diff --git a/.github/copilot-instructions.md b/.github/copilot-instructions.md
index c836c8d..5b9a53e 100644
--- a/.github/copilot-instructions.md
+++ b/.github/copilot-instructions.md
@@ -41,7 +41,7 @@ flowview/                               # Repository root (install to plugins/fl
 ├── flowview_schedules.php              # Scheduled report administration
 ├── flowview_process.php                # CLI: parallel query execution / report runner
 ├── flowview_cleanup.php                # CLI: data retention cleanup
-├── flowview_upgrade.php                # Background schema upgrade runner
+├── cli/flowview_upgrade.php            # Background schema upgrade runner
 ├── flow_collector.php                  # NetFlow v5/v9/v10 collector daemon
 ├── functions.php / functions-pre13.php # Core UI + protocol decode helpers
 ├── import_flows.php                    # CLI flow file importer
@@ -104,7 +104,7 @@ context (e.g. arithmetic, strict `===` type comparisons).
 Use `flowview_setup_table()`/`flowview_drop_table()` helpers in `setup.php` rather than ad hoc `CREATE TABLE`/`DROP TABLE` calls scattered across pages.
 
 ### Upgrade Handling
-Schema upgrades run in the **background** via `flowview_upgrade.php` (spawned with `exec_background()` from `plugin_flowview_check_upgrade()`), since flow tables can be very large:
+Schema upgrades run in the **background** via `cli/flowview_upgrade.php` (spawned with `exec_background()` from `plugin_flowview_check_upgrade()`), since flow tables can be very large:
 
 ```php
 function plugin_flowview_check_upgrade($force = false) {
@@ -116,7 +116,7 @@ function plugin_flowview_check_upgrade($force = false) {
 
 	if ($current != $old || $force) {
 		$php_binary = read_config_option('path_php_binary');
-		exec_background($php_binary, '-q ' . $config['base_path'] . '/plugins/flowview/flowview_upgrade.php');
+		exec_background($php_binary, '-q ' . $config['base_path'] . '/plugins/flowview/cli/flowview_upgrade.php');
 		raise_message('flowview_upgrade', __('Please be advised the Flowview plugins Tables are being upgraded in the background...', 'flowview'), MESSAGE_LEVEL_INFO);
 	}
 }
diff --git a/CHANGELOG.md b/CHANGELOG.md
index fde7b01..6824563 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,9 @@
 
 --- develop ---
 
+* feature: Add Cisco Apps (NBAR) reports for application-bearing NetFlow v9 exports, with IPv4/IPv6 application totals, conversations, paged connections, per-account capture/network options, recent-record status, first/last observation dates and a router setup guide
+* feature: Maintain reusable per-capture NBAR hourly/daily summaries through the existing Cacti poller, with raw partial-boundary fallback and a separate retention setting capped at 30 days
+* feature: Store raw NBAR records in time-sliced tables (plugin_flowview_nbar_data_<year><day>[<hour>]) that follow the Database Partitioning Scheme setting, and expire them by dropping whole slices
 * fix: Make bundled Net_DNS2 constructor nullability explicit for PHP 8.4 without changing accepted arguments
 
 * issue: Shorten the graph drilldown button title from 'View NetFlow Traffic In Range' to 'NetFlow' so it reads cleanly as a label in Cacti's graph action menu
diff --git a/README.md b/README.md
index 8de558c..7c06b45 100644
--- a/README.md
+++ b/README.md
@@ -209,5 +209,91 @@ an issue.
 Got any ideas or complaints, please see the Cacti forums or GitHub for a
 resolution.
 
+
+## Cisco Apps (NBAR)
+
+Cisco Apps is a separate application report within FlowView. The current NBAR
+integration reads application IDs and names from NetFlow v9 data and options
+templates, including IPv4 and IPv6 records. IPFIX application decoding is not
+implemented by this integration. Existing FlowView reports retain their normal
+collector and report paths.
+
+Configure a FlowView listener for each export stream and configure the router to
+export application-bearing records to it. The report's Setup guide contains a
+Cisco 1100 Series example with placeholders for the collector, UDP port and router
+interfaces. Check Cisco documentation for the exact platform and IOS XE release.
+Creating a listener alone does not enable NBAR on the router.
+
+The report offers Top applications, Conversations and Connections. Filter by IP
+matches either endpoint. Conversations requires the account's Internal Networks
+settings to identify hosts and upload/download direction. Combine Options accepts
+two or three captures; leave them all unselected to save networks without combining.
+Choose one observation point per traffic path: overlapping LAN/WAN captures add
+both copies and can overcount traffic.
+
+STATUS describes recent retained application records for each selected capture,
+independently of historical report filters. A quiet capture can show no recent
+NBAR despite a working exporter. It is not a connectivity test.
+
+First seen and Last seen are the earliest/latest retained observation minutes in
+the selected period. They do not prove continuous activity, or give exact connection
+start/end times. Missing dates are shown as Unavailable. Average bandwidth divides
+data volume by the full selected period. Column sorting applies to the displayed
+page; resizing is saved in that browser.
+
+NBAR History Retention is separate from the existing FlowView Data Retention Policy.
+It offers 1, 3, 7, 14 or 30 days, with a seven-day default. Timespan choices and custom
+ranges respect this setting. The existing Cacti poller maintains summaries and
+performs bounded cleanup; no extra scheduled task is required. A shorter retention
+setting cannot be undone to recover deleted history. If polling stops, maintenance
+and cleanup stop too. Shared maintenance locks are scoped to the FlowView database.
+
+## Cisco Apps (NBAR) historical Connections
+
+Connections reads the automatically maintained daily history for each selected capture.
+Opening a report or changing its IP filter does not queue a new complete connection build.
+The normal FlowView poller maintains this history; no additional cron job is required.
+
+Pages contain up to 100 connections, ordered by total data volume across the selected
+captures and period. Indexed candidates are checked against every selected daily segment
+so byte, packet and record totals remain exact. Partial days use hourly or raw data.
+Previous, Next and a numeric page field provide navigation without a large dropdown or
+an expensive full-result count. Very deep pages or broadly tied results can still require
+more work; a shorter period or IP filter reduces that work.
+
+A small account-scoped session cache holds nearby pages for 120 seconds for past periods
+and 30 seconds for periods including current data. This is separate from retained history.
+The existing authenticated FlowView realm controls access; capture selections and filters are included in cache keys.
+
+## Reusable NBAR daily summaries
+
+Top Applications, Conversations and Connections share daily summaries built automatically
+per capture, independently of report filters and Cacti accounts. Calendar days run from
+local midnight to the following midnight in the Cacti server timezone, including daylight
+saving changes. Completed hours are added to today's summary in bounded transactions.
+Completed days are reused; late exports invalidate affected summaries and trigger a rebuild.
+Partial days and unpublished or changed intervals fall back to hourly summaries or raw records.
+IP, application and IP-version filters are applied to the preserved summary fields.
+
+Daily history follows Cisco Apps (NBAR) History Retention, currently selectable up to
+30 days. Retention is a rolling data window, not a new retention period beginning each time
+a report is opened. Daily summaries are shared source data and are reused for different
+periods, filters and users, subject to listener permissions. Connections reads pages from
+this history rather than preparing another full copy for every selection.
+
 -----------------------------------------------
 Copyright (c) 2004-2026 - The Cacti Group, Inc.
+
+NBAR daily summary materialization and observation-date backfill require MariaDB statement deadlines. On MySQL 8, these workers safely defer their DML rather than running without a bound; reports continue through hourly/raw sources. Exact counts use the MySQL SELECT execution-time hint.
+
+New NBAR records retain the actual exporter address through hourly and daily summaries. Legacy rows keep their counters with an unknown exporter; an exact single-address listener may still resolve their names, but earlier multi-exporter rows cannot be attributed retrospectively.
+
+NBAR maintenance is launched independently of the poller. A registered supervisor runs the PHP maintenance child with a 90-second process deadline. MariaDB hourly mutations also set and restore a verified 20-second statement deadline. MySQL hourly builds remain available only inside the supervised child; raw records remain the fallback until a checkpoint is published.
+
+NBAR timespan requests keep their session state separate from Flow Reports. Conversation totals exclude IPv4 and IPv6 multicast endpoints, and feed lookup failures are shown separately from empty captures. Retention maintenance drains additional batches across raw, hourly and daily tables within a shared ten-second cleanup budget, under the supervised worker deadline.
+
+Template decoding rejects zero-length fields and invalidates the affected cached template until a valid refresh arrives. Chart fallback labels are grouped by their complete expression, so applications without learned names keep separate slices.
+
+The NBAR template cache retains at most 256 templates / 8,192 field definitions in total and 64 templates / 2,048 fields per exporter, across all source IDs. Least recently used entries are evicted and inactive templates expire after 30 minutes (removed lazily on packet activity). Evicted templates are learned again from the next exporter refresh. Numeric data fields must fit unsigned 64-bit values; options scope fields are decoded separately and are not treated as counters.
+
+NBAR maintenance supervision uses PHP's direct argv-array process API rather than Cacti's version-dependent timeout command interface, so startup and hard child termination work on the minimum supported Cacti 1.2.29 and newer releases. Both output pipes are drained in bounded chunks.
diff --git a/flowview_upgrade.php b/cli/flowview_upgrade.php
similarity index 94%
rename from flowview_upgrade.php
rename to cli/flowview_upgrade.php
index a0e8224..0c452e8 100644
--- a/flowview_upgrade.php
+++ b/cli/flowview_upgrade.php
@@ -23,11 +23,13 @@
  +-------------------------------------------------------------------------+
 */
 
-chdir('../../');
+chdir(__DIR__ . '/../../../');
 require('./include/cli_check.php');
+require_once('./lib/poller.php');
 require_once('./plugins/flowview/includes/functions.php');
 require_once('./plugins/flowview/setup.php');
 require_once('./plugins/flowview/includes/database.php');
+require_once('./plugins/flowview/includes/nbar_common.php');
 
 flowview_connect();
 
@@ -38,6 +40,7 @@
 array_shift($parms);
 
 $forcever    = '';
+$nbar_worker = '';
 
 if (cacti_sizeof($parms)) {
 	foreach($parms as $parameter) {
@@ -49,6 +52,13 @@
 		}
 
 		switch ($arg) {
+			case '--nbar-worker':
+				if (!in_array($value, ['supervise', 'build'], true)) {
+					exit(1);
+				}
+				$nbar_worker = $value;
+
+				break;
 			case '--forcever':
 				$forcever = $value;
 				break;
@@ -71,6 +81,17 @@
 }
 
 
+// Internal maintenance modes never enter the schema-upgrade path.
+if ($nbar_worker !== '') {
+	if ($nbar_worker === 'supervise') {
+		fv_nbar_supervise_maintenance();
+	} elseif ((int) read_config_option('flowview_nbar_schema_version') >= 2) {
+		fv_nbar_cleanup();
+		fv_nbar_summary_refresh(20, true);
+	}
+	exit(0);
+}
+
 /* we need to rerun the upgrade, force the current version */
 if ($forcever == '') {
 	$old_version = db_fetch_cell('SELECT version FROM plugin_config WHERE directory = "flowview"');
@@ -82,24 +103,37 @@
 $current_version = $info['version'];
 
 /* do a version check */
-if ($forcever == '' && $old_version == $current_version) {
+if ($forcever == '' && $old_version == $current_version && (int) read_config_option('flowview_nbar_schema_version') >= 2) {
 	cacti_log('Your Flowview is already up to date (v' . $current_version . ' vs v' . $old_version . ') not upgrading.  Use --forcever to override', true, 'FLOWVIEW');
+
+	unregister_process('flowview', 'upgrade_launch', 0);
+
 	exit(0);
 }
 
-if (!register_process_start('flowview', 'upgrade', 1, 86400)) {
+if (!register_process_start('flowview', 'upgrade', 1, 14400)) {
 	if (empty($forcever)) {
 		print 'WARNING: Running process detected.  To override use --forcever' . PHP_EOL;
 		exit(1);
 	}
 }
 
+// The launcher row holds the web worker's PID.  Hand it to this process so a timeout recovery can only
+// ever signal this upgrade, never a PHP-FPM worker that has since been reused for another request.
