the engine derives it (engine.go, *parser.SubqueryExpr case).
+type gridContext struct {
+	startMs int64
+	endMs   int64
+	stepMs  int64
+}
+
+// subqueryGrid derives the inner grid for a subquery evaluated on outer:
+// interval S, end = outer end − offset, start = first multiple of S strictly
+// greater than outer start − offset − range.
+func subqueryGrid(outer gridContext, rangeMs, stepMs, offsetMs int64) gridContext {
+	lower := outer.startMs - offsetMs - rangeMs
+	start := stepMs * (lower / stepMs)
+	if start <= lower {
+		start += stepMs
+	}
+	return gridContext{startMs: start, endMs: outer.endMs - offsetMs, stepMs: stepMs}
+}
+
+type transpiledUnit struct {
+	core coreUnit
+	name string // __signoz_transpiled_<n>__
+	grid gridContext
+}
+
+type transpilePlan struct {
+	units []*transpiledUnit
+	grid  gridContext // the query's top-level grid
+	// full is set when the entire query is units[0]; otherwise rewritten
+	// holds the query with each unit replaced by a synthetic selector, to be
+	// evaluated by the engine over a hybrid storage.
+	full      bool
+	rewritten string
+}
+
+const syntheticNamePrefix = "__signoz_transpiled_"
+
+func syntheticName(i int) string {
+	return fmt.Sprintf("%s%d__", syntheticNamePrefix, i)
+}
+
+// classifyCore matches a subtree against the transpilable core shape.
+// stepMs gates second-granularity: the grid functions take whole-second step
+// and window parameters (grid *starts* are millisecond-precise).
+func classifyCore(node parser.Expr, stepMs int64) (*coreUnit, bool) {
+	unit := &coreUnit{}
+
+	expr := node
+	// Peel scalar ops and parens off the top, outermost first; ops apply in
+	// evaluation order, so prepend while peeling.
+	for {
+		switch n := expr.(type) {
+		case *parser.ParenExpr:
+			expr = n.Expr
+			continue
+		case *parser.UnaryExpr:
+			if n.Op != parser.SUB {
+				expr = n.Expr // unary '+' is a no-op
+				continue
+			}
+			// -x == -1 * x for every float64 (incl. NaN and signed zero).
+			unit.ops = append([]scalarOp{{op: parser.MUL, scalar: -1}}, unit.ops...)
+			expr = n.Expr
+			continue
+		case *parser.StepInvariantExpr:
+			// @-pinned expressions evaluate on a different grid.
+			return nil, false
+		case *parser.BinaryExpr:
+			lit, litOnLeft, ok := numberLiteralSide(n)
+			if !ok {
+				return nil, false
+			}
+			if !n.Op.IsOperator() && !n.Op.IsComparisonOperator() {
+				return nil, false
+			}
+			if n.Op == parser.ATAN2 {
+				// atan2 is arithmetic in PromQL but rarely used; keep the
+				// allowlist tight.
+				return nil, false
+			}
+			returnBool := n.ReturnBool
+			unit.ops = append([]scalarOp{{op: n.Op, scalar: lit, scalarOnLeft: litOnLeft, returnBool: returnBool}}, unit.ops...)
+			if litOnLeft {
+				expr = n.RHS
+			} else {
+				expr = n.LHS
+			}
+			continue
+		}
+		break
+	}
+
+	// Optional aggregation.
+	if agg, ok := expr.(*parser.AggregateExpr); ok {
+		switch agg.Op {
+		case parser.SUM, parser.MIN, parser.MAX, parser.AVG, parser.COUNT:
+		default:
+			return nil, false
+		}
+		for _, g := range agg.Grouping {
+			if g == metricNameLabel {
+				// by(__name__)/without(__name__) over synthetic or compiled
+				// output needs name bookkeeping the compiler doesn't do.
+				return nil, false
+			}
+		}
+		unit.hasAgg = true
+		unit.aggOp = agg.Op
+		unit.by = !agg.Without
+		unit.grouping = agg.Grouping
+		expr = agg.Expr
+		for {
+			if p, ok := expr.(*parser.ParenExpr); ok {
+				expr = p.Expr
+				continue
+			}
+			break
+		}
+	}
+
+	// The grid functions take whole-second steps; stepMs == 0 is an instant
+	// query (single-point grid).
+	if stepMs < 0 || stepMs%1000 != 0 {
+		return nil, false
+	}
+
+	// Bare instant selector: resolved per grid point with lookback and
+	// stale-marker shadowing (see compiler_sql.go).
+	if vs, ok := expr.(*parser.VectorSelector); ok {
+		// A duration expression (offset step(), offset range()*2, ...) is
+		// resolved into OriginalOffset only at evaluation time; at
+		// classification time the field still holds its zero value, so
+		// transpiling would silently use the wrong offset.
+		if vs.Timestamp != nil || vs.StartOrEnd != 0 || vs.Anchored || vs.Smoothed || vs.OriginalOffsetExpr != nil {
+			return nil, false
+		}
+		offsetMs := vs.OriginalOffset.Milliseconds()
+		if offsetMs < 0 {
+			return nil, false
+		}
+		unit.kind = unitInstant
+		unit.offsetMs = offsetMs
+		unit.matchers = vs.LabelMatchers
+		return unit, true
+	}
+
+	// Range or *_over_time function over a plain matrix selector.
+	call, ok := expr.(*parser.Call)
+	if !ok {
+		return nil, false
+	}
+	var fn rangeFn
+	var overFn string
+	switch call.Func.Name {
+	case "rate":
+		fn = fnRate
+	case "increase":
+		fn = fnIncrease
+	case "delta":
+		fn = fnDelta
+	case "irate":
+		fn = fnIRate
+	case "idelta":
+		fn = fnIDelta
+	case "avg_over_time", "min_over_time", "max_over_time", "sum_over_time", "count_over_time", "last_over_time":
+		overFn = strings.TrimSuffix(call.Func.Name, "_over_time")
+	default:
+		return nil, false
+	}
+	if len(call.Args) != 1 {
+		return nil, false
+	}
+	ms, ok := call.Args[0].(*parser.MatrixSelector)
+	if !ok {
+		return nil, false
+	}
+	vs, ok := ms.VectorSelector.(*parser.VectorSelector)
+	if !ok {
+		return nil, false
+	}
+	// Duration expressions resolve at evaluation time (see the instant
+	// selector case above); Range/OriginalOffset would be read as zero here.
+	if vs.Timestamp != nil || vs.StartOrEnd != 0 || vs.Anchored || vs.Smoothed || vs.OriginalOffsetExpr != nil || ms.RangeExpr != nil {
+		return nil, false
+	}
+
+	rangeMs := ms.Range.Milliseconds()
+	offsetMs := vs.OriginalOffset.Milliseconds()
+	if rangeMs <= 0 || rangeMs%1000 != 0 || offsetMs < 0 {
+		return nil, false
+	}
+
+	if overFn != "" {
+		unit.kind = unitOverTime
+		unit.overFn = overFn
+	} else {
+		unit.kind = unitRange
+		unit.fn = fn
+	}
+	unit.rangeMs = rangeMs
+	unit.offsetMs = offsetMs
+	unit.matchers = vs.LabelMatchers
+	return unit, true
+}
+
+// numberLiteralSide returns the number literal on one side of a binary
+// expression (peeling parens and unary minus), and which side it is on.
+func numberLiteralSide(b *parser.BinaryExpr) (float64, bool, bool) {
+	if v, ok := literalValue(b.LHS); ok {
+		return v, true, true
+	}
+	if v, ok := literalValue(b.RHS); ok {
+		return v, false, true
+	}
+	return 0, false, false
+}
+
+func literalValue(e parser.Expr) (float64, bool) {
+	neg := false
+	for {
+		switch n := e.(type) {
+		case *parser.ParenExpr:
+			e = n.Expr
+			continue
+		case *parser.StepInvariantExpr:
+			e = n.Expr
+			continue
+		case *parser.UnaryExpr:
+			if n.Op == parser.SUB {
+				neg = !neg
+			}
+			e = n.Expr
+			continue
+		case *parser.NumberLiteral:
+			if neg {
+				return -n.Val, true
+			}
+			return n.Val, true
+		default:
+			return 0, false
+		}
+	}
+}
+
+// classify builds the compile plan for a query: full when the root is a core
+// unit, hybrid when core units sit strictly below the root (including inside
+// fixed-resolution subqueries, computed on the subquery grid), none
+// otherwise.
+func classify(root parser.Expr, grid gridContext) (*transpilePlan, bool) {
+	if unit, ok := classifyCore(root, grid.stepMs); ok {
+		return &transpilePlan{
+			units: []*transpiledUnit{{core: *unit, name: syntheticName(0), grid: grid}},
+			grid:  grid,
+			full:  true,
+		}, true
+	}
+
+	plan := &transpilePlan{grid: grid}
+	rewritten := rewrite(root, grid, plan, false)
+	if len(plan.units) == 0 {
+		return nil, false
+	}
+	plan.rewritten = rewritten.String()
+	return plan, true
+}
+
+// rewrite walks top-down replacing maximal transpilable subtrees with synthetic
+// vector selectors. nameSensitive marks scopes where an ancestor's semantics
+// depend on __name__ (grouping or vector matching on it): synthetic series
+// carry a synthetic __name__, so substitution there would change results.
+// Fixed-resolution subqueries recurse with the subquery's own grid; scopes
+// whose evaluation grid is unknowable (@-pinned, default-resolution
+// subqueries) are not entered.
+func rewrite(node parser.Expr, grid gridContext, plan *transpilePlan, nameSensitive bool) parser.Expr {
+	if node == nil {
+		return nil
+	}
+
+	if !nameSensitive {
+		// Units whose output keeps the real __name__ (bare instant selectors)
+		// cannot be substituted: the synthetic name would replace it in the
+		// engine's output. They still compile as full plans.
+		if unit, ok := classifyCore(node, grid.stepMs); ok && !unit.keepsName() {
+			cu := &transpiledUnit{core: *unit, name: syntheticName(len(plan.units)), grid: grid}
+			plan.units = append(plan.units, cu)
+			return &parser.VectorSelector{
+				Name: cu.name,
+				LabelMatchers: []*labels.Matcher{
+					labels.MustNewMatcher(labels.MatchEqual, metricNameLabel, cu.name),
+				},
+				PosRange: node.PositionRange(),
+			}
+		}
+	}
+
+	switch n := node.(type) {
+	case *parser.ParenExpr:
+		n.Expr = rewrite(n.Expr, grid, plan, nameSensitive)
+	case *parser.UnaryExpr:
+		n.Expr = rewrite(n.Expr, grid, plan, nameSensitive)
+	case *parser.AggregateExpr:
+		sensitive := nameSensitive || groupingUsesName(n.Grouping)
+		n.Expr = rewrite(n.Expr, grid, plan, sensitive)
+		// n.Param is a scalar/string; nothing transpilable inside for our core.
+	case *parser.Call:
+		for i, arg := range n.Args {
+			n.Args[i] = rewrite(arg, grid, plan, nameSensitive)
+		}
+	case *parser.BinaryExpr:
+		sensitive := nameSensitive || vectorMatchingUsesName(n.VectorMatching)
+		n.LHS = rewrite(n.LHS, grid, plan, sensitive)
+		n.RHS = rewrite(n.RHS, grid, plan, sensitive)
+	case *parser.SubqueryExpr:
+		// The alert-smoothing idiom fn_over_time((expr)[R:S]) dominates real
+		// rule fleets; inner units evaluate on the subquery grid, and the
+		// engine does the smoothing over the synthetic series. Requires an
+		// explicit whole-second resolution (S == 0 needs the engine's
+		// default-interval function) and no @ pinning.
+		stepMs := n.Step.Milliseconds()
+		rangeMs := n.Range.Milliseconds()
+		offsetMs := n.OriginalOffset.Milliseconds()
+		if n.Timestamp == nil && n.StartOrEnd == 0 &&
+			n.RangeExpr == nil && n.StepExpr == nil && n.OriginalOffsetExpr == nil &&
+			stepMs > 0 && stepMs%1000 == 0 && rangeMs%1000 == 0 && offsetMs >= 0 {
+			inner := subqueryGrid(grid, rangeMs, stepMs, offsetMs)
+			n.Expr = rewrite(n.Expr, inner, plan, nameSensitive)
+		}
+	case *parser.StepInvariantExpr, *parser.MatrixSelector,
+		*parser.VectorSelector, *parser.NumberLiteral, *parser.StringLiteral:
+		// Leaves, or scopes substitution must not enter.
+	}
+	return node
+}
+
+func groupingUsesName(grouping []string) bool {
+	for _, g := range grouping {
+		if g == metricNameLabel {
+			return true
+		}
+	}
+	return false
+}
+
+func vectorMatchingUsesName(vm *parser.VectorMatching) bool {
+	if vm == nil {
+		return false
+	}
+	for _, l := range append(append([]string{}, vm.MatchingLabels...), vm.Include...) {
+		if l == metricNameLabel {
+			return true
+		}
+	}
+	// Default (all-labels) matching ignores __name__, and by()/ignoring()
+	// lists were checked above.
+	return false
+}
+
+// isSyntheticSelector reports whether matchers target a compiled unit.
+func isSyntheticSelector(matchers []*labels.Matcher) (string, bool) {
+	for _, m := range matchers {
+		if m.Name == metricNameLabel && m.Type == labels.MatchEqual && strings.HasPrefix(m.Value, syntheticNamePrefix) {
+			return m.Value, true
+		}
+	}
+	return "", false
+}
--- a/pkg/prometheus/clickhouseprometheusv2/transpiler_exec.go
+++ b/pkg/prometheus/clickhouseprometheusv2/transpiler_exec.go
@@ -0,0 +1,541 @@
+package clickhouseprometheusv2
+
+import (
+	"context"
+	"encoding/json"
+	"math"
+	"sort"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/prometheus"
+	"github.com/prometheus/prometheus/model/labels"
+	promValue "github.com/prometheus/prometheus/model/value"
+	"github.com/prometheus/prometheus/promql"
+	"github.com/prometheus/prometheus/promql/parser"
+	"github.com/prometheus/prometheus/storage"
+	"golang.org/x/sync/errgroup"
+)
+
+type executor struct {
+	client *client
+	engine *prometheus.Engine
+	parser prometheus.Parser
+}
+
+// maxWindowBuckets caps range/step for the windowed *_over_time form.
+// Every grid slot combines that many bucket partials. The fleet's windows
+// sit well under the cap ([1m]..[17m] at 30-60s steps). Anything larger is
+// a long-range query whose step a dashboard scales up anyway. The engine
+// path serves the rest.
+const maxWindowBuckets = 64
+
+func (e *executor) TryExecuteRange(ctx context.Context, qs string, start, end time.Time, step time.Duration) (promql.Matrix, bool, error) {
+	expr, err := e.parser.ParseExpr(qs)
+	if err != nil {
+		// Let the engine path produce the (enhanced) parse error.
+		return nil, false, nil
+	}
+
+	plan, ok := classify(expr, queryGrid(start, end, step))
+	if !ok {
+		return nil, false, nil
+	}
+
+	// timeSeriesLastToGrid widens its window to max(window, step). We
+	// probed this: a sample aged (window, step] still fills the slot. The
+	// rate/delta family enforces the window strictly. The Last-style kinds
+	// used to fall back when window < step because of that widening. The
+	// window-sliver filter (see samplesConditions) makes the widening
+	// harmless there: samples exist only inside (t_k - window, t_k]
+	// slivers, so the widened window intersected with the data IS the
+	// lookback window. If a future ClickHouse stops widening, the
+	// unwidened window is the sliver too. Correct either way. A
+	// non-positive window still falls back: the sliver argument needs a
+	// real window to filter to.
+	//
+	// The windowed *_over_time form gates only the range >= step regime.
+	// It decomposes the window into whole step buckets (see windowedInner).
+	// That is exact only when the range is a multiple of the step. The
+	// per-slot slide costs range/step bucket combines; maxWindowBuckets
+	// bounds it, so a long-range short-step query cannot turn the slide
+	// into the bottleneck. range < step needs neither gate: the windows
+	// are disjoint slivers, aggregated one slot each, with no slide. Every
+	// miss falls back to the engine path, which is exact.
+	for _, unit := range plan.units {
+		stepMs := unit.grid.stepMs
+		if stepMs == 0 {
+			stepMs = 1000
+		}
+		switch {
+		case unit.core.kind == unitInstant || (unit.core.kind == unitOverTime && unit.core.overFn == "last"):
+			windowMs := unit.core.rangeMs
+			if unit.core.kind == unitInstant {
+				windowMs = e.client.lookbackMs
+			}
+			if windowMs <= 0 {
+				return nil, false, nil
+			}
+		case unit.core.kind == unitOverTime:
+			if unit.core.rangeMs < unit.grid.stepMs {
+				// Disjoint slivers: no divisibility or width requirement.
+				continue
+			}
+			if unit.core.rangeMs%stepMs != 0 || unit.core.rangeMs/stepMs > maxWindowBuckets {
+				return nil, false, nil
+			}
+		}
+	}
+
+	// Evaluate every unit concurrently on its own grid (the query grid, or a
+	// subquery grid); each is one series lookup plus one grid query.
+	results := make([][]transpiledSeries, len(plan.units))
+	eg, egCtx := errgroup.WithContext(ctx)
+	for i, unit := range plan.units {
+		eg.Go(func() error {
+			res, err := e.executeUnit(egCtx, &unit.core, unit.grid)
+			if err != nil {
+				return err
+			}
+			results[i] = res
+			return nil
+		})
+	}
+	if err := eg.Wait(); err != nil {
+		return nil, true, err
+	}
+
+	if plan.full {
+		g := plan.units[0].grid
+		return toMatrix(results[0], g.startMs, g.stepMs), true, nil
+	}
+
+	matrix, err := e.executeHybrid(ctx, plan, results)
+	if err != nil {
+		return nil, true, err
+	}
+	return matrix, true, nil
+}
+
+// A step of 0 is an instant query: a single evaluation at end, whatever
+// start was.
+func queryGrid(start, end time.Time, step time.Duration) gridContext {
+	startMs, endMs, stepMs := start.UnixMilli(), end.UnixMilli(), step.Milliseconds()
+	if stepMs == 0 {
+		startMs = endMs
+	}
+	return gridContext{startMs: startMs, endMs: endMs, stepMs: stepMs}
+}
+
+// transpiledSeries holds one value pointer per grid point; nil is absent.
+type transpiledSeries struct {
+	lset   labels.Labels
+	values []*float64
+}
+
+func (e *executor) executeUnit(ctx context.Context, unit *coreUnit, grid gridContext) ([]transpiledSeries, error) {
+	startMs, endMs, stepMs := grid.startMs, grid.endMs, grid.stepMs
+	windowMs := unit.rangeMs
+	if unit.kind == unitInstant {
+		windowMs = e.client.lookbackMs
+	}
+	dataStart := startMs - unit.offsetMs - windowMs
+	dataEnd := endMs - unit.offsetMs
+
+	seriesQuery, seriesArgs, err := buildSeriesQuery(dataStart, dataEnd, unit.matchers)
+	if err != nil {
+		return nil, err
+	}
+	lookup, err := e.client.selectSeries(ctx, seriesQuery, seriesArgs)
+	if err != nil {
+		return nil, err
+	}
+	if len(lookup.fingerprints) == 0 {
+		return nil, nil
+	}
+
+	query, args, err := buildUnitSQL(unit, lookup.metricNames, dataStart, dataEnd, startMs, endMs, stepMs, e.client.lookbackMs)
+	if err != nil {
+		return nil, err
+	}
+
+	rows, err := e.client.telemetryStore.ClickhouseDB().Query(e.client.withContext(ctx, "transpiledUnit"), query, args...)
+	if err != nil {
+		return nil, err
+	}
+	defer rows.Close()
+
+	// Name-dropping units keep __name__ in the SQL group key, so distinct
+	// metrics never merge server-side. The name comes off here. Two
+	// metrics can then share a labelset. The engine merges their samples
+	// into one series when they never overlap in time. It raises the
+	// duplicate-labelset error only when two samples land on the same
+	// evaluation timestamp. mergeSameLabelsetSeries reproduces exactly
+	// that.
+	stripName := !unit.hasAgg && !unit.keepsName()
+
+	// by (...) units return one plain column per grouped label. Everything
+	// else returns the single canonical JSON key (see groupKeyColumns).
+	keyNames := groupKeyColumns(unit)
+	keyVals := make([]string, max(len(keyNames), 1))
+	targets := make([]any, 0, len(keyVals)+1)
+	for i := range keyVals {
+		targets = append(targets, &keyVals[i])
+	}
+	var gridValues []*float64
+	targets = append(targets, &gridValues)
+
+	var out []transpiledSeries
+	for rows.Next() {
+		if err := rows.Scan(targets...); err != nil {
+			return nil, err
+		}
+		var lset labels.Labels
+		if keyNames != nil {
+			builder := labels.NewScratchBuilder(len(keyNames))
+			for i, name := range keyNames {
+				// An empty extracted value is the label being absent.
+				if keyVals[i] != "" {
+					builder.Add(name, keyVals[i])
+				}
+			}
+			builder.Sort()
+			lset = builder.Labels()
+		} else {
+			lset, err = labelsFromGroupKey(keyVals[0])
+			if err != nil {
+				return nil, err
+			}
+		}
+		if stripName {
+			lset = labels.NewBuilder(lset).Del(metricNameLabel).Labels()
+		}
+		values := make([]*float64, len(gridValues))
+		copy(values, gridValues)
+		applyScalarOps(unit.ops, values)
+		out = append(out, transpiledSeries{lset: lset, values: values})
+	}
+	if err := rows.Err(); err != nil {
+		return nil, err
+	}
+
+	if stripName {
+		if out, err = mergeSameLabelsetSeries(out); err != nil {
+			return nil, err
+		}
+	}
+	sort.Slice(out, func(i, j int) bool { return labels.Compare(out[i].lset, out[j].lset) < 0 })
+	return out, nil
+}
+
+// mergeSameLabelsetSeries combines series that a name strip left with
+// identical labelsets, slot by slot. The engine assembles its result matrix
+// by labelset. Post-strip twins whose points interleave in time are one
+// series to it. Two values on the same evaluation timestamp are its
+// duplicate-labelset error. v1 errors there too, so to silently pick one
+// value would be a divergence.
+func mergeSameLabelsetSeries(in []transpiledSeries) ([]transpiledSeries, error) {
+	index := make(map[uint64]int, len(in))
+	out := in[:0]
+	for _, s := range in {
+		hash := s.lset.Hash()
+		idx, ok := index[hash]
+		if ok && labels.Equal(out[idx].lset, s.lset) {
+			dst := out[idx].values
+			for k, v := range s.values {
+				if v == nil {
+					continue
+				}
+				if dst[k] != nil {
+					return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "vector cannot contain metrics with the same labelset")
+				}
+				dst[k] = v
+			}
+			continue
+		}
+		index[hash] = len(out)
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+// labelsFromGroupKey parses the toJSONString'd sorted [key, value] pairs.
+func labelsFromGroupKey(gkey string) (labels.Labels, error) {
+	var pairs [][]string
+	if err := json.Unmarshal([]byte(gkey), &pairs); err != nil {
+		return labels.EmptyLabels(), errors.WrapInternalf(err, errors.CodeInternal, "malformed compiled group key %q", gkey)
+	}
+	builder := labels.NewScratchBuilder(len(pairs))
+	for _, p := range pairs {
+		if len(p) != 2 {
+			return labels.EmptyLabels(), errors.NewInternalf(errors.CodeInternal, "malformed compiled group key pair %q", gkey)
+		}
+		builder.Add(p[0], p[1])
+	}
+	builder.Sort()
+	return builder.Labels(), nil
+}
+
+// applyScalarOps applies the number-literal op pipeline in place, with the
+// same float64 arithmetic and comparison-filter semantics as the engine.
+func applyScalarOps(ops []scalarOp, values []*float64) {
+	for _, op := range ops {
+		for i, v := range values {
+			if v == nil {
+				continue
+			}
+			lhs, rhs := *v, op.scalar
+			if op.scalarOnLeft {
+				lhs, rhs = op.scalar, *v
+			}
+			switch op.op {
+			case parser.ADD:
+				res := lhs + rhs
+				values[i] = &res
+			case parser.SUB:
+				res := lhs - rhs
+				values[i] = &res
+			case parser.MUL:
+				res := lhs * rhs
+				values[i] = &res
+			case parser.DIV:
+				res := lhs / rhs
+				values[i] = &res
+			case parser.MOD:
+				res := math.Mod(lhs, rhs)
+				values[i] = &res
+			case parser.POW:
+				res := math.Pow(lhs, rhs)
+				values[i] = &res
+			default:
+				keep := compare(op.op, lhs, rhs)
+				switch {
+				case op.returnBool:
+					res := 0.0
+					if keep {
+						res = 1.0
+					}
+					values[i] = &res
+				case keep:
+					// Filter comparisons keep the vector-side value.
+					vec := *v
+					values[i] = &vec
+				default:
+					values[i] = nil
+				}
+			}
+		}
+	}
+}
+
+func compare(op parser.ItemType, lhs, rhs float64) bool {
+	switch op {
+	case parser.EQLC:
+		return lhs == rhs
+	case parser.NEQ:
+		return lhs != rhs
+	case parser.GTR:
+		return lhs > rhs
+	case parser.LSS:
+		return lhs < rhs
+	case parser.GTE:
+		return lhs >= rhs
+	case parser.LTE:
+		return lhs <= rhs
+	}
+	return false
+}
+
+// toMatrix converts a unit result to a promql matrix on the query grid.
+func toMatrix(series []transpiledSeries, startMs, stepMs int64) promql.Matrix {
+	matrix := make(promql.Matrix, 0, len(series))
+	for _, s := range series {
+		var floats []promql.FPoint
+		for i, v := range s.values {
+			if v == nil {
+				continue
+			}
+			floats = append(floats, promql.FPoint{T: startMs + int64(i)*stepMs, F: *v})
+		}
+		if len(floats) == 0 {
+			continue
+		}
+		matrix = append(matrix, promql.Series{Metric: s.lset, Floats: floats})
+	}
+	return matrix
+}
+
+// executeHybrid substitutes each unit's grids into the engine as synthetic
+// series. It evaluates the rewritten query over a storage that serves
+// synthetic selectors from memory and everything else from the live
+// querier. Absent grid points become stale markers, so the engine's
+// lookback cannot resurrect the previous grid point. Each unit's synthetic
+// samples sit on its own grid: the query grid, or the subquery grid for
+// units inside subqueries.
+func (e *executor) executeHybrid(ctx context.Context, plan *transpilePlan, results [][]transpiledSeries) (promql.Matrix, error) {
+	synthetic := make(map[string][]*series, len(plan.units))
+	staleMarker := math.Float64frombits(promValue.StaleNaN)
+
+	queryGrid := plan.grid
+
+	for i, unit := range plan.units {
+		g := unit.grid
+		gridLen := 1
+		if g.stepMs > 0 {
+			gridLen = int((g.endMs-g.startMs)/g.stepMs) + 1
+		}
+		list := make([]*series, 0, len(results[i]))
+		for _, cs := range results[i] {
+			builder := labels.NewBuilder(cs.lset)
+			builder.Set(metricNameLabel, unit.name)
+			s := &series{lset: builder.Labels()}
+			s.ts = make([]int64, 0, gridLen)
+			s.vs = make([]float64, 0, gridLen)
+			for idx := 0; idx < gridLen; idx++ {
+				t := g.startMs + int64(idx)*g.stepMs
+				var v float64
+				if idx < len(cs.values) && cs.values[idx] != nil {
+					v = *cs.values[idx]
+				} else {
+					v = staleMarker
+				}
+				s.ts = append(s.ts, t)
+				s.vs = append(s.vs, v)
+			}
+			list = append(list, s)
+		}
+		synthetic[unit.name] = list
+	}
+
+	hybrid := &hybridQueryable{client: e.client, synthetic: synthetic}
+
+	var qry promql.Query
+	var err error
+	if queryGrid.stepMs == 0 {
+		qry, err = e.engine.NewInstantQuery(ctx, hybrid, nil, plan.rewritten, time.UnixMilli(queryGrid.endMs))
+	} else {
+		qry, err = e.engine.NewRangeQuery(ctx, hybrid, nil, plan.rewritten, time.UnixMilli(queryGrid.startMs), time.UnixMilli(queryGrid.endMs), time.Duration(queryGrid.stepMs)*time.Millisecond)
+	}
+	if err != nil {
+		return nil, err
+	}
+	defer qry.Close()
+
+	res := qry.Exec(ctx)
+	if res.Err != nil {
+		return nil, res.Err
+	}
+
+	matrix, err := resultToMatrix(res)
+	if err != nil {
+		return nil, err
+	}
+
+	// Deep-copy before Close returns the result's slices to the engine pool,
+	// and drop the synthetic __name__ that filter comparisons preserve.
+	out := make(promql.Matrix, 0, len(matrix))
+	for _, s := range matrix {
+		lset := s.Metric
+		if name := lset.Get(metricNameLabel); len(name) >= len(syntheticNamePrefix) && name[:len(syntheticNamePrefix)] == syntheticNamePrefix {
+			builder := labels.NewBuilder(lset)
+			builder.Del(metricNameLabel)
+			lset = builder.Labels()
+		}
+		floats := make([]promql.FPoint, len(s.Floats))
+		copy(floats, s.Floats)
+		out = append(out, promql.Series{Metric: lset.Copy(), Floats: floats})
+	}
+	// The strip can leave twins: two units' outputs that only their
+	// synthetic names told apart (e.g. -metric_a or -metric_b, both {}
+	// once real names are dropped). The engine assembles its matrix by
+	// labelset. It merges such temporally-disjoint elements into one
