diff --git a/brain/knowledge/decisions/000015-fan-in-is-an-event-driven-waitpoint-barrier.md b/brain/knowledge/decisions/000015-fan-in-is-an-event-driven-waitpoint-barrier.md
index c8c9c5e21113..94095a8c881a 100644
--- a/brain/knowledge/decisions/000015-fan-in-is-an-event-driven-waitpoint-barrier.md
+++ b/brain/knowledge/decisions/000015-fan-in-is-an-event-driven-waitpoint-barrier.md
@@ -14,7 +14,7 @@ producer's ordinal), nullable `label` (the human name in the summary) and a smal
 Release is an **unconditional floor rule**: a sealed barrier releases once no signal is still `PENDING`. No
 configuration can produce a hang; `policy` only ever releases *sooner* — `requiredSuccesses` (K-of-N
 approvals) and `releaseOnFirstFailure` (veto). Evaluation is a coalesced `BarrierJobName.EVALUATE` job on a
-dedicated `BARRIER_JOBS` queue, deduplicated on the barrier id, owned by the waitpoints module. Counts are
+dedicated `BARRIER_EVALUATION` queue, deduplicated on the barrier id, owned by the waitpoints module. Counts are
 taken once, from a single `GROUP BY status`, and handed to a pure predicate. Signals are deleted on release,
 in the same transaction that completes the waitpoint — summary first, then complete, then delete.
 
@@ -51,7 +51,7 @@ all, purely because child rows appear later than the dispatch that created them.
   already returns the ceiling, and a shorter deadline is a `policy` input, so both are known at create.
 - **Evaluation must be coalesced, and coalescing must not swallow its own last signal.** At 10 000 signals,
   evaluating per signal is ~100M row reads. BullMQ holds a deduplication key while the job is queued *and*
-  active, so the handler's **first statement** is `clearEvaluationDeduplication`, and every producer commits
+  active, so the handler's **first statement** is `clearEvaluationDedupKey`, and every producer commits
   its signal row **before** enqueuing. Otherwise the final signal lands while the job meant to see it is
   already running, its enqueue is dropped as a duplicate, and the barrier waits out its deadline holding a
   run that was ready to resume.
@@ -61,6 +61,31 @@ all, purely because child rows appear later than the dispatch that created them.
   `shouldReleaseBarrier({ policy, sealed, counts })` takes counts rather than issuing its own queries, so one
   `GROUP BY status` replaces up to three round-trips and the policy matrix is unit-testable without a
   database.
+- **Identity is path-keyed, and that needed no new column.** The engine sends `loop_1:3/loop_2:0/approval`
+  in the existing `stepName` field, which is only ever an identity key inside `waitpoint-service`. Which
+  fixes a live bug on the way past: a delay or approval **inside a loop** used to reuse one waitpoint row
+  across every iteration, so iteration 2 found iteration 1's COMPLETED row in `createForPause`'s
+  pre-completed check and skipped its pause entirely.
+- **Two per-run waitpoint reads stopped being sound and were fixed here.** `getByFlowRunId` became
+  `findCompletedWaitpointIfRunIsIdle` — **null when any PENDING row exists for the run**, else the newest COMPLETED
+  one — because per-iteration rows mean a run can hold a COMPLETED leftover *and* an open PENDING pause at
+  once, and both callers delete the row they find and enqueue a resume. `findNonFanInByFlowRunId` became
+  `findSubflowWaitpoint` and prefers PENDING, newest first. `findPendingByVersion` is **still** unsound
+  for parallel branches; nothing here creates that case.
+- **The resume guards moved to the entry point rather than becoming a flag.** `resumeFromWaitpoint`
+  **refuses barriers, always** — by addressed waitpoint type, or, on the by-run legacy routes, by "does this
+  run hold any PENDING barrier". Every unscoped route goes through it, so there is no `false` to forget and
+  no parameter to default wrong. What the guard is *not* is structural: `resumeTrusted` and
+  `resumeTrustedWithoutLock` are ordinary public members of `resumeService`, one `if` away from the guard
+  they skip. `flow-runs-queue`'s pre-completed recovery calls the unlocked variant from outside the module,
+  so a module-private `resumeTrusted` would not have worked as written. Treated as acceptable because the
+  reachable surface — the HTTP routes — is closed; if a third caller appears, make the boundary real rather
+  than adding a second convention.
+- **`release` is what happens to a barrier; `resume` is what happens to a run.** The two verbs sit one layer
+  apart — `barrierService.release` closes the barrier, then asks `resumeService` to resume the run — so a
+  `resumeService.releaseBarrier` named the wrong layer and hid that the same method also serves plain `DELAY`
+  and `WEBHOOK` waitpoints, which is exactly what `flow-runs-queue` calls it for. It is `resumeTrusted`:
+  resume, skipping the barrier guard, because the caller is internal rather than an HTTP route.
 - **An external actor never addresses the waitpoint.** Their link carries a **signal id** on
   `/v1/flow-runs/:id/signals/:signalId/confirm` — in the path, not the query string, because `resumePayload`
   is built from `{ body, headers, queryParams }` and persisted with the run. The link must never carry
@@ -76,7 +101,7 @@ all, purely because child rows appear later than the dispatch that created them.
 - **The machinery ships able to carry K-of-N approvals; no approval piece is rewired yet.** Per-signal links
   and `reasonRequiredOn` exist now because retrofitting them means another migration.
 - **`policy` carries no deadline override.** The plan allowed "or the policy's shorter value"; nothing
-  produces one, so `resolveDeadline()` is `now + AP_PAUSED_FLOW_TIMEOUT_DAYS` and takes no arguments. Add the
+  produces one, so `defaultBarrierDeadline()` is `now + AP_PAUSED_FLOW_TIMEOUT_DAYS` and takes no arguments. Add the
   field when a caller for it exists, not before.
 - **The 2 000-character reason bound stays a handler check, not a request schema.** The confirm route is
   `app.all` serving an HTML form: a Zod `body` schema would also apply to the GET that renders the page, and
diff --git a/brain/knowledge/decisions/000033-a-released-barrier-leaves-a-tombstone-until-the-run-ends.md b/brain/knowledge/decisions/000033-a-released-barrier-leaves-a-tombstone-until-the-run-ends.md
new file mode 100644
index 000000000000..a6d563b19edb
--- /dev/null
+++ b/brain/knowledge/decisions/000033-a-released-barrier-leaves-a-tombstone-until-the-run-ends.md
@@ -0,0 +1,57 @@
+---
+icon: 🪦
+status: accepted
+---
+
+# A released barrier leaves a tombstone until the run ends
+
+## Decision
+
+Delivering a resume no longer means deleting the waitpoint row. `waitpointService.consume` owns the
+rule: a `BARRIER` is tombstoned at a third status, `CONSUMED`, and every other type is still deleted.
+The tombstone lives until the run reaches a terminal status, where the existing `deleteByFlowRunId`
+sweep clears it. The legacy by-run resume guard (`hasBarrier`) therefore asks whether the run holds a
+barrier row **at all**, in any status, instead of whether one is `PENDING`.
+
+## Context
+
+A barrier's release boundary is predicate-owned: only its own predicate or its deadline may release
+it. The guard enforcing that on the deprecated V0 `/:id/requests/:requestId` routes asked
+`hasPendingBarrier`, which filters `status: PENDING`, so it stopped guarding the moment the barrier
+was released. Two windows followed — between `closeBarrier` committing `COMPLETED` and the trusted
+resume consuming it, and the much wider one after delivery, since a run stays `PAUSED` until the
+engine's next progress upload. In both, a legacy resume was accepted and enqueued a second job with
+a request-controlled payload, under a job id BullMQ would not collapse against the trusted one.
+
+The root cause was that "this resume was delivered" was encoded as *row-absence*, which makes a
+delivered barrier and a pre-waitpoint legacy pause indistinguishable — both are "no rows" — while
+the legacy path may only serve the second.
+
+## Why
+
+Making delivery explicit is what lets the two be told apart, and `waitpoint.status` is
+`character varying` with a TypeScript-only enum, so a third value costs no migration.
+
+Rejected: a `flow_run.pausedWaitpointId` column — a real migration, and `pauseMetadata` was not
+available to reuse (it is deprecated and pending removal). A Redis marker with a TTL — puts a
+security boundary on an expiry and a flush reopens the hole. Deleting the legacy path outright —
+tempting at 4.5 months past deprecation with a 30-day default pause timeout, but a self-hoster
+jumping many versions would silently lose every in-flight approval.
+
+Tombstoning is scoped to barriers rather than all waitpoints because the barrier is the only
+waitpoint whose release boundary is predicate-owned; for `DELAY` / `WEBHOOK` the unguessable link
+*is* the authorization. Widening it would leak `CONSUMED` rows into `findSubflowWaitpoint`'s
+any-status fallback and into `createForPause`'s unique `(flowRunId, stepName)` slot.
+
+## Consequences
+
+A run that has ever held a barrier can never use the legacy by-run resume path again. That is
+correct, not a side effect: that path serves only runs which never had a waitpoint row at all.
+
+`hasPendingBarrier` survives alongside `hasBarrier` and `findUndeliveredCompletedWaitpoint` must keep
+calling the *pending* one — switching it to existence would return null whenever a `CONSUMED` barrier
+exists and hang a later non-barrier delivery on the same run.
+
+The invariant that a row still sitting at `COMPLETED` was never delivered is preserved, now carried
+by an explicit status rather than by absence. Cost is one small row per barrier for the life of the
+run; `barrierService.create` already deletes any non-`PENDING` row occupying its step's slot.
diff --git a/brain/knowledge/decisions/000035-the-barrier-signal-cap-is-a-platform-configuration-row-not-an-env-var.md b/brain/knowledge/decisions/000035-the-barrier-signal-cap-is-a-platform-configuration-row-not-an-env-var.md
new file mode 100644
index 000000000000..b611aba38347
--- /dev/null
+++ b/brain/knowledge/decisions/000035-the-barrier-signal-cap-is-a-platform-configuration-row-not-an-env-var.md
@@ -0,0 +1,78 @@
+---
+status: accepted
+---
+
+# The barrier signal cap is a platform configuration row, not an env var
+
+## Decision
+
+`AP_MAX_BARRIER_SIGNALS` becomes `maxBarrierSignals`, an `integer NOT NULL DEFAULT 10000` column on
+`platform_configuration`, with a `Limits` section on the Configurations page to edit it. The row is
+authoritative and born from the env var, exactly as [000033](000033-platform-configuration-rows-are-authoritative-and-created-on-first-read.md)
+does it. The env var survives only as the birth default for a platform that has no row yet.
+
+Cloud is short-circuited **in the service**: `maxBarrierSignals({ platformId })` returns the system prop
+and ignores the row when `edition === CLOUD`, the same shape `isProductTelemetryEnabled` already uses.
+`platformId` is added to `CreateBarrierParams` so the caller supplies it rather than
+`barrierService.create` resolving it from `projectId`. There is no unlimited value and no nullable
+column.
+
+## Context
+
+The variable is new on `feat/barrier-service` and has never shipped: it is absent from `main`, from the
+published env var table, and from every deploy surface. So this is a choice about where a dial lives
+before release, with no upgrade path to protect, no breaking-change label and no docs migration.
+
+Its only read site is `assertSignalCountWithinLimit` in `waitpoints/barrier-service.ts`, and
+`barrierService.create` has no production caller yet, so the signature is free to change.
+
+## Why
+
+000033 draws a line that this decision deliberately walks up to: configurations hold behaviour,
+`platform_plan` holds entitlements, and a **cap** is the `MAX_RECORDS_PER_TABLE` shape that decision
+keeps off the page, because `POST /v1/platform-configurations` carries no edition guard and a limit
+living there is a self-serve quota bypass the day the page stops being Cloud-hidden.
+
+The cap goes there anyway because the bypass is closed where 000033 says invariants must be closed: in
+the server, on the value. Hiding the page was never the enforcement, and the Cloud short-circuit in the
+service makes the row unreadable as a cap on Cloud regardless of what an admin writes.
+
+**Rejected: `platform_plan`.** It is the correct home for a limit that is sold, and it is CE-readable
+via `platformService.getOneWithPlanOrThrow`. It was rejected because nobody sells barrier width, and a
+plan column would put a self-hoster's own protective cap behind an entitlement they cannot edit.
+
+**Rejected: env var as a `min(row, env)` ceiling.** It preserves an operator guarantee on a
+multi-platform EE install, where a platform admin is not the operator and could raise a cap that
+consumes shared Postgres and Redis. It was rejected as one concept too many for a case that does not
+yet exist, and because it reintroduces the two-sources-of-truth shape 000033 rejected for telemetry.
+This is the variant to revisit if multi-platform installs start mattering here.
+
+## Consequences
+
+- The error message must stop saying "raise `AP_MAX_BARRIER_SIGNALS`". It is read by a project member
+  who may not be a platform admin, so it names the limit and the page without implying the reader can
+  change it.
+- `platformId` on `CreateBarrierParams` means every future caller has to hold platform scope. The
+  waitpoints module already resolves it the other way in `resume-service.ts`
+  (`projectService.getPlatformId`), so the two paths in one module now differ on purpose: the check runs
+  before the transaction that inserts up to 10 000 signal rows, and the caller was cheaper to widen
+  while it has no production implementation.
+- **The number reaches the browser whether or not the builder uses it.** The GET response is the whole
+  `PlatformConfiguration` object, and `TelemetryProvider` wraps the router and already caches that row
+  for every signed-in user, so any builder component can read it with an existing hook and no new
+  endpoint. Nothing is built on that now: no fan-out step exists, and the real fan-out shape dispatches
+  over a runtime array, so a design-time count does not exist for the general case.
+- Because Cloud ignores the row, the raw column is **not** the effective cap. Whoever adds a builder
+  surface must serve a computed effective value rather than recompute the edition rule in the browser,
+  which is how 000033's split-brain bug happened.
+- **No `tryCatch` around the read, because every failure that could reach it is already fatal to
+  `barrierService.create`.** Postgres down kills the transaction and the signal inserts, Redis down kills
+  `enqueueEvaluation`, and the `distributedLock` is taken only on the create path, once per platform for
+  the life of the install. Fail-closed is also the do-nothing option, so there is no code to write.
+- **The `Limits` section is written but not rendered.** `limits-section.tsx` exists and is wired to the
+  same form schema, but `configurations/index.tsx` does not mount it, so no edition shows the field yet.
+  The row, the API and the cap are all live regardless: the value every platform runs on is the one
+  `AP_MAX_BARRIER_SIGNALS` seeded, and an existing platform's row can only be changed through
+  `POST /v1/platform-configurations` until the section is mounted. Rendering it is one import and one
+  line.
+- Postgres only. There is no sqlite migration for `platform_configuration`.
diff --git a/brain/knowledge/engineering/ci-pr-review-hygiene.md b/brain/knowledge/engineering/ci-pr-review-hygiene.md
index 93ae61d793bc..f8f33538c536 100644
--- a/brain/knowledge/engineering/ci-pr-review-hygiene.md
+++ b/brain/knowledge/engineering/ci-pr-review-hygiene.md
@@ -44,7 +44,7 @@ Enforcement is the **`Codeowners review` repository ruleset** (active on the def
 
 - **Linting a single server test file OOMs node at its default heap — pass `NODE_OPTIONS=--max-old-space-size=8192`.** `npx eslint packages/server/api/test/.../<file>.test.ts` on one file died with `FATAL ERROR: Reached heap limit` after ~23s at 2GB, because the type-aware config loads the whole `packages/server/api` program regardless of how few files you name. It reads as a broken lint setup, not as a memory ceiling. The same run with an 8GB heap finishes and reports normally.
 - **`bun install` on a recent bun adds `"configVersion": 0` to `bun.lock`, which is not on `main`.** It rides along in any commit that touches the lockfile and reads as an unrelated change; drop the line and re-run `bun install --frozen-lockfile` to confirm the lockfile is still consistent without it. **You do not have to run `bun install` to get it** — a bare `npx vitest run <file>` in `packages/web` was enough to rewrite the lockfile with `configVersion` *plus* every workspace version already bumped in the branch, so `git status` after any verification run is worth a glance before committing.
-- **A version bump that merges cleanly can still be wrong — check what `main`'s number *means*, not whether it conflicts.** Two branches bumping the same package to the same number do not conflict, so git takes it silently; but if `main`'s copy of `0.5.0` is another PR's content and yours adds further exports on top, you ship new exports under an already-published version and nothing catches it. Seen merging [#15001](https://github.com/activepieces/activepieces/pull/15001) after the six-providers PR landed: `core-piece-types` and `pieces-framework` auto-merged at `0.5.0` / `0.37.0` and both needed a further bump. Only a *conflicting* version (like `core/shared` `0.140.0` vs `0.141.0`) forces you to think; the clean ones are the dangerous ones. After any merge, re-check every package you bumped against `git show origin/main:<pkg>/package.json`. The reverse also happens: when review makes you *delete* code, the bump it justified can become dead — after acting on review, `git diff origin/main...HEAD -- <pkg>/src` and drop the bump if it is empty. On #15001 two packages ended up byte-identical to `main` while still carrying a bump, which is noise at best and a version collision at worst.
+- **A version bump that merges cleanly can still be wrong — check what `main`'s number *means*, not whether it conflicts.** Two branches bumping the same package to the same number do not conflict, so git takes it silently; but if `main`'s copy of `0.5.0` is another PR's content and yours adds further exports on top, you ship new exports under an already-published version and nothing catches it. Seen merging [#15001](https://github.com/activepieces/activepieces/pull/15001) after the six-providers PR landed: `core-piece-types` and `pieces-framework` auto-merged at `0.5.0` / `0.37.0` and both needed a further bump. Only a *conflicting* version (like `core/shared` `0.140.0` vs `0.141.0`) forces you to think; the clean ones are the dangerous ones. After any merge, re-check every package you bumped against `git show origin/main:<pkg>/package.json`. The reverse also happens: when review makes you *delete* code, the bump it justified can become dead — after acting on review, `git diff origin/main...HEAD -- <pkg>/src` and drop the bump if it is empty. On #15001 two packages ended up byte-identical to `main` while still carrying a bump, which is noise at best and a version collision at worst. **Nothing in CI catches a *missing* bump outside `packages/pieces/`.** `validate-publishable-packages` is the only bump check and it exempts every non-piece package, so a `core/shared` change with no bump goes green on every check. Seen on [#15078](https://github.com/activepieces/activepieces/pull/15078): nine new exports added to `core/shared/src/lib/automation/mcp/mcp-oauth.ts` with `package.json` still at `0.152.0` — the same number `main` had just reached via a *different* PR (#15162), so the collision was invisible and all 17 checks passed. Reviewing a PR that touches `core/shared`, diff the version by hand. `bun.lock` mirrors workspace versions and drifts behind — it read `0.151.0` while `main` was on `0.152.0`, because bumps routinely land without it (#15162 changed `package.json` alone). Sync it with **`bun install --lockfile-only`**, which needs no `node_modules` and so works in a throwaway worktree; on #15078 that produced exactly one line and swept up no unrelated drift. The 103-line sweep noted above is a *pieces* phenomenon — don't assume it for `core/*`, just read the diff before staging.
 - **`@activepieces/shared` re-exports from `@activepieces/core-execution`, so a partial rebuild produces phantom "has no exported member" errors in unrelated files.** Rebuilding `core/shared` against a stale `core/execution` dist drops those re-exports, and the API typecheck then fails in `ee/agent/*` on symbols like `GetPersonalizationConfigRequest` — which live in `core/execution/src/lib/workers/worker-contract.ts`, not in shared at all. It reads exactly like a bad merge. The dependency order that actually works is `core/utils` → `core/piece-types` → `core/formula` → `core/execution` → `core/shared` → `server/utils` → `pieces/framework` → `core/ai-providers`; skipping a link silently poisons everything downstream of it. The same staleness makes an editor report missing enum members that exist in the source. **There is no api typecheck "error baseline" — rebuild first, then trust it.** A stale `core/shared/dist` reliably yields a handful of `ee/agent` errors that look permanent enough to be waved off as known, which is how a real error hides among them; after `npx turbo run build --filter=@activepieces/shared`, `tsc --noEmit -p packages/server/api/tsconfig.app.json` comes back completely clean. The same staleness invents errors in files a rebase just touched, so during a conflict resolution rebuild before concluding you resolved it wrong.
 - **To pull a file back out of a PR, restore it from the merge-base, never from `origin/main`.** A PR's diff is computed against the merge-base, so `git checkout origin/main -- <file>` does not "revert" the file — it imports every change `main` made to it since the fork and attributes them to you. Dropping one web file from [#15001](https://github.com/activepieces/activepieces/pull/15001) that way would have silently added 82 insertions / 44 deletions of somebody else's work. `git checkout $(git merge-base origin/main HEAD) -- <file>` makes it byte-identical to where the branch started, so it leaves the diff entirely and merges cleanly instead of conflicting. Verify with `git diff --quiet $(git merge-base origin/main HEAD) -- <file>` before committing, and read `git status` first — a `bun.lock` left dirty by an earlier `bun install` loves to ride along on a commit like this.
 - **Retargeting a stacked PR to `main` does not drop its base branch — it merges the whole thing.** A PR opened against a long-lived feature branch shows a small diff *relative to that base*, but `gh pr edit --base main` only moves the target; the branch still contains every commit of its old base. [#14593](https://github.com/activepieces/activepieces/pull/14593) read as 2 docs files against `feat/autumn-billing-integration` and as 198 commits / 211 files / +12k lines against `main`. Check with `git diff --stat origin/main...<branch>` **before** retargeting, and if it disagrees with the PR page, cherry-pick that PR's own commits onto `main` and force-push instead. A "conflict" on such a PR is often against the feature base only — those same commits can apply to `main` cleanly.
@@ -67,5 +67,10 @@ Enforcement is the **`Codeowners review` repository ruleset** (active on the def
 - **Nothing rolls `## Unreleased` over at release time, and the docs site is unversioned — so a breaking-changes entry has to name its own version.** No workflow or script writes to `docs/install/reference/breaking-changes.mdx` (`breaking-change-check.ts` only reads it), and `git log -S"## 0.88"` on the file comes back empty: the heading has not moved since 0.87.0, so entries for work that shipped months ago still sit under "Unreleased" (PM2 removal in 0.88.2, cache pre-warm gate and workspace naming in 0.89.0, …). `docs/docs.json` has no versioning either, so there is one live page for every self-hoster whatever version they run, published on merge rather than on release — the version heading is the *only* thing telling a reader whether a change is already in their build. So before adding an entry, run `git tag --contains <commit>` on the change it describes and file it under the release that actually shipped it; only genuinely unshipped work belongs under "Unreleased". What points self-hosters at the page in the first place is `release-drafter.yml`, which appends a "review the Breaking Changes page" line to every release body and groups `⛓️‍💥 breaking-change` PRs under their own heading — which also means a docs-only PR back-documenting an old change shows up in the *next* release's breaking-change list.
 - **Greptile enforces the file-order rule on *private* constants too, which CLAUDE.md only states for exported ones.** CLAUDE.md says "Exported types and constants must be placed at the end of the file" and gives the order as imports → exports → helpers → types; Greptile reads that as covering module-private constants as well, and flags a `const` sitting above the file's exported symbol (P2 on [#15226](https://github.com/activepieces/activepieces/pull/15226), for two constants only read inside the service they sat above). It has that as a stored custom-context memory, so it will keep raising it. Put private constants in the helpers section below the export — hoisting is a non-issue when they are only read at call time.
 - **`turbo run lint --filter=<pkg>` never typechecks that package, so "0 errors" is no proof it compiles — run `turbo run build --filter=<pkg>` as well.** A package's `lint` script is `eslint 'src/**/*.ts'` with no `tsc`, and the turbo `lint` task's `dependsOn: ["^build"]` builds the package's *upstream dependencies* only, never itself — the `^` is the whole story. So a type error in the package you are editing is invisible to a filtered lint run. CI still catches it, but confusingly under the **lint** job as well as **main**, because linting the whole repo makes your package an upstream of something else whose `^build` finally compiles it. A branch can therefore sit red on two jobs for one `tsc` error that a local filtered lint reported clean.
+- **Never set `maxWorkers` in `packages/server/api/vitest.config.ts` — the api suites are not alone on the runner.** `ci.yml` runs `turbo run test-ce test-ee test-cloud check-migrations --filter=api` as concurrent turbo tasks, in parallel with a second `turbo run test` line and `web#build`'s vite run, all on one 4-vCPU / 16 GB `ubuntu-latest` box. Each vitest fork boots a Fastify server *and* a PGlite database, so the config's per-project worker count is really that number **times three editions**. A stray `maxWorkers: 4` on [#14777](https://github.com/activepieces/activepieces/pull/14777) raised the forks pool from its default `availableParallelism() - 1` (3) to 4 — 12 forks instead of 9 — and took the job down twice in a row with failures that never named the cause: first `execute-flow-e2e`'s `beforeAll` timing out while **1028 tests passed**, then the whole runner SIGKILLed mid-build (`web#build exited (137)`, `check-migrations` SIGTERM, api suites never finishing). Both read as "a test broke". Neither was. The tell is `The runner has received a shutdown signal` immediately above the 137, and the fix is to delete the line, not to raise a timeout. Same reason the config's `hookTimeout` is 120s: a loaded runner pushes a server boot past a minute, so a file that pins its own smaller `beforeAll` timeout (`}, 30_000)`) silently opts out of the protection and becomes the first thing to fail. Check the blast radius before calling it fixed: a config mistake made on a long-lived stack branch replicates by merge into every descendant, so deleting it from the PR in front of you leaves the rest of the stack to reintroduce it on the next rebase. This one originated once on `feat/subflow-fan-in-barrier` (2026-08-12) and reached **14 branches, 13 of them open PRs** across three unrelated stacks — `git log -S maxWorkers` over `origin/main` proved it never landed there, and a loop of `git show <branch>:<path> | grep` found every branch still carrying it.
+- **A red `api#test-ce` names one failing test, not all of them — the script runs `--bail 1`.** `test-ce-command` is `vitest run test/integration/ce --bail 1`, so CI stops at the first failure and the report is a floor, not a count. On `feat/barrier-edges` it showed one failing assertion; the file actually had three, all the same root cause. Before concluding a branch has one problem, re-run the suspect file locally *without* `--bail` — `npx vitest run <file>` — and fix the set.
+- **Fixing an infra failure can turn a branch from red to a different red, and that is progress, not a regression.** A runner killed mid-run (`shutdown signal` above `exited (137)`) reports no test results at all, so genuine failures underneath it are invisible. When the OOM is fixed the suites finally run to completion and those failures surface for the first time — on this stack, thirteen branches went from an OOM red to a real `barrier.test.ts` red the moment the runner survived. Check whether the *previous* run reached a test summary at all before blaming the change that unmasked it.
+- **A `beforeAll` that overrides the vitest timeout *downwards* is a slow-motion flake, and it fails in a way that blames your diff.** [`execute-flow-e2e.test.ts`](../../../packages/server/api/test/integration/ce/flows/flow-run/execute-flow-e2e.test.ts) passes `30_000` to `beforeAll` even though `packages/server/api/vitest.config.ts` sets `hookTimeout: 60000`, and spends 5s of that budget on a hardcoded `setTimeout`. Inside the remaining ~25s it boots a fresh app, runs the **whole migration chain**, starts queue consumers and a worker. That chain has grown 293 → 376 postgres migrations since the hook was written (`d2c42816013`, "feat: worker v2", #11608, 2026-03-15 — authored *after* the 60s default was already in place), so on a loaded runner it now times out. When it does, all 9 of its tests report **skipped**, not failed: the summary reads `1 failed | 84 passed` with no failing assertion anywhere, and `--bail 1` kills the rest of the CE task. Seen on [#15078](https://github.com/activepieces/activepieces/pull/15078), an MCP-OAuth-only PR that cannot reach that code. No single commit broke it, so there is nobody to blame and nothing to revert — the fix is to delete the override and poll for worker readiness instead of sleeping blind. When triaging a red CE task, check whether the failure is an assertion or a hook timeout **before** blaming the diff.
+- **Git hooks cannot run from a `git worktree`: `.husky/_/husky.sh` is an install artifact that only exists in the tree where `bun install` ran.** Every commit and push from a worktree dies on `.: cannot open .husky/_/husky.sh`, before the hook's own logic is reached. Don't reach for `--no-verify` — push the worktree's commit from the main checkout (`git push origin <local-branch>:<remote-branch>`; worktrees share the object store), so `pre-push` actually bootstraps and its "no direct pushes to `main`" guard runs. `SKIP_CHECK=1` is the repo's own sanctioned way to skip the lint/test prompt. Note `pre-push` special-cases `CLAUDE_PUSH=yes` into running the **full** lint + unit + API suite, so an agent that silently bypasses the hook is skipping a check the repo added deliberately for it — say so out loud when you do.
 - **Docs videos belong on `cdn.activepieces.com/videos/docs/`, never in the repo — and `docs/resources/` is the legacy path that suggests otherwise.** Every `<video>` already in the wiki points at that CDN prefix, but `docs/resources/` still holds ~43 MB of in-repo gifs from before the convention, so the tree itself gives mixed signals and a contributor reasonably copies the wrong one. [#15399](https://github.com/activepieces/activepieces/pull/15399) added a fresh `docs/videos/` folder with 155 MB of `.mp4` against an 880 MB `.git`, including one byte-identical duplicate. Nothing in CI catches it: `PR size` exempts unmatched areas and counts lines, not bytes, and a binary blob contributes zero lines. Review the *file list* of a docs PR, not just its diff. Once such a branch is pushed the blobs are already on the remote — dropping them at the tip only keeps them out of `main` if the PR is **squash**-merged and the branch deleted, so a merge commit ships them permanently. Because the blobs stay reachable until the branch is deleted, nobody has to re-request the assets from whoever recorded them — pull them straight back out of history with `git archive <commit> docs/videos | tar -x --strip-components=2 -C <dir>`, picking the commit *before* the removal, which is also how you get them under the post-rename filenames the pages already reference.
 - **Mintlify-editor PRs arrive with `untitled-page*.mdx` at the docs root and `(1)`/`(2)`-suffixed media, wired into `docs.json` under those names.** The bot commits whatever the web editor autosaved, so pages land as `docs/untitled-page-5.mdx` rather than in the folder their nav group implies, and re-uploaded assets keep the browser's download-collision suffix (`data-flow-(1).mp4`, `01---insert-panel-(1.2x).mp4`). Mintlify's own link check passes — the names are internally consistent — so nothing flags it. Rename the files, fix the `docs.json` entries, then diff the *flattened nav tree* against `main` rather than reading the raw JSON diff: the editor also reindents, which buried a real change (the Enterprise Control `Security` group demoted to a child of `Guides`) inside 242 lines of whitespace churn on that PR.
diff --git a/brain/knowledge/execution-runtime/workers.md b/brain/knowledge/execution-runtime/workers.md
index d31d32b7247b..4247e53dfb3b 100644
--- a/brain/knowledge/execution-runtime/workers.md
+++ b/brain/knowledge/execution-runtime/workers.md
@@ -77,7 +77,7 @@ Whole-fleet throughput can collapse while every worker is healthy and idle, beca
 
 **Diagnostic signature** (how it was found 2026-07-25/26), all from ClickHouse `default.otel_logs`: worker fleet constant (`uniqExact(LogAttributes['host'])` on `event='system.snapshot'`), per-job latency flat or improving (`avg(executionMs)` over `job.execute`) so workers aren't the bottleneck, and app-side dequeues falling on the same curve as executions. The decisive one is **uniform stretch**: for `EXECUTE_POLLING`, group by hour and compute `count() / uniqExact(flowVersion.id)`. Flat `distinctTriggers` with decaying fires-per-trigger (13,050 triggers steady while each went 15.2/hr → 1.05/hr over 30h) means a shared dispatcher throttling all of them equally; triggers actually dying looks the opposite — `distinctTriggers` drops, fires-per-trigger holds. Rule out diurnal against the same hours a week earlier first.
 
-Three latent hazards in the same file: `await dequeue(...)` has **no timeout**, so a hang on Redis leaves `loopRunning` true forever and every later `poll()` short-circuits, parks for `WAITER_TIMEOUT_MS` (50s) and returns null — that queue is dead for the life of the process and only a restart clears it. `tryDequeue` **recurses** once per skipped job (deferred-failure, invalid-schema, DISCARD, delay paths), so discarded zombie repeats burn dispatcher budget without producing executions (520k dequeues vs 270k executions) and a burst drives unbounded async recursion. And `concurrency: 500` on the BullMQWorker is **inert** — `autorun: false` means BullMQ's internal run loop never starts, so it reads as 500-way parallel dispatch while being 1-way.
+Three latent hazards in the same file: `await dequeue(...)` has **no timeout**, so a hang on Redis leaves `loopRunning` true forever and every later `poll()` short-circuits, parks for `WAITER_TIMEOUT_MS` (50s) and returns null — that queue is dead for the life of the process and only a restart clears it. `tryDequeue` **recurses** once per skipped job (deferred-failure, invalid-schema, DISCARD, delay paths), so discarded zombie repeats burn dispatcher budget without producing executions (520k dequeues vs 270k executions) and a burst drives unbounded async recursion. And `concurrency: 500` on the BullMQWorker is **inert** — `autorun: false` means BullMQ's internal run loop never starts, so it reads as 500-way parallel dispatch while being 1-way. Same root cause bites `Worker.on('failed')`: it emits from that same off run loop, so on `workerJobs`/`platform-*`/`project-*` the local handler never fires. Terminal failures reach observers only through the explicit `job.moveToFailed(...)` sites in `job-broker.ts` (deferred failure, invalid schema, engine INTERNAL_ERROR) or through `QueueEvents` off Redis' event stream — there is no third path. `runsMetadata` and `system-job-queue` use `autorun: true` and their `Worker.on('failed')` handlers fire normally.
 
 #### A worker can wedge mid-poll-loop and still report healthy
 
diff --git a/brain/knowledge/flows-execution/flow-runs.md b/brain/knowledge/flows-execution/flow-runs.md
index 14754aa8a156..a9d738711b47 100644
--- a/brain/knowledge/flows-execution/flow-runs.md
+++ b/brain/knowledge/flows-execution/flow-runs.md
@@ -24,7 +24,19 @@ A Flow Run records one execution of a specific flow version, from trigger to ter
 - **A Delay inside a Loop pauses and requeues the whole run once per iteration, so no fixed sync-webhook timeout can cover it.** The delay is not a sleep inside the step: each iteration arms a waitpoint, the run goes `PAUSED`, and the resume comes back through the queue, so every item costs its delay plus queue latency and the total scales with the item count. Worked case on dev: `Catch Webhook → Code → Loop { Delay For 8s } → Return Response` over 6 items reported `stepsCount` 9 (Code + Loop + 6 delays + Return Response) and ran 53.6s, of which 48s was delay and 3s was the initial queue leg. With `AP_WEBHOOK_TIMEOUT_SECONDS` at 30 the `/sync` caller was answered 408 mid-loop; Return Response then ran ~23s later and published to a listener that had already resolved and been deleted, so it was a no-op. Putting the response step *after* slow work is the bug: respond before it (respond-and-continue rather than `stop`) or go async with a callback, because raising the timeout only works until someone sends more items. See the sync-response gotchas in [webhooks](../eventing-webhooks/webhooks.md).
 - **A worker OOM-kill leaves the run stuck in RUNNING forever, and Cancel is greyed out.** The flow timeout is enforced *inside* the worker, so if the pod dies (OOM) nothing ever transitions the run to a terminal state; Cancel only applies to paused/queued runs, so the UI offers no way out and the run can't be retried either. Bug: activepieces#14372, fix PR #14374. Manual unblock on the customer's Postgres: `UPDATE flow_run SET status = 'CANCELED', "finishTime" = NOW(), updated = NOW() WHERE id = '<run id>' AND status = 'RUNNING';` (run id = last path segment of the run URL), then "Retry on latest version" replays the original payload.
 - **Resume Confirmation Page (scanner guard)**: the `/confirm` route serves an HTML Approve/Disapprove page on `GET`/`HEAD` (never consumes) and only resumes on `POST` — stops email security scanners (Safe Links, Mimecast, Proofpoint) prefetching approval links. The deprecated bare `GET /:id/waitpoints/:waitpointId` still resumes for old emails. Slack is unchanged (server-side POST from webhook).
+- **`POST /confirm` with an empty JSON body is rejected before it reaches the resume code.** Sending `Content-Type: application/json` with no body gets Fastify's `FST_ERR_CTP_EMPTY_JSON_BODY` 400, so the waitpoint is never consumed and the run just stays PAUSED — which reads exactly like a resume regression. `curl -X POST .../confirm?action=approve` is fine because curl sends no content-type at all; an HTTP client that defaults to JSON is not. Either omit the content-type or send a real body (`{}`). Hit while scripting the `/test-waitpoints` flow 4 race ordering, 2026-08-30.
 - **Cross-project isolation (subflow parent-fail)**: `markParentRunAsFailed` scopes its parent lookup to `{ id: parentRunId, projectId }` using the child run's authenticated `projectId`. `parentRunId`/`failParentOnFailure` arrive from spoofable webhook headers (`ap-parent-run-id`/`ap-fail-parent-on-failure`) on the public webhook endpoint, so without the scope a failed child in project A could complete a paused parent's waitpoint and resume it in project B. A cross-project parent id now matches nothing and the fail is a no-op; legitimate subflows are always same-project (Call Flow only targets flows in the caller's project).
+- **A resume link resumes the run, not the step it was minted for.** Waitpoints are unique on `(flowRunId, stepName)`, so a flow that runs `create_approval_links` and then `wait_for_approval` holds **two PENDING rows at once** — and the link handed out by `create_approval_links` points at the *first* row while the run blocks on the *second*. `handleResumeSignal`'s PAUSED branch looks the row up by `{ id, flowRunId }` with no check that it belongs to the step being waited on, so that link resumes the run anyway and its payload lands on whichever step is paused. Verified 2026-08-30 on a local instance: POSTing the step_1 link while PAUSED on step_3 resumed the run and gave step_3 `approved: true`. Upshot: an approval link is a **run-level** capability, not a step-level one.
+- **A resume that arrives while the run is still RUNNING is parked, and delivered later by the `runsMetadataQueue` worker.** `handleResumeSignal`'s RUNNING/QUEUED branch takes `complete()`, which marks the row COMPLETED rather than deleting it; the worker then picks it up on writing PAUSED via `findUndeliveredCompletedWaitpoint` (`flow-runs-queue.ts`) and enqueues the resume. Because delivering a resume never leaves the row at COMPLETED (both `handleResumeSignal`'s PAUSED branch and the race branch in `resumeTrustedWithoutLock` go through `waitpointService.consume`, which deletes a non-barrier and tombstones a barrier as CONSUMED), any row still sitting at COMPLETED is by construction one whose signal was never delivered — which is why that lookup does not need to care how many other waitpoints the run holds. It declines only when the run holds a PENDING **barrier**, since a barrier may be released solely by its predicate or deadline. **Gotcha for anyone narrowing this check:** an earlier form returned null whenever *any* PENDING row existed, which hung every run holding a second waitpoint — `create_approval_links` + `wait_for_approval` sat in PAUSED forever with the approval already consumed (`step_3` output `{approved: true}`, status `PAUSED`). Reproduced and fixed 2026-08-30 on `feat/barrier-service` with flow 4 of `/test-waitpoints`. Single-waitpoint runs (the common subflow-callback case) never showed it, so unit tests and every other flow in the suite stayed green.
+- **`create_approval_links` hands out an approval and a disapproval URL that are byte-identical** — both are the bare `/confirm` route with no `?action=`. The verdict comes from the button the human clicks on the confirmation page (which POSTs back with the action), not from which link they were given, and `wait_for_approval` reads `queryParams.action` with anything other than `approve` counting as a disapproval.
+- **A run can only have ONE scheduled DELAY resume at a time, and arming a second one is silently dropped.** `createForPause` schedules the resume job with `jobId: resume-delay-${flowRunId}` — keyed on the *run*, not the waitpoint — and `systemJobsSchedule.upsertJob` only calls `queue.add` when no job with that id exists (it retries an existing *failed* job, and otherwise does nothing at all, with no log beyond "Upserting job"). So if a run's first DELAY waitpoint is removed **before its job fires** and the run then arms another DELAY, the second schedule is a no-op: the queue still holds the first job, pointing at the now-deleted waitpoint. That job fires on the old date, `handleResumeSignal` finds nothing for the stale id, logs "Stale waitpointId, ignoring", and the job is consumed — leaving the run **PAUSED forever** with an overdue `resumeDateTime` and nothing in `bull:system-job-queue:delayed`. Reproduced 2026-08-30 by resuming a loop's iteration-0 delay early via `POST /:id/waitpoints/:waitpointId`: iteration 1 armed at +1s but the job kept iteration 0's id and fire time, and the run never completed. **This is on `main`, not a barrier-branch regression.** Normal delay flows are unaffected only because `removeOnComplete: true` frees the id once a job fires. Note `removeOnFail` keeps failed jobs for a month, so a single failed delay job also blocks every later DELAY in that run — and `upsertJob`'s retry re-runs the *old* `waitpointId`. Any path that resumes a run parked on a DELAY (the deprecated bare `GET` resume link, a subflow callback via `findSubflowWaitpoint`, a deadline sweep) can set this up. Fix direction: key the job on the waitpoint (`resume-delay-${waitpoint.id}`), which also needs `refill-paused-jobs.ts` updated since it reconstructs the same id.
+- **A barrier's waitpoint row survives its release, and the legacy by-run resume guard keys off that row's existence.** Until 2026-08-30 `legacyResume` / `legacySyncResume` (the deprecated V0 `/:id/requests/:requestId` routes, reached whenever `findPendingByVersion('V0')` returns null) checked `hasPendingBarrier`, which filters `status: PENDING` — so the guard stopped guarding the instant the barrier was released. `closeBarrier` commits COMPLETED in its own transaction and only *then* does `release()` call the trusted resume under the `runs_metadata_${flowRunId}` lock, and the legacy paths take no lock at all. Through that gap **and** the much wider one after delivery (the run stays PAUSED until the engine's next progress upload — `flow_run.status` is written only by the `runsMetadataWorker`), the run was PAUSED with no PENDING barrier, so a legacy resume was accepted and enqueued a **second** job with a request-controlled payload: `enqueueResume` namespaces job ids as `${runId}-resume-legacy` vs `${runId}-resume-${barrierId}` and the worker queue has no BullMQ `deduplication`, so nothing collapsed them. Reproduced against the dev DB on `feat/barrier-service`, and identical on all four stacked branches. **Fixed** by making delivery explicit rather than encoded as row-absence: a delivered barrier is tombstoned `CONSUMED` (see [decision 000033](../decisions/000033-a-released-barrier-leaves-a-tombstone-until-the-run-ends.md)) and the legacy guard became `hasBarrier` — existence, no status filter. **Gotcha for anyone touching these two methods:** `hasPendingBarrier` still exists and `findUndeliveredCompletedWaitpoint` must keep calling *it*, not `hasBarrier`; switching that call site to existence would return null whenever a CONSUMED barrier is present and hang a later non-barrier delivery on the same run. Two different questions, two methods. The V1 addressed path never had the hole — `addressedWaitpointIsBarrier` rejects on `waitpoint.type === BARRIER` whatever the status.
+- **`handleResumeSignal`'s PAUSED branch must reject `CONSUMED` only — never require `PENDING`.** The three statuses are a delivery state machine, not a lifecycle: PENDING is *not yet owed*, COMPLETED is *owed*, CONSUMED is *delivered*. Requiring PENDING therefore breaks the pre-completed path, because `findUndeliveredCompletedWaitpoint` hands this branch a COMPLETED row on purpose whenever a callback beat the pause. Tried on `feat/barrier-service` 2026-09-22 while answering a review that proposed exactly that: it failed **nine** tests, four of which predate the barrier work, including `consumes a COMPLETED waitpoint when race recovery fires` and `does not leave a stale COMPLETED row to poison the next pause cycle`. Before that fix the branch had no status filter at all, so a CONSUMED barrier tombstone could be dispatched a second time.
+- **That `CONSUMED` check does not need a conditional `UPDATE ... WHERE status = ... RETURNING`, and two reviewers have now asked for one.** The branch already runs `SELECT ... FOR UPDATE` inside `transaction()`, and TypeORM/Postgres default to READ COMMITTED, where a `FOR UPDATE` that blocks on a concurrent writer does **not** return its original snapshot on release — EvalPlanQual follows the update chain and re-checks the `WHERE` against the newest committed version. The predicate is `id` + `flowRunId` + `projectId`, all immutable, so the row comes back with the committed status. Read-then-branch-then-write in that transaction has exactly the atomicity of a conditional UPDATE. A conditional UPDATE is also actively worse here: `consume` is polymorphic (DELETE for a non-barrier, UPDATE for a barrier), and `onReady` has to run *between* the status check and the status write, which a single `RETURNING` statement cannot host.
+- **`onReady` runs inside that transaction deliberately — do not move it after the commit.** The order is dispatch → consume → commit, so a crash in the window leaves a resume job plus an unconsumed row: recoverable, and the row is the evidence that recovery is owed. Committing first would leave a `CONSUMED` tombstone (or, for a non-barrier, nothing at all) with no job, which is an unrecoverable hang and a tombstone that lies. The real cost of the current order is that `enqueueResume` does a platform lookup and an unconditional payload offload — taking a *second* pool connection — while holding `FOR UPDATE`. Fix that by hoisting the offload above the transaction, never by reordering the commit.
+- **Widening `releaseIfReady`'s lookup to COMPLETED recovers nothing on its own.** It still routes into `release` → `closeBarrier`, which filters `status: PENDING`, returns null, and makes `release` return *before* `resumeTrusted`. A crash between `closeBarrier`'s commit and `resumeTrusted` otherwise strands the run PAUSED with a COMPLETED barrier forever: `releaseIfReady` used to filter PENDING, the deadline handler returns unless the waitpoint is PENDING, and `closeBarrier` deleted the signals so nothing re-enqueues an evaluation. The recovery has to branch on status and re-dispatch the summary already persisted on the row, bypassing `closeBarrier` — routed through the same `resumeTrusted` call the normal path uses, so it inherits the run lock and the CONSUMED guard instead of enqueuing beside them.
+- **That recovery is bounded, not complete.** The only automatic re-invoker is BullMQ's stalled check on `BARRIER_EVALUATION`, and the worker takes the default `maxStalledCount: 1` — exactly one free redelivery after a SIGKILL. A second stall retires the job to `failed` permanently, and a Redis flush removes the trigger altogether while Postgres still holds a COMPLETED barrier on a PAUSED run. `attempts: 5` and the 8-minute backoff do not help: they govern *failed* jobs, and a retry just re-runs `releaseIfReady`. The durable backstop is a sweep, and a deadline sweep only closes this if it selects `type = BARRIER AND status = COMPLETED` — the natural `status = PENDING` reading never sees the state. The same hole exists for non-barrier waitpoints (`complete()` commits COMPLETED, the caller dies before dispatch) and is covered only opportunistically by the metadata worker.
+- **A waitpoint inside a loop is keyed by its full execution path**, e.g. `step_1:0/step_2`, not the bare `step_2` — so each iteration gets its own row under the `(flowRunId, stepName)` unique constraint instead of colliding with the previous iteration's. Set by `step-execution-path.ts`.
 - **ResumeReason** (`WAITPOINT`|`RETRY`) discriminates whether FAILED steps are restored on resume: waitpoint resumes preserve them, retry resumes drop them so the failed step re-executes.
 - **Pause timeout is cumulative from `flowRun.created`, not per-pause.** `waitpointService.createForPause` (`clampWaitpointResumeDeadline`) rejects any resume date past `flowRun.created + AP_PAUSED_FLOW_TIMEOUT_DAYS`, throws `ErrorCode.PAUSED_FLOW_TIMEOUT_EXCEEDED`, and `waitpointClient` in the engine translates that to `PausedFlowTimeoutError` (USER → clean FAILED). This catches stacked delays (e.g. `1 + 10 + 10 + 25 + 25 = 71 days` on a 30-day timeout) that individually pass the engine-side per-pause `assertDelayWithinTimeout` but cumulatively outlive retention. Webhook waitpoints without an explicit `resumeDateTime` are defaulted to the same run deadline so they can't wait indefinitely past retention; when their timer fires the `RESUME_DELAY_WAITPOINT` handler branches on `PauseType.WEBHOOK` and marks the run FAILED (expiry, not resume). The same handler also marks FAILED if the timer fires past pause-timeout for a `DELAY` waitpoint — catches BullMQ dispatch lag on ancient queued jobs. `AP_EXECUTION_DATA_RETENTION_DAYS` must be strictly greater than `AP_PAUSED_FLOW_TIMEOUT_DAYS` (a 1+ day margin) or a valid resume firing on the retention boundary can still race the file-cleanup job.
 - **`executionJournal.upsertStep` must stay immutable, and step retry is why.** `runWithExponentialBackoff` re-uses the *same* `executionState` for every attempt, so a failed attempt writing its `FAILED` output must not reach back into that state. While the journal still mutated the shared `steps` map (fixed in #14453), the write cleared the step's `PAUSED` status, the next attempt read `isPaused === false` and ran `BEGIN` instead of `RESUME`, armed a **new** waitpoint and paused again — a fresh engine run per resume means `attemptCount` restarts at 1, so `maxAttempts` is unreachable. For Call Flow with wait-for-response that re-invoked the subflow every 4-5s forever with the parent stuck `PAUSED` (GIT-1712, ≤0.86.3, same defect at the old `packages/shared/...` path in 0.85.5). Pinned by the retry-on-failure subflow case in `execute-flow-e2e.test.ts`.
@@ -36,6 +48,8 @@ A Flow Run records one execution of a specific flow version, from trigger to ter
 - Retries only allowed on terminal states within `EXECUTION_DATA_RETENTION_DAYS`.
 - **Credit metering (Autumn)**: on terminal runs (paid editions), `onFinish` does two tryCatch-wrapped billing steps that never break run completion. (1) A PRODUCTION run not in `QUOTA_EXCEEDED` charges +1 apCredit via `billingProvider.trackCredits` with idempotency key `{runId}:run`. (2) `flowRunAiUsageTracker` pre-scans the flow version for `@activepieces/piece-ai` steps, extracts per-provider/model usage from step outputs (`flow-run-ai-usage-extractor` — recurses into loops, fetches `FLOW_RUN_LOG_SLICE` files, falls back to flow-version settings on `**REDACTED**` models), meters `Σ(messages × model credit weight) + toolCalls` to Autumn (`{runId}:ai`, plus `{runId}:appSumoAi` for the managed-ACTIVEPIECES AppSumo cap), then emits the `AI_USAGE_PER_RUN` PostHog event — the license key is only the PostHog distinctId, no longer a gate on metering.
 - **Credit gate is fail-open at admission**: the worker RPC `submitPayloads` checks `shouldBlockOnCredits` (blocks only when the platform is `billingEnforced` AND the cached balance is exhausted; CE default and Autumn-outage behavior is false). A blocked run is still admitted — as a `QUOTA_EXCEEDED` run with the trigger payload persisted in its log — so it stays retryable once credits return instead of being dropped. **`AP_EDITION=ee` skips the gate entirely** (`shouldBlockRunOnCredits` returns `false` before any provider call) so self-hosters pay no Redis/Autumn latency on admission — a temporary measure, see decision 000020.
+- **A cancelled run's terminal status is only *queued*, so `flow_run.status` still reads `PAUSED` for a moment — read the Redis intent, not the row.** `cancelSingleRun` holds `runs_metadata_${id}`, removes the jobs and deletes every waitpoint, then hands `CANCELED` to `runsMetadataQueue` rather than writing it. For that window a resume request sees a `PAUSED` run with no waitpoint and cannot tell it from a legacy pre-waitpoint pause, and nothing downstream stops it — `execute-flow.ts` has no terminal-status guard, so the resume actually runs and overwrites the cancellation. The intent *is* observable: `runsMetadataQueue.add` writes the pending status into the `runs_metadata:<runId>` hash synchronously, inside that same lock, before enqueuing, and the metadata worker clears the key with `deleteKeyIfFieldValueMatches` once it lands. So `resumeService` refuses when `hgetJson(redisMetadataKey(id))` already holds a terminal status, and every resume path — the legacy by-run ones included — takes `runs_metadata_${id}` so the two orderings are both safe: cancel-first makes the resume wait and then see it, resume-first lets cancel's `removeAllFlowRunJobs` reap the job it just enqueued. The lock alone is not enough, and neither is re-reading `flow_run` inside it.
+- **The `RESUME_DELAY_WAITPOINT` job id is keyed per waitpoint, and it has to stay that way.** `waitpointService.createForPause` schedules it as `resumeDelayJobId(waitpoint.id)` — never per run — because `systemJobsSchedule.upsertJob` only adds when that id is free (`if (isNil(existingJob))`), so a run-keyed id means the first waitpoint to arm owns the run's **only** timer and every later one silently gets none. Since decision 000015 one run legitimately holds several waitpoints, so that is a hang, not an edge case: `create_approval_links` (WEBHOOK, +30d) followed by `delayFor 45s` (DELAY) left the delay with no timer and the run sat `PAUSED` until the 30-day webhook expiry marked it FAILED. Two `WEBHOOK` rows hide it — identical `AP_PAUSED_FLOW_TIMEOUT_DAYS` deadlines, and each is resumed by its own callback anyway — which is why flow 4 of `/test-waitpoints` never caught it and flow 9 was added. Found and fixed 2026-09-10; the bug had been live on `main`, not introduced by the barrier work. Per-waitpoint keying also fixes the `removeOnFail: { age: ONE_MONTH }` case, where `upsertJob` retries a month-old failed job and would otherwise replay it against a **different** waitpoint's id. Pinned by "should give each waitpoint of one run its own resume job id" in `waitpoint.test.ts`.
 - **Post-run metering window**: AI usage is metered only at `onFinish`, so a long run can spend past the credit limit before anything lands; interim by design — see decision 000016.
 
 ### Editions
diff --git a/brain/knowledge/flows-execution/index.md b/brain/knowledge/flows-execution/index.md
index 6b8580a64ac7..6ccaad002d39 100644
--- a/brain/knowledge/flows-execution/index.md
+++ b/brain/knowledge/flows-execution/index.md
@@ -53,6 +53,17 @@ A **Subflow** is a flow invoked by another flow rather than by its own external
 - **Batch** — the rows carried by one fan-out call: `{ batchIndex, headers, rows, extraData }`. *Avoid:* chunk, csv table, sub-table, shard.
 - Parent linkage is two headers (`x-parent-run-id`, `x-fail-parent-on-failure`); fan-out sets the latter false. Streaming bounds memory, not time — the step is still capped by `FLOW_TIMEOUT_SECONDS`.
 
+### Waitpoints
+A **waitpoint** is a row recording something a run waits on — `DELAY` / `WEBHOOK` / `BARRIER`. A run may hold several at once, and a barrier's row outlives its own delivery, so "the waitpoint a run is parked on" is never a safe singular. Reference lives in the public docs; what belongs here is the vocabulary, because the verbs are easy to swap.
+- **Release** — what happens to a **barrier**: close it, write its summary, delete its signals. `barrierService.release`. *Avoid:* "resume the barrier".
+- **Resume** — what happens to a **run**: enqueue the job that re-invokes the step. `resumeService.resume*`. A release ends by asking for a resume; the reverse never happens. *Avoid:* "release the run".
+- **Trusted resume** — `resumeTrusted` / `resumeTrustedWithoutLock`: resume skipping the barrier guard, for internal callers only. Every HTTP route goes through `resumeFromWaitpoint`, which refuses barriers always.
+- **Waitpoint key** — the path-qualified step identity the engine sends in `stepName`, e.g. `loop_1:3/approval`. It is only ever an identity key inside `waitpoint-service`. Gives each loop iteration its own row; without it a pause inside a loop fired on iteration 1 only.
+- **Consume** — what happens to a **waitpoint** once its resume has been enqueued: a barrier is tombstoned `CONSUMED` so the run stays provably barrier-owned until it ends, any other type is deleted. `waitpointService.consume`, the single owner of the rule. *Avoid:* "close the waitpoint".
+- **Signal** — one `waitpoint_signal` row per awaited thing on a barrier, created up front. Deleted on release, so a returning approver sees only "already responded".
+- Gotcha: a run can hold a COMPLETED leftover *and* an open PENDING pause at once, so any per-run waitpoint lookup must say which it wants — `findUndeliveredCompletedWaitpoint` declines only while a PENDING **barrier** is held, since delivering a resume never leaves a row at COMPLETED. An earlier form declined while *anything* was pending and hung every run holding a second waitpoint.
+- See [decision 000015](../decisions/000015-fan-in-is-an-event-driven-waitpoint-barrier.md), [decision 000033](../decisions/000033-a-released-barrier-leaves-a-tombstone-until-the-run-ends.md) and the public [Waitpoints](https://www.activepieces.com/docs/install/architecture/waitpoints) page.
+
 ### Folders
 Lightweight per-project grouping for flows and tables. Name unique case-insensitively per project.
 - `folder` entity (displayName, projectId, displayOrder). List returns `numberOfFlows`/`numberOfTables` via correlated subqueries. Create is an upsert by name.
@@ -71,6 +82,7 @@ Reusable flow/table blueprints. Types: OFFICIAL (Activepieces-curated, platformI
 - **Triggers** — POLLING / WEBHOOK / APP_WEBHOOK / MANUAL
 - **Human Input** — forms, approvals, the resume confirmation page
 - **Subflows** — flow-calls-flow: Callable Flow, Call Flow, streaming fan-out
+- **Waitpoints** — how a paused run is parked; release vs resume, barriers, signals
 - **Folders** — flow organization; the uncategorized sentinel
 - **Templates** — OFFICIAL / CUSTOM / SHARED blueprints
 - **Variables** — project-scoped values referenced from steps
diff --git a/brain/knowledge/pieces-engine/pieces.md b/brain/knowledge/pieces-engine/pieces.md
index 688e9612a1cc..711184ffecba 100644
--- a/brain/knowledge/pieces-engine/pieces.md
+++ b/brain/knowledge/pieces-engine/pieces.md
@@ -28,6 +28,8 @@ The metadata catalog of automation integrations ("pieces") — each a named inte
 - **Piece sorting mutates its input, which is why the list result cannot simply be cached.** `pieceSorting`'s comparators and `reverseIfDesc` sort in place (`pieces.sort(...)`, `pieces.reverse()`). That is safe only because the array is rebuilt per request; making them non-mutating is a prerequisite for ever caching the built list, or requests would reorder shared state under each other. Same trap in `pieceTranslation.translatePiece`: when the piece has no entry for the locale it returns the *original* object rather than a clone, so any `piece.i18n = undefined` after it would mutate the shared row — take the no-translations branch before calling it.
 - **DynamicProperties clears its value before it knows the new schema, so the merge source must be a snapshot.** `DynamicPropertiesImplementation` re-fetches the child schema on every refresher change, clearing the form value synchronously and re-populating it in the mutation callback. The merge source for `getDefaultValueForProperties` has to be a `lastKnownValue` ref captured *before* the clear — reading `form.getValues()` in the callback sees the cleared `null` and defaults every child (GIT-1514). The snapshot must be spread-cloned: RHF `getValues(name)` hands back the live object and the clear's `setValue(...child, null)` mutates it in place. Guard the ref with `isNil` so it survives rapid successive changes, where later effect runs already observe `null`.
 - `DynamicPropertiesContext` tracks loading by property name only, so two in-flight requests for the same property let the first completion clear the flag for both — briefly re-enabling Test Step while the value is still cleared.
+- **`POST /v1/pieces/options` cost scales with the whole flow's sample data, not with the property being resolved.** The handler builds an `EXECUTE_PROPERTY` job whose payload carries `sampleData` — and `getSampleDataForFlow` reads *every* step's sample-data `file` row. That payload then crosses Postgres → API → Redis → worker → engine socket, so a big flow pays megabytes to resolve a trivial resolver like the HTTP piece's `authFields`: measured 7.3 MB on a 25-step flow, and a panel open fires three of these in parallel (GIT-1822). The engine only uses `sampleData` to seed step outputs so `{{step.x}}` inside the property's `input` resolves, so callers must use `getSampleDataReferencedBy` and pass the request `input` — which narrows the read to the steps that input names. When narrowing, a referenced `LOOP_ON_ITEMS` step also needs whatever its `items` expression references: `stateFromFlowVersion` derives a loop's `item` by resolving its settings against the context built so far, never from `sampleData[loopName]`. Matching step names as substrings of the serialized input over-approximates, which is the safe direction — a step reference always spells the name literally, in both the property-path and script branches of `props-resolver`.
+- **There is no static signal for whether a DynamicProperties resolver is pure, so caching its result is never safe by inspection.** Both tempting heuristics have counterexamples in this repo. "Trivial resolver" fails because purity cannot be read off the declaration; "declares no connection" fails because `packages/pieces/core/tables` `update-record` declares `auth: PieceAuth.None()` yet its `values` resolver calls `tablesCommon.createFieldProperties` → `getTableFields`, a live request to `v1/fields` authenticated with the **engine token** rather than a connection — so a column added to an Activepieces Table would not show up. Third-party resolvers that fetch live schema (Zendesk `userFieldsDynamicProp`, Supabase `table_columns`) are the same class reached through a connection. The failure mode is a silently outdated form, which the builder gives the user no way to refresh. Anything in this area (GIT-813) needs either a purity signal the piece declares, or stale-while-revalidate that always refetches and corrects within a round trip — and note that SWR re-applies the schema a second time, which is exactly the path the `lastKnownValue` snapshot above exists to protect.
 - **The frontend `POST /v1/pieces/options` client only rejects for DYNAMIC.** `piecesApi.options` (`packages/web/src/features/pieces/api/`) catches DROPDOWN failures, toasts, and *resolves* with a disabled-dropdown fallback — so for dropdowns every error path wired onto that mutation is dead: `usePieceOptions`' `onError` handlers, its `retry: 1`, and the `if (error) throw error` into `DynamicPropertiesErrorBoundary`. DYNAMIC must rethrow: a swallowed failure arrives as a *successful* empty schema, which resets the property's children to defaults and gets persisted by step-settings autosave.
 - **An action that can be called as an MCP tool cannot create a waitpoint.** An MCP piece tool runs the
   real action through `actionRunService`, which sets `actionRunMode` on the engine, and
diff --git a/brain/knowledge/platform-editions-ee/platform-configuration.md b/brain/knowledge/platform-editions-ee/platform-configuration.md
index 4c098e411f65..1072f75adfbf 100644
--- a/brain/knowledge/platform-editions-ee/platform-configuration.md
+++ b/brain/knowledge/platform-editions-ee/platform-configuration.md
@@ -27,6 +27,12 @@ A **Platform** is the top-level tenant namespace in Activepieces. Every install
 - **What blocks `DELETE FROM platform`** is now two constraints: `project` and `signing_key`, both `RESTRICT`. It used to be four — `tag` and `piece_tag` were `NO ACTION` and were dropped once it was clear the tables had outlived their feature. The other 14 FKs already `CASCADE`. Platform deletion failing for one tenant and not another almost always means a new blocking FK, not a member count.
 - **Delete order is forced by `platform.ownerId → user` being `RESTRICT`**: the platform row must go before its owner's `user` row, never the reverse. `project.ownerId → user` is `NO ACTION`, so projects must also be gone before any user is deleted.
 - Any new entity carrying `platformId` should declare its FK `ON DELETE CASCADE`. Otherwise add it by name to the teardown job (`ee/platform/platform-teardown-jobs.ts`), which deletes the two blockers and the twelve unconstrained tables itself — nothing in CI checks either. See [000026](../../decisions/000026-delete-platform-is-a-cloud-owner-action-purged-by-one-cascading-job.md).
+- **`getOrCreateForPlatform` takes a `distributedLock` only on the create path, and that lock waits up to 60 seconds before it throws.** `runExclusive({ timeoutInSeconds: 60 })` becomes redlock `retryCount: 300, retryDelay: 200ms` in `distributed-lock-factory.ts`, so the timeout is both the lock TTL and the acquisition budget: a contended first touch blocks, it does not fail fast. This only ever applies to the first read for a platform, since a platform that already has a row is served by a bare `findOneBy` on the unique `platformId` index with no lock and no Redis. Worth knowing before putting a configuration read on a latency-sensitive path, and worth not defending against on a path that already needs Postgres and Redis to do its job.
+- **A `platform_configuration` column has three fallbacks for a missing row and none for a failed read, and the two shipped columns do not use the same ones.** `isProductTelemetryEnabled` is backed by `AP_TELEMETRY_ENABLED` at creation (`createInitialConfiguration`, via `spreadIfNotUndefined`) *and* at read time in the bulk path (`COALESCE(..., :fallback)` in `filterProjectsWithProductTelemetryEnabled`). `isInfraSetupTelemetryEnabled` has **no env var behind it at all**: nothing writes it on create, `filterPlatformsWithInfraSetupTelemetryEnabled` selects only the rows that say `false` and counts every row-less platform as enabled, so its only fallback is the schema `DEFAULT true`. Reading [000033](../../decisions/000033-platform-configuration-rows-are-authoritative-and-created-on-first-read.md) leaves the impression that "the insert reads the env var" holds for the table; it holds for one column. Separately, the single-platform read (`getOrCreateForPlatform`) is wrapped in no `tryCatch` at any call site, so a Postgres outage or a `distributedLock` timeout throws into the caller. `platformPlanService.getOrCreateForPlatform` has the same shape but its callers do defend (`ee/agent/agent-helpers.ts`). Any new consumer on a user-facing path has to choose fail-closed or fallback deliberately.
+- **`ActivepiecesError`'s `.message` is only the error code, so `rejects.toThrow('some text')` never matches the message you wrote.** The constructor is `super(error.code + ...)`, so a `VALIDATION` error thrown with `params: { message: 'This step waits on 3 things...' }` reports a `.message` of exactly `VALIDATION`, and a `toThrow` on the readable text fails with `expected [Function] to throw error including '...' but got 'VALIDATION'`. Assert on the structure instead: `rejects.toMatchObject({ error: { code: ErrorCode.VALIDATION, params: { message: expect.stringContaining('...') } } })`. Applies to every service-level throw in the API, not just configuration reads.
+- **Before moving an env var to `platform_configuration`, count the *processes* that read it, not the call sites, and check whether it is a cap rather than a toggle.** Two barrier vars were assessed and split cleanly. `AP_MAX_BARRIER_SIGNALS` is movable: one read site (`assertSignalCountWithinLimit` in `waitpoints/barrier-service.ts`), app-side only, and `barrierService.create` has no production caller yet. Its check site holds a `projectId` and not a `platformId`, and the waitpoints module already resolves that with `projectService.getPlatformId` (see `resume-service.ts`), so a per-platform read costs two indexed queries on a path that is about to insert up to 10 000 signal rows. `AP_PAUSED_FLOW_TIMEOUT_DAYS` is **not** movable despite also setting a barrier deadline: the engine reads it from `process.env` at module load (`handler/piece-executor.ts`), `machine-service.ts` ships it to workers inside the machine-settings zod contract, `flag.service.ts` republishes it to the browser, file cleanup sizes retention from it, and `system-validator` cross-checks it against `AP_EXECUTION_DATA_RETENTION_DAYS`, and a per-platform row cannot answer any of those. Separately, even the movable one is a *protective cap* on tenant fan-out, the `MAX_RECORDS_PER_TABLE` shape [000033](../../decisions/000033-platform-configuration-rows-are-authoritative-and-created-on-first-read.md) keeps off this page: `POST /v1/platform-configurations` has no edition guard, so the day the page stops being Cloud-hidden a cap living here is a self-serve limit bypass. If it should vary per tenant, it is a `platform_plan` entitlement.
+- **`maxBarrierSignals` has no UI.** `limits-section.tsx` renders it and `configurations/index.tsx` deliberately does not mount that component, so the Configurations page shows telemetry only. The column, the zod bounds and the `POST` body all accept it, so it is editable over the API and not in the product. Do not point a user-facing message at the Configurations page for this setting until the section is mounted.
+- **`maxBarrierSignals` is bounded on both ends, and the env var is clamped rather than trusted.** `maxBarrierSignalsBounds` in `@activepieces/shared` (1 … 10 000) backs the zod `.min`/`.max` on `PlatformConfiguration`, so the same numbers guard the request body, the response serialization and the `min`/`max` on the settings input. Because `PlatformConfiguration` is also the GET response schema, an `AP_MAX_BARRIER_SIGNALS` above the ceiling would seed a row that no longer serializes — `createInitialConfiguration` and the Cloud read path therefore clamp the env value into the bounds, and `system-validator` only warns (validator failures never block boot), so clamping is the actual protection, not the warning.
 - **Setting a user `INACTIVE` stops logins and nothing else.** The trigger scheduler, the BullMQ queue, and the `SERVICE` principal an API key produces never read `user.status`. Cutting a platform off means disabling every flow through `CHANGE_STATUS` (so `triggerSourceService.disable` unregisters webhooks and drops schedules), draining queued work with `batchDeleteByFlowId`, and deleting the platform's `api_key` rows — deactivating members alone leaves all of it running.
 