+if (db_table_exists('processes')) {
+	db_execute_prepared('UPDATE processes SET pid = ? WHERE tasktype = ? AND taskname = ? AND taskid = ?', [getmypid(), 'flowview', 'upgrade_launch', 0]);
+}
+
+// release this run and the web launcher's lock however the script ends, including a fatal error
+register_shutdown_function(static function (): void {
+	unregister_process('flowview', 'upgrade', 1);
+	unregister_process('flowview', 'upgrade_launch', 0);
+});
+
 cacti_log('Upgrading from v' . $old_version . ' to ' . $current_version, true, 'FLOWVIEW');
 
 flowview_upgrade($current_version, $old_version);
 
-unregister_process('flowview', 'upgrade', 1);
-
 exit(0);
 
 /**
@@ -119,6 +153,11 @@
  * @return void
  */
 function flowview_upgrade($current, $old): void {
+	if (!flowview_db_create_nbar_tables()) {
+		throw new RuntimeException('Unable to upgrade NBAR history schema');
+	}
+	set_config_option('flowview_nbar_schema_version', '2');
+
 	global $config, $info;
 
 	if ($current != $old) {
diff --git a/css/nbar.css b/css/nbar.css
new file mode 100644
index 0000000..16a12df
--- /dev/null
+++ b/css/nbar.css
@@ -0,0 +1,288 @@
+/* Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later. */
+#nbarTable th .ui-resizable-handle,
+#nbarConversationTable th .ui-resizable-handle {
+	display: none !important;
+	pointer-events: none !important;
+}
+.flowview-nbar-table-wrap {
+	position: relative;
+	width: 100%;
+	max-width: 100%;
+	min-width: 0;
+	/* Saved column widths must scroll here instead of widening the report bar. */
+	contain: inline-size;
+	overflow-x: auto;
+	display: block;
+}
+.flowview-nbar-resize {
+	display: block !important;
+	z-index: 10;
+}
+.flowview-nbar-resize .tablesorter-resizable-handle {
+	width: 12px !important;
+	pointer-events: auto;
+}
+.flowview-nbar-resize .tablesorter-resizable-handle:before {
+	content: '';
+	position: absolute;
+	top: 6px;
+	left: 4px;
+	height: 14px;
+	border-left: 1px solid currentColor;
+	border-right: 1px solid currentColor;
+	width: 2px;
+	opacity: 0.35;
+}
+.flowview-nbar-resize .tablesorter-resizable-handle:hover {
+	background: rgba(127, 127, 127, 0.25);
+}
+.nbarSettingsRow {
+	display: flex;
+	flex-wrap: wrap;
+	align-items: flex-start;
+	gap: 8px 12px;
+	padding: 4px;
+}
+.nbarSetting {
+	display: flex;
+	align-items: center;
+	gap: 6px;
+}
+.nbarSettingsRow > details {
+	max-width: 100%;
+	min-width: 0;
+}
+.nbarSettingsRow > details > div {
+	width: 400px;
+	max-width: 100%;
+	box-sizing: border-box;
+	white-space: normal;
+	overflow-wrap: anywhere;
+}
+.nbarSettingsRow textarea {
+	width: 100%;
+	max-width: 100%;
+	box-sizing: border-box;
+}
+.nbarSettingsRow summary {
+	cursor: pointer;
+}
+.nbarChart {
+	max-width: 100%;
+}
+.nbarReportBar {
+	display: flex;
+	flex-wrap: wrap;
+	align-items: flex-start;
+	gap: 12px;
+}
+.nbarReportBar > form {
+	flex: 1 1 660px;
+	min-width: 0;
+	margin: 0;
+}
+.nbarChart {
+	flex: 0 1 340px;
+	padding: 4px 12px;
+	box-sizing: border-box;
+	margin-right: 40px;
+}
+.nbarChartBody {
+	display: flex;
+	align-items: center;
+	gap: 14px;
+	margin-top: 6px;
+}
+.nbarChartPie {
+	width: 112px;
+	height: 112px;
+	border-radius: 50%;
+	flex-shrink: 0;
+}
+.nbarChart ul {
+	list-style: none;
+	margin: 0;
+	padding: 0;
+	flex: 1;
+	min-width: 0;
+}
+.nbarChart li {
+	display: flex;
+	align-items: center;
+	gap: 6px;
+	padding: 0;
+	line-height: 1.35;
+	white-space: nowrap;
+}
+.nbarChartKey {
+	width: 9px;
+	height: 9px;
+	flex-shrink: 0;
+}
+.nbarChartName {
+	flex: 1;
+	overflow: hidden;
+	text-overflow: ellipsis;
+}
+@media (max-width: 1100px) {
+	.nbarChart {
+		flex-basis: 100%;
+		padding-left: 4px;
+		margin-right: 0;
+	}
+	.nbarChartBody {
+		max-width: 340px;
+	}
+}
+#nbarTable,
+#nbarConversationTable {
+	table-layout: auto;
+	width: 100%;
+}
+#nbarTable th,
+#nbarTable td,
+#nbarConversationTable th,
+#nbarConversationTable td {
+	white-space: normal !important;
+	overflow-wrap: anywhere;
+}
+#nbarTable th .textSubHeaderDark,
+#nbarConversationTable th .textSubHeaderDark {
+	white-space: normal !important;
+}
+/* Observation dates must never wrap one character per line in a narrow column. */
+#nbarTable th:nth-last-child(-n + 2),
+#nbarTable td:nth-last-child(-n + 2),
+#nbarConversationTable th:nth-last-child(-n + 2),
+#nbarConversationTable td:nth-last-child(-n + 2) {
+	min-width: 136px;
+	white-space: nowrap !important;
+	overflow-wrap: normal;
+}
+#nbarTable th:nth-last-child(-n + 2) .textSubHeaderDark,
+#nbarConversationTable th:nth-last-child(-n + 2) .textSubHeaderDark {
+	white-space: nowrap !important;
+}
+#nbarCombineDialog {
+	width: min(640px, 90vw);
+	max-height: 85vh;
+	padding: 0;
+	position: fixed;
+	margin: auto;
+	box-sizing: border-box;
+	overflow: hidden;
+	font-weight: normal;
+}
+#nbarCombineDialog::backdrop {
+	background: rgba(0, 0, 0, 0.4);
+}
+#nbarCombineDialog .nbarCombineHeader {
+	display: flex;
+	justify-content: space-between;
+	align-items: center;
+	gap: 16px;
+	padding: 12px 16px;
+}
+#nbarCombineDialog .nbarCombineBody {
+	padding: 16px;
+	max-height: calc(85vh - 75px);
+	overflow: auto;
+	box-sizing: border-box;
+	font-weight: normal;
+	line-height: 1.45;
+}
+#nbarCombineDialog textarea {
+	width: 100%;
+	box-sizing: border-box;
+	max-width: 100%;
+}
+#nbarCombineDialog h3 {
+	margin: 0 0 8px;
+}
+#nbarCombineDialog p,
+#nbarCombineDialog small {
+	font-weight: normal;
+	font-size: inherit;
+}
+#nbarSetupGuide {
+	width: min(900px, 90vw);
+	max-width: 90vw;
+	max-height: 85vh;
+	padding: 0;
+	position: fixed;
+	margin: auto;
+	box-sizing: border-box;
+	overflow: hidden;
+	font-weight: normal;
+}
+#nbarSetupGuide::backdrop {
+	background: rgba(0, 0, 0, 0.4);
+}
+#nbarSetupGuide .nbarGuideHeader {
+	display: flex;
+	justify-content: space-between;
+	align-items: center;
+	gap: 16px;
+	padding: 12px 16px;
+	box-sizing: border-box;
+}
+#nbarSetupGuide .nbarGuideBody {
+	padding: 16px;
+	max-height: calc(85vh - 75px);
+	overflow-y: auto;
+	overflow-x: hidden;
+	box-sizing: border-box;
+	min-width: 0;
+	font-weight: normal;
+	line-height: 1.45;
+}
+#nbarSetupGuide .nbarGuideBody p,
+#nbarSetupGuide .nbarGuideBody small {
+	font-weight: normal;
+}
+#nbarSetupGuide h3 {
+	font-size: 1.15em;
+	margin: 0 0 0.8em;
+	font-weight: bold;
+}
+#nbarSetupGuide h3:not(:first-child) {
+	margin-top: 1.3em;
+}
+#nbarSetupGuide p {
+	margin: 0 0 1em;
+	overflow-wrap: anywhere;
+}
+#nbarSetupGuide pre {
+	padding: 12px;
+	width: 100%;
+	max-width: 100%;
+	box-sizing: border-box;
+	overflow: auto;
+	white-space: pre;
+	font-weight: normal;
+	font-family: monospace;
+	line-height: 1.3;
+}
+#nbarSetupGuide .nbarGuideHeader button {
+	flex-shrink: 0;
+}
+#fv_section_tabs {
+	padding-bottom: 0;
+}
+#fv_section_tabs + table {
+	margin-top: 0;
+}
+#fv_section_tabs a[aria-current='page'] {
+	font-weight: bold;
+	text-decoration: none;
+}
+#fv_section_tabs a:focus-visible {
+	outline: 2px solid currentColor;
+	outline-offset: 2px;
+}
+
+/* Use the theme foreground while retaining the surrounding report text size. */
+.nbarReportText {
+	font-size: inherit;
+	font-weight: normal;
+}
diff --git a/flow_collector.php b/flow_collector.php
index 0759e8a..13c0b9f 100644
--- a/flow_collector.php
+++ b/flow_collector.php
@@ -43,6 +43,7 @@
 require_once($config['base_path'] . '/lib/poller.php');
 require_once($config['base_path'] . '/plugins/flowview/setup.php');
 require_once($config['base_path'] . '/plugins/flowview/includes/functions.php');
+require_once($config['base_path'] . '/plugins/flowview/includes/nbar_collector.php');
 chdir(__DIR__);
 
 ini_set('max_execution_time', '-1');
@@ -1275,6 +1276,7 @@ function process_fv9($p, $ex_addr): void {
 	global $templates, $tlengths, $allfields, $pacmap, $listener_id;
 
 	flowview_connect();
+	fv_nbar_packet($p, $ex_addr);
 
 	if (!isset($templates[$ex_addr])) {
 		$templates[$ex_addr] = [];
@@ -1422,6 +1424,10 @@ function process_fv9($p, $ex_addr): void {
 
 						$field = substr($p, $h, $t['length']);
 
+						// Decode Cisco reduced-length three-byte unsigned integers.
+						if ($t['unpack'] === 'N' && $t['length'] == 3 && strlen($field) == 3) {
+							$field = chr(0) . $field;
+						}
 						$field = unpack($t['unpack'], $field) ?: [];
 
 						if ($t['pack'] == 'ipv4Address') {
@@ -1729,6 +1735,11 @@ function process_fv10($p, $ex_addr): void {
 						$id    = $t['field_id'];
 
 						$field = substr($p, $h, $t['length']);
+
+						// Decode Cisco reduced-length three-byte unsigned integers.
+						if ($t['unpack'] === 'N' && $t['length'] == 3 && strlen($field) == 3) {
+							$field = chr(0) . $field;
+						}
 						$field = unpack($t['unpack'], $field) ?: [];
 
 						if ($t['pack'] == 'ipv4Address') {
diff --git a/flowview.php b/flowview.php
index 0a2a903..5320876 100644
--- a/flowview.php
+++ b/flowview.php
@@ -31,10 +31,25 @@
 global $config;
 require_once($config['base_path'] . '/plugins/flowview/setup.php');
 require_once($config['base_path'] . '/plugins/flowview/includes/functions.php');
+require_once($config['base_path'] . '/plugins/flowview/includes/nbar_common.php');
+require_once($config['base_path'] . '/plugins/flowview/includes/nbar_count.php');
+require_once($config['base_path'] . '/plugins/flowview/includes/nbar_timespan.php');
+require_once($config['base_path'] . '/plugins/flowview/flowview_sections.php');
 require_once($config['base_path'] . '/lib/time.php');
 
 flowview_connect();
 
+if (get_nfilter_request_var('action') === 'nbar_count') {
+	fv_nbar_count_request();
+}
+
+if (get_nfilter_request_var('action') === 'applications' ||
+	(get_nfilter_request_var('action') === 'view' && get_nfilter_request_var('report') === 'nbar')) {
+	general_header();
+	include($config['base_path'] . '/plugins/flowview/nbar_report.php');
+	exit;
+}
+
 set_default_action();
 
 ini_set('max_execution_time', 240);
@@ -78,6 +93,10 @@
 
 		break;
 	case 'gettimespan':
+		if (fv_nbar_timespan_request()) {
+			break;
+		}
+
 		flowview_request_vars();
 		flowview_gettimespan();
 
@@ -88,6 +107,8 @@
 	default:
 		general_header();
 
+		fv_section_save('flows', fv_section_request_params());
+		fv_section_navigation('flows');
 		flowview_request_vars();
 
 		$title = load_session_for_filter();
@@ -153,7 +174,7 @@ function save_filter_as(): void {
 			WHERE id = ?',
 			array(get_request_var('query')));
 
-		if (cacti_sizeof($save)) {
+		if (is_array($save) && cacti_sizeof($save)) {
 			$save['name'] = get_request_var('sname');
 
 			if (isset_request_var('report')) {
diff --git a/flowview_devices.php b/flowview_devices.php
index bf52069..6e2a0c9 100644
--- a/flowview_devices.php
+++ b/flowview_devices.php
@@ -184,7 +184,7 @@ function export_template(): void {
 
 		exit;
 	} else {
-		raise_message_javascript('notemplate', __('No Flow Template was found for Device ID:%s and Template ID:%s', $device_id, $template_id, 'flowview'), MESSAGE_LEVEL_ERROR);
+		raise_message_javascript('notemplate', __('No Flow Template was found for Device ID:%s and Template ID:%s', $device_id, $template_id, 'flowview'), '', MESSAGE_LEVEL_ERROR);
 
 		exit;
 	}
diff --git a/flowview_schedules.php b/flowview_schedules.php
index 77b3ea7..996657f 100644
--- a/flowview_schedules.php
+++ b/flowview_schedules.php
@@ -364,7 +364,7 @@ function view_log_data(): void {
 
 	$log_data = db_fetch_row_prepared('SELECT * FROM reports_log WHERE id = ?', [$id]);
 
-	if (cacti_sizeof($log_data)) {
+	if (is_array($log_data) && cacti_sizeof($log_data)) {
 		$data    = json_decode($log_data['report_raw_data'], true);
 		$columns = array_keys($data[0]);
 
@@ -390,7 +390,7 @@ function download_log_data(): void {
 
 	$log_data = db_fetch_row_prepared('SELECT * FROM reports_log WHERE id = ?', [$id]);
 
-	if (cacti_sizeof($log_data)) {
+	if (is_array($log_data) && cacti_sizeof($log_data)) {
 		$data    = json_decode($log_data['report_raw_data'], true);
 		$columns = array_keys($data[0]);
 
diff --git a/flowview_sections.php b/flowview_sections.php
new file mode 100644
index 0000000..7f05718
--- /dev/null
+++ b/flowview_sections.php
@@ -0,0 +1,155 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Read scalar report-navigation fields through Cacti request helpers.
+ *
+ * @return array
+ */
+function fv_section_request_params(): array {
+	$params = [];
+
+	foreach (['action', 'section', 'report', 'query', 'device_id', 'listener', 'mode', 'family', 'predefined_timespan', 'period', 'date1', 'date2', 'context', 'sortfield', 'cutofflines', 'cutoffoctets', 'exclude', 'ex_addr', 'graph_type', 'graph_height', 'domains', 'headercontent'] as $key) {
+		$value = get_nfilter_request_var($key, null);
+
+		if (is_scalar($value)) {
+			$params[$key] = $value;
+		}
+	}
+
+	return $params;
+}
+/**
+ * Restore a report section with a fresh half-hour time window.
+ *
+ * @param string $section Report section identifier.
+ *
+ * @return array
+ */
+function fv_section_params(string $section): array {
+	$p = json_decode((string) read_user_setting('flowview_section_' . $section, '', true), true);
+
+	if (!is_array($p)) {
+		$p = [];
+	}
+	$keys = ['report', 'query', 'device_id', 'listener', 'mode', 'family', 'predefined_timespan', 'period', 'date1', 'date2', 'context', 'sortfield', 'cutofflines', 'cutoffoctets', 'exclude', 'ex_addr', 'graph_type', 'graph_height', 'domains'];
+	$p    = array_intersect_key($p, array_flip($keys));
+
+	foreach ($p as $k => $v) {
+		if (!is_scalar($v)) {
+			unset($p[$k]);
+		}
+	}
+	$p['predefined_timespan'] = 1; // Re-enter reports with a fresh half-hour window.
+
+	unset($p['date1'],$p['date2']);
+	$c = json_decode($p['context'] ?? '', true);
+
+	if (is_array($c)) {
+		unset($c['date1'],$c['date2']);
+		$p['context'] = json_encode($c);
+	}
+	$p['action']  = 'view';
+	$p['section'] = $section;
+
+	if ($section === 'nbar') {
+		$p['report'] = 'nbar';
+	} elseif (($p['report'] ?? '') === 'nbar') {
+		unset($p['report']);
+	}
+
+	return $p;
+}
+/**
+ * Build a local URL restoring one report section.
+ *
+ * @param string $section Report section identifier.