+	// series. Reproduce that, with its duplicate error on same-timestamp
+	// overlap.
+	out, err = mergeMatrixByLabelset(out)
+	if err != nil {
+		return nil, err
+	}
+	sort.Slice(out, func(i, j int) bool { return labels.Compare(out[i].Metric, out[j].Metric) < 0 })
+	return out, nil
+}
+
+// mergeMatrixByLabelset merges series that share a labelset. It interleaves
+// their points in timestamp order. A timestamp present in both is the
+// engine's duplicate-labelset error.
+func mergeMatrixByLabelset(matrix promql.Matrix) (promql.Matrix, error) {
+	index := make(map[uint64]int, len(matrix))
+	out := matrix[:0]
+	for _, s := range matrix {
+		hash := s.Metric.Hash()
+		idx, ok := index[hash]
+		if ok && labels.Equal(out[idx].Metric, s.Metric) {
+			merged := make([]promql.FPoint, 0, len(out[idx].Floats)+len(s.Floats))
+			a, b := out[idx].Floats, s.Floats
+			for len(a) > 0 && len(b) > 0 {
+				switch {
+				case a[0].T < b[0].T:
+					merged, a = append(merged, a[0]), a[1:]
+				case b[0].T < a[0].T:
+					merged, b = append(merged, b[0]), b[1:]
+				default:
+					return nil, errors.NewInvalidInputf(errors.CodeInvalidInput, "vector cannot contain metrics with the same labelset")
+				}
+			}
+			out[idx].Floats = append(append(merged, a...), b...)
+			continue
+		}
+		index[hash] = len(out)
+		out = append(out, s)
+	}
+	return out, nil
+}
+
+func resultToMatrix(res *promql.Result) (promql.Matrix, error) {
+	switch v := res.Value.(type) {
+	case promql.Matrix:
+		return v, nil
+	case promql.Vector:
+		matrix := make(promql.Matrix, 0, len(v))
+		for _, s := range v {
+			matrix = append(matrix, promql.Series{Metric: s.Metric, Floats: []promql.FPoint{{T: s.T, F: s.F}}})
+		}
+		return matrix, nil
+	case promql.Scalar:
+		return promql.Matrix{{Metric: labels.EmptyLabels(), Floats: []promql.FPoint{{T: v.T, F: v.V}}}}, nil
+	default:
+		return nil, errors.NewInternalf(errors.CodeInternal, "unexpected hybrid result type %T", res.Value)
+	}
+}
+
+// hybridQueryable serves synthetic (compiled) selectors from memory and
+// everything else from the live storage.
+type hybridQueryable struct {
+	client    *client
+	synthetic map[string][]*series
+}
+
+func (h *hybridQueryable) Querier(mint, maxt int64) (storage.Querier, error) {
+	return &hybridQuerier{
+		querier:   querier{mint: mint, maxt: maxt, client: h.client},
+		synthetic: h.synthetic,
+	}, nil
+}
+
+type hybridQuerier struct {
+	querier
+	synthetic map[string][]*series
+}
+
+func (h *hybridQuerier) Select(ctx context.Context, sortSeries bool, hints *storage.SelectHints, matchers ...*labels.Matcher) storage.SeriesSet {
+	if name, ok := isSyntheticSelector(matchers); ok {
+		list := h.synthetic[name]
+		if sortSeries {
+			sorted := make([]*series, len(list))
+			copy(sorted, list)
+			sort.Slice(sorted, func(i, j int) bool { return labels.Compare(sorted[i].lset, sorted[j].lset) < 0 })
+			list = sorted
+		}
+		return newSeriesSet(list)
+	}
+	return h.querier.Select(ctx, sortSeries, hints, matchers...)
+}
--- a/pkg/prometheus/clickhouseprometheusv2/transpiler_sql.go
+++ b/pkg/prometheus/clickhouseprometheusv2/transpiler_sql.go
@@ -0,0 +1,415 @@
+package clickhouseprometheusv2
+
+import (
+	"fmt"
+	"strings"
+
+	"github.com/SigNoz/signoz/pkg/telemetryschema/metricstelemetryschema"
+	"github.com/huandu/go-sqlbuilder"
+)
+
+// experimental gate for the timeSeries*ToGrid aggregate functions; attached
+// as a SETTINGS clause so telemetrystore hooks cannot clobber it.
+const gridFunctionsSetting = "SETTINGS allow_experimental_ts_to_grid_aggregate_function = 1"
+
+var aggForEach = map[string]string{
+	"sum":   "sumForEach",
+	"min":   "minForEach",
+	"max":   "maxForEach",
+	"avg":   "avgForEach",
+	"count": "countForEach",
+}
+
+// buildUnitSQL renders the single ClickHouse statement that evaluates one
+// core unit over the [startMs, endMs] / stepMs grid. The inner level
+// computes per-series grids with a timeSeries*ToGrid aggregate, or with a
+// windowed aggregation for *_over_time. The outer level is the spatial
+// aggregation: -ForEach combinators grouped by the projected group key.
+//
+// The heavy level runs on the shards. The top-level FROM is the distributed
+// samples table. The group-key join partner is a subquery on the
+// shard-local time series table. So the shard rewrite executes the join and
+// the per-series aggregation next to the data. Fingerprint co-locality
+// makes this complete: samples and series shard on the same key. The
+// initiator only merges the per-series states and applies the spatial
+// -ForEach step. This is the same layout as the telemetrymetrics statement
+// builder. The windowed *_over_time form shares the frame but holds
+// per-bucket partials inside each series group (see windowedInner).
+//
+// The offset shifts the selector's data window. The grid indices map 1:1
+// onto the query grid: output ts = startMs + i*stepMs. Grid parameters
+// render as literals. They are aggregate-function parameters, not bindable
+// values.
+//
+// Statements nest builder-rendered SQL as text. So the returned args must
+// follow the position of each fragment in the final statement: ClickHouse
+// binds ? placeholders by position. A JOIN renders before WHERE, so a
+// joined subquery's args come before the outer query's condition args.
+//
+// Row shape: the group-key columns (see groupKeyColumns), then grid
+// Array(Nullable(Float64)). A NULL grid point is an absent point, the
+// engine's "no value here". The -ForEach combinators preserve it: an index
+// where every series is NULL aggregates to NULL, and countForEach's 0 maps
+// back to NULL.
+func buildUnitSQL(unit *coreUnit, metricNames []string, dataStart, dataEnd int64, startMs, endMs, stepMs, lookbackMs int64) (string, []any, error) {
+	selStart := startMs - unit.offsetMs
+	selEnd := endMs - unit.offsetMs
+	stepSec := stepMs / 1000
+	if stepSec == 0 {
+		// Instant query: start == end, so the grid has one point for any
+		// positive step.
+		stepSec = 1
+	}
+	windowMs := unit.rangeMs
+	if unit.kind == unitInstant {
+		windowMs = lookbackMs
+	}
+	windowSec := windowMs / 1000
+
+	adjustedTsStartU, _, _, localTsTable := metricstelemetryschema.WhichTSTableToUse(uint64(dataStart), uint64(dataEnd), false, nil)
+	adjustedTsStart := int64(adjustedTsStartU)
+	keyNames := groupKeyColumns(unit)
+
+	// seriesSub computes fingerprint -> group key columns. It reads the
+	// local series table when it rides inside the shard-rewritten samples
+	// query, and the distributed one when it joins at the initiator
+	// (windowed form).
+	seriesSub := func(table string) (string, []any, error) {
+		sub := sqlbuilder.NewSelectBuilder()
+		selects := []string{"fingerprint"}
+		if keyNames == nil {
+			selects = append(selects, groupKeyExpr(unit)+" AS gkey")
+		} else {
+			// by (...) grouping extracts exactly the listed labels as plain
+			// columns: no reason to build, sort and stringify every label
+			// pair per row when the projection is a known short list and
+			// the label names live in Go anyway.
+			for i, name := range keyNames {
+				selects = append(selects, fmt.Sprintf("JSONExtractString(labels, %s) AS g%d", sub.Var(name), i))
+			}
+		}
+		sub.Select(selects...)
+		sub.From(fmt.Sprintf("%s.%s", metricstelemetryschema.DBName, table))
+		if err := applySeriesConditions(sub, adjustedTsStart, dataEnd, unit.matchers); err != nil {
+			return "", nil, err
+		}
+		sub.GroupBy(append([]string{"fingerprint"}, keyColumnAliases(keyNames)...)...)
+		q, args := sub.BuildWithFlavor(sqlbuilder.ClickHouse)
+		return q, args, nil
+	}
+
+	// samplesConditions adds the samples-side WHERE. The group-key join
+	// restricts to the matched series; no fingerprint condition is added
+	// here.
+	samplesConditions := func(sb *sqlbuilder.SelectBuilder, excludeStale bool) {
+		switch len(metricNames) {
+		case 0:
+			// No name constraint derivable; correct but unable to use the
+			// metric_name primary-key prefix.
+		case 1:
+			sb.Where(sb.EQ("metric_name", metricNames[0]))
+		default:
+			sb.Where(sb.In("metric_name", sqlbuilder.List(metricNames)))
+		}
+		// temporality precedes metric_name in the samples primary key; the
+		// fingerprints already come from these temporalities, so this only
+		// helps granule pruning.
+		sb.Where("temporality IN ['Cumulative', 'Unspecified']")
+		// When the window is narrower than the step, the grid windows
+		// (t_k − window, t_k] cover only window/step of the timeline. A
+		// sample in a gap belongs to no window. It cannot move any grid
+		// point, but the grid aggregate buffers every row it is fed. This
+		// predicate keeps only the in-window rows. It cut a 36k-series
+		// one-week rate from 74s/28GiB to 16s/4.3GiB on fleet data: the
+		// read stays the same, and the aggregate input shrinks by the
+		// coverage ratio. The lattice anchors at selStart, because the end
+		// can sit off-lattice on unaligned grids. positiveModulo is
+		// necessary because samples above selStart make the dividend
+		// negative. The upper bound tightens to the last grid point: rows
+		// past it are equally windowless. When window >= step, the windows
+		// tile the timeline, and the plain bounds stay.
+		sliver := stepMs > 0 && windowMs > 0 && windowMs < stepMs
+		upper := selEnd
+		if sliver {
+			upper = selStart + (selEnd-selStart)/stepMs*stepMs
+		}
+		// Left-open window: a sample exactly at the window's lower boundary
+		// is never used (range selectors and lookback are both left-open).
+		sb.Where(sb.GT("unix_milli", selStart-windowMs), sb.LTE("unix_milli", upper))
+		if sliver {
+			sb.Where(fmt.Sprintf("positiveModulo(%s - unix_milli, %s) < %s",
+				sb.Var(selStart), sb.Var(stepMs), sb.Var(windowMs)))
+		}
+		if excludeStale {
+			// PromQL excludes stale markers from range vectors. Instant
+			// selectors need the stale rows for shadowing instead.
+			sb.Where("bitAnd(flags, 1) = 0")
+		}
+	}
+
+	keyCols := keyColumnAliases(keyNames)
+
+	// joinedInner builds the shard-side SELECT for the single-pass kinds:
+	// grid expression per (fingerprint, group key), group-key join against
+	// the local series table.
+	joinedInner := func(gridExpr string, excludeStale bool) (string, []any, error) {
+		seriesSQL, seriesArgs, err := seriesSub(localTsTable)
+		if err != nil {
+			return "", nil, err
+		}
+		sb := sqlbuilder.NewSelectBuilder()
+		selects := make([]string, 0, len(keyCols)+1)
+		// A fingerprint is the hash of one labelset, so every group-key
+		// column is functionally dependent on it: any() is exact, and
+		// grouping by the fingerprint alone spares hashing the joined
+		// string per sample row — measured -10-13% on a 1.9B-row rate.
+		for _, col := range keyCols {
+			selects = append(selects, fmt.Sprintf("any(series.%s) AS %s", col, col))
+		}
+		sb.Select(append(selects, gridExpr+" AS grid")...)
+		sb.From(fmt.Sprintf("%s.%s AS points", metricstelemetryschema.DBName, metricstelemetryschema.SamplesV4TableName))
+		sb.JoinWithOption(sqlbuilder.InnerJoin, fmt.Sprintf("(%s) AS series", seriesSQL), "points.fingerprint = series.fingerprint")
+		samplesConditions(sb, excludeStale)
+		sb.GroupBy("points.fingerprint")
+		q, args := sb.BuildWithFlavor(sqlbuilder.ClickHouse)
+		// The join text renders before WHERE: its args come first.
+		return q, append(seriesArgs, args...), nil
+	}
+
+	var inner string
+	var innerArgs []any
+	var err error
+	switch unit.kind {
+	case unitInstant:
+		// Instant selection with stale shadowing: the grid value is the last
+		// non-stale sample in (t-lookback, t], absent when the overall last
+		// sample in that window is a stale marker (verified semantics: the
+		// -If combinator applies to the grid aggregates, and NULL comparisons
+		// make a stale-latest point absent).
+		gridParams := fmt.Sprintf("(fromUnixTimestamp64Milli(%d), fromUnixTimestamp64Milli(%d), %d, %d)", selStart, selEnd, stepSec, windowSec)
+		gridExpr := fmt.Sprintf(
+			"arrayMap((tall, tok, vok) -> if(tall IS NULL OR tok IS NULL OR tall != tok, NULL, vok), timeSeriesLastToGrid%s(fromUnixTimestamp64Milli(unix_milli), toFloat64(unix_milli)), timeSeriesLastToGridIf%s(fromUnixTimestamp64Milli(unix_milli), toFloat64(unix_milli), bitAnd(flags, 1) = 0), timeSeriesLastToGridIf%s(fromUnixTimestamp64Milli(unix_milli), value, bitAnd(flags, 1) = 0))",
+			gridParams, gridParams, gridParams,
+		)
+		inner, innerArgs, err = joinedInner(gridExpr, false)
+	case unitOverTime:
+		if unit.overFn == "last" {
+			// last_over_time == last non-stale sample in the window: the
+			// stale rows are already excluded in WHERE.
+			gridExpr := fmt.Sprintf(
+				"timeSeriesLastToGrid(fromUnixTimestamp64Milli(%d), fromUnixTimestamp64Milli(%d), %d, %d)(fromUnixTimestamp64Milli(unix_milli), value)",
+				selStart, selEnd, stepSec, windowSec,
+			)
+			inner, innerArgs, err = joinedInner(gridExpr, true)
+			break
+		}
+		inner, innerArgs, err = windowedInner(unit, samplesConditions, seriesSub, keyCols, localTsTable, selStart, selEnd, stepMs, windowMs)
+	default: // unitRange
+		gridExpr := fmt.Sprintf(
+			"%s(fromUnixTimestamp64Milli(%d), fromUnixTimestamp64Milli(%d), %d, %d)(fromUnixTimestamp64Milli(unix_milli), value)",
+			gridFunction[unit.fn], selStart, selEnd, stepSec, windowSec,
+		)
+		if unit.fn == fnIncrease {
+			// increase == rate * range-seconds, exactly: extrapolatedRate
+			// divides by the range only when isRate.
+			gridExpr = fmt.Sprintf("arrayMap(x -> x * %d, %s)", windowSec, gridExpr)
+		}
+		inner, innerArgs, err = joinedInner(gridExpr, true)
+	}
+	if err != nil {
+		return "", nil, err
+	}
+
+	spatial := "maxForEach(grid)"
+	switch {
+	case !unit.hasAgg:
+		// Per-series output: one row per (labels-minus-__name__) group.
+		// Distinct fingerprints can collapse onto the same projected label
+		// set only via a regex __name__ selector over metrics with identical
+		// other labels; maxForEach is a deterministic NULL-skipping merge and
+		// the identity for the overwhelmingly common one-fingerprint group.
+	case unit.aggOp.String() == "count":
+		// count over an all-absent index is an absent point, not 0.
+		spatial = "arrayMap(c -> if(c = 0, NULL, toFloat64(c)), countForEach(grid))"
+	default:
+		spatial = fmt.Sprintf("%s(grid)", aggForEach[unit.aggOp.String()])
+	}
+
+	keyList := strings.Join(keyCols, ", ")
+	query := fmt.Sprintf("SELECT %s, %s AS grid FROM (%s) GROUP BY %s %s", keyList, spatial, inner, keyList, gridFunctionsSetting)
+	return query, innerArgs, nil
+}
+
+// groupKeyColumns returns the label names to extract as plain group-key
+// columns, or nil when the unit needs the canonical JSON key instead. Only
+// by (...) grouping qualifies: its projection is a known short list, so
+// extracting each label directly beats building, sorting and stringifying
+// every label pair per row. without and no-aggregation project a label SET
+// that varies per series — there the sorted-JSON key is load-bearing: the
+// sort is what makes two fingerprints with different stored JSON key order
+// land in one group, and the string carries the labels back out.
+func groupKeyColumns(unit *coreUnit) []string {
+	if unit.hasAgg && unit.by && len(unit.grouping) > 0 {
+		return unit.grouping
+	}
+	return nil
+}
+
+// keyColumnAliases names the group-key columns in every SELECT level: g0..gN
+// for direct extraction, the single canonical gkey otherwise.
+func keyColumnAliases(keyNames []string) []string {
+	if keyNames == nil {
+		return []string{"gkey"}
+	}
+	cols := make([]string, len(keyNames))
+	for i := range keyNames {
+		cols[i] = fmt.Sprintf("g%d", i)
+	}
+	return cols
+}
+
+// windowedInner builds the avg/min/max/sum/count _over_time form without
+// fanning samples out. It runs only when the range is a whole multiple of
+// the step (see the transpile gate), because then the window
+// (t_k - range, t_k] is exactly the union of W = range/step step buckets —
+// both are left-open on the same boundaries — so bucket membership fully
+// determines window membership. Fanning each sample into all W windows it
+// covers (ARRAY JOIN) multiplies rows by W, which at long ranges over short
+// steps is a row explosion measured in billions.
+//
+// The bucketing itself is the -Resample combinator: one group per (series,
+// group key) whose state is a fixed array of per-bucket aggregates, updated
+// in place per sample. Grouping by (series, bucket) instead — measured on a
+// 100k-series x 371-bucket workload — creates a 37M-entry hash aggregation
+// whose per-thread partial tables scale memory WITH max_threads (12 -> 48
+// GiB from 2 to 8 threads, dead at 16) and ships one row per group to the
+// initiator; the Resample form carries the same numbers in 100k compact
+// array states, like every other unit kind.
+//
+// The wrapper level slides the window: slot k combines buckets k..k+W-1 by
+// direct aggregation over at most W partials — no prefix-sum tricks, so no
+// large-minus-large cancellation against the engine's directly-summed
+// windows. A slot with zero window count is absent, which also keeps
+// min/max honest: their slices filter on the bucket counts, so an empty
+// bucket's zero-fill can never be mistaken for a value (a real sample can
+// legitimately be 0 or +Inf).
+func windowedInner(unit *coreUnit, samplesConditions func(*sqlbuilder.SelectBuilder, bool), seriesSub func(string) (string, []any, error), keyCols []string, localSeriesTable string, selStart, selEnd, stepMs, windowMs int64) (string, []any, error) {
+	effStepMs := stepMs
+	if effStepMs == 0 {
+		effStepMs = 1000
+	}
+	lastIdx := (selEnd - selStart) / effStepMs
+	gridLen := lastIdx + 1
+	w := windowMs / effStepMs
+	bucketLen := gridLen + w
+
+	// A window narrower than the step makes the windows (t_k - range, t_k]
+	// pairwise disjoint. There is nothing to slide. Each slot reads exactly
+	// its own window's aggregate. This is exact ONLY over sliver-filtered
+	// rows (samplesConditions adds the window<step predicate): the index
+	// below assigns every gap sample to the window above it, and the
+	// filter removes those samples. This needs a real step. Instant
+	// queries carry no sliver filter, so they keep the tiled form and its
+	// gates.
+	disjoint := stepMs > 0 && windowMs < stepMs
+	if disjoint {
+		w = 1
+		bucketLen = gridLen
+	}
+
+	seriesSQL, seriesArgs, err := seriesSub(localSeriesTable)
+	if err != nil {
+		return "", nil, err
+	}
+
+	// Bucket index, shifted so the earliest in-window sample lands at 0:
+	// jj = ceil((ts - selStart)/step) + W - 1, folded into one intDiv.
+	// Slot k's window is then buckets jj in [k, k+W-1]. In the disjoint
+	// form, the same ceil lands each in-window sample directly on its slot
+	// (W = 1). The numerator stays positive: the fetch floor is
+	// selStart - range > selStart - step.
+	jjShift := windowMs
+	if disjoint {
+		jjShift = effStepMs
+	}
+	jj := fmt.Sprintf("intDiv(unix_milli - %d + %d - 1, %d)", selStart, jjShift, effStepMs)
+	buckets := sqlbuilder.NewSelectBuilder()
+	selects := make([]string, 0, len(keyCols)+2)
+	// any() over the group key: exact because the key is functionally
+	// dependent on the fingerprint (see joinedInner).
+	for _, col := range keyCols {
+		selects = append(selects, fmt.Sprintf("any(series.%s) AS %s", col, col))
+	}
+	selects = append(selects, fmt.Sprintf("countResample(0, %d, 1)(value, %s) AS cnts", bucketLen, jj))
+	if unit.overFn != "count" {
+		selects = append(selects, fmt.Sprintf("%sResample(0, %d, 1)(value, %s) AS vals", map[string]string{
+			"avg": "sum",
+			"sum": "sum",
+			"min": "min",
+			"max": "max",
+		}[unit.overFn], bucketLen, jj))
+	}
+	buckets.Select(selects...)
+	buckets.From(fmt.Sprintf("%s.%s AS points", metricstelemetryschema.DBName, metricstelemetryschema.SamplesV4TableName))
+	buckets.JoinWithOption(sqlbuilder.InnerJoin, fmt.Sprintf("(%s) AS series", seriesSQL), "points.fingerprint = series.fingerprint")
+	samplesConditions(buckets, true)
+	buckets.GroupBy("points.fingerprint")
+	bucketsSQL, bucketsArgs := buckets.BuildWithFlavor(sqlbuilder.ClickHouse)
+
+	windowCnt := fmt.Sprintf("arraySum(arraySlice(cnts, k + 1, %d))", w)
+	var slot string
+	switch unit.overFn {
+	case "count":
+		slot = fmt.Sprintf("if(%s = 0, NULL, toFloat64(%s))", windowCnt, windowCnt)
+	case "sum":
+		slot = fmt.Sprintf("if(%s = 0, NULL, arraySum(arraySlice(vals, k + 1, %d)))", windowCnt, w)
+	case "avg":
+		slot = fmt.Sprintf("if(%s = 0, NULL, arraySum(arraySlice(vals, k + 1, %d)) / %s)", windowCnt, w, windowCnt)
+	case "min":
+		slot = fmt.Sprintf("if(%s = 0, NULL, arrayMin(arrayFilter((v, c) -> c > 0, arraySlice(vals, k + 1, %d), arraySlice(cnts, k + 1, %d))))", windowCnt, w, w)
+	case "max":
+		slot = fmt.Sprintf("if(%s = 0, NULL, arrayMax(arrayFilter((v, c) -> c > 0, arraySlice(vals, k + 1, %d), arraySlice(cnts, k + 1, %d))))", windowCnt, w, w)
+	}
+
+	keyList := strings.Join(keyCols, ", ")
+	inner := fmt.Sprintf(
+		"SELECT %s, arrayMap(k -> %s, range(toUInt64(%d))) AS grid FROM (%s)",
+		keyList, slot, gridLen, bucketsSQL,
+	)
+	return inner, append(seriesArgs, bucketsArgs...), nil
+}
+
+// groupKeyExpr renders the canonical JSON group key for the units whose
+// projected label SET varies per series (see groupKeyColumns): the sorted
+// [key, value] pairs of the projected labels, JSON-encoded.
+//   - by () with no labels: one constant group;
+//   - without (a, b): keep everything except the listed labels and __name__;
+//   - no aggregation: keep everything including __name__ — even when the
+//     unit drops the name from its OUTPUT, the key must keep it so distinct
+//     metrics never merge in SQL; executeUnit strips the name afterwards and
+//     turns a post-strip collision into the engine's duplicate-labelset
+//     error instead of a silently invented merge.
+func groupKeyExpr(unit *coreUnit) string {
+	// An empty label value means "label absent" in Prometheus; the stored
+	// labels JSON can carry empty attribute values, which must not become
+	// output labels or group keys.
+	pairs := "arraySort(JSONExtractKeysAndValues(labels, 'String'))"
+	if !unit.hasAgg {
+		return fmt.Sprintf("toJSONString(arrayFilter(p -> p.2 != '', %s))", pairs)
+	}
+	if unit.by {
+		// Non-empty by (...) never reaches here; groupKeyColumns extracts
+		// those labels as plain columns instead.
+		return "'[]'"
+	}
+	excluded := append([]string{metricNameLabel}, unit.grouping...)
+	return fmt.Sprintf("toJSONString(arrayFilter(p -> p.2 != '' AND p.1 NOT IN (%s), %s))", quotedList(excluded), pairs)
+}
+
+func quotedList(items []string) string {
+	quoted := make([]string, len(items))
+	for i, s := range items {
+		quoted[i] = "'" + strings.ReplaceAll(s, "'", "\\'") + "'"
+	}
+	return strings.Join(quoted, ", ")
+}
--- a/pkg/prometheus/clickhouseprometheusv2/transpiler_test.go
+++ b/pkg/prometheus/clickhouseprometheusv2/transpiler_test.go
@@ -0,0 +1,698 @@
+package clickhouseprometheusv2
+
+import (
+	"context"
+	"testing"
+	"time"
+
+	"github.com/DATA-DOG/go-sqlmock"
+	cmock "github.com/SigNoz/clickhouse-go-mock"
+	"github.com/SigNoz/signoz/pkg/errors"
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/instrumentation/instrumentationtest"
+	"github.com/SigNoz/signoz/pkg/prometheus"
+	"github.com/SigNoz/signoz/pkg/telemetrystore"
+	"github.com/SigNoz/signoz/pkg/telemetrystore/telemetrystoretest"
+	"github.com/prometheus/prometheus/model/labels"
+	"github.com/prometheus/prometheus/promql"
+	"github.com/prometheus/prometheus/promql/parser"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+func newTestClient(t *testing.T) (*client, *telemetrystoretest.Provider) {
+	t.Helper()
+	store := telemetrystoretest.New(telemetrystore.Config{Provider: "clickhouse"}, sqlmock.QueryMatcherRegexp)
+	settings := factory.NewScopedProviderSettings(instrumentationtest.New().ToProviderSettings(), "clickhouseprometheusv2_test")
+	return newClient(settings, store, prometheus.Config{}), store
+}
+
+var seriesCols = []cmock.ColumnType{
+	{Name: "fingerprint", Type: "UInt64"},
+	{Name: "labels", Type: "String"},
+}
+
+func parse(t *testing.T, q string) parser.Expr {
+	t.Helper()
+	expr, err := parser.NewParser(parser.Options{}).ParseExpr(q)
+	require.NoError(t, err)
+	return expr
+}
+
+func TestClassifyFullShapes(t *testing.T) {
+	tests := []struct {
+		name  string
+		query string
+		check func(t *testing.T, u *coreUnit)
+	}{
+		{
+			name:  "sum by rate",
+			query: `sum by (pod) (rate(http_requests_total{job="api"}[5m]))`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, fnRate, u.fn)
+				assert.Equal(t, int64(300_000), u.rangeMs)
+				assert.True(t, u.hasAgg)
+				assert.True(t, u.by)
+				assert.Equal(t, []string{"pod"}, u.grouping)
+			},
+		},
+		{
+			name:  "bare increase with offset",
+			query: `increase(errors_total[10m] offset 30m)`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, fnIncrease, u.fn)
+				assert.Equal(t, int64(1_800_000), u.offsetMs)
+				assert.False(t, u.hasAgg)
+			},
+		},
+		{
+			name:  "avg without over delta",
+			query: `avg without (instance) (delta(gauge_metric[15m]))`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, fnDelta, u.fn)
+				assert.True(t, u.hasAgg)
+				assert.False(t, u.by)
+			},
+		},
+		{
+			name:  "scalar pipeline with comparison",
+			query: `sum(rate(x[5m])) * 100 > 5`,
+			check: func(t *testing.T, u *coreUnit) {
+				require.Len(t, u.ops, 2)
+				assert.Equal(t, parser.ItemType(parser.MUL), u.ops[0].op)
+				assert.Equal(t, 100.0, u.ops[0].scalar)
+				assert.Equal(t, parser.ItemType(parser.GTR), u.ops[1].op)
+			},
+		},
+		{
+			name:  "scalar on left with unary minus",
+			query: `-1 * sum(rate(x[5m]))`,
+			check: func(t *testing.T, u *coreUnit) {
+				require.Len(t, u.ops, 1)
+				assert.True(t, u.ops[0].scalarOnLeft)
+				assert.Equal(t, -1.0, u.ops[0].scalar)
+			},
+		},
+		{
+			name:  "bool comparison",
+			query: `sum(rate(x[5m])) >= bool 0.5`,
+			check: func(t *testing.T, u *coreUnit) {
+				require.Len(t, u.ops, 1)
+				assert.True(t, u.ops[0].returnBool)
+			},
+		},
+		{
+			name:  "irate utf8 name",