 ### Key files
diff --git a/bun.lock b/bun.lock
index 2051d39bfcc5..8ad96b2c8eb0 100644
--- a/bun.lock
+++ b/bun.lock
@@ -120,7 +120,7 @@
     },
     "packages/core/execution": {
       "name": "@activepieces/core-execution",
-      "version": "0.20.2",
+      "version": "0.21.0",
       "dependencies": {
         "@activepieces/core-piece-types": "workspace:*",
         "@activepieces/core-utils": "workspace:*",
@@ -165,7 +165,7 @@
     },
     "packages/core/shared": {
       "name": "@activepieces/shared",
-      "version": "0.176.0",
+      "version": "0.177.0",
       "dependencies": {
         "@activepieces/core-execution": "workspace:*",
         "@activepieces/core-formula": "workspace:*",
@@ -697,13 +697,14 @@
     },
     "packages/pieces/community/apitable": {
       "name": "@activepieces/piece-apitable",
-      "version": "0.2.0",
+      "version": "0.3.0",
       "dependencies": {
         "@activepieces/core-piece-types": "workspace:*",
         "@activepieces/core-utils": "workspace:*",
         "@activepieces/pieces-common": "workspace:*",
         "@activepieces/pieces-framework": "workspace:*",
         "dayjs": "1.11.9",
+        "form-data": "4.0.6",
       },
       "devDependencies": {
         "tslib": "2.6.2",
@@ -1862,7 +1863,7 @@
     },
     "packages/pieces/community/claude": {
       "name": "@activepieces/piece-claude",
-      "version": "0.5.0",
+      "version": "0.6.0",
       "dependencies": {
         "@activepieces/core-piece-types": "workspace:*",
         "@activepieces/core-utils": "workspace:*",
diff --git a/docs/install/architecture/waitpoints.mdx b/docs/install/architecture/waitpoints.mdx
index 20adcf77e53c..7ed01c7bf4ef 100644
--- a/docs/install/architecture/waitpoints.mdx
+++ b/docs/install/architecture/waitpoints.mdx
@@ -17,7 +17,7 @@ stateDiagram-v2
 
 | Field | Meaning |
 | --- | --- |
-| `flowRunId`, `stepName` | Which run/step is paused. Unique together: a step has at most one waitpoint. |
+| `flowRunId`, `stepName` | Which run/step is paused. Unique together. `stepName` is **path-qualified** for a step inside a loop (`loop_1:3/approval`), so each iteration gets its own row. |
 | `type` | `DELAY`, `WEBHOOK` or `BARRIER`. |
 | `status` | `PENDING` until the resume signal arrives, then `COMPLETED`. |
 | `resumeDateTime` | For `DELAY`: when to fire the resume. |
@@ -62,7 +62,8 @@ The step resumes with one shape, so an expression never breaks on fan-out width:
 
 The `signals` array is present only when `total <= 100`; above that only the counts travel and
 `signalsTruncated` is set. `AP_MAX_BARRIER_SIGNALS` (default 10 000) caps how many things one barrier may
-wait on. A barrier's deadline is set when it is created, from `AP_PAUSED_FLOW_TIMEOUT_DAYS`, and never moves.
+wait on. The cap is stored per platform, created from the env var the first time that platform's
+configuration is read. 10 000 is also the ceiling: the env var cannot raise it higher. A barrier's deadline is set when it is created, from `AP_PAUSED_FLOW_TIMEOUT_DAYS`, and never moves.
 
 ## Lifecycle
 
@@ -95,7 +96,7 @@ sequenceDiagram
 A callback can arrive before the flow run has finished writing `PAUSED` to disk. The protocol absorbs the race:
 
 - Completing a waitpoint takes a write lock on the `PENDING` row. If it exists, it flips to `COMPLETED` and stores the `resumePayload`. If it does not, a **pre-completed** row is inserted instead.
-- When the flow run transitions to `PAUSED`, the server checks for a matching `COMPLETED` waitpoint and enqueues the resume job immediately.
+- When the flow run transitions to `PAUSED`, the server checks for a `COMPLETED` waitpoint on the run and enqueues the resume job immediately — but only once **no** waitpoint for that run is still `PENDING`. A run holding a pause per loop iteration can carry a completed leftover and an open pause at the same time, and resuming off the leftover would skip the open one.
 
 Duplicate callbacks are absorbed by the uniqueness constraint; the engine never processes a resume twice.
 
@@ -111,3 +112,8 @@ Duplicate callbacks are absorbed by the uniqueness constraint; the engine never
 
 Piece authors create waitpoints with `ctx.run.createWaitpoint` / `ctx.run.waitForWaitpoint`. Patterns for `WEBHOOK`, `DELAY`, and `responseToSend` are in Flow Control.
 
+## Known limitation
+
+`findPendingByVersion` — the lookup behind the deprecated V0 `/:id/requests/:requestId` resume routes —
+returns an arbitrary pending V0 waitpoint for a run. That is exact today because nothing gives one run two
+pending V0 waitpoints at once. Parallel branches would, and must fix this lookup first.
diff --git a/docs/install/reference/environment-variables.mdx b/docs/install/reference/environment-variables.mdx
index 00dca0b93bee..3d65b0009822 100644
--- a/docs/install/reference/environment-variables.mdx
+++ b/docs/install/reference/environment-variables.mdx
@@ -178,6 +178,7 @@ run data is kept. The **Cloud** values and how these interact are covered in
 | `AP_MAX_WEBHOOK_PAYLOAD_SIZE_MB` | Maximum incoming webhook payload size (MB). Larger payloads are rejected with HTTP 413. | `25` |
 | `AP_WEBHOOK_PAYLOAD_INLINE_THRESHOLD_KB` | Webhook payloads below this (KB) are stored inline in Redis; larger ones are offloaded to file storage to protect Redis memory. | `512` |
 | `AP_WEBHOOK_TIMEOUT_SECONDS` | Default timeout for synchronous webhooks. Maximum 15 minutes; note Cloudflare caps it at 30 seconds. | `30` |
+| `AP_MAX_BARRIER_SIGNALS` | Maximum number of things a single barrier may wait on — the approvers on one approval, or the batches a fan-out dispatched. The cap is stored per platform and created from this value the first time that platform's configuration is read, so changing it later only affects platforms that have not been read yet. Capped at `10000`; a higher value is clamped down to it. | `10000` |
 | `AP_MAX_RECORDS_PER_TABLE` | Maximum number of records per table. | `10000` |
 | `AP_MAX_FIELDS_PER_TABLE` | Maximum number of fields per table. | `100` |
 
diff --git a/packages/core/execution/package.json b/packages/core/execution/package.json
index 099a27a8946d..7b1be0219e56 100644
--- a/packages/core/execution/package.json
+++ b/packages/core/execution/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@activepieces/core-execution",
-  "version": "0.20.2",
+  "version": "0.21.0",
   "type": "commonjs",
   "main": "./dist/src/index.js",
   "scripts": {
diff --git a/packages/core/execution/src/lib/flow-run/waitpoint/index.ts b/packages/core/execution/src/lib/flow-run/waitpoint/index.ts
index 7f3005206b60..7fc7a006104d 100644
--- a/packages/core/execution/src/lib/flow-run/waitpoint/index.ts
+++ b/packages/core/execution/src/lib/flow-run/waitpoint/index.ts
@@ -101,6 +101,8 @@ export const BarrierSummary = z.object({
 })
 export type BarrierSummary = z.infer<typeof BarrierSummary>
 
+export const MAX_INLINE_BARRIER_SIGNALS = 100
+
 export const UNFAVOURABLE_SIGNAL_STATUSES = [
     BarrierSignalStatus.FAILED,
     BarrierSignalStatus.REJECTED,
diff --git a/packages/core/shared/package.json b/packages/core/shared/package.json
index ff909b6dece7..303ade598a50 100644
--- a/packages/core/shared/package.json
+++ b/packages/core/shared/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@activepieces/shared",
-  "version": "0.176.0",
+  "version": "0.177.0",
   "type": "commonjs",
   "sideEffects": false,
   "main": "./dist/src/index.js",
diff --git a/packages/core/shared/src/lib/management/platform/platform-configuration.ts b/packages/core/shared/src/lib/management/platform/platform-configuration.ts
index 08e92b332824..ca7a006bdd9b 100644
--- a/packages/core/shared/src/lib/management/platform/platform-configuration.ts
+++ b/packages/core/shared/src/lib/management/platform/platform-configuration.ts
@@ -1,16 +1,33 @@
-import { BaseModelSchema } from '@activepieces/core-utils'
+import { BaseModelSchema, isNil } from '@activepieces/core-utils'
 import { z } from 'zod'
+import { formErrors } from '../../form-errors'
+
+const MIN_BARRIER_SIGNALS = 1
+const MAX_BARRIER_SIGNALS = 10_000
 
 export const PlatformConfiguration = z.object({
     ...BaseModelSchema,
     platformId: z.string(),
     isProductTelemetryEnabled: z.boolean(),
     isInfraSetupTelemetryEnabled: z.boolean(),
+    maxBarrierSignals: z
+        .int({ error: (issue) => isNil(issue.input) ? formErrors.required : formErrors.wholeNumber })
+        .min(MIN_BARRIER_SIGNALS, formErrors.atLeastOne)
+        .max(MAX_BARRIER_SIGNALS, formErrors.atMostTenThousand),
 })
 export type PlatformConfiguration = z.infer<typeof PlatformConfiguration>
 
-export const UpdatePlatformConfigurationRequestBody = PlatformConfiguration.pick({
+export const PlatformConfigurationSettings = PlatformConfiguration.pick({
     isProductTelemetryEnabled: true,
     isInfraSetupTelemetryEnabled: true,
-}).partial()
+    maxBarrierSignals: true,
+})
+export type PlatformConfigurationSettings = z.infer<typeof PlatformConfigurationSettings>
+
+export const UpdatePlatformConfigurationRequestBody = PlatformConfigurationSettings.partial()
 export type UpdatePlatformConfigurationRequestBody = z.infer<typeof UpdatePlatformConfigurationRequestBody>
+
+export const maxBarrierSignalsBounds = {
+    min: MIN_BARRIER_SIGNALS,
+    max: MAX_BARRIER_SIGNALS,
+}
diff --git a/packages/core/utils/src/lib/form-errors.ts b/packages/core/utils/src/lib/form-errors.ts
index d4f1545d7402..ffd87bbfb5d0 100644
--- a/packages/core/utils/src/lib/form-errors.ts
+++ b/packages/core/utils/src/lib/form-errors.ts
@@ -8,6 +8,9 @@ export const formErrors = {
     messageRequiresContentOrFiles: 'messageRequiresContentOrFiles',
     agentConfigTooLarge: 'agentConfigTooLarge',
     invalidGcpResourceId: 'invalidGcpResourceId',
+    atLeastOne: 'atLeastOne',
+    wholeNumber: 'wholeNumber',
+    atMostTenThousand: 'atMostTenThousand',
 } as const
 
 export const SAFE_EXTERNAL_ID_PATTERN = /^(?!\.{1,2}$)[A-Za-z0-9._-]{1,128}$/
diff --git a/packages/pieces/community/apitable/package.json b/packages/pieces/community/apitable/package.json
index 95ae7eb77682..30b352842c91 100644
--- a/packages/pieces/community/apitable/package.json
+++ b/packages/pieces/community/apitable/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@activepieces/piece-apitable",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
   "scripts": {
@@ -12,6 +12,7 @@
     "@activepieces/pieces-common": "workspace:*",
     "@activepieces/pieces-framework": "workspace:*",
     "dayjs": "1.11.9",
+    "form-data": "4.0.6",
     "@activepieces/core-piece-types": "workspace:*",
     "@activepieces/core-utils": "workspace:*"
   },
diff --git a/packages/pieces/community/apitable/src/index.ts b/packages/pieces/community/apitable/src/index.ts
index 92fc9d8d5882..2faa0d9c74d6 100644
--- a/packages/pieces/community/apitable/src/index.ts
+++ b/packages/pieces/community/apitable/src/index.ts
@@ -9,6 +9,14 @@ import { PieceCategory } from '@activepieces/pieces-framework';
 import { createRecordAction } from './lib/actions/create-record';
 import { findRecordAction } from './lib/actions/find-record';
 import { updateRecordAction } from './lib/actions/update-record';
+import { deleteRecordAction } from './lib/actions/delete-record';
+import { listSpacesAction } from './lib/actions/list-spaces';
+import { listDatasheetsAction } from './lib/actions/list-datasheets';
+import { getDatasheetFieldsAction } from './lib/actions/get-datasheet-fields';
+import { listViewsAction } from './lib/actions/list-views';
+import { uploadAttachmentAction } from './lib/actions/upload-attachment';
+import { searchNodesAction } from './lib/actions/search-nodes';
+import { getNodeDetailsAction } from './lib/actions/get-node-details';
 import { newRecordTrigger } from './lib/triggers/new-record';
 import { makeClient } from './lib/common';
 import { APITableAuth } from './lib/auth';
@@ -17,7 +25,7 @@ export const apitable = createPiece({
   displayName: 'AITable',
   auth: APITableAuth,
   description: `Interactive spreadsheets with collaboration`,
-  minimumSupportedRelease: '0.30.0',
+  minimumSupportedRelease: '0.87.0',
   logoUrl: 'https://cdn.activepieces.com/pieces/apitable.png',
   categories: [PieceCategory.PRODUCTIVITY],
   authors: [
@@ -31,6 +39,14 @@ export const apitable = createPiece({
     createRecordAction,
     updateRecordAction,
     findRecordAction,
+    deleteRecordAction,
+    listSpacesAction,
+    listDatasheetsAction,
+    getDatasheetFieldsAction,
+    listViewsAction,
+    uploadAttachmentAction,
+    searchNodesAction,
+    getNodeDetailsAction,
     createCustomApiCallAction({
       baseUrl: (auth) => {
         return (auth?.props.apiTableUrl ?? '');
diff --git a/packages/pieces/community/apitable/src/lib/actions/create-record.ts b/packages/pieces/community/apitable/src/lib/actions/create-record.ts
index 2a4bf1b3e462..944c5fd9740d 100644
--- a/packages/pieces/community/apitable/src/lib/actions/create-record.ts
+++ b/packages/pieces/community/apitable/src/lib/actions/create-record.ts
@@ -5,6 +5,7 @@ import {
 } from '@activepieces/pieces-framework';
 import { APITableCommon, createNewFields, makeClient } from '../common';
 import { APITableAuth } from '../auth';
+import { createRecordActionOutputSchema } from '../output-schemas';
 
 export const createRecordAction = createAction({
   auth: APITableAuth,
@@ -23,6 +24,7 @@ export const createRecordAction = createAction({
     datasheet_id: APITableCommon.datasheet_id,
     fields: APITableCommon.fields,
   },
+  outputSchema: createRecordActionOutputSchema,
   async run(context) {
     const auth = context.auth;
     const datasheetId = context.propsValue.datasheet_id;
diff --git a/packages/pieces/community/apitable/src/lib/actions/delete-record.ts b/packages/pieces/community/apitable/src/lib/actions/delete-record.ts
new file mode 100644
index 000000000000..59cd0c88063b
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/actions/delete-record.ts
@@ -0,0 +1,41 @@
+import { Property, createAction } from '@activepieces/pieces-framework';
+import { APITableCommon, makeClient } from '../common';
+import { APITableAuth } from '../auth';
+import { deleteRecordActionOutputSchema } from '../output-schemas';
+
+export const deleteRecordAction = createAction({
+  auth: APITableAuth,
+  name: 'apitable_delete_record',
+  classification: 'DESTRUCTIVE',
+  displayName: 'Delete Record',
+  description: 'Deletes one or more records from a datasheet.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Permanently deletes one or more records from an AITable datasheet by record ID; obtain the IDs from Find Records first. Use only when records should be removed entirely, not just updated. Not idempotent: retrying after a successful delete errors because the records no longer exist.',
+    idempotent: false,
+  },
+  props: {
+    space_id: APITableCommon.space_id,
+    datasheet_id: APITableCommon.datasheet_id,
+    recordIds: Property.Array({
+      displayName: 'Record IDs',
+      description: 'The IDs of the records to delete.',
+      required: true,
+    }),
+  },
+  outputSchema: deleteRecordActionOutputSchema,
+  async run(context) {
+    const datasheetId = context.propsValue.datasheet_id as string;
+    const recordIds = context.propsValue.recordIds as string[];
+
+    const client = makeClient(context.auth.props);
+    const response = await client.deleteRecords(datasheetId, recordIds);
+
+    if (!response.success) {
+      throw new Error(JSON.stringify(response, undefined, 2));
+    }
+
+    return response;
+  },
+});
diff --git a/packages/pieces/community/apitable/src/lib/actions/find-record.ts b/packages/pieces/community/apitable/src/lib/actions/find-record.ts
index a9a382ad7ab2..c1b674ce0bfd 100644
--- a/packages/pieces/community/apitable/src/lib/actions/find-record.ts
+++ b/packages/pieces/community/apitable/src/lib/actions/find-record.ts
@@ -6,6 +6,7 @@ import {
 import { APITableCommon, makeClient } from '../common';
 import { APITableAuth } from '../auth';
 import { prepareQuery } from '../common/client';
+import { findRecordActionOutputSchema } from '../output-schemas';
 
 export const findRecordAction = createAction({
   auth: APITableAuth,
@@ -55,6 +56,7 @@ export const findRecordAction = createAction({
       required: false,
     }),
   },
+  outputSchema: findRecordActionOutputSchema,
   async run(context) {
     const datasheetId = context.propsValue.datasheet_id;
     const recordIds = context.propsValue.recordIds ?? []
diff --git a/packages/pieces/community/apitable/src/lib/actions/get-datasheet-fields.ts b/packages/pieces/community/apitable/src/lib/actions/get-datasheet-fields.ts
new file mode 100644
index 000000000000..6b6ff2e13922
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/actions/get-datasheet-fields.ts
@@ -0,0 +1,35 @@
+import { createAction } from '@activepieces/pieces-framework';
+import { APITableCommon, makeClient } from '../common';
+import { APITableAuth } from '../auth';
+import { getDatasheetFieldsActionOutputSchema } from '../output-schemas';
+
+export const getDatasheetFieldsAction = createAction({
+  auth: APITableAuth,
+  name: 'apitable_get_datasheet_fields',
+  classification: 'READ',
+  displayName: 'Get Datasheet Fields',
+  description: 'Reads the field (column) definitions of a datasheet.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Reads the field (column) definitions of an AITable datasheet, including each field\'s name, type, and the option list for select/member fields. Use before creating or updating records to learn the valid field names and choices for that datasheet. Idempotent: it only reads data.',
+    idempotent: true,
+  },
+  props: {
+    space_id: APITableCommon.space_id,
+    datasheet_id: APITableCommon.datasheet_id,
+  },
+  outputSchema: getDatasheetFieldsActionOutputSchema,
+  async run(context) {
+    const client = makeClient(context.auth.props);
+    const response = await client.getDatasheetFields(
+      context.propsValue.datasheet_id as string
+    );
+
+    if (!response.success) {
+      throw new Error(JSON.stringify(response, undefined, 2));
+    }
+
+    return response;
+  },
+});
diff --git a/packages/pieces/community/apitable/src/lib/actions/get-node-details.ts b/packages/pieces/community/apitable/src/lib/actions/get-node-details.ts
new file mode 100644
index 000000000000..13ba734ff6ab
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/actions/get-node-details.ts
@@ -0,0 +1,40 @@
+import { Property, createAction } from '@activepieces/pieces-framework';
+import { APITableCommon, makeClient } from '../common';
+import { APITableAuth } from '../auth';
+import { getNodeDetailsActionOutputSchema } from '../output-schemas';
+
+export const getNodeDetailsAction = createAction({
+  auth: APITableAuth,
+  name: 'apitable_get_node_details',
+  classification: 'READ',
+  displayName: 'Get Node Details',
+  description: 'Reads the details of a single file node, including its children.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Reads a single AITable node (datasheet, folder, form, dashboard, etc.) by ID, returning its name, type, and, for a folder, the child nodes inside it. Use to confirm a node\'s type or list a folder\'s contents; obtain the node ID from Search Nodes or List Datasheets. Idempotent: it only reads data.',
+    idempotent: true,
+  },
+  props: {
+    space_id: APITableCommon.space_id,
+    node_id: Property.ShortText({
+      displayName: 'Node ID',
+      description: 'The ID of the node to read.',
+      required: true,
+    }),
+  },
+  outputSchema: getNodeDetailsActionOutputSchema,
+  async run(context) {
+    const client = makeClient(context.auth.props);
+    const response = await client.getNodeDetails(
+      context.propsValue.space_id as string,
+      context.propsValue.node_id
+    );
+
+    if (!response.success) {
+      throw new Error(JSON.stringify(response, undefined, 2));
+    }
+
+    return response;
+  },
+});
diff --git a/packages/pieces/community/apitable/src/lib/actions/list-datasheets.ts b/packages/pieces/community/apitable/src/lib/actions/list-datasheets.ts
new file mode 100644
index 000000000000..f315ea3c32e2
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/actions/list-datasheets.ts
@@ -0,0 +1,34 @@
+import { createAction } from '@activepieces/pieces-framework';
+import { APITableCommon, makeClient } from '../common';
+import { APITableAuth } from '../auth';
+import { listDatasheetsActionOutputSchema } from '../output-schemas';
+
+export const listDatasheetsAction = createAction({
+  auth: APITableAuth,
+  name: 'apitable_list_datasheets',
+  classification: 'SEARCH',
+  displayName: 'List Datasheets',
+  description: 'Lists the datasheets available in a space.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Lists the datasheets in an AITable space, returning each datasheet\'s ID and name. Use to discover a datasheet ID before creating, finding, updating, or deleting its records. Idempotent: it only reads data.',
+    idempotent: true,
+  },
+  props: {
+    space_id: APITableCommon.space_id,
+  },
+  outputSchema: listDatasheetsActionOutputSchema,
+  async run(context) {
+    const client = makeClient(context.auth.props);
+    const response = await client.listDatasheets(
+      context.propsValue.space_id as string
+    );
+
+    if (!response.success) {
+      throw new Error(JSON.stringify(response, undefined, 2));
+    }
+
+    return response;
+  },
+});
diff --git a/packages/pieces/community/apitable/src/lib/actions/list-spaces.ts b/packages/pieces/community/apitable/src/lib/actions/list-spaces.ts
new file mode 100644
index 000000000000..4f3674dab4c9
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/actions/list-spaces.ts
@@ -0,0 +1,30 @@
+import { createAction } from '@activepieces/pieces-framework';
+import { makeClient } from '../common';
+import { APITableAuth } from '../auth';
+import { listSpacesActionOutputSchema } from '../output-schemas';
+
+export const listSpacesAction = createAction({
+  auth: APITableAuth,
+  name: 'apitable_list_spaces',
+  classification: 'SEARCH',
+  displayName: 'List Spaces',
+  description: 'Lists the spaces available to the authenticated account.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Lists every space (workspace) the authenticated AITable account can access, returning each space\'s ID and name. Use to discover a space ID before listing its datasheets. Idempotent: it only reads data.',
+    idempotent: true,
+  },
+  props: {},
+  outputSchema: listSpacesActionOutputSchema,
+  async run(context) {
+    const client = makeClient(context.auth.props);
+    const response = await client.listSpaces();
+
+    if (!response.success) {
+      throw new Error(JSON.stringify(response, undefined, 2));
+    }
+
+    return response;
+  },
+});
diff --git a/packages/pieces/community/apitable/src/lib/actions/list-views.ts b/packages/pieces/community/apitable/src/lib/actions/list-views.ts
new file mode 100644
index 000000000000..25372ba73b77
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/actions/list-views.ts
@@ -0,0 +1,35 @@
+import { createAction } from '@activepieces/pieces-framework';
+import { APITableCommon, makeClient } from '../common';
+import { APITableAuth } from '../auth';
+import { listViewsActionOutputSchema } from '../output-schemas';
+
+export const listViewsAction = createAction({
+  auth: APITableAuth,
+  name: 'apitable_list_views',
+  classification: 'SEARCH',
+  displayName: 'List Views',
+  description: 'Lists the views of a datasheet.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Lists the views (Grid, Kanban, Gallery, etc.) of an AITable datasheet, returning each view\'s ID, name, and type. Use to discover a view ID to scope Find Records to that view\'s rows and sort order. Idempotent: it only reads data.',
+    idempotent: true,
+  },
+  props: {
+    space_id: APITableCommon.space_id,
+    datasheet_id: APITableCommon.datasheet_id,
+  },
+  outputSchema: listViewsActionOutputSchema,
+  async run(context) {
+    const client = makeClient(context.auth.props);
+    const response = await client.listViews(
+      context.propsValue.datasheet_id as string
+    );
+
+    if (!response.success) {
+      throw new Error(JSON.stringify(response, undefined, 2));
+    }
+
+    return response;
+  },
+});
diff --git a/packages/pieces/community/apitable/src/lib/actions/search-nodes.ts b/packages/pieces/community/apitable/src/lib/actions/search-nodes.ts
new file mode 100644
index 000000000000..4b0acb94b123
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/actions/search-nodes.ts
@@ -0,0 +1,58 @@
+import { Property, createAction } from '@activepieces/pieces-framework';
+import { APITableCommon, makeClient } from '../common';
+import { APITableAuth } from '../auth';
+import { searchNodesActionOutputSchema } from '../output-schemas';
+
+export const searchNodesAction = createAction({
+  auth: APITableAuth,
+  name: 'apitable_search_nodes',
+  classification: 'SEARCH',
+  displayName: 'Search Nodes',
+  description:
+    'Searches the file nodes (datasheets, folders, forms, dashboards, etc.) in a space.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Searches every file node in an AITable space by type and/or name query, regardless of folder hierarchy; returns id, name, type and parent for each match. Use to find folders, forms, dashboards, or mirrors that List Datasheets does not surface since it only returns datasheets. Idempotent: it only reads data.',
+    idempotent: true,
+  },
+  props: {
+    space_id: APITableCommon.space_id,
+    type: Property.StaticDropdown({
+      displayName: 'Node Type',
+      description: 'The type of node to search for.',
+      required: true,
+      options: {
+        options: [
+          { label: 'Datasheet', value: 'Datasheet' },
+          { label: 'Folder', value: 'Folder' },
+          { label: 'Form', value: 'Form' },
+          { label: 'Dashboard', value: 'Dashboard' },
+          { label: 'Mirror', value: 'Mirror' },
+        ],
+      },
+    }),
+    query: Property.ShortText({
+      displayName: 'Name Query',
+      description: 'Filter results to node names containing this text.',
+      required: false,
+    }),
+  },
+  outputSchema: searchNodesActionOutputSchema,
+  async run(context) {
+    const client = makeClient(context.auth.props);
+    const response = await client.searchNodes(
+      context.propsValue.space_id as string,
+      {
+        type: context.propsValue.type,
+        query: context.propsValue.query,
+      }
+    );
+
+    if (!response.success) {
+      throw new Error(JSON.stringify(response, undefined, 2));
+    }
+
+    return response;
+  },
+});
diff --git a/packages/pieces/community/apitable/src/lib/actions/update-record.ts b/packages/pieces/community/apitable/src/lib/actions/update-record.ts
index afe1023849c0..e1dac94cb727 100644
--- a/packages/pieces/community/apitable/src/lib/actions/update-record.ts
+++ b/packages/pieces/community/apitable/src/lib/actions/update-record.ts
@@ -6,6 +6,7 @@ import {
 } from '@activepieces/pieces-framework';
 import { APITableCommon, createNewFields, makeClient } from '../common';
 import { APITableAuth } from '../auth';
+import { updateRecordActionOutputSchema } from '../output-schemas';
 
 export const updateRecordAction = createAction({
 	auth: APITableAuth,
@@ -29,6 +30,7 @@ export const updateRecordAction = createAction({
 		}),
 		fields: APITableCommon.fields,
 	},
+	outputSchema: updateRecordActionOutputSchema,
 	async run(context) {
 		const auth = context.auth;
 		const datasheetId = context.propsValue.datasheet_id;
diff --git a/packages/pieces/community/apitable/src/lib/actions/upload-attachment.ts b/packages/pieces/community/apitable/src/lib/actions/upload-attachment.ts
new file mode 100644
index 000000000000..9785b8c63066
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/actions/upload-attachment.ts
@@ -0,0 +1,45 @@
+import { Property, createAction } from '@activepieces/pieces-framework';
+import { APITableCommon, makeClient } from '../common';
+import { APITableAuth } from '../auth';
+import { uploadAttachmentActionOutputSchema } from '../output-schemas';
+
+export const uploadAttachmentAction = createAction({
+  auth: APITableAuth,
+  name: 'apitable_upload_attachment',
+  classification: 'WRITE',
+  displayName: 'Upload Attachment',
+  description: 'Uploads a file to a datasheet and returns its storage URL.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Uploads a single file to an AITable datasheet and returns its stored token and URL. Use to obtain the URL for a file before writing it into an Attachment field with Create Record or Update Record. Not idempotent: each call stores a new file, so repeating it duplicates the upload.',
+    idempotent: false,
+  },
+  props: {
+    space_id: APITableCommon.space_id,
+    datasheet_id: APITableCommon.datasheet_id,
+    file: Property.File({
+      displayName: 'File',
+      description: 'The file to upload.',
+      required: true,
+    }),
+  },
+  outputSchema: uploadAttachmentActionOutputSchema,
+  async run(context) {
+    const datasheetId = context.propsValue.datasheet_id as string;
+    const file = context.propsValue.file;
+
+    const client = makeClient(context.auth.props);
+    const response = await client.uploadAttachment(
+      datasheetId,
+      file.filename,
+      file.data
+    );
+
+    if (!response.success) {
+      throw new Error(JSON.stringify(response, undefined, 2));
+    }
+
+    return response;
+  },
+});
diff --git a/packages/pieces/community/apitable/src/lib/common/client.ts b/packages/pieces/community/apitable/src/lib/common/client.ts
index 8387a1792d3c..a5d15ee4337b 100644
--- a/packages/pieces/community/apitable/src/lib/common/client.ts
+++ b/packages/pieces/community/apitable/src/lib/common/client.ts
@@ -6,6 +6,7 @@ import {
   httpClient,
 } from '@activepieces/pieces-common';
 import { AITableFieldType } from './constants';
+import FormData from 'form-data';
 
 function emptyValueFilter(
   accessor: (key: string) => any
@@ -20,6 +21,16 @@ function emptyValueFilter(
   };
 }
 
+type NodeSummary = {
+  id: string;
+  name: string;
+  type: string;
+  icon: string;
+  isFav: boolean;
+  permission: number;
+  parentId?: string;
+};
+
 export function prepareQuery(request?: Record<string, any>): QueryParams {
   const params: QueryParams = {};
   if (!request) return params;
@@ -38,7 +49,8 @@ export class AITableClient {
     method: HttpMethod,
     resourceUri: string,
     query?: QueryParams,
-    body: any | undefined = undefined
+    body: any | undefined = undefined,
+    headers?: Record<string, string>
   ): Promise<T> {
     const baseUrl = this.apiTableUrl.replace(/\/$/, '');
     const res = await httpClient.sendRequest<T>({
@@ -50,45 +62,79 @@ export class AITableClient {
       },
       queryParams: query,
       body: body,
+      headers: headers,
     });
     return res.body;
   }
 
   async listSpaces() {
     return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
       data: {
         spaces: {
           id: string;
           name: string;
+          isAdmin: boolean;
         }[];
       };
     }>(HttpMethod.GET, '/v1/spaces');
   }
   async listDatasheets(space_id: string) {
     return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
       data: {
-        nodes: {
-          id: string;
-          name: string;
-        }[];
+        nodes: NodeSummary[];
       };
     }>(HttpMethod.GET, `/v2/spaces/${space_id}/nodes`, { type: 'Datasheet' });
   }
 
+  async searchNodes(
+    space_id: string,
+    query?: { type?: string; query?: string }
+  ) {
+    return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
+      data: {
+        nodes: NodeSummary[];
+      };
+    }>(HttpMethod.GET, `/v2/spaces/${space_id}/nodes`, prepareQuery(query));
+  }
+
+  async getNodeDetails(space_id: string, node_id: string) {
+    return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
+      data: NodeSummary & {
+        children?: NodeSummary[];
+      };
+    }>(HttpMethod.GET, `/v1/spaces/${space_id}/nodes/${node_id}`);
+  }
+
   async getDatasheetFields(datasheet_id: string) {
     return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
       data: {
         fields: {
           id: string;
           name: string;
           type: AITableFieldType;
-          desc: string;
+          editable: boolean;
+          isPrimary?: boolean;
           property?: {
-            format?: string;
             defaultValue?: string;
             options?: {
+              id: string;
               name: string;
-              id?: string;
+              color?: { name: string; value: string };
             }[];
           };
         }[];
@@ -97,26 +143,43 @@ export class AITableClient {
   }
 
   async createRecord(datasheet_id: string, request: object) {
-    return await this.makeRequest(
-      HttpMethod.POST,
-      `/v1/datasheets/${datasheet_id}/records`,
-      undefined,
-      request
-    );
+    return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
+      data: {
+        records: {
+          recordId: string;
+          fields: Record<string, unknown>;
+        }[];
+      };
+    }>(HttpMethod.POST, `/v1/datasheets/${datasheet_id}/records`, undefined, request);
   }
   async updateRecord(datasheet_id: string, request: object) {
-    return await this.makeRequest(
-      HttpMethod.PATCH,
-      `/v1/datasheets/${datasheet_id}/records`,
-      undefined,
-      request
-    );
+    return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
+      data: {
+        records: {
+          recordId: string;
+          createdAt: number;
+          updatedAt: number;
+          fields: Record<string, unknown>;
+        }[];
+      };
+    }>(HttpMethod.PATCH, `/v1/datasheets/${datasheet_id}/records`, undefined, request);
   }
 
   async listRecords(datasheet_id: string, query?: QueryParams) {
     return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
       data: {
         total: number;
+        pageNum: number;
+        pageSize: number;
         records: {
           recordId: string;
           createdAt: number;
@@ -126,4 +189,54 @@ export class AITableClient {
       };
     }>(HttpMethod.GET, `/v1/datasheets/${datasheet_id}/records`, query);
   }
+
+  async uploadAttachment(datasheet_id: string, filename: string, file: Buffer) {
+    const formData = new FormData();
+    formData.append('file', file, { filename });
+    return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
+      data: {
+        token: string;
+        mimeType: string;
+        size: number;
+        width?: number;
+        height?: number;
+        name: string;
+        url: string;
+      };
+    }>(
+      HttpMethod.POST,
+      `/v1/datasheets/${datasheet_id}/attachments`,
+      undefined,
+      formData,
+      formData.getHeaders()
+    );
+  }
+
+  async listViews(datasheet_id: string) {
+    return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
+      data: {
+        views: {
+          id: string;
+          name: string;
+          type: string;
+        }[];
+      };
+    }>(HttpMethod.GET, `/v1/datasheets/${datasheet_id}/views`);
+  }
+
+  async deleteRecords(datasheet_id: string, recordIds: string[]) {
+    return await this.makeRequest<{
+      success: boolean;
+      code: number;
+      message: string;
+    }>(HttpMethod.DELETE, `/v1/datasheets/${datasheet_id}/records`, {
+      recordIds: recordIds.join(','),
+    });
+  }
 }
diff --git a/packages/pieces/community/apitable/src/lib/output-schemas.ts b/packages/pieces/community/apitable/src/lib/output-schemas.ts
new file mode 100644
index 000000000000..5fc67e9308bd
--- /dev/null
+++ b/packages/pieces/community/apitable/src/lib/output-schemas.ts
@@ -0,0 +1,261 @@
+import { OutputSchema } from '@activepieces/pieces-framework';
+
+const envelopeFields: OutputSchema['fields'] = [
+  { key: 'success', label: 'Success', format: 'boolean' },
+  { key: 'code', label: 'Code', format: 'number' },
+  { key: 'message', label: 'Message' },
+];
+
+const createdRecordFields: OutputSchema['fields'] = [
+  { key: 'recordId', label: 'Record ID' },
+  { key: 'fields', label: 'Fields', dynamicKey: true },
+];
+
+const recordFields: OutputSchema['fields'] = [
+  { key: 'recordId', label: 'Record ID' },
+  { key: 'createdAt', label: 'Created At', format: 'datetime' },
+  { key: 'updatedAt', label: 'Updated At', format: 'datetime' },
+  { key: 'fields', label: 'Fields', dynamicKey: true },
+];
+
+const datasheetFieldFields: OutputSchema['fields'] = [
+  { key: 'id', label: 'Field ID' },
+  { key: 'name', label: 'Name' },
+  { key: 'type', label: 'Type' },
+  { key: 'editable', label: 'Editable', format: 'boolean' },
+  { key: 'isPrimary', label: 'Primary Field', format: 'boolean' },
+  {
+    key: 'property',
+    label: 'Property',
+    children: [
+      { key: 'defaultValue', label: 'Default Value' },
+      {
+        key: 'options',
+        label: 'Options',
+        labelKey: 'name',
+        listItems: [
+          { key: 'id', label: 'ID' },
+          { key: 'name', label: 'Name' },
+          {
+            key: 'color',
+            label: 'Color',
+            children: [
+              { key: 'name', label: 'Name' },
+              { key: 'value', label: 'Value' },
+            ],
+          },
+        ],
+      },
+    ],
+  },
+];
+
+const nodeSummaryFields: OutputSchema['fields'] = [
+  { key: 'id', label: 'Node ID' },
+  { key: 'name', label: 'Name' },
+  { key: 'type', label: 'Type' },
+  { key: 'icon', label: 'Icon' },
+  { key: 'isFav', label: 'Favorite', format: 'boolean' },
+  { key: 'permission', label: 'Permission', format: 'number' },
+];
+
+export const createRecordActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        {
+          key: 'records',
+          label: 'Records',
+          labelKey: 'recordId',
+          listItems: createdRecordFields,
+        },
+      ],
+    },
+  ],
+};
+
+export const updateRecordActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        {
+          key: 'records',
+          label: 'Records',
+          labelKey: 'recordId',
+          listItems: recordFields,
+        },
+      ],
+    },
+  ],
+};
+
+export const findRecordActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        { key: 'total', label: 'Total', format: 'number' },
+        { key: 'pageNum', label: 'Page Number', format: 'number' },
+        { key: 'pageSize', label: 'Page Size', format: 'number' },
+        {
+          key: 'records',
+          label: 'Records',
+          labelKey: 'recordId',
+          listItems: recordFields,
+        },
+      ],
+    },
+  ],
+};
+
+export const listSpacesActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        {
+          key: 'spaces',
+          label: 'Spaces',
+          labelKey: 'name',
+          listItems: [
+            { key: 'id', label: 'Space ID' },
+            { key: 'name', label: 'Name' },
+            { key: 'isAdmin', label: 'Is Admin', format: 'boolean' },
+          ],
+        },
+      ],
+    },
+  ],
+};
+
+export const listDatasheetsActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        {
+          key: 'nodes',
+          label: 'Datasheets',
+          labelKey: 'name',
+          listItems: [...nodeSummaryFields, { key: 'parentId', label: 'Parent ID' }],
+        },
+      ],
+    },
+  ],
+};
+
+export const searchNodesActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        {
+          key: 'nodes',
+          label: 'Nodes',
+          labelKey: 'name',
+          listItems: [...nodeSummaryFields, { key: 'parentId', label: 'Parent ID' }],
+        },
+      ],
+    },
+  ],
+};
+
+export const getNodeDetailsActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Node',
+      children: [
+        ...nodeSummaryFields,
+        {
+          key: 'children',
+          label: 'Children',
+          labelKey: 'name',
+          listItems: nodeSummaryFields,
+        },
+      ],
+    },
+  ],
+};
+
+export const listViewsActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        {
+          key: 'views',
+          label: 'Views',
+          labelKey: 'name',
+          listItems: [
+            { key: 'id', label: 'View ID' },
+            { key: 'name', label: 'Name' },
+            { key: 'type', label: 'Type' },
+          ],
+        },
+      ],
+    },
+  ],
+};
+
+export const getDatasheetFieldsActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        {
+          key: 'fields',
+          label: 'Fields',
+          labelKey: 'name',
+          listItems: datasheetFieldFields,
+        },
+      ],
+    },
+  ],
+};
+
+export const uploadAttachmentActionOutputSchema: OutputSchema = {
+  fields: [
+    ...envelopeFields,
+    {
+      key: 'data',
+      label: 'Data',
+      children: [
+        { key: 'token', label: 'Token' },
+        { key: 'name', label: 'File Name' },
+        { key: 'mimeType', label: 'MIME Type' },
+        { key: 'size', label: 'Size', format: 'filesize' },
+        { key: 'width', label: 'Width', format: 'number' },
+        { key: 'height', label: 'Height', format: 'number' },
+        { key: 'url', label: 'URL', format: 'url' },
+      ],
+    },
+  ],
+};
+
+export const deleteRecordActionOutputSchema: OutputSchema = {
+  fields: envelopeFields,
+};
+
+export const newRecordTriggerOutputSchema: OutputSchema = {
+  fields: recordFields,
+};
diff --git a/packages/pieces/community/apitable/src/lib/triggers/new-record.ts b/packages/pieces/community/apitable/src/lib/triggers/new-record.ts
index 7c32f353520c..53fe11650563 100644
--- a/packages/pieces/community/apitable/src/lib/triggers/new-record.ts
+++ b/packages/pieces/community/apitable/src/lib/triggers/new-record.ts
@@ -11,6 +11,7 @@ import {
 } from '@activepieces/pieces-common';
 import { APITableCommon, makeClient } from '../common';
 import dayjs from 'dayjs';
+import { newRecordTriggerOutputSchema } from '../output-schemas';
 
 const polling: Polling<
    AppConnectionValueForAuthProperty<typeof APITableAuth>,
@@ -52,6 +53,7 @@ export const newRecordTrigger = createTrigger({
     space_id: APITableCommon.space_id,
     datasheet_id: APITableCommon.datasheet_id,
   },
+  outputSchema: newRecordTriggerOutputSchema,
   sampleData: {
     recordId: 'rec2T5ppW1Mal',
     createdAt: 1689772153000,
diff --git a/packages/pieces/community/claude/package.json b/packages/pieces/community/claude/package.json
index 59aecb9dde72..b133e1825ae5 100644
--- a/packages/pieces/community/claude/package.json
+++ b/packages/pieces/community/claude/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@activepieces/piece-claude",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
   "dependencies": {
diff --git a/packages/pieces/community/claude/src/index.ts b/packages/pieces/community/claude/src/index.ts
index 3703a3762c06..0399909c9b2d 100644
--- a/packages/pieces/community/claude/src/index.ts
+++ b/packages/pieces/community/claude/src/index.ts
@@ -1,21 +1,39 @@
-import { PieceAuth, createPiece } from '@activepieces/pieces-framework';
+import { createPiece } from '@activepieces/pieces-framework';
 import { createCustomApiCallAction } from '@activepieces/pieces-common';
 import { askClaude } from './lib/actions/send-prompt';
 import { baseUrl } from './lib/common/common';
 import { PieceCategory } from '@activepieces/pieces-framework';
 import { extractStructuredDataAction } from './lib/actions/extract-structured-data';
+import { listModelsAction } from './lib/actions/list-models';
+import { getModelAction } from './lib/actions/get-model';
+import { createMessageBatchAction } from './lib/actions/create-message-batch';
+import { getMessageBatchAction } from './lib/actions/get-message-batch';
+import { listMessageBatchesAction } from './lib/actions/list-message-batches';
+import { cancelMessageBatchAction } from './lib/actions/cancel-message-batch';
+import { deleteMessageBatchAction } from './lib/actions/delete-message-batch';
+import { getMessageBatchResultsAction } from './lib/actions/get-message-batch-results';
+import { countTokensAction } from './lib/actions/count-tokens';
 import { claudeAuth } from './lib/auth';
 