+ *
+ * @return string
+ */
+function fv_section_url(string $section): string {
+	return 'flowview.php?' . http_build_query(fv_section_params($section));
+}
+/**
+ * Persist account-specific section navigation without drilldown addresses.
+ *
+ * @param string $section Report section identifier.
+ * @param array  $params  Scalar navigation fields.
+ *
+ * @return void
+ */
+function fv_section_save(string $section, array $params): void {
+	unset($params['app'],$params['internal'],$params['external'],$params['section']);
+	$value = json_encode($params);
+
+	if (read_user_setting('flowview_last_section', '', true) !== $section) {
+		set_user_setting('flowview_last_section', $section);
+	}
+
+	if (read_user_setting('flowview_section_' . $section, '', true) !== $value) {
+		set_user_setting('flowview_section_' . $section, $value);
+	}
+}
+/**
+ * Render theme-aware navigation between Flow Reports and Cisco Apps.
+ *
+ * @param string $selected Currently selected report section.
+ *
+ * @return void
+ */
+function fv_section_navigation(string $selected): void {
+	global $config;
+	print '<link rel="stylesheet" href="' . plugin_flowview_escape_attr($config['url_path'] . 'plugins/flowview/css/nbar.css') . '">';
+	print '<nav id="fv_section_tabs" class="tabs" aria-label="' . plugin_flowview_escape_attr(__('FlowView sections', 'flowview')) . '" style="display:flex;flex-wrap:wrap;gap:6px;margin:8px 0 0;border:0;background:none"><ul style="display:flex;flex-wrap:wrap;gap:6px;list-style:none;margin:0;padding:0;border:0">';
+
+	foreach (['flows' => __('Flow Reports', 'flowview'), 'nbar' => __('Cisco Apps (NBAR)', 'flowview')] as $key => $label) {
+		print '<li><a class="' . ($key === $selected ? 'selected' : '') . '"' . ($key === $selected ? ' aria-current="page"' : '') . ' href="' . htmlspecialchars(fv_section_url($key), ENT_QUOTES, 'UTF-8') . '">' . html_escape($label) . '</a></li>';
+	}
+	print '</ul></nav>';
+}
+$section_entry = array_diff_key(fv_section_request_params(), array_flip(['headercontent']));
+
+if (($_SERVER['REQUEST_METHOD'] ?? '') === 'GET' && (!$section_entry || (cacti_sizeof($section_entry) === 1 && ($section_entry['action'] ?? '') === 'view'))) {
+	$last = read_user_setting('flowview_last_section', '', true);
+
+	if (in_array($last, ['flows', 'nbar'], true)) {
+		$restore = fv_section_url($last);
+
+		if (get_nfilter_request_var('header') === 'false') {
+			$restore .= '&header=false';
+		}
+
+		if (isset_request_var('headercontent')) {
+			$restore .= '&headercontent=true';
+		}
+		header('Location: ' . $restore);
+		exit;
+	}
+}
+
+if (get_nfilter_request_var('section') === 'nbar') {
+	set_request_var('action', 'view');
+	set_request_var('report', 'nbar');
+}
diff --git a/flowview_upgrade_nat_columns.php b/flowview_upgrade_nat_columns.php
index 8838a61..13a0e03 100644
--- a/flowview_upgrade_nat_columns.php
+++ b/flowview_upgrade_nat_columns.php
@@ -29,7 +29,7 @@
  * 'plugin_flowview_raw_*' partition tables.
  *
  * This is deliberately a standalone CLI rather than part of the automatic
- * background schema upgrade (flowview_upgrade.php): a busy install can have
+ * background schema upgrade (cli/flowview_upgrade.php): a busy install can have
  * hundreds of large raw partition tables, and altering all of them can take
  * a long time.  Run this manually (or on a schedule) after upgrading the
  * plugin to backfill existing partitions; new partitions created going
diff --git a/includes/database.php b/includes/database.php
index b457a30..100a802 100644
--- a/includes/database.php
+++ b/includes/database.php
@@ -506,7 +506,7 @@ function flowview_db_get_table_column_types($table, mixed $cnn_id = false) {
 
     $columns = db_fetch_assoc("SHOW COLUMNS FROM $table", false, $flowview_cnn);
     $cols    = [];
-    if (cacti_sizeof($columns)) {
+    if (is_array($columns) && cacti_sizeof($columns)) {
         foreach($columns as $col) {
             $cols[$col['Field']] = ['type' => $col['Type'], 'null' => $col['Null'], 'default' => $col['Default'], 'extra' => $col['Extra']];
         }
@@ -514,3 +514,218 @@ function flowview_db_get_table_column_types($table, mixed $cnn_id = false) {
 
     return $cols;
 }
+
+/**
+ * flowview_db_create_nbar_tables - creates the Cisco Apps (NBAR) tables if they do not already exist
+ *
+ * The application names, the hourly and daily summaries, the daily coverage
+ * checkpoints and the observation date backfill checkpoints.  The daily summary
+ * tables store the start of the day in their hour column.  The raw per-minute
+ * records are not created here: they live in time slices that are created as
+ * records arrive, see flowview_db_create_nbar_data_partition().  Every table is
+ * checked after it is created, so a failure is reported instead of surfacing
+ * later as a missing table.
+ *
+ * @return bool true when every table exists
+ */
+function flowview_db_create_nbar_tables(): bool {
+	$tables = [
+		'plugin_flowview_nbar_names' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_names` (
+			`router` varchar(45) NOT NULL,
+			`app_id` varchar(32) NOT NULL,
+			`name` varchar(255) NOT NULL,
+			`updated` int(10) unsigned NOT NULL,
+			PRIMARY KEY (`router`,`app_id`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR application names learned from exporter options templates'",
+
+		'plugin_flowview_nbar_hours' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_hours` (
+			`listener_id` int(10) unsigned NOT NULL,
+			`hour` int(10) unsigned NOT NULL,
+			`revision` bigint(20) unsigned NOT NULL DEFAULT 0,
+			`built` bigint(20) DEFAULT -1,
+			`connection_built` bigint(20) DEFAULT -1,
+			PRIMARY KEY (`listener_id`,`hour`),
+			KEY `hour` (`hour`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR hourly summary build state per capture'",
+
+		'plugin_flowview_nbar_apps' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_apps` (
+			`listener_id` int(10) unsigned NOT NULL,
+			`hour` int(10) unsigned NOT NULL,
+			`app_id` varchar(32) NOT NULL,
+			`family` tinyint(3) unsigned NOT NULL,
+			`bytes` bigint(20) unsigned NOT NULL,
+			`packets` bigint(20) unsigned NOT NULL,
+			`flows` bigint(20) unsigned NOT NULL,
+			`first_seen` int(10) unsigned DEFAULT NULL,
+			`last_seen` int(10) unsigned DEFAULT NULL,
+			`router` varchar(45) NOT NULL DEFAULT '',
+			PRIMARY KEY (`listener_id`,`hour`,`app_id`,`family`,`router`),
+			KEY `hour` (`hour`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR hourly traffic per application'",
+
+		'plugin_flowview_nbar_pairs' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_pairs` (
+			`listener_id` int(10) unsigned NOT NULL,
+			`hour` int(10) unsigned NOT NULL,
+			`app_id` varchar(32) NOT NULL,
+			`src` varbinary(16) NOT NULL,
+			`dst` varbinary(16) NOT NULL,
+			`bytes` bigint(20) unsigned NOT NULL,
+			`packets` bigint(20) unsigned NOT NULL,
+			`flows` bigint(20) unsigned NOT NULL,
+			`first_seen` int(10) unsigned DEFAULT NULL,
+			`last_seen` int(10) unsigned DEFAULT NULL,
+			`router` varchar(45) NOT NULL DEFAULT '',
+			PRIMARY KEY (`listener_id`,`hour`,`app_id`,`src`,`dst`,`router`),
+			KEY `hour` (`hour`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR hourly traffic per application and endpoint pair'",
+
+		'plugin_flowview_nbar_connections' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_connections` (
+			`listener_id` int(10) unsigned NOT NULL,
+			`hour` int(10) unsigned NOT NULL,
+			`app_id` varchar(32) NOT NULL,
+			`src` varbinary(16) NOT NULL,
+			`dst` varbinary(16) NOT NULL,
+			`sport` smallint(5) unsigned NOT NULL,
+			`dport` smallint(5) unsigned NOT NULL,
+			`protocol` tinyint(3) unsigned NOT NULL,
+			`bytes` bigint(20) unsigned NOT NULL,
+			`packets` bigint(20) unsigned NOT NULL,
+			`flows` bigint(20) unsigned NOT NULL,
+			`first_seen` int(10) unsigned DEFAULT NULL,
+			`last_seen` int(10) unsigned DEFAULT NULL,
+			`router` varchar(45) NOT NULL DEFAULT '',
+			PRIMARY KEY (`listener_id`,`hour`,`app_id`,`src`,`dst`,`sport`,`dport`,`protocol`,`router`),
+			KEY `hour` (`hour`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR hourly traffic per application connection'",
+
+		'plugin_flowview_nbar_daily_apps' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_daily_apps` (
+			`listener_id` int(10) unsigned NOT NULL,
+			`hour` int(10) unsigned NOT NULL,
+			`app_id` varchar(32) NOT NULL,
+			`family` tinyint(3) unsigned NOT NULL,
+			`bytes` bigint(20) unsigned NOT NULL,
+			`packets` bigint(20) unsigned NOT NULL,
+			`flows` bigint(20) unsigned NOT NULL,
+			`first_seen` int(10) unsigned DEFAULT NULL,
+			`last_seen` int(10) unsigned DEFAULT NULL,
+			`router` varchar(45) NOT NULL DEFAULT '',
+			PRIMARY KEY (`listener_id`,`hour`,`app_id`,`family`,`router`),
+			KEY `hour` (`hour`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR daily traffic per application'",
+
+		'plugin_flowview_nbar_daily_pairs' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_daily_pairs` (
+			`listener_id` int(10) unsigned NOT NULL,
+			`hour` int(10) unsigned NOT NULL,
+			`app_id` varchar(32) NOT NULL,
+			`src` varbinary(16) NOT NULL,
+			`dst` varbinary(16) NOT NULL,
+			`bytes` bigint(20) unsigned NOT NULL,
+			`packets` bigint(20) unsigned NOT NULL,
+			`flows` bigint(20) unsigned NOT NULL,
+			`first_seen` int(10) unsigned DEFAULT NULL,
+			`last_seen` int(10) unsigned DEFAULT NULL,
+			`router` varchar(45) NOT NULL DEFAULT '',
+			PRIMARY KEY (`listener_id`,`hour`,`app_id`,`src`,`dst`,`router`),
+			KEY `hour` (`hour`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR daily traffic per application and endpoint pair'",
+
+		'plugin_flowview_nbar_daily_connections' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_daily_connections` (
+			`listener_id` int(10) unsigned NOT NULL,
+			`hour` int(10) unsigned NOT NULL,
+			`app_id` varchar(32) NOT NULL,
+			`src` varbinary(16) NOT NULL,
+			`dst` varbinary(16) NOT NULL,
+			`sport` smallint(5) unsigned NOT NULL,
+			`dport` smallint(5) unsigned NOT NULL,
+			`protocol` tinyint(3) unsigned NOT NULL,
+			`bytes` bigint(20) unsigned NOT NULL,
+			`packets` bigint(20) unsigned NOT NULL,
+			`flows` bigint(20) unsigned NOT NULL,
+			`first_seen` int(10) unsigned DEFAULT NULL,
+			`last_seen` int(10) unsigned DEFAULT NULL,
+			`router` varchar(45) NOT NULL DEFAULT '',
+			PRIMARY KEY (`listener_id`,`hour`,`app_id`,`src`,`dst`,`sport`,`dport`,`protocol`,`router`),
+			KEY `hour` (`hour`),
+			KEY `capture_day_bytes` (`listener_id`,`hour`,`bytes`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR daily traffic per application connection'",
+
+		'plugin_flowview_nbar_days' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_days` (
+			`listener_id` int(10) unsigned NOT NULL,
+			`day` int(10) unsigned NOT NULL,
+			`covered_to` int(10) unsigned NOT NULL,
+			`revision` decimal(30,0) NOT NULL,
+			`timezone` varchar(64) CHARACTER SET ascii NOT NULL,
+			`updated` int(10) unsigned NOT NULL,
+			PRIMARY KEY (`listener_id`,`day`),
+			KEY `day` (`day`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR daily summary coverage checkpoints'",
+
+		'plugin_flowview_nbar_seen_upgrade' => "CREATE TABLE IF NOT EXISTS `plugin_flowview_nbar_seen_upgrade` (
+			`kind` tinyint(3) unsigned NOT NULL,
+			`listener_id` int(10) unsigned NOT NULL,
+			`period` int(10) unsigned NOT NULL,
+			`done` tinyint(3) unsigned NOT NULL DEFAULT 0,
+			`phase` tinyint(3) unsigned NOT NULL DEFAULT 0,
+			`app_cursor` varchar(32) DEFAULT NULL,
+			PRIMARY KEY (`kind`,`listener_id`,`period`),
+			KEY `pending` (`done`,`kind`,`period`))
+			ENGINE=InnoDB
+			COMMENT='Plugin Flowview - NBAR observation date backfill checkpoints'",
+	];
+
+	foreach ($tables as $table => $sql) {
+		flowview_db_execute($sql);
+
+		if (flowview_db_fetch_cell("SHOW TABLES LIKE '$table'") !== $table) {
+			return false;
+		}
+	}
+
+	return true;
+}
+
+/**
+ * flowview_db_create_nbar_data_partition - creates one time slice of the raw NBAR records if it does not already exist
+ *
+ * The raw records are partitioned the way the raw flow tables are, one table per hour or per
+ * day, named plugin_flowview_nbar_data_<year><day of year>[<hour>].  The table name is checked
+ * before it is used in the statement.
+ *
+ * @param string $table The slice table name.
+ *
+ * @return bool true when the slice exists
+ */
+function flowview_db_create_nbar_data_partition(string $table): bool {
+	if (!preg_match('/^plugin_flowview_nbar_data_[0-9]{7}([0-9]{2})?$/D', $table)) {
+		return false;
+	}
+
+	flowview_db_execute("CREATE TABLE IF NOT EXISTS `$table` (
+		`listener_id` int(10) unsigned NOT NULL,
+		`minute` int(10) unsigned NOT NULL,
+		`app_id` varchar(32) NOT NULL,
+		`src` varbinary(16) NOT NULL,
+		`dst` varbinary(16) NOT NULL,
+		`sport` smallint(5) unsigned NOT NULL,
+		`dport` smallint(5) unsigned NOT NULL,
+		`protocol` tinyint(3) unsigned NOT NULL,
+		`bytes` bigint(20) unsigned NOT NULL,
+		`packets` bigint(20) unsigned NOT NULL,
+		`flows` bigint(20) unsigned NOT NULL,
+		`router` varchar(45) NOT NULL DEFAULT '',
+		PRIMARY KEY (`listener_id`,`minute`,`app_id`,`src`,`dst`,`sport`,`dport`,`protocol`,`router`),
+		KEY `minute` (`minute`))
+		ENGINE=InnoDB
+		COMMENT='Plugin Flowview - NBAR raw per-minute application flow records'");
+
+	return flowview_db_fetch_cell("SHOW TABLES LIKE '$table'") === $table;
+}
diff --git a/includes/functions-pre13.php b/includes/functions-pre13.php
index 1a5f1c5..316fc50 100644
--- a/includes/functions-pre13.php
+++ b/includes/functions-pre13.php
@@ -40,7 +40,7 @@
  * @param array  $raw_data     Reference, the report's raw result data.