+			query: `sum by ("k8s.pod.name") (irate({"k8s.container.cpu.time"}[2m]))`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, fnIRate, u.fn)
+				assert.Equal(t, []string{"k8s.pod.name"}, u.grouping)
+			},
+		},
+		{
+			name:  "bare instant selector keeps name",
+			query: `up{job="api"}`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, unitInstant, u.kind)
+				assert.True(t, u.keepsName())
+			},
+		},
+		{
+			name:  "gauge aggregation",
+			query: `sum by (pod) (container_memory offset 5m)`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, unitInstant, u.kind)
+				assert.Equal(t, int64(300_000), u.offsetMs)
+				assert.True(t, u.hasAgg)
+				assert.False(t, u.keepsName())
+			},
+		},
+		{
+			name:  "gauge comparison keeps name",
+			query: `container_memory > 100`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, unitInstant, u.kind)
+				assert.True(t, u.keepsName())
+			},
+		},
+		{
+			name:  "gauge arithmetic drops name",
+			query: `container_memory / 1024`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, unitInstant, u.kind)
+				assert.False(t, u.keepsName())
+			},
+		},
+		{
+			name:  "avg_over_time",
+			query: `max by (node) (avg_over_time(load1[10m]))`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, unitOverTime, u.kind)
+				assert.Equal(t, "avg", u.overFn)
+				assert.Equal(t, int64(600_000), u.rangeMs)
+			},
+		},
+		{
+			name:  "last_over_time keeps name",
+			query: `last_over_time(load1[10m])`,
+			check: func(t *testing.T, u *coreUnit) {
+				assert.Equal(t, unitOverTime, u.kind)
+				assert.Equal(t, "last", u.overFn)
+				assert.True(t, u.keepsName())
+			},
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			plan, ok := classify(parse(t, tt.query), testGrid(60_000))
+			require.True(t, ok, "expected transpilable")
+			require.True(t, plan.full, "expected full compilation")
+			require.Len(t, plan.units, 1)
+			tt.check(t, &plan.units[0].core)
+		})
+	}
+}
+
+func TestClassifyFallbackShapes(t *testing.T) {
+	queries := []struct {
+		name  string
+		query string
+		step  int64
+	}{
+		{"default-resolution subquery", `max_over_time(rate(x[5m])[30m:])`, 60_000},
+		{"at modifier", `sum(rate(x[5m] @ 1609746000))`, 60_000},
+		{"at modifier on gauge", `sum(container_memory @ 1609746000)`, 60_000},
+		{"sub-second step", `sum(rate(x[5m]))`, 500},
+		{"sub-second range", `sum(rate(x[1500ms]))`, 60_000},
+		{"by __name__ full", `sum by (__name__) (rate({__name__=~"a|b"}[5m]))`, 60_000},
+		{"quantile_over_time unsupported", `quantile_over_time(0.9, load1[10m])`, 60_000},
+		// Duration expressions resolve into the selectors' static fields only
+		// at evaluation time; classification reads those fields as zero, so
+		// transpiling would silently use the wrong offset (caught by the
+		// conformance corpus' duration_expression.test cases). Offset
+		// expressions parse without the experimental-parser flag, so they do
+		// reach the transpiler; range-position expressions are rejected at
+		// parse (the RangeExpr/StepExpr guards are defense-in-depth).
+		{"duration expression offset on instant", `x offset step()`, 60_000},
+		{"duration expression offset arithmetic", `x offset -step()*2`, 60_000},
+		{"duration expression offset on range", `sum(rate(x[5m] offset max(3s, step())))`, 60_000},
+		{"duration expression subquery step", `max_over_time(rate(x[5m])[30m:step()])`, 60_000},
+	}
+	for _, tt := range queries {
+		t.Run(tt.name, func(t *testing.T) {
+			_, ok := classify(parse(t, tt.query), testGrid(tt.step))
+			assert.False(t, ok, "expected fallback for %s", tt.query)
+		})
+	}
+}
+
+func TestClassifyHybridShapes(t *testing.T) {
+	tests := []struct {
+		name          string
+		query         string
+		wantUnits     int
+		wantRewritten string
+	}{
+		{
+			name:          "histogram quantile",
+			query:         `histogram_quantile(0.95, sum by (le) (rate(http_bucket[5m])))`,
+			wantUnits:     1,
+			wantRewritten: `histogram_quantile(0.95, __signoz_transpiled_0__)`,
+		},
+		{
+			name:          "topk over compiled",
+			query:         `topk(5, sum by (pod) (rate(x[5m])))`,
+			wantUnits:     1,
+			wantRewritten: `topk(5, __signoz_transpiled_0__)`,
+		},
+		{
+			name:          "ratio of compiled units",
+			query:         `sum(rate(a[5m])) / sum(rate(b[5m]))`,
+			wantUnits:     2,
+			wantRewritten: `__signoz_transpiled_0__ / __signoz_transpiled_1__`,
+		},
+		{
+			name:          "or vector zero",
+			query:         `sum(rate(a[5m])) or vector(0)`,
+			wantUnits:     1,
+			wantRewritten: `__signoz_transpiled_0__ or vector(0)`,
+		},
+		{
+			name:          "quantile agg over compiled rate",
+			query:         `quantile(0.9, rate(x[5m]))`,
+			wantUnits:     1,
+			wantRewritten: `quantile(0.9, __signoz_transpiled_0__)`,
+		},
+		{
+			name:          "non-literal scalar side stays engine-side",
+			query:         `sum(rate(x[5m])) * scalar(y)`,
+			wantUnits:     1,
+			wantRewritten: `__signoz_transpiled_0__ * scalar(y)`,
+		},
+		{
+			name:          "compiled mixed with raw selector",
+			query:         `sum by (pod) (rate(a[5m])) / on (pod) group_left () b`,
+			wantUnits:     1,
+			wantRewritten: `__signoz_transpiled_0__ / on (pod) group_left () b`,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			plan, ok := classify(parse(t, tt.query), testGrid(60_000))
+			require.True(t, ok)
+			assert.False(t, plan.full)
+			assert.Len(t, plan.units, tt.wantUnits)
+			assert.Equal(t, tt.wantRewritten, plan.rewritten)
+		})
+	}
+}
+
+func TestClassifyHybridGuards(t *testing.T) {
+	t.Run("no substitution under on(__name__)", func(t *testing.T) {
+		plan, ok := classify(parse(t, `sum(rate(a[5m])) * on (__name__) b`), testGrid(60_000))
+		_ = plan
+		assert.False(t, ok, "matching on __name__ must not see synthetic names")
+	})
+	t.Run("no substitution inside @-pinned subquery", func(t *testing.T) {
+		_, ok := classify(parse(t, `max_over_time(rate(x[5m])[30m:1m] @ 1609746000)`), testGrid(60_000))
+		assert.False(t, ok)
+	})
+}
+
+// The alert-smoothing idiom: units inside a fixed-resolution subquery
+// evaluate on the subquery grid — epoch-aligned multiples of the resolution,
+// starting strictly after (outer start - range), exactly as the engine
+// derives it.
+func TestClassifySubqueryUnits(t *testing.T) {
+	grid := gridContext{startMs: 1_700_000_030_000, endMs: 1_700_007_200_000, stepMs: 60_000}
+
+	plan, ok := classify(parse(t, `min_over_time((sum by (ns) (increase(x[5m])))[10m:5m]) > 0`), grid)
+	require.True(t, ok)
+	require.False(t, plan.full)
+	require.Len(t, plan.units, 1)
+	assert.Equal(t, `min_over_time(__signoz_transpiled_0__[10m:5m]) > 0`, plan.rewritten)
+
+	unit := plan.units[0]
+	// lower bound = outer start - range = 1_699_999_430_000; first multiple
+	// of 300_000 strictly greater is 1_699_999_500_000.
+	assert.Equal(t, int64(1_699_999_500_000), unit.grid.startMs)
+	assert.Equal(t, grid.endMs, unit.grid.endMs)
+	assert.Equal(t, int64(300_000), unit.grid.stepMs)
+	assert.Equal(t, fnIncrease, unit.core.fn)
+
+	t.Run("subquery offset shifts the grid", func(t *testing.T) {
+		plan, ok := classify(parse(t, `max_over_time((sum(rate(x[5m])))[10m:5m] offset 30m)`), grid)
+		require.True(t, ok)
+		require.Len(t, plan.units, 1)
+		// lower = start - offset - range = 1_699_997_630_000 -> first
+		// multiple of 300_000 above = 1_699_997_700_000; end shifts too.
+		assert.Equal(t, int64(1_699_997_700_000), plan.units[0].grid.startMs)
+		assert.Equal(t, grid.endMs-1_800_000, plan.units[0].grid.endMs)
+	})
+
+	t.Run("mollusk ratio-inside-subquery idiom", func(t *testing.T) {
+		q := `min_over_time(((sum by (a) (rate(m1[5m]))) / (avg by (a) (m2)))[5m:1m])`
+		plan, ok := classify(parse(t, q), grid)
+		require.True(t, ok)
+		// Both sides compile on the subquery grid: the rate side and the
+		// gauge aggregation side; the engine joins them and smooths.
+		require.Len(t, plan.units, 2)
+		assert.Equal(t, int64(60_000), plan.units[0].grid.stepMs)
+		assert.Equal(t, unitInstant, plan.units[1].core.kind)
+		assert.Contains(t, plan.rewritten, `__signoz_transpiled_0__ / __signoz_transpiled_1__`)
+	})
+}
+
+func TestBuildUnitSQL(t *testing.T) {
+	unit := &coreUnit{
+		fn:       fnRate,
+		rangeMs:  300_000,
+		hasAgg:   true,
+		aggOp:    parser.SUM,
+		by:       true,
+		grouping: []string{"pod"},
+		matchers: []*labels.Matcher{mustMatcher(t, labels.MatchEqual, "__name__", "http_requests_total")},
+	}
+	sql, args, err := buildUnitSQL(unit, []string{"http_requests_total"}, 1_699_999_700_000, 1_700_003_600_000, 1_700_000_000_000, 1_700_003_600_000, 60_000, 300_000)
+	require.NoError(t, err)
+
+	assert.Contains(t, sql, "timeSeriesRateToGrid(fromUnixTimestamp64Milli(1700000000000), fromUnixTimestamp64Milli(1700003600000), 60, 300)(fromUnixTimestamp64Milli(unix_milli), value)")
+	assert.Contains(t, sql, "unix_milli > ? AND unix_milli <= ?")
+	assert.Contains(t, sql, "bitAnd(flags, 1) = 0")
+	assert.Contains(t, sql, "sumForEach(grid)")
+	// The group-key join rides inside the shard query: distributed samples
+	// at the top level, the local series table in the join subquery, the
+	// grid aggregation grouped per (fingerprint, group key) shard-side.
+	assert.Contains(t, sql, "FROM signoz_metrics.distributed_samples_v4 AS points INNER JOIN (SELECT fingerprint,")
+	assert.Contains(t, sql, "FROM signoz_metrics.time_series_v4 WHERE")
+	// The group key is functionally dependent on the fingerprint (one
+	// labelset per fingerprint): any() is exact and the per-row hash key
+	// shrinks to the fingerprint alone.
+	assert.Contains(t, sql, "any(series.g0) AS g0")
+	assert.Contains(t, sql, "GROUP BY points.fingerprint)")
+	// No samples-side fingerprint condition: the group-key join restricts.
+	assert.NotContains(t, sql, "points.fingerprint IN (")
+	// by (pod) extracts the grouped label directly — no per-row JSON
+	// build/sort/stringify for a known projection.
+	assert.Contains(t, sql, "JSONExtractString(labels, ?) AS g0")
+	assert.NotContains(t, sql, "toJSONString")
+	assert.Contains(t, sql, "SETTINGS allow_experimental_ts_to_grid_aggregate_function = 1")
+	// Args follow placeholder order: the joined series subquery renders
+	// before the samples WHERE, and its select list ('pod') renders before
+	// its own conditions.
+	assert.Equal(t, []any{"pod", "http_requests_total", int64(1_699_999_200_000), int64(1_700_003_600_000), "http_requests_total", int64(1_699_999_700_000), int64(1_700_003_600_000)}, args)
+}
+
+func TestBuildUnitSQLIncreaseAndOffset(t *testing.T) {
+	unit := &coreUnit{
+		fn:       fnIncrease,
+		rangeMs:  600_000,
+		offsetMs: 1_800_000,
+		matchers: []*labels.Matcher{mustMatcher(t, labels.MatchEqual, "__name__", "errors_total")},
+	}
+	sql, _, err := buildUnitSQL(unit, nil, 1_699_997_600_000, 1_700_001_800_000, 1_700_000_000_000, 1_700_003_600_000, 60_000, 300_000)
+	require.NoError(t, err)
+
+	// Grid and window shift by the offset; increase multiplies rate by the
+	// range in seconds.
+	assert.Contains(t, sql, "fromUnixTimestamp64Milli(1699998200000), fromUnixTimestamp64Milli(1700001800000)")
+	assert.Contains(t, sql, "arrayMap(x -> x * 600, timeSeriesRateToGrid")
+	assert.Contains(t, sql, "maxForEach(grid)")
+}
+
+func TestBuildUnitSQLWindowSliver(t *testing.T) {
+	// rate[5m] on a 30m grid evaluates only a 5m sliver before each grid
+	// point — samples in the gaps belong to no window and would only be
+	// buffered by the grid aggregate. The WHERE must keep exactly the
+	// in-window rows: positiveModulo anchored at the selector start (end
+	// can sit off-lattice on unaligned grids, and samples above the start
+	// make the plain modulo dividend negative), and the scan capped at the
+	// last grid point — rows past it are equally windowless.
+	unit := &coreUnit{
+		fn:       fnRate,
+		rangeMs:  300_000,
+		hasAgg:   true,
+		aggOp:    parser.SUM,
+		by:       true,
+		grouping: []string{"pod"},
+		matchers: []*labels.Matcher{mustMatcher(t, labels.MatchEqual, "__name__", "http_requests_total")},
+	}
+	sql, args, err := buildUnitSQL(unit, []string{"http_requests_total"}, 1_699_999_700_000, 1_700_003_600_000, 1_700_000_000_000, 1_700_003_600_000, 1_800_000, 300_000)
+	require.NoError(t, err)
+
+	assert.Contains(t, sql, "positiveModulo(? - unix_milli, ?) < ?")
+	assert.Equal(t, []any{"pod", "http_requests_total", int64(1_699_999_200_000), int64(1_700_003_600_000), "http_requests_total", int64(1_699_999_700_000), int64(1_700_003_600_000), int64(1_700_000_000_000), int64(1_800_000), int64(300_000)}, args)
+
+	t.Run("off-lattice end caps the scan at the last grid point", func(t *testing.T) {
+		// end - start = 50m at a 30m step: the only grid points are start
+		// and start+30m; samples in the trailing 20m serve no window.
+		_, args, err := buildUnitSQL(unit, []string{"http_requests_total"}, 1_699_999_700_000, 1_700_003_000_000, 1_700_000_000_000, 1_700_003_000_000, 1_800_000, 300_000)
+		require.NoError(t, err)
+		assert.Contains(t, args, int64(1_700_001_800_000))
+	})
+
+	t.Run("window covering the step keeps plain bounds", func(t *testing.T) {
+		sql, _, err := buildUnitSQL(unit, []string{"http_requests_total"}, 1_699_999_700_000, 1_700_003_600_000, 1_700_000_000_000, 1_700_003_600_000, 60_000, 300_000)
+		require.NoError(t, err)
+		assert.NotContains(t, sql, "positiveModulo")
+	})
+}
+
+func TestBuildUnitSQLWindowedBucketsWithoutFanOut(t *testing.T) {
+	// The window is W = range/step whole buckets, so each sample lands in
+	// exactly one bucket via GROUP BY and the window slides over bucket
+	// partials — fanning samples into every covered window (ARRAY JOIN)
+	// multiplies rows by W, a row explosion at long ranges.
+	unit := &coreUnit{
+		kind:     unitOverTime,
+		overFn:   "avg",
+		rangeMs:  600_000,
+		matchers: []*labels.Matcher{mustMatcher(t, labels.MatchEqual, "__name__", "node_load1")},
+	}
+	sql, _, err := buildUnitSQL(unit, []string{"node_load1"}, 1_699_999_400_000, 1_700_003_600_000, 1_700_000_000_000, 1_700_003_600_000, 60_000, 600_000)
+	require.NoError(t, err)
+
+	assert.NotContains(t, sql, "ARRAY JOIN")
+	// One group per series with fixed per-bucket arrays (-Resample); the
+	// bucket index jj = ceil((ts - start)/step) + W - 1 folded into a single
+	// intDiv. Grouping by (series, bucket) instead measured 37M hash groups
+	// whose per-thread partials scale memory with max_threads.
+	assert.Contains(t, sql, "countResample(0, 71, 1)(value, intDiv(unix_milli - 1700000000000 + 600000 - 1, 60000)) AS cnts")
+	assert.Contains(t, sql, "sumResample(0, 71, 1)(value, intDiv(unix_milli - 1700000000000 + 600000 - 1, 60000)) AS vals")
+	assert.Contains(t, sql, "any(series.gkey) AS gkey")
+	assert.Contains(t, sql, "GROUP BY points.fingerprint)")
+	assert.NotContains(t, sql, "jj) AS jj")
+	assert.Contains(t, sql, "INNER JOIN (SELECT fingerprint,")
+	assert.Contains(t, sql, "FROM signoz_metrics.time_series_v4 WHERE")
+	// Slide: W = 10 buckets per slot, absent when the window count is 0.
+	assert.Contains(t, sql, "arraySum(arraySlice(cnts, k + 1, 10))")
+	assert.Contains(t, sql, "arraySum(arraySlice(vals, k + 1, 10))")
+}
+
+func TestBuildUnitSQLDisjointOverTime(t *testing.T) {
+	// avg_over_time[5m] on a 30m grid: the windows are pairwise disjoint,
+	// so there is no slide — one Resample bucket per grid slot, read
+	// directly. Exact only together with the window-sliver predicate, which
+	// removes the gap samples the ceil index would otherwise assign to the
+	// window above them.
+	unit := &coreUnit{
+		kind:     unitOverTime,
+		overFn:   "avg",
+		rangeMs:  300_000,
+		matchers: []*labels.Matcher{mustMatcher(t, labels.MatchEqual, "__name__", "node_load1")},
+	}
+	sql, _, err := buildUnitSQL(unit, []string{"node_load1"}, 1_699_999_700_000, 1_700_003_600_000, 1_700_000_000_000, 1_700_003_600_000, 1_800_000, 300_000)
+	require.NoError(t, err)
+
+	assert.NotContains(t, sql, "ARRAY JOIN")
+	// gridLen = 3 slots, bucket array the same length — no W tail.
+	assert.Contains(t, sql, "countResample(0, 3, 1)(value, intDiv(unix_milli - 1700000000000 + 1800000 - 1, 1800000)) AS cnts")
+	assert.Contains(t, sql, "sumResample(0, 3, 1)(value, intDiv(unix_milli - 1700000000000 + 1800000 - 1, 1800000)) AS vals")
+	// Single-bucket window: the slide degenerates to reading one slot.
+	assert.Contains(t, sql, "arraySum(arraySlice(cnts, k + 1, 1))")
+	// The sliver predicate is the correctness precondition of this form.
+	assert.Contains(t, sql, "positiveModulo(? - unix_milli, ?) < ?")
+}
+
+// TestDisjointWindowLattice brute-forces the disjoint-form arithmetic: a
+// sample survives the sliver predicate exactly when some grid window
+// contains it, and the ceil bucket index then lands it on that window's
+// slot. This is the pure-Go mirror of the SQL expressions — the predicate
+// in samplesConditions and jj in windowedInner — over random lattices,
+// including off-lattice ends and samples beyond the last grid point.
+func TestDisjointWindowLattice(t *testing.T) {
+	rng := func(seed *uint64) int64 {
+		*seed = *seed*6364136223846793005 + 1442695040888963407
+		return int64(*seed >> 33)
+	}
+	seed := uint64(42)
+	for trial := 0; trial < 2000; trial++ {
+		stepMs := 1_000 * (1 + rng(&seed)%3600)
+		windowMs := 1 + rng(&seed)%(stepMs-1) // strictly below the step
+		selStart := 1_700_000_000_000 + rng(&seed)%1_000_000
+		selEnd := selStart + rng(&seed)%(50*stepMs) // end may sit off-lattice
+		lastIdx := (selEnd - selStart) / stepMs
+		upper := selStart + lastIdx*stepMs
+
+		for i := 0; i < 50; i++ {
+			u := selStart - windowMs - stepMs + rng(&seed)%(selEnd-selStart+3*stepMs)
+
+			// Oracle: is u inside any window (t_k - window, t_k]?
+			inWindow := false
+			var slot int64 = -1
+			for k := int64(0); k <= lastIdx; k++ {
+				tk := selStart + k*stepMs
+				if u > tk-windowMs && u <= tk {
+					inWindow = true
+					slot = k
+					break
+				}
+			}
+
+			// The SQL: fetch bounds, then the sliver predicate
+			// positiveModulo(selStart - u, step) < window.
+			kept := u > selStart-windowMs && u <= upper
+			if kept {
+				pmod := (selStart - u) % stepMs
+				if pmod < 0 {
+					pmod += stepMs
+				}
+				kept = pmod < windowMs
+			}
+
+			require.Equal(t, inWindow, kept,
+				"sliver keep mismatch: u=%d selStart=%d step=%d window=%d", u, selStart, stepMs, windowMs)
+			if !kept {
+				continue
+			}
+			// jj = ceil((u - selStart)/step) via one intDiv; numerator is
+			// positive because u > selStart - window > selStart - step.
+			jj := (u - selStart + stepMs - 1) / stepMs
+			require.Equal(t, slot, jj,
+				"slot mismatch: u=%d selStart=%d step=%d window=%d", u, selStart, stepMs, windowMs)
+		}
+	}
+}
+
+func TestTryExecuteRange_WindowedGateFallsBack(t *testing.T) {
+	c, store := newTestClient(t)
+	e := &executor{client: c, parser: prometheus.NewParser()}
+
+	start := time.UnixMilli(1_700_000_000_000)
+	end := time.UnixMilli(1_700_003_600_000)
+
+	// 10m range at 90s step: the window is not a whole number of buckets.
+	_, ok, err := e.TryExecuteRange(context.Background(), `avg_over_time(up[10m])`, start, end, 90*time.Second)
+	require.NoError(t, err)
+	assert.False(t, ok, "range not divisible by step must not transpile")
+
+	// 1d range at 60s step: 1440 bucket combines per slot, over the cap.
+	_, ok, err = e.TryExecuteRange(context.Background(), `avg_over_time(up[1d])`, start, end, time.Minute)
+	require.NoError(t, err)
+	assert.False(t, ok, "range/step above maxWindowBuckets must not transpile")
+
+	// 1m range at 5m step: the windows are disjoint slivers — no
+	// divisibility or width requirement, so this transpiles.
+	store.Mock().ExpectQuery("SELECT fingerprint, any\\(labels\\)").WithArgs("up", int64(1_699_999_200_000), int64(1_700_003_600_000)).WillReturnRows(cmock.NewRows(seriesCols, [][]any{}))
+	_, ok, err = e.TryExecuteRange(context.Background(), `avg_over_time(up[1m])`, start, end, 5*time.Minute)
+	require.NoError(t, err)
+	assert.True(t, ok, "range below step is the disjoint form and must transpile")
+}
+
+func TestApplyScalarOps(t *testing.T) {
+	f := func(v float64) *float64 { return &v }
+
+	t.Run("arithmetic chain", func(t *testing.T) {
+		values := []*float64{f(2), nil, f(4)}
+		applyScalarOps([]scalarOp{{op: parser.MUL, scalar: 100}, {op: parser.ADD, scalar: 1}}, values)
+		require.NotNil(t, values[0])
+		assert.Equal(t, 201.0, *values[0])
+		assert.Nil(t, values[1])
+		assert.Equal(t, 401.0, *values[2])
+	})
+
+	t.Run("comparison filters points", func(t *testing.T) {
+		values := []*float64{f(1), f(10)}
+		applyScalarOps([]scalarOp{{op: parser.GTR, scalar: 5}}, values)
+		assert.Nil(t, values[0])
+		require.NotNil(t, values[1])
+		assert.Equal(t, 10.0, *values[1], "filter comparisons keep the original value")
+	})
+
+	t.Run("bool comparison emits 0/1", func(t *testing.T) {
+		values := []*float64{f(1), f(10)}
+		applyScalarOps([]scalarOp{{op: parser.GTR, scalar: 5, returnBool: true}}, values)
+		assert.Equal(t, 0.0, *values[0])
+		assert.Equal(t, 1.0, *values[1])
+	})
+
+	t.Run("scalar on left division", func(t *testing.T) {
+		values := []*float64{f(4)}
+		applyScalarOps([]scalarOp{{op: parser.DIV, scalar: 100, scalarOnLeft: true}}, values)
+		assert.Equal(t, 25.0, *values[0])
+	})
+}
+
+func TestLabelsFromGroupKey(t *testing.T) {
+	lset, err := labelsFromGroupKey(`[["pod","api-0"],["ns","prod"]]`)
+	require.NoError(t, err)
+	assert.Equal(t, "api-0", lset.Get("pod"))
+	assert.Equal(t, "prod", lset.Get("ns"))
+
+	empty, err := labelsFromGroupKey(`[]`)
+	require.NoError(t, err)
+	assert.True(t, empty.IsEmpty())
+}
+
+// testGrid is a 2h query grid ending on a round timestamp.
+func testGrid(stepMs int64) gridContext {
+	return gridContext{startMs: 1_700_000_000_000, endMs: 1_700_007_200_000, stepMs: stepMs}
+}
+
+// A bool comparison returns 0/1, not the sample, so the engine drops
+// __name__; keeping it would change downstream vector matching.
+func TestKeepsName_BoolComparisonDropsName(t *testing.T) {
+	plan, ok := classify(parse(t, `up > bool 0`), testGrid(60_000))
+	require.True(t, ok)
+	assert.False(t, plan.units[0].core.keepsName())
+
+	plan, ok = classify(parse(t, `up > 0`), testGrid(60_000))
+	require.True(t, ok)
+	assert.True(t, plan.units[0].core.keepsName())
+}
+
+// timeSeriesLastToGrid widens its window to max(window, step) — probed on
+// 25.12 — so Last-style units at window < step must fall back or they would
+// resurrect samples the engine's lookback already dropped.
+func TestTryExecuteRange_LastStyleWindowBelowStepTranspiles(t *testing.T) {
+	// These used to fall back because timeSeriesLastToGrid widens its window
+	// to max(window, step). Over sliver-filtered rows the widening is
+	// harmless — the widened window intersected with the data IS the
+	// lookback window — so the gate is gone and both shapes transpile. The
+	// mock returns no series: the point here is the routing, the value
+	// semantics are the parity suite's job.
+	c, store := newTestClient(t)
+	e := &executor{client: c, parser: prometheus.NewParser()}
+
+	start := time.UnixMilli(1_700_000_000_000)
+	end := time.UnixMilli(1_700_003_600_000)
+
+	store.Mock().ExpectQuery("SELECT fingerprint, any\\(labels\\)").WithArgs("up", int64(1_699_999_200_000), int64(1_700_003_600_000)).WillReturnRows(cmock.NewRows(seriesCols, [][]any{}))
+	_, ok, err := e.TryExecuteRange(context.Background(), `sum by (pod) (up)`, start, end, time.Hour)
+	require.NoError(t, err)
+	assert.True(t, ok, "instant selection at step > lookback must transpile")
+
+	store.Mock().ExpectQuery("SELECT fingerprint, any\\(labels\\)").WithArgs("up", int64(1_699_999_200_000), int64(1_700_003_600_000)).WillReturnRows(cmock.NewRows(seriesCols, [][]any{}))
+	_, ok, err = e.TryExecuteRange(context.Background(), `last_over_time(up[10m])`, start, end, time.Hour)
+	require.NoError(t, err)
+	assert.True(t, ok, "last_over_time at range < step must transpile")
+}
+
+// A nameless selector can span metrics whose series alternate in time (one
+// dies inside the lookback before the other appears); after the name drop
+// the engine merges them into ONE series and errors only when two samples
+// share an evaluation timestamp. Pinned by conformance cases
+// operators.test:994/997 (-{job="api"} over http_requests/http_errors).
+func TestMergeSameLabelsetSeries(t *testing.T) {
+	f := func(v float64) *float64 { return &v }
+	api := labels.FromStrings("job", "api")
+
+	out, err := mergeSameLabelsetSeries([]transpiledSeries{
+		{lset: api, values: []*float64{f(-2), nil}},
+		{lset: api, values: []*float64{nil, f(-4)}},
+		{lset: labels.FromStrings("job", "web"), values: []*float64{f(7), nil}},
+	})
+	require.NoError(t, err)
+	require.Len(t, out, 2)
+	assert.Equal(t, []*float64{f(-2), f(-4)}, out[0].values, "temporally disjoint twins must merge into one series")
+
+	_, err = mergeSameLabelsetSeries([]transpiledSeries{
+		{lset: api, values: []*float64{f(1), nil}},
+		{lset: api, values: []*float64{f(2), nil}},
+	})
+	require.Error(t, err, "two values on one evaluation timestamp is the engine's duplicate error")
+	assert.True(t, errors.Ast(err, errors.TypeInvalidInput))
+}
+
+// Hybrid twin case: stripping the synthetic __name__ can leave two engine
+// output series distinguishable only by those names (-metric_a or -metric_b:
+// both {} once real names are dropped). Pinned by conformance cases
+// name_label_dropping.test:137 and operators.test:1016.
+func TestMergeMatrixByLabelset(t *testing.T) {
+	empty := labels.EmptyLabels()
+
+	out, err := mergeMatrixByLabelset(promql.Matrix{
+		{Metric: empty, Floats: []promql.FPoint{{T: 0, F: -1}}},
+		{Metric: empty, Floats: []promql.FPoint{{T: 600_000, F: -4}}},
+	})
+	require.NoError(t, err)
+	require.Len(t, out, 1)
+	assert.Equal(t, []promql.FPoint{{T: 0, F: -1}, {T: 600_000, F: -4}}, out[0].Floats)
+
+	_, err = mergeMatrixByLabelset(promql.Matrix{
+		{Metric: empty, Floats: []promql.FPoint{{T: 0, F: -1}}},
+		{Metric: empty, Floats: []promql.FPoint{{T: 0, F: -3}}},
+	})
+	require.Error(t, err)
+	assert.True(t, errors.Ast(err, errors.TypeInvalidInput))
+}
--- a/pkg/prometheus/prometheus.go
+++ b/pkg/prometheus/prometheus.go
@@ -1,6 +1,9 @@
 package prometheus