 export const claude = createPiece({
   displayName: 'Anthropic Claude',
   auth: claudeAuth,
-  minimumSupportedRelease: '0.63.0',
+  minimumSupportedRelease: '0.87.0',
   logoUrl: 'https://cdn.activepieces.com/pieces/claude.png',
   categories: [PieceCategory.ARTIFICIAL_INTELLIGENCE],
   authors: ['dennisrongo','kishanprmr'],
   actions: [
     askClaude,
     extractStructuredDataAction,
+    listModelsAction,
+    getModelAction,
+    createMessageBatchAction,
+    getMessageBatchAction,
+    listMessageBatchesAction,
+    cancelMessageBatchAction,
+    deleteMessageBatchAction,
+    getMessageBatchResultsAction,
+    countTokensAction,
     createCustomApiCallAction({
       auth: claudeAuth,
       baseUrl: () => baseUrl,
diff --git a/packages/pieces/community/claude/src/lib/actions/cancel-message-batch.ts b/packages/pieces/community/claude/src/lib/actions/cancel-message-batch.ts
new file mode 100644
index 000000000000..0342d4e39eb7
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/cancel-message-batch.ts
@@ -0,0 +1,29 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { cancelMessageBatchActionOutputSchema } from '../output-schemas';
+
+export const cancelMessageBatchAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'cancel_message_batch',
+  classification: 'WRITE',
+  displayName: 'Cancel Message Batch',
+  description: 'Cancels an in-progress message batch. Already-completed requests in the batch are not undone.',
+  aiMetadata: {
+    description:
+      "Cancels a message batch that is still 'in_progress'. The batch moves to 'canceling' and the system finishes any non-interruptible requests already underway before finalizing; check request_counts.canceled via Get Message Batch to see how many were actually stopped. Idempotent: canceling an already-canceling or ended batch has no further effect.",
+    idempotent: true,
+  },
+  props: {
+    messageBatchId: Property.ShortText({
+      displayName: 'Message Batch ID',
+      required: true,
+    }),
+  },
+  outputSchema: cancelMessageBatchActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    return anthropic.messages.batches.cancel(context.propsValue.messageBatchId);
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/actions/count-tokens.ts b/packages/pieces/community/claude/src/lib/actions/count-tokens.ts
new file mode 100644
index 000000000000..ab747ff10112
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/count-tokens.ts
@@ -0,0 +1,39 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { modelDropdown } from '../common/common';
+import { countTokensActionOutputSchema } from '../output-schemas';
+
+export const countTokensAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'count_tokens',
+  classification: 'READ',
+  displayName: 'Count Tokens',
+  description: 'Counts how many input tokens a prompt would use for a given model, without generating a response.',
+  aiMetadata: {
+    description:
+      'Counts the input tokens a prompt and optional system prompt would use for a given Claude model, without sending it to be answered. Use to check a prompt fits a model\'s context window or to estimate cost before calling Ask Claude or Extract Structured Data. Idempotent: it only counts, it never generates.',
+    idempotent: true,
+  },
+  props: {
+    model: modelDropdown,
+    systemPrompt: Property.LongText({
+      displayName: 'System Prompt',
+      required: false,
+    }),
+    prompt: Property.LongText({
+      displayName: 'Prompt',
+      required: true,
+    }),
+  },
+  outputSchema: countTokensActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    return anthropic.messages.countTokens({
+      model: context.propsValue.model,
+      system: context.propsValue.systemPrompt,
+      messages: [{ role: 'user', content: context.propsValue.prompt }],
+    });
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/actions/create-message-batch.ts b/packages/pieces/community/claude/src/lib/actions/create-message-batch.ts
new file mode 100644
index 000000000000..565db49cc445
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/create-message-batch.ts
@@ -0,0 +1,44 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { createMessageBatchActionOutputSchema } from '../output-schemas';
+
+export const createMessageBatchAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'create_message_batch',
+  classification: 'WRITE',
+  displayName: 'Create Message Batch',
+  description: 'Submits a batch of Messages API requests to be processed asynchronously, at up to 24 hours turnaround.',
+  aiMetadata: {
+    description:
+      "Submits multiple Messages API requests as a single asynchronous batch (up to 24h to complete), cheaper than calling Ask Claude repeatedly for large volumes. Each request needs a unique custom_id and a params object shaped like the Messages API (model, messages, max_tokens, system). Poll status with Get Message Batch and read output with Get Message Batch Results once processing_status is 'ended'. Not idempotent: each call creates a new batch.",
+    idempotent: false,
+  },
+  props: {
+    requests: Property.Json({
+      displayName: 'Requests',
+      description:
+        'Array of { custom_id, params } objects. Each custom_id must be unique within the batch; each params object matches the Messages API request body (model, messages, max_tokens, system, etc).',
+      required: true,
+      defaultValue: [
+        {
+          custom_id: 'request-1',
+          params: {
+            model: 'claude-3-5-haiku-latest',
+            max_tokens: 1024,
+            messages: [{ role: 'user', content: 'Hello, Claude!' }],
+          },
+        },
+      ],
+    }),
+  },
+  outputSchema: createMessageBatchActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    return anthropic.messages.batches.create({
+      requests: context.propsValue
+        .requests as unknown as Anthropic.Messages.BatchCreateParams['requests'],
+    });
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/actions/delete-message-batch.ts b/packages/pieces/community/claude/src/lib/actions/delete-message-batch.ts
new file mode 100644
index 000000000000..b7ff42f5a3e2
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/delete-message-batch.ts
@@ -0,0 +1,29 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { deleteMessageBatchActionOutputSchema } from '../output-schemas';
+
+export const deleteMessageBatchAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'delete_message_batch',
+  classification: 'DESTRUCTIVE',
+  displayName: 'Delete Message Batch',
+  description: 'Deletes a message batch and its results. The batch must have finished processing first.',
+  aiMetadata: {
+    description:
+      "Permanently deletes a message batch, once its processing_status is 'ended' (an in-progress batch must be canceled first via Cancel Message Batch). This removes access to the batch's results. Not idempotent: deleting an already-deleted batch fails with not_found.",
+    idempotent: false,
+  },
+  props: {
+    messageBatchId: Property.ShortText({
+      displayName: 'Message Batch ID',
+      required: true,
+    }),
+  },
+  outputSchema: deleteMessageBatchActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    return anthropic.messages.batches.delete(context.propsValue.messageBatchId);
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/actions/get-message-batch-results.ts b/packages/pieces/community/claude/src/lib/actions/get-message-batch-results.ts
new file mode 100644
index 000000000000..8029df2b3bc4
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/get-message-batch-results.ts
@@ -0,0 +1,49 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { getMessageBatchResultsActionOutputSchema } from '../output-schemas';
+
+const DEFAULT_MAX_RESULTS = 100;
+
+export const getMessageBatchResultsAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'get_message_batch_results',
+  classification: 'READ',
+  displayName: 'Get Message Batch Results',
+  description: 'Reads the per-request results of a finished message batch.',
+  aiMetadata: {
+    description:
+      "Reads the results of a message batch once Get Message Batch reports processing_status 'ended', returning each request's custom_id alongside its outcome ('succeeded' with the Message, or 'errored'/'canceled'/'expired'). Results are not guaranteed to be in request order; match on custom_id. Idempotent: it only reads data.",
+    idempotent: true,
+  },
+  props: {
+    messageBatchId: Property.ShortText({
+      displayName: 'Message Batch ID',
+      required: true,
+    }),
+    maxResults: Property.Number({
+      displayName: 'Max Results',
+      description: `Maximum number of results to return (default ${DEFAULT_MAX_RESULTS}).`,
+      required: false,
+    }),
+  },
+  outputSchema: getMessageBatchResultsActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    const maxResults = context.propsValue.maxResults ?? DEFAULT_MAX_RESULTS;
+    if (!Number.isInteger(maxResults) || maxResults <= 0) {
+      throw new Error('Max Results must be a positive integer.');
+    }
+    const decoder = await anthropic.messages.batches.results(context.propsValue.messageBatchId);
+
+    const results = [];
+    for await (const result of decoder) {
+      results.push(result);
+      if (results.length >= maxResults) {
+        break;
+      }
+    }
+    return { results };
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/actions/get-message-batch.ts b/packages/pieces/community/claude/src/lib/actions/get-message-batch.ts
new file mode 100644
index 000000000000..1cc172be0334
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/get-message-batch.ts
@@ -0,0 +1,29 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { getMessageBatchActionOutputSchema } from '../output-schemas';
+
+export const getMessageBatchAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'get_message_batch',
+  classification: 'READ',
+  displayName: 'Get Message Batch',
+  description: 'Reads the status and request counts of a message batch, to poll for completion.',
+  aiMetadata: {
+    description:
+      "Reads a message batch by ID, returning its processing_status ('in_progress', 'canceling', or 'ended') and a tally of succeeded/errored/canceled/expired requests. Poll this after Create Message Batch until processing_status is 'ended', then call Get Message Batch Results. Idempotent: it only reads data.",
+    idempotent: true,
+  },
+  props: {
+    messageBatchId: Property.ShortText({
+      displayName: 'Message Batch ID',
+      required: true,
+    }),
+  },
+  outputSchema: getMessageBatchActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    return anthropic.messages.batches.retrieve(context.propsValue.messageBatchId);
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/actions/get-model.ts b/packages/pieces/community/claude/src/lib/actions/get-model.ts
new file mode 100644
index 000000000000..fb94920c5eca
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/get-model.ts
@@ -0,0 +1,30 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { getModelActionOutputSchema } from '../output-schemas';
+
+export const getModelAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'get_model',
+  classification: 'READ',
+  displayName: 'Get Model',
+  description: 'Reads details for a single Claude model, or resolves a model alias to its ID.',
+  aiMetadata: {
+    description:
+      "Reads a single Claude model by ID or alias (e.g. 'claude-3-7-sonnet-latest'), returning its resolved ID, display name, and release date. Use to confirm a model ID is valid or resolve an alias before using it elsewhere. Idempotent: it only reads data.",
+    idempotent: true,
+  },
+  props: {
+    modelId: Property.ShortText({
+      displayName: 'Model ID',
+      description: 'The model ID or alias to look up.',
+      required: true,
+    }),
+  },
+  outputSchema: getModelActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    return anthropic.models.retrieve(context.propsValue.modelId);
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/actions/list-message-batches.ts b/packages/pieces/community/claude/src/lib/actions/list-message-batches.ts
new file mode 100644
index 000000000000..63625e8593a2
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/list-message-batches.ts
@@ -0,0 +1,50 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { listMessageBatchesActionOutputSchema } from '../output-schemas';
+
+export const listMessageBatchesAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'list_message_batches',
+  classification: 'SEARCH',
+  displayName: 'List Message Batches',
+  description: 'Lists message batches, most recently created first.',
+  aiMetadata: {
+    description:
+      'Lists message batches in the workspace, most recently created first, returning each batch\'s ID and processing_status. Use to discover a batch ID before calling Get Message Batch, Get Message Batch Results, Cancel Message Batch, or Delete Message Batch. Idempotent: it only reads data.',
+    idempotent: true,
+  },
+  props: {
+    limit: Property.Number({
+      displayName: 'Limit',
+      description: 'Number of batches to return per page (default 20, max 1000).',
+      required: false,
+    }),
+    afterId: Property.ShortText({
+      displayName: 'After ID',
+      description: 'Return the page of batches immediately after this batch ID.',
+      required: false,
+    }),
+    beforeId: Property.ShortText({
+      displayName: 'Before ID',
+      description: 'Return the page of batches immediately before this batch ID.',
+      required: false,
+    }),
+  },
+  outputSchema: listMessageBatchesActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    const page = await anthropic.messages.batches.list({
+      limit: context.propsValue.limit,
+      after_id: context.propsValue.afterId,
+      before_id: context.propsValue.beforeId,
+    });
+    return {
+      data: page.data,
+      has_more: page.has_more,
+      first_id: page.first_id,
+      last_id: page.last_id,
+    };
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/actions/list-models.ts b/packages/pieces/community/claude/src/lib/actions/list-models.ts
new file mode 100644
index 000000000000..928c170e17bf
--- /dev/null
+++ b/packages/pieces/community/claude/src/lib/actions/list-models.ts
@@ -0,0 +1,28 @@
+import { createAction } from '@activepieces/pieces-framework';
+import Anthropic from '@anthropic-ai/sdk';
+import { claudeAuth } from '../auth';
+import { listModelsActionOutputSchema } from '../output-schemas';
+
+export const listModelsAction = createAction({
+  audience: 'ai',
+  auth: claudeAuth,
+  name: 'list_models',
+  classification: 'SEARCH',
+  displayName: 'List Models',
+  description: 'Lists the Claude models available to this API key.',
+  aiMetadata: {
+    description:
+      "Lists the Claude models available for use, most recently released first, returning each model's ID and display name. Use to discover a valid model ID before calling Ask Claude, Extract Structured Data, or Create Message Batch. Idempotent: it only reads data.",
+    idempotent: true,
+  },
+  props: {},
+  outputSchema: listModelsActionOutputSchema,
+  async run(context) {
+    const anthropic = new Anthropic({ apiKey: context.auth.secret_text });
+    const models = [];
+    for await (const model of anthropic.models.list({ limit: 1000 })) {
+      models.push(model);
+    }
+    return { models };
+  },
+});
diff --git a/packages/pieces/community/claude/src/lib/output-schemas.ts b/packages/pieces/community/claude/src/lib/output-schemas.ts
index 349721c9ebed..1b80e6fa3829 100644
--- a/packages/pieces/community/claude/src/lib/output-schemas.ts
+++ b/packages/pieces/community/claude/src/lib/output-schemas.ts
@@ -31,3 +31,152 @@ export const extractStructuredDataActionOutputSchema: OutputSchema = {
     },
   ],
 };
+
+const capabilitySupportFields: OutputSchema['fields'] = [
+  { key: 'supported', label: 'Supported', format: 'boolean' },
+];
+
+const modelCapabilitiesFields: OutputSchema['fields'] = [
+  { key: 'batch', label: 'Batch API', children: capabilitySupportFields },
+  { key: 'citations', label: 'Citations', children: capabilitySupportFields },
+  { key: 'code_execution', label: 'Code Execution', children: capabilitySupportFields },
+  { key: 'image_input', label: 'Image Input', children: capabilitySupportFields },
+  { key: 'pdf_input', label: 'PDF Input', children: capabilitySupportFields },
+  { key: 'structured_outputs', label: 'Structured Outputs', children: capabilitySupportFields },
+  {
+    key: 'thinking',
+    label: 'Extended Thinking',
+    children: [
+      { key: 'supported', label: 'Supported', format: 'boolean' },
+      {
+        key: 'types',
+        label: 'Types',
+        children: [
+          { key: 'adaptive', label: 'Adaptive', children: capabilitySupportFields },
+          { key: 'enabled', label: 'Enabled', children: capabilitySupportFields },
+        ],
+      },
+    ],
+  },
+];
+
+const modelFields: OutputSchema['fields'] = [
+  { key: 'id', label: 'Model ID' },
+  { key: 'display_name', label: 'Display Name' },
+  { key: 'created_at', label: 'Created At', format: 'datetime' },
+  { key: 'max_input_tokens', label: 'Max Input Tokens', format: 'number' },
+  { key: 'max_tokens', label: 'Max Output Tokens', format: 'number' },
+  { key: 'capabilities', label: 'Capabilities', children: modelCapabilitiesFields },
+];
+
+const requestCountsFields: OutputSchema['fields'] = [
+  { key: 'processing', label: 'Processing', format: 'number' },
+  { key: 'succeeded', label: 'Succeeded', format: 'number' },
+  { key: 'errored', label: 'Errored', format: 'number' },
+  { key: 'canceled', label: 'Canceled', format: 'number' },
+  { key: 'expired', label: 'Expired', format: 'number' },
+];
+
+const messageBatchFields: OutputSchema['fields'] = [
+  { key: 'id', label: 'Batch ID' },
+  { key: 'processing_status', label: 'Status' },
+  { key: 'request_counts', label: 'Request Counts', children: requestCountsFields },
+  { key: 'created_at', label: 'Created At', format: 'datetime' },
+  { key: 'expires_at', label: 'Expires At', format: 'datetime' },
+  { key: 'ended_at', label: 'Ended At', format: 'datetime' },
+  { key: 'archived_at', label: 'Archived At', format: 'datetime' },
+  { key: 'cancel_initiated_at', label: 'Cancel Initiated At', format: 'datetime' },
+  { key: 'results_url', label: 'Results URL', format: 'url' },
+];
+
+export const listModelsActionOutputSchema: OutputSchema = {
+  fields: [{ key: 'models', label: 'Models', labelKey: 'display_name', listItems: modelFields }],
+};
+
+export const getModelActionOutputSchema: OutputSchema = { fields: modelFields };
+
+export const createMessageBatchActionOutputSchema: OutputSchema = { fields: messageBatchFields };
+
+export const getMessageBatchActionOutputSchema: OutputSchema = { fields: messageBatchFields };
+
+export const listMessageBatchesActionOutputSchema: OutputSchema = {
+  fields: [
+    { key: 'data', label: 'Batches', labelKey: 'id', listItems: messageBatchFields },
+    { key: 'has_more', label: 'Has More', format: 'boolean' },
+    { key: 'first_id', label: 'First ID' },
+    { key: 'last_id', label: 'Last ID' },
+  ],
+};
+
+export const cancelMessageBatchActionOutputSchema: OutputSchema = { fields: messageBatchFields };
+
+export const deleteMessageBatchActionOutputSchema: OutputSchema = {
+  fields: [
+    { key: 'id', label: 'Batch ID' },
+    { key: 'type', label: 'Type' },
+  ],
+};
+
+export const getMessageBatchResultsActionOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'results',
+      label: 'Results',
+      labelKey: 'custom_id',
+      listItems: [
+        { key: 'custom_id', label: 'Custom ID' },
+        {
+          key: 'result',
+          label: 'Result',
+          children: [
+            { key: 'type', label: 'Type' },
+            {
+              key: 'message',
+              label: 'Message',
+              children: [
+                { key: 'id', label: 'Message ID' },
+                { key: 'model', label: 'Model' },
+                { key: 'stop_reason', label: 'Stop Reason' },
+                {
+                  key: 'content',
+                  label: 'Content',
+                  listItems: [
+                    { key: 'type', label: 'Type' },
+                    { key: 'text', label: 'Text' },
+                  ],
+                },
+                {
+                  key: 'usage',
+                  label: 'Usage',
+                  children: [
+                    { key: 'input_tokens', label: 'Input Tokens', format: 'number' },
+                    { key: 'output_tokens', label: 'Output Tokens', format: 'number' },
+                  ],
+                },
+              ],
+            },
+            {
+              key: 'error',
+              label: 'Error',
+              children: [
+                { key: 'request_id', label: 'Request ID' },
+                {
+                  key: 'error',
+                  label: 'Error',
+                  children: [
+                    { key: 'type', label: 'Type' },
+                    { key: 'message', label: 'Message' },
+                  ],
+                },
+              ],
+            },
+          ],
+        },
+      ],
+    },
+  ],
+};
+
+export const countTokensActionOutputSchema: OutputSchema = {
+  fields: [{ key: 'input_tokens', label: 'Input Tokens', format: 'number' }],
+};
diff --git a/packages/pieces/community/google-contacts/package.json b/packages/pieces/community/google-contacts/package.json
index 2f44aee72074..e5276ee66fb3 100644
--- a/packages/pieces/community/google-contacts/package.json
+++ b/packages/pieces/community/google-contacts/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@activepieces/piece-google-contacts",
-  "version": "0.5.0",
+  "version": "0.5.1",
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
   "dependencies": {
diff --git a/packages/pieces/community/google-contacts/src/i18n/translation.json b/packages/pieces/community/google-contacts/src/i18n/translation.json
index 43bc7d899141..bb6f78ba0988 100644
--- a/packages/pieces/community/google-contacts/src/i18n/translation.json
+++ b/packages/pieces/community/google-contacts/src/i18n/translation.json
@@ -3,10 +3,47 @@
   "Add Contact": "Add Contact",
   "Update Contact": "Update Contact",
   "Search Contacts": "Search Contacts",
+  "Create Contact": "Create Contact",
+  "Update Contact Fields": "Update Contact Fields",
+  "Get Contact": "Get Contact",
+  "List Contacts": "List Contacts",
+  "Delete Contact": "Delete Contact",
+  "Batch Get Contacts": "Batch Get Contacts",
+  "Batch Create Contacts": "Batch Create Contacts",
+  "Batch Update Contacts": "Batch Update Contacts",
+  "Batch Delete Contacts": "Batch Delete Contacts",
+  "Update Contact Photo": "Update Contact Photo",
+  "Delete Contact Photo": "Delete Contact Photo",
+  "List Contact Groups": "List Contact Groups",
+  "Get Contact Group": "Get Contact Group",
+  "Batch Get Contact Groups": "Batch Get Contact Groups",
+  "Create Contact Group": "Create Contact Group",
+  "Update Contact Group": "Update Contact Group",
+  "Delete Contact Group": "Delete Contact Group",
+  "Add Or Remove Contact Group Members": "Add Or Remove Contact Group Members",
   "Custom API Call": "Custom API Call",
   "Add a contact to a Google Contacts account": "Add a contact to a Google Contacts account",
   "Update a contact in Google Contacts account.": "Update a contact in Google Contacts account.",
   "Search contacts in Google Contacts account.": "Search contacts in Google Contacts account.",
+  "Create a new contact in the connected Google account.": "Create a new contact in the connected Google account.",
+  "Update only the supplied fields on an existing contact.": "Update only the supplied fields on an existing contact.",
+  "Search the connected account contacts by a plain-text query.": "Search the connected account contacts by a plain-text query.",
+  "Read a single contact by its resource name.": "Read a single contact by its resource name.",
+  "List the contacts of the connected Google account.": "List the contacts of the connected Google account.",
+  "Permanently delete a contact by its resource name.": "Permanently delete a contact by its resource name.",
+  "Read up to 200 contacts in one call by their resource names.": "Read up to 200 contacts in one call by their resource names.",
+  "Create up to 200 contacts in a single call.": "Create up to 200 contacts in a single call.",
+  "Update up to 200 contacts in a single call from full Person objects.": "Update up to 200 contacts in a single call from full Person objects.",
+  "Permanently delete up to 500 contacts in a single call.": "Permanently delete up to 500 contacts in a single call.",
+  "Set the photo of an existing contact from base64 image bytes.": "Set the photo of an existing contact from base64 image bytes.",
+  "Remove the photo of an existing contact.": "Remove the photo of an existing contact.",
+  "List every contact group of the connected Google account.": "List every contact group of the connected Google account.",
+  "Read one contact group, optionally with its member resource names.": "Read one contact group, optionally with its member resource names.",
+  "Read up to 200 contact groups in one call by their resource names.": "Read up to 200 contact groups in one call by their resource names.",
+  "Create a contact group, or return the existing one with that name.": "Create a contact group, or return the existing one with that name.",
+  "Rename an existing user-created contact group.": "Rename an existing user-created contact group.",
+  "Delete a user-created contact group.": "Delete a user-created contact group.",
+  "Add contacts to a contact group or remove them from it.": "Add contacts to a contact group or remove them from it.",
   "Make a custom API call to a specific endpoint": "Make a custom API call to a specific endpoint",
   "First Name": "First Name",
   "Middle Name": "Middle Name",
@@ -21,14 +58,29 @@
   "Query": "Query",
   "Read Mask": "Read Mask",
   "Page Size": "Page Size",
+  "Nickname": "Nickname",
+  "Email Addresses": "Email Addresses",
+  "Phone Numbers": "Phone Numbers",
+  "Notes": "Notes",
+  "Max Results": "Max Results",
+  "Resource Names": "Resource Names",
+  "Contacts": "Contacts",
+  "Photo Bytes": "Photo Bytes",
+  "Max Members": "Max Members",
+  "Group Name": "Group Name",
+  "New Group Name": "New Group Name",
+  "Also Delete Contacts": "Also Delete Contacts",
+  "Contact Group Resource Name": "Contact Group Resource Name",
+  "Contacts To Add": "Contacts To Add",
+  "Contacts To Remove": "Contacts To Remove",
   "Method": "Method",
   "Headers": "Headers",
   "Query Parameters": "Query Parameters",
   "Body Type": "Body Type",
   "Body": "Body",
-  "Response is Binary ?": "Response is Binary ?",
-  "No Error on Failure": "No Error on Failure",
-  "Timeout (in seconds)": "Timeout (in seconds)",
+  "Response is Binary": "Response is Binary",
+  "Return Error as Output": "Return Error as Output",
+  "Timeout": "Timeout",
   "Follow redirects": "Follow redirects",
   "The first name of the contact": "The first name of the contact",
   "The middle name of the contact": "The middle name of the contact",
@@ -43,8 +95,37 @@
   "The plain-text query for the request.The query is used to match prefix phrases of the fields on a person. For example, a person with name \"foo name\" matches queries such as \"f\", \"fo\", \"foo\", \"foo n\", \"nam\", etc., but not \"oo n\".": "The plain-text query for the request.The query is used to match prefix phrases of the fields on a person. For example, a person with name \"foo name\" matches queries such as \"f\", \"fo\", \"foo\", \"foo n\", \"nam\", etc., but not \"oo n\".",
   "A field mask to restrict which fields on each person are returned.": "A field mask to restrict which fields on each person are returned.",
   "The number of results to return. Maximum 30.": "The number of results to return. Maximum 30.",
+  "Array of email address strings, for example [\"ada@example.com\"]. A single address still has to be wrapped in an array.": "Array of email address strings, for example [\"ada@example.com\"]. A single address still has to be wrapped in an array.",
+  "Array of phone number strings, for example [\"+1 555 0100\"]. A single number still has to be wrapped in an array.": "Array of phone number strings, for example [\"+1 555 0100\"]. A single number still has to be wrapped in an array.",
+  "Free-text notes stored on the contact biography.": "Free-text notes stored on the contact biography.",
+  "Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts.": "Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts.",
+  "Array of email address strings, for example [\"ada@example.com\"]. Replaces every email address stored on the contact. Leave empty to keep the stored addresses.": "Array of email address strings, for example [\"ada@example.com\"]. Replaces every email address stored on the contact. Leave empty to keep the stored addresses.",
+  "Array of phone number strings, for example [\"+1 555 0100\"]. Replaces every phone number stored on the contact. Leave empty to keep the stored numbers.": "Array of phone number strings, for example [\"+1 555 0100\"]. Replaces every phone number stored on the contact. Leave empty to keep the stored numbers.",
+  "Plain-text query prefix-matched against contact fields such as name, email and phone number.": "Plain-text query prefix-matched against contact fields such as name, email and phone number.",
+  "Number of results to return, maximum 30. Defaults to 30.": "Number of results to return, maximum 30. Defaults to 30.",
+  "Maximum number of contacts to return. Defaults to 200.": "Maximum number of contacts to return. Defaults to 200.",
+  "Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts. Deletion cannot be undone.": "Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts. Deletion cannot be undone.",
+  "Up to 200 opaque contact resource names such as people/c12345, resolved with List Contacts or Search Contacts.": "Up to 200 opaque contact resource names such as people/c12345, resolved with List Contacts or Search Contacts.",
+  "Up to 200 contacts to create. Each needs at least a name, an email or a phone number.": "Up to 200 contacts to create. Each needs at least a name, an email or a phone number.",
+  "JSON array of up to 200 full Person objects taken from Batch Get Contacts, each keeping its resourceName and etag, with the fields to change edited in place.": "JSON array of up to 200 full Person objects taken from Batch Get Contacts, each keeping its resourceName and etag, with the fields to change edited in place.",
+  "Up to 500 opaque contact resource names such as people/c12345. Every listed contact is deleted permanently and cannot be restored.": "Up to 500 opaque contact resource names such as people/c12345. Every listed contact is deleted permanently and cannot be restored.",
+  "Base64-encoded JPEG, PNG or WebP image. A data URL prefix is accepted and stripped.": "Base64-encoded JPEG, PNG or WebP image. A data URL prefix is accepted and stripped.",
+  "Opaque contact group resource name such as contactGroups/abc123, or a system group like contactGroups/myContacts. Resolve it with List Contact Groups.": "Opaque contact group resource name such as contactGroups/abc123, or a system group like contactGroups/myContacts. Resolve it with List Contact Groups.",
+  "How many member resource names to return. Defaults to 0, which returns none.": "How many member resource names to return. Defaults to 0, which returns none.",
+  "Up to 200 opaque contact group resource names such as contactGroups/abc123, resolved with List Contact Groups.": "Up to 200 opaque contact group resource names such as contactGroups/abc123, resolved with List Contact Groups.",
+  "How many member resource names to return per group. Defaults to 0, which returns none.": "How many member resource names to return per group. Defaults to 0, which returns none.",
+  "Name of the contact group to find or create.": "Name of the contact group to find or create.",
+  "Opaque contact group resource name such as contactGroups/abc123. Resolve it with List Contact Groups.": "Opaque contact group resource name such as contactGroups/abc123. Resolve it with List Contact Groups.",
+  "When enabled, every contact in the group is permanently deleted as well. Leave off to remove only the group.": "When enabled, every contact in the group is permanently deleted as well. Leave off to remove only the group.",
+  "Opaque contact group resource name such as contactGroups/abc123, contactGroups/myContacts or contactGroups/starred. Resolve it with List Contact Groups.": "Opaque contact group resource name such as contactGroups/abc123, contactGroups/myContacts or contactGroups/starred. Resolve it with List Contact Groups.",
+  "Opaque contact resource names such as people/c12345 to add to the group.": "Opaque contact resource names such as people/c12345 to add to the group.",
+  "Opaque contact resource names such as people/c12345 to remove from the group.": "Opaque contact resource names such as people/c12345 to remove from the group.",
   "Authorization headers are injected automatically from your connection.": "Authorization headers are injected automatically from your connection.",
+  "Appended to the URL as ?key=value.": "Appended to the URL as ?key=value.",
   "Enable for files like PDFs, images, etc.": "Enable for files like PDFs, images, etc.",
+  "On a failed request, output the error instead of failing the step.": "On a failed request, output the error instead of failing the step.",
+  "Seconds to wait for a response. Empty: up to the flow limit (10 min).": "Seconds to wait for a response. Empty: up to the flow limit (10 min).",
+  "Follow 3xx redirects instead of returning them as the response.": "Follow 3xx redirects instead of returning them as the response.",
   "Names": "Names",
   "Job Title / Company": "Job Title / Company",
   "addresses": "addresses",
@@ -82,10 +163,6 @@
   "PUT": "PUT",
   "DELETE": "DELETE",
   "HEAD": "HEAD",
-  "None": "None",
-  "JSON": "JSON",
-  "Form Data": "Form Data",
-  "Raw": "Raw",
   "New Or Updated Contact": "New Or Updated Contact",
   "Triggers when there is a new or updated contact": "Triggers when there is a new or updated contact"
 }
\ No newline at end of file
diff --git a/packages/pieces/community/google-contacts/src/index.ts b/packages/pieces/community/google-contacts/src/index.ts
index b09affdb2cb0..67456a968b1c 100644
--- a/packages/pieces/community/google-contacts/src/index.ts
+++ b/packages/pieces/community/google-contacts/src/index.ts
@@ -1,25 +1,59 @@
 import { createCustomApiCallAction } from '@activepieces/pieces-common';
-import {
-  OAuth2PropertyValue,
-  PieceAuth,
-  createPiece,
-} from '@activepieces/pieces-framework';
+import { createPiece } from '@activepieces/pieces-framework';
 import { PieceCategory } from '@activepieces/pieces-framework';
 import { googleContactsAddContactAction } from './lib/action/create-contact';
 import { googleContactsUpdateContactAction } from './lib/action/update-contact';
 import { googleContactsSearchContactsAction } from './lib/action/search-contact';
+import { googleContactsCreateContactAction } from './lib/action/create-contact-agent';
+import { googleContactsUpdateContactFieldsAction } from './lib/action/update-contact-fields';
+import { googleContactsSearchContactsAtomicAction } from './lib/action/search-contacts';
+import { googleContactsGetContactAction } from './lib/action/get-contact';
+import { googleContactsListContactsAction } from './lib/action/list-contacts';
+import { googleContactsDeleteContactAction } from './lib/action/delete-contact';
+import { googleContactsBatchGetContactsAction } from './lib/action/batch-get-contacts';
+import { googleContactsBatchCreateContactsAction } from './lib/action/batch-create-contacts';
+import { googleContactsBatchUpdateContactsAction } from './lib/action/batch-update-contacts';
+import { googleContactsBatchDeleteContactsAction } from './lib/action/batch-delete-contacts';
+import { googleContactsUpdateContactPhotoAction } from './lib/action/update-contact-photo';
+import { googleContactsDeleteContactPhotoAction } from './lib/action/delete-contact-photo';
+import { googleContactsListContactGroupsAction } from './lib/action/list-contact-groups';
+import { googleContactsGetContactGroupAction } from './lib/action/get-contact-group';
+import { googleContactsBatchGetContactGroupsAction } from './lib/action/batch-get-contact-groups';
+import { googleContactsCreateContactGroupAction } from './lib/action/create-contact-group';
+import { googleContactsUpdateContactGroupAction } from './lib/action/update-contact-group';
+import { googleContactsDeleteContactGroupAction } from './lib/action/delete-contact-group';
+import { googleContactsModifyContactGroupMembersAction } from './lib/action/modify-contact-group-members';
 import { googleContactsCommon } from './lib/common';
 import { googleContactNewOrUpdatedContact } from './lib/trigger/new-contact';
 import { googleContactsAuth } from './lib/auth';
 
 export const googleContacts = createPiece({
-  minimumSupportedRelease: '0.30.0',
+  minimumSupportedRelease: '0.87.0',
   logoUrl: 'https://cdn.activepieces.com/pieces/google-contacts.png',
   categories: [PieceCategory.SALES_AND_CRM],
   actions: [
     googleContactsAddContactAction,
     googleContactsUpdateContactAction,
     googleContactsSearchContactsAction,
+    googleContactsCreateContactAction,
+    googleContactsUpdateContactFieldsAction,
+    googleContactsSearchContactsAtomicAction,
+    googleContactsGetContactAction,
+    googleContactsListContactsAction,
+    googleContactsDeleteContactAction,
+    googleContactsBatchGetContactsAction,
+    googleContactsBatchCreateContactsAction,
+    googleContactsBatchUpdateContactsAction,
+    googleContactsBatchDeleteContactsAction,
+    googleContactsUpdateContactPhotoAction,
+    googleContactsDeleteContactPhotoAction,
+    googleContactsListContactGroupsAction,
+    googleContactsGetContactGroupAction,
+    googleContactsBatchGetContactGroupsAction,
+    googleContactsCreateContactGroupAction,
+    googleContactsUpdateContactGroupAction,
+    googleContactsDeleteContactGroupAction,
+    googleContactsModifyContactGroupMembersAction,
     createCustomApiCallAction({
       baseUrl: () => googleContactsCommon.baseUrl,
       auth: googleContactsAuth,
diff --git a/packages/pieces/community/google-contacts/src/lib/action/batch-create-contacts.ts b/packages/pieces/community/google-contacts/src/lib/action/batch-create-contacts.ts
new file mode 100644
index 000000000000..e65065ad4e52
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/batch-create-contacts.ts
@@ -0,0 +1,134 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsPerson } from '../common/person';
+import { batchCreateContactsOutputSchema } from '../output-schemas';
+
+function optionalString({ source, key }: { source: unknown; key: string }): string | undefined {
+  const value = googleContactsApi.readString({ source, path: [key] });
+  if (value === undefined || value.trim().length === 0) {
+    return undefined;
+  }
+  return value.trim();
+}
+
+export const googleContactsBatchCreateContactsAction = createAction({
+  auth: googleContactsAuth,
+  name: 'batch_create_contacts',
+  classification: 'WRITE',
+  displayName: 'Batch Create Contacts',
+  description: 'Create up to 200 contacts in a single call.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Creates up to 200 new Google Contacts people in one call and returns the created contacts split into succeeded and failed collections. Use it instead of repeated Create Contact calls when importing a list; a whole-call success can still contain per-contact failures, so always read the failed collection. Not idempotent — every call creates new people, so a retry after a partial failure duplicates the ones that already succeeded.',
+    idempotent: false,
+  },
+  outputSchema: batchCreateContactsOutputSchema,
+  props: {
+    contacts: Property.Array({
+      displayName: 'Contacts',
+      description: 'Up to 200 contacts to create. Each needs at least a name, an email or a phone number.',
+      required: true,
+      properties: {
+        firstName: Property.ShortText({ displayName: 'First Name', required: false }),
+        middleName: Property.ShortText({ displayName: 'Middle Name', required: false }),
+        lastName: Property.ShortText({ displayName: 'Last Name', required: false }),
+        email: Property.ShortText({ displayName: 'Email Address', required: false }),
+        phoneNumber: Property.ShortText({ displayName: 'Phone Number', required: false }),
+        company: Property.ShortText({ displayName: 'Company', required: false }),
+        jobTitle: Property.ShortText({ displayName: 'Job Title', required: false }),
+      },
+    }),
+  },
+  async run(context) {
+    const entries = context.propsValue.contacts;
+    if (!Array.isArray(entries) || entries.length === 0) {
+      throw new Error('Contacts must contain at least one entry.');
+    }
+    if (entries.length > 200) {
+      throw new Error(
+        `Contacts accepts at most 200 entries, received ${entries.length}.`
+      );
+    }
+    const people = entries.map((entry, index) => {
+      const email = optionalString({ source: entry, key: 'email' });
+      const phoneNumber = optionalString({ source: entry, key: 'phoneNumber' });
+      const { person, fields } = googleContactsPerson.buildPerson({
+        input: {
+          firstName: optionalString({ source: entry, key: 'firstName' }),
+          middleName: optionalString({ source: entry, key: 'middleName' }),
+          lastName: optionalString({ source: entry, key: 'lastName' }),
+          emails: email === undefined ? [] : [email],
+          phoneNumbers: phoneNumber === undefined ? [] : [phoneNumber],
+          company: optionalString({ source: entry, key: 'company' }),
+          jobTitle: optionalString({ source: entry, key: 'jobTitle' }),
+        },
+      });
+      if (fields.length === 0) {
+        throw new Error(
+          `Contact ${index + 1} needs at least one of first name, last name, email address or phone number.`
+        );
+      }
+      return { contactPerson: person };
+    });
+    let response: Record<string, unknown>;
+    try {
+      response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.POST,
+        path: '/people:batchCreateContacts',
+        body: {
+          contacts: people,
+          readMask: googleContactsApi.contactReadMask.join(','),
+        },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Batch Create Contacts',
+      });
+    }
+    const created = googleContactsApi.readArray({
+      source: response,
+      path: ['createdPeople'],
+    });
+    const succeeded = created
+      .map((item, index) => ({ item, index }))
+      .filter((entry) => !googleContactsApi.isFailedItem({ response: entry.item }))
+      .map((entry) => {
+        const payload = googleContactsApi.readValue({
+          source: entry.item,
+          path: ['person'],
+        });
+        return {
+          requestIndex: entry.index + 1,
+          resourceName: googleContactsApi.readString({
+            source: payload,
+            path: ['resourceName'],
+          }),
+          contact: googleContactsPerson.summarizePerson({ person: payload }),
+        };
+      });
+    const failed = created
+      .map((item, index) => ({ item, index }))
+      .filter((entry) => googleContactsApi.isFailedItem({ response: entry.item }))
+      .map((entry) => ({
+        requestIndex: entry.index + 1,
+        status: googleContactsApi.describeStatus({
+          status: googleContactsApi.readValue({
+            source: entry.item,
+            path: ['status'],
+          }),
+        }),
+      }));
+    return {
+      succeeded,
+      failed,
+      succeededCount: succeeded.length,
+      failedCount: failed.length,
+      requestedCount: people.length,
+    };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/batch-delete-contacts.ts b/packages/pieces/community/google-contacts/src/lib/action/batch-delete-contacts.ts
new file mode 100644
index 000000000000..28d9d7cbf721
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/batch-delete-contacts.ts
@@ -0,0 +1,53 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { batchDeleteContactsOutputSchema } from '../output-schemas';
+
+export const googleContactsBatchDeleteContactsAction = createAction({
+  auth: googleContactsAuth,
+  name: 'batch_delete_contacts',
+  classification: 'DESTRUCTIVE',
+  displayName: 'Batch Delete Contacts',
+  description: 'Permanently delete up to 500 contacts in a single call.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Permanently deletes up to 500 Google Contacts people in one call from a list of opaque resourceNames. Irreversible and unrecoverable — the People API has no trash and there is no per-contact confirmation in the response, so verify every resourceName with Batch Get Contacts or List Contacts before calling and prefer Delete Contact when removing a single person. Not idempotent: a repeat call fails on contacts that are already gone.',
+    idempotent: false,
+  },
+  outputSchema: batchDeleteContactsOutputSchema,
+  props: {
+    resourceNames: Property.Array({
+      displayName: 'Resource Names',
+      description:
+        'Up to 500 opaque contact resource names such as people/c12345. Every listed contact is deleted permanently and cannot be restored.',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const resourceNames = googleContactsApi.toStringList({
+      value: context.propsValue.resourceNames,
+      label: 'Resource Names',
+    });
+    googleContactsApi.assertBatchSize({
+      values: resourceNames,
+      max: 500,
+      label: 'Resource Names',
+    });
+    try {
+      await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.POST,
+        path: '/people:batchDeleteContacts',
+        body: { resourceNames },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Batch Delete Contacts',
+      });
+    }
+    return { deleted: true, resourceNames, count: resourceNames.length };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/batch-get-contact-groups.ts b/packages/pieces/community/google-contacts/src/lib/action/batch-get-contact-groups.ts
new file mode 100644
index 000000000000..1cc3880c57d2
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/batch-get-contact-groups.ts
@@ -0,0 +1,89 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsGroup } from '../common/contact-group';
+import { batchGetContactGroupsOutputSchema } from '../output-schemas';
+
+export const googleContactsBatchGetContactGroupsAction = createAction({
+  auth: googleContactsAuth,
+  name: 'batch_get_contact_groups',
+  classification: 'READ',
+  displayName: 'Batch Get Contact Groups',
+  description: 'Read up to 200 contact groups in one call by their resource names.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Reads up to 200 Google Contacts groups in one call from a list of opaque resourceNames, returning succeeded and failed collections. Use it instead of repeated Get Contact Group calls; a whole-call success can still contain per-group failures, so always read the failed collection. Resolve the resource names with List Contact Groups. Read-only and safe to retry.',
+    idempotent: true,
+  },
+  outputSchema: batchGetContactGroupsOutputSchema,
+  props: {
+    resourceNames: Property.Array({
+      displayName: 'Resource Names',
+      description:
+        'Up to 200 opaque contact group resource names such as contactGroups/abc123, resolved with List Contact Groups.',
+      required: true,
+    }),
+    maxMembers: Property.Number({
+      displayName: 'Max Members',
+      description:
+        'How many member resource names to return per group. Defaults to 0, which returns none.',
+      required: false,
+    }),
+  },
+  async run(context) {
+    const resourceNames = googleContactsApi.toStringList({
+      value: context.propsValue.resourceNames,
+      label: 'Resource Names',
+    });
+    googleContactsApi.assertBatchSize({
+      values: resourceNames,
+      max: 200,
+      label: 'Resource Names',
+    });
+    const maxMembers = Math.max(0, context.propsValue.maxMembers ?? 0);
+    let response: Record<string, unknown>;
+    try {
+      response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.GET,
+        path: '/contactGroups:batchGet',
+        queryParams: {
+          groupFields: googleContactsApi.contactGroupFields.join(','),
+          maxMembers: String(maxMembers),
+        },
+        repeatedQueryParams: { resourceNames },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Batch Get Contact Groups',
+      });
+    }
+    const items = googleContactsApi
+      .readArray({ source: response, path: ['responses'] })
+      .map((item, index) => ({
+        resourceName:
+          googleContactsApi.readString({
+            source: item,
+            path: ['requestedResourceName'],
+          }) ??
+          resourceNames[index] ??
+          '',
+        response: item,
+      }));
+    const { succeeded, failed } = googleContactsApi.splitItemResponses({
+      items,
+      payloadKey: 'contactGroup',
+    });
+    return {
+      succeeded: succeeded.map((item) =>
+        googleContactsGroup.summarizeGroup({ group: item.payload })
+      ),
+      failed,
+      succeededCount: succeeded.length,
+      failedCount: failed.length,
+    };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/batch-get-contacts.ts b/packages/pieces/community/google-contacts/src/lib/action/batch-get-contacts.ts
new file mode 100644
index 000000000000..4d22c62e2a9d
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/batch-get-contacts.ts
@@ -0,0 +1,83 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsPerson } from '../common/person';
+import { batchGetContactsOutputSchema } from '../output-schemas';
+
+export const googleContactsBatchGetContactsAction = createAction({
+  auth: googleContactsAuth,
+  name: 'batch_get_contacts',
+  classification: 'READ',
+  displayName: 'Batch Get Contacts',
+  description: 'Read up to 200 contacts in one call by their resource names.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Reads up to 200 Google Contacts people in one call from a list of opaque resourceNames and returns each full contact with its current etag, split into succeeded and failed collections. Use it instead of repeated Get Contact calls, and as the input source for Batch Update Contacts. A whole-call success can still contain per-contact failures, so always read the failed collection. Read-only and safe to retry.',
+    idempotent: true,
+  },
+  outputSchema: batchGetContactsOutputSchema,
+  props: {
+    resourceNames: Property.Array({
+      displayName: 'Resource Names',
+      description:
+        'Up to 200 opaque contact resource names such as people/c12345, resolved with List Contacts or Search Contacts.',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const resourceNames = googleContactsApi.toStringList({
+      value: context.propsValue.resourceNames,
+      label: 'Resource Names',
+    });
+    googleContactsApi.assertBatchSize({
+      values: resourceNames,
+      max: 200,
+      label: 'Resource Names',
+    });
+    let response: Record<string, unknown>;
+    try {
+      response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.GET,
+        path: '/people:batchGet',
+        queryParams: {
+          personFields: googleContactsApi.contactReadMask.join(','),
+        },
+        repeatedQueryParams: { resourceNames },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Batch Get Contacts',
+      });
+    }
+    const items = googleContactsApi
+      .readArray({ source: response, path: ['responses'] })
+      .map((item, index) => ({
+        resourceName:
+          googleContactsApi.readString({
+            source: item,
+            path: ['requestedResourceName'],
+          }) ??
+          resourceNames[index] ??
+          '',
+        response: item,
+      }));
+    const { succeeded, failed } = googleContactsApi.splitItemResponses({
+      items,
+      payloadKey: 'person',
+    });
+    return {
+      succeeded: succeeded.map((item) => ({
+        resourceName: item.resourceName,
+        contact: googleContactsPerson.summarizePerson({ person: item.payload }),
+        person: item.payload,
+      })),
+      failed,
+      succeededCount: succeeded.length,
+      failedCount: failed.length,
+    };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/batch-update-contacts.ts b/packages/pieces/community/google-contacts/src/lib/action/batch-update-contacts.ts
new file mode 100644
index 000000000000..77f6f88b634a
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/batch-update-contacts.ts
@@ -0,0 +1,167 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsPerson } from '../common/person';
+import { batchUpdateContactsOutputSchema } from '../output-schemas';
+
+function toPerson({ entry, index }: { entry: unknown; index: number }): {
+  resourceName: string;
+  person: Record<string, unknown>;
+  fields: string[];
+} {
+  const record = googleContactsApi.readRecord({ source: entry, path: [] });
+  if (record === undefined) {
+    throw new Error(`Contact ${index + 1} must be a Person object.`);
+  }
+  const resourceName = googleContactsApi.readString({
+    source: record,
+    path: ['resourceName'],
+  });
+  const etag = googleContactsApi.readString({ source: record, path: ['etag'] });
+  if (resourceName === undefined || etag === undefined) {
+    throw new Error(
+      `Contact ${index + 1} must carry both resourceName and etag exactly as returned by Batch Get Contacts.`
+    );
+  }
+  const fields = Object.keys(record).filter((key) =>
+    googleContactsApi.updatablePersonFields.includes(key)
+  );
+  const person = Object.fromEntries(
+    Object.entries(record).filter(
+      ([key]) =>
+        key === 'etag' ||
+        key === 'resourceName' ||
+        googleContactsApi.updatablePersonFields.includes(key)
+    )
+  );
+  return { resourceName, person, fields };
+}
+
+function groupBySignature({
+  parsed,
+}: {
+  parsed: { resourceName: string; person: Record<string, unknown>; fields: string[] }[];
+}): { updateMask: string; contacts: Record<string, Record<string, unknown>> }[] {
+  const groups = new Map<string, Record<string, Record<string, unknown>>>();
+  for (const item of parsed) {
+    const signature = [...item.fields].sort().join(',');
+    const existing = groups.get(signature);
+    if (existing === undefined) {
+      groups.set(signature, { [item.resourceName]: item.person });
+    } else {
+      existing[item.resourceName] = item.person;
+    }
+  }
+  return [...groups.entries()].map(([updateMask, contacts]) => ({
+    updateMask,
+    contacts,
+  }));
+}
+
+export const googleContactsBatchUpdateContactsAction = createAction({
+  auth: googleContactsAuth,
+  name: 'batch_update_contacts',
+  classification: 'WRITE',
+  displayName: 'Batch Update Contacts',
+  description: 'Update up to 200 contacts in a single call from full Person objects.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Updates up to 200 Google Contacts people in one call. Feed it the full Person objects returned by Batch Get Contacts, each still carrying its own resourceName and etag, with the values you want changed edited in place. The people are grouped by which field groups they carry and one request is issued per group, so a person carrying only a phone number and a person carrying only an email can be updated together; each request uses the field mask of its own group. Within a group the mask is applied to every person in it, so never hand-build partial Person objects here — a group a person no longer carries is erased on that person. Prefer Update Contact Fields for a single contact. Because the work is split across requests, this action can partially apply: one group can be written while another is rejected outright. It therefore does not throw when a request fails — it records every contact in that request under failed and carries on. Never treat a returned result as wholesale success and never assume an absent error means everything applied; always read failed and failedCount, which also cover per-contact rejections such as stale etags. Every submitted person must carry at least one updatable field group. Before retrying, re-read the people so the already-updated ones carry fresh etags.',
+    idempotent: true,
+  },
+  outputSchema: batchUpdateContactsOutputSchema,
+  props: {
+    contacts: Property.Json({
+      displayName: 'Contacts',
+      description:
+        'JSON array of up to 200 full Person objects taken from Batch Get Contacts, each keeping its resourceName and etag, with the fields to change edited in place.',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const entries = context.propsValue.contacts;
+    if (!Array.isArray(entries) || entries.length === 0) {
+      throw new Error(
+        'Contacts must be a JSON array holding at least one Person object.'
+      );
+    }
+    if (entries.length > 200) {
+      throw new Error(
+        `Contacts accepts at most 200 entries, received ${entries.length}.`
+      );
+    }
+    const parsed = entries.map((entry, index) => toPerson({ entry, index }));
+    const withoutGroups = parsed
+      .filter((item) => item.fields.length === 0)
+      .map((item) => item.resourceName);
+    if (withoutGroups.length > 0) {
+      throw new Error(
+        `Every submitted person must carry at least one updatable field group, because a person with no group has nothing to update. These people carry none: ${withoutGroups.join(
+          ', '
+        )}.`
+      );
+    }
+    const groups = groupBySignature({ parsed });
+    const succeeded: { resourceName: string; contact: Record<string, unknown>; person: unknown }[] =
+      [];
+    const failed: { resourceName: string; status: string; updateMask: string }[] = [];
+    for (const group of groups) {
+      let response: Record<string, unknown>;
+      try {
+        response = await googleContactsApi.sendRequest({
+          accessToken: context.auth.access_token,
+          method: HttpMethod.POST,
+          path: '/people:batchUpdateContacts',
+          body: {
+            contacts: group.contacts,
+            updateMask: group.updateMask,
+            readMask: googleContactsApi.contactReadMask.join(','),
+          },
+        });
+      } catch (error) {
+        const status = googleContactsApi.toApiError({
+          error,
+          operation: `Batch Update Contacts (field mask ${group.updateMask})`,
+        }).message;
+        for (const resourceName of Object.keys(group.contacts)) {
+          failed.push({ resourceName, status, updateMask: group.updateMask });
+        }
+        continue;
+      }
+      const updateResult = googleContactsApi.readRecord({
+        source: response,
+        path: ['updateResult'],
+      });
+      const items = Object.entries(updateResult ?? {}).map(
+        ([resourceName, value]) => ({ resourceName, response: value })
+      );
+      const split = googleContactsApi.splitItemResponses({
+        items,
+        payloadKey: 'person',
+      });
+      for (const item of split.succeeded) {
+        succeeded.push({
+          resourceName: item.resourceName,
+          contact: googleContactsPerson.summarizePerson({ person: item.payload }),
+          person: item.payload,
+        });
+      }
+      for (const item of split.failed) {
+        failed.push({
+          resourceName: item.resourceName,
+          status: item.status,
+          updateMask: group.updateMask,
+        });
+      }
+    }
+    return {
+      succeeded,
+      failed,
+      succeededCount: succeeded.length,
+      failedCount: failed.length,
+      updateMasks: groups.map((group) => group.updateMask),
+    };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/create-contact-agent.ts b/packages/pieces/community/google-contacts/src/lib/action/create-contact-agent.ts
new file mode 100644
index 000000000000..6feaa42c31f7
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/create-contact-agent.ts
@@ -0,0 +1,105 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsPerson } from '../common/person';
+import { createContactOutputSchema } from '../output-schemas';
+
+export const googleContactsCreateContactAction = createAction({
+  auth: googleContactsAuth,
+  name: 'create_contact',
+  classification: 'WRITE',
+  displayName: 'Create Contact',
+  description: 'Create a new contact in the connected Google account.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Creates one new person in the connected Google Contacts account from name, nickname, email, phone, organization and notes fields. Supply at least one of name, email or phone; email addresses and phone numbers are arrays of strings, so pass ["ada@example.com"] rather than a bare string. Use Batch Create Contacts for many at once, and Update Contact Fields to change someone who already exists. Not idempotent — every call creates a separate person, so check with Search Contacts first if duplicates matter.',
+    idempotent: false,
+  },
+  outputSchema: createContactOutputSchema,
+  props: {
+    firstName: Property.ShortText({
+      displayName: 'First Name',
+      required: false,
+    }),
+    middleName: Property.ShortText({
+      displayName: 'Middle Name',
+      required: false,
+    }),
+    lastName: Property.ShortText({
+      displayName: 'Last Name',
+      required: false,
+    }),
+    nickname: Property.ShortText({
+      displayName: 'Nickname',
+      required: false,
+    }),
+    emails: Property.Array({
+      displayName: 'Email Addresses',
+      description:
+        'Array of email address strings, for example ["ada@example.com"]. A single address still has to be wrapped in an array.',
+      required: false,
+    }),
+    phoneNumbers: Property.Array({
+      displayName: 'Phone Numbers',
+      description:
+        'Array of phone number strings, for example ["+1 555 0100"]. A single number still has to be wrapped in an array.',
+      required: false,
+    }),
+    company: Property.ShortText({
+      displayName: 'Company',
+      required: false,
+    }),
+    jobTitle: Property.ShortText({
+      displayName: 'Job Title',
+      required: false,
+    }),
+    biography: Property.LongText({
+      displayName: 'Notes',
+      description: 'Free-text notes stored on the contact biography.',
+      required: false,
+    }),
+  },
+  async run(context) {
+    const emails = googleContactsApi.toStringList({
+      value: context.propsValue.emails,
+      label: 'Email Addresses',
+    });
+    const phoneNumbers = googleContactsApi.toStringList({
+      value: context.propsValue.phoneNumbers,
+      label: 'Phone Numbers',
+    });
+    const { person, fields } = googleContactsPerson.buildPerson({
+      input: {
+        firstName: context.propsValue.firstName,
+        middleName: context.propsValue.middleName,
+        lastName: context.propsValue.lastName,
+        nickname: context.propsValue.nickname,
+        emails,
+        phoneNumbers,
+        company: context.propsValue.company,
+        jobTitle: context.propsValue.jobTitle,
+        biography: context.propsValue.biography,
+      },
+    });
+    if (fields.length === 0) {
+      throw new Error(
+        'Create Contact needs at least one of first name, last name, email address or phone number.'
+      );
+    }
+    try {
+      return await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.POST,
+        path: '/people:createContact',
+        queryParams: {
+          personFields: googleContactsApi.contactReadMask.join(','),
+        },
+        body: person,
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({ error, operation: 'Create Contact' });
+    }
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/create-contact-group.ts b/packages/pieces/community/google-contacts/src/lib/action/create-contact-group.ts
new file mode 100644
index 000000000000..3b10fa42f0cf
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/create-contact-group.ts
@@ -0,0 +1,120 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsGroup } from '../common/contact-group';
+import { createContactGroupOutputSchema } from '../output-schemas';
+
+const maxPages = 10;
+
+async function findGroupByName({
+  accessToken,
+  name,
+}: {
+  accessToken: string;
+  name: string;
+}): Promise<unknown | undefined> {
+  let pageToken: string | undefined = undefined;
+  for (let page = 0; page < maxPages; page++) {
+    const response: Record<string, unknown> = await googleContactsApi.sendRequest({
+      accessToken,
+      method: HttpMethod.GET,
+      path: '/contactGroups',
+      queryParams: {
+        groupFields: googleContactsApi.contactGroupFields.join(','),
+        pageSize: '1000',
+        pageToken,
+      },
+    });
+    const match = googleContactsApi
+      .readArray({ source: response, path: ['contactGroups'] })
+      .find((group) => googleContactsGroup.matchesName({ group, name }));
+    if (match !== undefined) {
+      return match;
+    }
+    pageToken = googleContactsApi.readString({
+      source: response,
+      path: ['nextPageToken'],
+    });
+    if (pageToken === undefined) {
+      return undefined;
+    }
+  }
+  return undefined;
+}
+
+export const googleContactsCreateContactGroupAction = createAction({
+  auth: googleContactsAuth,
+  name: 'create_contact_group',
+  classification: 'WRITE',
+  displayName: 'Create Contact Group',
+  description: 'Create a contact group, or return the existing one with that name.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Creates a contact group (label) with the given name in the connected Google account, or returns the existing group when one already carries that name, reporting which happened through the created flag. Use it before Add Or Remove Contact Group Members when the target group may not exist yet. Safe to retry: the lookup runs first and a duplicate-name rejection is resolved by returning the existing group.',
+    idempotent: true,
+  },
+  outputSchema: createContactGroupOutputSchema,
+  props: {
+    name: Property.ShortText({
+      displayName: 'Group Name',
+      description: 'Name of the contact group to find or create.',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const name = context.propsValue.name.trim();
+    if (name.length === 0) {
+      throw new Error('Group Name must not be empty.');
+    }
+    const accessToken = context.auth.access_token;
+    try {
+      const existing = await findGroupByName({ accessToken, name });
+      if (existing !== undefined) {
+        return {
+          created: false,
+          contactGroup: googleContactsGroup.summarizeGroup({ group: existing }),
+        };
+      }
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Create Contact Group (looking up existing groups)',
+      });
+    }
+    try {
+      const response = await googleContactsApi.sendRequest({
+        accessToken,
+        method: HttpMethod.POST,
+        path: '/contactGroups',
+        body: {
+          contactGroup: { name },
+          readGroupFields: googleContactsApi.contactGroupFields.join(','),
+        },
+      });
+      return {
+        created: true,
+        contactGroup: googleContactsGroup.summarizeGroup({ group: response }),
+      };
+    } catch (error) {
+      if (!googleContactsApi.isConflict({ error })) {
+        throw googleContactsApi.toApiError({
+          error,
+          operation: 'Create Contact Group',
+        });
+      }
+      const raced = await findGroupByName({ accessToken, name });
+      if (raced === undefined) {
+        throw googleContactsApi.toApiError({
+          error,
+          operation: 'Create Contact Group',
+        });
+      }
+      return {
+        created: false,
+        contactGroup: googleContactsGroup.summarizeGroup({ group: raced }),
+      };
+    }
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/create-contact.ts b/packages/pieces/community/google-contacts/src/lib/action/create-contact.ts
index f18f304643da..58d8d2cae24c 100644
--- a/packages/pieces/community/google-contacts/src/lib/action/create-contact.ts
+++ b/packages/pieces/community/google-contacts/src/lib/action/create-contact.ts
@@ -14,7 +14,7 @@ export const googleContactsAddContactAction = createAction({
   name: 'add_contact',
   classification: 'WRITE',
   description: 'Add a contact to a Google Contacts account',
-  audience: 'both',
+  audience: 'human',
   aiMetadata: { description: 'Creates a new person in the authenticated Google Contacts account from name, email, phone, company, and job title fields. Use when an agent needs to add someone to address book contacts; first and last name are required. Not idempotent — each call creates a separate contact even with identical input, so guard against duplicates.', idempotent: false },
   displayName: 'Add Contact',
   outputSchema: addContactOutputSchema,
diff --git a/packages/pieces/community/google-contacts/src/lib/action/delete-contact-group.ts b/packages/pieces/community/google-contacts/src/lib/action/delete-contact-group.ts
new file mode 100644
index 000000000000..fbad577734bd
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/delete-contact-group.ts
@@ -0,0 +1,53 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { deleteContactGroupOutputSchema } from '../output-schemas';
+
+export const googleContactsDeleteContactGroupAction = createAction({
+  auth: googleContactsAuth,
+  name: 'delete_contact_group',
+  classification: 'DESTRUCTIVE',
+  displayName: 'Delete Contact Group',
+  description: 'Delete a user-created contact group.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Deletes one user-created Google Contacts group by its opaque resourceName (contactGroups/{id}). By default only the group is removed and its members stay in the address book; turning on Delete Contacts also permanently deletes every contact in the group, which cannot be undone. Resolve the resourceName with List Contact Groups; Google-managed system groups cannot be deleted. Not idempotent: a repeat call fails because the group is already gone.',
+    idempotent: false,
+  },
+  outputSchema: deleteContactGroupOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Resource Name',
+      description:
+        'Opaque contact group resource name such as contactGroups/abc123. Resolve it with List Contact Groups.',
+      required: true,
+    }),
+    deleteContacts: Property.Checkbox({
+      displayName: 'Also Delete Contacts',
+      description:
+        'When enabled, every contact in the group is permanently deleted as well. Leave off to remove only the group.',
+      required: false,
+      defaultValue: false,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    const deleteContacts = context.propsValue.deleteContacts === true;
+    try {
+      await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.DELETE,
+        path: `/${resourceName}`,
+        queryParams: { deleteContacts: String(deleteContacts) },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Delete Contact Group',
+      });
+    }
+    return { deleted: true, resourceName, deletedContacts: deleteContacts };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/delete-contact-photo.ts b/packages/pieces/community/google-contacts/src/lib/action/delete-contact-photo.ts
new file mode 100644
index 000000000000..78d48714a3e0
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/delete-contact-photo.ts
@@ -0,0 +1,57 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { deleteContactPhotoOutputSchema } from '../output-schemas';
+
+export const googleContactsDeleteContactPhotoAction = createAction({
+  auth: googleContactsAuth,
+  name: 'delete_contact_photo',
+  classification: 'WRITE',
+  displayName: 'Delete Contact Photo',
+  description: 'Remove the photo of an existing contact.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Removes the photo from one Google Contacts person, leaving the rest of the contact untouched. Supply the opaque resourceName from List Contacts or Search Contacts; use Update Contact Photo to set a new image instead. The removed image is not recoverable through this API.',
+    idempotent: false,
+  },
+  outputSchema: deleteContactPhotoOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Resource Name',
+      description:
+        'Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts.',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    let response: Record<string, unknown>;
+    try {
+      response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.DELETE,
+        path: `/${resourceName}:deleteContactPhoto`,
+        queryParams: {
+          personFields: googleContactsApi.contactReadMask.join(','),
+        },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Delete Contact Photo',
+      });
+    }
+    const person = googleContactsApi.readRecord({
+      source: response,
+      path: ['person'],
+    });
+    if (person === undefined) {
+      throw new Error(
+        'Delete Contact Photo could not read the updated contact back from Google Contacts; re-read the contact with Get Contact to confirm the photo was removed.'
+      );
+    }
+    return person;
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/delete-contact.ts b/packages/pieces/community/google-contacts/src/lib/action/delete-contact.ts
new file mode 100644
index 000000000000..2c2a325b7923
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/delete-contact.ts
@@ -0,0 +1,41 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { deleteContactOutputSchema } from '../output-schemas';
+
+export const googleContactsDeleteContactAction = createAction({
+  auth: googleContactsAuth,
+  name: 'delete_contact',
+  classification: 'DESTRUCTIVE',
+  displayName: 'Delete Contact',
+  description: 'Permanently delete a contact by its resource name.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Permanently deletes one Google Contacts person by its opaque resourceName (people/{id}). Irreversible — the People API has no trash, so confirm the contact with Get Contact or List Contacts first; use Batch Delete Contacts for many at once. Not idempotent: a repeat call fails because the contact is already gone.',
+    idempotent: false,
+  },
+  outputSchema: deleteContactOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Resource Name',
+      description:
+        'Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts. Deletion cannot be undone.',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    try {
+      await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.DELETE,
+        path: `/${resourceName}:deleteContact`,
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({ error, operation: 'Delete Contact' });
+    }
+    return { deleted: true, resourceName };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/get-contact-group.ts b/packages/pieces/community/google-contacts/src/lib/action/get-contact-group.ts
new file mode 100644
index 000000000000..be536800981a
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/get-contact-group.ts
@@ -0,0 +1,56 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsGroup } from '../common/contact-group';
+import { getContactGroupOutputSchema } from '../output-schemas';
+
+export const googleContactsGetContactGroupAction = createAction({
+  auth: googleContactsAuth,
+  name: 'get_contact_group',
+  classification: 'READ',
+  displayName: 'Get Contact Group',
+  description: 'Read one contact group, optionally with its member resource names.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Reads one Google Contacts group by its opaque resourceName (contactGroups/{id}) and returns its name, type, member count and, when Max Members is above zero, the resource names of its members. Resolve the resourceName with List Contact Groups; use Batch Get Contact Groups for several groups. Read-only and safe to retry.',
+    idempotent: true,
+  },
+  outputSchema: getContactGroupOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Resource Name',
+      description:
+        'Opaque contact group resource name such as contactGroups/abc123, or a system group like contactGroups/myContacts. Resolve it with List Contact Groups.',
+      required: true,
+    }),
+    maxMembers: Property.Number({
+      displayName: 'Max Members',
+      description:
+        'How many member resource names to return. Defaults to 0, which returns none.',
+      required: false,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    const maxMembers = Math.max(0, context.propsValue.maxMembers ?? 0);
+    try {
+      const response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.GET,
+        path: `/${resourceName}`,
+        queryParams: {
+          groupFields: googleContactsApi.contactGroupFields.join(','),
+          maxMembers: String(maxMembers),
+        },
+      });
+      return googleContactsGroup.summarizeGroup({ group: response });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Get Contact Group',
+      });
+    }
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/get-contact.ts b/packages/pieces/community/google-contacts/src/lib/action/get-contact.ts
new file mode 100644
index 000000000000..2558df57c15d
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/get-contact.ts
@@ -0,0 +1,43 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { getContactOutputSchema } from '../output-schemas';
+
+export const googleContactsGetContactAction = createAction({
+  auth: googleContactsAuth,
+  name: 'get_contact',
+  classification: 'READ',
+  displayName: 'Get Contact',
+  description: 'Read a single contact by its resource name.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Reads one Google Contacts person by its opaque resourceName (people/{id}) and returns names, emails, phone numbers, organizations, memberships and the current etag. Obtain the resourceName from List Contacts or Search Contacts; do not construct or parse it. Use Batch Get Contacts for more than one contact. Read-only and safe to retry.',
+    idempotent: true,
+  },
+  outputSchema: getContactOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Resource Name',
+      description:
+        'Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts.',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    try {
+      return await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.GET,
+        path: `/${resourceName}`,
+        queryParams: {
+          personFields: googleContactsApi.contactReadMask.join(','),
+        },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({ error, operation: 'Get Contact' });
+    }
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/list-contact-groups.ts b/packages/pieces/community/google-contacts/src/lib/action/list-contact-groups.ts
new file mode 100644
index 000000000000..e5c2a68475b7
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/list-contact-groups.ts
@@ -0,0 +1,66 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsGroup } from '../common/contact-group';
+import { listContactGroupsOutputSchema } from '../output-schemas';
+
+const maxPages = 10;
+
+export const googleContactsListContactGroupsAction = createAction({
+  auth: googleContactsAuth,
+  name: 'list_contact_groups',
+  classification: 'SEARCH',
+  displayName: 'List Contact Groups',
+  description: 'List every contact group of the connected Google account.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Lists the contact groups (labels) of the connected Google account with the opaque resourceName, name, type and member count of each. Use it to resolve a group name to its resourceName before Get Contact Group, Update Contact Group, Delete Contact Group or Add Or Remove Contact Group Members. Member resource names are not included here — read a single group with Get Contact Group for those. Read-only and safe to retry.',
+    idempotent: true,
+  },
+  outputSchema: listContactGroupsOutputSchema,
+  props: {},
+  async run(context) {
+    const groups: Record<string, unknown>[] = [];
+    let pageToken: string | undefined = undefined;
+    try {
+      for (let page = 0; page < maxPages; page++) {
+        const response: Record<string, unknown> =
+          await googleContactsApi.sendRequest({
+            accessToken: context.auth.access_token,
+            method: HttpMethod.GET,
+            path: '/contactGroups',
+            queryParams: {
+              groupFields: googleContactsApi.contactGroupFields.join(','),
+              pageSize: '1000',
+              pageToken,
+            },
+          });
+        for (const group of googleContactsApi.readArray({
+          source: response,
+          path: ['contactGroups'],
+        })) {
+          groups.push(googleContactsGroup.summarizeGroup({ group }));
+        }
+        pageToken = googleContactsApi.readString({
+          source: response,
+          path: ['nextPageToken'],
+        });
+        if (pageToken === undefined) {
+          break;
+        }
+      }
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'List Contact Groups',
+      });
+    }
+    return {
+      contactGroups: groups,
+      count: groups.length,
+      hasMore: pageToken !== undefined,
+    };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/list-contacts.ts b/packages/pieces/community/google-contacts/src/lib/action/list-contacts.ts
new file mode 100644
index 000000000000..fec807de8646
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/list-contacts.ts
@@ -0,0 +1,73 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsPerson } from '../common/person';
+import { listContactsOutputSchema } from '../output-schemas';
+
+const maxPages = 10;
+
+export const googleContactsListContactsAction = createAction({
+  auth: googleContactsAuth,
+  name: 'list_contacts',
+  classification: 'SEARCH',
+  displayName: 'List Contacts',
+  description: 'List the contacts of the connected Google account.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Lists the connected account contacts with the resourceName and etag every write action needs, plus display name, emails, phone numbers and organization. Use this to resolve a person name to a resourceName before Update Contact Fields, Delete Contact or group membership changes; use Search Contacts when you already have a query string. Read-only and safe to retry.',
+    idempotent: true,
+  },
+  outputSchema: listContactsOutputSchema,
+  props: {
+    maxResults: Property.Number({
+      displayName: 'Max Results',
+      description: 'Maximum number of contacts to return. Defaults to 200.',
+      required: false,
+    }),
+  },
+  async run(context) {
+    const limit = context.propsValue.maxResults ?? 200;
+    const collected: Record<string, unknown>[] = [];
+    let pageToken: string | undefined = undefined;
+    try {
+      for (let page = 0; page < maxPages; page++) {
+        const pageSize = Math.min(1000, Math.max(1, limit - collected.length));
+        const response: Record<string, unknown> =
+          await googleContactsApi.sendRequest({
+            accessToken: context.auth.access_token,
+            method: HttpMethod.GET,
+            path: '/people/me/connections',
+            queryParams: {
+              personFields: googleContactsApi.contactReadMask.join(','),
+              pageSize: String(pageSize),
+              pageToken,
+            },
+          });
+        const connections = googleContactsApi.readArray({
+          source: response,
+          path: ['connections'],
+        });
+        for (const person of connections) {
+          collected.push(googleContactsPerson.summarizePerson({ person }));
+        }
+        pageToken = googleContactsApi.readString({
+          source: response,
+          path: ['nextPageToken'],
+        });
+        if (pageToken === undefined || collected.length >= limit) {
+          break;
+        }
+      }
+    } catch (error) {
+      throw googleContactsApi.toApiError({ error, operation: 'List Contacts' });
+    }
+    const contacts = collected.slice(0, limit);
+    return {
+      contacts,
+      count: contacts.length,
+      hasMore: pageToken !== undefined,
+    };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/modify-contact-group-members.ts b/packages/pieces/community/google-contacts/src/lib/action/modify-contact-group-members.ts
new file mode 100644
index 000000000000..782c5b2f62c6
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/modify-contact-group-members.ts
@@ -0,0 +1,102 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { modifyContactGroupMembersOutputSchema } from '../output-schemas';
+
+export const googleContactsModifyContactGroupMembersAction = createAction({
+  auth: googleContactsAuth,
+  name: 'modify_contact_group_members',
+  classification: 'WRITE',
+  displayName: 'Add Or Remove Contact Group Members',
+  description: 'Add contacts to a contact group or remove them from it.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Adds contacts to a Google Contacts group and removes contacts from it in one call, taking opaque people/{id} resource names resolved with List Contacts or Search Contacts and a contactGroups/{id} group resolved with List Contact Groups. Additions are accepted by user-created groups and by the system groups contactGroups/myContacts and contactGroups/starred only; other system groups accept removals only. Combined additions and removals are capped at 1000, and the response reports contacts that were not found. Safe to retry — re-applying the same membership changes converges.',
+    idempotent: true,
+  },
+  outputSchema: modifyContactGroupMembersOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Contact Group Resource Name',
+      description:
+        'Opaque contact group resource name such as contactGroups/abc123, contactGroups/myContacts or contactGroups/starred. Resolve it with List Contact Groups.',
+      required: true,
+    }),
+    resourceNamesToAdd: Property.Array({
+      displayName: 'Contacts To Add',
+      description:
+        'Opaque contact resource names such as people/c12345 to add to the group.',
+      required: false,
+    }),
+    resourceNamesToRemove: Property.Array({
+      displayName: 'Contacts To Remove',
+      description:
+        'Opaque contact resource names such as people/c12345 to remove from the group.',
+      required: false,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    const resourceNamesToAdd = googleContactsApi.toStringList({
+      value: context.propsValue.resourceNamesToAdd,
+      label: 'Contacts To Add',
+    });
+    const resourceNamesToRemove = googleContactsApi.toStringList({
+      value: context.propsValue.resourceNamesToRemove,
+      label: 'Contacts To Remove',
+    });
+    const total = resourceNamesToAdd.length + resourceNamesToRemove.length;
+    if (total === 0) {
+      throw new Error(
+        'Add Or Remove Contact Group Members needs at least one contact to add or remove.'
+      );
+    }
+    if (total > 1000) {
+      throw new Error(
+        `Contacts to add and remove are capped at 1000 combined, received ${total}.`
+      );
+    }
+    if (
+      resourceNamesToAdd.length > 0 &&
+      googleContactsApi.systemGroupsRejectingAdds.includes(resourceName)
+    ) {
+      throw new Error(
+        `The system group ${resourceName} does not accept added members; only contactGroups/myContacts, contactGroups/starred and user-created groups do.`
+      );
+    }
+    let response: Record<string, unknown>;
+    try {
+      response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.POST,
+        path: `/${resourceName}/members:modify`,
+        body: { resourceNamesToAdd, resourceNamesToRemove },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Add Or Remove Contact Group Members',
+      });
+    }
+    const notFound = googleContactsApi
+      .readArray({ source: response, path: ['notFoundResourceNames'] })
+      .filter((value): value is string => typeof value === 'string');
+    const notRemovable = googleContactsApi
+      .readArray({
+        source: response,
+        path: ['canNotRemoveLastContactGroupResourceNames'],
+      })
+      .filter((value): value is string => typeof value === 'string');
+    return {
+      resourceName,
+      added: resourceNamesToAdd.filter((name) => !notFound.includes(name)),
+      removed: resourceNamesToRemove.filter(
+        (name) => !notFound.includes(name) && !notRemovable.includes(name)
+      ),
+      notFoundResourceNames: notFound,
+      canNotRemoveLastContactGroupResourceNames: notRemovable,
+    };
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/search-contact.ts b/packages/pieces/community/google-contacts/src/lib/action/search-contact.ts
index b2ce4832e456..8457e050f3be 100644
--- a/packages/pieces/community/google-contacts/src/lib/action/search-contact.ts
+++ b/packages/pieces/community/google-contacts/src/lib/action/search-contact.ts
@@ -15,7 +15,7 @@ export const googleContactsSearchContactsAction = createAction({
   name: 'search_contact',
   classification: 'SEARCH',
   description: 'Search contacts in Google Contacts account.',
-  audience: 'both',
+  audience: 'human',
   aiMetadata: { description: 'Searches the authenticated Google Contacts account for people matching a plain-text query, which prefix-matches against contact fields. Use when an agent needs to find a contact or its resourceName before updating it; the query is required and a read mask selects which fields come back (max 30 results). Read-only and idempotent.', idempotent: true },
   displayName: 'Search Contacts',
   outputSchema: searchContactsOutputSchema,
diff --git a/packages/pieces/community/google-contacts/src/lib/action/search-contacts.ts b/packages/pieces/community/google-contacts/src/lib/action/search-contacts.ts
new file mode 100644
index 000000000000..c220d48c8b16
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/search-contacts.ts
@@ -0,0 +1,73 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsPerson } from '../common/person';
+import { searchContactsAtomicOutputSchema } from '../output-schemas';
+
+export const googleContactsSearchContactsAtomicAction = createAction({
+  auth: googleContactsAuth,
+  name: 'search_contacts',
+  classification: 'SEARCH',
+  displayName: 'Search Contacts',
+  description: 'Search the connected account contacts by a plain-text query.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Searches the connected Google Contacts account for people whose fields prefix-match a plain-text query and returns each match with its resourceName and etag. Use it to resolve a name, email or phone fragment into a resourceName before an update or delete; use List Contacts to enumerate everything instead. Matching is prefix-only ("foo n" matches "foo name", "oo n" does not) and capped at 30 results. Read-only and safe to retry.',
+    idempotent: true,
+  },
+  outputSchema: searchContactsAtomicOutputSchema,
+  props: {
+    query: Property.ShortText({
+      displayName: 'Query',
+      description:
+        'Plain-text query prefix-matched against contact fields such as name, email and phone number.',
+      required: true,
+    }),
+    pageSize: Property.Number({
+      displayName: 'Page Size',
+      description: 'Number of results to return, maximum 30. Defaults to 30.',
+      required: false,
+    }),
+  },
+  async run(context) {
+    const readMask = googleContactsApi.contactReadMask.join(',');
+    const pageSize = Math.min(30, Math.max(1, context.propsValue.pageSize ?? 30));
+    try {
+      await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.GET,
+        path: '/people:searchContacts',
+        queryParams: { query: '', readMask, pageSize: '1' },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Search Contacts warm-up',
+      });
+    }
+    try {
+      const response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.GET,
+        path: '/people:searchContacts',
+        queryParams: {
+          query: context.propsValue.query,
+          readMask,
+          pageSize: String(pageSize),
+        },
+      });
+      const results = googleContactsApi
+        .readArray({ source: response, path: ['results'] })
+        .map((result) =>
+          googleContactsPerson.summarizePerson({
+            person: googleContactsApi.readValue({ source: result, path: ['person'] }),
+          })
+        );
+      return { results, count: results.length };
+    } catch (error) {
+      throw googleContactsApi.toApiError({ error, operation: 'Search Contacts' });
+    }
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/update-contact-fields.ts b/packages/pieces/community/google-contacts/src/lib/action/update-contact-fields.ts
new file mode 100644
index 000000000000..d5f7010b968a
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/update-contact-fields.ts
@@ -0,0 +1,163 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsPerson } from '../common/person';
+import { updateContactFieldsOutputSchema } from '../output-schemas';
+
+export const googleContactsUpdateContactFieldsAction = createAction({
+  auth: googleContactsAuth,
+  name: 'update_contact_fields',
+  classification: 'WRITE',
+  displayName: 'Update Contact Fields',
+  description: 'Update only the supplied fields on an existing contact.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Updates an existing Google Contacts person, changing only the fields you supply and leaving every other field untouched. It reads the contact first, so it resolves the required etag and field mask itself — you never pass them. Supply the opaque resourceName from List Contacts or Search Contacts. A non-empty email or phone list replaces the stored list for that field wholesale; first/middle/last name and company/job title are merged over the current values. Leaving a list empty does NOT clear it, because the platform cannot distinguish an untouched list from an emptied one: to remove every email address or every phone number, including the last one, set clearEmails or clearPhoneNumbers to true. Setting a clear flag while also supplying a non-empty list for the same field is rejected. Safe to retry: re-applying the same values converges, and a concurrent edit surfaces as a re-read-and-retry error.',
+    idempotent: true,
+  },
+  outputSchema: updateContactFieldsOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Resource Name',
+      description:
+        'Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts.',
+      required: true,
+    }),
+    firstName: Property.ShortText({
+      displayName: 'First Name',
+      required: false,
+    }),
+    middleName: Property.ShortText({
+      displayName: 'Middle Name',
+      required: false,
+    }),
+    lastName: Property.ShortText({
+      displayName: 'Last Name',
+      required: false,
+    }),
+    nickname: Property.ShortText({
+      displayName: 'Nickname',
+      required: false,
+    }),
+    emails: Property.Array({
+      displayName: 'Email Addresses',
+      description:
+        'Array of email address strings, for example ["ada@example.com"]. Replaces every email address stored on the contact. Leaving it empty keeps the stored addresses; it does not clear them, because an untouched list and an emptied one cannot be told apart. Use Clear Email Addresses to remove them.',
+      required: false,
+    }),
+    clearEmails: Property.Checkbox({
+      displayName: 'Clear Email Addresses',
+      description:
+        'Remove every email address from the contact, including the last one. This is the only way to clear them. Cannot be combined with a non-empty Email Addresses list.',
+      required: false,
+      defaultValue: false,
+    }),
+    phoneNumbers: Property.Array({
+      displayName: 'Phone Numbers',
+      description:
+        'Array of phone number strings, for example ["+1 555 0100"]. Replaces every phone number stored on the contact. Leaving it empty keeps the stored numbers; it does not clear them, because an untouched list and an emptied one cannot be told apart. Use Clear Phone Numbers to remove them.',
+      required: false,
+    }),
+    clearPhoneNumbers: Property.Checkbox({
+      displayName: 'Clear Phone Numbers',
+      description:
+        'Remove every phone number from the contact, including the last one. This is the only way to clear them. Cannot be combined with a non-empty Phone Numbers list.',
+      required: false,
+      defaultValue: false,
+    }),
+    company: Property.ShortText({
+      displayName: 'Company',
+      required: false,
+    }),
+    jobTitle: Property.ShortText({
+      displayName: 'Job Title',
+      required: false,
+    }),
+    biography: Property.LongText({
+      displayName: 'Notes',
+      required: false,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    const clearEmails = context.propsValue.clearEmails === true;
+    const clearPhoneNumbers = context.propsValue.clearPhoneNumbers === true;
+    const emails = googleContactsApi.toStringList({
+      value: context.propsValue.emails,
+      label: 'Email Addresses',
+    });
+    const phoneNumbers = googleContactsApi.toStringList({
+      value: context.propsValue.phoneNumbers,
+      label: 'Phone Numbers',
+    });
+    if (clearEmails && emails.length > 0) {
+      throw new Error(
+        'Clear Email Addresses removes every email address, so it cannot be combined with an Email Addresses list. Either clear the list or turn the checkbox off.'
+      );
+    }
+    if (clearPhoneNumbers && phoneNumbers.length > 0) {
+      throw new Error(
+        'Clear Phone Numbers removes every phone number, so it cannot be combined with a Phone Numbers list. Either clear the list or turn the checkbox off.'
+      );
+    }
+    const input = {
+      firstName: context.propsValue.firstName,
+      middleName: context.propsValue.middleName,
+      lastName: context.propsValue.lastName,
+      nickname: context.propsValue.nickname,
+      emails,
+      phoneNumbers,
+      clearEmails,
+      clearPhoneNumbers,
+      company: context.propsValue.company,
+      jobTitle: context.propsValue.jobTitle,
+      biography: context.propsValue.biography,
+    };
+    const { fields: requestedFields } = googleContactsPerson.buildPerson({ input });
+    if (requestedFields.length === 0) {
+      throw new Error(
+        'Update Contact Fields needs at least one field to change; every field prop was left empty.'
+      );
+    }
+    let current: Record<string, unknown>;
+    try {
+      current = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.GET,
+        path: `/${resourceName}`,
+        queryParams: { personFields: requestedFields.join(',') },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Update Contact Fields (reading the contact)',
+      });
+    }
+    const etag = googleContactsApi.readString({ source: current, path: ['etag'] });
+    if (etag === undefined) {
+      throw new Error(
+        'Update Contact Fields could not read the current etag of the contact; re-read the contact and retry.'
+      );
+    }
+    const { person, fields } = googleContactsPerson.buildPerson({ input, current });
+    try {
+      return await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.PATCH,
+        path: `/${resourceName}:updateContact`,
+        queryParams: {
+          updatePersonFields: fields.join(','),
+          personFields: googleContactsApi.contactReadMask.join(','),
+        },
+        body: { etag, ...person },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Update Contact Fields',
+      });
+    }
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/update-contact-group.ts b/packages/pieces/community/google-contacts/src/lib/action/update-contact-group.ts
new file mode 100644
index 000000000000..8582ab92e39c
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/update-contact-group.ts
@@ -0,0 +1,79 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { googleContactsGroup } from '../common/contact-group';
+import { updateContactGroupOutputSchema } from '../output-schemas';
+
+export const googleContactsUpdateContactGroupAction = createAction({
+  auth: googleContactsAuth,
+  name: 'update_contact_group',
+  classification: 'WRITE',
+  displayName: 'Update Contact Group',
+  description: 'Rename an existing user-created contact group.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Renames one user-created Google Contacts group identified by its opaque resourceName (contactGroups/{id}). It reads the group first to resolve the required etag and sends an explicit name-only field mask, so members and other group data are untouched. Resolve the resourceName with List Contact Groups; Google-managed system groups cannot be renamed. Safe to retry: re-applying the same name converges, and a concurrent edit surfaces as a re-read-and-retry error.',
+    idempotent: true,
+  },
+  outputSchema: updateContactGroupOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Resource Name',
+      description:
+        'Opaque contact group resource name such as contactGroups/abc123. Resolve it with List Contact Groups.',
+      required: true,
+    }),
+    name: Property.ShortText({
+      displayName: 'New Group Name',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    const name = context.propsValue.name.trim();
+    if (name.length === 0) {
+      throw new Error('New Group Name must not be empty.');
+    }
+    const groupFields = googleContactsApi.contactGroupFields.join(',');
+    let current: Record<string, unknown>;
+    try {
+      current = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.GET,
+        path: `/${resourceName}`,
+        queryParams: { groupFields, maxMembers: '0' },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Update Contact Group (reading the group)',
+      });
+    }
+    const etag = googleContactsApi.readString({ source: current, path: ['etag'] });
+    if (etag === undefined) {
+      throw new Error(
+        'Update Contact Group could not read the current etag of the group; re-read the group and retry.'
+      );
+    }
+    try {
+      const response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.PUT,
+        path: `/${resourceName}`,
+        body: {
+          contactGroup: { etag, name },
+          updateGroupFields: 'name',
+          readGroupFields: groupFields,
+        },
+      });
+      return googleContactsGroup.summarizeGroup({ group: response });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Update Contact Group',
+      });
+    }
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/update-contact-photo.ts b/packages/pieces/community/google-contacts/src/lib/action/update-contact-photo.ts
new file mode 100644
index 000000000000..f34f77f38993
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/action/update-contact-photo.ts
@@ -0,0 +1,75 @@
+import { HttpMethod } from '@activepieces/pieces-common';
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { googleContactsAuth } from '../auth';
+import { googleContactsApi } from '../common';
+import { updateContactPhotoOutputSchema } from '../output-schemas';
+
+const base64Marker = 'base64,';
+
+export const googleContactsUpdateContactPhotoAction = createAction({
+  auth: googleContactsAuth,
+  name: 'update_contact_photo',
+  classification: 'WRITE',
+  displayName: 'Update Contact Photo',
+  description: 'Set the photo of an existing contact from base64 image bytes.',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Replaces the photo of one Google Contacts person with the supplied base64-encoded JPEG, PNG or WebP image. Supply the opaque resourceName from List Contacts or Search Contacts; use Delete Contact Photo to remove a photo instead. Safe to retry — re-sending the same bytes converges on the same photo.',
+    idempotent: true,
+  },
+  outputSchema: updateContactPhotoOutputSchema,
+  props: {
+    resourceName: Property.ShortText({
+      displayName: 'Resource Name',
+      description:
+        'Opaque contact resource name such as people/c12345. Resolve it with List Contacts or Search Contacts.',
+      required: true,
+    }),
+    photoBytes: Property.LongText({
+      displayName: 'Photo Bytes',
+      description:
+        'Base64-encoded JPEG, PNG or WebP image. A data URL prefix is accepted and stripped.',
+      required: true,
+    }),
+  },
+  async run(context) {
+    const resourceName = context.propsValue.resourceName.trim();
+    const supplied = context.propsValue.photoBytes.trim();
+    const markerIndex = supplied.indexOf(base64Marker);
+    const photoBytes =
+      markerIndex === -1
+        ? supplied
+        : supplied.slice(markerIndex + base64Marker.length);
+    if (photoBytes.length === 0) {
+      throw new Error('Update Contact Photo needs base64-encoded image bytes.');
+    }
+    let response: Record<string, unknown>;
+    try {
+      response = await googleContactsApi.sendRequest({
+        accessToken: context.auth.access_token,
+        method: HttpMethod.PATCH,
+        path: `/${resourceName}:updateContactPhoto`,
+        body: {
+          photoBytes,
+          personFields: googleContactsApi.contactReadMask.join(','),
+        },
+      });
+    } catch (error) {
+      throw googleContactsApi.toApiError({
+        error,
+        operation: 'Update Contact Photo',
+      });
+    }
+    const person = googleContactsApi.readRecord({
+      source: response,
+      path: ['person'],
+    });
+    if (person === undefined) {
+      throw new Error(
+        'Update Contact Photo could not read the updated contact back from Google Contacts; re-read the contact with Get Contact to confirm the photo was set.'
+      );
+    }
+    return person;
+  },
+});
diff --git a/packages/pieces/community/google-contacts/src/lib/action/update-contact.ts b/packages/pieces/community/google-contacts/src/lib/action/update-contact.ts
index 3d7e75ec0d79..b6c78343740f 100644
--- a/packages/pieces/community/google-contacts/src/lib/action/update-contact.ts
+++ b/packages/pieces/community/google-contacts/src/lib/action/update-contact.ts
@@ -18,7 +18,7 @@ export const googleContactsUpdateContactAction = createAction({
   name: 'update_contact',
   classification: 'WRITE',
   description: 'Update a contact in Google Contacts account.',
-  audience: 'both',
+  audience: 'human',
   aiMetadata: { description: 'Updates fields (name, email, phone, company, job title) on an existing Google Contacts person identified by its resourceName (people/{id}). Use when an agent needs to modify a known contact; requires both the resourceName and the current etag, and a field mask listing which fields to update — the call is rejected if the contact changed since the etag was fetched. Repeating the same update with the same etag/values is safe and yields the same result.', idempotent: true },
   displayName: 'Update Contact',
   outputSchema: updateContactOutputSchema,
diff --git a/packages/pieces/community/google-contacts/src/lib/common/contact-group.ts b/packages/pieces/community/google-contacts/src/lib/common/contact-group.ts
new file mode 100644
index 000000000000..50d370388d46
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/common/contact-group.ts
@@ -0,0 +1,43 @@
+import { googleContactsApi } from './index';
+
+function summarizeGroup({ group }: { group: unknown }): Record<string, unknown> {
+  const memberCount = googleContactsApi.readValue({
+    source: group,
+    path: ['memberCount'],
+  });
+  return {
+    resourceName: googleContactsApi.readString({
+      source: group,
+      path: ['resourceName'],
+    }),
+    etag: googleContactsApi.readString({ source: group, path: ['etag'] }),
+    name: googleContactsApi.readString({ source: group, path: ['name'] }),
+    formattedName: googleContactsApi.readString({
+      source: group,
+      path: ['formattedName'],
+    }),
+    groupType: googleContactsApi.readString({ source: group, path: ['groupType'] }),
+    memberCount: typeof memberCount === 'number' ? memberCount : 0,
+    memberResourceNames: googleContactsApi
+      .readArray({ source: group, path: ['memberResourceNames'] })
+      .filter((value): value is string => typeof value === 'string'),
+  };
+}
+
+function matchesName({ group, name }: { group: unknown; name: string }): boolean {
+  const target = name.trim().toLowerCase();
+  const groupName = googleContactsApi.readString({ source: group, path: ['name'] });
+  const formatted = googleContactsApi.readString({
+    source: group,
+    path: ['formattedName'],
+  });
+  return (
+    groupName?.trim().toLowerCase() === target ||
+    formatted?.trim().toLowerCase() === target
+  );
+}
+
+export const googleContactsGroup = {
+  summarizeGroup,
+  matchesName,
+};
diff --git a/packages/pieces/community/google-contacts/src/lib/common/index.ts b/packages/pieces/community/google-contacts/src/lib/common/index.ts
index 4532fbae00cd..ae87ea58750c 100644
--- a/packages/pieces/community/google-contacts/src/lib/common/index.ts
+++ b/packages/pieces/community/google-contacts/src/lib/common/index.ts
@@ -1,3 +1,343 @@
+import {
+  AuthenticationType,
+  HttpMethod,
+  HttpRequest,
+  httpClient,
+} from '@activepieces/pieces-common';
+
+const apiRoot = 'https://people.googleapis.com/v1';
+
+const contactReadMask = [
+  'names',
+  'nicknames',
+  'emailAddresses',
+  'phoneNumbers',
+  'organizations',
+  'addresses',
+  'biographies',
+  'urls',
+  'memberships',
+  'photos',
+  'metadata',
+];
+
+const contactGroupFields = [
+  'clientData',
+  'groupType',
+  'memberCount',
+  'metadata',
+  'name',
+];
+
+const updatablePersonFields = [
+  'addresses',
+  'biographies',
+  'birthdays',
+  'calendarUrls',
+  'clientData',
+  'emailAddresses',
+  'events',
+  'externalIds',
+  'genders',
+  'imClients',
+  'interests',
+  'locales',
+  'locations',
+  'memberships',
+  'miscKeywords',
+  'names',
+  'nicknames',
+  'occupations',
+  'organizations',
+  'phoneNumbers',
+  'relations',
+  'sipAddresses',
+  'urls',
+  'userDefined',
+];
+
+const systemGroupsRejectingAdds = [
+  'contactGroups/all',
+  'contactGroups/blocked',
+  'contactGroups/chatBuddies',
+  'contactGroups/coworkers',
+  'contactGroups/family',
+  'contactGroups/friends',
+];
+
+function buildUrl({
+  path,
+  queryParams,
+  repeatedQueryParams,
+}: {
+  path: string;
+  queryParams?: Record<string, string | undefined>;
+  repeatedQueryParams?: Record<string, string[]>;
+}): string {
+  const search = new URLSearchParams();
+  for (const [key, value] of Object.entries(queryParams ?? {})) {
+    if (value !== undefined) {
+      search.append(key, value);
+    }
+  }
+  for (const [key, values] of Object.entries(repeatedQueryParams ?? {})) {
+    for (const value of values) {
+      search.append(key, value);
+    }
+  }
+  const query = search.toString();
+  return query.length > 0 ? `${apiRoot}${path}?${query}` : `${apiRoot}${path}`;
+}
+
+function readValue({ source, path }: { source: unknown; path: string[] }): unknown {
+  let current: unknown = source;
+  for (const key of path) {
+    if (typeof current !== 'object' || current === null || !(key in current)) {
+      return undefined;
+    }
+    current = Reflect.get(current, key);
+  }
+  return current;
+}
+
+function readString({
+  source,
+  path,
+}: {
+  source: unknown;
+  path: string[];
+}): string | undefined {
+  const value = readValue({ source, path });
+  return typeof value === 'string' ? value : undefined;
+}
+
+function readRecord({
+  source,
+  path,
+}: {
+  source: unknown;
+  path: string[];
+}): Record<string, unknown> | undefined {
+  const value = readValue({ source, path });
+  if (typeof value !== 'object' || value === null || Array.isArray(value)) {
+    return undefined;
+  }
+  return Object.fromEntries(Object.entries(value));
+}
+
+function readArray({ source, path }: { source: unknown; path: string[] }): unknown[] {
+  const value = readValue({ source, path });
+  return Array.isArray(value) ? value : [];
+}
+
+function parseStringList({ value, label }: { value: string; label: string }): unknown[] {
+  try {
+    const parsed: unknown = JSON.parse(value);
+    if (Array.isArray(parsed)) {
+      return parsed;
+    }
+  } catch {
+    throw new Error(`${label} must be a list of strings.`);
+  }
+  throw new Error(`${label} must be a list of strings.`);
+}
+
+function toStringList({ value, label }: { value: unknown; label: string }): string[] {
+  if (value === undefined || value === null) {
+    return [];
+  }
+  const entries =
+    typeof value === 'string' ? parseStringList({ value, label }) : value;
+  if (!Array.isArray(entries)) {
+    throw new Error(`${label} must be a list of strings.`);
+  }
+  return entries.map((item) => {
+    if (typeof item !== 'string' || item.trim().length === 0) {
+      throw new Error(`${label} must be a list of non-empty strings.`);
+    }
+    return item.trim();
+  });
+}
+
+function assertBatchSize({
+  values,
+  max,
+  label,
+}: {
+  values: string[];
+  max: number;
+  label: string;
+}): void {
+  if (values.length === 0) {
+    throw new Error(`${label} must contain at least one entry.`);
+  }
+  if (values.length > max) {
+    throw new Error(
+      `${label} accepts at most ${max} entries, received ${values.length}.`
+    );
+  }
+}
+
+function describeStatus({ status }: { status: unknown }): string {
+  const message = readString({ source: status, path: ['message'] });
+  const code = readValue({ source: status, path: ['code'] });
+  if (message !== undefined) {
+    return message;
+  }
+  if (typeof code === 'number') {
+    return `Google returned status code ${code}.`;
+  }
+  return 'Google returned an unspecified failure for this item.';
+}
+
+function isFailedItem({ response }: { response: unknown }): boolean {
+  const status = readValue({ source: response, path: ['status'] });
+  if (status === undefined || status === null) {
+    return false;
+  }
+  const code = readValue({ source: status, path: ['code'] });
+  const message = readValue({ source: status, path: ['message'] });
+  if (typeof code === 'number' && code !== 0) {
+    return true;
+  }
+  return typeof message === 'string' && message.length > 0;
+}
+
+function splitItemResponses({
+  items,
+  payloadKey,
+}: {
+  items: { resourceName: string; response: unknown }[];
+  payloadKey: string;
+}): {
+  succeeded: { resourceName: string; payload: unknown }[];
+  failed: { resourceName: string; status: string }[];
+} {
+  const succeeded = items
+    .filter((item) => !isFailedItem({ response: item.response }))
+    .map((item) => ({
+      resourceName:
+        readString({
+          source: item.response,
+          path: [payloadKey, 'resourceName'],
+        }) ?? item.resourceName,
+      payload: readValue({ source: item.response, path: [payloadKey] }),
+    }));
+  const failed = items
+    .filter((item) => isFailedItem({ response: item.response }))
+    .map((item) => ({
+      resourceName: item.resourceName,
+      status: describeStatus({
+        status: readValue({ source: item.response, path: ['status'] }),
+      }),
+    }));
+  return { succeeded, failed };
+}
+
+function toApiError({
+  error,
+  operation,
+}: {
+  error: unknown;
+  operation: string;
+}): Error {
+  const status = readValue({ source: error, path: ['response', 'status'] });
+  const reason = readString({
+    source: error,
+    path: ['response', 'body', 'error', 'status'],
+  });
+  const message = readString({
+    source: error,
+    path: ['response', 'body', 'error', 'message'],
+  });
+  const suffix = message === undefined ? '' : ` ${message}`;
+  if (status === 400 && reason === 'FAILED_PRECONDITION') {
+    return new Error(
+      `${operation} failed because the record changed since it was read. Re-read the record to get a fresh etag and retry.${suffix}`
+    );
+  }
+  if (status === 400) {
+    return new Error(
+      `${operation} was rejected as invalid by Google Contacts.${suffix}`
+    );
+  }
+  if (status === 401) {
+    return new Error(
+      `${operation} failed: the Google Contacts connection is no longer authorized. Reconnect the account.${suffix}`
+    );
+  }
+  if (status === 403) {
+    return new Error(
+      `${operation} failed: the connected Google account is not allowed to perform it, or the connection is missing the required scope.${suffix}`
+    );
+  }
+  if (status === 404) {
+    return new Error(
+      `${operation} failed: the resource was not found. Resource names are opaque, so resolve a current one with the matching list or search action.${suffix}`
+    );
+  }
+  if (status === 409) {
+    return new Error(`${operation} failed: the resource already exists.${suffix}`);
+  }
+  if (status === 429) {
+    return new Error(
+      `${operation} failed: Google Contacts rate limit reached. Retry later.${suffix}`
+    );
+  }
+  return new Error(`${operation} failed.${suffix}`);
+}
+
+function isConflict({ error }: { error: unknown }): boolean {
+  return readValue({ source: error, path: ['response', 'status'] }) === 409;
+}
+
+async function sendRequest({
+  accessToken,
+  method,
+  path,
+  queryParams,
+  repeatedQueryParams,
+  body,
+}: {
+  accessToken: string;
+  method: HttpMethod;
+  path: string;
+  queryParams?: Record<string, string | undefined>;
+  repeatedQueryParams?: Record<string, string[]>;
+  body?: Record<string, unknown>;
+}): Promise<Record<string, unknown>> {
+  const request: HttpRequest<Record<string, unknown>> = {
+    method,
+    url: buildUrl({ path, queryParams, repeatedQueryParams }),
+    body,
+    authentication: {
+      type: AuthenticationType.BEARER_TOKEN,
+      token: accessToken,
+    },
+  };
+  const response = await httpClient.sendRequest<Record<string, unknown>>(request);
+  return response.body ?? {};
+}
+
 export const googleContactsCommon = {
   baseUrl: `https://people.googleapis.com/v1/people`,
 };
+
+export const googleContactsApi = {
+  contactReadMask,
+  contactGroupFields,
+  updatablePersonFields,
+  systemGroupsRejectingAdds,
+  sendRequest,
+  toApiError,
+  isConflict,
+  readValue,
+  readString,
+  readRecord,
+  readArray,
+  toStringList,
+  assertBatchSize,
+  splitItemResponses,
+  describeStatus,
+  isFailedItem,
+};
diff --git a/packages/pieces/community/google-contacts/src/lib/common/person.ts b/packages/pieces/community/google-contacts/src/lib/common/person.ts
new file mode 100644
index 000000000000..289f1ddb00c5
--- /dev/null
+++ b/packages/pieces/community/google-contacts/src/lib/common/person.ts
@@ -0,0 +1,157 @@
+import { googleContactsApi } from './index';
+
+function mergeFirstEntry({
+  current,
+  group,
+  overrides,
+  defaults,
+}: {
+  current: Record<string, unknown> | undefined;
+  group: string;
+  overrides: Record<string, unknown>;
+  defaults?: Record<string, unknown>;
+}): unknown[] {
+  const entries = googleContactsApi.readArray({ source: current, path: [group] });
+  const head = entries[0];
+  const base =
+    typeof head === 'object' && head !== null && !Array.isArray(head)
+      ? Object.fromEntries(Object.entries(head))
+      : {};
+  return [{ ...defaults, ...base, ...overrides }, ...entries.slice(1)];
+}
+
+function buildPerson({
+  input,
+  current,
+}: {
+  input: ContactInput;
+  current?: Record<string, unknown>;
+}): { person: Record<string, unknown>; fields: string[] } {
+  const person: Record<string, unknown> = {};
+  const fields: string[] = [];
+
+  const nameSupplied =
+    input.firstName !== undefined ||
+    input.middleName !== undefined ||
+    input.lastName !== undefined;
+  if (nameSupplied) {
+    person['names'] = mergeFirstEntry({
+      current,
+      group: 'names',
+      overrides: {
+        ...(input.firstName === undefined ? {} : { givenName: input.firstName }),
+        ...(input.middleName === undefined ? {} : { middleName: input.middleName }),
+        ...(input.lastName === undefined ? {} : { familyName: input.lastName }),
+      },
+    });
+    fields.push('names');
+  }
+
+  if (input.nickname !== undefined) {
+    person['nicknames'] = mergeFirstEntry({
+      current,
+      group: 'nicknames',
+      overrides: { value: input.nickname },
+    });
+    fields.push('nicknames');
+  }
+
+  if (input.clearEmails === true) {
+    person['emailAddresses'] = [];
+    fields.push('emailAddresses');
+  } else if (input.emails !== undefined && input.emails.length > 0) {
+    person['emailAddresses'] = input.emails.map((value) => ({ value }));
+    fields.push('emailAddresses');
+  }
+
+  if (input.clearPhoneNumbers === true) {
+    person['phoneNumbers'] = [];
+    fields.push('phoneNumbers');
+  } else if (input.phoneNumbers !== undefined && input.phoneNumbers.length > 0) {
+    person['phoneNumbers'] = input.phoneNumbers.map((value) => ({ value }));
+    fields.push('phoneNumbers');
+  }
+
+  const organizationSupplied =
+    input.company !== undefined || input.jobTitle !== undefined;
+  if (organizationSupplied) {
+    person['organizations'] = mergeFirstEntry({
+      current,
+      group: 'organizations',
+      overrides: {
+        ...(input.company === undefined ? {} : { name: input.company }),
+        ...(input.jobTitle === undefined ? {} : { title: input.jobTitle }),
+      },
+    });
+    fields.push('organizations');
+  }
+
+  if (input.biography !== undefined) {
+    person['biographies'] = mergeFirstEntry({
+      current,
+      group: 'biographies',
+      overrides: { value: input.biography },
+      defaults: { contentType: 'TEXT_PLAIN' },
+    });
+    fields.push('biographies');
+  }
+
+  return { person, fields };
+}
+
+function valuesOf({
+  person,
+  group,
+}: {
+  person: unknown;
+  group: string;
+}): string[] {
+  const entries = googleContactsApi.readArray({ source: person, path: [group] });
+  const values = entries.map((entry) =>
+    googleContactsApi.readString({ source: entry, path: ['value'] })
+  );
+  return values.filter((value): value is string => value !== undefined);
+}
+
+function summarizePerson({ person }: { person: unknown }): Record<string, unknown> {
+  const name = googleContactsApi.readArray({ source: person, path: ['names'] })[0];
+  const organization = googleContactsApi.readArray({
+    source: person,
+    path: ['organizations'],
+  })[0];
+  const source = googleContactsApi.readArray({
+    source: person,
+    path: ['metadata', 'sources'],
+  })[0];
+  return {
+    resourceName: googleContactsApi.readString({ source: person, path: ['resourceName'] }),
+    etag: googleContactsApi.readString({ source: person, path: ['etag'] }),
+    displayName: googleContactsApi.readString({ source: name, path: ['displayName'] }),
+    givenName: googleContactsApi.readString({ source: name, path: ['givenName'] }),
+    familyName: googleContactsApi.readString({ source: name, path: ['familyName'] }),
+    emails: valuesOf({ person, group: 'emailAddresses' }),
+    phoneNumbers: valuesOf({ person, group: 'phoneNumbers' }),
+    company: googleContactsApi.readString({ source: organization, path: ['name'] }),
+    jobTitle: googleContactsApi.readString({ source: organization, path: ['title'] }),
+    updateTime: googleContactsApi.readString({ source: source, path: ['updateTime'] }),
+  };
+}
+
+export const googleContactsPerson = {
+  buildPerson,
+  summarizePerson,
+};
+
+export type ContactInput = {
+  firstName?: string;
+  middleName?: string;
+  lastName?: string;
+  nickname?: string;
+  emails?: string[];
+  phoneNumbers?: string[];
+  clearEmails?: boolean;
+  clearPhoneNumbers?: boolean;
+  company?: string;
+  jobTitle?: string;
+  biography?: string;
+};
diff --git a/packages/pieces/community/google-contacts/src/lib/output-schemas.ts b/packages/pieces/community/google-contacts/src/lib/output-schemas.ts
index 7576a5c92571..988b789e9851 100644
--- a/packages/pieces/community/google-contacts/src/lib/output-schemas.ts
+++ b/packages/pieces/community/google-contacts/src/lib/output-schemas.ts
@@ -1,9 +1,5 @@
 import { OutputSchema } from '@activepieces/pieces-framework';
 