  * @param mixed  $oput_raw     Reference, the raw rendered output.
  * @param string $oput_html    Reference, the HTML-rendered output body.
- * @param string|null $oput_text Reference, the plain-text output body (defaulted to '' if null).
+ * @param string $oput_text Reference, the plain-text output body.
  * @param array  $attachments  Optional list of file attachments to include.
  * @param array  $headers      Optional extra email headers to include.
  *
@@ -69,7 +69,7 @@ function reports_log_and_notify($id, $start_time, $report_type, $source, $source
 	$from[0] = $fromemail;
 	$from[1] = $fromname;
 
-	if (cacti_sizeof($report)) {
+	if (is_array($report) && cacti_sizeof($report)) {
 		if ($report['notification'] != '') {
 			$notifications = json_decode($report['notification'], true);
 
@@ -114,9 +114,9 @@ function reports_log_and_notify($id, $start_time, $report_type, $source, $source
 								WHERE id = ?',
 								[$data['id']]);
 
-							if (cacti_sizeof($list)) {
+							if (is_array($list) && cacti_sizeof($list)) {
 								/* process the format file */
-								$report_tag  = '';
+								$report_tag  = false;
 								$theme       = 'modern';
 								$output_html = '';
 								$format      = $list['format_file'] != '' ? $list['format_file']:'default';
@@ -269,7 +269,7 @@ function reports_run($id): bool {
 		WHERE id = ?',
 		[$id]);
 
-	if (cacti_sizeof($report)) {
+	if (is_array($report) && cacti_sizeof($report)) {
 		db_execute_prepared('UPDATE reports_queued
 			SET status = ?, start_time = ?
 			WHERE id = ?',
diff --git a/includes/functions.php b/includes/functions.php
index bbe9f3f..f6702cc 100644
--- a/includes/functions.php
+++ b/includes/functions.php
@@ -944,12 +944,16 @@ function flowview_display_filter(): void {
 						</select>
 					</td>
 					<td class='nowrap' title='<?php print __esc('Show only Domains on Charts Below');?>'>
-						<input type='checkbox' id='domains' name='domains' <?php print (get_request_var('domains') == 'true' ? 'checked':'');?>>
-						<label for='domains'><?php print __('Domains/Hostnames Only', 'flowview');?></label>
+						<span>
+							<input type='checkbox' id='domains' name='domains' <?php print (get_request_var('domains') == 'true' ? 'checked':'');?>>
+							<label for='domains'><?php print __('Domains/Hostnames Only', 'flowview');?></label>
+						</span>
 					</td>
 					<td class='nowrap' title='<?php print __esc('Show the post-NAT (translated) IP/DNS name instead of the original values', 'flowview');?>'>
-						<input type='checkbox' id='usenat' name='usenat' <?php print (get_request_var('usenat') == 'true' ? 'checked':'');?>>
-						<label for='usenat'><?php print __('Use NAT Data', 'flowview');?></label>
+						<span>
+							<input type='checkbox' id='usenat' name='usenat' <?php print (get_request_var('usenat') == 'true' ? 'checked':'');?>>
+							<label for='usenat'><?php print __('Use NAT Data', 'flowview');?></label>
+						</span>
 					</td>
 				</tr>
 			</table>
@@ -1037,20 +1041,28 @@ function flowview_display_filter(): void {
 						<?php print __('Show/Hide', 'flowview');?>
 					</td>
 					<td class='nowrap'>
-						<input type='checkbox' id='table' name='table' <?php print (get_request_var('table') == 'true' ? 'checked':'');?>>
-						<label for='table'><?php print __('Table', 'flowview');?></label>
+						<span>
+							<input type='checkbox' id='table' name='table' <?php print (get_request_var('table') == 'true' ? 'checked':'');?>>
+							<label for='table'><?php print __('Table', 'flowview');?></label>
+						</span>
 					</td>
 					<td class='nowrap'>
-						<input type='checkbox' id='bytes' name='bytes' <?php print (get_request_var('bytes') == 'true' ? 'checked':'');?>>
-						<label for='bytes'><?php print __('Bytes', 'flowview');?></label>
+						<span>
+							<input type='checkbox' id='bytes' name='bytes' <?php print (get_request_var('bytes') == 'true' ? 'checked':'');?>>
+							<label for='bytes'><?php print __('Bytes', 'flowview');?></label>
+						</span>
 					</td>
 					<td class='nowrap'>
-						<input type='checkbox' id='packets' name='packets' <?php print (get_request_var('packets') == 'true' ? 'checked':'');?>>
-						<label for='packets'><?php print __('Packets', 'flowview');?></label>
+						<span>
+							<input type='checkbox' id='packets' name='packets' <?php print (get_request_var('packets') == 'true' ? 'checked':'');?>>
+							<label for='packets'><?php print __('Packets', 'flowview');?></label>
+						</span>
 					</td>
 					<td class='nowrap'>
-						<input type='checkbox' id='flows' name='flows' <?php print (get_request_var('flows') == 'true' ? 'checked':'');?>>
-						<label for='flows'><?php print __('Flows', 'flowview');?></label>
+						<span>
+							<input type='checkbox' id='flows' name='flows' <?php print (get_request_var('flows') == 'true' ? 'checked':'');?>>
+							<label for='flows'><?php print __('Flows', 'flowview');?></label>
+						</span>
 					</td>
 					<td>
 						<span>
@@ -1968,7 +1980,7 @@ function plugin_flowview_run_schedule($id, $report_id): void {
 	}
 
 	/* process the format file */
-	$report_tag  = '';
+	$report_tag  = false;
 	$theme       = 'modern';
 	$body_html   = '';
 	$format      = $schedule['format_file'] != '' ? $schedule['format_file']:'default';
@@ -2832,7 +2844,7 @@ function run_flow_query($session, $query_id, $start, $end) {
 			$data['printed']    = $nreport;
 			$data['statistics'] = 0;
 		}
-	} elseif (!sizeof($data)) {
+	} elseif (!cacti_sizeof($data)) {
 		return false;
 	}
 
@@ -4217,7 +4229,7 @@ function parallel_database_query_run($requests) {
 	}
 
 	if ($total_time >= $max_time) {
-		raise_message_javascript('parallel_query_timeout', __('The Parallel Query Timed Out.  Please contact your administrator', 'flowview'), MESSAGE_LEVEL_ERROR);
+		raise_message_javascript('parallel_query_timeout', __('The Parallel Query Timed Out.  Please contact your administrator', 'flowview'), '', MESSAGE_LEVEL_ERROR);
 
 		foreach($requests as $request_id) {
 			parallel_database_query_cleanup($request_id);
diff --git a/includes/nbar_chart.php b/includes/nbar_chart.php
new file mode 100644
index 0000000..7df2337
--- /dev/null
+++ b/includes/nbar_chart.php
@@ -0,0 +1,99 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Render the top application totals for the current report filters.
+ *
+ * @param string $scope  Trusted capture predicate.
+ * @param array  $args   Prepared statement values.
+ * @param string $family IP family selection.
+ * @param string $host   Optional endpoint IP filter.
+ *
+ * @return void
+ */
+function fv_nbar_chart(string $scope, array $args, string $family, string $host = ''): void {
+	$where = $scope . ' AND d.minute>=? AND d.minute<?';
+
+	if ($family !== 'all') {
+		$where .= ' AND LENGTH(d.src)=' . ($family === '6' ? 16 : 4);
+	}
+	global $lid, $combined_lids;
+
+	try {
+		$source = fv_nbar_summary_source($host === '' ? 'apps' : 'pairs', $lid === 0 ? $combined_lids : [$lid], $args[cacti_sizeof($args) - 2], $args[cacti_sizeof($args) - 1]);
+	} catch (RuntimeException $e) {
+		cacti_log('NBAR chart: ' . $e->getMessage(), false, 'FLOWVIEW');
+		print '<aside class="nbarChart"><p>' . fv_nbar_h(__('Unable to load application chart. Please try again.', 'flowview')) . '</p></aside>';
+
+		return;
+	}
+
+	if ($host !== '' && filter_var($host, FILTER_VALIDATE_IP)) {
+		$where .= ' AND (d.src=INET6_ATON(?) OR d.dst=INET6_ATON(?))';
+		array_push($args, $host, $host);
+	}
+	$rows = fv_nbar_query_cached(
+		"SELECT COALESCE(NULLIF(n.name,''),CONCAT('Application ',d.app_id)) name,SUM(d.bytes) bytes FROM (SELECT d.listener_id,d.app_id,d.router,SUM(d.bytes) bytes FROM " . $source . ' d WHERE ' . $where . ' GROUP BY d.listener_id,d.app_id,d.router) d JOIN plugin_flowview_devices l ON l.id=d.listener_id LEFT JOIN plugin_flowview_nbar_names n ON n.router=COALESCE(NULLIF(d.router,SPACE(0)),l.allowfrom) AND n.app_id=d.app_id GROUP BY COALESCE(NULLIF(n.name,\'\'),CONCAT(\'Application \',d.app_id)) ORDER BY bytes DESC',
+		$args
+	);
+
+	if (!is_array($rows)) {
+		print '<aside class="nbarChart"><p>' . fv_nbar_h(__('Unable to load application chart. Please try again.', 'flowview')) . '</p></aside>';
+
+		return;
+	}
+	$total = array_sum(array_column($rows, 'bytes'));
+	$items = array_slice($rows, 0, 5);
+	$other = $total - array_sum(array_column($items, 'bytes'));
+
+	if ($other > 0) {
+		$items[] = ['name' => __('Other', 'flowview'), 'bytes' => $other];
+	}
+	$colors   = ['#4c9bd6', '#73ae53', '#e2a545', '#a780c5', '#de7970', '#91979d'];
+	$stops    = [];
+	$legend   = '';
+	$position = 0;
+
+	foreach ($items as $i => $item) {
+		$bytes = (float) $item['bytes'];
+
+		if ($bytes <= 0) {
+			continue;
+		}
+		$next     = min(100, $position + $bytes / $total * 100);
+		$stops[]  = $colors[$i] . ' ' . round($position, 5) . '% ' . round($next, 5) . '%';
+		$position = $next;
+		$value    = $bytes >= 1000000000 ? number_format($bytes / 1000000000, 2) . ' GB' : number_format($bytes / 1000000, 2) . ' MB';
+		$legend .= '<li><span class="nbarChartKey" style="background:' . $colors[$i] . '"></span><span class="nbarChartName">' . fv_nbar_h($item['name']) . '</span><span>' . $value . '</span></li>';
+	}
+	print '<aside class="nbarChart" aria-label="' . fv_nbar_h(__('Top 5 applications by data', 'flowview')) . '"><strong>' . __('Top 5 applications', 'flowview') . '</strong>';
+
+	if ($total > 0) {
+		print '<div class="nbarChartBody"><div class="nbarChartPie" role="img" aria-label="' . fv_nbar_h(__('Application data share for the selected period', 'flowview')) . '" style="background:conic-gradient(' . implode(',', $stops) . ')"></div><ul>' . $legend . '</ul></div>';
+	} else {
+		print '<p>' . __('No application data in this period', 'flowview') . '</p>';
+	}
+	print '</aside>';
+}
diff --git a/includes/nbar_collector.php b/includes/nbar_collector.php
new file mode 100644
index 0000000..3b26303
--- /dev/null
+++ b/includes/nbar_collector.php
@@ -0,0 +1,320 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+require_once(__DIR__ . '/nbar_common.php');
+
+// Decode application-bearing NetFlow v9 records from exporter templates.
+/** Bounded LRU template state, shared across source IDs but limited per exporter. */
+class FlowviewNbarTemplateCache {
+	private array $entries = [];
+	private int $pruned    = 0;
+
+	public function prune(int $now): void {
+		if ($now - $this->pruned < 60) {
+			return;
+		}
+
+		foreach ($this->entries as $key => $entry) {
+			if ($entry['used'] <= $now - 1800) {
+				unset($this->entries[$key]);
+			}
+		}
+		$this->pruned = $now;
+	}
+
+	public function remove(string $router, string $source, int $id): void {
+		unset($this->entries[$router . ':' . $source . ':' . $id]);
+	}
+
+	public function store(string $router, string $source, int $id, array $template, int $now): bool {
+		$this->prune($now);
+		$this->remove($router, $source, $id);
+		$fields = cacti_count($template[0]);
+
+		if ($fields > 2048) {
+			return false;
+		}
+
+		while (true) {
+			$usage = $this->usage($router);
+			$local = $usage['exporter_templates'] >= 64 || $usage['exporter_fields'] + $fields > 2048;
+
+			if (!$local && $usage['templates'] < 256 && $usage['fields'] + $fields <= 8192) {
+				break;
+			}
+
+			foreach ($this->entries as $key => $entry) {
+				if (!$local || $entry['router'] === $router) {
+					unset($this->entries[$key]);
+
+					break;
+				}
+			}
+		}
+		$this->entries[$router . ':' . $source . ':' . $id] = ['router' => $router, 'used' => $now, 'template' => $template];
+
+		return true;
+	}
+
+	public function get(string $router, string $source, int $id, int $now): ?array {
+		$key = $router . ':' . $source . ':' . $id;
+
+		if (!isset($this->entries[$key])) {
+			return null;
+		}
+		$entry = $this->entries[$key];
+		unset($this->entries[$key]);
+
+		if ($entry['used'] <= $now - 1800) {
+			return null;
+		}
+		$entry['used']       = $now;
+		$this->entries[$key] = $entry;
+
+		return $entry['template'];
+	}
+
+	public function usage(string $router): array {
+		$usage = ['templates' => cacti_count($this->entries), 'fields' => 0, 'exporter_templates' => 0, 'exporter_fields' => 0];
+
+		foreach ($this->entries as $entry) {
+			$fields = cacti_count($entry['template'][0]);
+			$usage['fields'] += $fields;
+
+			if ($entry['router'] === $router) {
+				$usage['exporter_templates']++;
+				$usage['exporter_fields'] += $fields;
+			}
+		}
+
+		return $usage;
+	}
+}
+
+/**
+ * Decode network-order counters without rounding unsigned 64-bit values.