 import (
+	"context"
+	"time"
+
 	"github.com/prometheus/prometheus/promql"
 	"github.com/prometheus/prometheus/promql/parser"
 	"github.com/prometheus/prometheus/storage"
@@ -41,3 +44,14 @@ type StatementCapturer interface {
 // X-SigNoz-PromQL-Provider request header all use it, so they cannot drift
 // apart.
 const ProviderClickhouseV2 = "clickhousev2"
+
+// RangeExecutor is the optional capability of a provider that can evaluate
+// some range queries entirely inside the datastore. ok=false means the
+// query is not evaluable that way. The caller then runs the engine over the
+// provider's Storage, which is always exact. Only the clickhousev2 provider
+// implements this capability. When that provider is the only one, the
+// capability folds into Prometheus itself, and the engine-vs-datastore
+// decision becomes internal.
+type RangeExecutor interface {
+	TryExecuteRange(ctx context.Context, query string, start, end time.Time, step time.Duration) (promql.Matrix, bool, error)
+}
--- a/pkg/querier/promql_query.go
+++ b/pkg/querier/promql_query.go
@@ -344,8 +344,8 @@ func (q *promqlQuery) Execute(ctx context.Context) (*qbv5.Result, error) {
 	}

 	// Accumulate ClickHouse-side scan stats across every storage query this
-	// evaluation issues: progress options propagate to each ClickHouse query
-	// through the context.
+	// evaluation issues (engine selectors or the compiled executor): progress
+	// options propagate to each ClickHouse query through the context.
 	var statsMu sync.Mutex
 	var rowsScanned, bytesScanned uint64
 	ctx = clickhouse.Context(ctx, clickhouse.WithProgress(func(p *clickhouse.Progress) {
@@ -371,6 +371,23 @@ func (q *promqlQuery) Execute(ctx context.Context) (*qbv5.Result, error) {
 		return q.toResult(matrix, nil, began, &statsMu, &rowsScanned, &bytesScanned), nil
 	}