-// Google People returns every contact detail as a repeated field: a contact can hold several
-// names, emails, phone numbers and organizations, each carrying its own `metadata`. Only the
-// `metadata.primary` flag is surfaced from that block -- the rest (source ids, per-field etags)
-// is server bookkeeping that says nothing about the contact.
 const nameFields: OutputSchema['fields'] = [
   { key: 'displayName', label: 'Display Name' },
   { key: 'givenName', label: 'First Name' },
@@ -21,11 +17,21 @@ const emailFields: OutputSchema['fields'] = [
 
 const phoneFields: OutputSchema['fields'] = [
   { key: 'value', label: 'Phone Number' },
-  // Google normalises to E.164 here; the raw `value` keeps whatever the user typed.
   { key: 'canonicalForm', label: 'Canonical Form' },
   { key: 'primary', label: 'Primary', value: 'metadata.primary', format: 'boolean' },
 ];
 
+const nicknameFields: OutputSchema['fields'] = [
+  { key: 'value', label: 'Nickname' },
+  { key: 'primary', label: 'Primary', value: 'metadata.primary', format: 'boolean' },
+];
+
+const biographyFields: OutputSchema['fields'] = [
+  { key: 'value', label: 'Notes' },
+  { key: 'contentType', label: 'Content Type' },
+  { key: 'primary', label: 'Primary', value: 'metadata.primary', format: 'boolean' },
+];
+
 const organizationFields: OutputSchema['fields'] = [
   { key: 'name', label: 'Company' },
   { key: 'title', label: 'Job Title' },
@@ -34,7 +40,6 @@ const organizationFields: OutputSchema['fields'] = [
 
 const photoFields: OutputSchema['fields'] = [
   { key: 'url', label: 'Photo URL', format: 'image' },
-  // True when this is Google's generated placeholder rather than a photo the contact has.
   { key: 'default', label: 'Is Placeholder', format: 'boolean' },
   { key: 'primary', label: 'Primary', value: 'metadata.primary', format: 'boolean' },
 ];
@@ -61,18 +66,13 @@ const metadataFields: OutputSchema['fields'] = [
     listItems: [
       { key: 'type', label: 'Source Type' },
       { key: 'id', label: 'Source ID' },
-      // The only timestamp on a contact, and what the polling trigger orders and dedupes on.
       { key: 'updateTime', label: 'Last Updated', format: 'datetime' },
     ],
   },
 ];
 
-// One person record. Shared by every action and the trigger, because People returns the same
-// shape whether the contact was just created, just updated, matched by a search, or polled.
 const personFields: OutputSchema['fields'] = [
-  // `people/{person_id}` -- the id Update Contact requires.
   { key: 'resourceName', label: 'Resource Name' },
-  // Required alongside resourceName on update; the call is rejected if the contact moved on.
   { key: 'etag', label: 'ETag' },
   { key: 'names', label: 'Names', labelKey: 'displayName', listItems: nameFields },
   {
@@ -87,6 +87,8 @@ const personFields: OutputSchema['fields'] = [
     labelKey: 'value',
     listItems: phoneFields,
   },
+  { key: 'nicknames', label: 'Nicknames', labelKey: 'value', listItems: nicknameFields },
+  { key: 'biographies', label: 'Notes', labelKey: 'value', listItems: biographyFields },
   {
     key: 'organizations',
     label: 'Organizations',
@@ -97,14 +99,51 @@ const personFields: OutputSchema['fields'] = [
   {
     key: 'memberships',
     label: 'Group Memberships',
-    // labelKey resolves by dot path against the raw item, so it has to name the nested
-    // property rather than the flattened key used in membershipFields.
     labelKey: 'contactGroupMembership.contactGroupId',
     listItems: membershipFields,
   },
   { key: 'metadata', label: 'Metadata', children: metadataFields },
 ];
 
+const contactSummaryFields: OutputSchema['fields'] = [
+  { key: 'resourceName', label: 'Resource Name' },
+  { key: 'etag', label: 'ETag' },
+  { key: 'displayName', label: 'Display Name' },
+  { key: 'givenName', label: 'First Name' },
+  { key: 'familyName', label: 'Last Name' },
+  { key: 'emails', label: 'Email Addresses' },
+  { key: 'phoneNumbers', label: 'Phone Numbers' },
+  { key: 'company', label: 'Company' },
+  { key: 'jobTitle', label: 'Job Title' },
+  { key: 'updateTime', label: 'Last Updated', format: 'datetime' },
+];
+
+const contactGroupSummaryFields: OutputSchema['fields'] = [
+  { key: 'resourceName', label: 'Resource Name' },
+  { key: 'etag', label: 'ETag' },
+  { key: 'name', label: 'Name' },
+  { key: 'formattedName', label: 'Formatted Name' },
+  { key: 'groupType', label: 'Group Type' },
+  { key: 'memberCount', label: 'Member Count', format: 'number' },
+  { key: 'memberResourceNames', label: 'Member Resource Names' },
+];
+
+const batchFailureFields: OutputSchema['fields'] = [
+  { key: 'resourceName', label: 'Resource Name' },
+  { key: 'status', label: 'Failure Reason' },
+];
+
+const batchUpdateFailureFields: OutputSchema['fields'] = [
+  { key: 'resourceName', label: 'Resource Name' },
+  { key: 'status', label: 'Failure Reason' },
+  { key: 'updateMask', label: 'Field Groups Not Applied' },
+];
+
+const batchCreateFailureFields: OutputSchema['fields'] = [
+  { key: 'requestIndex', label: 'Request Index', format: 'number' },
+  { key: 'status', label: 'Failure Reason' },
+];
+
 export const addContactOutputSchema: OutputSchema = {
   fields: personFields,
 };
@@ -113,9 +152,6 @@ export const updateContactOutputSchema: OutputSchema = {
   fields: personFields,
 };
 
-// searchContacts wraps each hit as `{ person: {...} }` under a `results` array, so the person
-// fields sit one level deeper than they do on the other three steps. Which of them are actually
-// populated follows the caller's Read Mask -- the default is names and email addresses only.
 export const searchContactsOutputSchema: OutputSchema = {
   fields: [
     {
@@ -128,7 +164,209 @@ export const searchContactsOutputSchema: OutputSchema = {
   ],
 };
 
-// The polling trigger emits one person per run, so its payload is a person record directly.
 export const newOrUpdatedContactOutputSchema: OutputSchema = {
   fields: personFields,
 };
+
+export const createContactOutputSchema: OutputSchema = {
+  fields: personFields,
+};
+
+export const getContactOutputSchema: OutputSchema = {
+  fields: personFields,
+};
+
+export const updateContactFieldsOutputSchema: OutputSchema = {
+  fields: personFields,
+};
+
+export const listContactsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'contacts',
+      label: 'Contacts',
+      labelKey: 'displayName',
+      listItems: contactSummaryFields,
+    },
+    { key: 'count', label: 'Count', format: 'number' },
+    { key: 'hasMore', label: 'Has More', format: 'boolean' },
+  ],
+};
+
+export const searchContactsAtomicOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'results',
+      label: 'Matching Contacts',
+      labelKey: 'displayName',
+      listItems: contactSummaryFields,
+    },
+    { key: 'count', label: 'Count', format: 'number' },
+  ],
+};
+
+export const deleteContactOutputSchema: OutputSchema = {
+  fields: [
+    { key: 'deleted', label: 'Deleted', format: 'boolean' },
+    { key: 'resourceName', label: 'Resource Name' },
+  ],
+};
+
+export const batchDeleteContactsOutputSchema: OutputSchema = {
+  fields: [
+    { key: 'deleted', label: 'Deleted', format: 'boolean' },
+    { key: 'resourceNames', label: 'Resource Names' },
+    { key: 'count', label: 'Count', format: 'number' },
+  ],
+};
+
+export const batchGetContactsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'succeeded',
+      label: 'Contacts Read',
+      labelKey: 'contact.displayName',
+      listItems: [
+        { key: 'resourceName', label: 'Resource Name' },
+        { key: 'contact', label: 'Contact', children: contactSummaryFields },
+        { key: 'person', label: 'Full Person', children: personFields },
+      ],
+    },
+    {
+      key: 'failed',
+      label: 'Failures',
+      labelKey: 'resourceName',
+      listItems: batchFailureFields,
+    },
+    { key: 'succeededCount', label: 'Succeeded Count', format: 'number' },
+    { key: 'failedCount', label: 'Failed Count', format: 'number' },
+  ],
+};
+
+export const batchCreateContactsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'succeeded',
+      label: 'Contacts Created',
+      labelKey: 'contact.displayName',
+      listItems: [
+        { key: 'requestIndex', label: 'Request Index', format: 'number' },
+        { key: 'resourceName', label: 'Resource Name' },
+        { key: 'contact', label: 'Contact', children: contactSummaryFields },
+      ],
+    },
+    {
+      key: 'failed',
+      label: 'Failures',
+      labelKey: 'requestIndex',
+      listItems: batchCreateFailureFields,
+    },
+    { key: 'succeededCount', label: 'Succeeded Count', format: 'number' },
+    { key: 'failedCount', label: 'Failed Count', format: 'number' },
+    { key: 'requestedCount', label: 'Requested Count', format: 'number' },
+  ],
+};
+
+export const batchUpdateContactsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'succeeded',
+      label: 'Contacts Updated',
+      labelKey: 'contact.displayName',
+      listItems: [
+        { key: 'resourceName', label: 'Resource Name' },
+        { key: 'contact', label: 'Contact', children: contactSummaryFields },
+        { key: 'person', label: 'Full Person', children: personFields },
+      ],
+    },
+    {
+      key: 'failed',
+      label: 'Failures',
+      labelKey: 'resourceName',
+      listItems: batchUpdateFailureFields,
+    },
+    { key: 'succeededCount', label: 'Succeeded Count', format: 'number' },
+    { key: 'failedCount', label: 'Failed Count', format: 'number' },
+    { key: 'updateMasks', label: 'Update Masks' },
+  ],
+};
+
+export const updateContactPhotoOutputSchema: OutputSchema = {
+  fields: personFields,
+};
+
+export const deleteContactPhotoOutputSchema: OutputSchema = {
+  fields: personFields,
+};
+
+export const listContactGroupsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'contactGroups',
+      label: 'Contact Groups',
+      labelKey: 'formattedName',
+      listItems: contactGroupSummaryFields,
+    },
+    { key: 'count', label: 'Count', format: 'number' },
+    { key: 'hasMore', label: 'Has More', format: 'boolean' },
+  ],
+};
+
+export const getContactGroupOutputSchema: OutputSchema = {
+  fields: contactGroupSummaryFields,
+};
+
+export const updateContactGroupOutputSchema: OutputSchema = {
+  fields: contactGroupSummaryFields,
+};
+
+export const batchGetContactGroupsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'succeeded',
+      label: 'Contact Groups Read',
+      labelKey: 'formattedName',
+      listItems: contactGroupSummaryFields,
+    },
+    {
+      key: 'failed',
+      label: 'Failures',
+      labelKey: 'resourceName',
+      listItems: batchFailureFields,
+    },
+    { key: 'succeededCount', label: 'Succeeded Count', format: 'number' },
+    { key: 'failedCount', label: 'Failed Count', format: 'number' },
+  ],
+};
+
+export const createContactGroupOutputSchema: OutputSchema = {
+  fields: [
+    { key: 'created', label: 'Created', format: 'boolean' },
+    {
+      key: 'contactGroup',
+      label: 'Contact Group',
+      children: contactGroupSummaryFields,
+    },
+  ],
+};
+
+export const deleteContactGroupOutputSchema: OutputSchema = {
+  fields: [
+    { key: 'deleted', label: 'Deleted', format: 'boolean' },
+    { key: 'resourceName', label: 'Resource Name' },
+    { key: 'deletedContacts', label: 'Contacts Also Deleted', format: 'boolean' },
+  ],
+};
+
+export const modifyContactGroupMembersOutputSchema: OutputSchema = {
+  fields: [
+    { key: 'resourceName', label: 'Contact Group Resource Name' },
+    { key: 'added', label: 'Added Contacts' },
+    { key: 'removed', label: 'Removed Contacts' },
+    { key: 'notFoundResourceNames', label: 'Not Found Contacts' },
+    {
+      key: 'canNotRemoveLastContactGroupResourceNames',
+      label: 'Cannot Remove Last Group',
+    },
+  ],
+};
diff --git a/packages/pieces/community/pushover/package.json b/packages/pieces/community/pushover/package.json
index c4bfc18feacd..66e862be7b3e 100644
--- a/packages/pieces/community/pushover/package.json
+++ b/packages/pieces/community/pushover/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@activepieces/piece-pushover",
-  "version": "0.2.8",
+  "version": "0.2.9",
   "main": "./dist/src/index.js",
   "types": "./dist/src/index.d.ts",
   "scripts": {
diff --git a/packages/pieces/community/pushover/src/i18n/translation.json b/packages/pieces/community/pushover/src/i18n/translation.json
index c765d41f4ea3..cefe1d56675f 100644
--- a/packages/pieces/community/pushover/src/i18n/translation.json
+++ b/packages/pieces/community/pushover/src/i18n/translation.json
@@ -6,7 +6,45 @@
   "Pushover User Key": "Pushover User Key",
   "\n    To obtain the api token:\n\n    1. Log in to Pushover.\n    2. Click on your Application or on Create an Application/API Token\n    3. Copy the API Token/Key.\n\n    To obtain the user key:\n    1. Log in to Pushover\n    2. Copy your Your User Key\n\n    Note if you want to send the message to your group, you should specify a group key instead of the user key\n    ": "\n    To obtain the api token:\n\n    1. Log in to Pushover.\n    2. Click on your Application or on Create an Application/API Token\n    3. Copy the API Token/Key.\n\n    To obtain the user key:\n    1. Log in to Pushover\n    2. Copy your Your User Key\n\n    Note if you want to send the message to your group, you should specify a group key instead of the user key\n    ",
   "Send Notification": "Send Notification",
+  "Send Push Message": "Send Push Message",
+  "Get Emergency Receipt Status": "Get Emergency Receipt Status",
+  "Cancel Emergency Retries": "Cancel Emergency Retries",
+  "Cancel Emergency Retries by Tag": "Cancel Emergency Retries by Tag",
+  "Validate User or Group Key": "Validate User or Group Key",
+  "Get Monthly Message Limits": "Get Monthly Message Limits",
+  "Update Glance Widget": "Update Glance Widget",
+  "List Delivery Groups": "List Delivery Groups",
+  "Get Delivery Group": "Get Delivery Group",
+  "Create Delivery Group": "Create Delivery Group",
+  "Rename Delivery Group": "Rename Delivery Group",
+  "Add User to Delivery Group": "Add User to Delivery Group",
+  "Remove User from Delivery Group": "Remove User from Delivery Group",
+  "Disable Group User": "Disable Group User",
+  "Enable Group User": "Enable Group User",
+  "Get License Credits": "Get License Credits",
+  "Assign License": "Assign License",
+  "List Notification Sounds": "List Notification Sounds",
+  "Migrate User to Subscription": "Migrate User to Subscription",
   "Send a notification to Pushover": "Send a notification to Pushover",
+  "Send a push message through Pushover with the full parameter set": "Send a push message through Pushover with the full parameter set",
+  "Read the acknowledgement status of an emergency notification receipt": "Read the acknowledgement status of an emergency notification receipt",
+  "Stop the retry loop of one emergency notification receipt": "Stop the retry loop of one emergency notification receipt",
+  "Stop the retry loops of every emergency notification carrying a tag": "Stop the retry loops of every emergency notification carrying a tag",
+  "Check whether a Pushover user or group key is valid and reachable": "Check whether a Pushover user or group key is valid and reachable",
+  "Read the monthly message allowance and remaining quota of the application": "Read the monthly message allowance and remaining quota of the application",
+  "Update the Pushover glance widget fields on the user devices": "Update the Pushover glance widget fields on the user devices",
+  "List the delivery groups owned by the Pushover account": "List the delivery groups owned by the Pushover account",
+  "Read the name and members of one Pushover delivery group": "Read the name and members of one Pushover delivery group",
+  "Create a Pushover delivery group, or return the existing one with that name": "Create a Pushover delivery group, or return the existing one with that name",
+  "Change the name of a Pushover delivery group": "Change the name of a Pushover delivery group",
+  "Add a user key as a member of a Pushover delivery group": "Add a user key as a member of a Pushover delivery group",
+  "Permanently remove a member from a Pushover delivery group": "Permanently remove a member from a Pushover delivery group",
+  "Temporarily stop a group member from receiving group messages": "Temporarily stop a group member from receiving group messages",
+  "Resume group deliveries to a suspended group member": "Resume group deliveries to a suspended group member",
+  "Read how many prepaid Pushover license credits remain": "Read how many prepaid Pushover license credits remain",
+  "Spend a prepaid credit to license a Pushover user": "Spend a prepaid credit to license a Pushover user",
+  "List the notification sound identifiers Pushover accepts": "List the notification sound identifiers Pushover accepts",
+  "Convert an existing user key into a subscribed user key": "Convert an existing user key into a subscribed user key",
   "Title": "Title",
   "Message": "Message",
   "Enable HTML": "Enable HTML",
@@ -17,6 +55,28 @@
   "URL Title": "URL Title",
   "Timestamp": "Timestamp",
   "Device": "Device",
+  "Time To Live": "Time To Live",
+  "Sound": "Sound",
+  "Monospace": "Monospace",
+  "Tags": "Tags",
+  "Callback URL": "Callback URL",
+  "Attachment (Base64)": "Attachment (Base64)",
+  "Attachment Type": "Attachment Type",
+  "Receipt": "Receipt",
+  "Tag": "Tag",
+  "User or Group Key": "User or Group Key",
+  "Text": "Text",
+  "Subtext": "Subtext",
+  "Count": "Count",
+  "Percent": "Percent",
+  "Group Key": "Group Key",
+  "Name": "Name",
+  "New Name": "New Name",
+  "Memo": "Memo",
+  "Email": "Email",
+  "Operating System": "Operating System",
+  "Subscription Code": "Subscription Code",
+  "Device Name": "Device Name",
   "The title of the notification": "The title of the notification",
   "The message to send": "The message to send",
   "To enable HTML parsing": "To enable HTML parsing",
@@ -26,5 +86,58 @@
   "A supplementary URL to show with your message.": "A supplementary URL to show with your message.",
   "A title for the URL specified as the url input parameter, otherwise just the URL is shown.": "A title for the URL specified as the url input parameter, otherwise just the URL is shown.",
   "a Unix timestamp of a time to display instead of when our API received it.": "a Unix timestamp of a time to display instead of when our API received it.",
-  "The name of one of your devices to send just to that device instead of all devices.": "The name of one of your devices to send just to that device instead of all devices."
+  "The name of one of your devices to send just to that device instead of all devices.": "The name of one of your devices to send just to that device instead of all devices.",
+  "Body of the notification. Required.": "Body of the notification. Required.",
+  "Title shown above the message. Defaults to the application name when omitted.": "Title shown above the message. Defaults to the application name when omitted.",
+  "Delivery urgency. 2 (emergency) additionally requires Retry and Expire, ignores Time To Live, and returns a receipt.": "Delivery urgency. 2 (emergency) additionally requires Retry and Expire, ignores Time To Live, and returns a receipt.",
+  "Emergency priority only. Seconds between repeat deliveries, minimum 30. Pushover stops after 50 retries even if Expire has not elapsed.": "Emergency priority only. Seconds between repeat deliveries, minimum 30. Pushover stops after 50 retries even if Expire has not elapsed.",
+  "Emergency priority only. Seconds to keep retrying for, maximum 10800.": "Emergency priority only. Seconds to keep retrying for, maximum 10800.",
+  "Seconds after which the notification is auto-deleted from the device. Ignored at emergency priority (2).": "Seconds after which the notification is auto-deleted from the device. Ignored at emergency priority (2).",
+  "Notification sound. Leave on the default option to omit the parameter so the recipient device sound applies.": "Notification sound. Leave on the default option to omit the parameter so the recipient device sound applies.",
+  "Supplementary URL shown with the message, for example 'https://status.example.com/incident/42'.": "Supplementary URL shown with the message, for example 'https://status.example.com/incident/42'.",
+  "Link text for the supplementary URL. The raw URL is shown when omitted.": "Link text for the supplementary URL. The raw URL is shown when omitted.",
+  "Deliver only to this device name, for example 'iphone'. All devices receive it when omitted.": "Deliver only to this device name, for example 'iphone'. All devices receive it when omitted.",
+  "Unix timestamp to display instead of the receive time, for example '1767225600'.": "Unix timestamp to display instead of the receive time, for example '1767225600'.",
+  "Parse a limited HTML subset in the message. Cannot be combined with Monospace.": "Parse a limited HTML subset in the message. Cannot be combined with Monospace.",
+  "Render the message in a monospace font. Cannot be combined with Enable HTML.": "Render the message in a monospace font. Cannot be combined with Enable HTML.",
+  "Comma-separated tags stored with an emergency notification, for example 'deploy,prod'. Required upfront if you intend to use Cancel Emergency Retries by Tag.": "Comma-separated tags stored with an emergency notification, for example 'deploy,prod'. Required upfront if you intend to use Cancel Emergency Retries by Tag.",
+  "Emergency priority only. Pushover POSTs to this URL once the notification is acknowledged.": "Emergency priority only. Pushover POSTs to this URL once the notification is acknowledged.",
+  "Base64-encoded image to attach, maximum 5242880 bytes decoded. Requires Attachment Type.": "Base64-encoded image to attach, maximum 5242880 bytes decoded. Requires Attachment Type.",
+  "MIME type of the attachment, for example 'image/jpeg'. Required when an attachment is supplied.": "MIME type of the attachment, for example 'image/jpeg'. Required when an attachment is supplied.",
+  "Receipt id returned by Send Push Message at emergency priority, for example rXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.": "Receipt id returned by Send Push Message at emergency priority, for example rXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.",
+  "Receipt id returned by Send Push Message at emergency priority (2).": "Receipt id returned by Send Push Message at emergency priority (2).",
+  "A single tag that was supplied in the Tags parameter at send time, for example deploy. One tag only, with no spaces or slashes.": "A single tag that was supplied in the Tags parameter at send time, for example deploy. One tag only, with no spaces or slashes.",
+  "The 30-character user or group key to validate. Defaults to the key stored on the connection when left blank.": "The 30-character user or group key to validate. Defaults to the key stored on the connection when left blank.",
+  "Optional device name to validate alongside the key, for example iphone.": "Optional device name to validate alongside the key, for example iphone.",
+  "Short description of the data, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.": "Short description of the data, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.",
+  "Main line of text, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.": "Main line of text, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.",
+  "Second line of text, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.": "Second line of text, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.",
+  "Integer shown on the widget, may be negative. Omit to leave unchanged.": "Integer shown on the widget, may be negative. Omit to leave unchanged.",
+  "Integer from 0 to 100 rendered as a progress bar. Omit to leave unchanged.": "Integer from 0 to 100 rendered as a progress bar. Omit to leave unchanged.",
+  "Update only this device name. All devices are updated when omitted.": "Update only this device name. All devices are updated when omitted.",
+  "The 30-character delivery group key. Resolve it with List Delivery Groups; this is not the user key stored on the connection.": "The 30-character delivery group key. Resolve it with List Delivery Groups; this is not the user key stored on the connection.",
+  "Name of the delivery group, for example On-Call Engineers. Matching against existing groups ignores case, and the name is returned exactly as Pushover stores it.": "Name of the delivery group, for example On-Call Engineers. Matching against existing groups ignores case, and the name is returned exactly as Pushover stores it.",
+  "The 30-character delivery group key. Resolve it with List Delivery Groups.": "The 30-character delivery group key. Resolve it with List Delivery Groups.",
+  "The new group name, for example Weekend On-Call.": "The new group name, for example Weekend On-Call.",
+  "The 30-character user key of the person to add.": "The 30-character user key of the person to add.",
+  "Limit group deliveries to this one device of the user. All of their devices receive them when omitted.": "Limit group deliveries to this one device of the user. All of their devices receive them when omitted.",
+  "Note stored with the membership, maximum 200 characters, for example Primary on-call.": "Note stored with the membership, maximum 200 characters, for example Primary on-call.",
+  "The 30-character user key of the member to remove. Confirm membership with Get Delivery Group first.": "The 30-character user key of the member to remove. Confirm membership with Get Delivery Group first.",
+  "The 30-character user key of the member to suspend. Confirm membership with Get Delivery Group first.": "The 30-character user key of the member to suspend. Confirm membership with Get Delivery Group first.",
+  "The 30-character user key of the suspended member. Confirm membership with Get Delivery Group first.": "The 30-character user key of the suspended member. Confirm membership with Get Delivery Group first.",
+  "The 30-character user key to license. Supply either this or Email, not both.": "The 30-character user key to license. Supply either this or Email, not both.",
+  "Pushover account email of the person to license, used when their user key is unknown. Supply either this or User Key, not both.": "Pushover account email of the person to license, used when their user key is unknown. Supply either this or User Key, not both.",
+  "Restrict the license to one platform. Any platform may be used when omitted.": "Restrict the license to one platform. Any platform may be used when omitted.",
+  "The subscription code shown on the Pushover subscription page, for example sABCDEFGHIJKLMNOPQRSTUVWXYZ.": "The subscription code shown on the Pushover subscription page, for example sABCDEFGHIJKLMNOPQRSTUVWXYZ.",
+  "The existing 30-character user key to migrate. Defaults to the key stored on the connection when left blank.": "The existing 30-character user key to migrate. Defaults to the key stored on the connection when left blank.",
+  "Migrate only this one device of the user instead of the whole account.": "Migrate only this one device of the user instead of the whole account.",
+  "Default sound to set on the migrated subscription. Resolve an identifier with List Notification Sounds.": "Default sound to set on the migrated subscription. Resolve an identifier with List Notification Sounds.",
+  "Lowest (-2, no notification)": "Lowest (-2, no notification)",
+  "Low (-1, no sound or vibration)": "Low (-1, no sound or vibration)",
+  "Normal (0)": "Normal (0)",
+  "High (1, bypasses quiet hours)": "High (1, bypasses quiet hours)",
+  "Emergency (2, repeats until acknowledged)": "Emergency (2, repeats until acknowledged)",
+  "Android": "Android",
+  "iOS": "iOS",
+  "Desktop": "Desktop"
 }
\ No newline at end of file
diff --git a/packages/pieces/community/pushover/src/index.ts b/packages/pieces/community/pushover/src/index.ts
index d8cc61983a3a..3de8dae7c841 100644
--- a/packages/pieces/community/pushover/src/index.ts
+++ b/packages/pieces/community/pushover/src/index.ts
@@ -1,6 +1,25 @@
 import { PieceAuth, createPiece } from '@activepieces/pieces-framework';
 import { PieceCategory } from '@activepieces/pieces-framework';
 import { sendNotification } from './lib/actions/send-notification';
+import { sendPushMessage } from './lib/actions/send-push-message';
+import { getReceiptStatus } from './lib/actions/get-receipt-status';
+import { cancelEmergencyRetries } from './lib/actions/cancel-emergency-retries';
+import { cancelEmergencyRetriesByTag } from './lib/actions/cancel-emergency-retries-by-tag';
+import { validateUserKey } from './lib/actions/validate-user-key';
+import { getAppLimits } from './lib/actions/get-app-limits';
+import { updateGlance } from './lib/actions/update-glance';
+import { listDeliveryGroups } from './lib/actions/list-delivery-groups';
+import { getDeliveryGroup } from './lib/actions/get-delivery-group';
+import { createDeliveryGroup } from './lib/actions/create-delivery-group';
+import { renameDeliveryGroup } from './lib/actions/rename-delivery-group';
+import { addUserToGroup } from './lib/actions/add-user-to-group';
+import { removeUserFromGroup } from './lib/actions/remove-user-from-group';
+import { disableGroupUser } from './lib/actions/disable-group-user';
+import { enableGroupUser } from './lib/actions/enable-group-user';
+import { getLicenseCredits } from './lib/actions/get-license-credits';
+import { assignLicense } from './lib/actions/assign-license';
+import { listNotificationSounds } from './lib/actions/list-notification-sounds';
+import { migrateUserToSubscription } from './lib/actions/migrate-user-to-subscription';
 
 export const pushoverAuth = PieceAuth.CustomAuth({
   description: `
@@ -37,9 +56,30 @@ export const pushover = createPiece({
 