+ *
+ * @param string $s Input text or network-order bytes.
+ *
+ * @return int|string
+ */
+function fv_nbar_uint(string $s): int|string {
+	if (strlen($s) > 8) {
+		throw new InvalidArgumentException('NBAR numeric fields must fit an unsigned 64-bit value');
+	}
+	$n = 0;
+
+	foreach (unpack('C*', $s) ?: [] as $v) {
+		if (is_int($n) && $n <= intdiv(PHP_INT_MAX - $v, 256)) {
+			$n = (int) ($n * 256 + $v);
+
+			continue;
+		}
+		$digits = (string) $n;
+		$carry  = $v;
+		$out    = '';
+
+		for ($i = strlen($digits) - 1; $i >= 0; $i--) {
+			$carry += ((int) $digits[$i]) * 256;
+			$out   = ($carry % 10) . $out;
+			$carry = intdiv($carry, 10);
+		}
+		$n = ($carry > 0 ? (string) $carry : '') . $out;
+	}
+
+	return $n;
+}
+
+/**
+ * Decode a network-order integer of at most four bytes, which always fits a native int.
+ *
+ * @param string $s Network-order bytes.
+ *
+ * @return int
+ */
+function fv_nbar_int(string $s): int {
+	return (int) fv_nbar_uint($s);
+}
+
+/**
+ * Decode template-defined NetFlow v9 application records and names.
+ *
+ * @param string $p      NetFlow v9 packet bytes.
+ * @param string $router Exporter source IP address.
+ *
+ * @return void
+ */
+function fv_nbar_packet(string $p, string $router): void {
+	global $listener_id;
+	static $templates = null;
+
+	if (strlen($p) < 20 || fv_nbar_int(substr($p, 0, 2)) !== 9) {
+		return;
+	}
+	$templates ??= new FlowviewNbarTemplateCache();
+	$now = time();
+	$templates->prune($now);
+	$source  = bin2hex(substr($p, 16, 4));
+	$unix    = fv_nbar_int(substr($p, 8, 4));
+	$uptime  = fv_nbar_int(substr($p, 4, 4));
+	$batches = [];
+	$hours   = [];
+
+	for ($o = 20; $o + 4 <= strlen($p);) {
+		$id  = fv_nbar_int(substr($p, $o, 2));
+		$len = fv_nbar_int(substr($p, $o + 2, 2));
+
+		if ($len < 4 || $o + $len > strlen($p)) {
+			break;
+		}
+		$end = $o + $len;
+		$q   = $o + 4;
+
+		if ($id === 0 || $id === 1) {
+			while ($q + ($id === 0 ? 4 : 6) <= $end) {
+				$tid = fv_nbar_int(substr($p, $q, 2));
+
+				if ($tid < 256) {
+					break;
+				}
+
+				if ($id === 0) {
+					$count = fv_nbar_int(substr($p, $q + 2, 2));
+					$size  = $count * 4;
+					$q += 4;
+				} else {
+					$size = fv_nbar_int(substr($p, $q + 2, 2)) + fv_nbar_int(substr($p, $q + 4, 2));
+					$q += 6;
+				}
+
+				if ($size < 4 || $size % 4 || $q + $size > $end) {
+					$templates->remove($router, $source, $tid);
+
+					break;
+				}
+				$fields = [];
+				$total  = 0;
+				$valid  = true;
+
+				for ($z = 0; $z < $size; $z += 4) {
+					$f     = fv_nbar_int(substr($p, $q + $z, 2));
+					$l     = fv_nbar_int(substr($p, $q + $z + 2, 2));
+					$width = [1 => 8, 2 => 8, 4 => 1, 7 => 2, 11 => 2, 21 => 4][$f] ?? null;
+
+					if ($l === 0 || ($id === 0 && $width !== null && $l > $width)) {
+						$valid = false;
+
+						break;
+					}
+					$fields[] = [$f, $l];
+					$total += $l;
+				}
+
+				if ($valid && $total > 0 && $total <= 65535) {
+					$templates->store($router, $source, $tid, [$fields, $total, $id === 1], $now);
+				} else {
+					$templates->remove($router, $source, $tid);
+				}
+				$q += $size;
+			}
+		} elseif ($id >= 256 && ($template = $templates->get($router, $source, $id, $now)) !== null) {
+			[$fields, $total, $options] = $template;
+
+			while ($q + $total <= $end) {
+				$data = [];
+
+				foreach ($fields as $f) {
+					$data[$f[0]] = substr($p, $q, $f[1]);
+					$q += $f[1];
+				}
+
+				if (!isset($data[95])) {
+					continue;
+				}
+				$aid = bin2hex($data[95]);
+
+				if ($options) {
+					$name = trim($data[96] ?? '', chr(0) . ' ');
+
+					if ($name !== '' && strlen($name) <= 255 && preg_match('/^[a-zA-Z0-9_.: -]+$/D', $name)) {
+						flowview_db_execute_prepared('INSERT INTO plugin_flowview_nbar_names VALUES (?,?,?,?) ON DUPLICATE KEY UPDATE name=VALUES(name),updated=VALUES(updated)', [$router, $aid, $name, time()]);
+					}
+
+					continue;
+				}
+				$src = $data[27] ?? $data[8] ?? '';
+				$dst = $data[28] ?? $data[12] ?? '';
+
+				if (!in_array(strlen($src), [4, 16], true) || !in_array(strlen($dst), [4, 16], true) || !isset($data[1])) {
+					continue;
+				}
+				$ts = $unix;
+
+				if (isset($data[21])) {
+					$age = ($uptime - fv_nbar_int($data[21]) + 4294967296) % 4294967296;
+					$ts  = $unix - (int) floor($age / 1000);
+				}
+
+				if ($ts < time() - fv_nbar_retention_days() * 86400 || $ts > time() + 300) {
+					continue;
+				}
+				$hours[(int) (floor($ts / 3600) * 3600)] = true;
+				$minute                                  = (int) (floor($ts / 60) * 60);
+				$table                                   = fv_nbar_data_table($minute);
+				$batches[$table] ??= ['rows' => [], 'args' => []];
+				$batches[$table]['rows'][] = '(?,?,?,UNHEX(?),UNHEX(?),?,?,?,?,?,1,?)';
+				array_push(
+					$batches[$table]['args'],
+					(int) $listener_id,
+					$minute,
+					$aid,
+					bin2hex($src),
+					bin2hex($dst),
+					fv_nbar_uint($data[7] ?? chr(0)),
+					fv_nbar_uint($data[11] ?? chr(0)),
+					fv_nbar_uint($data[4] ?? chr(0)),
+					fv_nbar_uint($data[1]),
+					fv_nbar_uint($data[2] ?? chr(0)),
+					$router
+				);
+			}
+		}
+		$o = $end;
+	}
+	$statements = [];
+
+	foreach ($batches as $table => $batch) {
+		if (!fv_nbar_data_ensure($table)) {
+			cacti_log('WARNING: NBAR raw table ' . $table . ' could not be created', false, 'FLOWVIEW');
+
+			return;
+		}
+		$statements[] = ['INSERT INTO `' . $table . '` VALUES ' . implode(',', $batch['rows']) . ' ON DUPLICATE KEY UPDATE bytes=bytes+VALUES(bytes),packets=packets+VALUES(packets),flows=flows+1', $batch['args']];
+	}
+
+	if ($statements && !fv_nbar_summary_store($statements, (int) $listener_id, $hours)) {
+		cacti_log('WARNING: NBAR record transaction failed', false, 'FLOWVIEW');
+	}
+}
diff --git a/includes/nbar_common.php b/includes/nbar_common.php
new file mode 100644
index 0000000..eed088b
--- /dev/null
+++ b/includes/nbar_common.php
@@ -0,0 +1,208 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+require_once(__DIR__ . '/nbar_partition.php');
+require_once(__DIR__ . '/nbar_seen.php');
+require_once(__DIR__ . '/nbar_summary.php');
+
+// Shared NBAR report and retention helpers.
+
+/**
+ * Escape report text and quoted HTML attributes.
+ *
+ * @param mixed $s Input text or network-order bytes.
+ *
+ * @return string
+ */
+function fv_nbar_h(mixed $s): string {
+	return htmlspecialchars((string) $s, ENT_QUOTES, 'UTF-8');
+}
+
+/**
+ * Read the validated history-retention setting with a short cache.
+ *
+ * @return int
+ */
+function fv_nbar_retention_days(): int {
+	static $days = 7,$checked = 0;
+
+	if (time() - $checked >= 60) {
+		$value   = (int) read_config_option('flowview_nbar_retention_days', true);
+		$days    = in_array($value, [1, 3, 7, 14, 30], true) ? $value : 7;
+		$checked = time();
+	}
+
+	return $days;
+}
+/**
+ * Expire raw records and summaries: whole raw slices are dropped, summaries are deleted in bounded batches.
+ *
+ * @return void
+ */
+function fv_nbar_cleanup(int|float $budget = 10): void {
+	// One deadline for the raw slice drops and every summary deletion batch, so dropping a large
+	// backlog of slices cannot use up the supervisor's time before the summaries are maintained.
+	$deadline = microtime(true) + max(0, (float) $budget);
+	$cutoff   = (int) (floor((time() - fv_nbar_retention_days() * 86400) / 3600) * 3600);
+	$queries  = [];
+
+	fv_nbar_data_drop_expired(time() - fv_nbar_retention_days() * 86400, $deadline);
+
+	foreach (['apps', 'pairs', 'connections', 'hours'] as $table) {
+		$queries[] = ["DELETE FROM plugin_flowview_nbar_$table WHERE hour<$cutoff LIMIT 50000", 50000];
+	}
+	$queries = array_merge($queries, fv_nbar_daily_cleanup_queries());
+	fv_nbar_cleanup_batches($queries, $deadline);
+}
+
+/** Drain every retention level fairly until empty or the shared deadline expires. */
+function fv_nbar_cleanup_batches(array $queries, float $deadline): void {
+	while ($queries && microtime(true) < $deadline) {
+		foreach ($queries as $key => [$sql, $limit]) {
+			if (microtime(true) >= $deadline) {
+				return;
+			}
+
+			if (flowview_db_execute($sql) === false) {
+				unset($queries[$key]);
+
+				continue;
+			}
+
+			if ((int) flowview_db_affected_rows() < $limit) {
+				unset($queries[$key]);
+			}
+		}
+	}
+}
+
+/** Establish a verified DML deadline; MySQL SELECT timeouts do not bound INSERT SELECT. */
+function fv_nbar_worker_timeout(int $seconds): ?float {
+	$old = flowview_db_fetch_cell('SELECT @@session.max_statement_time', '', false);
+
+	if (!is_numeric($old) || (float) $old < 0) {
+		return null;
+	}
+
+	if (!flowview_db_execute('SET SESSION max_statement_time=' . $seconds, false)) {
+		return null;
+	}
+
+	return (float) $old;
+}
+
+/** Launch maintenance without holding the Cacti poller on aggregate queries. */
+function fv_nbar_launch_maintenance(): bool {
+	global $config;
+	$php = read_config_option('path_php_binary');
+
+	if (!is_string($php) || $php === '') {
+		cacti_log('NBAR maintenance requires a configured PHP binary.', false, 'FLOWVIEW');
+
+		return false;
+	}
+	exec_background($php, '-q ' . escapeshellarg($config['base_path'] . '/plugins/flowview/cli/flowview_upgrade.php') . ' --nbar-worker=supervise');
+
+	return true;
+}
+
+/** Run an isolated maintenance child with a hard process deadline. */
+function fv_nbar_supervise_maintenance(): void {
+	global $config;
+
+	if (!register_process_start('flowview', 'nbar_maintenance', 0, 120)) {
+		return;
+	}
+
+	try {
+		// Invoke PHP directly; older Cacti timeout helpers accept strings only.
+		$command = [(string) read_config_option('path_php_binary'), '-q', $config['base_path'] . '/plugins/flowview/cli/flowview_upgrade.php', '--nbar-worker=build'];
+		$status  = fv_nbar_run_child($command, 90);
+
+		if ($status !== 0) {
+			cacti_log('NBAR maintenance child failed or exceeded its 90-second deadline.', false, 'FLOWVIEW');
+		}
+	} finally {
+		unregister_process('flowview', 'nbar_maintenance', 0);
+	}
+}
+
+/**
+ * Supervise a direct PHP child independently of Cacti's versioned command API.
+ *
+ * @param list<string> $command Executable followed by its arguments.
+ * @param int          $seconds Hard process deadline in seconds.
+ *
+ * @return int
+ */
+function fv_nbar_run_child(array $command, int $seconds): int {
+	$pipes      = [];
+	$process    = false;
+	$executable = $command[0] ?? '';
+
+	if (is_string($executable) && $executable !== '' && (strpbrk($executable, '/\\') === false || is_executable($executable))) {
+		try {
+			$process = @proc_open($command, [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes, null, null, ['bypass_shell' => true]);
+		} catch (Throwable $error) {
+			$process = false;
+		}
+	}
+
+	if (!is_resource($process)) {
+		return 125;
+	}
+
+	try {
+		fclose($pipes[0]);
+		stream_set_blocking($pipes[1], false);
+		stream_set_blocking($pipes[2], false);
+		$deadline = hrtime(true) + max(1, $seconds) * 1000000000;
+
+		while (true) {
+			// Drain both pipes in bounded chunks; child output cannot fill memory.
+			stream_get_contents($pipes[1], 8192);
+			stream_get_contents($pipes[2], 8192);
+			$state = proc_get_status($process);
+
+			if (!$state['running']) {
+				return (int) $state['exitcode'];
+			}
+
+			if (hrtime(true) >= $deadline) {
+				proc_terminate($process, 9);
+
+				return 124;
+			}
+			usleep(10000);
+		}
+	} finally {
+		foreach ($pipes as $pipe) {
+			if (is_resource($pipe)) {
+				fclose($pipe);
+			}
+		}
+		proc_close($process);
+	}
+}
diff --git a/includes/nbar_connections.php b/includes/nbar_connections.php
new file mode 100644
index 0000000..6ddb4b0
--- /dev/null
+++ b/includes/nbar_connections.php
@@ -0,0 +1,422 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Add unsigned decimal counters without floating-point rounding.
+ *
+ * @param int|string $a First unsigned decimal counter.
+ * @param int|string $b Second unsigned decimal counter.