+	// When the serving provider has the RangeExecutor capability
+	// (prometheus::provider: clickhousev2), serve the way the provider is
+	// designed to serve: transpiled when the shape allows. Without this the
+	// override would silently run the engine path only.
+	if re, ok := q.promEngine.(prometheus.RangeExecutor); ok {
+		matrix, served, err := re.TryExecuteRange(ctx, query, time.Unix(0, start), time.Unix(0, end), q.query.Step.Duration)
+		if err != nil {
+			if enhanced := tryEnhancePromQLExecError(err); enhanced != nil {
+				return nil, enhanced
+			}
+			return nil, err
+		}
+		if served {
+			return q.toResult(matrix, nil, began, &statsMu, &rowsScanned, &bytesScanned), nil
+		}
+	}
+
 	qry, err := q.promEngine.Engine().NewRangeQuery(
 		ctx,
 		q.promEngine.Storage(),
--- a/pkg/querier/promql_shadow.go
+++ b/pkg/querier/promql_shadow.go
@@ -19,11 +19,11 @@ import (
 const shadowTimeout = 2 * time.Minute

 // runShadowCompare executes the query on the clickhousev2 provider exactly
-// as it would serve (the engine over the v2 querier), compares against the
-// served result and logs the outcome. Serving is never affected: this runs
-// after the response, off the request context, and only logs. The mismatch
-// and failure logs are the rollout evidence — serving cuts over to v2 only
-// after they stay clean.
+// as it would serve (transpiled when the shape allows, engine over the v2
+// querier otherwise), compares against the served result and logs the
+// outcome. Serving is never affected: this runs after the response, off the
+// request context, and only logs. The mismatch and failure logs are the
+// rollout evidence — serving cuts over to v2 only after they stay clean.
 func (q *promqlQuery) runShadowCompare(ctx context.Context, query string, startNs, endNs int64, served promql.Matrix, servedIn time.Duration) {
 	defer func() {
 		if r := recover(); r != nil {
@@ -45,7 +45,7 @@ func (q *promqlQuery) runShadowCompare(ctx context.Context, query string, startN

 	start, end := time.Unix(0, startNs), time.Unix(0, endNs)
 	began := time.Now()
-	shadow, err := executeOnProvider(ctx, q.opts.shadow, query, start, end, q.query.Step.Duration)
+	shadow, transpiled, err := executeOnProvider(ctx, q.opts.shadow, query, start, end, q.query.Step.Duration)
 	shadowIn := time.Since(began)

 	logAttrs := []any{
@@ -53,6 +53,7 @@ func (q *promqlQuery) runShadowCompare(ctx context.Context, query string, startN
 		slog.Int64("start_ms", startNs/int64(time.Millisecond)),
 		slog.Int64("end_ms", endNs/int64(time.Millisecond)),
 		slog.Duration("step", q.query.Step.Duration),
+		slog.Bool("transpiled", transpiled),
 		slog.Duration("served_in", servedIn),
 		slog.Duration("shadow_in", shadowIn),
 	}
@@ -79,32 +80,39 @@ func (q *promqlQuery) runShadowCompare(ctx context.Context, query string, startN
 	q.logger.DebugContext(ctx, "promql shadow comparison matched", logAttrs...)
 }

-// serveFromProvider evaluates the query the way the pinned provider would
-// serve it.
 func (q *promqlQuery) serveFromProvider(ctx context.Context, query string, startNs, endNs int64) (promql.Matrix, error) {
-	return executeOnProvider(ctx, q.opts.serve, query, time.Unix(0, startNs), time.Unix(0, endNs), q.query.Step.Duration)
+	matrix, _, err := executeOnProvider(ctx, q.opts.serve, query, time.Unix(0, startNs), time.Unix(0, endNs), q.query.Step.Duration)
+	return matrix, err
 }

-// executeOnProvider evaluates the query the way the provider would serve it:
-// the engine over the provider's storage. The returned matrix is an owned
-// copy.
-func executeOnProvider(ctx context.Context, prov prometheus.Prometheus, query string, start, end time.Time, step time.Duration) (promql.Matrix, error) {
+// The returned matrix is an owned copy.
+func executeOnProvider(ctx context.Context, prov prometheus.Prometheus, query string, start, end time.Time, step time.Duration) (promql.Matrix, bool, error) {
+	if re, ok := prov.(prometheus.RangeExecutor); ok {
+		matrix, served, err := re.TryExecuteRange(ctx, query, start, end, step)
+		if err != nil {
+			return nil, true, err
+		}
+		if served {
+			return matrix, true, nil
+		}
+	}
+
 	qry, err := prov.Engine().NewRangeQuery(ctx, prov.Storage(), nil, query, start, end, step)
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	defer qry.Close()

 	res := qry.Exec(ctx)
 	if res.Err != nil {
-		return nil, res.Err
+		return nil, false, res.Err
 	}
 	matrix, err := res.Matrix()
 	if err != nil {
-		return nil, err
+		return nil, false, err
 	}
 	// Close returns the result's sample slices to the engine pool.
-	return copyMatrix(matrix), nil
+	return copyMatrix(matrix), false, nil
 }

 func copyMatrix(matrix promql.Matrix) promql.Matrix {
--- a/pkg/querybuilder/clickhouse_sql.go
+++ b/pkg/querybuilder/clickhouse_sql.go
@@ -17,6 +17,7 @@ var (
 	CodeClickHouseSQLNotSingleStatement = errors.MustNewCode("clickhouse_sql_not_single_statement")
 	CodeClickHouseSQLNotSelect          = errors.MustNewCode("clickhouse_sql_not_select")
 	CodeClickHouseSQLTableFunction      = errors.MustNewCode("clickhouse_sql_table_function")
+	CodeClickHouseSQLReadingFunction    = errors.MustNewCode("clickhouse_sql_reading_function")
 	CodeClickHouseSQLInternalDatabase   = errors.MustNewCode("clickhouse_sql_internal_database")
 	CodeClickHouseSQLReadonlyOverride   = errors.MustNewCode("clickhouse_sql_readonly_override")
 )
@@ -43,6 +44,25 @@ var generatorTableFunctions = map[string]string{

 var generatorTableFunctionsMessage = "allowed table functions are " + strings.Join(slices.Sorted(maps.Values(generatorTableFunctions)), ", ")

+// readingFunctions reach a file, a model or the server binary while looking like ordinary
+// scalar functions. They name no table and no database, so neither of the rules above sees
+// them, and a wrapper that returns a number leaks what they read through the row count alone:
+// numbers(length(file(x))) yields one row per byte.
+//
+// Keyed by the lowercased name, since ClickHouse resolves function names case-insensitively.
+var readingFunctions = map[string]struct{}{
+	"file":                     {},
+	"catboostevaluate":         {},
+	"demangle":                 {},
+	"addresstoline":            {},
+	"addresstolinewithinlines": {},
+	"addresstosymbol":          {},
+}
+
+// A dictionary can be backed by HTTP, ODBC or another database, and every one of the 42
+// accessors carries this prefix.
+const dictionaryFunctionPrefix = "dict"
+
 // The parser's grammar has gaps against SQL that ClickHouse itself accepts.
 func ErrIfStatementIsNotValid(query string) (err error) {
 	defer func() {
@@ -69,11 +89,23 @@ func ErrIfStatementIsNotValid(query string) (err error) {

 	visitor := &chparser.DefaultASTVisitor{Visit: func(node chparser.Expr) error {
 		switch expr := node.(type) {
-		case *chparser.TableFunctionExpr:
-			// Source table functions remain usable in ClickHouse read-only mode. Arguments are
-			// visited before this, so a read smuggled into one is already refused by the time
-			// an allowed generator gets here.
-			name := chparser.Format(expr.Name)
+		case *chparser.TableExpr:
+			// Source table functions remain usable in ClickHouse read-only mode, and only a
+			// table position can be one. The parser also types a call inside a table function's
+			// argument list as a TableFunctionExpr, so asking every one of those refuses the
+			// numbers(intDiv(...)) that every dashboard writes. What can read from an argument
+			// is caught by name below instead.
+			source := expr.Expr
+			if alias, ok := source.(*chparser.AliasExpr); ok {
+				source = alias.Expr
+			}
+
+			tableFunction, ok := source.(*chparser.TableFunctionExpr)
+			if !ok {
+				return nil
+			}
+
+			name := functionName(tableFunction.Name)
 			if _, ok := generatorTableFunctions[strings.ToLower(name)]; ok {
 				return nil
 			}
@@ -82,6 +114,25 @@ func ErrIfStatementIsNotValid(query string) (err error) {
 				NewInvalidInputf(CodeClickHouseSQLTableFunction, "ClickHouse table functions are not allowed in SQL queries: %s", name).
 				WithAdditional(generatorTableFunctionsMessage)

+		case *chparser.FunctionExpr:
+			return errIfFunctionReads(expr.Name.Name)
+
+		case *chparser.TableFunctionExpr:
+			// Reached for a call in an argument list, and for a table position ahead of the
+			// TableExpr above, since a node is visited after its children.
+			return errIfFunctionReads(functionName(expr.Name))
+
+		case *chparser.Path:
+			// ClickHouse reads `x IN db.table` as a select from that table, and a qualified name
+			// on the right of IN is a Path rather than a TableIdentifier.
+			if len(expr.Fields) < 2 {
+				return nil
+			}
+
+			if _, ok := internalDatabases[strings.ToLower(expr.Fields[0].Name)]; ok {
+				return errors.NewInvalidInputf(CodeClickHouseSQLInternalDatabase, "the ClickHouse %s database is not allowed in SQL queries", expr.Fields[0].Name)
+			}
+
 		case *chparser.TableIdentifier:
 			// Reading these is unaffected by ClickHouse read-only mode.
 			if expr.Database == nil {
@@ -111,3 +162,22 @@ func LogIfStatementIsNotValid(ctx context.Context, logger *slog.Logger, query st
 		logger.WarnContext(ctx, "clickhouse sql is not valid", errors.Attr(err), slog.String("query", query))
 	}
 }
+
+func errIfFunctionReads(name string) error {
+	lowered := strings.ToLower(name)
+	if _, ok := readingFunctions[lowered]; !ok && !strings.HasPrefix(lowered, dictionaryFunctionPrefix) {
+		return nil
+	}
+
+	return errors.NewInvalidInputf(CodeClickHouseSQLReadingFunction, "ClickHouse functions that read outside the telemetry tables are not allowed in SQL queries: %s", name)
+}
+
+// The parser spells a call's name as an Ident everywhere it can. Reading the field rather than
+// formatting the node keeps the quoting out, so `numbers`(1) matches numbers.
+func functionName(expr chparser.Expr) string {
+	if ident, ok := expr.(*chparser.Ident); ok {
+		return ident.Name
+	}
+
+	return chparser.Format(expr)
+}
--- a/pkg/querybuilder/clickhouse_sql_test.go
+++ b/pkg/querybuilder/clickhouse_sql_test.go
@@ -7,6 +7,7 @@ import (
 	"github.com/SigNoz/signoz/pkg/errors"