   logoUrl: 'https://cdn.activepieces.com/pieces/pushover.png',
   categories: [PieceCategory.COMMUNICATION],
-  minimumSupportedRelease: '0.30.0',
+  minimumSupportedRelease: '0.87.0',
   authors: ["MyWay","Vitalini","kishanprmr","khaledmashaly","abuaboud"],
   auth: pushoverAuth,
-  actions: [sendNotification],
+  actions: [
+    sendNotification,
+    sendPushMessage,
+    getReceiptStatus,
+    cancelEmergencyRetries,
+    cancelEmergencyRetriesByTag,
+    validateUserKey,
+    getAppLimits,
+    updateGlance,
+    listDeliveryGroups,
+    getDeliveryGroup,
+    createDeliveryGroup,
+    renameDeliveryGroup,
+    addUserToGroup,
+    removeUserFromGroup,
+    disableGroupUser,
+    enableGroupUser,
+    getLicenseCredits,
+    assignLicense,
+    listNotificationSounds,
+    migrateUserToSubscription,
+  ],
   triggers: [],
 });
diff --git a/packages/pieces/community/pushover/src/lib/actions/add-user-to-group.ts b/packages/pieces/community/pushover/src/lib/actions/add-user-to-group.ts
new file mode 100644
index 000000000000..3dc1de85ed0a
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/add-user-to-group.ts
@@ -0,0 +1,58 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { GROUP_OWNERSHIP_HINT, pushoverApiCall } from '../common';
+import { addUserToGroupOutputSchema } from '../output-schemas';
+
+export const addUserToGroup = createAction({
+  auth: pushoverAuth,
+  name: 'add_user_to_group',
+  classification: 'WRITE',
+  displayName: 'Add User to Delivery Group',
+  description: 'Add a user key as a member of a Pushover delivery group',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Add one user key to a delivery group so the group key also delivers to them. Resolve the group key with List Delivery Groups and validate the user key with Validate User or Group Key first. Not idempotent: adding a user who is already a member fails, so check the members with Get Delivery Group before retrying. To restore a suspended member use Enable Group User instead.',
+    idempotent: false,
+  },
+  props: {
+    group_key: Property.ShortText({
+      displayName: 'Group Key',
+      description:
+        'The 30-character delivery group key. Resolve it with List Delivery Groups.',
+      required: true,
+    }),
+    user: Property.ShortText({
+      displayName: 'User Key',
+      description: 'The 30-character user key of the person to add.',
+      required: true,
+    }),
+    device: Property.ShortText({
+      displayName: 'Device',
+      description:
+        'Limit group deliveries to this one device of the user. All of their devices receive them when omitted.',
+      required: false,
+    }),
+    memo: Property.ShortText({
+      displayName: 'Memo',
+      description:
+        'Note stored with the membership, maximum 200 characters, for example Primary on-call.',
+      required: false,
+    }),
+  },
+  outputSchema: addUserToGroupOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: `/groups/${encodeURIComponent(propsValue.group_key)}/add_user.json`,
+      body: {
+        token: auth.props.api_token,
+        user: propsValue.user,
+        ...(propsValue.device ? { device: propsValue.device } : {}),
+        ...(propsValue.memo ? { memo: propsValue.memo } : {}),
+      },
+      errorHint: GROUP_OWNERSHIP_HINT,
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/assign-license.ts b/packages/pieces/community/pushover/src/lib/actions/assign-license.ts
new file mode 100644
index 000000000000..9ba5e673797b
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/assign-license.ts
@@ -0,0 +1,66 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+
+export const assignLicense = createAction({
+  auth: pushoverAuth,
+  name: 'assign_license',
+  classification: 'WRITE',
+  displayName: 'Assign License',
+  description: 'Spend a prepaid credit to license a Pushover user',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Assign a Pushover license to one user, identified by either their user key or their account email. This spends one prepaid credit, costs real money and cannot be revoked: there is no unassign endpoint. Check the balance with Get License Credits first and only call it when a human has explicitly asked for this person to be licensed. Not idempotent: a repeat call spends another credit.',
+    idempotent: false,
+  },
+  props: {
+    user: Property.ShortText({
+      displayName: 'User Key',
+      description:
+        'The 30-character user key to license. Supply either this or Email, not both.',
+      required: false,
+    }),
+    email: Property.ShortText({
+      displayName: 'Email',
+      description:
+        'Pushover account email of the person to license, used when their user key is unknown. Supply either this or User Key, not both.',
+      required: false,
+    }),
+    os: Property.StaticDropdown({
+      displayName: 'Operating System',
+      description:
+        'Restrict the license to one platform. Any platform may be used when omitted.',
+      required: false,
+      options: {
+        options: [
+          { label: 'Android', value: 'Android' },
+          { label: 'iOS', value: 'iOS' },
+          { label: 'Desktop', value: 'Desktop' },
+        ],
+      },
+    }),
+  },
+  async run({ auth, propsValue }) {
+    const hasUser = propsValue.user !== undefined && propsValue.user.length > 0;
+    const hasEmail =
+      propsValue.email !== undefined && propsValue.email.length > 0;
+    if (hasUser === hasEmail) {
+      throw new Error(
+        'Assign License needs exactly one of User Key or Email to identify the recipient.'
+      );
+    }
+
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: '/licenses/assign.json',
+      body: {
+        token: auth.props.api_token,
+        ...(hasUser ? { user: propsValue.user } : {}),
+        ...(hasEmail ? { email: propsValue.email } : {}),
+        ...(propsValue.os ? { os: propsValue.os } : {}),
+      },
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/cancel-emergency-retries-by-tag.ts b/packages/pieces/community/pushover/src/lib/actions/cancel-emergency-retries-by-tag.ts
new file mode 100644
index 000000000000..621f918039c3
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/cancel-emergency-retries-by-tag.ts
@@ -0,0 +1,35 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+import { cancelEmergencyRetriesByTagOutputSchema } from '../output-schemas';
+
+export const cancelEmergencyRetriesByTag = createAction({
+  auth: pushoverAuth,
+  name: 'cancel_emergency_retries_by_tag',
+  classification: 'WRITE',
+  displayName: 'Cancel Emergency Retries by Tag',
+  description: 'Stop the retry loops of every emergency notification carrying a tag',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Stop the retries of every still-active emergency (priority 2) notification sent with this tag. The tag must have been supplied in the Tags parameter of Send Push Message at send time; tags cannot be attached afterwards. Use Cancel Emergency Retries when you hold a single receipt instead. Safe to retry: it is a no-op once nothing with the tag is retrying.',
+    idempotent: true,
+  },
+  props: {
+    tag: Property.ShortText({
+      displayName: 'Tag',
+      description:
+        'A single tag that was supplied in the Tags parameter at send time, for example deploy. One tag only, with no spaces or slashes.',
+      required: true,
+    }),
+  },
+  outputSchema: cancelEmergencyRetriesByTagOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: `/receipts/cancel_by_tag/${encodeURIComponent(propsValue.tag)}.json`,
+      body: { token: auth.props.api_token },
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/cancel-emergency-retries.ts b/packages/pieces/community/pushover/src/lib/actions/cancel-emergency-retries.ts
new file mode 100644
index 000000000000..62d31aa36288
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/cancel-emergency-retries.ts
@@ -0,0 +1,37 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+import { cancelEmergencyRetriesOutputSchema } from '../output-schemas';
+
+export const cancelEmergencyRetries = createAction({
+  auth: pushoverAuth,
+  name: 'cancel_emergency_retries',
+  classification: 'WRITE',
+  displayName: 'Cancel Emergency Retries',
+  description: 'Stop the retry loop of one emergency notification receipt',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Stop Pushover from resending one emergency (priority 2) notification, identified by the receipt returned by Send Push Message. Use it once the underlying incident is resolved so the recipient stops being re-alerted; it deletes nothing and already-delivered notifications stay. To stop many notifications at once use Cancel Emergency Retries by Tag. Safe to retry: cancelling an already-cancelled receipt is a no-op.',
+    idempotent: true,
+  },
+  props: {
+    receipt: Property.ShortText({
+      displayName: 'Receipt',
+      description:
+        'Receipt id returned by Send Push Message at emergency priority (2).',
+      required: true,
+    }),
+  },
+  outputSchema: cancelEmergencyRetriesOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: `/receipts/${encodeURIComponent(propsValue.receipt)}/cancel.json`,
+      body: { token: auth.props.api_token },
+      errorHint:
+        'Receipts expire after about one week and only exist for priority 2 notifications.',
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/create-delivery-group.ts b/packages/pieces/community/pushover/src/lib/actions/create-delivery-group.ts
new file mode 100644
index 000000000000..a943c21df0d3
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/create-delivery-group.ts
@@ -0,0 +1,128 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import {
+  GROUP_OWNERSHIP_HINT,
+  PushoverRequestError,
+  pushoverApiCall,
+} from '../common';
+import { createDeliveryGroupOutputSchema } from '../output-schemas';
+
+export const createDeliveryGroup = createAction({
+  auth: pushoverAuth,
+  name: 'create_delivery_group',
+  classification: 'WRITE',
+  displayName: 'Create Delivery Group',
+  description: 'Create a Pushover delivery group, or return the existing one with that name',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Get or create a delivery group by name and return its group key. Pushover allows only one group per name on an account, so this action lists the existing groups first and returns the case-insensitive match with created=false instead of failing; it only creates when the name is unused, returning created=true. Safe to retry: a second call with the same name returns the same group key. Add members afterwards with Add User to Delivery Group.',
+    idempotent: true,
+  },
+  props: {
+    name: Property.ShortText({
+      displayName: 'Name',
+      description:
+        'Name of the delivery group, for example On-Call Engineers. Matching against existing groups ignores case, and the name is returned exactly as Pushover stores it.',
+      required: true,
+    }),
+  },
+  outputSchema: createDeliveryGroupOutputSchema,
+  async run({ auth, propsValue }) {
+    const existing = await findGroupByName({
+      apiToken: auth.props.api_token,
+      name: propsValue.name,
+    });
+    if (existing !== undefined) {
+      return {
+        group: existing.group,
+        name: existing.name,
+        created: false,
+      };
+    }
+
+    try {
+      const created = await pushoverApiCall<CreateGroupResponse>({
+        method: HttpMethod.POST,
+        resourceUri: '/groups.json',
+        body: {
+          token: auth.props.api_token,
+          name: propsValue.name,
+        },
+        errorHint: GROUP_OWNERSHIP_HINT,
+      });
+
+      return {
+        group: created.group,
+        name: propsValue.name,
+        created: true,
+      };
+    } catch (error) {
+      if (!isNameAlreadyTakenError(error)) {
+        throw error;
+      }
+      const raced = await findGroupByName({
+        apiToken: auth.props.api_token,
+        name: propsValue.name,
+      });
+      if (raced === undefined) {
+        throw error;
+      }
+      return {
+        group: raced.group,
+        name: raced.name,
+        created: false,
+      };
+    }
+  },
+});
+
+async function findGroupByName({
+  apiToken,
+  name,
+}: FindGroupByNameParams): Promise<PushoverGroup | undefined> {
+  const existingGroups = await pushoverApiCall<GroupsResponse>({
+    method: HttpMethod.GET,
+    resourceUri: '/groups.json',
+    queryParams: { token: apiToken },
+    errorHint: GROUP_OWNERSHIP_HINT,
+  });
+  const wanted = name.trim().toLowerCase();
+  return (existingGroups.groups ?? []).find(
+    (group) => group.name.trim().toLowerCase() === wanted
+  );
+}
+
+function isNameAlreadyTakenError(error: unknown): boolean {
+  if (error instanceof PushoverRequestError) {
+    if (error.status !== undefined && error.status >= 500) {
+      return false;
+    }
+    if (error.vendorErrors.length > 0) {
+      return error.vendorErrors.some((entry) => NAME_TAKEN_PATTERN.test(entry));
+    }
+  }
+  const message = error instanceof Error ? error.message : String(error);
+  return NAME_TAKEN_PATTERN.test(message);
+}
+
+const NAME_TAKEN_PATTERN = /already (exists|been taken|in use)|has already been|must be unique/i;
+
+type PushoverGroup = {
+  group: string;
+  name: string;
+};
+
+type GroupsResponse = {
+  groups: PushoverGroup[];
+};
+
+type FindGroupByNameParams = {
+  apiToken: string;
+  name: string;
+};
+
+type CreateGroupResponse = {
+  group: string;
+};
diff --git a/packages/pieces/community/pushover/src/lib/actions/disable-group-user.ts b/packages/pieces/community/pushover/src/lib/actions/disable-group-user.ts
new file mode 100644
index 000000000000..edbccc04b08e
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/disable-group-user.ts
@@ -0,0 +1,45 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { GROUP_OWNERSHIP_HINT, pushoverApiCall } from '../common';
+import { disableGroupUserOutputSchema } from '../output-schemas';
+
+export const disableGroupUser = createAction({
+  auth: pushoverAuth,
+  name: 'disable_group_user',
+  classification: 'WRITE',
+  displayName: 'Disable Group User',
+  description: 'Temporarily stop a group member from receiving group messages',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Suspend one member of a delivery group so group messages skip them while their membership, device and memo are kept. This is the reversible alternative to Remove User from Delivery Group: undo it with Enable Group User. Safe to retry: disabling an already-disabled member converges on the same state.',
+    idempotent: true,
+  },
+  props: {
+    group_key: Property.ShortText({
+      displayName: 'Group Key',
+      description:
+        'The 30-character delivery group key. Resolve it with List Delivery Groups.',
+      required: true,
+    }),
+    user: Property.ShortText({
+      displayName: 'User Key',
+      description:
+        'The 30-character user key of the member to suspend. Confirm membership with Get Delivery Group first.',
+      required: true,
+    }),
+  },
+  outputSchema: disableGroupUserOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: `/groups/${encodeURIComponent(propsValue.group_key)}/disable_user.json`,
+      body: {
+        token: auth.props.api_token,
+        user: propsValue.user,
+      },
+      errorHint: GROUP_OWNERSHIP_HINT,
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/enable-group-user.ts b/packages/pieces/community/pushover/src/lib/actions/enable-group-user.ts
new file mode 100644
index 000000000000..b6315a9fff4d
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/enable-group-user.ts
@@ -0,0 +1,45 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { GROUP_OWNERSHIP_HINT, pushoverApiCall } from '../common';
+import { enableGroupUserOutputSchema } from '../output-schemas';
+
+export const enableGroupUser = createAction({
+  auth: pushoverAuth,
+  name: 'enable_group_user',
+  classification: 'WRITE',
+  displayName: 'Enable Group User',
+  description: 'Resume group deliveries to a suspended group member',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Re-enable a member of a delivery group who was suspended with Disable Group User, so group messages reach them again. It only works on someone who is still a member: a user removed with Remove User from Delivery Group has to be re-added with Add User to Delivery Group. Safe to retry: enabling an already-enabled member converges on the same state.',
+    idempotent: true,
+  },
+  props: {
+    group_key: Property.ShortText({
+      displayName: 'Group Key',
+      description:
+        'The 30-character delivery group key. Resolve it with List Delivery Groups.',
+      required: true,
+    }),
+    user: Property.ShortText({
+      displayName: 'User Key',
+      description:
+        'The 30-character user key of the suspended member. Confirm membership with Get Delivery Group first.',
+      required: true,
+    }),
+  },
+  outputSchema: enableGroupUserOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: `/groups/${encodeURIComponent(propsValue.group_key)}/enable_user.json`,
+      body: {
+        token: auth.props.api_token,
+        user: propsValue.user,
+      },
+      errorHint: GROUP_OWNERSHIP_HINT,
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/get-app-limits.ts b/packages/pieces/community/pushover/src/lib/actions/get-app-limits.ts
new file mode 100644
index 000000000000..b48d4032b4a0
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/get-app-limits.ts
@@ -0,0 +1,28 @@
+import { createAction } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+import { getAppLimitsOutputSchema } from '../output-schemas';
+
+export const getAppLimits = createAction({
+  auth: pushoverAuth,
+  name: 'get_app_limits',
+  classification: 'READ',
+  displayName: 'Get Monthly Message Limits',
+  description: 'Read the monthly message allowance and remaining quota of the application',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Read the monthly message allowance of the application, how many messages remain, and the Unix timestamp when the counter resets. Use it before a bulk send, or to explain a 429 from Send Push Message, which means the monthly quota is exhausted rather than transient throttling. Takes no input. Safe to retry.',
+    idempotent: true,
+  },
+  props: {},
+  outputSchema: getAppLimitsOutputSchema,
+  async run({ auth }) {
+    return await pushoverApiCall({
+      method: HttpMethod.GET,
+      resourceUri: '/apps/limits.json',
+      queryParams: { token: auth.props.api_token },
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/get-delivery-group.ts b/packages/pieces/community/pushover/src/lib/actions/get-delivery-group.ts
new file mode 100644
index 000000000000..9e207ad374cf
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/get-delivery-group.ts
@@ -0,0 +1,36 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { GROUP_OWNERSHIP_HINT, pushoverApiCall } from '../common';
+import { getDeliveryGroupOutputSchema } from '../output-schemas';
+
+export const getDeliveryGroup = createAction({
+  auth: pushoverAuth,
+  name: 'get_delivery_group',
+  classification: 'READ',
+  displayName: 'Get Delivery Group',
+  description: 'Read the name and members of one Pushover delivery group',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Read one delivery group: its name and every member, including each member device, memo and whether the member is currently disabled. Use it to check membership before adding, removing, disabling or enabling a user. Resolve the group key with List Delivery Groups first. Safe to retry.',
+    idempotent: true,
+  },
+  props: {
+    group_key: Property.ShortText({
+      displayName: 'Group Key',
+      description:
+        'The 30-character delivery group key. Resolve it with List Delivery Groups; this is not the user key stored on the connection.',
+      required: true,
+    }),
+  },
+  outputSchema: getDeliveryGroupOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.GET,
+      resourceUri: `/groups/${encodeURIComponent(propsValue.group_key)}.json`,
+      queryParams: { token: auth.props.api_token },
+      errorHint: GROUP_OWNERSHIP_HINT,
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/get-license-credits.ts b/packages/pieces/community/pushover/src/lib/actions/get-license-credits.ts
new file mode 100644
index 000000000000..640b221ea4bd
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/get-license-credits.ts
@@ -0,0 +1,28 @@
+import { createAction } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+import { getLicenseCreditsOutputSchema } from '../output-schemas';
+
+export const getLicenseCredits = createAction({
+  auth: pushoverAuth,
+  name: 'get_license_credits',
+  classification: 'READ',
+  displayName: 'Get License Credits',
+  description: 'Read how many prepaid Pushover license credits remain',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Read how many prepaid Pushover license credits the application still holds. Call it before Assign License, which spends one credit irreversibly. Takes no input. Safe to retry.',
+    idempotent: true,
+  },
+  props: {},
+  outputSchema: getLicenseCreditsOutputSchema,
+  async run({ auth }) {
+    return await pushoverApiCall({
+      method: HttpMethod.GET,
+      resourceUri: '/licenses.json',
+      queryParams: { token: auth.props.api_token },
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/get-receipt-status.ts b/packages/pieces/community/pushover/src/lib/actions/get-receipt-status.ts
new file mode 100644
index 000000000000..cc07ce8c0fa6
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/get-receipt-status.ts
@@ -0,0 +1,37 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+import { getReceiptStatusOutputSchema } from '../output-schemas';
+
+export const getReceiptStatus = createAction({
+  auth: pushoverAuth,
+  name: 'get_receipt_status',
+  classification: 'READ',
+  displayName: 'Get Emergency Receipt Status',
+  description: 'Read the acknowledgement status of an emergency notification receipt',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Read whether an emergency (priority 2) notification has been acknowledged, and whether its retries have expired. The receipt comes from Send Push Message sent at priority 2; no other priority produces one. This is a single read, not a wait loop: re-call it at most once every 5 seconds until acknowledged is 1 or expired is 1. Receipts stay valid for up to one week and older ids return an error. Safe to retry.',
+    idempotent: true,
+  },
+  props: {
+    receipt: Property.ShortText({
+      displayName: 'Receipt',
+      description:
+        'Receipt id returned by Send Push Message at emergency priority, for example rXXXXXXXXXXXXXXXXXXXXXXXXXXXXX.',
+      required: true,
+    }),
+  },
+  outputSchema: getReceiptStatusOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.GET,
+      resourceUri: `/receipts/${encodeURIComponent(propsValue.receipt)}.json`,
+      queryParams: { token: auth.props.api_token },
+      errorHint:
+        'Receipts expire after about one week and only exist for priority 2 notifications.',
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/list-delivery-groups.ts b/packages/pieces/community/pushover/src/lib/actions/list-delivery-groups.ts
new file mode 100644
index 000000000000..586af0d3457f
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/list-delivery-groups.ts
@@ -0,0 +1,43 @@
+import { createAction } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { GROUP_OWNERSHIP_HINT, pushoverApiCall } from '../common';
+import { listDeliveryGroupsOutputSchema } from '../output-schemas';
+
+export const listDeliveryGroups = createAction({
+  auth: pushoverAuth,
+  name: 'list_delivery_groups',
+  classification: 'READ',
+  displayName: 'List Delivery Groups',
+  description: 'List the delivery groups owned by the Pushover account',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'List every delivery group on the account with its group key and name. This is the id resolver for every other group action: call it first to turn a group name into the group key that Get Delivery Group, Add User to Delivery Group and the rest require. Only groups owned by the same account as the application token are visible. Takes no input. Safe to retry.',
+    idempotent: true,
+  },
+  props: {},
+  outputSchema: listDeliveryGroupsOutputSchema,
+  async run({ auth }) {
+    const response = await pushoverApiCall<GroupsResponse>({
+      method: HttpMethod.GET,
+      resourceUri: '/groups.json',
+      queryParams: { token: auth.props.api_token },
+      errorHint: GROUP_OWNERSHIP_HINT,
+    });
+    const groups = response.groups ?? [];
+
+    return {
+      groups,
+      count: groups.length,
+      status: response.status,
+      request: response.request,
+    };
+  },
+});
+
+type GroupsResponse = {
+  groups: { group: string; name: string }[];
+  status: number;
+  request: string;
+};
diff --git a/packages/pieces/community/pushover/src/lib/actions/list-notification-sounds.ts b/packages/pieces/community/pushover/src/lib/actions/list-notification-sounds.ts
new file mode 100644
index 000000000000..fc602962a6fc
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/list-notification-sounds.ts
@@ -0,0 +1,45 @@
+import { createAction } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+import { listNotificationSoundsOutputSchema } from '../output-schemas';
+
+export const listNotificationSounds = createAction({
+  auth: pushoverAuth,
+  name: 'list_notification_sounds',
+  classification: 'READ',
+  displayName: 'List Notification Sounds',
+  description: 'List the notification sound identifiers Pushover accepts',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'List every sound identifier Pushover accepts, each with its human-readable name. Call it to resolve a sound before setting the Sound parameter of Send Push Message instead of guessing an identifier; omit the sound entirely to leave the recipient device default in place. Takes no input. Safe to retry.',
+    idempotent: true,
+  },
+  props: {},
+  outputSchema: listNotificationSoundsOutputSchema,
+  async run({ auth }) {
+    const response = await pushoverApiCall<SoundsResponse>({
+      method: HttpMethod.GET,
+      resourceUri: '/sounds.json',
+      queryParams: { token: auth.props.api_token },
+    });
+    const sounds = Object.entries(response.sounds ?? {}).map(([id, name]) => ({
+      id,
+      name,
+    }));
+
+    return {
+      sounds,
+      count: sounds.length,
+      status: response.status,
+      request: response.request,
+    };
+  },
+});
+
+type SoundsResponse = {
+  sounds: Record<string, string>;
+  status: number;
+  request: string;
+};
diff --git a/packages/pieces/community/pushover/src/lib/actions/migrate-user-to-subscription.ts b/packages/pieces/community/pushover/src/lib/actions/migrate-user-to-subscription.ts
new file mode 100644
index 000000000000..9363cbec8ada
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/migrate-user-to-subscription.ts
@@ -0,0 +1,65 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+
+export const migrateUserToSubscription = createAction({
+  auth: pushoverAuth,
+  name: 'migrate_user_to_subscription',
+  classification: 'WRITE',
+  displayName: 'Migrate User to Subscription',
+  description: 'Convert an existing user key into a subscribed user key',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Convert a user key that already authorised this application into a subscription-specific user key, returning subscribed_user_key. Only meaningful for an application owner running a Pushover subscription, and it needs the subscription code from the subscription page; there is no programmatic way to subscribe someone who has not gone through the subscription URL. Send future messages to the returned key. Not idempotent: call it once per user and store the result.',
+    idempotent: false,
+  },
+  props: {
+    subscription: Property.ShortText({
+      displayName: 'Subscription Code',
+      description:
+        'The subscription code shown on the Pushover subscription page, for example sABCDEFGHIJKLMNOPQRSTUVWXYZ.',
+      required: true,
+    }),
+    user: Property.ShortText({
+      displayName: 'User Key',
+      description:
+        'The existing 30-character user key to migrate. Defaults to the key stored on the connection when left blank.',
+      required: false,
+    }),
+    device_name: Property.ShortText({
+      displayName: 'Device Name',
+      description:
+        'Migrate only this one device of the user instead of the whole account.',
+      required: false,
+    }),
+    sound: Property.ShortText({
+      displayName: 'Sound',
+      description:
+        'Default sound to set on the migrated subscription. Resolve an identifier with List Notification Sounds.',
+      required: false,
+    }),
+  },
+  async run({ auth, propsValue }) {
+    const suppliedUser = propsValue.user;
+    const user =
+      suppliedUser !== undefined && suppliedUser.length > 0
+        ? suppliedUser
+        : auth.props.user_key;
+
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: '/subscriptions/migrate.json',
+      body: {
+        token: auth.props.api_token,
+        subscription: propsValue.subscription,
+        user,
+        ...(propsValue.device_name
+          ? { device_name: propsValue.device_name }
+          : {}),
+        ...(propsValue.sound ? { sound: propsValue.sound } : {}),
+      },
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/remove-user-from-group.ts b/packages/pieces/community/pushover/src/lib/actions/remove-user-from-group.ts
new file mode 100644
index 000000000000..37034ba60d30
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/remove-user-from-group.ts
@@ -0,0 +1,45 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { GROUP_OWNERSHIP_HINT, pushoverApiCall } from '../common';
+import { removeUserFromGroupOutputSchema } from '../output-schemas';
+
+export const removeUserFromGroup = createAction({
+  auth: pushoverAuth,
+  name: 'remove_user_from_group',
+  classification: 'WRITE',
+  displayName: 'Remove User from Delivery Group',
+  description: 'Permanently remove a member from a Pushover delivery group',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Permanently remove a user key from a delivery group, discarding their device and memo settings. Prefer Disable Group User when the person should stop receiving messages only temporarily, since that is reversible with Enable Group User and this is not. Not idempotent: a repeat call for a user who is no longer a member fails with "user is not a member of this group", so confirm membership with Get Delivery Group before retrying. Re-adding afterwards is a fresh membership, not an undo.',
+    idempotent: false,
+  },
+  props: {
+    group_key: Property.ShortText({
+      displayName: 'Group Key',
+      description:
+        'The 30-character delivery group key. Resolve it with List Delivery Groups.',
+      required: true,
+    }),
+    user: Property.ShortText({
+      displayName: 'User Key',
+      description:
+        'The 30-character user key of the member to remove. Confirm membership with Get Delivery Group first.',
+      required: true,
+    }),
+  },
+  outputSchema: removeUserFromGroupOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: `/groups/${encodeURIComponent(propsValue.group_key)}/remove_user.json`,
+      body: {
+        token: auth.props.api_token,
+        user: propsValue.user,
+      },
+      errorHint: GROUP_OWNERSHIP_HINT,
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/rename-delivery-group.ts b/packages/pieces/community/pushover/src/lib/actions/rename-delivery-group.ts
new file mode 100644
index 000000000000..1b05fa97d62e
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/rename-delivery-group.ts
@@ -0,0 +1,44 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { GROUP_OWNERSHIP_HINT, pushoverApiCall } from '../common';
+import { renameDeliveryGroupOutputSchema } from '../output-schemas';
+
+export const renameDeliveryGroup = createAction({
+  auth: pushoverAuth,
+  name: 'rename_delivery_group',
+  classification: 'WRITE',
+  displayName: 'Rename Delivery Group',
+  description: 'Change the name of a Pushover delivery group',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Rename one delivery group. The group key never changes, so existing flows keep delivering. Only one group per name may exist on an account, so renaming onto a name already in use fails: check with List Delivery Groups first. Safe to retry: renaming to the name it already has converges on the same state.',
+    idempotent: true,
+  },
+  props: {
+    group_key: Property.ShortText({
+      displayName: 'Group Key',
+      description:
+        'The 30-character delivery group key. Resolve it with List Delivery Groups.',
+      required: true,
+    }),
+    name: Property.ShortText({
+      displayName: 'New Name',
+      description: 'The new group name, for example Weekend On-Call.',
+      required: true,
+    }),
+  },
+  outputSchema: renameDeliveryGroupOutputSchema,
+  async run({ auth, propsValue }) {
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: `/groups/${encodeURIComponent(propsValue.group_key)}/rename.json`,
+      body: {
+        token: auth.props.api_token,
+        name: propsValue.name,
+      },
+      errorHint: GROUP_OWNERSHIP_HINT,
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/send-notification.ts b/packages/pieces/community/pushover/src/lib/actions/send-notification.ts
index 76df6e33a62f..9a08a4f5b61b 100644
--- a/packages/pieces/community/pushover/src/lib/actions/send-notification.ts
+++ b/packages/pieces/community/pushover/src/lib/actions/send-notification.ts
@@ -1,6 +1,7 @@
 import { createAction, Property } from '@activepieces/pieces-framework';
 import { httpClient, HttpMethod } from '@activepieces/pieces-common';
 import { pushoverAuth } from '../..';
+import { buildMessageBody } from '../common';
 import { sendNotificationActionOutputSchema } from '../output-schemas';
 
 export const sendNotification = createAction({
@@ -9,7 +10,7 @@ export const sendNotification = createAction({
   classification: 'WRITE',
   displayName: 'Send Notification',
   description: 'Send a notification to Pushover',
-  audience: 'both',
+  audience: 'human',
   aiMetadata: {
     description: 'Sends a push notification through Pushover to the device(s) tied to the configured user/group key. Use to alert a person or group on their phone/desktop. The message body is required; optional priority (-2 to 2) controls urgency, and emergency priority (2) additionally requires retry and expire values. Not idempotent: each call delivers a new notification.',
     idempotent: false,
@@ -74,38 +75,25 @@ export const sendNotification = createAction({
   },
   outputSchema: sendNotificationActionOutputSchema,
   async run({ auth, propsValue }) {
-    const baseUrl = 'https://api.pushover.net/1/messages.json';
-    const apiToken = auth.props.api_token;
-    const userKey = auth.props.user_key;
-
-    const title = propsValue.title;
-    const message = propsValue.message;
-    const html = propsValue.html;
-    const priority = propsValue.priority;
-    const url = propsValue.url;
-    const url_title = propsValue.url_title;
-    const timestamp = propsValue.timestamp;
-    const device = propsValue.device;
-    const retry = propsValue.retry;
-    const expire = propsValue.expire;
+    const body = buildMessageBody({
+      apiToken: auth.props.api_token,
+      userKey: auth.props.user_key,
+      message: propsValue.message,
+      title: propsValue.title,
+      html: propsValue.html,
+      priority: propsValue.priority,
+      retry: propsValue.retry,
+      expire: propsValue.expire,
+      url: propsValue.url,
+      urlTitle: propsValue.url_title,
+      timestamp: propsValue.timestamp,
+      device: propsValue.device,
+    });
 
     return await httpClient.sendRequest({
       method: HttpMethod.POST,
-      url: baseUrl,
-      body: {
-        token: apiToken,
-        user: userKey,
-        title,
-        message,
-        html: html ? 1 : 0,
-        url,
-        url_title,
-        timestamp,
-        device,
-        ...(priority && { priority: +priority }),
-        ...(retry && { retry: +retry }),
-        ...(expire && { expire: +expire }),
-      },
+      url: 'https://api.pushover.net/1/messages.json',
+      body,
     });
   },
 });
diff --git a/packages/pieces/community/pushover/src/lib/actions/send-push-message.ts b/packages/pieces/community/pushover/src/lib/actions/send-push-message.ts
new file mode 100644
index 000000000000..a79adf7cb1e7
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/send-push-message.ts
@@ -0,0 +1,188 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { buildMessageBody, pushoverApiCall } from '../common';
+import { sendPushMessageOutputSchema } from '../output-schemas';
+
+export const sendPushMessage = createAction({
+  auth: pushoverAuth,
+  name: 'send_push_message',
+  classification: 'WRITE',
+  displayName: 'Send Push Message',
+  description: 'Send a push message through Pushover with the full parameter set',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Send a push notification to the user or group key on the connection, exposing every Pushover message parameter (sound, ttl, tags, attachment, monospace, callback). Emergency priority 2 requires both retry (>= 30 seconds) and expire (<= 10800 seconds), is capped at 50 total retries regardless of expire (retry=30 with expire=10800 therefore stops after about 25 minutes), ignores ttl, and is the only priority that returns a receipt for Get Emergency Receipt Status and the cancel actions. Not idempotent: every call delivers a new notification.',
+    idempotent: false,
+  },
+  props: {
+    message: Property.LongText({
+      displayName: 'Message',
+      description: 'Body of the notification. Required.',
+      required: true,
+    }),
+    title: Property.ShortText({
+      displayName: 'Title',
+      description:
+        'Title shown above the message. Defaults to the application name when omitted.',
+      required: false,
+    }),
+    priority: Property.StaticDropdown({
+      displayName: 'Priority',
+      description:
+        'Delivery urgency. 2 (emergency) additionally requires Retry and Expire, ignores Time To Live, and returns a receipt.',
+      required: false,
+      options: {
+        options: [
+          { label: 'Lowest (-2, no notification)', value: -2 },
+          { label: 'Low (-1, no sound or vibration)', value: -1 },
+          { label: 'Normal (0)', value: 0 },
+          { label: 'High (1, bypasses quiet hours)', value: 1 },
+          { label: 'Emergency (2, repeats until acknowledged)', value: 2 },
+        ],
+      },
+    }),
+    retry: Property.Number({
+      displayName: 'Retry',
+      description:
+        'Emergency priority only. Seconds between repeat deliveries, minimum 30. Pushover stops after 50 retries even if Expire has not elapsed.',
+      required: false,
+    }),
+    expire: Property.Number({
+      displayName: 'Expire',
+      description:
+        'Emergency priority only. Seconds to keep retrying for, maximum 10800.',
+      required: false,
+    }),
+    ttl: Property.Number({
+      displayName: 'Time To Live',
+      description:
+        'Seconds after which the notification is auto-deleted from the device. Ignored at emergency priority (2).',
+      required: false,
+    }),
+    sound: Property.Dropdown({
+      displayName: 'Sound',
+      description:
+        'Notification sound. Leave on the default option to omit the parameter so the recipient device sound applies.',
+      required: false,
+      auth: pushoverAuth,
+      refreshers: [],
+      options: async ({ auth }) => {
+        if (!auth) {
+          return {
+            disabled: true,
+            placeholder: 'Connect a Pushover account first',
+            options: [],
+          };
+        }
+        const response = await pushoverApiCall<{
+          sounds: Record<string, string>;
+        }>({
+          method: HttpMethod.GET,
+          resourceUri: '/sounds.json',
+          queryParams: { token: auth.props.api_token },
+        });
+        return {
+          disabled: false,
+          options: [
+            { label: "Device default (don't send a sound)", value: '' },
+            ...Object.entries(response.sounds ?? {}).map(
+              ([value, label]) => ({ label, value })
+            ),
+          ],
+        };
+      },
+    }),
+    url: Property.ShortText({
+      displayName: 'URL',
+      description:
+        "Supplementary URL shown with the message, for example 'https://status.example.com/incident/42'.",
+      required: false,
+    }),
+    url_title: Property.ShortText({
+      displayName: 'URL Title',
+      description:
+        'Link text for the supplementary URL. The raw URL is shown when omitted.',
+      required: false,
+    }),
+    device: Property.ShortText({
+      displayName: 'Device',
+      description:
+        "Deliver only to this device name, for example 'iphone'. All devices receive it when omitted.",
+      required: false,
+    }),
+    timestamp: Property.ShortText({
+      displayName: 'Timestamp',
+      description:
+        "Unix timestamp to display instead of the receive time, for example '1767225600'.",
+      required: false,
+    }),
+    html: Property.Checkbox({
+      displayName: 'Enable HTML',
+      description:
+        'Parse a limited HTML subset in the message. Cannot be combined with Monospace.',
+      required: false,
+    }),
+    monospace: Property.Checkbox({
+      displayName: 'Monospace',
+      description:
+        'Render the message in a monospace font. Cannot be combined with Enable HTML.',
+      required: false,
+    }),
+    tags: Property.ShortText({
+      displayName: 'Tags',
+      description:
+        "Comma-separated tags stored with an emergency notification, for example 'deploy,prod'. Required upfront if you intend to use Cancel Emergency Retries by Tag.",
+      required: false,
+    }),
+    callback: Property.ShortText({
+      displayName: 'Callback URL',
+      description:
+        'Emergency priority only. Pushover POSTs to this URL once the notification is acknowledged.',
+      required: false,
+    }),
+    attachment_base64: Property.LongText({
+      displayName: 'Attachment (Base64)',
+      description:
+        'Base64-encoded image to attach, maximum 5242880 bytes decoded. Requires Attachment Type.',
+      required: false,
+    }),
+    attachment_type: Property.ShortText({
+      displayName: 'Attachment Type',
+      description:
+        "MIME type of the attachment, for example 'image/jpeg'. Required when an attachment is supplied.",
+      required: false,
+    }),
+  },
+  outputSchema: sendPushMessageOutputSchema,
+  async run({ auth, propsValue }) {
+    const body = buildMessageBody({
+      apiToken: auth.props.api_token,
+      userKey: auth.props.user_key,
+      message: propsValue.message,
+      title: propsValue.title,
+      html: propsValue.html,
+      monospace: propsValue.monospace,
+      priority: propsValue.priority,
+      retry: propsValue.retry,
+      expire: propsValue.expire,
+      ttl: propsValue.ttl,
+      url: propsValue.url,
+      urlTitle: propsValue.url_title,
+      timestamp: propsValue.timestamp,
+      device: propsValue.device,
+      sound: propsValue.sound,
+      tags: propsValue.tags,
+      callback: propsValue.callback,
+      attachmentBase64: propsValue.attachment_base64,
+      attachmentType: propsValue.attachment_type,
+    });
+
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: '/messages.json',
+      body,
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/actions/update-glance.ts b/packages/pieces/community/pushover/src/lib/actions/update-glance.ts
new file mode 100644
index 000000000000..f1cddf4c1e4b
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/update-glance.ts
@@ -0,0 +1,89 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+
+export const updateGlance = createAction({
+  auth: pushoverAuth,
+  name: 'update_glance',
+  classification: 'WRITE',
+  displayName: 'Update Glance Widget',
+  description: 'Update the Pushover glance widget fields on the user devices',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Silently update the Pushover glance widget on the recipient devices without sending a notification. Use it for a continuously refreshed status number or line of text, and use Send Push Message when the person should actually be alerted. At least one of title, text, subtext, count or percent is required. Fields persist between calls: omit a field to leave its current value alone. This action only sets field values and cannot clear a field once it has one. A registered widget is required and the Apple Watch is the only supported widget, so a success response on an account without one proves the call shape only. Safe to retry: the same values converge on the same widget state.',
+    idempotent: true,
+  },
+  props: {
+    title: Property.ShortText({
+      displayName: 'Title',
+      description:
+        'Short description of the data, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.',
+      required: false,
+    }),
+    text: Property.ShortText({
+      displayName: 'Text',
+      description:
+        'Main line of text, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.',
+      required: false,
+    }),
+    subtext: Property.ShortText({
+      displayName: 'Subtext',
+      description:
+        'Second line of text, maximum 100 characters. Omit to leave unchanged. Values cannot be cleared once set.',
+      required: false,
+    }),
+    count: Property.Number({
+      displayName: 'Count',
+      description:
+        'Integer shown on the widget, may be negative. Omit to leave unchanged.',
+      required: false,
+    }),
+    percent: Property.Number({
+      displayName: 'Percent',
+      description:
+        'Integer from 0 to 100 rendered as a progress bar. Omit to leave unchanged.',
+      required: false,
+    }),
+    device: Property.ShortText({
+      displayName: 'Device',
+      description:
+        'Update only this device name. All devices are updated when omitted.',
+      required: false,
+    }),
+  },
+  async run({ auth, propsValue }) {
+    const fields = {
+      ...(isFilled(propsValue.title) ? { title: propsValue.title } : {}),
+      ...(isFilled(propsValue.text) ? { text: propsValue.text } : {}),
+      ...(isFilled(propsValue.subtext)
+        ? { subtext: propsValue.subtext }
+        : {}),
+      ...(propsValue.count !== undefined ? { count: propsValue.count } : {}),
+      ...(propsValue.percent !== undefined
+        ? { percent: propsValue.percent }
+        : {}),
+    };
+    if (Object.keys(fields).length === 0) {
+      throw new Error(
+        'Update Glance Widget needs at least one of title, text, subtext, count or percent.'
+      );
+    }
+
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: '/glances.json',
+      body: {
+        token: auth.props.api_token,
+        user: auth.props.user_key,
+        ...fields,
+        ...(propsValue.device ? { device: propsValue.device } : {}),
+      },
+    });
+  },
+});
+
+function isFilled(value: string | undefined): value is string {
+  return value !== undefined && value.length > 0;
+}
diff --git a/packages/pieces/community/pushover/src/lib/actions/validate-user-key.ts b/packages/pieces/community/pushover/src/lib/actions/validate-user-key.ts
new file mode 100644
index 000000000000..e7f4cdf77a80
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/actions/validate-user-key.ts
@@ -0,0 +1,51 @@
+import { createAction, Property } from '@activepieces/pieces-framework';
+import { HttpMethod } from '@activepieces/pieces-common';
+import { pushoverAuth } from '../..';
+import { pushoverApiCall } from '../common';
+import { validateUserKeyOutputSchema } from '../output-schemas';
+
+export const validateUserKey = createAction({
+  auth: pushoverAuth,
+  name: 'validate_user_key',
+  classification: 'READ',
+  displayName: 'Validate User or Group Key',
+  description: 'Check whether a Pushover user or group key is valid and reachable',
+  audience: 'ai',
+  aiMetadata: {
+    description:
+      'Check before sending whether a user or group key exists, is not disabled, and has at least one active device, returning its device names and licenses. Use it to validate a key handed to you by someone else; leave the key blank to check the key stored on the connection. Read-only despite being a POST: nothing is delivered and nothing changes. Safe to retry.',
+    idempotent: true,
+  },
+  props: {
+    user: Property.ShortText({
+      displayName: 'User or Group Key',
+      description:
+        'The 30-character user or group key to validate. Defaults to the key stored on the connection when left blank.',
+      required: false,
+    }),
+    device: Property.ShortText({
+      displayName: 'Device',
+      description:
+        'Optional device name to validate alongside the key, for example iphone.',
+      required: false,
+    }),
+  },
+  outputSchema: validateUserKeyOutputSchema,
+  async run({ auth, propsValue }) {
+    const suppliedUser = propsValue.user;
+    const user =
+      suppliedUser !== undefined && suppliedUser.length > 0
+        ? suppliedUser
+        : auth.props.user_key;
+
+    return await pushoverApiCall({
+      method: HttpMethod.POST,
+      resourceUri: '/users/validate.json',
+      body: {
+        token: auth.props.api_token,
+        user,
+        ...(propsValue.device ? { device: propsValue.device } : {}),
+      },
+    });
+  },
+});
diff --git a/packages/pieces/community/pushover/src/lib/common/index.ts b/packages/pieces/community/pushover/src/lib/common/index.ts
new file mode 100644
index 000000000000..5a5927a82882
--- /dev/null
+++ b/packages/pieces/community/pushover/src/lib/common/index.ts
@@ -0,0 +1,331 @@
+import {
+  HttpError,
+  HttpMessageBody,
+  HttpMethod,
+  httpClient,
+} from '@activepieces/pieces-common';
+
+export const PUSHOVER_BASE_URL = 'https://api.pushover.net/1';
+
+export const PUSHOVER_MAX_EMERGENCY_RETRIES = 50;
+export const PUSHOVER_MIN_RETRY_SECONDS = 30;
+export const PUSHOVER_MAX_EXPIRE_SECONDS = 10800;
+export const PUSHOVER_MIN_PRIORITY = -2;
+export const PUSHOVER_MAX_PRIORITY = 2;
+export const PUSHOVER_MAX_ATTACHMENT_BYTES = 5242880;
+
+const MAX_ERROR_DETAIL_LENGTH = 400;
+
+const ERROR_BODY_METADATA_KEYS = new Set(['status', 'request', 'receipt']);
+
+const DATA_URI_PREFIX_PATTERN = /^data:[^;,]*;base64,/;
+
+const WHITESPACE_PATTERN = /\s+/g;
+
+export async function pushoverApiCall<T extends HttpMessageBody>({
+  method,
+  resourceUri,
+  body,
+  queryParams,
+  errorHint,
+}: PushoverApiCallParams): Promise<T> {
+  try {
+    const response = await httpClient.sendRequest<T>({
+      method,
+      url: `${PUSHOVER_BASE_URL}${resourceUri}`,
+      body,
+      queryParams,
+    });
+    return response.body;
+  } catch (error) {
+    throw new PushoverRequestError({
+      message: describePushoverError({ error, errorHint }),
+      status: error instanceof HttpError ? error.response.status : undefined,
+      vendorErrors:
+        error instanceof HttpError
+          ? collectVendorErrors(error.response.body)
+          : [],
+      responseBody:
+        error instanceof HttpError ? error.response.body : undefined,
+    });
+  }
+}
+
+export function buildMessageBody({
+  apiToken,
+  userKey,
+  title,
+  message,
+  html,
+  monospace,
+  priority,
+  retry,
+  expire,
+  ttl,
+  url,
+  urlTitle,
+  timestamp,
+  device,
+  sound,
+  tags,
+  callback,
+  attachmentBase64,
+  attachmentType,
+}: BuildMessageBodyParams): Record<string, unknown> {
+  if (html === true && monospace === true) {
+    throw new Error(
+      'Pushover rejects html and monospace together: choose one message formatting mode.'
+    );
+  }
+  const priorityNumber = isPresent(priority) ? Number(priority) : undefined;
+  if (priorityNumber !== undefined && Number.isNaN(priorityNumber)) {
+    throw new Error(
+      `Priority must be a number between ${PUSHOVER_MIN_PRIORITY} and ${PUSHOVER_MAX_PRIORITY}.`
+    );
+  }
+  if (
+    priorityNumber !== undefined &&
+    (priorityNumber < PUSHOVER_MIN_PRIORITY ||
+      priorityNumber > PUSHOVER_MAX_PRIORITY)
+  ) {
+    throw new Error(
+      `Priority must be a number between ${PUSHOVER_MIN_PRIORITY} and ${PUSHOVER_MAX_PRIORITY}.`
+    );
+  }
+  if (priorityNumber === 2) {
+    if (!isPresent(retry) || !isPresent(expire)) {
+      throw new Error(
+        `Emergency priority (2) requires both retry (>= ${PUSHOVER_MIN_RETRY_SECONDS} seconds) and expire (<= ${PUSHOVER_MAX_EXPIRE_SECONDS} seconds).`
+      );
+    }
+    if (retry < PUSHOVER_MIN_RETRY_SECONDS) {
+      throw new Error(
+        `Emergency priority (2) requires retry to be at least ${PUSHOVER_MIN_RETRY_SECONDS} seconds.`
+      );
+    }
+    if (expire < 1 || expire > PUSHOVER_MAX_EXPIRE_SECONDS) {
+      throw new Error(
+        `Emergency priority (2) requires expire between 1 and ${PUSHOVER_MAX_EXPIRE_SECONDS} seconds.`
+      );
+    }
+  }
+  if (isPresent(attachmentBase64) && !isPresent(attachmentType)) {
+    throw new Error(
+      'attachment_type (for example image/jpeg) is required whenever an attachment is supplied.'
+    );
+  }
+  if (
+    isPresent(attachmentBase64) &&
+    decodedBase64ByteLength(attachmentBase64) > PUSHOVER_MAX_ATTACHMENT_BYTES
+  ) {
+    throw new Error(
+      `The attachment decodes to more than the Pushover limit of ${PUSHOVER_MAX_ATTACHMENT_BYTES} bytes (5 MB). Resize or recompress the image before sending.`
+    );
+  }
+
+  return {
+    token: apiToken,
+    user: userKey,
+    message,
+    ...spreadWhenPresent({ title }),
+    ...spreadWhenPresent({ url }),
+    ...spreadWhenPresent({ url_title: urlTitle }),
+    ...spreadWhenPresent({ timestamp }),
+    ...spreadWhenPresent({ device }),
+    ...spreadWhenPresent({ callback }),
+    ...spreadWhenPresent({ tags }),
+    ...spreadWhenPresent({ sound }),
+    ...spreadWhenPresent({ attachment_base64: attachmentBase64 }),
+    ...spreadWhenPresent({ attachment_type: attachmentType }),
+    ...(html === true ? { html: 1 } : {}),
+    ...(monospace === true ? { monospace: 1 } : {}),
+    ...(priorityNumber !== undefined ? { priority: priorityNumber } : {}),
+    ...(priorityNumber === 2 ? { retry, expire } : {}),
+    ...(priorityNumber !== 2 && isPresent(ttl) ? { ttl } : {}),
+  };
+}
+
+function decodedBase64ByteLength(attachmentBase64: string): number {
+  const payload = attachmentBase64
+    .replace(DATA_URI_PREFIX_PATTERN, '')
+    .replace(WHITESPACE_PATTERN, '');
+  const paddingLength = payload.endsWith('==')
+    ? 2
+    : payload.endsWith('=')
+    ? 1
+    : 0;
+  return Math.floor((payload.length * 3) / 4) - paddingLength;
+}
+
+function isPresent<T>(value: T | undefined | null): value is T {
+  if (value === undefined || value === null) {
+    return false;
+  }
+  return typeof value === 'string' ? value.length > 0 : true;
+}
+
+function spreadWhenPresent(
+  entry: Record<string, unknown>
+): Record<string, unknown> {
+  return Object.fromEntries(
+    Object.entries(entry).filter(([, value]) => isPresent(value))
+  );
+}
+
+function truncateDetail(detail: string): string {
+  return detail.length > MAX_ERROR_DETAIL_LENGTH
+    ? `${detail.slice(0, MAX_ERROR_DETAIL_LENGTH)}...`
+    : detail;
+}
+
+function flattenErrorValue(value: unknown): string[] {
+  if (typeof value === 'string') {
+    return value.trim().length > 0 ? [value.trim()] : [];
+  }
+  if (typeof value === 'number' || typeof value === 'boolean') {
+    return [String(value)];
+  }
+  if (Array.isArray(value)) {
+    return value.flatMap(flattenErrorValue);
+  }
+  if (typeof value === 'object' && value !== null) {
+    return Object.entries(value).flatMap(([key, nested]) =>
+      flattenErrorValue(nested).map((entry) => `${key}: ${entry}`)
+    );
+  }
+  return [];
+}
+
+function collectVendorErrors(body: unknown): string[] {
+  if (typeof body === 'string') {
+    const trimmed = body.trim();
+    return trimmed.length > 0 ? [trimmed] : [];
+  }
+  if (typeof body !== 'object' || body === null) {
+    return [];
+  }
+  const listedErrors = flattenErrorValue(
+    'errors' in body ? body.errors : undefined
+  );
+  const fieldErrors = Object.entries(body)
+    .filter(([key]) => key !== 'errors' && !ERROR_BODY_METADATA_KEYS.has(key))
+    .flatMap(([key, value]) =>
+      flattenErrorValue(value).map((entry) => `${key}: ${entry}`)
+    );
+  return [...listedErrors, ...fieldErrors];
+}
+
+function readVendorErrors(body: unknown): string {
+  if (typeof body === 'string') {
+    const trimmed = body.trim();
+    return trimmed.length > 0
+      ? ` Pushover said: ${truncateDetail(trimmed)}.`
+      : '';
+  }
+  if (typeof body !== 'object' || body === null) {
+    return '';
+  }
+
+  const listedErrors = flattenErrorValue(
+    'errors' in body ? body.errors : undefined
+  );
+  const fieldErrors = Object.entries(body)
+    .filter(([key]) => key !== 'errors' && !ERROR_BODY_METADATA_KEYS.has(key))
+    .flatMap(([key, value]) =>
+      typeof value === 'string' && value.trim().length > 0
+        ? [`${key}: ${value.trim()}`]
+        : []
+    );
+  const messages = [...listedErrors, ...fieldErrors];
+  if (messages.length > 0) {
+    return ` Pushover said: ${truncateDetail(messages.join('; '))}.`;
+  }
+
+  return ` Pushover returned this body: ${truncateDetail(JSON.stringify(body))}.`;
+}
+
+function describePushoverError({
+  error,
+  errorHint,
+}: DescribeErrorParams): string {
+  const hint = isPresent(errorHint) ? ` ${errorHint}` : '';
+  if (!(error instanceof HttpError)) {
+    return error instanceof Error ? error.message : String(error);
+  }
+  const status = error.response.status;
+  const vendorErrors = readVendorErrors(error.response.body);
+  if (status === 429) {
+    return `Pushover returned 429: the application monthly message quota is exhausted, not a transient rate limit. Check Get Monthly Message Limits for the reset date.${vendorErrors}`;
+  }
+  if (status >= 500) {
+    return `Pushover returned ${status}. This class is retryable, but wait at least 5 seconds before trying again.${vendorErrors}`;
+  }
+  if (status >= 400) {
+    return `Pushover returned ${status}. 4xx responses are terminal: retrying the same request will fail again, and repeated bad requests can get the IP temporarily blocked. Fix the input first.${hint}${vendorErrors}`;
+  }
+  return `Pushover request failed with status ${status}.${vendorErrors}`;
+}
+
+export class PushoverRequestError extends Error {
+  readonly status: number | undefined;
+  readonly vendorErrors: string[];
+  readonly responseBody: unknown;
+
+  constructor({
+    message,
+    status,
+    vendorErrors,
+    responseBody,
+  }: PushoverRequestErrorParams) {
+    super(message);
+    this.name = 'PushoverRequestError';
+    this.status = status;
+    this.vendorErrors = vendorErrors;
+    this.responseBody = responseBody;
+  }
+}
+
+export const GROUP_OWNERSHIP_HINT =
+  'The Groups API requires the application token to belong to the same account that owns the group, so an ownership mismatch reports the same way as an unknown group key.';
+
+export type PushoverApiCallParams = {
+  method: HttpMethod;
+  resourceUri: string;
+  body?: Record<string, unknown>;
+  queryParams?: Record<string, string>;
+  errorHint?: string;
+};
+
+export type BuildMessageBodyParams = {
+  apiToken: string;
+  userKey: string;
+  message: string;
+  title?: string;
+  html?: boolean;
+  monospace?: boolean;
+  priority?: number | string;
+  retry?: number;
+  expire?: number;
+  ttl?: number;
+  url?: string;
+  urlTitle?: string;
+  timestamp?: string;
+  device?: string;
+  sound?: string;
+  tags?: string;
+  callback?: string;
+  attachmentBase64?: string;
+  attachmentType?: string;
+};
+
+export type DescribeErrorParams = {
+  error: unknown;
+  errorHint?: string;
+};
+
+export type PushoverRequestErrorParams = {
+  message: string;
+  status: number | undefined;
+  vendorErrors: string[];
+  responseBody: unknown;
+};
diff --git a/packages/pieces/community/pushover/src/lib/output-schemas.ts b/packages/pieces/community/pushover/src/lib/output-schemas.ts
index 742de019e784..0f1c479a6e64 100644
--- a/packages/pieces/community/pushover/src/lib/output-schemas.ts
+++ b/packages/pieces/community/pushover/src/lib/output-schemas.ts
@@ -24,3 +24,470 @@ export const sendNotificationActionOutputSchema: OutputSchema = {
     },
   ],
 };
+
+export const sendPushMessageOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover accepted the notification. Any other value means it was rejected.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request, worth quoting when reporting a delivery problem.',
+    },
+    {
+      key: 'receipt',
+      label: 'Receipt',
+      description:
+        'Only returned at emergency priority (2). Pass it to Get Emergency Receipt Status or Cancel Emergency Retries.',
+    },
+  ],
+};
+
+export const getAppLimitsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'limit',
+      label: 'Monthly Limit',
+      format: 'number',
+      description: 'Total messages the application may send this month.',
+    },
+    {
+      key: 'remaining',
+      label: 'Remaining',
+      format: 'number',
+      description:
+        'Messages still available before the monthly quota is exhausted and sends start returning 429.',
+    },
+    {
+      key: 'reset',
+      label: 'Quota Reset',
+      format: 'number',
+      description: 'Unix timestamp in seconds at which the monthly counter resets.',
+    },
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover accepted the request.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request, worth quoting when reporting a problem.',
+    },
+  ],
+};
+
+export const listNotificationSoundsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'sounds',
+      label: 'Sounds',
+      labelKey: 'name',
+      description: 'Every sound Pushover accepts for the Sound parameter of Send Push Message.',
+      listItems: [
+        {
+          key: 'id',
+          label: 'Sound ID',
+          description: 'Identifier to pass as the Sound parameter, for example pushover or cosmic.',
+        },
+        {
+          key: 'name',
+          label: 'Name',
+          description: 'Human-readable sound name, for example Pushover (default).',
+        },
+      ],
+    },
+    {
+      key: 'count',
+      label: 'Count',
+      format: 'number',
+      description: 'Number of sounds returned.',
+    },
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover accepted the request.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const listDeliveryGroupsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'groups',
+      label: 'Groups',
+      labelKey: 'name',
+      description: 'Delivery groups owned by the same account as the application token.',
+      listItems: [
+        {
+          key: 'group',
+          label: 'Group Key',
+          description: 'The 30-character group key every other group action takes as input.',
+        },
+        {
+          key: 'name',
+          label: 'Name',
+          description: 'Group name, unique within the account.',
+        },
+      ],
+    },
+    {
+      key: 'count',
+      label: 'Count',
+      format: 'number',
+      description: 'Number of groups returned.',
+    },
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover accepted the request.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const getDeliveryGroupOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'name',
+      label: 'Name',
+      description: 'Name of the delivery group.',
+    },
+    {
+      key: 'users',
+      label: 'Members',
+      labelKey: 'user',
+      description: 'Every member of the group, including members currently suspended.',
+      listItems: [
+        {
+          key: 'user',
+          label: 'User Key',
+          description:
+            'The 30-character user key of the member, as passed to Remove User from Delivery Group, Disable Group User and Enable Group User.',
+        },
+        {
+          key: 'device',
+          label: 'Device',
+          description:
+            'Device the group delivers to for this member, or null when every device of theirs receives group messages.',
+        },
+        {
+          key: 'memo',
+          label: 'Memo',
+          description: 'Note stored with the membership, for example Primary on-call.',
+        },
+        {
+          key: 'disabled',
+          label: 'Disabled',
+          format: 'boolean',
+          description:
+            'True while the member is suspended by Disable Group User and group messages skip them. Restore with Enable Group User.',
+        },
+        {
+          key: 'valid',
+          label: 'Valid',
+          format: 'boolean',
+          description:
+            'False when the user key is no longer reachable, for example because the account was deleted or has no active device.',
+        },
+      ],
+    },
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover accepted the request.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const getLicenseCreditsOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'credits',
+      label: 'Credits',
+      format: 'number',
+      description:
+        'Prepaid license credits the application still holds. Assign License spends one irreversibly.',
+    },
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover accepted the request.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const validateUserKeyOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when the key is valid, has at least one active device and is not disabled.',
+    },
+    {
+      key: 'group',
+      label: 'Is Group',
+      format: 'number',
+      description: '1 when the validated key is a delivery group key, 0 when it is a user key.',
+    },
+    {
+      key: 'devices',
+      label: 'Devices',
+      description:
+        'Names of the devices registered to this user, usable as the Device parameter of Send Push Message.',
+    },
+    {
+      key: 'licenses',
+      label: 'Licenses',
+      description: 'Platforms the user holds a license for, for example Android or iOS.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const createDeliveryGroupOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'group',
+      label: 'Group Key',
+      description: 'The 30-character group key, whether the group was created or already existed.',
+    },
+    {
+      key: 'name',
+      label: 'Name',
+      description: 'Name of the group.',
+    },
+    {
+      key: 'created',
+      label: 'Created',
+      format: 'boolean',
+      description:
+        'True when a new group was created, false when an existing group with that name was returned.',
+    },
+  ],
+};
+
+export const renameDeliveryGroupOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover renamed the group.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const getReceiptStatusOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover accepted the request.',
+    },
+    {
+      key: 'acknowledged',
+      label: 'Acknowledged',
+      format: 'number',
+      description:
+        '1 once a recipient acknowledged the emergency notification, which stops the retries.',
+    },
+    {
+      key: 'acknowledged_at',
+      label: 'Acknowledged At',
+      format: 'number',
+      description: 'Unix timestamp in seconds of the acknowledgement, 0 while unacknowledged.',
+    },
+    {
+      key: 'acknowledged_by',
+      label: 'Acknowledged By',
+      description: 'User key of the recipient who acknowledged, empty while unacknowledged.',
+    },
+    {
+      key: 'acknowledged_by_device',
+      label: 'Acknowledged By Device',
+      description: 'Device name that acknowledged, empty while unacknowledged.',
+    },
+    {
+      key: 'last_delivered_at',
+      label: 'Last Delivered At',
+      format: 'number',
+      description: 'Unix timestamp in seconds of the most recent retry delivery.',
+    },
+    {
+      key: 'expired',
+      label: 'Expired',
+      format: 'number',
+      description: '1 once the retry window closed without an acknowledgement.',
+    },
+    {
+      key: 'expires_at',
+      label: 'Expires At',
+      format: 'number',
+      description: 'Unix timestamp in seconds at which retrying stops.',
+    },
+    {
+      key: 'called_back',
+      label: 'Called Back',
+      format: 'number',
+      description: '1 once Pushover called the callback URL supplied at send time.',
+    },
+    {
+      key: 'called_back_at',
+      label: 'Called Back At',
+      format: 'number',
+      description: 'Unix timestamp in seconds of the callback, 0 when no callback fired.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const cancelEmergencyRetriesOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when the retry loop for this receipt is stopped.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const cancelEmergencyRetriesByTagOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description: '1 when Pushover accepted the request.',
+    },
+    {
+      key: 'canceled',
+      label: 'Canceled Count',
+      format: 'number',
+      description:
+        'Number of still-retrying emergency notifications carrying the tag that were stopped.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const addUserToGroupOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description:
+        '1 when the user was added as a member. Adding someone who is already a member fails instead of returning a non-1 status.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const removeUserFromGroupOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description:
+        '1 when the member was removed. Removing someone who is not a member fails instead of returning a non-1 status.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const disableGroupUserOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description:
+        '1 when the member is suspended. Read the membership back with Get Delivery Group to see disabled turn true.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
+
+export const enableGroupUserOutputSchema: OutputSchema = {
+  fields: [
+    {
+      key: 'status',
+      label: 'Status',
+      format: 'number',
+      description:
+        '1 when the member receives group messages again. Read the membership back with Get Delivery Group to see disabled turn false.',
+    },
+    {
+      key: 'request',
+      label: 'Request ID',
+      description: 'Pushover\'s identifier for this request.',
+    },
+  ],
+};
diff --git a/packages/server/api/src/app/database/migration/postgres/1845000000000-AddMaxBarrierSignalsToPlatformConfiguration.ts b/packages/server/api/src/app/database/migration/postgres/1845000000000-AddMaxBarrierSignalsToPlatformConfiguration.ts
new file mode 100644
index 000000000000..a0ce699e6bd3
--- /dev/null
+++ b/packages/server/api/src/app/database/migration/postgres/1845000000000-AddMaxBarrierSignalsToPlatformConfiguration.ts
@@ -0,0 +1,23 @@
+import { QueryRunner } from 'typeorm'
+import { Migration } from '../../migration'
+
+export class AddMaxBarrierSignalsToPlatformConfiguration1845000000000 implements Migration {
+    name = 'AddMaxBarrierSignalsToPlatformConfiguration1845000000000'
+    breaking = false
+    release = '0.91.0'
+    transaction = true
+
+    public async up(queryRunner: QueryRunner): Promise<void> {
+        await queryRunner.query(`
+            ALTER TABLE "platform_configuration"
+            ADD COLUMN "maxBarrierSignals" integer NOT NULL DEFAULT 10000
+        `)
+    }
+
+    public async down(queryRunner: QueryRunner): Promise<void> {
+        await queryRunner.query(`
+            ALTER TABLE "platform_configuration"
+            DROP COLUMN "maxBarrierSignals"
+        `)
+    }
+}
diff --git a/packages/server/api/src/app/database/migration/postgres/1847000000000-IndexWaitpointLookups.ts b/packages/server/api/src/app/database/migration/postgres/1847000000000-IndexWaitpointLookups.ts
new file mode 100644
index 000000000000..4c58c59ce1ab
--- /dev/null
+++ b/packages/server/api/src/app/database/migration/postgres/1847000000000-IndexWaitpointLookups.ts
@@ -0,0 +1,40 @@
+import { QueryRunner } from 'typeorm'
+import { system } from '../../../helper/system/system'
+import { AppSystemProp } from '../../../helper/system/system-props'
+import { DatabaseType } from '../../database-type'
+import { Migration } from '../../migration'
+
+export class IndexWaitpointLookups1847000000000 implements Migration {
+    name = 'IndexWaitpointLookups1847000000000'
+    breaking = false
+    release = '0.92.0'
+    transaction = false
+
+    public async up(queryRunner: QueryRunner): Promise<void> {
+        await queryRunner.query(`DROP INDEX ${concurrently()} IF EXISTS "idx_waitpoint_signal_ref_id"`)
+        await queryRunner.query(`
+            CREATE INDEX ${concurrently()} IF NOT EXISTS "idx_waitpoint_signal_ref_id"
+            ON "waitpoint_signal" ("refId", "projectId")
+        `)
+        await queryRunner.query(`
+            CREATE INDEX ${concurrently()} IF NOT EXISTS "idx_waitpoint_signal_waitpoint_id_project_id_sequence"
+            ON "waitpoint_signal" ("waitpointId", "projectId", "sequence", "created")
+        `)
+        await queryRunner.query(`
+            CREATE INDEX ${concurrently()} IF NOT EXISTS "idx_waitpoint_flow_run_id_status_created"
+            ON "waitpoint" ("flowRunId", "status", "created")
+        `)
+    }
+
+    public async down(queryRunner: QueryRunner): Promise<void> {
+        await queryRunner.query(`DROP INDEX ${concurrently()} IF EXISTS "idx_waitpoint_flow_run_id_status_created"`)
+        await queryRunner.query(`DROP INDEX ${concurrently()} IF EXISTS "idx_waitpoint_signal_waitpoint_id_project_id_sequence"`)
+        await queryRunner.query(`DROP INDEX ${concurrently()} IF EXISTS "idx_waitpoint_signal_ref_id"`)
+        await queryRunner.query(`
+            CREATE INDEX ${concurrently()} IF NOT EXISTS "idx_waitpoint_signal_ref_id"
+            ON "waitpoint_signal" ("refId")
+        `)
+    }
+}
+
+const concurrently = (): string => system.get(AppSystemProp.DB_TYPE) === DatabaseType.PGLITE ? '' : 'CONCURRENTLY'
diff --git a/packages/server/api/src/app/database/postgres-connection.ts b/packages/server/api/src/app/database/postgres-connection.ts
index 1a62566fef1d..3c2826766b99 100644
--- a/packages/server/api/src/app/database/postgres-connection.ts
+++ b/packages/server/api/src/app/database/postgres-connection.ts
@@ -437,7 +437,9 @@ import { AddPlatformConfiguration1841000000000 } from './migration/postgres/1841
 import { AddAgentRunsIndex1842000000000 } from './migration/postgres/1842000000000-AddAgentRunsIndex'
 import { AddAgentConversationFlowRunId1843000000000 } from './migration/postgres/1843000000000-AddAgentConversationFlowRunId'
 import { AddMcpActivity1844000000000 } from './migration/postgres/1844000000000-AddMcpActivity'
+import { AddMaxBarrierSignalsToPlatformConfiguration1845000000000 } from './migration/postgres/1845000000000-AddMaxBarrierSignalsToPlatformConfiguration'
 import { NullOrphanFolderReferences1846000000000 } from './migration/postgres/1846000000000-NullOrphanFolderReferences'
+import { IndexWaitpointLookups1847000000000 } from './migration/postgres/1847000000000-IndexWaitpointLookups'
 import { AddAgentConversationAiCredits1850000000000 } from './migration/postgres/1850000000000-AddAgentConversationAiCredits'
 import { AddMcpOAuthCodeNonce1851000000000 } from './migration/postgres/1851000000000-AddMcpOAuthCodeNonce'
 import { FlowExternalIdUniqueIgnoresDeleting1855000000000 } from './migration/postgres/1855000000000-FlowExternalIdUniqueIgnoresDeleting'
@@ -894,7 +896,9 @@ export const getMigrations = (): (new () => Migration)[] => {
         AddAgentRunsIndex1842000000000,
         AddAgentConversationFlowRunId1843000000000,
         AddMcpActivity1844000000000,
+        AddMaxBarrierSignalsToPlatformConfiguration1845000000000,
         NullOrphanFolderReferences1846000000000,
+        IndexWaitpointLookups1847000000000,
         AddAgentConversationAiCredits1850000000000,
         AddMcpOAuthCodeNonce1851000000000,
         FlowExternalIdUniqueIgnoresDeleting1855000000000,
diff --git a/packages/server/api/src/app/ee/agent/agent-run-controller.ts b/packages/server/api/src/app/ee/agent/agent-run-controller.ts
index 53dee9b67452..e94d4d13927f 100644
--- a/packages/server/api/src/app/ee/agent/agent-run-controller.ts
+++ b/packages/server/api/src/app/ee/agent/agent-run-controller.ts
@@ -124,7 +124,7 @@ async function resolvePublishedAgent({ projectId, externalId, flowRunId, waitpoi
     log: FastifyBaseLogger
 }): Promise<{ id: string, config: AgentConfig }> {
     const flowRun = await flowRunService(log).getOneOrThrow({ id: flowRunId, projectId })
-    const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId, flowRunId })
+    const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId, flowRunId, projectId })
     if (isNil(waitpoint)) {
         throw new ActivepiecesError({ code: ErrorCode.VALIDATION, params: { message: 'That waitpoint does not belong to this run, so there is no step to run an agent for' } })
     }
diff --git a/packages/server/api/src/app/flows/flow-run/flow-run-service.ts b/packages/server/api/src/app/flows/flow-run/flow-run-service.ts
index 1016bc5af6d0..06971fdeab40 100644
--- a/packages/server/api/src/app/flows/flow-run/flow-run-service.ts
+++ b/packages/server/api/src/app/flows/flow-run/flow-run-service.ts
@@ -1,6 +1,6 @@
 import { ActivepiecesError, apId, Cursor, ErrorCode, FlowId, FlowRunId, FlowVersionId, isNil, PlatformId, ProjectId, SeekPage } from '@activepieces/core-utils'
 import { apDayjs, apDayjsDuration, wideEvent } from '@activepieces/server-utils'
-import { ExecuteFlowJobData, ExecutionType, ExecutioOutputFile, FileCompression, FileType, FlowRetryStrategy, FlowRun, FlowRunCountByStatus, FlowRunStatus, FlowRunWithRetryError, FlowVersion, GenericStepOutput, isFlowRunStateTerminal, JobPayload, LATEST_JOB_DATA_SCHEMA_VERSION, logSerializer, LogSliceRef, ResumeReason, RunEnvironment, RunInternalError, SampleDataFileType, StepOutput, StepOutputStatus, StepOutputType, StreamStepProgress, WorkerJobType } from '@activepieces/shared'
+import { ExecuteFlowJobData, ExecutionType, ExecutioOutputFile, FileCompression, FileType, FlowRetryStrategy, FlowRun, FlowRunCountByStatus, FlowRunStatus, FlowRunWithRetryError, flowStructureUtil, FlowVersion, GenericStepOutput, isFlowRunStateTerminal, JobPayload, LATEST_JOB_DATA_SCHEMA_VERSION, logSerializer, LogSliceRef, ResumeReason, RunEnvironment, RunInternalError, SampleDataFileType, StepOutput, StepOutputStatus, StepOutputType, StreamStepProgress, WorkerJobType } from '@activepieces/shared'
 import { FastifyBaseLogger } from 'fastify'
 import pLimit from 'p-limit'
 import { ArrayContains, In, IsNull, Not, Repository, SelectQueryBuilder } from 'typeorm'
@@ -375,7 +375,12 @@ export const flowRunService = (log: FastifyBaseLogger) => ({
             platformId: await projectService(log).getPlatformId(projectId),
             executeTrigger: false,
             streamStepProgress: StreamStepProgress.WEBSOCKET,
-            sampleData: !isNil(stepNameToTest) ? await sampleDataService(log).getSampleDataForFlow(projectId, flowVersion, SampleDataFileType.OUTPUT) : undefined,
+            sampleData: !isNil(stepNameToTest) ? await sampleDataService(log).getSampleDataForFlow({
+                projectId,
+                flowVersion,
+                type: SampleDataFileType.OUTPUT,
+                referencedBy: settingsOfStepUnderTest({ flowVersion, stepNameToTest }),
+            }) : undefined,
         }, log)
     },
     async startManualTrigger({ projectId, flowVersionId, triggeredBy }: StartManualTriggerParams): Promise<FlowRun> {
@@ -502,7 +507,7 @@ async function cancelSingleRun(log: FastifyBaseLogger, flowRun: FlowRun, platfor
         timeoutInSeconds: 30,
         fn: async () => {
             await jobQueue(log).removeAllFlowRunJobs({ flowRunId: flowRun.id, platformId, projectId: flowRun.projectId })
-            await waitpointService(log).deleteByFlowRunId(flowRun.id)
+            await waitpointService(log).deleteByFlowRunId({ flowRunId: flowRun.id, projectId: flowRun.projectId })
             await runsMetadataQueue(log).add({
                 id: flowRun.id,
                 projectId: flowRun.projectId,
@@ -779,6 +784,19 @@ export function isOutsideRetentionWindow(createdTime: string, retentionDays: num
     return apDayjs(createdTime).add(retentionDays, 'day').isBefore(apDayjs())
 }
 