+ *
+ * @return string
+ */
+function fv_nbar_decimal_add(int|string $a, int|string $b): string {
+	$a     = strrev((string) $a);
+	$b     = strrev((string) $b);
+	$carry = 0;
+	$out   = '';
+
+	for ($i = 0,$n = max(strlen($a), strlen($b)); $i < $n || $carry; $i++) {
+		$v = (isset($a[$i]) ? (int) $a[$i] : 0) + (isset($b[$i]) ? (int) $b[$i] : 0) + $carry;
+		$out .= ($v % 10);
+		$carry = intdiv($v, 10);
+	}
+
+	return ltrim(strrev($out), '0') ?: '0';
+}
+/**
+ * Compare unsigned decimal counters without floating-point rounding.
+ *
+ * @param int|string $a First unsigned decimal counter.
+ * @param int|string $b Second unsigned decimal counter.
+ *
+ * @return int
+ */
+function fv_nbar_decimal_compare(int|string $a, int|string $b): int {
+	$a = ltrim((string) $a, '0') ?: '0';
+	$b = ltrim((string) $b, '0') ?: '0';
+
+	return strlen($a) <=> strlen($b) ?: strcmp($a, $b);
+}
+/**
+ * Identify an exported tuple using the resolved application-name rank.
+ *
+ * @param array $row      Exported tuple or observation fields.
+ * @param array $names    Application-name ranks by capture.
+ * @param int   $listener Capture identifier.
+ *
+ * @return string
+ */
+function fv_nbar_connection_key(array $row, array $names, int $listener): string {
+	return json_encode([(string) $row['app_id'], (int) ($names[$listener][($row['router'] ?? '') . ':' . $row['app_id']]['name_id'] ?? 0), $row['src_hex'], $row['dst_hex'], (int) $row['sport'], (int) $row['dport'], (int) $row['protocol'], (string) ($row['router'] ?? '')], JSON_THROW_ON_ERROR);
+}
+/**
+ * Order connection totals by exact byte count and deterministic tuple fields.
+ *
+ * @param array $a First connection total with its normalized tuple key.
+ * @param array $b Second connection total with its normalized tuple key.
+ *
+ * @return int
+ */
+function fv_nbar_connection_compare(array $a, array $b): int {
+	$cmp = fv_nbar_decimal_compare($b['bytes'], $a['bytes']);
+
+	if ($cmp) {
+		return $cmp;
+	}
+
+	foreach ($a['_key'] as $i => $v) {
+		$cmp = ($i === 0 || $i === 2 || $i === 3 || $i === 7) ? strcmp((string) $v, (string) $b['_key'][$i]) : ($v <=> $b['_key'][$i]);
+
+		if ($cmp) {
+			return $cmp;
+		}
+	}
+
+	return 0;
+}
+// Read completed hours independently instead of regrouping a whole partial day.
+/**
+ * Plan independently reusable complete hours and raw partial boundaries.
+ *
+ * @param int $listener Capture identifier.
+ * @param int $from     Inclusive boundary in Unix seconds.
+ * @param int $to       Exclusive boundary in Unix seconds.
+ * @param int $now      Current Unix time.
+ *
+ * @return array
+ */
+function fv_nbar_connection_edges(int $listener, int $from, int $to, int $now): array {
+	$segments = [];
+	$ready    = flowview_db_fetch_assoc_prepared('SELECT hour FROM plugin_flowview_nbar_hours WHERE listener_id=? AND hour>=? AND hour<? AND connection_built>=0 AND connection_built=revision', [$listener, (int) (ceil($from / 3600) * 3600), (int) (floor(min($to, $now - 300) / 3600) * 3600)]);
+
+	if (!is_array($ready)) {
+		throw new RuntimeException('Cannot read hourly summary state');
+	}
+	$hours  = array_fill_keys(array_column($ready, 'hour'), true);
+	$tables = fv_nbar_data_tables();
+
+	for ($cursor = $from; $cursor < $to; $cursor = $end) {
+		$hour = (int) (floor($cursor / 3600) * 3600);
+		$end  = min($to, $hour + 3600);
+
+		if ($cursor == $hour && $end == $hour + 3600 && isset($hours[$hour])) {
+			$source     = '(SELECT listener_id,hour minute,app_id,src,dst,sport,dport,protocol,bytes,packets,flows,first_seen,last_seen,router FROM plugin_flowview_nbar_connections WHERE listener_id=' . (int) $listener . ' AND hour=' . $hour . ')';
+			$segments[] = ['listener' => $listener, 'source' => $source, 'daily' => true];
+		} else {
+			$source     = fv_nbar_data_source(fv_nbar_data_columns(), 'listener_id=' . (int) $listener . ' AND minute>=' . (int) $cursor . ' AND minute<' . (int) $end, (int) $cursor, (int) $end, $tables);
+			$segments[] = ['listener' => $listener, 'source' => $source, 'daily' => false];
+		}
+	}
+
+	return $segments;
+}
+/**
+ * Plan a capture range using current daily, hourly and raw revisions.
+ *
+ * @param array $listeners Selected capture identifiers.
+ * @param int   $start     Inclusive range start in Unix seconds.
+ * @param int   $end       Exclusive range end in Unix seconds.
+ * @param int   $now       Current Unix time.
+ *
+ * @return array
+ */
+function fv_nbar_connection_plan(array $listeners, int $start, int $end, int $now): array {
+	$segments = [];
+
+	foreach ($listeners as $listener) {
+		$listener = (int) $listener;
+
+		if ($listener <= 0) {
+			throw new InvalidArgumentException('Invalid capture');
+		}
+		$days = flowview_db_fetch_assoc_prepared('SELECT * FROM plugin_flowview_nbar_days WHERE listener_id=? AND day>=? AND covered_to<=? AND covered_to>day ORDER BY day', [$listener, $start, $end]);
+
+		if (!is_array($days)) {
+			throw new RuntimeException('Cannot read daily history');
+		}
+		$cursor = $start;
+
+		foreach ($days as $day) {
+			$from = (int) $day['day'];
+			$to   = (int) $day['covered_to'];
+
+			if ($day['timezone'] !== date_default_timezone_get() || $from < $cursor || $to > (int) (floor(($now - 300) / 3600) * 3600)) {
+				continue;
+			}
+
+			if (fv_nbar_daily_signature($listener, $from, $to) !== (string) $day['revision']) {
+				continue;
+			}
+
+			if ($from > $cursor) {
+				$segments = array_merge($segments, fv_nbar_connection_edges($listener, $cursor, $from, $now));
+			}
+			$segments[] = ['listener' => $listener, 'source' => '(SELECT listener_id,hour minute,app_id,src,dst,sport,dport,protocol,bytes,packets,flows,first_seen,last_seen,router FROM plugin_flowview_nbar_daily_connections WHERE listener_id=' . $listener . ' AND hour=' . $from . ')', 'daily' => true];
+			$cursor     = $to;
+		}
+
+		if ($cursor < $end) {
+			$segments = array_merge($segments, fv_nbar_connection_edges($listener, $cursor, $end, $now));
+		}
+	}
+
+	return $segments;
+}
+/**
+ * Read an exact connection page from a consistent history snapshot.
+ *
+ * @param array  $listeners Selected capture identifiers.
+ * @param int    $start     Inclusive range start in Unix seconds.
+ * @param int    $end       Exclusive range end in Unix seconds.
+ * @param string $where     Validated filter predicate.
+ * @param array  $args      Prepared statement values.
+ * @param int    $page      One-based connection page.
+ * @param int    $size      Bounded page size including the next-page sentinel.
+ *
+ * @return array
+ */
+function fv_nbar_connections_direct(array $listeners, int $start, int $end, string $where, array $args, int $page, int $size = 101): array {
+	$listeners = array_values(array_unique(array_map('intval', $listeners)));
+
+	if (!$listeners || cacti_sizeof($listeners) > 3) {
+		throw new InvalidArgumentException('Choose one to three captures');
+	}
+	$page   = max(1, (int) $page);
+	$size   = max(101, min(501, (int) $size));
+	$offset = ($page - 1) * 100;
+	$need   = $offset + $size;
+	// Keep page retrieval bounded. Deep jumps use the exact SQL fallback below.
+	$limit = max(256, min(4096, $need * 2));
+
+	if (!flowview_db_execute('SET TRANSACTION ISOLATION LEVEL REPEATABLE READ') || !flowview_db_execute('START TRANSACTION WITH CONSISTENT SNAPSHOT')) {
+		throw new RuntimeException('Cannot open history snapshot');
+	}
+
+	try {
+		$segments = fv_nbar_connection_plan($listeners, (int) $start, (int) $end, time());
+		$nameRows = flowview_db_fetch_assoc_prepared('SELECT l.id listener_id,l.allowfrom,n.router,n.app_id,n.name,DENSE_RANK() OVER (ORDER BY n.name) name_id FROM plugin_flowview_devices l CROSS JOIN plugin_flowview_nbar_names n WHERE l.id IN (' . implode(',', $listeners) . ')', []);
+
+		if (!is_array($nameRows)) {
+			throw new RuntimeException('Cannot read application names');
+		}
+		$names = [];
+
+		foreach ($nameRows as $row) {
+			if ($row['app_id'] !== null) {
+				$names[(int) $row['listener_id']][($row['router'] ?? '') . ':' . $row['app_id']] = $row;
+
+				if (($row['router'] ?? '') === ($row['allowfrom'] ?? '')) {
+					$names[(int) $row['listener_id']][':' . $row['app_id']] = $row;
+				}
+			}
+		}
+		$fields   = 'd.router,d.app_id,HEX(d.src) src_hex,HEX(d.dst) dst_hex,d.sport,d.dport,d.protocol';
+		$group    = 'd.router,d.app_id,d.src,d.dst,d.sport,d.dport,d.protocol';
+		$counters = 'd.bytes bytes,d.packets packets,d.flows records,d.first_seen,d.last_seen';
+		$sum      = 'SUM(d.bytes) bytes,SUM(d.packets) packets,SUM(d.flows) records,IF(COUNT(d.first_seen)=COUNT(*),MIN(d.first_seen),NULL) first_seen,IF(COUNT(d.last_seen)=COUNT(*),MAX(d.last_seen),NULL) last_seen';
+		$order    = 'bytes DESC';
+
+		for ($round = 0; $round < 7 && $need <= 32768; $round++,$limit *= 2) {
+			$candidates = [];
+			$bound      = '0';
+			$exhausted  = true;
+
+			foreach ($segments as $segment) {
+				$sql  = 'SELECT ' . $fields . ',' . ($segment['daily'] ? $counters : $sum) . ' FROM ' . $segment['source'] . ' d WHERE ' . $where . ($segment['daily'] ? '' : ' GROUP BY ' . $group) . ' ORDER BY ' . $order . ' LIMIT ' . ($limit + 1);
+				$rows = flowview_db_fetch_assoc_prepared($sql, $args);
+
+				if (!is_array($rows)) {
+					throw new RuntimeException('Cannot read connection page');
+				}
+
+				if (cacti_sizeof($rows) > $limit) {
+					$exhausted = false;
+					$last      = array_pop($rows);
+					$bound     = fv_nbar_decimal_add($bound, $last['bytes']);
+				}
+
+				foreach ($rows as $row) {
+					$candidates[fv_nbar_connection_key($row, $names, $segment['listener'])] = $row;
+				}
+			}
+
+			if (!$candidates) {
+				flowview_db_execute('COMMIT');
+
+				return [];
+			}
+
+			// Sparse histories produce different candidates for each day. Bound
+			// cross-day probes before they cost more than one grouped SQL query.
+			if (cacti_sizeof($candidates) >= 1024) {
+				break;
+			}
+			// Look up every candidate in every day, including small contributions
+			// outside each day's top list. The final totals are exact, not sampled.
+			$totals = [];
+
+			foreach ($candidates as $key => $row) {
+				$tuple       = json_decode($key, true);
+				$row['name'] = null;
+
+				foreach ($nameRows as $name) {
+					if ((int) $name['name_id'] === $tuple[1]) {
+						$row['name'] = $name['name'];
+
+						break;
+					}
+				}
+				$row['first_seen']    = null;
+				$row['last_seen']     = null;
+				$row['_seen_missing'] = false;
+				$row['bytes']         = '0';
+				$row['packets']       = '0';
+				$row['records']       = '0';
+				$totals[$key]         = $row;
+			}
+			$tuples = [];
+
+			foreach ($candidates as $row) {
+				$tuples[json_encode([$row['router'] ?? '', $row['app_id'], $row['src_hex'], $row['dst_hex'], $row['sport'], $row['dport'], $row['protocol']])] = $row;
+			}
+
+			foreach ($segments as $segment) {
+				foreach (array_chunk(array_values($tuples), 400) as $chunk) {
+					$lookup = [];
+					$values = [];
+
+					foreach ($chunk as $row) {
+						$lookup[] = '(?,?,UNHEX(?),UNHEX(?),?,?,?)';
+						array_push($values, $row['router'] ?? '', $row['app_id'], $row['src_hex'], $row['dst_hex'], $row['sport'], $row['dport'], $row['protocol']);
+					}
+					$sql  = 'SELECT ' . $fields . ',' . ($segment['daily'] ? $counters : $sum) . ' FROM ' . $segment['source'] . ' d WHERE ' . $where . ' AND (' . $group . ') IN (' . implode(',', $lookup) . ')' . ($segment['daily'] ? '' : ' GROUP BY ' . $group);
+					$rows = flowview_db_fetch_assoc_prepared($sql, array_merge($args, $values));
+
+					if (!is_array($rows)) {
+						throw new RuntimeException('Cannot total connection page');
+					}
+
+					foreach ($rows as $row) {
+						$key = fv_nbar_connection_key($row, $names, $segment['listener']);
+
+						if (!isset($totals[$key])) {
+							continue;
+						}
+						fv_nbar_seen_merge($totals[$key], $row);
+
+						foreach (['bytes', 'packets', 'records'] as $counter) {
+							$totals[$key][$counter] = fv_nbar_decimal_add($totals[$key][$counter], $row[$counter]);
+						}
+					}
+				}
+			}
+			$ranked = [];
+
+			foreach ($totals as $key => $row) {
+				if ($row['_seen_missing']) {
+					$row['first_seen'] = null;
+					$row['last_seen']  = null;
+				} unset($row['_seen_missing']);
+				$row['_key'] = json_decode($key, true);
+				$ranked[]    = $row;
+			}
+			usort($ranked, 'fv_nbar_connection_compare');
+
+			// Any unseen connection has at most $bound bytes across all segments.
+			// Strict inequality also protects deterministic ties at page boundaries.
+			if ($exhausted || (cacti_sizeof($ranked) >= $need && fv_nbar_decimal_compare($ranked[$need - 1]['bytes'], $bound) > 0)) {
+				$result = array_slice($ranked, $offset, $size);
+
+				foreach ($result as &$row) {
+					$row['src'] = inet_ntop((string) hex2bin($row['src_hex']));
+					$row['dst'] = inet_ntop((string) hex2bin($row['dst_hex']));
+					unset($row['_key'],$row['src_hex'],$row['dst_hex']);
+				} unset($row);
+				flowview_db_execute('COMMIT');
+
+				return $result;
+			}
+		}
+		// Exact fallback for exceptionally deep pages or a flat traffic distribution.