 	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
 )

 func TestErrIfStatementIsNotValid_Pass(t *testing.T) {
@@ -14,13 +15,12 @@ func TestErrIfStatementIsNotValid_Pass(t *testing.T) {
 		name  string
 		query string
 	}{
-		// Shapes a telemetry read is allowed to take.
 		{"Select", "SELECT region AS r, zone FROM metrics WHERE metric_name = 'cpu' GROUP BY region, zone"},
 		{"TrailingSemicolon", "SELECT count() FROM signoz_logs.distributed_logs_v2;"},
 		{"CommonTableExpression", "WITH t AS (SELECT fingerprint FROM signoz_metrics.time_series_v4) SELECT * FROM t"},
 		{"Join", "SELECT * FROM t1 LEFT JOIN t2 ON t1.a = t2.b"},
 		{"GlobalIn", "SELECT a FROM t WHERE a GLOBAL IN (SELECT b FROM t2)"},
-		// GLOBAL parsed only when the join type was omitted, and only before IN. https://github.com/AfterShip/clickhouse-sql-parser/pull/293
+		// https://github.com/AfterShip/clickhouse-sql-parser/pull/293
 		{"GlobalLeftJoin", "SELECT * FROM t1 GLOBAL LEFT JOIN t2 ON t1.a = t2.a"},
 		{"GlobalNotIn", "SELECT a FROM t WHERE a GLOBAL NOT IN (SELECT b FROM t2)"},
 		{"Union", "SELECT * FROM t UNION ALL SELECT * FROM t2"},
@@ -29,32 +29,34 @@ func TestErrIfStatementIsNotValid_Pass(t *testing.T) {
 		{"UnrelatedSetting", "SELECT * FROM t SETTINGS max_threads = 4"},
 		{"TerminatedBlockComment", "SELECT /* keep me */ count() FROM t"},
 		{"BlockCommentMarkerInsideStringLiteral", "SELECT count() FROM t WHERE body = '/* not a comment'"},
-		// The parser used to loop forever on this; it now reads the comment to the end of
-		// the input, so this doubles as a canary for that regression.
+		// Looped forever before v0.5.2.
 		{"TrailingUnterminatedBlockComment", "SELECT count() FROM t /* unterminated"},
-		// The rule keys on the database, not on the table name.
+		// Keyed on the database, not on the table name.
 		{"TableNamedSystemInTelemetryDatabase", "SELECT * FROM signoz_logs.system"},
 		{"SignedLiteralAfterClosingParenSpaced", "SELECT (toUnixTimestamp(now()) - 3600)*1000000000"},
-		// order by interval
 		{"OrderByInterval", "SELECT toStartOfInterval(timestamp, INTERVAL 1 MINUTE) AS interval ORDER BY interval"},
 		{"OrderByIntervalAndDirection", "SELECT toStartOfInterval(timestamp, INTERVAL 1 MINUTE) AS `interval` ORDER BY `interval` ASC"},
-		// `interval` is a unit keyword, so unquoting it was rejected everywhere the parser
-		// expected a plain identifier. https://github.com/AfterShip/clickhouse-sql-parser/pull/296
+		// https://github.com/AfterShip/clickhouse-sql-parser/pull/296
 		{"OrderByUnquotedIntervalAsc", "SELECT toStartOfInterval(timestamp, INTERVAL 1 MINUTE) AS interval FROM t GROUP BY interval ORDER BY interval ASC"},
 		{"OrderByUnquotedIntervalDesc", "SELECT toStartOfInterval(timestamp, INTERVAL 1 MINUTE) AS interval FROM t GROUP BY interval ORDER BY interval DESC"},
 		{"UnquotedIntervalInGroupByTuple", "SELECT a FROM t GROUP BY (`service.name`, `service.version`, interval)"},
 		{"UnquotedIntervalProductionQuery", "SELECT toStartOfInterval(timestamp, INTERVAL 1 MINUTE) AS interval, resource_string_service$$name AS `service.name`, attributes_string['http.route'] AS `http.route`, quantile(0.95)(duration_nano) / 1000000000 AS value FROM signoz_traces.distributed_signoz_index_v3 WHERE resource_string_service$$name = 'svc-a' AND resources_string['deployment.environment'] = 'dev' AND attributes_string['http.route'] = '/v1' AND http_method = 'POST' AND timestamp BETWEEN toDateTime(1784601720) AND toDateTime(1784602620) AND ts_bucket_start BETWEEN 1784601720 - 1800 AND 1784602620 GROUP BY `service.name`, `http.route`, interval ORDER BY interval ASC"},
-		// Separating the two readings of INTERVAL needs backtracking as per the current implementation which could have performance regressions.
-		// https://github.com/AfterShip/clickhouse-sql-parser/pull/296#issuecomment-5150316367
+		// The fix backtracks, so this bounds the cost. https://github.com/AfterShip/clickhouse-sql-parser/pull/296#issuecomment-5150316367
 		{"UnquotedIntervalRepeatedThirtyTimes", "SELECT interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval + interval AS total FROM t WHERE interval > 0 ORDER BY interval ASC"},
+		// `interval` was one of 37 such keywords. https://github.com/AfterShip/clickhouse-sql-parser/pull/305
+		{"UnquotedLimitInFunctionArgument", "SELECT sum(limit) FROM t"},
+		{"UnquotedLimitInArithmetic", "SELECT limit + 1 FROM t"},
+		{"UnquotedLimitInNegation", "SELECT abs(-limit) FROM t"},
+		{"UnquotedKeywordOperands", "SELECT sum(offset) + sum(format) + sum(settings) FROM t"},
+		{"UnquotedLimitProductionQuery", "WITH limit_value AS (SELECT cluster, region, value AS limit FROM t) SELECT region AS `Region`, sum(limit) AS `Capacity` FROM limit_value GROUP BY Region"},
 		{"SignedLiteralAfterClosingParenUnspaced", "SELECT now() AS ts, toFloat64(count()) AS value FROM ( SELECT attributes_string['TableName'] AS T, attributes_string['MissingId'] AS M, max(fromUnixTimestamp64Nano(timestamp)) AS last_seen, dateDiff('minute', min(fromUnixTimestamp64Nano(timestamp)), max(fromUnixTimestamp64Nano(timestamp))) AS age_min FROM signoz_logs.distributed_logs_v2 WHERE body='missing_map_record' AND timestamp >= (toUnixTimestamp(now())-3600)*1000000000 GROUP BY T, M ) WHERE age_min >= 20 AND last_seen >= now() - toIntervalMinute(8)"},
 		{"SignedLiteralAfterClosingParenMinimal", "SELECT (1)-1"},
 		{"TrimFunction", "SELECT trimBoth('/api/endpoint/', '/');"},
-		// The SQL-standard keyword-separated argument forms, which took commas only. https://github.com/AfterShip/clickhouse-sql-parser/pull/290
+		// https://github.com/AfterShip/clickhouse-sql-parser/pull/290
 		{"StandardTrimSyntax", "SELECT trim(BOTH ' ' FROM body) FROM t"},
 		{"StandardSubstringSyntax", "SELECT substring(body FROM 2 FOR 3) FROM t"},
 		{"StandardOverlaySyntax", "SELECT overlay(body PLACING 'x' FROM 2) FROM t"},
-		// Row generators compute their rows from their arguments, so they read through nothing. This is the shape they get used for: a dense interval axis to CROSS JOIN a sparse series against.
+		// The shape row generators get used for: a dense interval axis to CROSS JOIN a sparse series against.
 		{"NumbersTableFunction", "SELECT intervals.interval AS interval, active.cluster AS cluster, toFloat64(if(ts_data.has_data = 0, 0, 1)) AS value FROM ( SELECT DISTINCT JSONExtractString(labels, 'k8s.cluster.name') AS cluster FROM signoz_metrics.distributed_time_series_v4 WHERE metric_name = 'my_metric' AND unix_milli >= toUnixTimestamp(now() - INTERVAL 30 DAY) * 1000 HAVING cluster != '' ) AS active CROSS JOIN ( SELECT toStartOfInterval( toDateTime(toUnixTimestamp(now() - INTERVAL 30 MINUTE) + number * 60), INTERVAL 1 MINUTE ) AS interval FROM numbers(31) ) AS intervals LEFT JOIN ( SELECT toStartOfInterval( toDateTime(intDiv(s.unix_milli, 1000)), INTERVAL 1 MINUTE ) AS interval, JSONExtractString(ts.labels, 'k8s.cluster.name') AS cluster, 1 AS has_data FROM signoz_metrics.distributed_samples_v4 s INNER JOIN ( SELECT DISTINCT fingerprint, labels FROM signoz_metrics.distributed_time_series_v4 WHERE metric_name = 'my_metric' ) AS ts ON s.fingerprint = ts.fingerprint WHERE s.metric_name = 'my_metric' AND s.unix_milli >= toUnixTimestamp(now() - INTERVAL 30 MINUTE) * 1000 GROUP BY interval, cluster ) AS ts_data ON active.cluster = ts_data.cluster AND intervals.interval = ts_data.interval ORDER BY interval ASC"},
 		{"NumbersMtTableFunction", "SELECT * FROM numbers_mt(31)"},
 		{"ZerosTableFunction", "SELECT * FROM zeros(31)"},
@@ -63,6 +65,16 @@ func TestErrIfStatementIsNotValid_Pass(t *testing.T) {
 		{"GenerateSeriesSnakeCaseTableFunction", "SELECT * FROM generate_series(1, 10)"},
 		{"GeneratorTableFunctionUppercase", "SELECT * FROM NUMBERS(31)"},
 		{"GeneratorTableFunctionParenthesisedArgument", "SELECT * FROM NUMBERS((31))"},
+		// CAST in an argument was itself read as a table function. https://github.com/AfterShip/clickhouse-sql-parser/pull/307
+		{"CastInGeneratorTableFunctionArgument", "SELECT * FROM numbers(CAST(10 AS UInt64))"},
+		{"ScalarCallInGeneratorTableFunctionArgument", "SELECT * FROM numbers(intDiv(100, 2))"},
+		{"NestedScalarCallInGeneratorTableFunctionArgument", "SELECT * FROM numbers(greatest(1, intDiv(100, 2) + 1))"},
+		{"GeneratorTableFunctionProductionQuery", "WITH toInt64(1786029960000000000) AS start_ns, toInt64(1786031760000000000) AS end_ns, 300000000000 AS step_ns SELECT ts, toFloat64(sum(value)) AS value FROM (SELECT fromUnixTimestamp64Nano(start_ns + toInt64(number) * step_ns) AS ts, 0 AS value FROM numbers(greatest(1, intDiv(end_ns - start_ns, step_ns) + 1)) UNION ALL SELECT toStartOfInterval(fromUnixTimestamp64Nano(timestamp), INTERVAL 5 minute) AS ts, count() AS value FROM signoz_logs.distributed_logs_v2 WHERE timestamp >= 1786029960000000000 AND timestamp <= 1786031760000000000 GROUP BY ts) GROUP BY ts ORDER BY ts"},
+		// The allow list keys on the bare name, so quoting must not hide a generator from it.
+		{"BacktickQuotedGeneratorTableFunction", "SELECT * FROM `numbers`(31)"},
+		{"DoubleQuotedGeneratorTableFunction", "SELECT * FROM \"numbers\"(31)"},
+		// Reads nothing: format builds a string, and shares its name with a table function.
+		{"ScalarFunctionNamedAfterATableFunction", "SELECT format('{} {}', a, b) FROM t"},
 		{"GeneratorTableFunctionInJoin", "SELECT * FROM signoz_logs.distributed_logs_v2 AS l CROSS JOIN numbers(31) AS n"},
 		{"GeneratorTableFunctionInCommonTableExpression", "WITH axis AS (SELECT number FROM numbers(31)) SELECT * FROM axis"},
 		{"GeneratorTableFunctionInWhereSubquery", "SELECT * FROM t WHERE a IN (SELECT number FROM numbers(31))"},
@@ -71,8 +83,7 @@ func TestErrIfStatementIsNotValid_Pass(t *testing.T) {

 	for _, testCase := range testCases {
 		t.Run(testCase.name, func(t *testing.T) {
-			// Bounded rather than called directly: a parser that backtracks without memoising
-			// hangs instead of returning. Every case here parses in well under a millisecond.
+			// Bounded because a parser that backtracks without memoising hangs rather than returning.
 			errC := make(chan error, 1)
 			go func() { errC <- ErrIfStatementIsNotValid(testCase.query) }()

@@ -92,46 +103,57 @@ func TestErrIfStatementIsNotValid_Fail(t *testing.T) {
 		query        string
 		expectedCode errors.Code
 	}{
-		// Not a single statement, or not a statement at all.
 		{"Empty", "", CodeClickHouseSQLNotSingleStatement},
 		{"UnterminatedBlockCommentOnly", "/* x", CodeClickHouseSQLUnparseable},
 		{"Unparseable", "SELECT FROM WHERE", CodeClickHouseSQLUnparseable},
 		{"MultipleStatements", "SELECT 1; DROP TABLE signoz_logs.logs_v2", CodeClickHouseSQLNotSingleStatement},
-		// Parses, but is not a SELECT.
 		{"Drop", "DROP TABLE signoz_logs.logs_v2", CodeClickHouseSQLNotSelect},
 		{"Insert", "INSERT INTO signoz_logs.logs_v2 SELECT * FROM signoz_logs.logs_v2", CodeClickHouseSQLNotSelect},
 		{"AlterDelete", "ALTER TABLE signoz_logs.logs_v2 DELETE WHERE 1 = 1", CodeClickHouseSQLNotSelect},
 		{"CreateTable", "CREATE TABLE evil (a Int) ENGINE = Memory", CodeClickHouseSQLNotSelect},
 		{"Grant", "GRANT ALL ON *.* TO admin", CodeClickHouseSQLNotSelect},
 		{"Set", "SET readonly = 0", CodeClickHouseSQLNotSelect},
-		// The parser still dereferences nil on a DEFAULT expression it cannot read, so the recover is what turns this into a rejection rather than a crash.
-		{"UnparseableDefaultExpression", "CREATE TABLE t (a String DEFAULT foo(b FROM 2)) ENGINE = Memory", CodeClickHouseSQLParserPanic},
-		// These the parser rejects outright rather than classifying.
+		// Both panicked before v0.5.5. https://github.com/AfterShip/clickhouse-sql-parser/pull/306
+		{"UnparseableDefaultExpression", "CREATE TABLE t (a String DEFAULT foo(b FROM 2)) ENGINE = Memory", CodeClickHouseSQLUnparseable},
+		{"TrailingOperatorInDefaultExpression", "CREATE TABLE t (a String DEFAULT 1 +) ENGINE = Memory", CodeClickHouseSQLUnparseable},
+		// Rejected outright rather than classified.
 		{"ShowGrants", "SHOW GRANTS", CodeClickHouseSQLUnparseable},
 		{"IntoOutfile", "SELECT * FROM t INTO OUTFILE '/tmp/x.csv'", CodeClickHouseSQLUnparseable},
-		// Table functions, which read through something other than a telemetry table.
 		{"UrlTableFunction", "SELECT * FROM url('http://attacker.example/x', CSV, 'a String')", CodeClickHouseSQLTableFunction},
-		{"FileTableFunction", "SELECT * FROM file('/etc/passwd', CSV, 'a String')", CodeClickHouseSQLTableFunction},
+		// file is also a scalar function, so the reading rule reaches it before the table rule does.
+		{"FileTableFunction", "SELECT * FROM file('/etc/passwd', CSV, 'a String')", CodeClickHouseSQLReadingFunction},
 		{"ExecutableTableFunction", "SELECT * FROM executable('script.sh', CSV, 'a String')", CodeClickHouseSQLTableFunction},
 		{"TableFunctionInJoin", "SELECT * FROM t1 JOIN url('http://x', CSV, 'a String') u ON 1 = 1", CodeClickHouseSQLTableFunction},
 		{"TableFunctionInCommonTableExpression", "WITH c AS (SELECT * FROM url('http://x', CSV, 'a String')) SELECT * FROM c", CodeClickHouseSQLTableFunction},
-		{"TableFunctionInWhereSubquery", "SELECT * FROM t WHERE a IN (SELECT * FROM file('/etc/passwd', CSV, 'a String'))", CodeClickHouseSQLTableFunction},
+		{"TableFunctionInWhereSubquery", "SELECT * FROM t WHERE a IN (SELECT * FROM url('http://x', CSV, 'a String'))", CodeClickHouseSQLTableFunction},
 		{"TableFunctionInUnion", "SELECT * FROM t UNION ALL SELECT * FROM url('http://x', CSV, 'a String')", CodeClickHouseSQLTableFunction},
-		// These reach the internal databases without ever naming one, so the table-function rule is the only thing that sees them.
+		// Reach an internal database without naming one, so only the table-function rule sees them.
 		{"MergeTableFunction", "SELECT * FROM merge('system', '.*')", CodeClickHouseSQLTableFunction},
 		{"RemoteTableFunction", "SELECT * FROM remote('other-host', 'system.users')", CodeClickHouseSQLTableFunction},
 		{"ClusterTableFunction", "SELECT * FROM cluster('c', 'system.users')", CodeClickHouseSQLTableFunction},
-		// Pure, but excluded: generateRandom streams rows the arguments do not bound, and values has no use here that an array literal does not already cover.
+		// Pure, but excluded: generateRandom is unbounded, and values adds nothing over an array literal.
 		{"GenerateRandomTableFunction", "SELECT * FROM generateRandom('a UInt64')", CodeClickHouseSQLTableFunction},
 		{"ValuesTableFunction", "SELECT * FROM values('a UInt64', 1, 2)", CodeClickHouseSQLTableFunction},
-		// Arguments are visited before the table function itself, so allowing a generator does not give anyone a wrapper to smuggle a read through.
+		// Arguments are visited first, so an allowed generator is not a wrapper to smuggle a read through.
 		{"InternalDatabaseInsideAllowedTableFunction", "SELECT * FROM numbers((SELECT count() FROM system.users))", CodeClickHouseSQLInternalDatabase},
 		{"InternalDatabaseJoinedOntoAllowedTableFunction", "SELECT * FROM numbers(31) AS n JOIN system.users AS u ON 1 = 1", CodeClickHouseSQLInternalDatabase},
 		{"InternalDatabaseUnionedWithAllowedTableFunction", "SELECT number FROM numbers(31) UNION ALL SELECT name FROM system.users", CodeClickHouseSQLInternalDatabase},
 		{"RefusedTableFunctionJoinedOntoAllowedTableFunction", "SELECT * FROM numbers(31) AS n JOIN url('http://x', CSV, 'a String') AS u ON 1 = 1", CodeClickHouseSQLTableFunction},
-		{"RefusedTableFunctionInsideAllowedTableFunction", "SELECT * FROM numbers((SELECT count() FROM file('/etc/passwd', CSV, 'a String')))", CodeClickHouseSQLTableFunction},
+		{"RefusedTableFunctionInsideAllowedTableFunction", "SELECT * FROM numbers((SELECT count() FROM url('http://x', CSV, 'a String')))", CodeClickHouseSQLTableFunction},
 		{"InternalDatabaseInsideAllowedTableFunctionCommonTableExpression", "WITH axis AS (SELECT * FROM numbers((SELECT count() FROM system.users))) SELECT * FROM axis", CodeClickHouseSQLInternalDatabase},
-		// Internal databases, which hold grants and server metadata rather than telemetry.
+		// Read a file, a dictionary or the server binary without naming a table, so neither the table rule nor the database rule sees them. The row count alone is an oracle: numbers(length(file(x))) returns one row per byte.
+		{"ScalarFileFunction", "SELECT file('/etc/passwd')", CodeClickHouseSQLReadingFunction},
+		{"ScalarFileFunctionInWhere", "SELECT * FROM t WHERE length(file('/etc/passwd')) > 0", CodeClickHouseSQLReadingFunction},
+		{"ScalarFileFunctionInGeneratorTableFunctionArgument", "SELECT * FROM numbers(length(file('/etc/passwd')))", CodeClickHouseSQLReadingFunction},
+		{"DictionaryFunction", "SELECT dictGetUInt64('d', 'k', toUInt64(1))", CodeClickHouseSQLReadingFunction},
+		{"DictionaryFunctionUppercase", "SELECT DICTGETSTRING('d', 'k', toUInt64(1))", CodeClickHouseSQLReadingFunction},
+		{"DictionaryFunctionInGeneratorTableFunctionArgument", "SELECT * FROM numbers(dictGetUInt64('d', 'k', toUInt64(1)))", CodeClickHouseSQLReadingFunction},
+		{"IntrospectionFunction", "SELECT demangle(addressToSymbol(toUInt64(1)))", CodeClickHouseSQLReadingFunction},
+		{"ModelEvaluationFunction", "SELECT catboostEvaluate('/model.bin', 1)", CodeClickHouseSQLReadingFunction},
+		// ClickHouse reads `x IN table` as `x IN (SELECT * FROM table)`, and a qualified name there is a Path rather than a TableIdentifier.
+		{"InternalDatabaseInInOperator", "SELECT * FROM t WHERE a IN system.users", CodeClickHouseSQLInternalDatabase},
+		{"InternalDatabaseInGlobalInOperator", "SELECT * FROM t WHERE a GLOBAL IN system.users", CodeClickHouseSQLInternalDatabase},
+		{"InternalDatabaseInNotInOperator", "SELECT * FROM t WHERE a NOT IN system.users", CodeClickHouseSQLInternalDatabase},
 		{"SystemUsers", "SELECT * FROM system.users", CodeClickHouseSQLInternalDatabase},
 		{"SystemUppercase", "SELECT * FROM SYSTEM.USERS", CodeClickHouseSQLInternalDatabase},
 		{"SystemQuoted", "SELECT count() FROM `system`.`tables`", CodeClickHouseSQLInternalDatabase},
@@ -139,7 +161,7 @@ func TestErrIfStatementIsNotValid_Fail(t *testing.T) {
 		{"SystemInJoin", "SELECT * FROM signoz_logs.distributed_logs_v2 AS l JOIN system.users AS u ON 1 = 1", CodeClickHouseSQLInternalDatabase},
 		{"SystemInIntersect", "SELECT * FROM t INTERSECT SELECT * FROM system.users", CodeClickHouseSQLInternalDatabase},
 		{"InformationSchema", "SELECT * FROM information_schema.tables", CodeClickHouseSQLInternalDatabase},
-		// A query-level setting takes precedence over the one the caller applies.
+		// Takes precedence over the setting the caller applies.
 		{"ReadonlySettingOverride", "SELECT * FROM t SETTINGS readonly = 0", CodeClickHouseSQLReadonlyOverride},
 		{"ReadonlySettingOverrideAmongOthers", "SELECT * FROM t SETTINGS max_threads = 4, readonly = 0", CodeClickHouseSQLReadonlyOverride},
 	}
@@ -148,7 +170,33 @@ func TestErrIfStatementIsNotValid_Fail(t *testing.T) {
 		t.Run(testCase.name, func(t *testing.T) {
 			err := ErrIfStatementIsNotValid(testCase.query)