+function settingsOfStepUnderTest({ flowVersion, stepNameToTest }: SettingsOfStepUnderTestParams): unknown {
+    const stepUnderTest = flowStructureUtil.getStep(stepNameToTest, flowVersion.trigger)
+    if (isNil(stepUnderTest)) {
+        return undefined
+    }
+    return flowStructureUtil.getAllChildSteps(stepUnderTest).map((step) => step.settings)
+}
+
+type SettingsOfStepUnderTestParams = {
+    flowVersion: FlowVersion
+    stepNameToTest: string
+}
+
 type CreateParams = {
     projectId: ProjectId
     flowVersionId: FlowVersionId
diff --git a/packages/server/api/src/app/flows/flow-run/flow-run-side-effects.ts b/packages/server/api/src/app/flows/flow-run/flow-run-side-effects.ts
index 70a2173c1b0f..cefe5f747a01 100644
--- a/packages/server/api/src/app/flows/flow-run/flow-run-side-effects.ts
+++ b/packages/server/api/src/app/flows/flow-run/flow-run-side-effects.ts
@@ -16,7 +16,7 @@ export const flowRunSideEffects = (log: FastifyBaseLogger) => ({
         })) {
             return
         }
-        await waitpointService(log).deleteByFlowRunId(flowRun.id)
+        await waitpointService(log).deleteByFlowRunId({ flowRunId: flowRun.id, projectId: flowRun.projectId })
         await flowRunHooks(log).onFinish(flowRun)
         applicationEvents(log).sendWorkerEvent({
             projectId: flowRun.projectId,
diff --git a/packages/server/api/src/app/flows/flow-run/flow-runs-queue.ts b/packages/server/api/src/app/flows/flow-run/flow-runs-queue.ts
index 738f73d6ebcb..f76b6b24dcaf 100644
--- a/packages/server/api/src/app/flows/flow-run/flow-runs-queue.ts
+++ b/packages/server/api/src/app/flows/flow-run/flow-runs-queue.ts
@@ -10,8 +10,8 @@ import { AppSystemProp } from '../../helper/system/system-props'
 import { projectService } from '../../project/project-service'
 import { resumeService } from '../../waitpoints/resume-service'
 import { waitpointService } from '../../waitpoints/waitpoint-service'
-import { WaitpointStatus } from '../../waitpoints/waitpoint-types'
 import { legacyRedisMetadataKey, QueueName, redisMetadataKey, runsMetadataDeduplicationId, RunsMetadataJobData, RunsMetadataQueueConfig, runsMetadataQueueFactory, RunsMetadataUpsertData } from '../../workers/job'
+import { jobFailureLogger } from '../../workers/job-queue/job-failure-logger'
 import { flowService } from '../flow/flow.service'
 import { flowRunRepo } from './flow-run-service'
 import { flowRunSideEffects } from './flow-run-side-effects'
@@ -138,14 +138,12 @@ export const runsMetadataQueue = (log: FastifyBaseLogger) => ({
                             }
 
                             if (savedFlowRun.status === FlowRunStatus.PAUSED) {
-                                const latestWaitpoint = await waitpointService(log).getByFlowRunId(savedFlowRun.id)
-                                const isPreCompleted = !isNil(latestWaitpoint)
-                                    && latestWaitpoint.status === WaitpointStatus.COMPLETED
-                                if (isPreCompleted) {
-                                    await resumeService(log).resumeFromWaitpointWithoutLock({
+                                const undeliveredWaitpoint = await waitpointService(log).findUndeliveredCompletedWaitpoint({ flowRunId: savedFlowRun.id, projectId: savedFlowRun.projectId })
+                                if (!isNil(undeliveredWaitpoint)) {
+                                    await resumeService(log).resumeTrustedWithoutLock({
                                         flowRunId: savedFlowRun.id,
-                                        waitpointId: latestWaitpoint.id,
-                                        resumePayload: latestWaitpoint.resumePayload,
+                                        waitpointId: undeliveredWaitpoint.id,
+                                        resumePayload: undeliveredWaitpoint.resumePayload,
                                     })
                                 }
                             }
@@ -169,6 +167,20 @@ export const runsMetadataQueue = (log: FastifyBaseLogger) => ({
             },
         )
 
+        runsMetadataWorker.on('failed', (job, err) => {
+            const attemptsUsed = job?.attemptsMade ?? 0
+            const maxAttempts = job?.opts?.attempts ?? 1
+            if (attemptsUsed >= maxAttempts) {
+                jobFailureLogger.logJobFailed({
+                    queueName: QueueName.RUNS_METADATA,
+                    jobId: job?.id,
+                    jobType: job?.name ?? 'update-run-metadata',
+                    error: err,
+                    log,
+                })
+            }
+        })
+
         await runsMetadataWorker.waitUntilReady()
     },
 
@@ -261,7 +273,7 @@ export async function markParentRunAsFailed({
         queryParams: {},
     }
 
-    const existingWaitpoint = await waitpointService(log).getByFlowRunId(parentRunId)
+    const existingWaitpoint = await waitpointService(log).findSubflowWaitpoint({ flowRunId: parentRunId, projectId: flowRun.projectId })
     const result = await waitpointService(log).complete({
         flowRunId: parentRunId,
         projectId: flowRun.projectId,
diff --git a/packages/server/api/src/app/flows/step-run/sample-data.service.ts b/packages/server/api/src/app/flows/step-run/sample-data.service.ts
index 1415fef44c7e..8aea4de635a1 100644
--- a/packages/server/api/src/app/flows/step-run/sample-data.service.ts
+++ b/packages/server/api/src/app/flows/step-run/sample-data.service.ts
@@ -1,5 +1,5 @@
 import { apId, FlowId, FlowVersionId, isNil, ProjectId, stringifyNullOrUndefined } from '@activepieces/core-utils'
-import { DATA_TYPE_KEY_IN_FILE_METADATA, FileCompression, FileType, FlowAction, flowStructureUtil, FlowTrigger, FlowVersion, SampleDataDataType, SampleDataFileType, SampleDataSettings, SaveSampleDataResponse, Step } from '@activepieces/shared'
+import { DATA_TYPE_KEY_IN_FILE_METADATA, FileCompression, FileType, FlowAction, FlowActionType, flowStructureUtil, FlowTrigger, FlowVersion, SampleDataDataType, SampleDataFileType, SampleDataSettings, SaveSampleDataResponse, Step } from '@activepieces/shared'
 import dayjs from 'dayjs'
 import { FastifyBaseLogger } from 'fastify'
 import { fileRepo, fileService } from '../../file/file.service'
@@ -55,19 +55,13 @@ export const sampleDataService = (log: FastifyBaseLogger) => ({
             type: params.fileType,
         }).andWhere('metadata->>\'flowId\' = :flowId', { flowId: params.flowId }).execute()
     },
-    async getSampleDataForFlow(projectId: ProjectId, flowVersion: FlowVersion, type: SampleDataFileType): Promise<Record<string, unknown>> {
-        const steps = flowStructureUtil.getAllSteps(flowVersion.trigger)
-        const sampleDataPromises = steps.map(async (step) => {
-            const data = await this.getOrReturnEmpty({
-                projectId,
-                flowVersion,
-                stepName: step.name,
-                type,
-            })
-            return { [step.name]: data }
-        })
-        const sampleDataArray = await Promise.all(sampleDataPromises)
-        return Object.assign({}, ...sampleDataArray)
+    async getSampleDataForFlow({ projectId, flowVersion, type, referencedBy }: GetSampleDataForFlowParams): Promise<Record<string, unknown>> {
+        const allSteps = flowStructureUtil.getAllSteps(flowVersion.trigger)
+        const steps = isNil(referencedBy) ? allSteps : selectReferencedSteps({ steps: allSteps, referencedBy })
+        return Object.fromEntries(await Promise.all(steps.map(async (step) => [
+            step.name,
+            await this.getOrReturnEmpty({ projectId, flowVersion, stepName: step.name, type }),
+        ])))
     },
 })
 
@@ -100,6 +94,21 @@ export async function saveSampleData({
     })
 }
 
+function selectReferencedSteps({ steps, referencedBy }: SelectReferencedStepsParams): Step[] {
+    const referenced: Step[] = []
+    let references = isNil(referencedBy) ? '' : JSON.stringify(referencedBy)
+    for (const step of [...steps].reverse()) {
+        if (!references.includes(step.name)) {
+            continue
+        }
+        referenced.push(step)
+        if (step.type === FlowActionType.LOOP_ON_ITEMS) {
+            references += JSON.stringify(step.settings)
+        }
+    }
+    return referenced.reverse()
+}
+
 async function useExistingOrCreateNewSampleId(projectId: ProjectId, flowVersion: FlowVersion, step: FlowAction | FlowTrigger, fileType: FileType, log: FastifyBaseLogger): Promise<string> {
     const sampleDataId = fileType === FileType.SAMPLE_DATA ? step.settings.sampleData?.sampleDataFileId : step.settings.sampleData?.sampleDataInputFileId
     if (isNil(sampleDataId)) {
@@ -118,6 +127,18 @@ async function useExistingOrCreateNewSampleId(projectId: ProjectId, flowVersion:
 }
 
 
+type SelectReferencedStepsParams = {
+    steps: Step[]
+    referencedBy: unknown
+}
+
+type GetSampleDataForFlowParams = {
+    projectId: ProjectId
+    flowVersion: FlowVersion
+    type: SampleDataFileType
+    referencedBy?: unknown
+}
+
 type DeleteSampleDataForStepParams = {
     projectId: ProjectId
     fileId: string
diff --git a/packages/server/api/src/app/helper/system-jobs/system-job.ts b/packages/server/api/src/app/helper/system-jobs/system-job.ts
index 239ee33ddecb..7635bc426f99 100644
--- a/packages/server/api/src/app/helper/system-jobs/system-job.ts
+++ b/packages/server/api/src/app/helper/system-jobs/system-job.ts
@@ -4,6 +4,7 @@ import { Job, JobsOptions, Queue, Worker } from 'bullmq'
 import { Dayjs } from 'dayjs'
 import { FastifyBaseLogger } from 'fastify'
 import { redisConnections } from '../../database/redis-connections'
+import { jobFailureLogger } from '../../workers/job-queue/job-failure-logger'
 import { exceptionHandler } from '../exception-handler'
 import { SystemJobData, SystemJobName, SystemJobSchedule } from './common'
 import { systemJobHandlers } from './job-handlers'
@@ -58,8 +59,15 @@ export const systemJobsSchedule = (log: FastifyBaseLogger): SystemJobSchedule =>
 
         systemJobWorker.on('failed', (job, err) => {
             const attemptsUsed = job?.attemptsMade ?? 0
-            const maxAttempts = job?.opts?.attempts ?? Infinity
+            const maxAttempts = job?.opts?.attempts ?? 1
             if (attemptsUsed >= maxAttempts) {
+                jobFailureLogger.logJobFailed({
+                    queueName: SYSTEM_JOB_QUEUE,
+                    jobId: job?.id,
+                    jobType: job?.name ?? 'unknown',
+                    error: err,
+                    log,
+                })
                 exceptionHandler.handle(err, log)
             }
         })
diff --git a/packages/server/api/src/app/helper/system-validator.ts b/packages/server/api/src/app/helper/system-validator.ts
index 6b0c97bc5833..2f148c387513 100644
--- a/packages/server/api/src/app/helper/system-validator.ts
+++ b/packages/server/api/src/app/helper/system-validator.ts
@@ -1,6 +1,6 @@
 import { inspect } from 'util'
 import { isNil } from '@activepieces/core-utils'
-import { ApEdition, ApEnvironment, DefaultProjectRole, ExecutionMode, FileLocation, NetworkMode, PieceSyncMode } from '@activepieces/shared'
+import { ApEdition, ApEnvironment, DefaultProjectRole, ExecutionMode, FileLocation, maxBarrierSignalsBounds, NetworkMode, PieceSyncMode } from '@activepieces/shared'
 import { FastifyBaseLogger } from 'fastify'
 import { DatabaseType } from '../database/database-type'
 import { RedisType } from '../database/redis/types'
@@ -39,6 +39,14 @@ function positiveFiniteNumberValidator(value: string | undefined) {
     return isValid ? true : 'Value must be a finite number greater than zero'
 }
 
+function boundedNumberValidator({ min, max }: { min: number, max: number }) {
+    return (value: string | undefined) => {
+        const parsed = Number(value)
+        const isValid = !isNil(value) && Number.isInteger(parsed) && parsed >= min && parsed <= max
+        return isValid ? true : `Value must be a whole number between ${min} and ${max}`
+    }
+}
+
 function stringValidator(value: string) {
     const isValid = typeof value === 'string' && value.length > 0
     return isValid ? true : 'Value must be a non-empty string'
@@ -75,6 +83,7 @@ const systemPropValidators: {
     [AppSystemProp.EVENT_DESTINATION_TIMEOUT_SECONDS]: numberValidator,
     [AppSystemProp.PAUSED_FLOW_TIMEOUT_DAYS]: numberValidator,
     [AppSystemProp.APP_WEBHOOK_SECRETS]: stringValidator,
+    [AppSystemProp.MAX_BARRIER_SIGNALS]: boundedNumberValidator(maxBarrierSignalsBounds),
     [AppSystemProp.MAX_FILE_SIZE_MB]: numberValidator,
     [AppSystemProp.AI_CREDIT_USD_VALUE]: positiveFiniteNumberValidator,
     [AppSystemProp.MAX_FLOW_RUN_LOG_SIZE_MB]: numberValidator,
diff --git a/packages/server/api/src/app/helper/system/system-props.ts b/packages/server/api/src/app/helper/system/system-props.ts
index 23978e21483f..c1c2086e283c 100644
--- a/packages/server/api/src/app/helper/system/system-props.ts
+++ b/packages/server/api/src/app/helper/system/system-props.ts
@@ -57,6 +57,7 @@ export enum AppSystemProp {
     LOKI_PASSWORD = 'LOKI_PASSWORD',
     LOKI_URL = 'LOKI_URL',
     LOKI_USERNAME = 'LOKI_USERNAME',
+    MAX_BARRIER_SIGNALS = 'MAX_BARRIER_SIGNALS',
     MAX_FIELDS_PER_TABLE = 'MAX_FIELDS_PER_TABLE',
     MAX_FILE_SIZE_MB = 'MAX_FILE_SIZE_MB',
     AI_CREDIT_USD_VALUE = 'AI_CREDIT_USD_VALUE',
diff --git a/packages/server/api/src/app/helper/system/system.ts b/packages/server/api/src/app/helper/system/system.ts
index 45ae8d697c20..16e33a073cd2 100644
--- a/packages/server/api/src/app/helper/system/system.ts
+++ b/packages/server/api/src/app/helper/system/system.ts
@@ -36,6 +36,7 @@ const systemPropDefaultValues: Partial<Record<SystemProp, string>> = {
     [AppSystemProp.LOG_LEVEL]: 'info',
     [AppSystemProp.LOG_PRETTY]: 'false',
     [AppSystemProp.S3_USE_SIGNED_URLS]: 'false',
+    [AppSystemProp.MAX_BARRIER_SIGNALS]: '10000',
     [AppSystemProp.MAX_FILE_SIZE_MB]: '25',
     [AppSystemProp.AI_CREDIT_USD_VALUE]: '0.0005',
     [AppSystemProp.MAX_FLOW_RUN_LOG_SIZE_MB]: '50',
diff --git a/packages/server/api/src/app/mcp/tools/ap-get-piece-props.ts b/packages/server/api/src/app/mcp/tools/ap-get-piece-props.ts
index 8b492988762e..138c837c12b9 100644
--- a/packages/server/api/src/app/mcp/tools/ap-get-piece-props.ts
+++ b/packages/server/api/src/app/mcp/tools/ap-get-piece-props.ts
@@ -158,7 +158,12 @@ async function resolvePropertyOptions({ props, componentProps, pieceName, pieceV
     const [piecePackage, sampleData] = await Promise.all([
         getPiecePackageWithoutArchive(log, platformId, { pieceName, pieceVersion }),
         flow
-            ? sampleDataService(log).getSampleDataForFlow(projectId, flow.version, SampleDataFileType.OUTPUT)
+            ? sampleDataService(log).getSampleDataForFlow({
+                projectId,
+                flowVersion: flow.version,
+                type: SampleDataFileType.OUTPUT,
+                referencedBy: providedInput,
+            })
             : Promise.resolve({} as Record<string, unknown>),
     ])
     const flowVersion: FlowVersion | undefined = flow?.version
diff --git a/packages/server/api/src/app/pieces/metadata/piece-metadata-controller.ts b/packages/server/api/src/app/pieces/metadata/piece-metadata-controller.ts
index eeac17ff19e5..8d4760fbb29f 100644
--- a/packages/server/api/src/app/pieces/metadata/piece-metadata-controller.ts
+++ b/packages/server/api/src/app/pieces/metadata/piece-metadata-controller.ts
@@ -138,7 +138,12 @@ const basePiecesController: FastifyPluginAsyncZod = async (app) => {
                 id: req.body.flowId,
                 versionId: req.body.flowVersionId,
             })
-            const sampleData = await sampleDataService(req.log).getSampleDataForFlow(projectId, flow.version, SampleDataFileType.OUTPUT)
+            const sampleData = await sampleDataService(req.log).getSampleDataForFlow({
+                projectId,
+                flowVersion: flow.version,
+                type: SampleDataFileType.OUTPUT,
+                referencedBy: req.body.input,
+            })
             const { response } = await userInteractionWatcher.submitAndWaitForResponse<EngineResponse<unknown>>({
                 jobType: WorkerJobType.EXECUTE_PROPERTY,
                 platformId: platform.id,
diff --git a/packages/server/api/src/app/platform/platform-configuration.controller.ts b/packages/server/api/src/app/platform/platform-configuration.controller.ts
index 588cb794f720..dfeb73aa126a 100644
--- a/packages/server/api/src/app/platform/platform-configuration.controller.ts
+++ b/packages/server/api/src/app/platform/platform-configuration.controller.ts
@@ -16,6 +16,7 @@ export const platformConfigurationController: FastifyPluginAsyncZod = async (app
             platformId: request.principal.platform.id,
             isProductTelemetryEnabled: request.body.isProductTelemetryEnabled,
             isInfraSetupTelemetryEnabled: request.body.isInfraSetupTelemetryEnabled,
+            maxBarrierSignals: request.body.maxBarrierSignals,
         })
     })
 }
diff --git a/packages/server/api/src/app/platform/platform-configuration.entity.ts b/packages/server/api/src/app/platform/platform-configuration.entity.ts
index 51d71f49b124..fc31eed0245b 100644
--- a/packages/server/api/src/app/platform/platform-configuration.entity.ts
+++ b/packages/server/api/src/app/platform/platform-configuration.entity.ts
@@ -24,6 +24,11 @@ export const PlatformConfigurationEntity = new EntitySchema<PlatformConfiguratio
             nullable: false,
             default: true,
         },
+        maxBarrierSignals: {
+            type: Number,
+            nullable: false,
+            default: 10000,
+        },
     },
     indices: [
         {
diff --git a/packages/server/api/src/app/platform/platform-configuration.service.ts b/packages/server/api/src/app/platform/platform-configuration.service.ts
index a982af04d0ac..b711a384f654 100644
--- a/packages/server/api/src/app/platform/platform-configuration.service.ts
+++ b/packages/server/api/src/app/platform/platform-configuration.service.ts
@@ -1,5 +1,5 @@
 import { apId, chunk, isEmpty, isNil, spreadIfNotUndefined } from '@activepieces/core-utils'
-import { ApEdition, PlatformConfiguration, UpdatePlatformConfigurationRequestBody } from '@activepieces/shared'
+import { ApEdition, maxBarrierSignalsBounds, PlatformConfiguration, UpdatePlatformConfigurationRequestBody } from '@activepieces/shared'
 import { FastifyBaseLogger } from 'fastify'
 import { In } from 'typeorm'
 import { repoFactory } from '../core/db/repo-factory'
@@ -41,6 +41,14 @@ export const platformConfigurationService = (log: FastifyBaseLogger) => ({
         return configuration.isProductTelemetryEnabled
     },
 
+    async maxBarrierSignals({ platformId }: GetOrCreateParams): Promise<number> {
+        if (system.getEdition() === ApEdition.CLOUD) {
+            return clampBarrierSignalCap(system.getNumberOrThrow(AppSystemProp.MAX_BARRIER_SIGNALS))
+        }
+        const configuration = await this.getOrCreateForPlatform({ platformId })
+        return configuration.maxBarrierSignals
+    },
+
     async filterProjectsWithProductTelemetryEnabled({ projectIds }: FilterProjectsParams): Promise<string[]> {
         if (projectIds.length === 0) {
             return []
@@ -83,11 +91,12 @@ export const platformConfigurationService = (log: FastifyBaseLogger) => ({
         return platformIds.filter((platformId) => !optedOutIds.has(platformId))
     },
 
-    async update({ platformId, isProductTelemetryEnabled, isInfraSetupTelemetryEnabled }: UpdateParams): Promise<PlatformConfiguration> {
+    async update({ platformId, isProductTelemetryEnabled, isInfraSetupTelemetryEnabled, maxBarrierSignals }: UpdateParams): Promise<PlatformConfiguration> {
         await this.getOrCreateForPlatform({ platformId })
         const patch = {
             ...spreadIfNotUndefined('isProductTelemetryEnabled', isProductTelemetryEnabled),
             ...spreadIfNotUndefined('isInfraSetupTelemetryEnabled', isInfraSetupTelemetryEnabled),
+            ...spreadIfNotUndefined('maxBarrierSignals', maxBarrierSignals),
         }
         if (!isEmpty(patch)) {
             await platformConfigurationRepo().update({ platformId }, patch)
@@ -98,13 +107,20 @@ export const platformConfigurationService = (log: FastifyBaseLogger) => ({
 
 async function createInitialConfiguration({ platformId }: GetOrCreateParams): Promise<PlatformConfiguration> {
     const isProductTelemetryEnabled = system.getBoolean(AppSystemProp.TELEMETRY_ENABLED)
+    const configuredMaxBarrierSignals = system.getNumber(AppSystemProp.MAX_BARRIER_SIGNALS)
+    const maxBarrierSignals = isNil(configuredMaxBarrierSignals) ? undefined : clampBarrierSignalCap(configuredMaxBarrierSignals)
     return platformConfigurationRepo().save({
         id: apId(),
         platformId,
         ...spreadIfNotUndefined('isProductTelemetryEnabled', isProductTelemetryEnabled),
+        ...spreadIfNotUndefined('maxBarrierSignals', maxBarrierSignals),
     })
 }
 
+function clampBarrierSignalCap(configured: number): number {
+    return Math.min(Math.max(configured, maxBarrierSignalsBounds.min), maxBarrierSignalsBounds.max)
+}
+
 type GetOrCreateParams = {
     platformId: string
 }
diff --git a/packages/server/api/src/app/waitpoints/barrier-queue-factory.ts b/packages/server/api/src/app/waitpoints/barrier-queue-factory.ts
new file mode 100644
index 000000000000..d357b8d2f764
--- /dev/null
+++ b/packages/server/api/src/app/waitpoints/barrier-queue-factory.ts
@@ -0,0 +1,74 @@
+import { apDayjsDuration } from '@activepieces/server-utils'
+import { Queue } from 'bullmq'
+import Redis from 'ioredis'
+import { QueueName } from '../workers/job'
+
+export const evaluationDedupKey = (barrierId: string): string => `evaluate-${barrierId}`
+
+export const barrierQueueFactory = ({ createRedisConnection }: BarrierQueueFactoryParams) => {
+    let queueInstance: Queue<BarrierJobData> | undefined = undefined
+
+    const requireQueue = (): Queue<BarrierJobData> => {
+        if (!queueInstance) {
+            throw new Error('Barrier queue not initialized')
+        }
+        return queueInstance
+    }
+
+    return {
+        async init(config: BarrierQueueConfig): Promise<void> {
+            queueInstance = new Queue<BarrierJobData>(QueueName.BARRIER_EVALUATION, {
+                connection: await createRedisConnection(),
+                defaultJobOptions: {
+                    attempts: 5,
+                    backoff: {
+                        type: 'exponential',
+                        delay: apDayjsDuration(8, 'minute').asMilliseconds(),
+                    },
+                    removeOnComplete: true,
+                    removeOnFail: {
+                        age: apDayjsDuration(config.redisFailedJobRetentionDays, 'day').asSeconds(),
+                        count: config.redisFailedJobRetentionMaxCount,
+                    },
+                },
+            })
+            await queueInstance.waitUntilReady()
+        },
+
+        async enqueueEvaluation(params: BarrierJobData): Promise<void> {
+            await requireQueue().add(BarrierJobName.EVALUATE, params, {
+                deduplication: { id: evaluationDedupKey(params.barrierId) },
+            })
+        },
+
+        async clearEvaluationDedupKey(barrierId: string): Promise<void> {
+            await requireQueue().removeDeduplicationKey(evaluationDedupKey(barrierId))
+        },
+
+        get(): Queue<BarrierJobData> {
+            return requireQueue()
+        },
+
+        isInitialized(): boolean {
+            return queueInstance !== undefined
+        },
+    }
+}
+
+export enum BarrierJobName {
+    EVALUATE = 'evaluate-barrier',
+}
+
+export type BarrierJobData = {
+    barrierId: string
+    projectId: string
+}
+
+export type BarrierQueueConfig = {
+    redisFailedJobRetentionDays: number
+    redisFailedJobRetentionMaxCount: number
+}
+
+type BarrierQueueFactoryParams = {
+    createRedisConnection: () => Promise<Redis>
+}
diff --git a/packages/server/api/src/app/waitpoints/barrier-queue.ts b/packages/server/api/src/app/waitpoints/barrier-queue.ts
new file mode 100644
index 000000000000..a920e488912d
--- /dev/null
+++ b/packages/server/api/src/app/waitpoints/barrier-queue.ts
@@ -0,0 +1,85 @@
+import { createLogger, wideEvent } from '@activepieces/server-utils'
+import { Job, Queue, Worker } from 'bullmq'
+import { FastifyBaseLogger } from 'fastify'
+import { redisConnections } from '../database/redis-connections'
+import { system } from '../helper/system/system'
+import { AppSystemProp } from '../helper/system/system-props'
+import { QueueName } from '../workers/job'
+import { BarrierJobData, BarrierJobName, BarrierQueueConfig, barrierQueueFactory } from './barrier-queue-factory'
+import { barrierService } from './barrier-service'
+
+let barrierWorker: Worker<BarrierJobData> | undefined = undefined
+
+const barrierQueueInstance = barrierQueueFactory({ createRedisConnection: redisConnections.create })
+
+export const barrierQueue = (log: FastifyBaseLogger) => ({
+    async init(): Promise<void> {
+        const config: BarrierQueueConfig = {
+            redisFailedJobRetentionDays: system.getNumberOrThrow(AppSystemProp.REDIS_FAILED_JOB_RETENTION_DAYS),
+            redisFailedJobRetentionMaxCount: system.getNumberOrThrow(AppSystemProp.REDIS_FAILED_JOB_RETENTION_MAX_COUNT),
+        }
+        await barrierQueueInstance.init(config)
+        barrierWorker = new Worker<BarrierJobData>(
+            QueueName.BARRIER_EVALUATION,
+            async (job) => {
+                const jobLogger = createLogger({
+                    event: 'barrier.job',
+                    job: { id: job.id, type: job.name },
+                    fanIn: { barrierId: job.data.barrierId },
+                })
+                return wideEvent.run({
+                    logger: jobLogger,
+                    fn: () => processBarrierJob({ job, log })
+                        .catch((error: unknown) => {
+                            wideEvent.error(error)
+                            throw error
+                        })
+                        .finally(() => jobLogger.emit()),
+                })
+            },
+            {
+                connection: await redisConnections.create(),
+                concurrency: system.getNumberOrThrow(AppSystemProp.RUNS_METADATA_UPDATE_CONCURRENCY),
+                autorun: true,
+            },
+        )
+        await barrierWorker.waitUntilReady()
+    },
+
+    async enqueueEvaluation(params: BarrierJobData): Promise<void> {
+        await barrierQueueInstance.enqueueEvaluation(params)
+    },
+
+    async clearEvaluationDedupKey(barrierId: string): Promise<void> {
+        await barrierQueueInstance.clearEvaluationDedupKey(barrierId)
+    },
+
+    get(): Queue<BarrierJobData> {
+        return barrierQueueInstance.get()
+    },
+
+    async close(): Promise<void> {
+        if (barrierQueueInstance.isInitialized()) {
+            await barrierQueueInstance.get().close()
+        }
+        if (barrierWorker) {
+            await barrierWorker.close()
+        }
+    },
+})
+
+async function processBarrierJob({ job, log }: ProcessBarrierJobParams): Promise<void> {
+    switch (job.name) {
+        case BarrierJobName.EVALUATE:
+            await barrierQueueInstance.clearEvaluationDedupKey(job.data.barrierId)
+            await barrierService(log).releaseIfReady({ barrierId: job.data.barrierId, projectId: job.data.projectId })
+            return
+        default:
+            log.warn({ job: { id: job.id, type: job.name } }, '[barrierQueue#worker] Unknown barrier job name, dropping it')
+    }
+}
+
+type ProcessBarrierJobParams = {
+    job: Job<BarrierJobData>
+    log: FastifyBaseLogger
+}
diff --git a/packages/server/api/src/app/waitpoints/barrier-service.ts b/packages/server/api/src/app/waitpoints/barrier-service.ts
new file mode 100644
index 000000000000..7431fc6406e9
--- /dev/null
+++ b/packages/server/api/src/app/waitpoints/barrier-service.ts
@@ -0,0 +1,342 @@
+import { apId, chunk, isNil, sanitizeObjectForPostgresql, tryCatch } from '@activepieces/core-utils'
+import { wideEvent } from '@activepieces/server-utils'
+import { ActivepiecesError, BarrierPolicy, barrierReleasesOnLastPendingSignal, BarrierSignalCounts, BarrierSignalStatus, BarrierSummary, ErrorCode, MAX_INLINE_BARRIER_SIGNALS, PauseType, RespondResponse, shouldReleaseBarrier, WaitpointVersion } from '@activepieces/shared'
+import dayjs from 'dayjs'
+import { FastifyBaseLogger } from 'fastify'
+import { EntityManager } from 'typeorm'
+import { repoFactory } from '../core/db/repo-factory'
+import { transaction } from '../core/db/transaction'
+import { system } from '../helper/system/system'
+import { AppSystemProp } from '../helper/system/system-props'
+import { platformConfigurationService } from '../platform/platform-configuration.service'
+import { barrierQueue } from './barrier-queue'
+import { resumeService } from './resume-service'
+import { WaitpointEntity } from './waitpoint-entity'
+import { WaitpointSignalEntity } from './waitpoint-signal-entity'
+import { Waitpoint, WaitpointSignal, WaitpointStatus } from './waitpoint-types'
+
+const waitpointRepo = repoFactory(WaitpointEntity)
+const signalRepo = repoFactory(WaitpointSignalEntity)
+
+export const barrierService = (log: FastifyBaseLogger) => ({
+    async create(params: CreateBarrierParams): Promise<CreateBarrierResult> {
+        const labels = params.signalLabels ?? []
+        await assertSignalCountWithinLimit({ signalCount: labels.length, platformId: params.platformId, log })
+
+        const creation = await transaction(async (entityManager) => {
+            const repo = waitpointRepo(entityManager)
+            const existing = await repo.findOneBy({ flowRunId: params.flowRunId, projectId: params.projectId, stepName: params.stepName })
+            if (!isNil(existing) && existing.status === WaitpointStatus.PENDING) {
+                log.info({ flowRun: { id: params.flowRunId }, waitpoint: { id: existing.id } }, '[barrierService#create] Barrier already open for this step, reusing it')
+                return { inserted: false, barrier: existing, signals: await signalRepo(entityManager).findBy({ waitpointId: existing.id, projectId: params.projectId }) }
+            }
+            if (!isNil(existing)) {
+                await repo.delete({ id: existing.id, projectId: params.projectId })
+            }
+            const now = dayjs().toISOString()
+            const barrier: Waitpoint = {
+                id: apId(),
+                created: now,
+                updated: now,
+                flowRunId: params.flowRunId,
+                projectId: params.projectId,
+                stepName: params.stepName,
+                type: PauseType.BARRIER,
+                version: params.version,
+                status: WaitpointStatus.PENDING,
+                resumeDateTime: defaultBarrierDeadline(),
+                responseToSend: params.responseToSend ?? null,
+                workerHandlerId: params.workerHandlerId ?? null,
+                httpRequestId: params.httpRequestId ?? null,
+                resumePayload: null,
+                sealed: true,
+                policy: params.policy ?? null,
+            }
+            await repo.createQueryBuilder().insert().into('waitpoint').values(barrier).execute()
+            const signals = buildPendingSignals({ barrierId: barrier.id, projectId: params.projectId, labels })
+            for (const rows of chunk(signals, SIGNAL_INSERT_BATCH_SIZE)) {
+                await signalRepo(entityManager).createQueryBuilder().insert().into('waitpoint_signal').values(rows).execute()
+            }
+            return { inserted: true, barrier, signals }
+        })
+
+        if (creation.inserted) {
+            await barrierQueue(log).enqueueEvaluation({ barrierId: creation.barrier.id, projectId: params.projectId })
+        }
+
+        return { barrier: creation.barrier, signals: creation.signals, signalCount: creation.signals.length }
+    },
+
+    async findById({ barrierId, projectId }: FindByIdParams): Promise<Waitpoint | null> {
+        return waitpointRepo().findOneBy({ id: barrierId, projectId, type: PauseType.BARRIER })
+    },
+
+    async findSignalById({ signalId, projectId }: FindSignalByIdParams): Promise<WaitpointSignal | null> {
+        return signalRepo().findOneBy({ id: signalId, projectId })
+    },
+
+    async receiveSignal(params: ReceiveSignalParams): Promise<WaitpointSignal | null> {
+        if (isNil(params.signalId) && isNil(params.refId)) {
+            return null
+        }
+        const signal = isNil(params.signalId)
+            ? await signalRepo().findOneBy({ refId: params.refId, projectId: params.projectId })
+            : await signalRepo().findOneBy({ id: params.signalId, projectId: params.projectId })
+        if (isNil(signal)) {
+            return null
+        }
+        await signalRepo().save({
+            ...signal,
+            status: params.status,
+            result: isNil(params.result) ? null : sanitizeObjectForPostgresql(params.result),
+        })
+        await barrierQueue(log).enqueueEvaluation({ barrierId: signal.waitpointId, projectId: signal.projectId })
+        return signal
+    },
+
+    async releaseIfReady({ barrierId, projectId }: ReleaseIfReadyParams): Promise<void> {
+        const barrier = await waitpointRepo().findOneBy({ id: barrierId, projectId, type: PauseType.BARRIER })
+        if (isNil(barrier)) {
+            return
+        }
+        if (barrier.status === WaitpointStatus.COMPLETED) {
+            await redeliverClosedBarrier({ barrier, log })
+            return
+        }
+        if (barrier.status !== WaitpointStatus.PENDING) {
+            return
+        }
+        if (!await isReadyToRelease({ barrier, projectId })) {
+            return
+        }
+        await this.release({ barrier, timedOut: false, releaseReason: 'predicate' })
+    },
+
+    async release({ barrier, timedOut, releaseReason }: ReleaseParams): Promise<BarrierSummary | null> {
+        const summary = await closeBarrier({ barrier, timedOut })
+        if (isNil(summary)) {
+            log.info({ waitpoint: { id: barrier.id }, flowRun: { id: barrier.flowRunId } }, '[barrierService#release] Barrier was already closed by another release; leaving the resume to the release that closed it')
+            return null
+        }
+        wideEvent.set({
+            fanIn: {
+                barrierId: barrier.id,
+                signalCount: summary.total,
+                releaseReason,
+                stillRunning: summary.stillRunning,
+            },
+        })
+        await resumeService(log).resumeTrusted({
+            flowRunId: barrier.flowRunId,
+            waitpointId: barrier.id,
+            resumePayload: { body: summary, headers: {}, queryParams: {} },
+        })
+        return summary
+    },
+})
+
+function buildPendingSignals({ barrierId, projectId, labels }: BuildPendingSignalsParams): WaitpointSignal[] {
+    const now = new Date().toISOString()
+    return labels.map((label) => ({
+        id: apId(),
+        created: now,
+        updated: now,
+        waitpointId: barrierId,
+        projectId,
+        status: BarrierSignalStatus.PENDING,
+        refId: null,
+        sequence: null,
+        label,
+        result: null,
+    }))
+}
+
+async function closeBarrier({ barrier, timedOut }: CloseBarrierParams): Promise<BarrierSummary | null> {
+    return transaction(async (entityManager) => {
+        const repo = waitpointRepo(entityManager)
+        const lockedBarrier = await repo
+            .createQueryBuilder('waitpoint')
+            .setLock('pessimistic_write')
+            .where({ id: barrier.id, projectId: barrier.projectId, status: WaitpointStatus.PENDING })
+            .getOne()
+        if (isNil(lockedBarrier)) {
+            return null
+        }
+        const summary = await buildSummary({ barrierId: lockedBarrier.id, projectId: lockedBarrier.projectId, timedOut, entityManager })
+        await repo.save({
+            ...lockedBarrier,
+            status: WaitpointStatus.COMPLETED,
+            resumePayload: { body: summary, headers: {}, queryParams: {} },
+        })
+        await signalRepo(entityManager).delete({ waitpointId: lockedBarrier.id, projectId: lockedBarrier.projectId })
+        return summary
+    })
+}
+
+async function redeliverClosedBarrier({ barrier, log }: RedeliverClosedBarrierParams): Promise<void> {
+    log.warn({ waitpoint: { id: barrier.id }, flowRun: { id: barrier.flowRunId } }, '[barrierService#redeliverClosedBarrier] Barrier was closed but never delivered; re-dispatching the persisted summary')
+    const { error } = await tryCatch(() => resumeService(log).resumeTrusted({
+        flowRunId: barrier.flowRunId,
+        waitpointId: barrier.id,
+        resumePayload: barrier.resumePayload,
+    }))
+    if (!isNil(error)) {
+        log.error({ error, waitpoint: { id: barrier.id }, flowRun: { id: barrier.flowRunId } }, '[barrierService#redeliverClosedBarrier] Re-dispatching a closed barrier failed')
+        throw error
+    }
+}
+
+async function isReadyToRelease({ barrier, projectId }: IsReadyToReleaseParams): Promise<boolean> {
+    const { policy, sealed } = barrier
+    if (barrierReleasesOnLastPendingSignal({ policy, sealed })) {
+        return !await signalRepo().existsBy({ waitpointId: barrier.id, projectId, status: BarrierSignalStatus.PENDING })
+    }
+    const counts = await countSignalsByStatus({ barrierId: barrier.id, projectId })
+    return shouldReleaseBarrier({ policy, sealed, counts })
+}
+
+async function countSignalsByStatus({ barrierId, projectId, entityManager }: CountSignalsByStatusParams): Promise<BarrierSignalCounts> {
+    const rows = await signalRepo(entityManager)
+        .createQueryBuilder('signal')
+        .select('signal."status"', 'status')
+        .addSelect('COUNT(*)', 'count')
+        .where('signal."waitpointId" = :barrierId', { barrierId })
+        .andWhere('signal."projectId" = :projectId', { projectId })
+        .groupBy('signal."status"')
+        .getRawMany<{ status: BarrierSignalStatus, count: string }>()
+    return rows.reduce<BarrierSignalCounts>((accumulated, row) => ({ ...accumulated, [row.status]: Number(row.count) }), {})
+}
+
+async function buildSummary({ barrierId, projectId, timedOut, entityManager }: BuildSummaryParams): Promise<BarrierSummary> {
+    const counts = await countSignalsByStatus({ barrierId, projectId, entityManager })
+    const total = Object.values(counts).reduce((sum, count) => sum + count, 0)
+    const inlineSignals = total <= MAX_INLINE_BARRIER_SIGNALS
+        ? await signalRepo(entityManager).find({ where: { waitpointId: barrierId, projectId }, order: { sequence: 'ASC', created: 'ASC' } })
+        : null
+
+    return {
+        total,
+        succeeded: counts[BarrierSignalStatus.SUCCEEDED] ?? 0,
+        failed: counts[BarrierSignalStatus.FAILED] ?? 0,
+        rejected: counts[BarrierSignalStatus.REJECTED] ?? 0,
+        canceled: counts[BarrierSignalStatus.CANCELED] ?? 0,
+        notDispatched: counts[BarrierSignalStatus.NOT_DISPATCHED] ?? 0,
+        stillRunning: counts[BarrierSignalStatus.PENDING] ?? 0,
+        timedOut,
+        ...(isNil(inlineSignals)
+            ? { signalsTruncated: true }
+            : {
+                signals: inlineSignals.map((signal) => ({
+                    sequence: signal.sequence,
+                    label: signal.label,
+                    outcome: signal.status,
+                    result: signal.result ?? null,
+                    runId: signal.refId,
+                })),
+            }),
+    }
+}
+
+async function assertSignalCountWithinLimit({ signalCount, platformId, log }: AssertSignalCountWithinLimitParams): Promise<void> {
+    const maxSignals = await platformConfigurationService(log).maxBarrierSignals({ platformId })
+    if (signalCount > maxSignals) {
+        throw new ActivepiecesError({
+            code: ErrorCode.VALIDATION,
+            params: { message: `This step waits on ${signalCount} things, which exceeds the maximum of ${maxSignals}. Wait on fewer things.` },
+        })
+    }
+}
+
+function defaultBarrierDeadline(): string {
+    const maxDurationInDays = system.getNumberOrThrow(AppSystemProp.PAUSED_FLOW_TIMEOUT_DAYS)
+    return dayjs().add(maxDurationInDays, 'day').toISOString()
+}
+
+const SIGNAL_INSERT_BATCH_SIZE = 500
+
+export type BarrierReleaseReason = 'predicate' | 'timeout'
+
+export type CreateBarrierParams = {
+    flowRunId: string
+    projectId: string
+    platformId: string
+    stepName: string
+    version: WaitpointVersion
+    responseToSend?: RespondResponse
+    workerHandlerId?: string
+    httpRequestId?: string
+    policy?: BarrierPolicy
+    signalLabels?: (string | null)[]
+}
+
+export type CreateBarrierResult = {
+    barrier: Waitpoint
+    signals: WaitpointSignal[]
+    signalCount: number
+}
+
+export type ReceiveSignalParams = {
+    signalId?: string
+    refId?: string
+    projectId: string
+    status: BarrierSignalStatus
+    result?: Record<string, unknown>
+}
+
+type FindSignalByIdParams = {
+    signalId: string
+    projectId: string
+}
+
+type ReleaseIfReadyParams = {
+    barrierId: string
+    projectId: string
+}
+
+type FindByIdParams = {
+    barrierId: string
+    projectId: string
+}
+
+type ReleaseParams = {
+    barrier: Waitpoint
+    timedOut: boolean
+    releaseReason: BarrierReleaseReason
+}
+
+type CloseBarrierParams = {
+    barrier: Waitpoint
+    timedOut: boolean
+}
+
+type RedeliverClosedBarrierParams = {
+    barrier: Waitpoint
+    log: FastifyBaseLogger
+}
+
+type IsReadyToReleaseParams = {
+    barrier: Waitpoint
+    projectId: string
+}
+
+type CountSignalsByStatusParams = {
+    barrierId: string
+    projectId: string
+    entityManager?: EntityManager
+}
+
+type BuildSummaryParams = CountSignalsByStatusParams & {
+    timedOut: boolean
+}
+
+type BuildPendingSignalsParams = {
+    barrierId: string
+    projectId: string
+    labels: (string | null)[]
+}
+
+type AssertSignalCountWithinLimitParams = {
+    signalCount: number
+    platformId: string
+    log: FastifyBaseLogger
+}
diff --git a/packages/server/api/src/app/waitpoints/resume-controller.ts b/packages/server/api/src/app/waitpoints/resume-controller.ts
index e1391948a215..f221de63cbd2 100644
--- a/packages/server/api/src/app/waitpoints/resume-controller.ts
+++ b/packages/server/api/src/app/waitpoints/resume-controller.ts
@@ -54,7 +54,8 @@ export const resumeController: FastifyPluginAsyncZod = async (app) => {
     app.all('/:id/requests/:requestId', V0ResumeFlowRunRequest, async (req, reply) => {
         const headers = req.headers as Record<string, string>
         const queryParams = req.query as Record<string, string>
-        const waitpoint = await waitpointService(req.log).findPendingByVersion({ flowRunId: req.params.id, version: 'V0' })
+        const flowRun = await findFlowRunOrThrow(req.params.id)
+        const waitpoint = await waitpointService(req.log).findPendingByVersion({ flowRunId: flowRun.id, projectId: flowRun.projectId, version: 'V0' })
         if (waitpoint) {
             await handleAsyncResume({ flowRunId: req.params.id, waitpointId: waitpoint.id, body: req.body, headers, queryParams, log: req.log, reply })
         }
@@ -69,7 +70,8 @@ export const resumeController: FastifyPluginAsyncZod = async (app) => {
     app.all('/:id/requests/:requestId/sync', V0ResumeFlowRunRequest, async (req, reply) => {
         const headers = req.headers as Record<string, string>
         const queryParams = req.query as Record<string, string>
-        const waitpoint = await waitpointService(req.log).findPendingByVersion({ flowRunId: req.params.id, version: 'V0' })
+        const flowRun = await findFlowRunOrThrow(req.params.id)
+        const waitpoint = await waitpointService(req.log).findPendingByVersion({ flowRunId: flowRun.id, projectId: flowRun.projectId, version: 'V0' })
         if (waitpoint) {
             await handleSyncResume({ flowRunId: req.params.id, waitpointId: waitpoint.id, body: req.body, headers, queryParams, log: req.log, reply, correlationId: waitpoint.workerHandlerId ?? waitpoint.id })
         }
@@ -82,7 +84,7 @@ export const resumeController: FastifyPluginAsyncZod = async (app) => {
 async function serveConfirmationPage({ flowRunId, waitpointId, url, queryParams, log, reply }: ConfirmationPageParams): Promise<void> {
     const flowRun = await findFlowRunOrThrow(flowRunId)
     const theme = await resolveResumePageTheme({ projectId: flowRun.projectId, log })
-    const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId, flowRunId })
+    const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId, flowRunId, projectId: flowRun.projectId })
     const isOpen = !isNil(waitpoint) && waitpoint.status === WaitpointStatus.PENDING && flowRun.status === FlowRunStatus.PAUSED
     if (!isOpen) {
         await replyWithHtml({ reply, html: Mustache.render(STATUS_HTML_TEMPLATE, buildThemeView({ theme, extra: { title: ALREADY_TITLE, message: ALREADY_MESSAGE, success: false } })) })
diff --git a/packages/server/api/src/app/waitpoints/resume-delay-handler.ts b/packages/server/api/src/app/waitpoints/resume-delay-handler.ts
index 922e1e3bab4f..b04f0f3d436a 100644
--- a/packages/server/api/src/app/waitpoints/resume-delay-handler.ts
+++ b/packages/server/api/src/app/waitpoints/resume-delay-handler.ts
@@ -24,7 +24,7 @@ export async function handleResumeDelayWaitpoint({ data, log }: HandleResumeDela
             '[RESUME_DELAY_WAITPOINT] Flow not PAUSED, skipping')
         return
     }
-    const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId: data.waitpointId, flowRunId: data.flowRunId })
+    const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId: data.waitpointId, flowRunId: data.flowRunId, projectId: flowRun.projectId })
     if (isNil(waitpoint) || waitpoint.status !== WaitpointStatus.PENDING) {
         log.info({ flowRun: { id: data.flowRunId }, waitpoint: { id: data.waitpointId }, waitpointStatus: waitpoint?.status },
             '[RESUME_DELAY_WAITPOINT] Waitpoint no longer PENDING (stale timer from completed/deleted waitpoint), skipping')
diff --git a/packages/server/api/src/app/waitpoints/resume-service.ts b/packages/server/api/src/app/waitpoints/resume-service.ts
index 15413acf0382..5c069fb1c5d3 100644
--- a/packages/server/api/src/app/waitpoints/resume-service.ts
+++ b/packages/server/api/src/app/waitpoints/resume-service.ts
@@ -1,5 +1,5 @@
 import { apId, FlowRunId, isNil, tryCatch } from '@activepieces/core-utils'
-import { EngineHttpResponse, ExecutionType, FlowRun, FlowRunStatus, isFlowRunStateTerminal, ResumeReason, RunEnvironment, StreamStepProgress } from '@activepieces/shared'
+import { EngineHttpResponse, ExecutionType, FlowRun, FlowRunStatus, isFlowRunStateTerminal, PauseType, ResumeReason, RunEnvironment, StreamStepProgress } from '@activepieces/shared'
 import { FastifyBaseLogger } from 'fastify'
 import { StatusCodes } from 'http-status-codes'
 import { distributedLock, distributedStore } from '../database/redis-connections'
@@ -7,20 +7,38 @@ import { addToQueue, findFlowRunOrThrow, flowRunService, WEBHOOK_TIMEOUT_MS } fr
 import { flowRunSideEffects } from '../flows/flow-run/flow-run-side-effects'
 import { projectService } from '../project/project-service'
 import { engineResponseWatcher } from '../workers/engine-response-watcher'
+import { redisMetadataKey, RunsMetadataUpsertData } from '../workers/job'
 import { waitpointService } from './waitpoint-service'
 import { Waitpoint, WaitpointResumePayload, WaitpointStatus } from './waitpoint-types'
 
 export const resumeService = (log: FastifyBaseLogger) => ({
     async resumeFromWaitpoint({ flowRunId, waitpointId, resumePayload, workerHandlerId, httpRequestId }: ResumeFromWaitpointParams): Promise<ResumeFromWaitpointResult> {
+        const flowRun = await findFlowRunOrThrow(flowRunId)
+        const addressed = await addressedWaitpointIsBarrier({ flowRunId, waitpointId, projectId: flowRun.projectId, log })
+        const refuse = addressed === 'no-such-waitpoint'
+            ? await waitpointService(log).hasBarrier({ flowRunId, projectId: flowRun.projectId })
+            : addressed
+        if (refuse) {
+            log.warn({ flowRun: { id: flowRunId }, waitpoint: { id: waitpointId } }, '[resumeService#resumeFromWaitpoint] Refused an external resume of a barrier; only the barrier predicate and its deadline may release it')
+            return { flowRun, stale: true }
+        }
+        return this.resumeTrusted({ flowRunId, waitpointId, resumePayload, workerHandlerId, httpRequestId })
+    },
+
+    async resumeTrusted({ flowRunId, waitpointId, resumePayload, workerHandlerId, httpRequestId }: ResumeFromWaitpointParams): Promise<ResumeFromWaitpointResult> {
         return distributedLock(log).runExclusive({
             key: `runs_metadata_${flowRunId}`,
             timeoutInSeconds: 30,
-            fn: () => this.resumeFromWaitpointWithoutLock({ flowRunId, waitpointId, resumePayload, workerHandlerId, httpRequestId }),
+            fn: () => this.resumeTrustedWithoutLock({ flowRunId, waitpointId, resumePayload, workerHandlerId, httpRequestId }),
         })
     },
 