+		$source = '(' . implode(' UNION ALL ', array_map(static function (array $segment): string {return 'SELECT * FROM ' . $segment['source'] . ' s'; }, $segments)) . ')';
+		$result = flowview_db_fetch_assoc_prepared(str_replace(' LIMIT 101 OFFSET ', ' LIMIT ' . $size . ' OFFSET ', fv_nbar_connections_sql($source, $where, $page)), $args);
+
+		if (!is_array($result)) {
+			throw new RuntimeException('Cannot read connection page');
+		}
+		flowview_db_execute('COMMIT');
+
+		return $result;
+	} catch (Throwable $e) {
+		flowview_db_execute('ROLLBACK');
+
+		throw $e;
+	}
+}
+
+// Cache requested pages, never an entire report. Authorization is in the key.
+/**
+ * Cache only requested connection pages within the current account.
+ *
+ * @param array  $listeners Selected capture identifiers.
+ * @param int    $start     Inclusive range start in Unix seconds.
+ * @param int    $end       Exclusive range end in Unix seconds.
+ * @param string $where     Validated filter predicate.
+ * @param array  $args      Prepared statement values.
+ * @param int    $page      One-based connection page.
+ *
+ * @return array
+ */
+function fv_nbar_connections_cached(array $listeners, int $start, int $end, string $where, array $args, int $page): array {
+	if (session_status() !== PHP_SESSION_ACTIVE) {
+		return fv_nbar_connections_direct($listeners, $start, $end, $where, $args, $page);
+	}
+	$block = max(1, (int) $page);
+	$slice = 0;
+	$key   = hash('sha256', serialize(['requested-page-seen-v3', $_SESSION['sess_user_id'] ?? 0, $listeners, $start, $end, $where, $args, $block]));
+	$cache = $_SESSION['fv_nbar_connection_pages'] ?? [];
+
+	foreach ($cache as $id => $entry) {
+		if ($entry['until'] <= time()) {
+			unset($cache[$id]);
+		}
+	}
+
+	if (isset($cache[$key])) {
+		$_SESSION['fv_nbar_connection_pages'] = $cache;
+
+		return array_slice($cache[$key]['rows'], $slice, 101);
+	}
+	$rows = fv_nbar_connections_direct($listeners, $start, $end, $where, $args, $block, 101);
+
+	if (strlen(serialize($rows)) <= 524288) {
+		while (cacti_sizeof($cache) >= 3) {
+			array_shift($cache);
+		} $cache[$key] = ['until' => time() + ($end < time() - 300 ? 120 : 30), 'rows' => $rows];
+	}
+	$_SESSION['fv_nbar_connection_pages'] = $cache;
+
+	return array_slice($rows, $slice, 101);
+}
diff --git a/includes/nbar_count.php b/includes/nbar_count.php
new file mode 100644
index 0000000..d9664cb
--- /dev/null
+++ b/includes/nbar_count.php
@@ -0,0 +1,191 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+// Exact connection counts, requested separately from page rendering.
+/**
+ * Count distinct connection tuples without regrouping traffic counters.
+ *
+ * @param string $source Trusted summary or raw SQL source.
+ * @param string $where  Validated filter predicate.
+ *
+ * @return string
+ */
+function fv_nbar_count_sql(string $source, string $where): string {
+	$map = '(SELECT router,app_id,DENSE_RANK() OVER (ORDER BY name) name_id FROM plugin_flowview_nbar_names)';
+
+	return 'SELECT COUNT(DISTINCT d.router,d.app_id,COALESCE(n.name_id,0),d.src,d.dst,d.sport,d.dport,d.protocol) total FROM ' . $source . ' d JOIN plugin_flowview_devices l ON l.id=d.listener_id LEFT JOIN ' . $map . ' n ON n.router=COALESCE(NULLIF(d.router,SPACE(0)),l.allowfrom) AND n.app_id=d.app_id WHERE ' . $where;
+}
+/**
+ * Store a bounded account-scoped context for an asynchronous exact count.
+ *
+ * @param string     $source    Trusted summary or raw SQL source.
+ * @param string     $where     Validated filter predicate.
+ * @param array      $args      Prepared statement values.
+ * @param int        $end       Exclusive range end in Unix seconds.
+ * @param array|null $listeners Selected capture identifiers.
+ * @param int|null   $start     Inclusive range start in Unix seconds.
+ *
+ * @return string
+ */
+function fv_nbar_count_context(string $source, string $where, array $args, int $end, ?array $listeners = null, ?int $start = null): string {
+	$scope = null;
+
+	// The source is rebuilt when the count runs, because a raw slice created in the meantime would
+	// otherwise be missing from the saved SQL.  Revision guards are evaluated in the count statement.
+	if ($listeners !== null && $start !== null) {
+		$scope  = ['where' => $where, 'listeners' => array_map('intval', $listeners), 'start' => (int) $start, 'end' => (int) $end];
+		$source = fv_nbar_summary_source('connections', $listeners, (int) $start, (int) $end);
+	}
+	$sql   = fv_nbar_count_sql($source, $where);
+	$key   = hash('sha256', serialize([$_SESSION['sess_user_id'] ?? 0, $scope ?? $sql, $args]));
+	$cache = $_SESSION['fv_nbar_counts'] ?? [];
+
+	foreach ($cache as $k => $entry) {
+		if ($entry['expires'] < time()) {
+			unset($cache[$k]);
+		}
+	}
+
+	if (!isset($cache[$key])) {
+		while (cacti_sizeof($cache) >= 12) {
+			array_shift($cache);
+		}
+		$cache[$key] = ['sql' => $sql, 'args' => $args, 'expires' => time() + 3600, 'ttl' => $end >= time() - 120 ? 60 : 600] + ($scope === null ? [] : ['scope' => $scope]);
+	}
+	$_SESSION['fv_nbar_counts'] = $cache;
+
+	return $key;
+}
+/**
+ * Send a JSON count response and terminate the HTTP request.
+ *
+ * @param array $payload JSON response fields.
+ *
+ * @return never
+ */
+function fv_nbar_count_response(array $payload): never {
+	header('Content-Type: application/json');
+	header('Cache-Control: no-store');
+	print json_encode($payload);
+	exit;
+}
+/**
+ * Handle an authenticated count request without blocking account navigation.
+ *
+ * @return never
+ */
+function fv_nbar_count_request(): never {
+	$key = get_nfilter_request_var('key');
+
+	if (!is_string($key) || !preg_match('/^[a-f0-9]{64}$/D', $key)) {
+		fv_nbar_count_response(['status' => 'expired']);
+	}
+	$entry = $_SESSION['fv_nbar_counts'][$key] ?? null;
+
+	if (!$entry || $entry['expires'] < time()) {
+		fv_nbar_count_response(['status' => 'expired']);
+	}
+
+	if (($entry['failed_until'] ?? 0) > time()) {
+		fv_nbar_count_response(['status' => 'unavailable']);
+	}
+
+	if (isset($entry['total']) && $entry['until'] > time()) {
+		fv_nbar_count_response(['status' => 'ready', 'pages' => (int) ceil($entry['total'] / 100), 'total' => $entry['total']]);
+	}
+	// Release the account session lock so navigation remains available during counting.
+	session_write_close();
+	$locked = flowview_db_fetch_cell("SELECT GET_LOCK(CONCAT('flowview_nbar_page_count:',LEFT(SHA2(DATABASE(),256),16)),0)");
+
+	if ((int) $locked !== 1) {
+		fv_nbar_count_response(['status' => 'busy']);
+	}
+	// Return promptly; subsequent polls read the completed session cache.
+	// PHP-FPM can finish this bounded calculation after closing the response.
+	ini_set('session.use_cookies', '0');
+	session_cache_limiter('');
+	$background = function_exists('fastcgi_finish_request');
+
+	if ($background) {
+		header('Content-Type: application/json');
+		header('Cache-Control: no-store');
+		print json_encode(['status' => 'busy']);
+		fastcgi_finish_request();
+	}
+	$row = null;
+
+	try {
+		set_time_limit(100);
+		$sql = isset($entry['scope']) ? fv_nbar_count_sql(fv_nbar_summary_source('connections', $entry['scope']['listeners'], $entry['scope']['start'], $entry['scope']['end']), $entry['scope']['where']) : $entry['sql'];
+		$row = fv_nbar_count_query($sql, $entry['args']);
+	} catch (RuntimeException $e) {
+		// The raw slices could not be listed, so the count is reported as unavailable.
+		cacti_log('NBAR count: ' . $e->getMessage(), false, 'FLOWVIEW');
+	} finally {
+		flowview_db_fetch_cell("SELECT RELEASE_LOCK(CONCAT('flowview_nbar_page_count:',LEFT(SHA2(DATABASE(),256),16)))");
+	}
+
+	if (!is_array($row) || !isset($row['total'])) {
+		session_start();
+
+		if (isset($_SESSION['fv_nbar_counts'][$key])) {
+			$_SESSION['fv_nbar_counts'][$key]['failed_until'] = time() + 60;
+		}
+		session_write_close();
+
+		if ($background) {
+			exit;
+		}
+		fv_nbar_count_response(['status' => 'unavailable']);
+	}
+	$total = (int) $row['total'];
+	session_start();
+
+	if (isset($_SESSION['fv_nbar_counts'][$key])) {
+		$_SESSION['fv_nbar_counts'][$key]['total'] = $total;
+		$_SESSION['fv_nbar_counts'][$key]['until'] = time() + $entry['ttl'];
+	}
+	session_write_close();
+
+	if ($background) {
+		exit;
+	}
+	fv_nbar_count_response(['status' => 'ready', 'pages' => (int) ceil($total / 100), 'total' => $total]);
+}
+
+/** Bound a SELECT on the actual FlowView server rather than Cacti's server. */
+function fv_nbar_count_query(string $sql, array $args): array|false|null {
+	$version = flowview_db_fetch_cell('SELECT VERSION()');
+
+	if (is_string($version) && stripos($version, 'MariaDB') !== false) {
+		return flowview_db_fetch_row_prepared('SET STATEMENT max_statement_time=90 FOR ' . $sql, $args);
+	}
+
+	if (is_string($version) && preg_match('/^8[.]/', $version)) {
+		return flowview_db_fetch_row_prepared(preg_replace('/^SELECT /', 'SELECT /*+ MAX_EXECUTION_TIME(90000) */ ', $sql), $args);
+	}
+
+	return false;
+}
diff --git a/includes/nbar_daily.php b/includes/nbar_daily.php
new file mode 100644
index 0000000..cd720aa
--- /dev/null
+++ b/includes/nbar_daily.php
@@ -0,0 +1,311 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Return local calendar-day boundaries, including daylight-saving changes.
+ *
+ * @param int $timestamp Unix observation time.
+ *
+ * @return array
+ */
+function fv_nbar_daily_bounds(int $timestamp): array {
+	$day = new DateTimeImmutable(date('Y-m-d', (int) $timestamp), new DateTimeZone(date_default_timezone_get()));
+
+	return [$day->getTimestamp(), $day->modify('+1 day')->getTimestamp()];
+}
+/**
+ * Require every overlapping hour to match its completed raw revision.
+ *
+ * @param int $listener Capture identifier.
+ * @param int $from     Inclusive boundary in Unix seconds.
+ * @param int $to       Exclusive boundary in Unix seconds.
+ *
+ * @return string|null
+ */
+function fv_nbar_daily_signature(int $listener, int $from, int $to): ?string {
+	$lo = (int) (floor($from / 3600) * 3600);
+	$hi = (int) (ceil($to / 3600) * 3600);
+	$r  = flowview_db_fetch_row_prepared('SELECT COUNT(*) n, COALESCE(SUM(revision),0) rev,
+        COALESCE(SUM(built=revision AND connection_built=revision AND built>=0),0) ready
+        FROM plugin_flowview_nbar_hours WHERE listener_id=? AND hour>=? AND hour<?', [$listener, $lo, $hi]);
+
+	return (int) ($r['n'] ?? 0) === (int) (($hi - $lo) / 3600) && (int) ($r['ready'] ?? 0) === (int) $r['n'] ? (string) $r['rev'] : null;
+}
+/**
+ * Build a SQL guard that rejects days invalidated by late records.
+ *
+ * @param int    $listener Capture identifier.
+ * @param int    $day      Local calendar-day start in Unix seconds.
+ * @param int    $to       Exclusive boundary in Unix seconds.
+ * @param string $revision Expected summary revision.
+ *
+ * @return string
+ */
+function fv_nbar_daily_guard(int $listener, int $day, int $to, string $revision): string {
+	$listener = (int) $listener;
+	$lo       = (int) (floor($day / 3600) * 3600);
+	$hi       = (int) (ceil($to / 3600) * 3600);
+	$count    = (int) (($hi - $lo) / 3600);
+	$revision = preg_match('/^[0-9]+$/', (string) $revision) ? $revision : '-1';
+
+	return "EXISTS (SELECT 1 FROM plugin_flowview_nbar_days WHERE listener_id=$listener AND day=$day AND covered_to=$to AND revision=$revision) AND (SELECT COUNT(*)=$count AND COALESCE(SUM(revision),0)=$revision AND
+        COALESCE(SUM(built=revision AND connection_built=revision AND built>=0),0)=$count
+        FROM plugin_flowview_nbar_hours WHERE listener_id=$listener AND hour>=$lo AND hour<$hi)";
+}
+/**
+ * Add one hour atomically or restart a day invalidated by late records.
+ *
+ * @param int $listener Capture identifier.
+ * @param int $day      Local calendar-day start in Unix seconds.
+ * @param int $target   Requested exclusive summary boundary.