-			assert.Error(t, err)
+			// Required rather than asserted: errors.Asc dereferences the error it is given.
+			require.Error(t, err)
+			assert.True(t, errors.Asc(err, testCase.expectedCode), "expected code %s, got %v", testCase.expectedCode, err)
+		})
+	}
+}
+
+func TestErrIfStatementIsNotValid_ShouldPassButFails(t *testing.T) {
+	testCases := []struct {
+		name         string
+		query        string
+		expectedCode errors.Code
+	}{
+		// The left operand commits the parser to a subquery, leaving the operator nowhere to bind. Parenthesising only the right operand is fine.
+		{"ParenthesisedUnionLeftOperand", "SELECT a FROM ((SELECT 1 AS a) UNION ALL (SELECT 2 AS a))", CodeClickHouseSQLUnparseable},
+		{"ParenthesisedExceptLeftOperand", "SELECT a FROM ((SELECT 1 AS a) EXCEPT (SELECT 2 AS a))", CodeClickHouseSQLUnparseable},
+		{"ParenthesisedUnionLeftOperandAtStatementLevel", "(SELECT 1 AS a) UNION ALL (SELECT 2 AS a)", CodeClickHouseSQLUnparseable},
+		// The one keyword PR 305 left behind, because ON also opens a join condition.
+		{"UnquotedOnAsColumnName", "SELECT on + 1 FROM t", CodeClickHouseSQLUnparseable},
+	}
+
+	for _, testCase := range testCases {
+		t.Run(testCase.name, func(t *testing.T) {
+			err := ErrIfStatementIsNotValid(testCase.query)
+
+			// Required rather than asserted: errors.Asc dereferences the error it is given.
+			require.Error(t, err)
 			assert.True(t, errors.Asc(err, testCase.expectedCode), "expected code %s, got %v", testCase.expectedCode, err)
 		})
 	}
--- a/pkg/signoz/provider.go
+++ b/pkg/signoz/provider.go
@@ -234,6 +234,7 @@ func NewSQLMigrationProviderFactories(
 		sqlmigration.NewUpdateRoleTransactionGroupsFactory(),
 		sqlmigration.NewFillDashboardSpecCollectionsFactory(sqlstore, dashboardStore),
 		sqlmigration.NewScrubEmailChannelTransportFactory(sqlstore),
+		sqlmigration.NewAddDashboardTuplesFactory(sqlstore),
 	)
 }