-    async resumeFromWaitpointWithoutLock({ flowRunId, waitpointId, resumePayload, workerHandlerId, httpRequestId }: ResumeFromWaitpointParams): Promise<ResumeFromWaitpointResult> {
+    async resumeTrustedWithoutLock({ flowRunId, waitpointId, resumePayload, workerHandlerId, httpRequestId }: ResumeFromWaitpointParams): Promise<ResumeFromWaitpointResult> {
         const flowRun = await findFlowRunOrThrow(flowRunId)
+        if (await hasPendingTerminalStatus({ flowRunId, projectId: flowRun.projectId })) {
+            log.warn({ flowRun: { id: flowRunId } }, '[resumeService#resumeTrustedWithoutLock] Refused a resume of a run whose terminal status is already queued')
+            return { flowRun, stale: true }
+        }
         const processed = await waitpointService(log).handleResumeSignal({
             flowRunId,
             waitpointId,
@@ -43,20 +61,18 @@ export const resumeService = (log: FastifyBaseLogger) => ({
         if (processed) {
             const currentFlowRun = await findFlowRunOrThrow(flowRunId)
             if (currentFlowRun.status === FlowRunStatus.PAUSED) {
-                const latestWaitpoint = await waitpointService(log).getByFlowRunId(flowRunId)
-                if (!isNil(latestWaitpoint) && latestWaitpoint.status === WaitpointStatus.COMPLETED) {
-                    log.info({ flowRun: { id: flowRunId } }, '[resumeService#resumeFromWaitpointWithoutLock] Race detected: metadata worker wrote PAUSED after callback completed waitpoint; consuming waitpoint and enqueuing resume')
-                    // Consume the stale COMPLETED waitpoint under the lock so it cannot
-                    // poison the next createForPause call on a subsequent loop iteration
+                const addressedWaitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId, flowRunId, projectId: currentFlowRun.projectId })
+                if (!isNil(addressedWaitpoint) && addressedWaitpoint.status === WaitpointStatus.COMPLETED) {
+                    log.info({ flowRun: { id: flowRunId } }, '[resumeService#resumeTrustedWithoutLock] Race detected: metadata worker wrote PAUSED after callback completed waitpoint; consuming waitpoint and enqueuing resume')
+                    await waitpointService(log).consume({ waitpoint: addressedWaitpoint })
                     await enqueueResume({
                         flowRun: currentFlowRun,
-                        waitpoint: latestWaitpoint,
+                        waitpoint: addressedWaitpoint,
                         resumePayload: resumePayload ?? null,
                         workerHandlerId,
                         httpRequestId,
                     }, log)
-                    await recordWaitpointConsumed({ waitpointId: latestWaitpoint.id, log })
-                    await waitpointService(log).delete({ id: latestWaitpoint.id })
+                    await recordWaitpointConsumed({ waitpointId: addressedWaitpoint.id, log })
                 }
             }
         }
@@ -65,9 +81,12 @@ export const resumeService = (log: FastifyBaseLogger) => ({
     },
 
     async waitpointWasConsumed({ waitpointId, flowRunId }: WaitpointWasConsumedParams): Promise<boolean> {
-        const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId, flowRunId })
-        if (!isNil(waitpoint)) {
-            return waitpoint.status === WaitpointStatus.COMPLETED
+        const { data: flowRun } = await tryCatch(() => findFlowRunOrThrow(flowRunId))
+        if (!isNil(flowRun)) {
+            const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId, flowRunId, projectId: flowRun.projectId })
+            if (!isNil(waitpoint)) {
+                return waitpoint.status === WaitpointStatus.COMPLETED
+            }
         }
         const { data, error } = await tryCatch(() => distributedStore.get<boolean>(waitpointConsumedKey(waitpointId)))
         if (error) {
@@ -78,12 +97,26 @@ export const resumeService = (log: FastifyBaseLogger) => ({
     },
 
     async legacyResume({ flowRunId, resumePayload, workerHandlerId }: LegacyResumeParams): Promise<ResumeFromWaitpointResult> {
-        const flowRun = await findFlowRunOrThrow(flowRunId)
-        if (flowRun.status !== FlowRunStatus.PAUSED) {
-            return { flowRun, stale: true }
-        }
-        await enqueueResume({ flowRun, resumePayload, workerHandlerId }, log)
-        return { flowRun, stale: false }
+        return distributedLock(log).runExclusive({
+            key: `runs_metadata_${flowRunId}`,
+            timeoutInSeconds: 30,
+            fn: async () => {
+                const flowRun = await findFlowRunOrThrow(flowRunId)
+                if (flowRun.status !== FlowRunStatus.PAUSED) {
+                    return { flowRun, stale: true }
+                }
+                if (await hasPendingTerminalStatus({ flowRunId, projectId: flowRun.projectId })) {
+                    log.warn({ flowRun: { id: flowRunId } }, '[resumeService#legacyResume] Refused a resume of a run whose terminal status is already queued')
+                    return { flowRun, stale: true }
+                }
+                if (await waitpointService(log).hasBarrier({ flowRunId, projectId: flowRun.projectId })) {
+                    log.warn({ flowRun: { id: flowRunId } }, '[resumeService#legacyResume] Refused an external resume of a barrier; only the barrier predicate and its deadline may release it')
+                    return { flowRun, stale: true }
+                }
+                await enqueueResume({ flowRun, resumePayload, workerHandlerId }, log)
+                return { flowRun, stale: false }
+            },
+        })
     },
 
     async handleSyncResumeFlow({ runId, waitpointId, payload, correlationId }: HandleSyncResumeFlowParams): Promise<EngineHttpResponse> {
@@ -125,16 +158,42 @@ export const resumeService = (log: FastifyBaseLogger) => ({
     },
 
     async legacySyncResume({ runId, payload, correlationId }: LegacySyncResumeParams): Promise<EngineHttpResponse> {
-        const flowRun = await findFlowRunOrThrow(runId)
-        if (flowRun.status !== FlowRunStatus.PAUSED) {
-            return {
-                status: StatusCodes.CONFLICT,
-                body: { message: 'Flow run is not paused', flowRunStatus: flowRun.status },
-                headers: {},
-            }
+        const refusal = await distributedLock(log).runExclusive({
+            key: `runs_metadata_${runId}`,
+            timeoutInSeconds: 30,
+            fn: async (): Promise<EngineHttpResponse | null> => {
+                const flowRun = await findFlowRunOrThrow(runId)
+                if (flowRun.status !== FlowRunStatus.PAUSED) {
+                    return {
+                        status: StatusCodes.CONFLICT,
+                        body: { message: 'Flow run is not paused', flowRunStatus: flowRun.status },
+                        headers: {},
+                    }
+                }
+                if (await hasPendingTerminalStatus({ flowRunId: runId, projectId: flowRun.projectId })) {
+                    log.warn({ flowRun: { id: runId } }, '[resumeService#legacySyncResume] Refused a resume of a run whose terminal status is already queued')
+                    return {
+                        status: StatusCodes.GONE,
+                        body: { message: 'This link has expired. The action may have already been processed.' },
+                        headers: {},
+                    }
+                }
+                if (await waitpointService(log).hasBarrier({ flowRunId: runId, projectId: flowRun.projectId })) {
+                    log.warn({ flowRun: { id: runId } }, '[resumeService#legacySyncResume] Refused an external resume of a barrier; only the barrier predicate and its deadline may release it')
+                    return {
+                        status: StatusCodes.GONE,
+                        body: { message: 'This link has expired. The action may have already been processed.' },
+                        headers: {},
+                    }
+                }
+                const syncServerId = engineResponseWatcher(log).getServerId()
+                await enqueueResume({ flowRun, resumePayload: payload, workerHandlerId: syncServerId, httpRequestId: correlationId }, log)
+                return null
+            },
+        })
+        if (!isNil(refusal)) {
+            return refusal
         }
-        const syncServerId = engineResponseWatcher(log).getServerId()
-        await enqueueResume({ flowRun, resumePayload: payload, workerHandlerId: syncServerId, httpRequestId: correlationId }, log)
         return engineResponseWatcher(log).oneTimeListener<EngineHttpResponse>(correlationId, true, WEBHOOK_TIMEOUT_MS, {
             status: StatusCodes.NO_CONTENT,
             body: {},
@@ -143,6 +202,22 @@ export const resumeService = (log: FastifyBaseLogger) => ({
     },
 })
 
+async function hasPendingTerminalStatus({ flowRunId, projectId }: HasPendingTerminalStatusParams): Promise<boolean> {
+    const pending = await distributedStore.hgetJson<RunsMetadataUpsertData>(redisMetadataKey({ projectId, runId: flowRunId }))
+    if (isNil(pending) || isNil(pending.status)) {
+        return false
+    }
+    return isFlowRunStateTerminal({ status: pending.status, ignoreInternalError: false })
+}
+
+async function addressedWaitpointIsBarrier({ flowRunId, waitpointId, projectId, log }: AddressedWaitpointIsBarrierParams): Promise<AddressedWaitpointVerdict> {
+    const waitpoint = await waitpointService(log).findByIdAndFlowRunId({ waitpointId, flowRunId, projectId })
+    if (isNil(waitpoint)) {
+        return 'no-such-waitpoint'
+    }
+    return waitpoint.type === PauseType.BARRIER
+}
+
 async function recordWaitpointConsumed({ waitpointId, log }: RecordWaitpointConsumedParams): Promise<void> {
     const { error } = await tryCatch(() => distributedStore.put(waitpointConsumedKey(waitpointId), true, WAITPOINT_CONSUMED_TTL_SECONDS))
     if (isNil(error)) {
@@ -214,6 +289,20 @@ type ResumeFromWaitpointParams = {
     httpRequestId?: string
 }
 
+type HasPendingTerminalStatusParams = {
+    flowRunId: FlowRunId
+    projectId: string
+}
+
+type AddressedWaitpointVerdict = boolean | 'no-such-waitpoint'
+
+type AddressedWaitpointIsBarrierParams = {
+    flowRunId: FlowRunId
+    waitpointId: string
+    projectId: string
+    log: FastifyBaseLogger
+}
+
 type LegacyResumeParams = {
     flowRunId: FlowRunId
     resumePayload: WaitpointResumePayload
diff --git a/packages/server/api/src/app/waitpoints/waitpoint-entity.ts b/packages/server/api/src/app/waitpoints/waitpoint-entity.ts
index 1527ce0c5ebf..92ea40f692cd 100644
--- a/packages/server/api/src/app/waitpoints/waitpoint-entity.ts
+++ b/packages/server/api/src/app/waitpoints/waitpoint-entity.ts
@@ -80,6 +80,10 @@ export const WaitpointEntity = new EntitySchema<WaitpointSchema>({
             name: 'idx_waitpoint_project_id',
             columns: ['projectId'],
         },
+        {
+            name: 'idx_waitpoint_flow_run_id_status_created',
+            columns: ['flowRunId', 'status', 'created'],
+        },
         {
             name: 'idx_waitpoint_pending_resume_date_time',
             columns: ['resumeDateTime'],
diff --git a/packages/server/api/src/app/waitpoints/waitpoint-service.ts b/packages/server/api/src/app/waitpoints/waitpoint-service.ts
index 4c8029e92bbf..e72ecfcdc89c 100644
--- a/packages/server/api/src/app/waitpoints/waitpoint-service.ts
+++ b/packages/server/api/src/app/waitpoints/waitpoint-service.ts
@@ -2,6 +2,7 @@ import { ActivepiecesError, apId, ErrorCode, isNil } from '@activepieces/core-ut
 import { FlowRunStatus, PauseType } from '@activepieces/shared'
 import dayjs from 'dayjs'
 import { FastifyBaseLogger } from 'fastify'
+import { EntityManager, Not } from 'typeorm'
 import { repoFactory } from '../core/db/repo-factory'
 import { transaction } from '../core/db/transaction'
 import { flowRunRepo } from '../flows/flow-run/flow-run-service'
@@ -18,6 +19,7 @@ export const waitpointService = (log: FastifyBaseLogger) => ({
     async createForPause(params: CreateForPauseParams): Promise<CreateForPauseResult> {
         const preCompleted = await waitpointRepo().findOneBy({
             flowRunId: params.flowRunId,
+            projectId: params.projectId,
             stepName: params.stepName,
             status: WaitpointStatus.COMPLETED,
         })
@@ -47,11 +49,13 @@ export const waitpointService = (log: FastifyBaseLogger) => ({
                 workerHandlerId: params.workerHandlerId ?? null,
                 httpRequestId: params.httpRequestId ?? null,
                 resumePayload: null,
+                sealed: false,
+                policy: null,
             })
             .orIgnore()
             .execute()
 
-        const waitpoint = await waitpointRepo().findOneByOrFail({ flowRunId: params.flowRunId, stepName: params.stepName })
+        const waitpoint = await waitpointRepo().findOneByOrFail({ flowRunId: params.flowRunId, projectId: params.projectId, stepName: params.stepName })
         const inserted = waitpoint.id === id
         if (inserted) {
             log.info({ flowRun: { id: params.flowRunId }, waitpoint: { id } }, '[waitpointService#createForPause] Waitpoint created')
@@ -64,7 +68,7 @@ export const waitpointService = (log: FastifyBaseLogger) => ({
                 job: {
                     name: SystemJobName.RESUME_DELAY_WAITPOINT,
                     data: { flowRunId: params.flowRunId, projectId: params.projectId, waitpointId: waitpoint.id },
-                    jobId: `resume-delay-${params.flowRunId}`,
+                    jobId: resumeDelayJobId(waitpoint.id),
                 },
                 schedule: {
                     type: 'one-time',
@@ -82,7 +86,7 @@ export const waitpointService = (log: FastifyBaseLogger) => ({
             const pending = await repo
                 .createQueryBuilder('waitpoint')
                 .setLock('pessimistic_write')
-                .where({ id: params.waitpointId, flowRunId: params.flowRunId, status: WaitpointStatus.PENDING })
+                .where({ id: params.waitpointId, flowRunId: params.flowRunId, projectId: params.projectId, status: WaitpointStatus.PENDING })
                 .getOne()
 
             if (isNil(pending)) {
@@ -106,24 +110,31 @@ export const waitpointService = (log: FastifyBaseLogger) => ({
         const { flowRunId, waitpointId, flowRunStatus, projectId, resumePayload, workerHandlerId, onReady } = params
 
         if (flowRunStatus === FlowRunStatus.PAUSED) {
-            const waitpoint = await transaction(async (entityManager) => {
+            const delivery = await transaction<PausedDelivery>(async (entityManager) => {
                 const repo = waitpointRepo(entityManager)
                 const found = await repo
                     .createQueryBuilder('waitpoint')
                     .setLock('pessimistic_write')
-                    .where({ id: waitpointId, flowRunId })
+                    .where({ id: waitpointId, flowRunId, projectId })
                     .getOne()
                 if (isNil(found)) {
-                    return null
+                    return 'unknown-waitpoint'
+                }
+                if (found.status === WaitpointStatus.CONSUMED) {
+                    return 'already-delivered'
                 }
                 await onReady(found)
-                await repo.delete({ id: found.id })
-                return found
+                await this.consume({ waitpoint: found, entityManager })
+                return 'dispatched'
             })
-            if (isNil(waitpoint)) {
+            if (delivery === 'unknown-waitpoint') {
                 log.info({ flowRun: { id: flowRunId }, waitpoint: { id: waitpointId } }, '[waitpointService#handleResumeSignal] Stale waitpointId, ignoring')
                 return false
             }
+            if (delivery === 'already-delivered') {
+                log.info({ flowRun: { id: flowRunId }, waitpoint: { id: waitpointId } }, '[waitpointService#handleResumeSignal] Waitpoint was already delivered, ignoring')
+                return false
+            }
             log.info({ flowRun: { id: flowRunId }, waitpoint: { id: waitpointId } }, '[waitpointService#handleResumeSignal] Resume triggered')
             return true
         }
@@ -142,32 +153,75 @@ export const waitpointService = (log: FastifyBaseLogger) => ({
         return false
     },
 
-    async findPendingByVersion({ flowRunId, version }: FindPendingByVersionParams): Promise<Waitpoint | null> {
+    async findPendingByVersion({ flowRunId, projectId, version }: FindPendingByVersionParams): Promise<Waitpoint | null> {
         return waitpointRepo().findOne({
-            where: { flowRunId, status: WaitpointStatus.PENDING, version },
+            where: { flowRunId, projectId, status: WaitpointStatus.PENDING, version },
         })
     },
 
-    async findByIdAndFlowRunId({ waitpointId, flowRunId }: { waitpointId: string, flowRunId: string }): Promise<Waitpoint | null> {
-        return waitpointRepo().findOneBy({ id: waitpointId, flowRunId })
+    async findByIdAndFlowRunId({ waitpointId, flowRunId, projectId }: FindByIdAndFlowRunIdParams): Promise<Waitpoint | null> {
+        return waitpointRepo().findOneBy({ id: waitpointId, flowRunId, projectId })
+    },
+
+    async findUndeliveredCompletedWaitpoint({ flowRunId, projectId }: FindUndeliveredCompletedWaitpointParams): Promise<Waitpoint | null> {
+        const barrierPending = await this.hasPendingBarrier({ flowRunId, projectId })
+        if (barrierPending) {
+            return null
+        }
+        return waitpointRepo().findOne({
+            where: { flowRunId, projectId, status: WaitpointStatus.COMPLETED },
+            order: { created: 'DESC' },
+        })
+    },
+
+    async hasPendingBarrier({ flowRunId, projectId }: HasPendingBarrierParams): Promise<boolean> {
+        return waitpointRepo().existsBy({ flowRunId, projectId, type: PauseType.BARRIER, status: WaitpointStatus.PENDING })
+    },
+
+    async hasBarrier({ flowRunId, projectId }: HasBarrierParams): Promise<boolean> {
+        return waitpointRepo().existsBy({ flowRunId, projectId, type: PauseType.BARRIER })
     },
 
-    async getByFlowRunId(flowRunId: string): Promise<Waitpoint | null> {
-        const completed = await waitpointRepo().findOneBy({ flowRunId, status: WaitpointStatus.COMPLETED })
-        return completed ?? waitpointRepo().findOneBy({ flowRunId })
+    async consume({ waitpoint, entityManager }: ConsumeParams): Promise<void> {
+        const repo = waitpointRepo(entityManager)
+        if (waitpoint.type === PauseType.BARRIER) {
+            await repo.save({ ...waitpoint, status: WaitpointStatus.CONSUMED })
+            log.info({ waitpoint: { id: waitpoint.id }, flowRun: { id: waitpoint.flowRunId } }, '[waitpointService#consume] Barrier kept as CONSUMED so the run stays barrier-owned until it ends')
+            return
+        }
+        await repo.delete({ id: waitpoint.id, projectId: waitpoint.projectId })
+        log.info({ waitpoint: { id: waitpoint.id }, flowRun: { id: waitpoint.flowRunId } }, '[waitpointService#consume] Waitpoint consumed and deleted')
     },
 
-    async delete({ id }: { id: string }): Promise<void> {
-        await waitpointRepo().delete({ id })
+    async findSubflowWaitpoint({ flowRunId, projectId }: FindSubflowWaitpointParams): Promise<Waitpoint | null> {
+        const pending = await waitpointRepo().findOne({
+            where: { flowRunId, projectId, status: WaitpointStatus.PENDING, type: Not(PauseType.BARRIER) },
+            order: { created: 'DESC' },
+        })
+        if (!isNil(pending)) {
+            return pending
+        }
+        return waitpointRepo().findOne({
+            where: { flowRunId, projectId, type: Not(PauseType.BARRIER) },
+            order: { created: 'DESC' },
+        })
+    },
+
+    async delete({ id, projectId }: DeleteWaitpointParams): Promise<void> {
+        await waitpointRepo().delete({ id, projectId })
         log.info({ waitpoint: { id } }, '[waitpointService#delete] Waitpoint deleted')
     },
 
-    async deleteByFlowRunId(flowRunId: string): Promise<void> {
-        await waitpointRepo().delete({ flowRunId })
+    async deleteByFlowRunId({ flowRunId, projectId }: DeleteByFlowRunIdParams): Promise<void> {
+        await waitpointRepo().delete({ flowRunId, projectId })
         log.info({ flowRun: { id: flowRunId } }, '[waitpointService#deleteByFlowRunId] Waitpoint deleted')
     },
 })
 
+export function resumeDelayJobId(waitpointId: string): string {
+    return `resume-delay-${waitpointId}`
+}
+
 function clampWaitpointResumeDeadline({ requested, type, flowRunCreated, flowRunId }: ClampWaitpointResumeDeadlineParams): string | undefined {
     const pauseTimeoutDays = system.getNumberOrThrow(AppSystemProp.PAUSED_FLOW_TIMEOUT_DAYS)
     const runDeadline = dayjs(flowRunCreated).add(pauseTimeoutDays, 'day')
@@ -183,9 +237,52 @@ function clampWaitpointResumeDeadline({ requested, type, flowRunCreated, flowRun
     return requested
 }
 
+type PausedDelivery = 'dispatched' | 'already-delivered' | 'unknown-waitpoint'
+
 type ClampWaitpointResumeDeadlineParams = {
     requested: string | undefined
     type: `${PauseType}`
     flowRunCreated: string
     flowRunId: string
 }
+
+type HasPendingBarrierParams = {
+    flowRunId: string
+    projectId: string
+}
+
+type HasBarrierParams = {
+    flowRunId: string
+    projectId: string
+}
+
+type ConsumeParams = {
+    waitpoint: Waitpoint
+    entityManager?: EntityManager
+}
+
+type FindByIdAndFlowRunIdParams = {
+    waitpointId: string
+    flowRunId: string
+    projectId: string
+}
+
+type FindUndeliveredCompletedWaitpointParams = {
+    flowRunId: string
+    projectId: string
+}
+
+type FindSubflowWaitpointParams = {
+    flowRunId: string
+    projectId: string
+}
+
+type DeleteWaitpointParams = {
+    id: string
+    projectId: string
+}
+
+type DeleteByFlowRunIdParams = {
+    flowRunId: string
+    projectId: string
+}
diff --git a/packages/server/api/src/app/waitpoints/waitpoint-signal-entity.ts b/packages/server/api/src/app/waitpoints/waitpoint-signal-entity.ts
index d3a40a5f77df..83433513b905 100644
--- a/packages/server/api/src/app/waitpoints/waitpoint-signal-entity.ts
+++ b/packages/server/api/src/app/waitpoints/waitpoint-signal-entity.ts
@@ -48,7 +48,11 @@ export const WaitpointSignalEntity = new EntitySchema<WaitpointSignalSchema>({
         },
         {
             name: 'idx_waitpoint_signal_ref_id',
-            columns: ['refId'],
+            columns: ['refId', 'projectId'],
+        },
+        {
+            name: 'idx_waitpoint_signal_waitpoint_id_project_id_sequence',
+            columns: ['waitpointId', 'projectId', 'sequence', 'created'],
         },
         {
             name: 'idx_waitpoint_signal_waitpoint_id_sequence',
diff --git a/packages/server/api/src/app/waitpoints/waitpoint-types.ts b/packages/server/api/src/app/waitpoints/waitpoint-types.ts
index ee4f90850c08..bc669e2c9623 100644
--- a/packages/server/api/src/app/waitpoints/waitpoint-types.ts
+++ b/packages/server/api/src/app/waitpoints/waitpoint-types.ts
@@ -4,6 +4,7 @@ import { BarrierPolicy, BarrierSignalStatus, FlowRunStatus, PauseType, RespondRe
 enum WaitpointStatus {
     PENDING = 'PENDING',
     COMPLETED = 'COMPLETED',
+    CONSUMED = 'CONSUMED',
 }
 
 enum WaitpointVersionEnum {
@@ -91,6 +92,7 @@ type HandleResumeSignalParams = {
 
 type FindPendingByVersionParams = {
     flowRunId: ApId
+    projectId: ApId
     version: WaitpointVersion
 }
 
diff --git a/packages/server/api/src/app/workers/job-queue/job-broker.ts b/packages/server/api/src/app/workers/job-queue/job-broker.ts
index 923d67eecdaf..9c5aafbc1af4 100644
--- a/packages/server/api/src/app/workers/job-queue/job-broker.ts
+++ b/packages/server/api/src/app/workers/job-queue/job-broker.ts
@@ -10,6 +10,7 @@ import { jobMigrations } from '../migrations/job-data-migrations'
 import { rateLimiterInterceptor } from './interceptors/rate-limiter-interceptor'
 import { zombiePollingInterceptor } from './interceptors/zombie-polling-interceptor'
 import { jobAssignmentTracker } from './job-assignment-tracker'
+import { jobFailureLogger } from './job-failure-logger'
 import { InterceptorVerdict, JobInterceptor } from './job-interceptor'
 import { callerWaitingForResponse } from './job-queue'
 import { createQueueDispatcher, QueueDispatcher } from './queue-dispatcher'
@@ -92,13 +93,17 @@ async function tryDequeue(worker: BullMQWorker, queueName: string, log: FastifyB
             { queueName, job: { id: job.id }, jobName: job.name, deferredFailure: job.deferredFailure },
             '[jobBroker#tryDequeue] Failing job with deferred failure (BullMQ stalled limit exceeded)',
         )
-        const { error: failError } = await tryCatch(() => job.moveToFailed(new UnrecoverableError(job.deferredFailure), token, false))
+        const deferredError = new UnrecoverableError(job.deferredFailure)
+        const { error: failError } = await tryCatch(() => job.moveToFailed(deferredError, token, false))
         if (failError) {
             log.error(
                 { queueName, job: { id: job.id }, error: String(failError) },
                 '[jobBroker#tryDequeue] Failed to fail deferred-failure job',
             )
         }
+        else {
+            jobFailureLogger.logJobFailed({ queueName, jobId: job.id, jobType: job.name, error: deferredError, log })
+        }
         return tryDequeue(worker, queueName, log)
     }
 
@@ -120,10 +125,14 @@ async function tryDequeue(worker: BullMQWorker, queueName: string, log: FastifyB
             { queueName, job: { id: jobId, type: migratedData.jobType }, schemaVersion: migratedData.schemaVersion, issues: parseResult.error.issues },
             '[jobBroker#tryDequeue] Failing job with invalid schema as unrecoverable',
         )
-        const { error: failError } = await tryCatch(() => job.moveToFailed(new UnrecoverableError(reason), token, false))
+        const schemaError = new UnrecoverableError(reason)
+        const { error: failError } = await tryCatch(() => job.moveToFailed(schemaError, token, false))
         if (failError) {
             log.error({ queueName, job: { id: jobId }, error: String(failError) }, '[jobBroker#tryDequeue] Failed to fail invalid-schema job')
         }
+        else {
+            jobFailureLogger.logJobFailed({ queueName, jobId, jobType: migratedData.jobType, error: schemaError, log })
+        }
         return tryDequeue(worker, queueName, log)
     }
 
@@ -263,7 +272,19 @@ export const jobBroker = (log: FastifyBaseLogger) => ({
                     await job.moveToCompleted({ response: undefined }, input.token, false)
                     return
                 }
-                await job.moveToFailed(new Error(buildFailedReason(input.errorMessage ?? 'Internal error', input.logs)), input.token)
+                const engineErrorMessage = input.errorMessage ?? 'Internal error'
+                const engineError = new Error(buildFailedReason(engineErrorMessage, input.logs))
+                await job.moveToFailed(engineError, input.token)
+                if ((job.attemptsMade ?? 0) >= (job.opts?.attempts ?? 1)) {
+                    jobFailureLogger.logJobFailed({
+                        queueName: input.queueName,
+                        jobId: input.jobId,
+                        jobType: jobData.jobType,
+                        error: engineError,
+                        log,
+                        signatureOverride: jobFailureLogger.signatureFromMessage(engineErrorMessage, 'EngineError'),
+                    })
+                }
                 return
             }
 
diff --git a/packages/server/api/src/app/workers/job-queue/job-failure-logger.ts b/packages/server/api/src/app/workers/job-queue/job-failure-logger.ts
new file mode 100644
index 000000000000..72ae72264f0b
--- /dev/null
+++ b/packages/server/api/src/app/workers/job-queue/job-failure-logger.ts
@@ -0,0 +1,55 @@
+import path from 'path'
+import { FastifyBaseLogger } from 'fastify'
+
+const STACK_FRAME_RE = /at\s+(?:.+?\s+\()?([^\s()]+):(\d+):\d+\)?/
+
+export const jobFailureLogger = {
+    signatureOf(error: unknown): string {
+        const errorName = readErrorName(error)
+        const frame = readTopStackFrame(error)
+        return frame ? `${errorName}@${frame}` : errorName
+    },
+    signatureFromMessage(message: string, sourceLabel: string): string {
+        const firstLine = message.split('\n', 1)[0].trim()
+        const colonIdx = firstLine.indexOf(':')
+        const head = colonIdx > 0 ? firstLine.slice(0, colonIdx) : firstLine
+        const clean = head.replace(/\s+/g, ' ').slice(0, 80)
+        return `${sourceLabel}@${clean || 'unknown'}`
+    },
+    logJobFailed({ queueName, jobId, jobType, error, log, signatureOverride }: LogJobFailedParams): void {
+        const errorSignature = signatureOverride ?? jobFailureLogger.signatureOf(error)
+        log.error({
+            queue: { name: queueName },
+            job: { id: jobId ?? '', type: jobType },
+            error,
+            errorSignature,
+        }, 'job.failed')
+    },
+}
+
+function readErrorName(error: unknown): string {
+    if (error instanceof Error) {
+        const declared = error.name && error.name !== 'Error' ? error.name : undefined
+        return declared ?? error.constructor?.name ?? 'Error'
+    }
+    return typeof error
+}
+
+function readTopStackFrame(error: unknown): string | null {
+    if (!(error instanceof Error) || !error.stack) return null
+    for (const line of error.stack.split('\n')) {
+        const match = STACK_FRAME_RE.exec(line)
+        if (!match) continue
+        return `${path.basename(match[1])}:${match[2]}`
+    }
+    return null
+}
+
+type LogJobFailedParams = {
+    queueName: string
+    jobId: string | undefined
+    jobType: string
+    error: unknown
+    log: FastifyBaseLogger
+    signatureOverride?: string
+}
diff --git a/packages/server/api/src/app/workers/job/index.ts b/packages/server/api/src/app/workers/job/index.ts
index e94f3d046064..78fd58116a8a 100644
--- a/packages/server/api/src/app/workers/job/index.ts
+++ b/packages/server/api/src/app/workers/job/index.ts
@@ -27,6 +27,7 @@ export enum JobStatus {
 export enum QueueName {
     WORKER_JOBS = 'workerJobs',
     RUNS_METADATA = 'runsMetadata',
+    BARRIER_EVALUATION = 'barrierEvaluation',
 }
 
 export const getPlatformGroupQueueName = (workerGroupId: string): string => {
diff --git a/packages/server/api/src/app/workers/migrations/refill-paused-jobs.ts b/packages/server/api/src/app/workers/migrations/refill-paused-jobs.ts
index 5eaadd285afa..6a8d380c1842 100644
--- a/packages/server/api/src/app/workers/migrations/refill-paused-jobs.ts
+++ b/packages/server/api/src/app/workers/migrations/refill-paused-jobs.ts
@@ -2,7 +2,7 @@ import { isNil } from '@activepieces/core-utils'
 import { FlowRunStatus, PauseType } from '@activepieces/shared'
 import dayjs from 'dayjs'
 import { FastifyBaseLogger } from 'fastify'
-import { In, MoreThan } from 'typeorm'
+import { In, IsNull, MoreThan, Not } from 'typeorm'
 import { repoFactory } from '../../core/db/repo-factory'
 import { redisConnections } from '../../database/redis-connections'
 import { flowRunRepo } from '../../flows/flow-run/flow-run-service'
@@ -11,6 +11,8 @@ import { AppSystemProp } from '../../helper/system/system-props'
 import { SystemJobName } from '../../helper/system-jobs/common'
 import { systemJobsSchedule } from '../../helper/system-jobs/system-job'
 import { WaitpointEntity } from '../../waitpoints/waitpoint-entity'
+import { resumeDelayJobId } from '../../waitpoints/waitpoint-service'
+import { WaitpointStatus } from '../../waitpoints/waitpoint-types'
 import { jobQueue } from '../job-queue/job-queue'
 
 const REFILL_PAUSED_RUNS_KEY = 'refill_paused_runs_v7'
@@ -41,14 +43,19 @@ export const refillPausedRuns = (log: FastifyBaseLogger) => ({
         }
 
         const flowRunIds = pausedRuns.map(r => r.id)
-        const waitpoints = await waitpointRepo().findBy({ flowRunId: In(flowRunIds) })
-        const waitpointByRunId = Object.fromEntries(waitpoints.map(w => [w.flowRunId, w]))
+        const delayWaitpoints = await waitpointRepo().findBy({
+            flowRunId: In(flowRunIds),
+            type: PauseType.DELAY,
+            status: WaitpointStatus.PENDING,
+            resumeDateTime: Not(IsNull()),
+        })
+        const pausedRunById = Object.fromEntries(pausedRuns.map(run => [run.id, run]))
 
         let migratedCount = 0
 
-        for (const pausedRun of pausedRuns) {
-            const waitpoint = waitpointByRunId[pausedRun.id]
-            if (isNil(waitpoint) || waitpoint.type !== PauseType.DELAY || isNil(waitpoint.resumeDateTime)) {
+        for (const waitpoint of delayWaitpoints) {
+            const pausedRun = pausedRunById[waitpoint.flowRunId]
+            if (isNil(pausedRun) || isNil(waitpoint.resumeDateTime)) {
                 continue
             }
             if (dayjs(pausedRun.created).isBefore(dayjs().subtract(executionRetentionDays, 'day'))) {
@@ -68,7 +75,7 @@ export const refillPausedRuns = (log: FastifyBaseLogger) => ({
                 job: {
                     name: SystemJobName.RESUME_DELAY_WAITPOINT,
                     data: { flowRunId: pausedRun.id, projectId: pausedRun.projectId, waitpointId: waitpoint.id },
-                    jobId: `resume-delay-${pausedRun.id}`,
+                    jobId: resumeDelayJobId(waitpoint.id),
                 },
                 schedule: {
                     type: 'one-time',
diff --git a/packages/server/api/src/app/workers/worker-module.ts b/packages/server/api/src/app/workers/worker-module.ts
index 1f30302e8906..b222b338a12c 100644
--- a/packages/server/api/src/app/workers/worker-module.ts
+++ b/packages/server/api/src/app/workers/worker-module.ts
@@ -4,6 +4,7 @@ import { runsMetadataQueue } from '../flows/flow-run/flow-runs-queue'
 import { pubsub } from '../helper/pubsub'
 import { system } from '../helper/system/system'
 import { AppSystemProp } from '../helper/system/system-props'
+import { barrierQueue } from '../waitpoints/barrier-queue'
 import { flowEngineWorker } from './engine-controller'
 import { setupBullMQBoard } from './job-queue/bullboard'
 import { jobBroker } from './job-queue/job-broker'
@@ -21,11 +22,14 @@ export const workerModule: FastifyPluginAsyncZod = async (app) => {
 
     await runsMetadataQueue(app.log).init()
 
+    await barrierQueue(app.log).init()
+
     await setupBullMQBoard(app)
 
     app.addHook('onClose', async () => {
         await jobBroker(app.log).close()
         await runsMetadataQueue(app.log).close()
+        await barrierQueue(app.log).close()
         await jobQueue(app.log).close()
         await pubsub.close()
     })
diff --git a/packages/server/api/test/integration/ce/flows/flow-run/barrier.test.ts b/packages/server/api/test/integration/ce/flows/flow-run/barrier.test.ts
new file mode 100644
index 000000000000..92c101dddf12
--- /dev/null
+++ b/packages/server/api/test/integration/ce/flows/flow-run/barrier.test.ts
@@ -0,0 +1,551 @@
+import { apId, isNil } from '@activepieces/core-utils'
+import { BarrierSignalStatus, BarrierSummary, ErrorCode, FlowRunStatus, FlowVersionState, PauseType, RunEnvironment } from '@activepieces/shared'
+import { Queue } from 'bullmq'
+import { FastifyInstance } from 'fastify'
+import { StatusCodes } from 'http-status-codes'
+import { databaseConnection } from '../../../../../src/app/database/database-connection'
+import { platformConfigurationService } from '../../../../../src/app/platform/platform-configuration.service'
+import { jobQueue } from '../../../../../src/app/workers/job-queue/job-queue'
+import { barrierQueue } from '../../../../../src/app/waitpoints/barrier-queue'
+import { BarrierJobData } from '../../../../../src/app/waitpoints/barrier-queue-factory'
+import { barrierService } from '../../../../../src/app/waitpoints/barrier-service'
+import { resumeService } from '../../../../../src/app/waitpoints/resume-service'
+import { waitpointService } from '../../../../../src/app/waitpoints/waitpoint-service'
+import { Waitpoint, WaitpointStatus } from '../../../../../src/app/waitpoints/waitpoint-types'
+import { db } from '../../../../helpers/db'
+import { createMockFlow, createMockFlowRun, createMockFlowVersion } from '../../../../helpers/mocks'
+import { createTestContext, TestContext } from '../../../../helpers/test-context'
+import { setupTestEnvironment, teardownTestEnvironment } from '../../../../helpers/test-setup'
+
+let app: FastifyInstance
+let ctx: TestContext
+
+beforeAll(async () => {
+    app = await setupTestEnvironment()
+})
+
+afterAll(async () => {
+    await teardownTestEnvironment()
+})
+
+beforeEach(async () => {
+    ctx = await createTestContext(app)
+})
+
+async function createParentRun(status: FlowRunStatus = FlowRunStatus.PAUSED) {
+    const flow = createMockFlow({ projectId: ctx.project.id })
+    await db.save('flow', flow)
+    const flowVersion = createMockFlowVersion({ flowId: flow.id, state: FlowVersionState.LOCKED })
+    await db.save('flow_version', flowVersion)
+    const flowRun = createMockFlowRun({
+        projectId: ctx.project.id,
+        flowId: flow.id,
+        flowVersionId: flowVersion.id,
+        status,
+        environment: RunEnvironment.PRODUCTION,
+    })
+    await db.save('flow_run', flowRun)
+    return { flow, flowVersion, flowRun }
+}
+
+async function createBarrier({ flowRunId, signalLabels, policy, stepName }: {
+    flowRunId: string
+    signalLabels: (string | null)[]
+    policy?: { requiredSuccesses?: number, releaseOnFirstFailure?: boolean }
+    stepName?: string
+}) {
+    return barrierService(app.log).create({
+        flowRunId,
+        projectId: ctx.project.id,
+        platformId: ctx.platform.id,
+        stepName: stepName ?? 'approval',
+        version: 'V1',
+        policy,
+        signalLabels,
+    })
+}
+
+async function listSignals(barrierId: string) {
+    return databaseConnection().getRepository('waitpoint_signal').findBy({ waitpointId: barrierId })
+}
+
+async function readSummary(barrierId: string): Promise<BarrierSummary> {
+    const barrier = await databaseConnection().getRepository('waitpoint').findOneByOrFail({ id: barrierId })
+    return BarrierSummary.parse(barrier.resumePayload?.body)
+}
+
+async function receiveSignal({ signalId, status, result }: { signalId: string, status: BarrierSignalStatus, result?: Record<string, unknown> }) {
+    return barrierService(app.log).receiveSignal({ signalId, projectId: ctx.project.id, status, result })
+}
+
+async function releaseIfReady(barrierId: string) {
+    return barrierService(app.log).releaseIfReady({ barrierId, projectId: ctx.project.id })
+}
+
+async function releaseNow(barrier: Waitpoint) {
+    return barrierService(app.log).release({ barrier, timedOut: false, releaseReason: 'predicate' })
+}
+
+async function completeWithoutConsuming(barrierId: string) {
+    await databaseConnection().getRepository('waitpoint').update({ id: barrierId }, {
+        status: WaitpointStatus.COMPLETED,
+        resumePayload: { body: { total: 1 }, headers: {}, queryParams: {} },
+    })
+    await databaseConnection().getRepository('waitpoint_signal').delete({ waitpointId: barrierId })
+}
+
+async function countPendingEvaluations({ queue, barrierId }: { queue: Queue<BarrierJobData>, barrierId: string }): Promise<number> {
+    const jobs = await queue.getJobs(['waiting', 'delayed', 'prioritized', 'paused'])
+    return jobs.filter((job) => job.data.barrierId === barrierId).length
+}
+
+async function closeWithoutConsuming(barrierId: string) {
+    await databaseConnection().getRepository('waitpoint').update({ id: barrierId }, {
+        status: WaitpointStatus.COMPLETED,
+        resumePayload: {
+            body: {
+                total: 1,
+                succeeded: 1,
+                failed: 0,
+                rejected: 0,
+                canceled: 0,
+                notDispatched: 0,
+                stillRunning: 0,
+                timedOut: false,
+                signals: [],
+            },
+            headers: {},
+            queryParams: {},
+        },
+    })
+    await databaseConnection().getRepository('waitpoint_signal').delete({ waitpointId: barrierId })
+}
+
+async function listResumeJobs(flowRunId: string) {
+    const queue = jobQueue(app.log).getSharedQueue()
+    const jobs = await queue.getJobs(['waiting', 'delayed', 'prioritized', 'paused', 'active'])
+    return jobs.filter((job) => job.id?.startsWith(`${flowRunId}-resume-`))
+}
+
+async function dropResumeJobs(flowRunId: string) {
+    const jobs = await listResumeJobs(flowRunId)
+    await Promise.all(jobs.map((job) => job.remove()))
+}
+
+async function readStatus(barrierId: string): Promise<WaitpointStatus> {
+    const barrier = await db.findOneByOrFail<{ status: WaitpointStatus }>('waitpoint', { id: barrierId })
+    return barrier.status
+}
+
+async function recoverUndeliveredResume(flowRunId: string) {
+    const undelivered = await waitpointService(app.log).findUndeliveredCompletedWaitpoint({ flowRunId, projectId: ctx.project.id })
+    if (isNil(undelivered)) {
+        return null
+    }
+    await resumeService(app.log).resumeTrustedWithoutLock({
+        flowRunId,
+        waitpointId: undelivered.id,
+        resumePayload: undelivered.resumePayload,
+    })
+    return undelivered
+}
+
+describe('barrier release predicate', () => {
+    it('releases once every signal has been received, and not before', async () => {
+        const { flowRun } = await createParentRun(FlowRunStatus.RUNNING)
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com', 'b@example.com'] })
+        const signals = await listSignals(barrier.id)
+        expect(signals).toHaveLength(2)
+
+        await receiveSignal({ signalId: signals[0].id, status: BarrierSignalStatus.SUCCEEDED })
+        await releaseIfReady(barrier.id)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.PENDING)
+
+        await receiveSignal({ signalId: signals[1].id, status: BarrierSignalStatus.SUCCEEDED })
+        await releaseIfReady(barrier.id)
+
+        const summary = await readSummary(barrier.id)
+        expect(summary).toMatchObject({ total: 2, succeeded: 2, failed: 0, stillRunning: 0, timedOut: false })
+        expect(await listSignals(barrier.id)).toHaveLength(0)
+    })
+
+    it('releases early once requiredSuccesses favourable signals have landed', async () => {
+        const { flowRun } = await createParentRun(FlowRunStatus.RUNNING)
+        const { barrier } = await createBarrier({
+            flowRunId: flowRun.id,
+            signalLabels: ['a@example.com', 'b@example.com', 'c@example.com'],
+            policy: { requiredSuccesses: 2 },
+        })
+        const signals = await listSignals(barrier.id)
+
+        await receiveSignal({ signalId: signals[0].id, status: BarrierSignalStatus.SUCCEEDED })
+        await releaseIfReady(barrier.id)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.PENDING)
+
+        await receiveSignal({ signalId: signals[1].id, status: BarrierSignalStatus.SUCCEEDED })
+        await releaseIfReady(barrier.id)
+
+        const summary = await readSummary(barrier.id)
+        expect(summary).toMatchObject({ total: 3, succeeded: 2, stillRunning: 1 })
+    })
+
+    it('releases on the first unfavourable signal when releaseOnFirstFailure is set', async () => {
+        const { flowRun } = await createParentRun(FlowRunStatus.RUNNING)
+        const { barrier } = await createBarrier({
+            flowRunId: flowRun.id,
+            signalLabels: ['a@example.com', 'b@example.com', 'c@example.com'],
+            policy: { releaseOnFirstFailure: true },
+        })
+        const signals = await listSignals(barrier.id)
+
+        await receiveSignal({ signalId: signals[0].id, status: BarrierSignalStatus.REJECTED })
+        await releaseIfReady(barrier.id)
+
+        const summary = await readSummary(barrier.id)
+        expect(summary).toMatchObject({ total: 3, rejected: 1, stillRunning: 2 })
+    })
+
+    it('reports the inline signals so every awaited thing is named, not only the failures', async () => {
+        const { flowRun } = await createParentRun(FlowRunStatus.RUNNING)
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com', 'b@example.com'] })
+        const signals = await listSignals(barrier.id)
+
+        await receiveSignal({ signalId: signals[0].id, status: BarrierSignalStatus.SUCCEEDED })
+        await receiveSignal({ signalId: signals[1].id, status: BarrierSignalStatus.FAILED, result: { reason: 'nope' } })
+        await releaseIfReady(barrier.id)
+
+        const summary = await readSummary(barrier.id)
+        expect(summary.failed).toBe(1)
+        expect(summary.signals?.map((signal) => signal.label).sort()).toEqual(['a@example.com', 'b@example.com'])
+        expect(summary.signals?.map((signal) => signal.outcome).sort()).toEqual([BarrierSignalStatus.FAILED, BarrierSignalStatus.SUCCEEDED])
+    })
+})
+
+describe('signal identity', () => {
+    it('rejects a second signal on the same (waitpointId, sequence)', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        const row = {
+            waitpointId: barrier.id,
+            projectId: ctx.project.id,
+            status: BarrierSignalStatus.PENDING,
+            refId: null,
+            sequence: 0,
+            label: null,
+            result: null,
+        }
+        await databaseConnection().getRepository('waitpoint_signal').insert({ id: apId(), ...row })
+
+        await expect(databaseConnection().getRepository('waitpoint_signal').insert({ id: apId(), ...row })).rejects.toThrow()
+    })
+
+    it('lets two null sequences coexist on one barrier', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com', 'b@example.com'] })
+
+        const signals = await listSignals(barrier.id)
+        expect(signals).toHaveLength(2)
+        expect(signals.every((signal) => signal.sequence === null)).toBe(true)
+    })
+
+    it('overwrites the outcome when the same signal is received twice', async () => {
+        const { flowRun } = await createParentRun(FlowRunStatus.RUNNING)
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com', 'b@example.com'] })
+        const [signal] = await listSignals(barrier.id)
+
+        await receiveSignal({ signalId: signal.id, status: BarrierSignalStatus.FAILED })
+        await receiveSignal({ signalId: signal.id, status: BarrierSignalStatus.SUCCEEDED })
+
+        const reread = (await listSignals(barrier.id)).find((row) => row.id === signal.id)
+        expect(reread.status).toBe(BarrierSignalStatus.SUCCEEDED)
+    })
+})
+
+describe('evaluation coalescing', () => {
+    it('clears the deduplication key before evaluating, so a signal landing mid-job is not swallowed', async () => {
+        const { flowRun } = await createParentRun()
+        const queue = barrierQueue(app.log).get()
+        await queue.pause()
+        try {
+            const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com', 'b@example.com'] })
+
+            await barrierQueue(app.log).enqueueEvaluation({ barrierId: barrier.id, projectId: ctx.project.id })
+            const beforeHandling = await countPendingEvaluations({ queue, barrierId: barrier.id })
+
+            await barrierQueue(app.log).clearEvaluationDedupKey(barrier.id)
+            await barrierQueue(app.log).enqueueEvaluation({ barrierId: barrier.id, projectId: ctx.project.id })
+            const afterHandling = await countPendingEvaluations({ queue, barrierId: barrier.id })
+
+            expect(beforeHandling).toBe(1)
+            expect(afterHandling).toBe(2)
+        }
+        finally {
+            await queue.resume()
+        }
+    })
+})
+
+describe('resume guards', () => {
+    it('refuses an external resume that addresses a barrier waitpoint', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com', 'b@example.com'] })
+
+        const { stale } = await resumeService(app.log).resumeFromWaitpoint({
+            flowRunId: flowRun.id,
+            waitpointId: barrier.id,
+            resumePayload: { body: { forged: true } },
+        })
+
+        expect(stale).toBe(true)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.PENDING)
+    })
+
+    it('refuses a by-run resume while the run holds a pending barrier', async () => {
+        const { flowRun } = await createParentRun()
+        await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com', 'b@example.com'] })
+
+        const { stale } = await resumeService(app.log).legacyResume({
+            flowRunId: flowRun.id,
+            resumePayload: { body: { forged: true } },
+        })
+
+        expect(stale).toBe(true)
+    })
+
+    it('refuses a resume addressed at a waitpoint id the run does not own while a barrier is open', async () => {
+        const { flowRun } = await createParentRun()
+        await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com', 'b@example.com'] })
+
+        const { stale } = await resumeService(app.log).resumeFromWaitpoint({
+            flowRunId: flowRun.id,
+            waitpointId: apId(),
+            resumePayload: { body: { forged: true } },
+        })
+
+        expect(stale).toBe(true)
+    })
+
+    it('lets the module release a barrier and consumes the waitpoint exactly once', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        const [signal] = await listSignals(barrier.id)
+
+        await receiveSignal({ signalId: signal.id, status: BarrierSignalStatus.SUCCEEDED })
+        await releaseIfReady(barrier.id)
+
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.CONSUMED)
+        expect(await listSignals(barrier.id)).toHaveLength(0)
+    })
+
+    it('leaves the resume to the release that closed the barrier, even inside the window before that release consumes it', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        await closeWithoutConsuming(barrier.id)
+        await dropResumeJobs(flowRun.id)
+
+        const lost = await releaseNow(barrier)
+
+        expect(lost).toBeNull()
+        expect(await listResumeJobs(flowRun.id)).toHaveLength(0)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.COMPLETED)
+    })
+
+    it('refuses a by-run resume between the barrier closing and the trusted resume consuming it', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        await completeWithoutConsuming(barrier.id)
+
+        const { stale } = await resumeService(app.log).legacyResume({
+            flowRunId: flowRun.id,
+            resumePayload: { body: { forged: true }, headers: {}, queryParams: {} },
+        })
+
+        expect(stale).toBe(true)
+    })
+
+    it('refuses a by-run resume after the barrier was released while the run is still PAUSED', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+
+        await releaseNow(barrier)
+
+        const run = await db.findOneByOrFail<{ status: FlowRunStatus }>('flow_run', { id: flowRun.id })
+        expect(run.status).toBe(FlowRunStatus.PAUSED)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.CONSUMED)
+
+        const { stale } = await resumeService(app.log).legacyResume({
+            flowRunId: flowRun.id,
+            resumePayload: { body: { forged: true }, headers: {}, queryParams: {} },
+        })
+
+        expect(stale).toBe(true)
+    })
+
+    it('refuses a by-run sync resume through both barrier windows', async () => {
+        const { flowRun: closedRun } = await createParentRun()
+        const { barrier: closedBarrier } = await createBarrier({ flowRunId: closedRun.id, signalLabels: ['a@example.com'] })
+        await completeWithoutConsuming(closedBarrier.id)
+
+        const closedResponse = await resumeService(app.log).legacySyncResume({
+            runId: closedRun.id,
+            payload: { body: { forged: true }, headers: {}, queryParams: {} },
+            correlationId: apId(),
+        })
+        expect(closedResponse.status).toBe(StatusCodes.GONE)
+
+        const { flowRun: releasedRun } = await createParentRun()
+        const { barrier: releasedBarrier } = await createBarrier({ flowRunId: releasedRun.id, signalLabels: ['a@example.com'] })
+        await releaseNow(releasedBarrier)
+
+        const releasedResponse = await resumeService(app.log).legacySyncResume({
+            runId: releasedRun.id,
+            payload: { body: { forged: true }, headers: {}, queryParams: {} },
+            correlationId: apId(),
+        })
+        expect(releasedResponse.status).toBe(StatusCodes.GONE)
+    })
+
+    it('still resumes a paused run that never held a waitpoint at all', async () => {
+        const { flowRun } = await createParentRun()
+
+        const { stale } = await resumeService(app.log).legacyResume({
+            flowRunId: flowRun.id,
+            resumePayload: { body: { approved: true }, headers: {}, queryParams: {} },
+        })
+
+        expect(stale).toBe(false)
+    })
+
+    it('leaves a non-barrier waitpoint resumable', async () => {
+        const { flowRun } = await createParentRun()
+        const { waitpoint } = await waitpointService(app.log).createForPause({
+            flowRunId: flowRun.id,
+            projectId: ctx.project.id,
+            stepName: 'approval',
+            type: PauseType.WEBHOOK,
+            version: 'V1',
+        })
+
+        const { stale } = await resumeService(app.log).resumeFromWaitpoint({
+            flowRunId: flowRun.id,
+            waitpointId: waitpoint.id,
+            resumePayload: { body: { approved: true } },
+        })
+
+        expect(stale).toBe(false)
+    })
+
+    it('refuses a trusted resume of a barrier that was already delivered', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        await releaseNow(barrier)
+        await dropResumeJobs(flowRun.id)
+
+        const { stale } = await resumeService(app.log).resumeTrustedWithoutLock({
+            flowRunId: flowRun.id,
+            waitpointId: barrier.id,
+            resumePayload: { body: { forged: true }, headers: {}, queryParams: {} },
+        })
+
+        expect(stale).toBe(true)
+        expect(await listResumeJobs(flowRun.id)).toHaveLength(0)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.CONSUMED)
+    })
+
+    it('does not dispatch a second resume for a barrier that was already consumed', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        await releaseNow(barrier)
+        await dropResumeJobs(flowRun.id)
+
+        const { stale } = await resumeService(app.log).resumeFromWaitpoint({
+            flowRunId: flowRun.id,
+            waitpointId: barrier.id,
+            resumePayload: { body: { forged: true } },
+        })
+
+        expect(stale).toBe(true)
+        expect(await listResumeJobs(flowRun.id)).toHaveLength(0)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.CONSUMED)
+    })
+})
+
+describe('undelivered resume recovery', () => {
+    it('dispatches the resume for a waitpoint that was already completed before the run reached PAUSED', async () => {
+        const { flowRun } = await createParentRun()
+        const { waitpoint } = await waitpointService(app.log).createForPause({
+            flowRunId: flowRun.id,
+            projectId: ctx.project.id,
+            stepName: 'approval',
+            type: PauseType.WEBHOOK,
+            version: 'V1',
+        })
+        await completeWithoutConsuming(waitpoint.id)
+        await dropResumeJobs(flowRun.id)
+
+        await recoverUndeliveredResume(flowRun.id)
+
+        expect(await listResumeJobs(flowRun.id)).toHaveLength(1)
+        expect(await db.findOneBy('waitpoint', { id: waitpoint.id })).toBeNull()
+    })
+
+    it('still resumes when the release that closed the barrier died before dispatching', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        await closeWithoutConsuming(barrier.id)
+        await dropResumeJobs(flowRun.id)
+
+        await releaseIfReady(barrier.id)
+
+        expect(await listResumeJobs(flowRun.id)).toHaveLength(1)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.CONSUMED)
+    })
+
+    it('fails the evaluation when the re-dispatch fails, so the queue spends its remaining attempts', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        await closeWithoutConsuming(barrier.id)
+        await dropResumeJobs(flowRun.id)
+        await db.update('waitpoint', barrier.id, { flowRunId: apId() })
+
+        await expect(releaseIfReady(barrier.id)).rejects.toThrow()
+
+        expect(await listResumeJobs(flowRun.id)).toHaveLength(0)
+        expect(await readStatus(barrier.id)).toBe(WaitpointStatus.COMPLETED)
+    })
+
+    it('enqueues nothing when recovery runs a second time on a consumed barrier', async () => {
+        const { flowRun } = await createParentRun()
+        const { barrier } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a@example.com'] })
+        await releaseNow(barrier)
+        await dropResumeJobs(flowRun.id)
+
+        await releaseIfReady(barrier.id)
+
+        expect(await recoverUndeliveredResume(flowRun.id)).toBeNull()
+        expect(await listResumeJobs(flowRun.id)).toHaveLength(0)
+    })
+})
+
+describe('signal count limit', () => {
+    it('refuses a barrier that waits on more than the platform allows', async () => {
+        const { flowRun } = await createParentRun()
+        await platformConfigurationService(app.log).update({ platformId: ctx.platform.id, maxBarrierSignals: 2 })
+
+        await expect(createBarrier({ flowRunId: flowRun.id, signalLabels: ['a', 'b', 'c'] })).rejects.toMatchObject({
+            error: {
+                code: ErrorCode.VALIDATION,
+                params: { message: expect.stringContaining('exceeds the maximum of 2') },
+            },
+        })
+    })
+
+    it('allows a barrier at exactly the platform limit', async () => {
+        const { flowRun } = await createParentRun()
+        await platformConfigurationService(app.log).update({ platformId: ctx.platform.id, maxBarrierSignals: 2 })
+
+        const { signalCount } = await createBarrier({ flowRunId: flowRun.id, signalLabels: ['a', 'b'] })
+
+        expect(signalCount).toBe(2)
+    })
+})
diff --git a/packages/server/api/test/integration/ce/flows/flow-run/execute-flow-e2e.test.ts b/packages/server/api/test/integration/ce/flows/flow-run/execute-flow-e2e.test.ts
index 51bfee484ed9..4d518b5a188f 100644
--- a/packages/server/api/test/integration/ce/flows/flow-run/execute-flow-e2e.test.ts
+++ b/packages/server/api/test/integration/ce/flows/flow-run/execute-flow-e2e.test.ts
@@ -22,6 +22,7 @@ import {
     FlowTriggerType,
     FlowVersionState,
     PackageType,
+    PauseType,
     PieceScope,
     PieceType,
     RunEnvironment,
@@ -60,7 +61,7 @@ beforeAll(async () => {
         workerToken: ctx.workerToken,
     })
     await new Promise((resolve) => setTimeout(resolve, 5000))
-}, 30_000)
+})
 
 afterAll(async () => {
     worker.stop()
@@ -402,6 +403,117 @@ async function setupSubflowWithWebhookResponseFixtures() {
     return { parentFlow, parentFlowVersion, mockPlatform, mockProject }
 }
 
+const APPROVAL_PIECE_VERSION = '0.1.28'
+const DELAY_PIECE_VERSION = '0.3.34'
+const WEBHOOK_PIECE_VERSION = '0.1.29'
+
+async function saveWaitpointPieces(): Promise<void> {
+    const pieces = [
+        { name: '@activepieces/piece-webhook', version: WEBHOOK_PIECE_VERSION },
+        { name: '@activepieces/piece-approval', version: APPROVAL_PIECE_VERSION },
+        { name: '@activepieces/piece-delay', version: DELAY_PIECE_VERSION },
+    ].map(({ name, version }) => createMockPieceMetadata({
+        name,
+        version,
+        platformId: undefined,
+        packageType: PackageType.REGISTRY,
+        pieceType: PieceType.OFFICIAL,
+    }))
+    await databaseConnection().getRepository('piece_metadata').save(pieces)
+}
+
+function approvalAction({ name, displayName, nextAction }: { name: string, displayName: string, nextAction?: unknown }) {
+    return {
+        type: FlowActionType.PIECE as const,
+        name,
+        displayName,
+        valid: true,
+        settings: {
+            pieceName: '@activepieces/piece-approval',
+            pieceVersion: APPROVAL_PIECE_VERSION,
+            actionName: 'wait_for_approval',
+            input: {},
+            propertySettings: {},
+            errorHandlingOptions: {},
+        },
+        ...(nextAction ? { nextAction } : {}),
+    }
+}
+
+async function startWaitpointRun({ mockPlatform, mockProject, firstAction, payload }: {
+    mockPlatform: { id: string }
+    mockProject: { id: string }
+    firstAction: unknown
+    payload?: Record<string, unknown>
+}) {
+    const mockFlow = createMockFlow({ projectId: mockProject.id })
+    await db.save('flow', mockFlow)
+    const mockFlowVersion = createMockFlowVersion({
+        flowId: mockFlow.id,
+        state: FlowVersionState.DRAFT,
+        trigger: {
+            type: FlowTriggerType.PIECE,
+            name: 'trigger',
+            displayName: 'Catch Webhook',
+            valid: true,
+            lastUpdatedDate: new Date().toISOString(),
+            settings: {
+                pieceName: '@activepieces/piece-webhook',
+                pieceVersion: WEBHOOK_PIECE_VERSION,
+                triggerName: 'catch_webhook',
+                input: { authType: 'none' },
+                propertySettings: {},
+            },
+            nextAction: firstAction,
+        },
+    })
+    await db.save('flow_version', mockFlowVersion)
+
+    return flowRunService(app.log).start({
+        flowId: mockFlow.id,
+        payload: { body: payload ?? { test: true } },
+        platformId: mockPlatform.id,
+        executionType: ExecutionType.BEGIN,
+        environment: RunEnvironment.TESTING,
+        streamStepProgress: StreamStepProgress.NONE,
+        executeTrigger: false,
+        flowVersionId: mockFlowVersion.id,
+        projectId: mockProject.id,
+        workerHandlerId: undefined,
+        httpRequestId: undefined,
+        failParentOnFailure: undefined,
+    })
+}
+
+async function waitForPendingWaitpoint(flowRunId: string, excludeIds: string[] = [], timeoutMs = 90_000): Promise<WaitpointRow> {
+    const start = Date.now()
+    while (Date.now() - start < timeoutMs) {
+        const rows = await db.findBy<WaitpointRow>('waitpoint', { flowRunId, status: 'PENDING' })
+        const fresh = rows.filter((row) => !excludeIds.includes(row.id))
+        if (fresh.length > 0) {
+            return fresh[0]
+        }
+        await new Promise((resolve) => setTimeout(resolve, 500))
+    }
+    const all = await db.findBy('waitpoint', { flowRunId })
+    throw new Error(`no fresh PENDING waitpoint for run ${flowRunId}; rows=${JSON.stringify(all)}`)
+}
+
+async function resumeWaitpoint({ flowRunId, waitpointId }: { flowRunId: string, waitpointId: string }): Promise<number> {
+    const response = await app.inject({
+        method: 'POST',
+        url: `/api/v1/flow-runs/${flowRunId}/waitpoints/${waitpointId}?action=approve`,
+    })
+    return response.statusCode
+}
+
+type WaitpointRow = {
+    id: string
+    stepName: string
+    type: string
+    status: string
+}
+
 async function pollFlowRunToCompletion(flowRunId: string, projectId: string) {
     const maxWaitMs = 120_000
     const pollIntervalMs = 500
@@ -1270,4 +1382,145 @@ describe('Execute Flow E2E', () => {
         expect(response.statusCode).toBe(StatusCodes.OK)
         expect(response.headers['x-webhook-id']).toBeDefined()
     }, 180_000)
+
+    it('gives every loop iteration its own path-keyed waitpoint row', async () => {
+        const { mockPlatform, mockProject } = await mockAndSaveBasicSetup()
+        await saveWaitpointPieces()
+
+        const loopAction = {
+            type: FlowActionType.LOOP_ON_ITEMS as const,
+            name: 'step_1',
+            displayName: 'Loop',
+            valid: true,
+            settings: { items: '{{trigger[\'output\'].body.items}}' },
+            firstLoopAction: approvalAction({ name: 'step_2', displayName: 'Wait for Approval' }),
+            nextAction: {
+                type: FlowActionType.CODE as const,
+                name: 'step_3',
+                displayName: 'After Loop',
+                valid: true,
+                settings: {
+                    sourceCode: { code: 'export const code = async () => ({ done: true });', packageJson: '{}' },
+                    input: {},
+                    errorHandlingOptions: {},
+                },
+            },
+        }
+
+        const flowRun = await startWaitpointRun({ mockPlatform, mockProject, firstAction: loopAction, payload: { items: [1, 2, 3] } })
+
+        const seenStepNames: string[] = []
+        const seenWaitpointIds: string[] = []
+        for (let iteration = 0; iteration < 3; iteration++) {
+            const waitpoint = await waitForPendingWaitpoint(flowRun.id, seenWaitpointIds)
+            seenStepNames.push(waitpoint.stepName)
+            seenWaitpointIds.push(waitpoint.id)
+            await resumeWaitpoint({ flowRunId: flowRun.id, waitpointId: waitpoint.id })
+        }
+
+        const result = await pollFlowRunToCompletion(flowRun.id, mockProject.id)
+
+        expect(seenStepNames).toEqual(['step_1:0/step_2', 'step_1:1/step_2', 'step_1:2/step_2'])
+        expect(result.status).toBe(FlowRunStatus.SUCCEEDED)
+    }, 180_000)
+
+    it('advances one step per approval in a three-link approval chain', async () => {
+        const { mockPlatform, mockProject } = await mockAndSaveBasicSetup()
+        await saveWaitpointPieces()
+
+        const chain = approvalAction({
+            name: 'step_1',
+            displayName: 'Approval One',
+            nextAction: approvalAction({
+                name: 'step_2',
+                displayName: 'Approval Two',
+                nextAction: approvalAction({
+                    name: 'step_3',
+                    displayName: 'Approval Three',
+                    nextAction: {
+                        type: FlowActionType.CODE as const,
+                        name: 'step_4',
+                        displayName: 'Done',
+                        valid: true,
+                        settings: {
+                            sourceCode: { code: 'export const code = async () => ({ done: true });', packageJson: '{}' },
+                            input: {},
+                            errorHandlingOptions: {},
+                        },
+                    },
+                }),
+            }),
+        })
+
+        const flowRun = await startWaitpointRun({ mockPlatform, mockProject, firstAction: chain })
+
+        const seenStepNames: string[] = []
+        const consumedWaitpointIds: string[] = []
+        for (let link = 0; link < 3; link++) {
+            const waitpoint = await waitForPendingWaitpoint(flowRun.id, consumedWaitpointIds)
+            seenStepNames.push(waitpoint.stepName)
+            await resumeWaitpoint({ flowRunId: flowRun.id, waitpointId: waitpoint.id })
+            consumedWaitpointIds.push(waitpoint.id)
+        }
+
+        const replayStatuses = await Promise.all(
+            consumedWaitpointIds.map((waitpointId) => resumeWaitpoint({ flowRunId: flowRun.id, waitpointId })),
+        )
+        const result = await pollFlowRunToCompletion(flowRun.id, mockProject.id)
+
+        expect(seenStepNames).toEqual(['step_1', 'step_2', 'step_3'])
+        expect(result.status).toBe(FlowRunStatus.SUCCEEDED)
+        expect(replayStatuses.every((status) => status < 500)).toBe(true)
+    }, 180_000)
+
+    it('delivers a DELAY pause and a WEBHOOK pause in one run and leaves no waitpoint behind', async () => {
+        const { mockPlatform, mockProject } = await mockAndSaveBasicSetup()
+        await saveWaitpointPieces()
+
+        const delayThenApproval = {
+            type: FlowActionType.PIECE as const,
+            name: 'step_1',
+            displayName: 'Delay For',
+            valid: true,
+            settings: {
+                pieceName: '@activepieces/piece-delay',
+                pieceVersion: DELAY_PIECE_VERSION,
+                actionName: 'delayFor',
+                input: { unit: 'seconds', delayFor: 11 },
+                propertySettings: {},
+                errorHandlingOptions: {},
+            },
+            nextAction: approvalAction({
+                name: 'step_2',
+                displayName: 'Wait for Approval',
+                nextAction: {
+                    type: FlowActionType.CODE as const,
+                    name: 'step_3',
+                    displayName: 'Done',
+                    valid: true,
+                    settings: {
+                        sourceCode: { code: 'export const code = async () => ({ done: true });', packageJson: '{}' },
+                        input: {},
+                        errorHandlingOptions: {},
+                    },
+                },
+            }),
+        }
+
+        const flowRun = await startWaitpointRun({ mockPlatform, mockProject, firstAction: delayThenApproval })
+
+        const delayWaitpoint = await waitForPendingWaitpoint(flowRun.id)
+        expect(delayWaitpoint.type).toBe(PauseType.DELAY)
+        expect(delayWaitpoint.stepName).toBe('step_1')
+
+        const approvalWaitpoint = await waitForPendingWaitpoint(flowRun.id, [delayWaitpoint.id], 120_000)
+        expect(approvalWaitpoint.type).toBe(PauseType.WEBHOOK)
+        expect(approvalWaitpoint.stepName).toBe('step_2')
+
+        await resumeWaitpoint({ flowRunId: flowRun.id, waitpointId: approvalWaitpoint.id })
+        const result = await pollFlowRunToCompletion(flowRun.id, mockProject.id)
+
+        expect(result.status).toBe(FlowRunStatus.SUCCEEDED)
+        expect(await db.findBy('waitpoint', { flowRunId: flowRun.id })).toHaveLength(0)
+    }, 180_000)
 })
diff --git a/packages/server/api/test/integration/ce/flows/flow-run/resume-service.test.ts b/packages/server/api/test/integration/ce/flows/flow-run/resume-service.test.ts
index 926f968200b4..1d48e4361e54 100644
--- a/packages/server/api/test/integration/ce/flows/flow-run/resume-service.test.ts
+++ b/packages/server/api/test/integration/ce/flows/flow-run/resume-service.test.ts
@@ -1,9 +1,12 @@
 import { apId } from '@activepieces/core-utils'
 import { FlowRunStatus, FlowVersionState, PauseType, RunEnvironment } from '@activepieces/shared'
 import { FastifyInstance } from 'fastify'
+import { StatusCodes } from 'http-status-codes'
+import { distributedStore } from '../../../../../src/app/database/redis-connections'
 import { resumeService } from '../../../../../src/app/waitpoints/resume-service'
 import { waitpointService } from '../../../../../src/app/waitpoints/waitpoint-service'
 import { WaitpointStatus } from '../../../../../src/app/waitpoints/waitpoint-types'
+import { redisMetadataKey } from '../../../../../src/app/workers/job'
 import { db } from '../../../../helpers/db'
 import { createMockFlow, createMockFlowRun, createMockFlowVersion } from '../../../../helpers/mocks'
 import { createTestContext, TestContext } from '../../../../helpers/test-context'
@@ -62,7 +65,16 @@ async function createFlowRunAndWaitpoint(params: {
     return { flow, flowVersion, flowRun, waitpointId }
 }
 