--- a/pkg/sqlmigration/108_add_dashboard_tuples.go
+++ b/pkg/sqlmigration/108_add_dashboard_tuples.go
@@ -0,0 +1,149 @@
+package sqlmigration
+
+import (
+	"context"
+	"time"
+
+	"github.com/SigNoz/signoz/pkg/factory"
+	"github.com/SigNoz/signoz/pkg/sqlstore"
+	"github.com/SigNoz/signoz/pkg/types/authtypes"
+	"github.com/oklog/ulid/v2"
+	"github.com/uptrace/bun"
+	"github.com/uptrace/bun/dialect"
+	"github.com/uptrace/bun/migrate"
+)
+
+type addDashboardTuples struct {
+	sqlstore sqlstore.SQLStore
+}
+
+func NewAddDashboardTuplesFactory(sqlstore sqlstore.SQLStore) factory.ProviderFactory[SQLMigration, Config] {
+	return factory.NewProviderFactory(factory.MustNewName("add_dashboard_tuples"), func(ctx context.Context, ps factory.ProviderSettings, c Config) (SQLMigration, error) {
+		return &addDashboardTuples{sqlstore: sqlstore}, nil
+	})
+}
+
+func (migration *addDashboardTuples) Register(migrations *migrate.Migrations) error {
+	return migrations.Register(migration.Up, migration.Down)
+}
+
+func (migration *addDashboardTuples) Up(ctx context.Context, db *bun.DB) error {
+	tx, err := db.BeginTx(ctx, nil)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = tx.Rollback() }()
+
+	var storeID string
+	err = tx.QueryRowContext(ctx, `SELECT id FROM store WHERE name = ? LIMIT 1`, "signoz").Scan(&storeID)
+	if err != nil {
+		return err
+	}
+
+	var orgIDs []string
+	rows, err := tx.QueryContext(ctx, `SELECT id FROM organizations`)
+	if err != nil {
+		return err
+	}
+	defer rows.Close()
+	for rows.Next() {
+		var orgID string
+		if err := rows.Scan(&orgID); err != nil {
+			return err
+		}
+		orgIDs = append(orgIDs, orgID)
+	}
+
+	isPG := migration.sqlstore.BunDB().Dialect().Name() == dialect.PG
+
+	// The dashboard routes, including the public sharing config, now authorize per
+	// resource, so every org needs the managed-role dashboard tuples. Orgs
+	// bootstrapped before these entries landed in ManagedRoleToTransactions never
+	// got them.
+	tuples := []migrationTuple{
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "read"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "update"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "delete"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "create"},
+		{authtypes.SigNozAdminRoleName, "metaresource", "dashboard", "list"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "read"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "update"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "delete"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "create"},
+		{authtypes.SigNozEditorRoleName, "metaresource", "dashboard", "list"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "dashboard", "read"},
+		{authtypes.SigNozViewerRoleName, "metaresource", "dashboard", "list"},
+	}
+
+	for _, orgID := range orgIDs {
+		for _, tuple := range tuples {
+			entropy := ulid.DefaultEntropy()
+			now := time.Now().UTC()
+			tupleID := ulid.MustNew(ulid.Timestamp(now), entropy).String()
+
+			objectID := "organization/" + orgID + "/" + tuple.objectName + "/*"
+			roleSubject := "organization/" + orgID + "/role/" + tuple.roleName
+
+			if isPG {
+				user := "role:" + roleSubject + "#assignee"
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, _user, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, _user) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, _user, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, user, 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			} else {
+				result, err := tx.ExecContext(ctx, `
+					INSERT INTO tuple (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, user_type, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", "userset", tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+				rowsAffected, err := result.RowsAffected()
+				if err != nil {
+					return err
+				}
+				if rowsAffected == 0 {
+					continue
+				}
+				_, err = tx.ExecContext(ctx, `
+					INSERT INTO changelog (store, object_type, object_id, relation, user_object_type, user_object_id, user_relation, operation, ulid, inserted_at)
+					VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+					ON CONFLICT (store, ulid, object_type) DO NOTHING`,
+					storeID, tuple.objectType, objectID, tuple.relation, "role", roleSubject, "assignee", 0, tupleID, now,
+				)
+				if err != nil {
+					return err
+				}
+			}
+		}
+	}
+
+	return tx.Commit()
+}
+
+func (migration *addDashboardTuples) Down(context.Context, *bun.DB) error {
+	return nil
+}
--- a/pkg/types/coretypes/registry_resource.go
+++ b/pkg/types/coretypes/registry_resource.go
@@ -54,7 +54,7 @@ var (
 	ResourceMetaResourceCloudIntegration                 = NewResourceMetaResource(KindCloudIntegration)
 	ResourceMetaResourceCloudIntegrationService          = NewResourceMetaResource(KindCloudIntegrationService)
 	ResourceMetaResourceIntegration                      = NewResourceMetaResource(KindIntegration)
-	ResourceMetaResourceDashboard                        = NewResourceMetaResource(KindDashboard)
+	ResourceMetaResourceDashboard                        = NewResourceMetaResource(KindDashboard, VerbCreate, VerbList, VerbRead, VerbUpdate, VerbDelete)
 	ResourceMetaResourcePublicDashboard                  = NewResourceMetaResource(KindPublicDashboard)
 	ResourceMetaResourceIngestionKey                     = NewResourceMetaResource(KindIngestionKey)
 	ResourceMetaResourceIngestionLimit                   = NewResourceMetaResource(KindIngestionLimit)
--- a/tests/integration/testdata/promqltestcorpus/known_divergences_v2.json
+++ b/tests/integration/testdata/promqltestcorpus/known_divergences_v2.json
@@ -1,4 +1,17 @@
 {
-  "note": "Divergences of the clickhousev2 provider (pinned via X-SigNoz-PromQL-Provider) from the upstream reference engine, enforced exactly by 01_upstream_corpus.py in both directions. This ledger is the rollout scorecard for the provider swap: the default provider cannot be replaced by clickhousev2 while anything is listed here. Entries must carry the defect's cause and be REMOVED as the provider is fixed.",
-  "divergences": {}
+  "note": "Divergences of the clickhousev2 provider (pinned via X-SigNoz-PromQL-Provider) from the upstream reference engine, enforced exactly by 01_upstream_corpus.py in both directions. This ledger is the rollout scorecard for the provider swap: the default provider cannot be replaced by clickhousev2 while anything is listed here. Entries must carry the defect's cause and be REMOVED as the provider is fixed. Current class: the engine aggregates floats with Kahan compensated summation (sum, sum_over_time) and an overflow-free incremental mean (avg); ClickHouse's sumForEach/avgForEach/arraySum are naive, so extreme-magnitude corpus data (±1e100 cancellation, ±1.8e308 overflow) diverges on transpiled plans. Burn-down candidates: sumKahanForEach for the cancellation class; the overflow class needs an incremental-mean aggregate ClickHouse does not have.",
+  "divergences": {
+    "aggregators.test:651[base]": "avg over near-max-float64 values: engine's incremental mean never forms the overflowing sum; avgForEach sums then divides, overflowing to +Inf",
+    "aggregators.test:651[instant-coarse]": "same as aggregators.test:651[base] on the coarse-step grid variant",
+    "aggregators.test:654[base]": "avg over near-min-float64 values: engine's incremental mean never forms the overflowing sum; avgForEach overflows to -Inf",
+    "aggregators.test:654[instant-coarse]": "same as aggregators.test:654[base] on the coarse-step grid variant",
+    "aggregators.test:687[base]": "sum over {1e100, -1e100, small}: engine uses Kahan compensated summation; sumForEach's naive summation loses the small terms to cancellation and returns 0",
+    "aggregators.test:687[instant-coarse]": "same as aggregators.test:687[base] on the coarse-step grid variant",
+    "aggregators.test:695[base]": "avg over {1e100, -1e100, small}: same Kahan-vs-naive cancellation as aggregators.test:687, divided by count",
+    "aggregators.test:695[instant-coarse]": "same as aggregators.test:695[base] on the coarse-step grid variant",
+    "functions.test:1084[instant-coarse]": "sum_over_time over a window containing ±1e100: the disjoint coarse-step form's arraySum slide is naive summation, cancelling to 0 (the base variant's W>64 shape falls back to the engine and is exact)",
+    "functions.test:1087[instant-coarse]": "avg_over_time, same window and cancellation as functions.test:1084[instant-coarse]",
+    "functions.test:1149[base]": "avg_over_time over ±2.258e220-magnitude samples: engine's Kahan-compensated incremental mean cancels exactly to 0; the bucketed form's naive slide summation leaves a ~1e202 residue",
+    "functions.test:1149[instant-coarse]": "same as functions.test:1149[base] through the disjoint coarse-step form"
+  }
 }
--- a/tests/integration/tests/dashboard/06_authz.py
+++ b/tests/integration/tests/dashboard/06_authz.py
@@ -0,0 +1,623 @@
+from collections.abc import Callable
+from http import HTTPStatus
+
+import requests
+from wiremock.resources.mappings import Mapping
+
+from fixtures.auth import (
+    USER_ADMIN_EMAIL,
+    USER_ADMIN_PASSWORD,
+    add_license,
+    change_user_role,
+    create_active_user,
+    find_user_by_email,
+)
+from fixtures.role import transaction_group
+from fixtures.types import Operation, SigNoz, TestContainerDocker
+
+V2_BASE_URL = "/api/v2/dashboards"
+MAX_LIST_LIMIT = 200
+
+_EDITOR_EMAIL = "editor+dashboardauthz@integration.test"
+_EDITOR_PASSWORD = "password123Z$"
+_VIEWER_EMAIL = "viewer+dashboardauthz@integration.test"
+_VIEWER_PASSWORD = "password123Z$"
+
+_ACTOR_ROLE_NAME = "dashboard-fga-actor"
+_ACTOR_EMAIL = "customrole+dashboardauthz@integration.test"
+_ACTOR_PASSWORD = "password123Z$"
+
+# Instance verbs are granted on _TARGET_A only; _TARGET_B must stay forbidden.
+_TARGET_A = "dashboard-authz-target-a"
+_TARGET_B = "dashboard-authz-target-b"
+_CLONE_SOURCE = "dashboard-authz-clone-source"
+_VIEW_NAME = "dashboard-authz-view"
+
+_SPEC = {
+    "display": {"name": "Dashboard Authz"},
+    "duration": "1h",
+    "links": [],
+    "variables": [],
+    "panels": {},
+    "layouts": [],
+}
+
+
+# ─── managed roles (community-safe: no license, role gate only) ───────────────
+
+
+def test_setup_managed_role_users(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    # A rerun against a --reuse stack starts from the previous run's state, and
+    # inviting an existing address fails, so only invite what is missing.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    existing_emails = {user["email"] for user in response.json()["data"]}
+
+    for email, role, password, name in (
+        (_EDITOR_EMAIL, "EDITOR", _EDITOR_PASSWORD, "dashboard authz editor"),
+        (_VIEWER_EMAIL, "VIEWER", _VIEWER_PASSWORD, "dashboard authz viewer"),
+    ):
+        if email not in existing_emails:
+            create_active_user(signoz, admin_token, email=email, role=role, password=password, name=name)
+
+    # (org_id, name) is unique, so leftovers from an earlier run have to go before
+    # these are recreated.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    for dashboard in response.json()["data"]["dashboards"]:
+        if dashboard["name"] in (_TARGET_A, _TARGET_B, _CLONE_SOURCE):
+            response = requests.delete(
+                signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{dashboard['id']}"),
+                headers={"Authorization": f"Bearer {admin_token}"},
+                timeout=5,
+            )
+            assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    for name in (_TARGET_A, _TARGET_B, _CLONE_SOURCE):
+        response = requests.post(
+            signoz.self.host_configs["8080"].get(V2_BASE_URL),
+            json={"schemaVersion": "v6", "name": name, "spec": _SPEC, "tags": []},
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.CREATED, response.text
+
+
+def test_viewer_allowed_on_reads_and_pins(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_TARGET_A]}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/users/me/dashboards"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v2/users/me/dashboards/{ids[_TARGET_A]}/pins"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/users/me/dashboards/{ids[_TARGET_A]}/pins"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_viewer_forbidden_on_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+    target_id = ids[_TARGET_A]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(V2_BASE_URL),
+        json={"schemaVersion": "v6", "name": "viewer-denied", "spec": _SPEC, "tags": []},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"create: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}"),
+        json={"schemaVersion": "v6", "name": _TARGET_A, "spec": _SPEC, "tags": []},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"update: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.patch(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}"),
+        json=[{"op": "replace", "path": "/spec/display/name", "value": "Patched"}],
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"patch: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}/clone"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"clone: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}/migrate"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"migrate: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}/lock"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"lock: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{target_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"delete: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_editor_allowed_on_mutations(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_TARGET_A]}"),
+        json={"schemaVersion": "v6", "name": _TARGET_A, "spec": _SPEC, "tags": [{"key": "team", "value": "pulse"}]},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_CLONE_SOURCE]}/clone"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    clone_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{clone_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_viewer_forbidden_on_public_config(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # The public config routes authorize on the dashboard itself, so a viewer is
+    # refused before the handler runs, licensed or not.
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_id = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}[_TARGET_A]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": True, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"create public: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": False, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"update public: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"delete public: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_viewer_allowed_on_saved_views(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # Saved views ride on dashboard list, which a viewer holds, so the whole CRUD
+    # surface is open to them.
+    token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get("/api/v2/dashboard_views"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get("/api/v2/dashboard_views"),
+        json={"name": _VIEW_NAME, "data": {"version": "v1", "sort": "updated_at", "order": "desc"}},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+    view_id = response.json()["data"]["id"]
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v2/dashboard_views/{view_id}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+# ─── per-object FGA scoping (enterprise, custom role) ─────────────────────────
+
+
+def test_apply_license(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    make_http_mocks: Callable[[TestContainerDocker, list[Mapping]], None],
+    get_token: Callable[[str, str], str],
+) -> None:
+    add_license(signoz, make_http_mocks, get_token)
+
+
+def test_editor_allowed_on_public_config(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    # An editor holds dashboard update, which is what the public config routes ask
+    # for, so publishing is open to editors and not just admins.
+    token = get_token(_EDITOR_EMAIL, _EDITOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_id = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}[_TARGET_B]
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": True, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, response.text
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    # Reading the config asks only for dashboard read, so a viewer sees it too.
+    viewer_token = get_token(_VIEWER_EMAIL, _VIEWER_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {viewer_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+
+def test_setup_scoped_actor(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    create_role: Callable[..., str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    create_role(
+        admin_token,
+        _ACTOR_ROLE_NAME,
+        [
+            transaction_group("read", "metaresource", "dashboard", [ids[_TARGET_A]]),
+            transaction_group("list", "metaresource", "dashboard", ["*"]),
+        ],
+    )
+
+    user_id = create_active_user(signoz, admin_token, email=_ACTOR_EMAIL, role="VIEWER", password=_ACTOR_PASSWORD, name="dashboard fga actor")
+    change_user_role(signoz, admin_token, user_id, "signoz-viewer", _ACTOR_ROLE_NAME)
+
+
+def test_read_scoped_to_granted_dashboard(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_TARGET_A]}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, f"read granted dashboard: {response.text}"
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[_TARGET_B]}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"read other dashboard: expected 403, got {response.status_code}: {response.text}"
+
+
+def test_list_returns_every_dashboard(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+):
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    # list is collection-scoped: list on "*" returns every dashboard, including
+    # the one the actor cannot read individually.
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    names = {dashboard["name"] for dashboard in response.json()["data"]["dashboards"]}
+    assert {_TARGET_A, _TARGET_B} <= names
+
+
+def test_publish_and_unpublish_require_update_on_the_dashboard(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    actor_role_id = find_role_id(admin_token, _ACTOR_ROLE_NAME)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    target_id = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}[_TARGET_A]
+
+    # read and list alone must not be enough to publish.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "dashboard", [target_id]),
+                transaction_group("list", "metaresource", "dashboard", ["*"]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    token = get_token(_ACTOR_EMAIL, _ACTOR_PASSWORD)
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": True, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"publish without dashboard update: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "dashboard", [target_id]),
+                transaction_group("list", "metaresource", "dashboard", ["*"]),
+                transaction_group("update", "metaresource", "dashboard", [target_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.post(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        json={"timeRangeEnabled": True, "defaultTimeRange": "10m"},
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.CREATED, f"publish with dashboard update: {response.text}"
+
+    # Unpublishing asks for the same update grant.
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "dashboard", [target_id]),
+                transaction_group("list", "metaresource", "dashboard", ["*"]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.FORBIDDEN, f"unpublish without dashboard update: expected 403, got {response.status_code}: {response.text}"
+
+    response = requests.put(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{actor_role_id}"),
+        json={
+            "description": "",
+            "transactionGroups": [
+                transaction_group("read", "metaresource", "dashboard", [target_id]),
+                transaction_group("list", "metaresource", "dashboard", ["*"]),
+                transaction_group("update", "metaresource", "dashboard", [target_id]),
+            ],
+        },
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, response.text
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/dashboards/{target_id}/public"),
+        headers={"Authorization": f"Bearer {token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"unpublish with dashboard update: {response.text}"
+
+
+def test_dashboard_authz_cleanup(
+    signoz: SigNoz,
+    create_user_admin: Operation,  # pylint: disable=unused-argument
+    get_token: Callable[[str, str], str],
+    find_role_id: Callable[[str, str], str],
+):
+    admin_token = get_token(USER_ADMIN_EMAIL, USER_ADMIN_PASSWORD)
+    actor = find_user_by_email(signoz, admin_token, _ACTOR_EMAIL)
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"/api/v2/users/{actor['id']}/roles"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    actor_entry = next((role for role in response.json()["data"] if role["name"] == _ACTOR_ROLE_NAME), None)
+    if actor_entry is not None:
+        response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"/api/v2/users/{actor['id']}/roles/{actor_entry['id']}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, f"remove role from user: {response.text}"
+
+    response = requests.delete(
+        signoz.self.host_configs["8080"].get(f"/api/v1/roles/{find_role_id(admin_token, _ACTOR_ROLE_NAME)}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {_ACTOR_ROLE_NAME}: {response.text}"
+
+    response = requests.get(
+        signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}?limit={MAX_LIST_LIMIT}"),
+        headers={"Authorization": f"Bearer {admin_token}"},
+        timeout=5,
+    )
+    assert response.status_code == HTTPStatus.OK, response.text
+    ids = {dashboard["name"]: dashboard["id"] for dashboard in response.json()["data"]["dashboards"]}
+
+    for name in (_TARGET_A, _TARGET_B, _CLONE_SOURCE):
+        response = requests.delete(
+            signoz.self.host_configs["8080"].get(f"{V2_BASE_URL}/{ids[name]}"),
+            headers={"Authorization": f"Bearer {admin_token}"},
+            timeout=5,
+        )
+        assert response.status_code == HTTPStatus.NO_CONTENT, f"delete {name}: {response.text}"
Author	SHA1	Message	Date
grandwizard28	a0b2025a5d	chore: simplify PR template and add agent rules - replace the multi-section PR template with four concise headings - add .claude/rules/ covering comments (repo-wide, Go, Python) and pull requests - ignore .dev/ and .claude/worktrees/ in .gitignore	2026-08-07 16:44:54 +05:30
Pandey	53ab4546bc	chore(deps): bump clickhouse-sql-parser to v0.5.5 (#12454 ) Some checks are pending build-staging / prepare (push) Waiting to run Details build-staging / js-build (push) Blocked by required conditions Details build-staging / go-build (push) Blocked by required conditions Details build-staging / staging (push) Blocked by required conditions Details cacheci / tests (push) Waiting to run Details Release Drafter / update_release_draft (push) Waiting to run Details Bumps `clickhouse-sql-parser` to v0.5.5, fixes the false rejection that was left over once it landed, and closes three holes in the same validator that the first two changes brought to light. ## The bump Reserved keywords as expression operands ([#305](https://github.com/AfterShip/clickhouse-sql-parser/pull/305)). `interval` was fixed in v0.5.4, but the same defect affected 36 other keywords once the column appeared as an operand rather than bare. Sweeping 94 candidates against ClickHouse 26.8.1.337, only `on` still rejects — and ClickHouse runs that too. This one was live: `sum(limit)` on a metric label. Panic on an unparseable `DEFAULT` expression ([#306](https://github.com/AfterShip/clickhouse-sql-parser/pull/306)). Both known cases return a parse error now instead of dereferencing nil. The `recover` in `ErrIfStatementIsNotValid` stays — it guards the next one of these, not these two. [#307](https://github.com/AfterShip/clickhouse-sql-parser/pull/307) also allows `CAST` in a table function's argument list. ## Table functions are only table functions in a table position The parser types a call inside a table function's argument list as a `TableFunctionExpr` as well, so the generator allow list only ever cleared a generator whose argument was a literal. Every real dashboard computes its row count — `numbers(greatest(1, intDiv(end_ns - start_ns, step_ns) + 1))` — and every one was refused, on `intDiv` rather than on `numbers`. `TableExpr.Expr` is the only table position a SELECT can reach, so the allow list asks that instead. Of the four places the parser builds a `TableFunctionExpr`, two are `CREATE TABLE` paths rejected as not-a-SELECT before the walk starts, one is `parseTableArgPrimaryExpr`, and one is the `FROM`/`JOIN` path that wraps into a `TableExpr`. ## Three holes that were already open Skipping argument position is only safe if nothing there can read, and that turned out not to be true — not because of this change, but independently of it. Reading functions. `file` is both a table function and a scalar function, and the validator never inspected scalar calls at all. On `main` today, `SELECT file('/etc/passwd')` is accepted and returns the file. A numeric wrapper passes ClickHouse's type check, so the row count alone is an oracle: `numbers(length(file(x)))` yields one row per byte. The same applies to the 42 dictionary accessors, which can be backed by HTTP, ODBC or another database, to `catboostEvaluate`, and to the introspection functions. All are now refused by name wherever they appear, under `clickhouse_sql_reading_function`. `x IN db.table`. ClickHouse reads this as `x IN (SELECT * FROM db.table)`, and a qualified name on the right of `IN` parses as a `Path`, not a `TableIdentifier` — so `SELECT * FROM t WHERE a IN system.users` bypassed the internal-database rule entirely. Now checked, including the `GLOBAL IN` and `NOT IN` forms. Quoted generator names. The allow list matched on the formatted name, which carries the quoting, so ``SELECT * FROM `numbers`(31)`` was refused. It now reads the identifier the way the internal-database branch already did. ## Effect Replaying 72 distinct shapes of production `clickhouse_sql` that the validator currently rejects: 64 pass, up from 59 on v0.5.4. Two came from the bump, three from the table-position change, and those three are 379 of the 1390 sampled occurrences. The three new rules add no false positives to the corpus. Of the eight left, four are correct rejections (`system` reads, `SHOW TABLES`), one is a dashboard variable rendering as the literal `<no value>`, one is SQL ClickHouse also rejects, and two are an open upstream gap. ## Tests `TestErrIfStatementIsNotValid_ShouldPassButFails` is back, holding what remains: three forms of a parenthesised left operand of a set operator, and `on` as a column name. It also stopped panicking — `errors.Asc` dereferences the error it is given, so a case starting to pass took the suite out with a SIGSEGV instead of reporting. Both refusal tables now share one harness, bounded by the same timeout the passing table uses. Known gap: no input is currently known to panic the parser, so the `recover` has no test exercising it.	2026-08-07 10:39:21 +00:00
Srikanth Chekuri	5c0dfe2ad1	feat(promql): transpile allowlisted query shapes to ClickHouse grid statements (#12325 ) > Stack (review in order; each PR's diff is against its predecessor): > 1. #12323 `v2-read-path` — v2 native read path (leaf package) > 2. #12324 `v2-wiring` — wiring, shadow/pin rollout machinery, dual-leg conformance > 3. #12325 `v2-transpiler` — PromQL→ClickHouse transpiler + classification golden > 4. #12093 `issue-4293` — the /prometheus API move (breaking slice, last) ### What The performance half of the v2 provider: an allowlist compiler (`classify`/`rewrite`) that evaluates proven PromQL shapes entirely inside ClickHouse on the `timeSeriesToGrid` aggregate functions (CH ≥ 25.6), so one row per output series comes back instead of every raw sample. Everything not provably equivalent falls back to the engine over the PR-1 querier; a transpilable subtree under a non-transpilable node runs hybrid (subtree materialized as synthetic series, engine on top). `TryExecuteRange` slots into the PR-2 serve/shadow paths (until now engine-only) through the new `prometheus.RangeExecutor` capability interface — the provider stays unexported and pkg/querier keeps holding `prometheus.Prometheus`; providers without the capability (v1) simply never transpile. The capability folds into the main interface once v1 is removed. Highlights (docs/contributing/prometheus.md carries the full correctness story): - Range functions map to verified grid aggregates; `increase` is `rate × range` exactly (same extrapolated delta, factor algebra). - Instant selectors reproduce stale-marker shadowing with a three-aggregate compare — skipping stale rows in WHERE would resurrect the sample the marker buried. - `_over_time` at range = k·step aggregates whole step buckets (`groupArrayInsertAt` + slide) — no per-window fan-out, no prefix-sum differencing. - Window-sliver filtering (the headline perf commit, folded here): when the window is narrower than the step, only window/step of the timeline can influence any grid point; a lattice predicate in WHERE cuts the aggregate's input by the coverage ratio — measured 74s/28GiB → 16s/4.3GiB on a 36k-series 1w rate, and a 2.67B-sample case that exceeded 150GiB now completes in 19s/17GiB. Over sliver-filtered rows the last-style gates lift (instant selectors and `last_over_time` transpile at window < step), and disjoint-window `_over_time` forms drop the divisibility gate. - Scalar-op pipelines apply in Go, slot by slot — same float64 ops, same order the AST dictates. Two guards land with it: - Classification golden* (`classification_golden_test.go` + `testdata/classification_golden.json`): freezes the route (full/hybrid(n)/fallback + reason) of every conformance-corpus expression, one line each — 317 expressions: 132 full, 39 hybrid, 146 fallback. The test also requires each expression to route the same on every corpus grid; if a classifier change ever makes the route grid-dependent, the test fails and the key must grow. Routing is its own correctness surface — silently falling back costs the pushdown, silently transpiling an unproven shape risks wrong numbers; both now show up in review as a golden diff, with the corpus suite's v2 leg judging the numbers. - Workload coverage reporter (`TestClassifyCorpus`, env-gated): classifies a JSON-lines corpus of real dashboard/alert queries and buckets fallbacks by reason, to steer future allowlist work. What the dual-leg suite caught on its first transpiled run (evidence the PR-2 guard works, worth stating in review): - The classifier read a duration expression's offset (`x offset step()`) as zero and transpiled it — offset expressions parse without the experimental-parser flag, so they reach production. 20 corpus cases served silently wrong numbers. Fixed by refusing `OriginalOffsetExpr` / `RangeExpr` / `StepExpr` at classification (engine evaluates them exactly); regression cases added, golden regenerated (30 routings flipped to fallback). - Name-drop assembly treated temporally-disjoint same-labelset twins as separate series: `-{job="api"}` spanning `http_requests`/`http_errors` returned a 400 the engine would not raise, and hybrid `-metric_a or -metric_b` returned duplicate `{}` series. The engine's actual rule is: assemble the matrix by labelset, merging elements that never share an evaluation timestamp; error only on a same-timestamp conflict. Both the full-plan path (`mergeSameLabelsetSeries`) and the hybrid post-strip path (`mergeMatrixByLabelset`) now reproduce it, with unit tests pinning the corpus scenarios. - 12 remaining divergences, all one class, recorded in `known_divergences_v2.json` with causes: the engine aggregates with Kahan compensated summation (sum, sum_over_time) and an overflow-free incremental mean (avg); ClickHouse's `sumForEach`/`avgForEach`/`arraySum` are naive, so ±1e100 cancellation returns 0/residue and near-max-float64 `avg` overflows to ±Inf. Burn-down note: `sumKahanForEach` for the cancellation class; the overflow class needs an incremental-mean aggregate ClickHouse doesn't have. ### Alternatives considered and discarded - General PromQL→SQL translation. An allowlist inverts the failure mode: an overlooked construct becomes a fallback instead of a wrong number. Every shape on the list was validated slot-for-slot against the vendored engine on live data before entering it. - ClickHouse's own PromQL dialect (ClickHouse#57545, `dialect='promql'`). Emits the same grid functions, but currently covers only rate/irate/delta/idelta/last_over_time, has no fallback engine, and ties us to their TimeSeries table engine. We use the same primitives with our own classifier and our own exactness gates. - *Prefix-sum differencing for `_over_time` windows. Large-minus-large cancellation drifts past the shadow tolerance on counter-sized values; direct per-slot combination of at most W bucket partials adds the way the engine adds. - Fanning each sample into every window that covers it. Multiplies rows by W — billions of rows for a long range over a short step; the bucketed form's row count is series × buckets, the size of the output. - Handling staleness by filtering stale rows in WHERE (instant units). Resurrects the older real sample the marker was written to bury; hence the last-overall vs last-non-stale timestamp comparison. - Transpiling @-modifier and default-resolution subqueries.** Their evaluation grid depends on server runtime settings the transpiler cannot see; they stay on the (exact) engine path. ### Test plan - `go test ./pkg/prometheus/clickhouseprometheusv2` — transpiler unit tests (SQL forms, classification, scalar ops, subquery grids), golden. - `pytest integration/tests/promqlconformance/` — the v2 leg now exercises transpiled serving for every routable corpus case; ledger unchanged (empty). 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Fable 5 <noreply@anthropic.com> Co-authored-by: Pandey <vibhupandey28@gmail.com>	2026-08-07 10:07:32 +00:00
Pandey	bb3f5818c1	fix(sentry): stop reporting self-healed chunk load failures (#12440 ) Some checks failed build-staging / js-build (push) Has been cancelled Details build-staging / prepare (push) Has been cancelled Details build-staging / go-build (push) Has been cancelled Details build-staging / staging (push) Has been cancelled Details cacheci / tests (push) Has been cancelled Details Release Drafter / update_release_draft (push) Has been cancelled Details A tab that outlives a deploy requests hashed assets the new build no longer has. `lazyRetry` already recovers from this by reloading once, so the resulting errors are noise — they spike on every deploy and each one burns a Session Replay (`replaysOnErrorSampleRate: 1.0`). ### Sentry `ignoreErrors` Filters the whole class. Four patterns because the same failure is worded differently per source: \| Pattern \| Source \| \|---\|---\| \| `Unable to preload CSS for` \| Vite's own thrown `Error`, identical everywhere \| \| `Failed to fetch dynamically imported module` \| Chromium \| \| `error loading dynamically imported module` \| Firefox \| \| `Importing a module script failed` \| Safari \| `ignoreErrors` is applied as an event processor (`@sentry/core` `eventFilters.js`), so the event is dropped before transport. Replay's error flush hooks `afterSendEvent`, which never fires for a dropped event — so this stops the replay burn too, not just the issue count. Trade-off, stated plainly: stale-asset failures now produce no Sentry signal at all, including the case where the reload doesn't fix it. A genuinely broken deploy has to be caught from asset 404 rates rather than from Sentry. ### `lazyRetry` Behaviour is unchanged. One guard added: `setSessionStorageApi` returns `false` when sessionStorage is blocked (iframe, storage disabled), and the retry flag can't persist. The reload was previously issued anyway, so every failed import reloaded forever with no way out. It now reloads only when the flag was actually written.	2026-08-06 22:31:33 +00:00
Jugal Kishore	8a481d8a75	feat(onboarding): add Apache, HAProxy, Elasticsearch, RabbitMQ, Open WebUI, DSPy datasources (#12363 ) Some checks failed build-staging / prepare (push) Has been cancelled Details build-staging / js-build (push) Has been cancelled Details build-staging / go-build (push) Has been cancelled Details build-staging / staging (push) Has been cancelled Details cacheci / tests (push) Has been cancelled Details Release Drafter / update_release_draft (push) Has been cancelled Details	2026-08-06 15:28:41 +00:00
Shivam Gupta	84eeacd084	feat(onboarding): add HCP Vault, OpenTelemetry eBPF, Langflow, Cohere, Auth0, and PgBouncer datasources (#12098 ) * feat(onboarding): add HCP Vault, OpenTelemetry eBPF, Langflow, Cohere, and Auth0 datasources Add UI onboarding configurations (logos + datasource entries) so these tools appear in the Add Data Source onboarding flow. SVG logos optimized with svgo. Closes signoz.io#3614 (HCP Vault) Closes signoz.io#3626 (OpenTelemetry eBPF / OBI) Closes signoz.io#3680 (Langflow) Closes signoz.io#3702 (Cohere) Closes signoz.io#3562 (Auth0) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(onboarding): add PgBouncer datasource Add PgBouncer (PostgreSQL connection pooler) metrics onboarding entry, reusing the existing PostgreSQL logo. Closes signoz.io#3553 (PgBouncer) Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(onboarding): update SVG logos and category of datasources --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> Co-authored-by: Jugal Kishore <jugal@signoz.io>	2026-08-06 13:25:53 +00:00
Vinicius Lourenço	41576954c4	fix(query-context): ensure operator is correctly suggested (#11575 ) Co-authored-by: Nikhil Mantri <nikhil.mantri1999@gmail.com>	2026-08-06 13:24:06 +00:00
Vinicius Lourenço	4a7ce110b3	fix(infrastructure-monitoring-hosts): missing warning prop for list table (#12431 ) Some checks failed build-staging / prepare (push) Has been cancelled Details build-staging / js-build (push) Has been cancelled Details build-staging / go-build (push) Has been cancelled Details build-staging / staging (push) Has been cancelled Details cacheci / tests (push) Has been cancelled Details Release Drafter / update_release_draft (push) Has been cancelled Details	2026-08-06 11:24:26 +00:00
Naman Verma	e42e42ee71	feat: enable FGA for dashboards and their public config (#12408 ) * feat: enable FGA for dashboards and their public config * test: add integration test for dashboard FGA * fix: fix permissions for public dashboards, pinning, views * fix: allow viewers to manage views * fix: remove edits to the public dashboard line	2026-08-06 07:19:21 +00:00
dependabot[bot]	b4e1af261b	chore(deps): bump google.golang.org/grpc from 1.80.0 to 1.82.1 (#12222 ) Bumps [google.golang.org/grpc](https://github.com/grpc/grpc-go) from 1.80.0 to 1.82.1. - [Release notes](https://github.com/grpc/grpc-go/releases) - [Commits](https://github.com/grpc/grpc-go/compare/v1.80.0...v1.82.1) --- updated-dependencies: - dependency-name: google.golang.org/grpc dependency-version: 1.82.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-06 07:17:06 +00:00
dependabot[bot]	0de7f666e4	chore(deps): bump github.com/google/cel-go from 0.28.0 to 0.29.0 (#12305 ) Bumps [github.com/google/cel-go](https://github.com/google/cel-go) from 0.28.0 to 0.29.0. - [Release notes](https://github.com/google/cel-go/releases) - [Commits](https://github.com/google/cel-go/compare/v0.28.0...v0.29.0) --- updated-dependencies: - dependency-name: github.com/google/cel-go dependency-version: 0.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-06 07:16:55 +00:00
Vinicius Lourenço	20606e274b	feat(infrastructure-monitoring-details): add support to pin tooltip (#12414 ) Some checks failed build-staging / prepare (push) Has been cancelled Details build-staging / js-build (push) Has been cancelled Details build-staging / go-build (push) Has been cancelled Details build-staging / staging (push) Has been cancelled Details cacheci / tests (push) Has been cancelled Details Release Drafter / update_release_draft (push) Has been cancelled Details	2026-08-06 02:25:45 +00:00
				`@@ -0,0 +1 @@`
				`<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 24 24"><path fill="#EB5424" d="M21.98 7.448 19.62 0H4.347L2.02 7.448c-1.352 4.312.03 9.206 3.815 12.015L12.007 24l6.157-4.552c3.755-2.81 5.182-7.688 3.815-12.015l-6.16 4.58 2.343 7.45-6.157-4.597-6.158 4.58 2.358-7.433-6.188-4.55 7.63-.045L12.008 0l2.356 7.404 7.615.044z"/></svg>`
				`@@ -0,0 +1 @@`
				<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20"><path fill="#355146" fill-rule="evenodd" d="M6.82 11.908c.525 0 1.57-.03 3.013-.639 1.682-.71 5.029-2 7.443-3.323 1.689-.926 2.429-2.151 2.429-3.8 0-2.29-1.81-4.146-4.043-4.146H6.307C3.1 0 .5 2.666.5 5.954s2.434 5.954 6.32 5.954" clip-rule="evenodd"/><path fill="#d18ee2" fill-rule="evenodd" d="M8.402 16.01c0-1.611.947-3.064 2.399-3.682l2.946-1.254c2.98-1.268 6.26.977 6.26 4.286 0 2.563-2.027 4.64-4.527 4.64l-3.19-.002c-2.147 0-3.888-1.785-3.888-3.987" clip-rule="evenodd"/><path fill="#ff7759" d="M3.848 12.691C1.998 12.691.5 14.228.5 16.124v.444C.5 18.464 1.999 20 3.848 20s3.347-1.536 3.347-3.432v-.444c0-1.896-1.499-3.433-3.347-3.433"/></svg>