-describe('resumeService resumeFromWaitpointWithoutLock', () => {
+async function queueTerminalStatus({ flowRunId, projectId }: { flowRunId: string, projectId: string }) {
+    await distributedStore.merge(redisMetadataKey({ projectId, runId: flowRunId }), {
+        id: flowRunId,
+        projectId,
+        status: FlowRunStatus.CANCELED,
+        requestId: apId(),
+    })
+}
+
+describe('resumeService resumeTrustedWithoutLock', () => {
     it('consumes a PENDING waitpoint and enqueues resume when flow is PAUSED (worker-before-callback ordering)', async () => {
         const { flowRun, waitpointId } = await createFlowRunAndWaitpoint({
             projectId: ctx.project.id,
@@ -70,7 +82,7 @@ describe('resumeService resumeFromWaitpointWithoutLock', () => {
             waitpointStatus: WaitpointStatus.PENDING,
         })
 
-        const result = await resumeService(app.log).resumeFromWaitpointWithoutLock({
+        const result = await resumeService(app.log).resumeTrustedWithoutLock({
             flowRunId: flowRun.id,
             waitpointId,
             resumePayload: { body: { status: 'approved' } },
@@ -98,7 +110,7 @@ describe('resumeService resumeFromWaitpointWithoutLock', () => {
 
         await db.update('flow_run', flowRun.id, { status: FlowRunStatus.PAUSED })
 
-        const result = await resumeService(app.log).resumeFromWaitpointWithoutLock({
+        const result = await resumeService(app.log).resumeTrustedWithoutLock({
             flowRunId: flowRun.id,
             waitpointId,
             resumePayload: { body: { status: 'early' } },
@@ -126,7 +138,7 @@ describe('resumeService resumeFromWaitpointWithoutLock', () => {
 
         await db.update('flow_run', flowRun.id, { status: FlowRunStatus.PAUSED })
 
-        await resumeService(app.log).resumeFromWaitpointWithoutLock({
+        await resumeService(app.log).resumeTrustedWithoutLock({
             flowRunId: flowRun.id,
             waitpointId,
             resumePayload: { body: { status: 'quick' } },
@@ -154,7 +166,7 @@ describe('resumeService resumeFromWaitpointWithoutLock', () => {
         })
 
         const bogusWaitpointId = apId()
-        const result = await resumeService(app.log).resumeFromWaitpointWithoutLock({
+        const result = await resumeService(app.log).resumeTrustedWithoutLock({
             flowRunId: flowRun.id,
             waitpointId: bogusWaitpointId,
             resumePayload: { body: { status: 'stale' } },
@@ -166,3 +178,71 @@ describe('resumeService resumeFromWaitpointWithoutLock', () => {
         expect(waitpoint).not.toBeNull()
     })
 })
+
+describe('resume guards against a cancellation in flight', () => {
+    it('refuses a by-run resume once a terminal status is queued but not yet persisted', async () => {
+        const { flowRun } = await createFlowRunAndWaitpoint({
+            projectId: ctx.project.id,
+            flowRunStatus: FlowRunStatus.PAUSED,
+        })
+        await waitpointService(app.log).deleteByFlowRunId({ flowRunId: flowRun.id, projectId: ctx.project.id })
+        await queueTerminalStatus({ flowRunId: flowRun.id, projectId: ctx.project.id })
+
+        const { stale } = await resumeService(app.log).legacyResume({
+            flowRunId: flowRun.id,
+            resumePayload: { body: { forged: true }, headers: {}, queryParams: {} },
+        })
+
+        expect(stale).toBe(true)
+    })
+
+    it('refuses a by-run sync resume in the same window', async () => {
+        const { flowRun } = await createFlowRunAndWaitpoint({
+            projectId: ctx.project.id,
+            flowRunStatus: FlowRunStatus.PAUSED,
+        })
+        await waitpointService(app.log).deleteByFlowRunId({ flowRunId: flowRun.id, projectId: ctx.project.id })
+        await queueTerminalStatus({ flowRunId: flowRun.id, projectId: ctx.project.id })
+
+        const response = await resumeService(app.log).legacySyncResume({
+            runId: flowRun.id,
+            payload: { body: { forged: true }, headers: {}, queryParams: {} },
+            correlationId: apId(),
+        })
+
+        expect(response.status).toBe(StatusCodes.GONE)
+    })
+
+    it('refuses an addressed resume of a live waitpoint in the same window, leaving the row intact', async () => {
+        const { flowRun, waitpointId } = await createFlowRunAndWaitpoint({
+            projectId: ctx.project.id,
+            flowRunStatus: FlowRunStatus.PAUSED,
+            waitpointStatus: WaitpointStatus.PENDING,
+        })
+        await queueTerminalStatus({ flowRunId: flowRun.id, projectId: ctx.project.id })
+
+        const { stale } = await resumeService(app.log).resumeFromWaitpoint({
+            flowRunId: flowRun.id,
+            waitpointId,
+            resumePayload: { body: { forged: true }, headers: {}, queryParams: {} },
+        })
+
+        expect(stale).toBe(true)
+        expect(await db.findOneBy('waitpoint', { id: waitpointId })).not.toBeNull()
+    })
+
+    it('still resumes a paused run with nothing queued against it', async () => {
+        const { flowRun } = await createFlowRunAndWaitpoint({
+            projectId: ctx.project.id,
+            flowRunStatus: FlowRunStatus.PAUSED,
+        })
+        await waitpointService(app.log).deleteByFlowRunId({ flowRunId: flowRun.id, projectId: ctx.project.id })
+
+        const { stale } = await resumeService(app.log).legacyResume({
+            flowRunId: flowRun.id,
+            resumePayload: { body: { approved: true }, headers: {}, queryParams: {} },
+        })
+
+        expect(stale).toBe(false)
+    })
+})
diff --git a/packages/server/api/test/integration/ce/flows/flow-run/waitpoint.test.ts b/packages/server/api/test/integration/ce/flows/flow-run/waitpoint.test.ts
index 8a7a7516b92c..40b86721a720 100644
--- a/packages/server/api/test/integration/ce/flows/flow-run/waitpoint.test.ts
+++ b/packages/server/api/test/integration/ce/flows/flow-run/waitpoint.test.ts
@@ -3,10 +3,10 @@ import { FlowRunStatus, FlowVersionState, PauseType, RunEnvironment } from '@act
 import { FastifyInstance } from 'fastify'
 import * as systemJobModule from '../../../../../src/app/helper/system-jobs/system-job'
 import { handleResumeDelayWaitpoint } from '../../../../../src/app/waitpoints/resume-delay-handler'
-import { waitpointService } from '../../../../../src/app/waitpoints/waitpoint-service'
+import { resumeDelayJobId, waitpointService } from '../../../../../src/app/waitpoints/waitpoint-service'
 import { WaitpointStatus } from '../../../../../src/app/waitpoints/waitpoint-types'
 import { db } from '../../../../helpers/db'
-import { createMockFlow, createMockFlowRun, createMockFlowVersion } from '../../../../helpers/mocks'
+import { createMockFlow, createMockFlowRun, createMockFlowVersion, mockAndSaveBasicSetup } from '../../../../helpers/mocks'
 import { createTestContext, TestContext } from '../../../../helpers/test-context'
 import { setupTestEnvironment, teardownTestEnvironment } from '../../../../helpers/test-setup'
 
@@ -130,6 +130,31 @@ describe('Waitpoint service', () => {
             expect(result.waitpoint.resumePayload).toEqual({ body: { data: 'test' } })
         })
 
+        it('should not hand back a pre-completed waitpoint from another project', async () => {
+            const { flowRun } = await createFlowRun({ status: FlowRunStatus.RUNNING })
+            const { mockProject: otherProject } = await mockAndSaveBasicSetup()
+
+            const pause = await waitpointService(app.log).createForPause({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                stepName: 'approval',
+                type: PauseType.WEBHOOK,
+            })
+            await waitpointService(app.log).complete({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                waitpointId: pause.waitpoint.id,
+                resumePayload: { body: { data: 'test' } },
+            })
+
+            await expect(waitpointService(app.log).createForPause({
+                flowRunId: flowRun.id,
+                projectId: otherProject.id,
+                stepName: 'approval',
+                type: PauseType.WEBHOOK,
+            })).rejects.toThrow()
+        })
+
         it('should correctly map DELAY pause fields', async () => {
             const { flowRun } = await createFlowRun()
             const resumeAt = new Date(Date.now() + 60000).toISOString()
@@ -174,6 +199,40 @@ describe('Waitpoint service', () => {
             expect(retried.waitpoint.id).toBe(first.waitpoint.id)
             expect(upsertJobSpy).toHaveBeenCalledTimes(2)
             expect(upsertJobSpy.mock.calls[1][0].job.data.waitpointId).toBe(first.waitpoint.id)
+            expect(upsertJobSpy.mock.calls[1][0].job.jobId).toBe(upsertJobSpy.mock.calls[0][0].job.jobId)
+        })
+
+        it('should give each waitpoint of one run its own resume job id', async () => {
+            const { flowRun } = await createFlowRun()
+            const upsertJobSpy = vi.fn()
+            vi.spyOn(systemJobModule, 'systemJobsSchedule').mockImplementation((log) => ({
+                ...originalSystemJobsSchedule(log),
+                upsertJob: upsertJobSpy,
+            }))
+
+            const approval = await waitpointService(app.log).createForPause({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                stepName: 'approval_link',
+                type: PauseType.WEBHOOK,
+            })
+            const delay = await waitpointService(app.log).createForPause({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                stepName: 'delay_step',
+                type: PauseType.DELAY,
+                resumeDateTime: new Date(Date.now() + 45000).toISOString(),
+            })
+
+            const scheduled = upsertJobSpy.mock.calls.map(([params]) => ({
+                jobId: params.job.jobId,
+                waitpointId: params.job.data.waitpointId,
+            }))
+            expect(scheduled).toEqual([
+                { jobId: resumeDelayJobId(approval.waitpoint.id), waitpointId: approval.waitpoint.id },
+                { jobId: resumeDelayJobId(delay.waitpoint.id), waitpointId: delay.waitpoint.id },
+            ])
+            expect(scheduled[0].jobId).not.toBe(scheduled[1].jobId)
         })
 
         it('should reject a resumeDateTime past flowRun.created + AP_PAUSED_FLOW_TIMEOUT_DAYS (cumulative check)', async () => {
@@ -414,7 +473,7 @@ describe('Waitpoint service', () => {
                 type: PauseType.WEBHOOK,
             })
 
-            await waitpointService(app.log).deleteByFlowRunId(flowRun.id)
+            await waitpointService(app.log).deleteByFlowRunId({ flowRunId: flowRun.id, projectId: ctx.project.id })
 
             const deleted = await db.findOneBy('waitpoint', { flowRunId: flowRun.id })
             expect(deleted).toBeNull()
@@ -432,25 +491,82 @@ describe('Waitpoint service', () => {
         })
     })
 
-    describe('getByFlowRunId', () => {
+    describe('findUndeliveredCompletedWaitpoint', () => {
         it('should return null when no waitpoint exists', async () => {
-            const result = await waitpointService(app.log).getByFlowRunId(apId())
+            const result = await waitpointService(app.log).findUndeliveredCompletedWaitpoint({ flowRunId: apId(), projectId: ctx.project.id })
             expect(result).toBeNull()
         })
 
-        it('should return the waitpoint when it exists', async () => {
-            const { flowRun } = await createFlowRun()
+        it('should return the COMPLETED waitpoint when it is the only one left', async () => {
+            const { flowRun } = await createFlowRun({ status: FlowRunStatus.RUNNING })
+
+            const pause = await waitpointService(app.log).createForPause({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                stepName: 'approval',
+                type: PauseType.WEBHOOK,
+            })
+            await waitpointService(app.log).complete({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                waitpointId: pause.waitpoint.id,
+                resumePayload: { body: { ok: true } },
+            })
 
+            const result = await waitpointService(app.log).findUndeliveredCompletedWaitpoint({ flowRunId: flowRun.id, projectId: ctx.project.id })
+            expect(result?.id).toBe(pause.waitpoint.id)
+        })
+
+        it('should return the COMPLETED waitpoint even while another step of the same run is still PENDING', async () => {
+            const { flowRun } = await createFlowRun({ status: FlowRunStatus.RUNNING })
+
+            const minted = await waitpointService(app.log).createForPause({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                stepName: 'create_approval_links',
+                type: PauseType.WEBHOOK,
+            })
+            await waitpointService(app.log).complete({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                waitpointId: minted.waitpoint.id,
+                resumePayload: { body: { approved: true } },
+            })
             await waitpointService(app.log).createForPause({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                stepName: 'wait_for_approval',
+                type: PauseType.WEBHOOK,
+            })
+
+            const result = await waitpointService(app.log).findUndeliveredCompletedWaitpoint({ flowRunId: flowRun.id, projectId: ctx.project.id })
+            expect(result?.id).toBe(minted.waitpoint.id)
+        })
+
+        it('should return null while the run holds a PENDING barrier', async () => {
+            const { flowRun } = await createFlowRun({ status: FlowRunStatus.RUNNING })
+
+            const webhook = await waitpointService(app.log).createForPause({
                 flowRunId: flowRun.id,
                 projectId: ctx.project.id,
                 stepName: 'approval',
                 type: PauseType.WEBHOOK,
             })
+            await waitpointService(app.log).complete({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                waitpointId: webhook.waitpoint.id,
+                resumePayload: { body: { ok: true } },
+            })
+            await waitpointService(app.log).createForPause({
+                flowRunId: flowRun.id,
+                projectId: ctx.project.id,
+                stepName: 'fan_out',
+                type: PauseType.BARRIER,
+            })
 
-            const result = await waitpointService(app.log).getByFlowRunId(flowRun.id)
-            expect(result).not.toBeNull()
-            expect(result!.flowRunId).toBe(flowRun.id)
+            const result = await waitpointService(app.log).findUndeliveredCompletedWaitpoint({ flowRunId: flowRun.id, projectId: ctx.project.id })
+            expect(result).toBeNull()
         })
     })
 
@@ -656,7 +772,7 @@ describe('Waitpoint service', () => {
             const staleWaitpointId = delayPause.waitpoint.id
 
             // Simulate: delay resolved early, flow continued and paused on approval (new waitpoint)
-            await waitpointService(app.log).deleteByFlowRunId(flowRun.id)
+            await waitpointService(app.log).deleteByFlowRunId({ flowRunId: flowRun.id, projectId: ctx.project.id })
             const approvalPause = await waitpointService(app.log).createForPause({
                 flowRunId: flowRun.id,
                 projectId: ctx.project.id,
@@ -725,7 +841,7 @@ describe('Waitpoint service', () => {
                 workerHandlerId: null,
             })
 
-            const result = await waitpointService(app.log).findPendingByVersion({ flowRunId: flowRun.id, version: 'V0' })
+            const result = await waitpointService(app.log).findPendingByVersion({ flowRunId: flowRun.id, projectId: ctx.project.id, version: 'V0' })
             expect(result).not.toBeNull()
             expect(result!.flowRunId).toBe(flowRun.id)
             expect(result!.version).toBe('V0')
@@ -746,7 +862,7 @@ describe('Waitpoint service', () => {
                 workerHandlerId: null,
             })
 
-            const result = await waitpointService(app.log).findPendingByVersion({ flowRunId: flowRun.id, version: 'V0' })
+            const result = await waitpointService(app.log).findPendingByVersion({ flowRunId: flowRun.id, projectId: ctx.project.id, version: 'V0' })
             expect(result).toBeNull()
         })
 
@@ -765,7 +881,7 @@ describe('Waitpoint service', () => {
                 workerHandlerId: null,
             })
 
-            const result = await waitpointService(app.log).findPendingByVersion({ flowRunId: flowRun.id, version: 'V0' })
+            const result = await waitpointService(app.log).findPendingByVersion({ flowRunId: flowRun.id, projectId: ctx.project.id, version: 'V0' })
             expect(result).toBeNull()
         })
     })
diff --git a/packages/server/api/test/integration/ce/flows/step-run/sample-data-scope.test.ts b/packages/server/api/test/integration/ce/flows/step-run/sample-data-scope.test.ts
new file mode 100644
index 000000000000..673015c08077
--- /dev/null
+++ b/packages/server/api/test/integration/ce/flows/step-run/sample-data-scope.test.ts
@@ -0,0 +1,164 @@
+import { apDayjs } from '@activepieces/server-utils'
+import {
+    FileCompression,
+    FileType,
+    FlowAction,
+    FlowActionType,
+    FlowTrigger,
+    FlowTriggerType,
+    FlowVersion,
+    SampleDataFileType,
+} from '@activepieces/shared'
+import { FastifyInstance } from 'fastify'
+import { sampleDataService } from '../../../../../src/app/flows/step-run/sample-data.service'
+import { db } from '../../../../helpers/db'
+import { createMockFile, createMockFlowVersion, mockAndSaveBasicSetup } from '../../../../helpers/mocks'
+import { setupTestEnvironment, teardownTestEnvironment } from '../../../../helpers/test-setup'
+
+let app: FastifyInstance
+let projectId: string
+let flowVersion: FlowVersion
+
+beforeAll(async () => {
+    app = await setupTestEnvironment()
+    const { mockPlatform, mockProject } = await mockAndSaveBasicSetup()
+    projectId = mockProject.id
+    flowVersion = await buildFlowVersion({ projectId, platformId: mockPlatform.id })
+})
+
+afterAll(async () => {
+    await teardownTestEnvironment()
+})
+
+async function saveSampleDataFile({ projectId, platformId, output }: SaveSampleDataFileParams): Promise<string> {
+    const file = createMockFile({
+        projectId,
+        platformId,
+        type: FileType.SAMPLE_DATA,
+        compression: FileCompression.NONE,
+        data: Buffer.from(JSON.stringify(output)),
+    })
+    await db.save('file', file)
+    return file.id
+}
+
+function pieceStep({ name, sampleDataFileId, nextAction }: PieceStepParams): FlowAction {
+    return {
+        type: FlowActionType.PIECE,
+        name,
+        displayName: name,
+        settings: {
+            pieceName: '@activepieces/piece-webhook',
+            pieceVersion: '~0.1.29',
+            actionName: 'return_response',
+            input: {},
+            propertySettings: {},
+            errorHandlingOptions: {},
+            sampleData: { sampleDataFileId, lastTestDate: apDayjs().toISOString() },
+        },
+        valid: true,
+        lastUpdatedDate: apDayjs().toISOString(),
+        nextAction,
+    }
+}
+
+async function buildFlowVersion({ projectId, platformId }: BuildFlowVersionParams): Promise<FlowVersion> {
+    const [triggerFileId, firstFileId, secondFileId, unrelatedFileId] = await Promise.all([
+        saveSampleDataFile({ projectId, platformId, output: { rows: [1, 2] } }),
+        saveSampleDataFile({ projectId, platformId, output: { body: 'step_1' } }),
+        saveSampleDataFile({ projectId, platformId, output: { body: 'step_2' } }),
+        saveSampleDataFile({ projectId, platformId, output: { body: 'unrelated' } }),
+    ])
+
+    const loopStep: FlowAction = {
+        type: FlowActionType.LOOP_ON_ITEMS,
+        name: 'loop_1',
+        displayName: 'loop_1',
+        settings: { items: '{{trigger.rows}}' },
+        valid: true,
+        lastUpdatedDate: apDayjs().toISOString(),
+        nextAction: pieceStep({ name: 'unrelated', sampleDataFileId: unrelatedFileId }),
+    }
+
+    const trigger: FlowTrigger = {
+        type: FlowTriggerType.PIECE,
+        name: 'trigger',
+        displayName: 'trigger',
+        settings: {
+            pieceName: '@activepieces/piece-webhook',
+            pieceVersion: '~0.1.29',
+            triggerName: 'catch_webhook',
+            input: {},
+            propertySettings: {},
+            sampleData: { sampleDataFileId: triggerFileId, lastTestDate: apDayjs().toISOString() },
+        },
+        valid: true,
+        lastUpdatedDate: apDayjs().toISOString(),
+        nextAction: pieceStep({
+            name: 'step_1',
+            sampleDataFileId: firstFileId,
+            nextAction: pieceStep({
+                name: 'step_2',
+                sampleDataFileId: secondFileId,
+                nextAction: loopStep,
+            }),
+        }),
+    }
+
+    return createMockFlowVersion({ trigger })
+}
+
+describe('Sample data scope for property resolution', () => {
+    it.each([
+        ['an input that references no step', { authType: 'basic' }, []],
+        ['only the step the input references', { url: '{{step_2.body}}' }, ['step_2']],
+        ['a referenced loop and the step it iterates over', { url: '{{loop_1.item}}' }, ['loop_1', 'trigger']],
+    ])('reads %s', async (_case, referencedBy, expectedStepNames) => {
+        const sampleData = await sampleDataService(app.log).getSampleDataForFlow({
+            projectId,
+            flowVersion,
+            type: SampleDataFileType.OUTPUT,
+            referencedBy,
+        })
+
+        expect(Object.keys(sampleData).sort()).toStrictEqual(expectedStepNames)
+    })
+
+    it('reads a step under test together with the steps inside it', async () => {
+        const sampleData = await sampleDataService(app.log).getSampleDataForFlow({
+            projectId,
+            flowVersion,
+            type: SampleDataFileType.OUTPUT,
+            referencedBy: [{ items: '{{trigger.rows}}' }, { input: { url: '{{step_1.body}}' } }],
+        })
+
+        expect(Object.keys(sampleData).sort()).toStrictEqual(['step_1', 'trigger'])
+    })
+
+    it('still reads every step for a whole-flow read', async () => {
+        const sampleData = await sampleDataService(app.log).getSampleDataForFlow({
+            projectId,
+            flowVersion,
+            type: SampleDataFileType.OUTPUT,
+        })
+
+        expect(Object.keys(sampleData).sort()).toStrictEqual(['loop_1', 'step_1', 'step_2', 'trigger', 'unrelated'])
+    })
+})
+
+type SaveSampleDataFileParams = {
+    projectId: string
+    platformId: string
+    output: unknown
+}
+
+type PieceStepParams = {
+    name: string
+    sampleDataFileId: string
+    nextAction?: FlowAction
+}
+
+type BuildFlowVersionParams = {
+    projectId: string
+    platformId: string
+}
diff --git a/packages/server/api/test/integration/ce/flows/step-run/test-step-e2e.test.ts b/packages/server/api/test/integration/ce/flows/step-run/test-step-e2e.test.ts
new file mode 100644
index 000000000000..a14380978db6
--- /dev/null
+++ b/packages/server/api/test/integration/ce/flows/step-run/test-step-e2e.test.ts
@@ -0,0 +1,179 @@
+import { apDayjs } from '@activepieces/server-utils'
+import {
+    FileCompression,
+    FileType,
+    FlowActionType,
+    FlowRunStatus,
+    FlowTriggerType,
+    FlowVersionState,
+    PackageType,
+    PieceType,
+} from '@activepieces/shared'
+import { FastifyInstance } from 'fastify'
+import { worker } from '../../../../../../worker/src/lib/worker'
+import { databaseConnection } from '../../../../../src/app/database/database-connection'
+import { flowRunService } from '../../../../../src/app/flows/flow-run/flow-run-service'
+import { db } from '../../../../helpers/db'
+import { setupE2eEnvironment } from '../../../../helpers/e2e-setup'
+import {
+    createMockFile,
+    createMockFlow,
+    createMockFlowVersion,
+    createMockPieceMetadata,
+    mockAndSaveBasicSetup,
+} from '../../../../helpers/mocks'
+
+let app: FastifyInstance
+
+beforeAll(async () => {
+    const ctx = await setupE2eEnvironment()
+    app = ctx.app
+    await worker.start({
+        apiUrl: ctx.apiUrl,
+        socketUrl: { url: ctx.apiUrl, path: '/api/socket.io' },
+        workerToken: ctx.workerToken,
+    })
+    await new Promise((resolve) => setTimeout(resolve, 5000))
+}, 30_000)
+
+afterAll(async () => {
+    await worker.stop()
+    await app.close()
+}, 15_000)
+
+async function saveSampleDataFile({ projectId, platformId, output }: { projectId: string, platformId: string, output: unknown }): Promise<string> {
+    const file = createMockFile({
+        projectId,
+        platformId,
+        type: FileType.SAMPLE_DATA,
+        compression: FileCompression.NONE,
+        data: Buffer.from(JSON.stringify(output)),
+    })
+    await db.save('file', file)
+    return file.id
+}
+
+async function pollFlowRunToCompletion({ flowRunId, projectId }: { flowRunId: string, projectId: string }) {
+    const deadline = Date.now() + 120_000
+    let result = await flowRunService(app.log).getOnePopulatedOrThrow({ id: flowRunId, projectId })
+    while (
+        (result.status === FlowRunStatus.QUEUED || result.status === FlowRunStatus.RUNNING) &&
+        Date.now() < deadline
+    ) {
+        await new Promise((resolve) => setTimeout(resolve, 500))
+        result = await flowRunService(app.log).getOnePopulatedOrThrow({ id: flowRunId, projectId })
+    }
+    return result
+}
+
+describe('Test step with narrowed sample data', () => {
+    it('resolves a reference to an earlier step through the full worker round trip', async () => {
+        const { mockPlatform, mockProject } = await mockAndSaveBasicSetup()
+
+        const triggerFileId = await saveSampleDataFile({
+            projectId: mockProject.id,
+            platformId: mockPlatform.id,
+            output: { unreferenced: 'trigger payload the tested step never mentions' },
+        })
+        const firstStepFileId = await saveSampleDataFile({
+            projectId: mockProject.id,
+            platformId: mockPlatform.id,
+            output: { value: 'from-step-1' },
+        })
+
+        const mockPiece = createMockPieceMetadata({
+            name: '@activepieces/piece-webhook',
+            version: '0.1.29',
+            platformId: undefined,
+            packageType: PackageType.REGISTRY,
+            pieceType: PieceType.OFFICIAL,
+        })
+        await databaseConnection().getRepository('piece_metadata').save(mockPiece)
+
+        const mockFlow = createMockFlow({ projectId: mockProject.id })
+        await db.save('flow', mockFlow)
+
+        const stepUnderTest = {
+            type: FlowActionType.CODE,
+            name: 'step_2',
+            displayName: 'Echo',
+            valid: true,
+            lastUpdatedDate: apDayjs().toISOString(),
+            settings: {
+                sourceCode: {
+                    code: 'export const code = async (inputs) => ({ echoed: inputs.value });',
+                    packageJson: '{}',
+                },
+                input: { value: '{{step_1[\'output\'].value}}' },
+                errorHandlingOptions: {},
+            },
+        }
+
+        const mockFlowVersion = createMockFlowVersion({
+            flowId: mockFlow.id,
+            state: FlowVersionState.DRAFT,
+            trigger: {
+                type: FlowTriggerType.PIECE,
+                name: 'trigger',
+                displayName: 'Catch Webhook',
+                valid: true,
+                lastUpdatedDate: apDayjs().toISOString(),
+                settings: {
+                    pieceName: '@activepieces/piece-webhook',
+                    pieceVersion: '~0.1.29',
+                    triggerName: 'catch_webhook',
+                    input: {},
+                    propertySettings: {},
+                    sampleData: { sampleDataFileId: triggerFileId, lastTestDate: apDayjs().toISOString() },
+                },
+                nextAction: {
+                    type: FlowActionType.CODE,
+                    name: 'step_1',
+                    displayName: 'Produce Value',
+                    valid: true,
+                    lastUpdatedDate: apDayjs().toISOString(),
+                    settings: {
+                        sourceCode: { code: 'export const code = async () => ({ value: \'never runs\' });', packageJson: '{}' },
+                        input: {},
+                        errorHandlingOptions: {},
+                        sampleData: { sampleDataFileId: firstStepFileId, lastTestDate: apDayjs().toISOString() },
+                    },
+                    nextAction: stepUnderTest,
+                },
+            },
+        })
+        await db.save('flow_version', mockFlowVersion)
+
+        const flowRun = await flowRunService(app.log).test({
+            projectId: mockProject.id,
+            flowVersionId: mockFlowVersion.id,
+            stepNameToTest: 'step_2',
+            triggeredBy: undefined,
+        })
+
+        const result = await pollFlowRunToCompletion({ flowRunId: flowRun.id, projectId: mockProject.id })
+
+        expect(result.status).toBe(FlowRunStatus.SUCCEEDED)
+        expect(result.steps?.['step_2']?.output).toStrictEqual({ echoed: 'from-step-1' })
+    }, 180_000)
+
+    it('still queues a tracked run when the step under test no longer exists', async () => {
+        const { mockProject } = await mockAndSaveBasicSetup()
+        const mockFlow = createMockFlow({ projectId: mockProject.id })
+        await db.save('flow', mockFlow)
+        const mockFlowVersion = createMockFlowVersion({
+            flowId: mockFlow.id,
+            state: FlowVersionState.DRAFT,
+        })
+        await db.save('flow_version', mockFlowVersion)
+
+        const flowRun = await flowRunService(app.log).test({
+            projectId: mockProject.id,
+            flowVersionId: mockFlowVersion.id,
+            stepNameToTest: 'deleted_step',
+            triggeredBy: undefined,
+        })
+
+        expect(flowRun.id).toBeDefined()
+    }, 180_000)
+})
diff --git a/packages/server/api/test/integration/ce/platform/platform-configuration.test.ts b/packages/server/api/test/integration/ce/platform/platform-configuration.test.ts
index e29fbe868edc..8e832c79b025 100644
--- a/packages/server/api/test/integration/ce/platform/platform-configuration.test.ts
+++ b/packages/server/api/test/integration/ce/platform/platform-configuration.test.ts
@@ -1,4 +1,4 @@
-import { ApFlagId, DefaultProjectRole } from '@activepieces/shared'
+import { ApFlagId, DefaultProjectRole, maxBarrierSignalsBounds } from '@activepieces/shared'
 import { FastifyInstance } from 'fastify'
 import { StatusCodes } from 'http-status-codes'
 import { system } from '../../../../src/app/helper/system/system'
@@ -39,6 +39,50 @@ describe('platform configuration', () => {
         expect(configuration.isInfraSetupTelemetryEnabled).toBe(true)
     })
 
+    it('creates the barrier signal cap from AP_MAX_BARRIER_SIGNALS', async () => {
+        const ctx = await createTestContext(app!)
+
+        const configuration = (await ctx.get('/v1/platform-configurations'))!.json()
+
+        expect(configuration.maxBarrierSignals).toBe(system.getNumberOrThrow(AppSystemProp.MAX_BARRIER_SIGNALS))
+    })
+
+    it('persists the barrier signal cap without disturbing telemetry', async () => {
+        const ctx = await createTestContext(app!)
+
+        await ctx.post('/v1/platform-configurations', { maxBarrierSignals: 5 })
+
+        const configuration = (await ctx.get('/v1/platform-configurations'))!.json()
+        expect(configuration.maxBarrierSignals).toBe(5)
+        expect(configuration.isInfraSetupTelemetryEnabled).toBe(true)
+    })
+
+    it('refuses a barrier signal cap below one', async () => {
+        const ctx = await createTestContext(app!)
+
+        const response = await ctx.post('/v1/platform-configurations', { maxBarrierSignals: 0 })
+
+        expect(response?.statusCode).toBe(StatusCodes.BAD_REQUEST)
+        expect((await ctx.get('/v1/platform-configurations'))!.json().maxBarrierSignals).toBe(system.getNumberOrThrow(AppSystemProp.MAX_BARRIER_SIGNALS))
+    })
+
+    it('refuses a barrier signal cap above the ten thousand ceiling', async () => {
+        const ctx = await createTestContext(app!)
+
+        const response = await ctx.post('/v1/platform-configurations', { maxBarrierSignals: maxBarrierSignalsBounds.max + 1 })
+
+        expect(response?.statusCode).toBe(StatusCodes.BAD_REQUEST)
+        expect((await ctx.get('/v1/platform-configurations'))!.json().maxBarrierSignals).toBe(system.getNumberOrThrow(AppSystemProp.MAX_BARRIER_SIGNALS))
+    })
+
+    it('accepts a barrier signal cap sitting exactly on the ceiling', async () => {
+        const ctx = await createTestContext(app!)
+
+        await ctx.post('/v1/platform-configurations', { maxBarrierSignals: maxBarrierSignalsBounds.max })
+
+        expect((await ctx.get('/v1/platform-configurations'))!.json().maxBarrierSignals).toBe(maxBarrierSignalsBounds.max)
+    })
+
     it('switches each setting without disturbing the other', async () => {
         const ctx = await createTestContext(app!)
 
diff --git a/packages/server/api/test/integration/ce/workers/refill-paused-jobs.test.ts b/packages/server/api/test/integration/ce/workers/refill-paused-jobs.test.ts
new file mode 100644
index 000000000000..b23d723ead8d
--- /dev/null
+++ b/packages/server/api/test/integration/ce/workers/refill-paused-jobs.test.ts
@@ -0,0 +1,171 @@
+import { apId } from '@activepieces/core-utils'
+import { FlowRunStatus, FlowVersionState, PauseType, RunEnvironment } from '@activepieces/shared'
+import dayjs from 'dayjs'
+import { FastifyInstance } from 'fastify'
+import { databaseConnection } from '../../../../src/app/database/database-connection'
+import { redisConnections } from '../../../../src/app/database/redis-connections'
+import { systemJobsSchedule } from '../../../../src/app/helper/system-jobs/system-job'
+import { resumeDelayJobId, waitpointService } from '../../../../src/app/waitpoints/waitpoint-service'
+import { WaitpointStatus } from '../../../../src/app/waitpoints/waitpoint-types'
+import { refillPausedRuns } from '../../../../src/app/workers/migrations/refill-paused-jobs'
+import { db } from '../../../helpers/db'
+import { createMockFlow, createMockFlowRun, createMockFlowVersion } from '../../../helpers/mocks'
+import { createTestContext, TestContext } from '../../../helpers/test-context'
+import { setupTestEnvironment, teardownTestEnvironment } from '../../../helpers/test-setup'
+
+const REFILL_MIGRATION_KEY = 'refill_paused_runs_v7'
+
+let app: FastifyInstance
+let ctx: TestContext
+
+beforeAll(async () => {
+    app = await setupTestEnvironment()
+})
+
+afterAll(async () => {
+    await teardownTestEnvironment()
+})
+
+beforeEach(async () => {
+    ctx = await createTestContext(app)
+})
+
+async function createPausedRun(): Promise<{ id: string }> {
+    const flow = createMockFlow({ projectId: ctx.project.id })
+    await db.save('flow', flow)
+    const flowVersion = createMockFlowVersion({ flowId: flow.id, state: FlowVersionState.LOCKED })
+    await db.save('flow_version', flowVersion)
+    const flowRun = createMockFlowRun({
+        projectId: ctx.project.id,
+        flowId: flow.id,
+        flowVersionId: flowVersion.id,
+        status: FlowRunStatus.PAUSED,
+        environment: RunEnvironment.PRODUCTION,
+    })
+    await db.save('flow_run', flowRun)
+    return flowRun
+}
+
+async function insertConsumedBarrier({ flowRunId }: { flowRunId: string }): Promise<void> {
+    const now = dayjs().toISOString()
+    await databaseConnection().getRepository('waitpoint').insert({
+        id: apId(),
+        created: now,
+        updated: now,
+        flowRunId,
+        projectId: ctx.project.id,
+        stepName: 'fan_in',
+        type: PauseType.BARRIER,
+        version: 'V1',
+        status: WaitpointStatus.CONSUMED,
+        resumeDateTime: dayjs().add(30, 'day').toISOString(),
+        responseToSend: null,
+        workerHandlerId: null,
+        httpRequestId: null,
+        resumePayload: null,
+        sealed: true,
+        policy: null,
+    })
+}
+
+async function createPendingDelay({ flowRunId, stepName }: { flowRunId: string, stepName: string }): Promise<{ id: string }> {
+    const { waitpoint } = await waitpointService(app.log).createForPause({
+        flowRunId,
+        projectId: ctx.project.id,
+        stepName,
+        type: PauseType.DELAY,
+        version: 'V1',
+        resumeDateTime: dayjs().add(1, 'hour').toISOString(),
+    })
+    return waitpoint
+}
+
+async function loseScheduledTimers({ waitpointIds }: { waitpointIds: string[] }): Promise<void> {
+    for (const waitpointId of waitpointIds) {
+        const job = await systemJobsSchedule(app.log).getJob(resumeDelayJobId(waitpointId))
+        await job?.remove()
+    }
+    const redis = await redisConnections.useExisting()
+    await redis.del(REFILL_MIGRATION_KEY)
+}
+
+async function timerIsArmed({ waitpointId }: { waitpointId: string }): Promise<boolean> {
+    const job = await systemJobsSchedule(app.log).getJob(resumeDelayJobId(waitpointId))
+    return !isNilJob(job)
+}
+
+function isNilJob(job: unknown): boolean {
+    return job === undefined || job === null
+}
+
+describe('refillPausedRuns', () => {
+    it('re-arms the timer of a run whose only waitpoint is a pending DELAY', async () => {
+        const flowRun = await createPausedRun()
+        const delay = await createPendingDelay({ flowRunId: flowRun.id, stepName: 'delay_step' })
+
+        await loseScheduledTimers({ waitpointIds: [delay.id] })
+        expect(await timerIsArmed({ waitpointId: delay.id })).toBe(false)
+
+        await refillPausedRuns(app.log).run()
+
+        expect(await timerIsArmed({ waitpointId: delay.id })).toBe(true)
+    })
+
+    it('re-arms the timer when a consumed barrier tombstone shares the run', async () => {
+        const flowRun = await createPausedRun()
+        await insertConsumedBarrier({ flowRunId: flowRun.id })
+        const delay = await createPendingDelay({ flowRunId: flowRun.id, stepName: 'delay_step' })
+
+        await loseScheduledTimers({ waitpointIds: [delay.id] })
+        await refillPausedRuns(app.log).run()
+
+        expect(await timerIsArmed({ waitpointId: delay.id })).toBe(true)
+    })
+
+    it('re-arms the timer when the tombstone was written after the delay', async () => {
+        const flowRun = await createPausedRun()
+        const delay = await createPendingDelay({ flowRunId: flowRun.id, stepName: 'delay_step' })
+        await insertConsumedBarrier({ flowRunId: flowRun.id })
+
+        await loseScheduledTimers({ waitpointIds: [delay.id] })
+        expect(await timerIsArmed({ waitpointId: delay.id })).toBe(false)
+
+        await refillPausedRuns(app.log).run()
+
+        expect(await timerIsArmed({ waitpointId: delay.id })).toBe(true)
+    })
+
+    it('re-arms every timer when one run holds several pending delays', async () => {
+        const flowRun = await createPausedRun()
+        const first = await createPendingDelay({ flowRunId: flowRun.id, stepName: 'loop_1:0/delay_step' })
+        const second = await createPendingDelay({ flowRunId: flowRun.id, stepName: 'loop_1:1/delay_step' })
+
+        await loseScheduledTimers({ waitpointIds: [first.id, second.id] })
+        await refillPausedRuns(app.log).run()
+
+        expect(await timerIsArmed({ waitpointId: first.id })).toBe(true)
+        expect(await timerIsArmed({ waitpointId: second.id })).toBe(true)
+    })
+
+    it('leaves a delivered waitpoint alone', async () => {
+        const flowRun = await createPausedRun()
+        const delay = await createPendingDelay({ flowRunId: flowRun.id, stepName: 'delay_step' })
+        await databaseConnection().getRepository('waitpoint').update({ id: delay.id }, { status: WaitpointStatus.COMPLETED })
+
+        await loseScheduledTimers({ waitpointIds: [delay.id] })
+        await refillPausedRuns(app.log).run()
+
+        expect(await timerIsArmed({ waitpointId: delay.id })).toBe(false)
+    })
+
+    it('runs once and then leaves the migration key set', async () => {
+        const flowRun = await createPausedRun()
+        const delay = await createPendingDelay({ flowRunId: flowRun.id, stepName: 'delay_step' })
+
+        await loseScheduledTimers({ waitpointIds: [delay.id] })
+        await refillPausedRuns(app.log).run()
+
+        const redis = await redisConnections.useExisting()
+        expect(await redis.get(REFILL_MIGRATION_KEY)).toBe('true')
+    })
+})
diff --git a/packages/server/api/test/unit/app/workers/job-queue/job-failure-logger.test.ts b/packages/server/api/test/unit/app/workers/job-queue/job-failure-logger.test.ts
new file mode 100644
index 000000000000..bb1b2996d380
--- /dev/null
+++ b/packages/server/api/test/unit/app/workers/job-queue/job-failure-logger.test.ts
@@ -0,0 +1,55 @@
+import { describe, expect, it } from 'vitest'
+import { jobFailureLogger } from '../../../../../src/app/workers/job-queue/job-failure-logger'
+
+describe('jobFailureLogger.signatureOf', () => {
+    it('groups two failures thrown at the same site under the same signature', () => {
+        function throwAtFixedLine(): never {
+            throw new Error('same call site')
+        }
+        let sigA = ''
+        let sigB = ''
+        try { throwAtFixedLine() }
+        catch (e) { sigA = jobFailureLogger.signatureOf(e) }
+        try { throwAtFixedLine() }
+        catch (e) { sigB = jobFailureLogger.signatureOf(e) }
+        expect(sigA).toBe(sigB)
+        expect(sigA).toMatch(/^Error@job-failure-logger\.test\.ts:\d+$/)
+    })
+
+    it('preserves the subclass name for a custom Error', () => {
+        class BoomError extends Error {
+            constructor() {
+                super('boom')
+                this.name = 'BoomError'
+            }
+        }
+        try { throw new BoomError() }
+        catch (e) {
+            expect(jobFailureLogger.signatureOf(e)).toMatch(/^BoomError@/)
+        }
+    })
+
+    it('returns just the typeof for non-Error thrown values', () => {
+        expect(jobFailureLogger.signatureOf('nope')).toBe('string')
+        expect(jobFailureLogger.signatureOf({ a: 1 })).toBe('object')
+        expect(jobFailureLogger.signatureOf(undefined)).toBe('undefined')
+    })
+})
+
+describe('jobFailureLogger.signatureFromMessage', () => {
+    it('groups by the leading token before the first colon', () => {
+        expect(jobFailureLogger.signatureFromMessage('ConnectionNotFoundError: connection abc not found', 'EngineError'))
+            .toBe('EngineError@ConnectionNotFoundError')
+        expect(jobFailureLogger.signatureFromMessage('ConnectionNotFoundError: connection xyz missing', 'EngineError'))
+            .toBe('EngineError@ConnectionNotFoundError')
+    })
+
+    it('uses the first line when no colon is present, truncated to 80 chars', () => {
+        expect(jobFailureLogger.signatureFromMessage('Sandbox process exited with code 137', 'EngineError'))
+            .toBe('EngineError@Sandbox process exited with code 137')
+    })
+
+    it('handles empty message with unknown fallback', () => {
+        expect(jobFailureLogger.signatureFromMessage('', 'EngineError')).toBe('EngineError@unknown')
+    })
+})
diff --git a/packages/server/engine/src/lib/handler/context/step-execution-path.ts b/packages/server/engine/src/lib/handler/context/step-execution-path.ts
index 956e48b90107..6198f05b3963 100644
--- a/packages/server/engine/src/lib/handler/context/step-execution-path.ts
+++ b/packages/server/engine/src/lib/handler/context/step-execution-path.ts
@@ -13,6 +13,10 @@ export class StepExecutionPath {
         return new StepExecutionPath([])
     }
 
+    waitpointKeyFor({ stepName }: { stepName: string }): string {
+        return [...this.path.map(([loopName, iteration]) => `${loopName}:${iteration}`), stepName].join('/')
+    }
+
     removeLast(): StepExecutionPath {
         const newPath = this.path.slice(0, -1)
         return new StepExecutionPath(newPath)
diff --git a/packages/server/engine/src/lib/handler/piece-executor.ts b/packages/server/engine/src/lib/handler/piece-executor.ts
index 45b03d1e0ff7..55693b9f09df 100644
--- a/packages/server/engine/src/lib/handler/piece-executor.ts
+++ b/packages/server/engine/src/lib/handler/piece-executor.ts
@@ -131,7 +131,7 @@ const executeAction: ActionHandler<PieceAction> = async ({ action, executionStat
                 canPause: !constants.actionRunMode,
                 stop: createStopHook(params),
                 respond: createRespondHook(params),
-                createWaitpoint: createWaitpointHook({ constants, stepName: action.name, hookParams: params }),
+                createWaitpoint: createWaitpointHook({ constants, waitpointKey: executionState.currentPath.waitpointKeyFor({ stepName: action.name }), hookParams: params }),
                 waitForWaitpoint: createWaitForWaitpointHook({ constants, hookParams: params }),
             },
             project: {
@@ -258,14 +258,14 @@ type CreateRespondHookParams = {
     hookResponse: HookResponse
 }
 
-function createWaitpointHook({ constants, stepName, hookParams }: { constants: EngineConstants, stepName: string, hookParams: { hookResponse: HookResponse } }): CreateWaitpointHook {
+function createWaitpointHook({ constants, waitpointKey, hookParams }: { constants: EngineConstants, waitpointKey: string, hookParams: { hookResponse: HookResponse } }): CreateWaitpointHook {
     return (req: CreateWaitpointParams): Promise<CreateWaitpointResult> => {
         assertActionRunCannotSuspend(constants)
-        return submitWaitpoint({ constants, stepName, hookParams, req })
+        return submitWaitpoint({ constants, waitpointKey, hookParams, req })
     }
 }
 
-async function submitWaitpoint({ constants, stepName, hookParams, req }: { constants: EngineConstants, stepName: string, hookParams: { hookResponse: HookResponse }, req: CreateWaitpointParams }): Promise<CreateWaitpointResult> {
+async function submitWaitpoint({ constants, waitpointKey, hookParams, req }: { constants: EngineConstants, waitpointKey: string, hookParams: { hookResponse: HookResponse }, req: CreateWaitpointParams }): Promise<CreateWaitpointResult> {
     const resumeDateTime = cappedForTestFlow({ resumeDateTime: req.resumeDateTime, maxTestWaitMs: req.maxTestWaitMs, isTestFlow: constants.isTestFlow })
     assertDelayWithinTimeout(resumeDateTime)
     if (!isNil(req.responseToSend)) {
@@ -276,7 +276,7 @@ async function submitWaitpoint({ constants, stepName, hookParams, req }: { const
         engineToken: constants.engineToken,
         flowRunId: constants.flowRunId,
         projectId: constants.projectId,
-        stepName,
+        stepName: waitpointKey,
         type: req.type,
         version: req.version ?? 'V1',
         resumeDateTime,
diff --git a/packages/server/engine/test/handler/context/step-execution-path.test.ts b/packages/server/engine/test/handler/context/step-execution-path.test.ts
new file mode 100644
index 000000000000..22482dd140d4
--- /dev/null
+++ b/packages/server/engine/test/handler/context/step-execution-path.test.ts
@@ -0,0 +1,22 @@
+import { StepExecutionPath } from '../../../src/lib/handler/context/step-execution-path'
+
+describe('StepExecutionPath#waitpointKeyFor', () => {
+    it('returns the bare step name outside a loop', () => {
+        expect(StepExecutionPath.empty().waitpointKeyFor({ stepName: 'approval' })).toBe('approval')
+    })
+
+    it('qualifies the step name with every enclosing iteration, so each iteration gets its own waitpoint', () => {
+        const path = StepExecutionPath.empty()
+            .loopIteration({ loopName: 'loop_1', iteration: 3 })
+            .loopIteration({ loopName: 'loop_2', iteration: 0 })
+
+        expect(path.waitpointKeyFor({ stepName: 'approval' })).toBe('loop_1:3/loop_2:0/approval')
+    })
+
+    it('gives two iterations of the same loop different keys', () => {
+        const first = StepExecutionPath.empty().loopIteration({ loopName: 'loop_1', iteration: 0 })
+        const second = StepExecutionPath.empty().loopIteration({ loopName: 'loop_1', iteration: 1 })
+
+        expect(first.waitpointKeyFor({ stepName: 'approval' })).not.toBe(second.waitpointKeyFor({ stepName: 'approval' }))
+    })
+})
diff --git a/packages/web/public/locales/en/translation.json b/packages/web/public/locales/en/translation.json
index 8f0499542daa..d3f607d4983c 100644
--- a/packages/web/public/locales/en/translation.json
+++ b/packages/web/public/locales/en/translation.json
@@ -2848,6 +2848,13 @@
   "Responses": "Responses",
   "Chat completions suits most gateways. Pick Responses for endpoints that only serve the newer OpenAI Responses API, such as Amazon Bedrock.": "Chat completions suits most gateways. Pick Responses for endpoints that only serve the newer OpenAI Responses API, such as Amazon Bedrock.",
   "Configurations": "Configurations",
+  "atLeastOne": "Must be at least 1",
+  "atMostTenThousand": "Must be at most 10,000",
+  "wholeNumber": "Must be a whole number",
+  "Limits": "Limits",
+  "Guardrails that apply to every project on this platform.": "Guardrails that apply to every project on this platform.",
+  "Max things one step can wait on": "Max things one step can wait on",
+  "A step that waits on more than this fails when it runs. Every thing waited on costs database rows, so raise it only as far as your database can carry.": "A step that waits on more than this fails when it runs. Every thing waited on costs database rows, so raise it only as far as your database can carry.",
   "Telemetry": "Telemetry",
   "Product analytics": "Product analytics",
   "Shares usage events so we can see which features are used and fix what breaks.": "Shares usage events so we can see which features are used and fix what breaks.",
diff --git a/packages/web/src/app/routes/platform/infra/configurations/index.tsx b/packages/web/src/app/routes/platform/infra/configurations/index.tsx
index fd9322119def..1679d0595596 100644
--- a/packages/web/src/app/routes/platform/infra/configurations/index.tsx
+++ b/packages/web/src/app/routes/platform/infra/configurations/index.tsx
@@ -3,7 +3,7 @@ import {
   ApEdition,
   ApFlagId,
   PlatformConfiguration,
-  UpdatePlatformConfigurationRequestBody,
+  PlatformConfigurationSettings,
 } from '@activepieces/shared';
 import { zodResolver } from '@hookform/resolvers/zod';
 import { useMutation, useQueryClient } from '@tanstack/react-query';
@@ -11,7 +11,6 @@ import { t } from 'i18next';
 import { useForm } from 'react-hook-form';
 import { Navigate } from 'react-router-dom';
 import { toast } from 'sonner';
-import { z } from 'zod';
 
 import { platformConfigurationApi } from '@/api/platform-configuration-api';
 import { CenteredPage } from '@/app/components/centered-page';
@@ -47,14 +46,14 @@ const ConfigurationsContent = ({
 }: ConfigurationsContentProps) => {
   const queryClient = useQueryClient();
 
-  const form = useForm<ConfigurationsFormValues>({
+  const form = useForm<PlatformConfigurationSettings>({
     defaultValues: toFormValues(configuration),
-    resolver: zodResolver(ConfigurationsFormValues),
+    resolver: zodResolver(PlatformConfigurationSettings),
     mode: 'onChange',
   });
 
   const { mutate: saveConfiguration, isPending } = useMutation({
-    mutationFn: (values: ConfigurationsFormValues) =>
+    mutationFn: (values: PlatformConfigurationSettings) =>
       platformConfigurationApi.update(values),
     onSuccess: async (saved) => {
       const productAnalyticsChanged =
@@ -121,16 +120,12 @@ const ConfigurationsSkeleton = () => {
 
 const toFormValues = (
   configuration: PlatformConfiguration,
-): ConfigurationsFormValues => ({
+): PlatformConfigurationSettings => ({
   isProductTelemetryEnabled: configuration.isProductTelemetryEnabled,
   isInfraSetupTelemetryEnabled: configuration.isInfraSetupTelemetryEnabled,
+  maxBarrierSignals: configuration.maxBarrierSignals,
 });
 
-export const ConfigurationsFormValues =
-  UpdatePlatformConfigurationRequestBody.required();
-
-export type ConfigurationsFormValues = z.infer<typeof ConfigurationsFormValues>;
-
 type ConfigurationsContentProps = {
   configuration: PlatformConfiguration;
 };
diff --git a/packages/web/src/app/routes/platform/infra/configurations/limits-section.tsx b/packages/web/src/app/routes/platform/infra/configurations/limits-section.tsx
new file mode 100644
index 000000000000..8d69ee2bae77
--- /dev/null
+++ b/packages/web/src/app/routes/platform/infra/configurations/limits-section.tsx
@@ -0,0 +1,77 @@
+import {
+  maxBarrierSignalsBounds,
+  PlatformConfigurationSettings,
+} from '@activepieces/shared';
+import { t } from 'i18next';
+import { Split } from 'lucide-react';
+import { Control } from 'react-hook-form';
+
+import { FormField, FormItem, FormMessage } from '@/components/ui/form';
+import { Input } from '@/components/ui/input';
+import {
+  Item,
+  ItemMedia,
+  ItemContent,
+  ItemTitle,
+  ItemDescription,
+  ItemActions,
+} from '@/components/ui/item';
+
+export const LimitsSection = ({ control, disabled }: LimitsSectionProps) => {
+  return (
+    <div className="flex flex-col gap-3">
+      <div className="flex flex-col gap-1">
+        <h2 className="text-base font-semibold">{t('Limits')}</h2>
+        <p className="text-sm text-muted-foreground">
+          {t('Guardrails that apply to every project on this platform.')}
+        </p>
+      </div>
+      <FormField
+        control={control}
+        name="maxBarrierSignals"
+        render={({ field }) => (
+          <FormItem>
+            <Item variant="outline">
+              <ItemMedia variant="icon">
+                <Split />
+              </ItemMedia>
+              <ItemContent>
+                <ItemTitle>{t('Max things one step can wait on')}</ItemTitle>
+                <ItemDescription className="line-clamp-none">
+                  {t(
+                    'A step that waits on more than this fails when it runs. Every thing waited on costs database rows, so raise it only as far as your database can carry.',
+                  )}
+                </ItemDescription>
+              </ItemContent>
+              <ItemActions>
+                <Input
+                  {...field}
+                  id="maxBarrierSignals"
+                  type="number"
+                  min={maxBarrierSignalsBounds.min}
+                  max={maxBarrierSignalsBounds.max}
+                  className="w-28"
+                  value={field.value ?? ''}
+                  onChange={(e) =>
+                    field.onChange(
+                      e.target.value === ''
+                        ? undefined
+                        : Number(e.target.value),
+                    )
+                  }
+                  disabled={disabled}
+                />
+              </ItemActions>
+            </Item>
+            <FormMessage />
+          </FormItem>
+        )}
+      />
+    </div>
+  );
+};
+
+type LimitsSectionProps = {
+  control: Control<PlatformConfigurationSettings>;
+  disabled: boolean;
+};
diff --git a/packages/web/src/app/routes/platform/infra/configurations/telemetry-section.tsx b/packages/web/src/app/routes/platform/infra/configurations/telemetry-section.tsx
index e45348d47052..b70e2ef06022 100644
--- a/packages/web/src/app/routes/platform/infra/configurations/telemetry-section.tsx
+++ b/packages/web/src/app/routes/platform/infra/configurations/telemetry-section.tsx
@@ -1,3 +1,4 @@
+import { PlatformConfigurationSettings } from '@activepieces/shared';
 import { t } from 'i18next';
 import { Activity, Server } from 'lucide-react';
 import { Control } from 'react-hook-form';
@@ -15,8 +16,6 @@ import { Switch } from '@/components/ui/switch';
 
 import { TrackedEventsDialog } from './tracked-events-dialog';
 
-import type { ConfigurationsFormValues } from './index';
-
 export const TelemetrySection = ({
   control,
   disabled,
@@ -95,6 +94,6 @@ export const TelemetrySection = ({
 };
 
 type TelemetrySectionProps = {
-  control: Control<ConfigurationsFormValues>;
+  control: Control<PlatformConfigurationSettings>;
   disabled: boolean;
 };
diff --git a/packages/web/test/app/routes/platform/infra/configurations/index.test.ts b/packages/web/test/app/routes/platform/infra/configurations/index.test.ts
new file mode 100644
index 000000000000..e6693f7be9b9
--- /dev/null
+++ b/packages/web/test/app/routes/platform/infra/configurations/index.test.ts
@@ -0,0 +1,54 @@
+import { readFileSync } from 'fs';
+import path from 'path';
+
+import { PlatformConfigurationSettings } from '@activepieces/shared';
+import { describe, expect, it } from 'vitest';
+
+const translations: Record<string, string> = JSON.parse(
+  readFileSync(
+    path.resolve(
+      __dirname,
+      '../../../../../../public/locales/en/translation.json',
+    ),
+    'utf-8',
+  ),
+);
+
+const messageFor = (maxBarrierSignals: unknown): string => {
+  const result = PlatformConfigurationSettings.safeParse({
+    isProductTelemetryEnabled: true,
+    isInfraSetupTelemetryEnabled: true,
+    maxBarrierSignals,
+  });
+  expect(result.success).toBe(false);
+  return result.error!.issues[0].message;
+};
+
+describe('configurations form schema', () => {
+  it.each([
+    ['an empty field', undefined, 'Required'],
+    ['a fractional cap', 1.5, 'Must be a whole number'],
+    ['a non-numeric cap', 'abc', 'Must be a whole number'],
+    ['a cap below the floor', 0, 'Must be at least 1'],
+    ['a cap above the ceiling', 10_001, 'Must be at most 10,000'],
+  ])(
+    'renders readable English for %s instead of a raw zod message',
+    (_case, input, expected) => {
+      const message = messageFor(input);
+
+      expect(translations[message]).toBe(expected);
+    },
+  );
+
+  it('accepts a cap sitting on each bound', () => {
+    for (const maxBarrierSignals of [1, 10_000]) {
+      expect(
+        PlatformConfigurationSettings.safeParse({
+          isProductTelemetryEnabled: true,
+          isInfraSetupTelemetryEnabled: true,
+          maxBarrierSignals,
+        }).success,
+      ).toBe(true);
+    }
+  });
+});