+ *
+ * @return int
+ */
+function fv_nbar_daily_build(int $listener, int $day, int $target): int {
+	$listener = (int) $listener;
+	$day      = (int) $day;
+	$target   = (int) $target;
+
+	if (!flowview_db_execute('START TRANSACTION WITH CONSISTENT SNAPSHOT')) {
+		return 0;
+	}
+	$old   = flowview_db_fetch_row_prepared('SELECT * FROM plugin_flowview_nbar_days WHERE listener_id=? AND day=?', [$listener, $day]);
+	$valid = $old && $old['timezone']                                   === date_default_timezone_get() && (int) $old['covered_to'] <= $target &&
+		fv_nbar_daily_signature($listener, $day, (int) $old['covered_to']) === (string) $old['revision'];
+	$from = $valid ? (int) $old['covered_to'] : $day;
+
+	if ($from >= $target) {
+		flowview_db_execute('ROLLBACK');
+
+		return 0;
+	}
+	$to       = min($target, (int) (floor($from / 3600) * 3600 + 3600));
+	$revision = fv_nbar_daily_signature($listener, $day, $to);
+
+	if ($revision === null) {
+		flowview_db_execute('ROLLBACK');
+
+		return 0;
+	}
+	$statement_timeout = fv_nbar_worker_timeout(20);
+
+	if ($statement_timeout === null) {
+		flowview_db_execute('ROLLBACK');
+
+		return 0;
+	}
+
+	try {
+		foreach (['apps' => 'app_id,LENGTH(src)', 'pairs' => 'app_id,src,dst', 'connections' => 'app_id,src,dst,sport,dport,protocol'] as $kind => $fields) {
+			if (!$valid && !flowview_db_execute_prepared("DELETE FROM plugin_flowview_nbar_daily_$kind WHERE listener_id=? AND hour=?", [$listener, $day])) {
+				throw new RuntimeException('Daily reset failed');
+			}
+			$source = fv_nbar_hourly_source($kind, [$listener], $from, $to);
+			$sql    = "INSERT INTO plugin_flowview_nbar_daily_$kind SELECT $listener,$day,$fields,SUM(bytes),SUM(packets),SUM(flows),IF(COUNT(first_seen)=COUNT(*),MIN(first_seen),NULL),IF(COUNT(last_seen)=COUNT(*),MAX(last_seen),NULL),router
+                FROM $source d WHERE d.listener_id=$listener AND d.minute>=$from AND d.minute<$to GROUP BY $fields,router
+                ON DUPLICATE KEY UPDATE bytes=bytes+VALUES(bytes),packets=packets+VALUES(packets),flows=flows+VALUES(flows),first_seen=LEAST(first_seen,VALUES(first_seen)),last_seen=GREATEST(last_seen,VALUES(last_seen))";
+
+			if (!flowview_db_execute($sql)) {
+				throw new RuntimeException('Daily aggregate failed');
+			}
+		}
+
+		if (!flowview_db_execute_prepared(
+			'INSERT INTO plugin_flowview_nbar_days
+            (listener_id,day,covered_to,revision,timezone,updated) VALUES (?,?,?,?,?,?)
+            ON DUPLICATE KEY UPDATE covered_to=VALUES(covered_to),revision=VALUES(revision),timezone=VALUES(timezone),updated=VALUES(updated)',
+			[$listener, $day, $to, $revision, date_default_timezone_get(), time()]
+		)) {
+			throw new RuntimeException('Daily checkpoint failed');
+		}
+
+		if (!flowview_db_execute('COMMIT')) {
+			throw new RuntimeException('Daily commit failed');
+		}
+
+		return 1;
+	} catch (Throwable $e) {
+		flowview_db_execute('ROLLBACK');
+		cacti_log('NBAR daily summary: ' . $e->getMessage(), false, 'FLOWVIEW');
+
+		return 0;
+	} finally {
+		flowview_db_execute('SET SESSION max_statement_time=' . $statement_timeout);
+	}
+}
+/**
+ * Maintain reusable calendar-day summaries within a worker budget.
+ *
+ * @param int $budget Worker time budget in seconds.
+ *
+ * @return int
+ */
+function fv_nbar_daily_refresh(int $budget = 20): int {
+	if ((int) flowview_db_fetch_cell("SELECT GET_LOCK(CONCAT('flowview_nbar_daily:',LEFT(SHA2(DATABASE(),256),16)),0)") !== 1) {
+		return 0;
+	}
+	$deadline = microtime(true) + max(1, (int) $budget);
+	$done     = 0;
+
+	try {
+		$cutoff     = time() - fv_nbar_retention_days() * 86400;
+		$closed     = (int) (floor((time() - 300) / 3600) * 3600);
+		$listeners  = flowview_db_fetch_assoc('SELECT listener_id,MIN(hour) first_hour FROM plugin_flowview_nbar_hours GROUP BY listener_id');
+		$candidates = [];
+
+		foreach ($listeners as $row) {
+			$first_record = fv_nbar_data_edge((int) $row['listener_id'])['minute'] ?? 0;
+
+			if (!$first_record) {
+				continue;
+			}
+			$row['first_hour'] = (int) (floor((int) $first_record / 3600) * 3600);
+			[$first]           = fv_nbar_daily_bounds(max($cutoff, (int) $first_record));
+
+			if ($first >= $cutoff) {
+				for ($empty = (int) (floor($first / 3600) * 3600); $empty < (int) $row['first_hour']; $empty += 3600) {
+					flowview_db_execute_prepared('INSERT IGNORE INTO plugin_flowview_nbar_hours (listener_id,hour,revision,built,connection_built) VALUES (?,?,0,0,0)', [(int) $row['listener_id'], $empty]);
+				}
+			}
+			[$today] = fv_nbar_daily_bounds($closed);
+
+			for ($day = $first; $day <= $today; $day = $next) {
+				[, $next] = fv_nbar_daily_bounds($day);
+
+				if ($day < $cutoff) {
+					continue;
+				}
+				$candidates[] = [(int) $row['listener_id'], $day, min($next, $closed)];
+			}
+		}
+		// Finish older days first; each checkpoint appends only the next hour.
+		usort($candidates, static function (array $a, array $b): int {return $a[1] <=> $b[1] ?: $a[0] <=> $b[0]; });
+
+		do {
+			$progress = 0;
+
+			foreach ($candidates as [$listener,$day,$target]) {
+				if (microtime(true) >= $deadline) {
+					break 2;
+				}
+				$progress += fv_nbar_daily_build($listener, $day, $target);
+			}
+			$done += $progress;
+		} while ($progress && microtime(true) < $deadline);
+	} finally {
+		flowview_db_fetch_cell("SELECT RELEASE_LOCK(CONCAT('flowview_nbar_daily:',LEFT(SHA2(DATABASE(),256),16)))");
+	}
+
+	return $done;
+}
+/**
+ * Expire daily summary rows and checkpoints in bounded batches.
+ *
+ * @return void
+ */
+function fv_nbar_daily_cleanup(): void {
+	fv_nbar_cleanup_batches(fv_nbar_daily_cleanup_queries(), microtime(true) + 10);
+}
+/** Return allowlisted daily retention batches for the shared cleanup worker. */
+function fv_nbar_daily_cleanup_queries(): array {
+	$cutoff  = time() - fv_nbar_retention_days() * 86400;
+	$queries = [];
+
+	foreach (['apps', 'pairs', 'connections'] as $kind) {
+		$queries[] = ["DELETE FROM plugin_flowview_nbar_daily_$kind WHERE hour<$cutoff LIMIT 5000", 5000];
+	}
+	$queries[] = ["DELETE FROM plugin_flowview_nbar_days WHERE day<$cutoff LIMIT 100", 100];
+
+	return $queries;
+}
+/**
+ * Use valid full-day summaries and hourly or raw boundary records.
+ *
+ * @param string   $kind      Allowlisted summary type.
+ * @param array    $listeners Selected capture identifiers.
+ * @param int      $start     Inclusive range start in Unix seconds.
+ * @param int      $end       Exclusive range end in Unix seconds.
+ * @param int|null $now       Current Unix time, or null to read the clock.
+ *
+ * @return string
+ */
+function fv_nbar_summary_source(string $kind, array $listeners, int $start, int $end, ?int $now = null): string {
+	if (!in_array($kind, ['apps', 'pairs', 'connections'], true)) {
+		throw new InvalidArgumentException('Unknown summary kind');
+	}
+	$listeners = array_values(array_unique(array_filter(array_map('intval', $listeners), static function (int $id): bool {return $id > 0; })));
+
+	$start = (int) $start;
+	$end   = (int) $end;
+
+	if (!$listeners) {
+		return fv_nbar_data_source(fv_nbar_data_columns(), "minute>=$start AND minute<$end", $start, $end);
+	}
+	$now = $now ?? time();
+
+	if ($end - $start < 3600) {
+		return fv_nbar_hourly_source($kind, $listeners, $start, $end, $now);
+	}
+	$parts = [];
+
+	foreach ($listeners as $listener) {
+		$days   = flowview_db_fetch_assoc_prepared('SELECT * FROM plugin_flowview_nbar_days WHERE listener_id=? AND day>=? AND covered_to<=? AND covered_to>day ORDER BY day', [$listener, $start, $end]);
+		$cursor = $start;
+
+		foreach ($days as $row) {
+			$day = (int) $row['day'];
+			$to  = (int) $row['covered_to'];
+
+			if ($row['timezone'] !== date_default_timezone_get() || $day < $cursor || $to > (int) (floor(($now - 300) / 3600) * 3600)) {
+				continue;
+			}
+
+			if ($day > $cursor) {
+				$s       = fv_nbar_hourly_source($kind, [$listener], $cursor, $day, $now);
+				$parts[] = "SELECT * FROM $s fallback_before WHERE listener_id=$listener AND minute>=$cursor AND minute<$day";
+			}
+			$ready = fv_nbar_daily_guard($listener, $day, $to, $row['revision']);
+
+			if ($kind === 'apps') {
+				$fields = 'listener_id,hour minute,app_id,REPEAT(CHAR(0),family) src,REPEAT(CHAR(0),family) dst,0 sport,0 dport,0 protocol,bytes,packets,flows,first_seen,last_seen,router';
+			} elseif ($kind === 'pairs') {
+				$fields = 'listener_id,hour minute,app_id,src,dst,0 sport,0 dport,0 protocol,bytes,packets,flows,first_seen,last_seen,router';
+			} else {
+				$fields = 'listener_id,hour minute,app_id,src,dst,sport,dport,protocol,bytes,packets,flows,first_seen,last_seen,router';
+			}
+			$parts[] = "SELECT $fields FROM plugin_flowview_nbar_daily_$kind WHERE listener_id=$listener AND hour=$day AND ($ready)";
+			$s       = fv_nbar_hourly_source($kind, [$listener], $day, $to, $now);
+			$parts[] = "SELECT * FROM $s fallback_day WHERE listener_id=$listener AND minute>=$day AND minute<$to AND NOT ($ready)";
+			$cursor  = $to;
+		}
+
+		if ($cursor < $end) {
+			$s       = fv_nbar_hourly_source($kind, [$listener], $cursor, $end, $now);
+			$parts[] = "SELECT * FROM $s fallback_after WHERE listener_id=$listener AND minute>=$cursor AND minute<$end";
+		}
+	}
+
+	return '(' . implode(' UNION ALL ', $parts) . ')';
+}
diff --git a/includes/nbar_dns.php b/includes/nbar_dns.php
new file mode 100644
index 0000000..8ee6f35
--- /dev/null
+++ b/includes/nbar_dns.php
@@ -0,0 +1,115 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+// Uses FlowView's DNS cache and a bounded resolver budget.
+/**
+ * Resolve a host through persistent and bounded per-account DNS caches.
+ *
+ * @param string $ip Endpoint IP address.
+ *
+ * @return string
+ */
+function fv_nbar_dns(string $ip): string {
+	global $config;
+
+	if (($GLOBALS['fv_nbar_preferences']['dns'] ?? '1') === '0') {
+		return '';
+	}
+	static $names = [], $resolver = null, $started = null;
+
+	if (array_key_exists($ip, $names)) {
+		return $names[$ip];
+	}
+	$cache = flowview_db_fetch_row_prepared('SELECT host FROM plugin_flowview_dnscache WHERE ip = ? AND source IN (?,?,?)', [$ip, 'DNS', 'Local DNS', 'Specified DNS']);
+
+	if (!empty($cache['host'])) {
+		return $names[$ip] = ($cache['host'] === $ip ? __('No reverse DNS', 'flowview') : $cache['host']);
+	}
+	$negative = $_SESSION['fv_nbar_dns_negative'] ?? [];
+
+	if (isset($negative[$ip]) && $negative[$ip]['until'] > time()) {
+		return $names[$ip] = $negative[$ip]['name'];
+	}
+
+	if ($started === null) {
+		$started = microtime(true);
+	}
+
+	if (microtime(true) - $started > 1) {
+		return $names[$ip] = __('Not resolved', 'flowview');
+	}
+
+	if ($resolver === null) {
+		set_include_path($config['base_path'] . '/plugins/flowview' . PATH_SEPARATOR . get_include_path());
+		require_once($config['base_path'] . '/plugins/flowview/Net/DNS2.php');
+		$servers           = array_filter([read_config_option('settings_dns_primary'), read_config_option('settings_dns_secondary')]);
+		$resolver          = new Net_DNS2_Resolver($servers ? ['nameservers' => array_values($servers)] : []);
+		$resolver->timeout = 1;
+	}
+
+	try {
+		$response = $resolver->query($ip, 'PTR');
+
+		foreach ($response->answer as $answer) {
+			if (!empty($answer->ptrdname)) {
+				$name = rtrim($answer->ptrdname, '.');
+				flowview_db_execute_prepared('INSERT INTO plugin_flowview_dnscache (ip,host,source,arin_verified,arin_id,time) VALUES (?,?,?,0,0,?) ON DUPLICATE KEY UPDATE host=VALUES(host),source=VALUES(source),time=VALUES(time)', [$ip, $name, 'DNS', time()]);
+
+				return $names[$ip] = $name;
+			}
+		}
+
+		return $names[$ip] = fv_nbar_dns_negative($ip, __('No reverse DNS', 'flowview'), 300);
+	} catch (Exception $e) {
+		return $names[$ip] = fv_nbar_dns_negative($ip, $e->getCode() === 3 ? __('No reverse DNS', 'flowview') : __('Not resolved', 'flowview'), $e->getCode() === 3 ? 300 : 30);
+	}
+}
+
+/**
+ * Cache a negative DNS result with bounded account-session storage.
+ *
+ * @param string $ip   Endpoint IP address.
+ * @param string $name Cached DNS result label.
+ * @param int    $ttl  Cache lifetime in seconds.
+ *
+ * @return string
+ */
+function fv_nbar_dns_negative(string $ip, string $name, int $ttl): string {
+	$cache = $_SESSION['fv_nbar_dns_negative'] ?? [];
+
+	foreach ($cache as $key => $entry) {
+		if ($entry['until'] <= time()) {
+			unset($cache[$key]);
+		}
+	}
+	$cache[$ip] = ['name' => $name, 'until' => time() + $ttl];
+
+	if (cacti_sizeof($cache) > 512) {
+		$cache = array_slice($cache, -512, null, true);
+	}
+	$_SESSION['fv_nbar_dns_negative'] = $cache;
+
+	return $name;
+}
diff --git a/includes/nbar_feed_status.php b/includes/nbar_feed_status.php
new file mode 100644
index 0000000..1ec72c7
--- /dev/null
+++ b/includes/nbar_feed_status.php
@@ -0,0 +1,67 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Render record freshness independently for each selected capture.
+ *
+ * @param array $devices     Available capture definitions.
+ * @param array $capture_ids Selected capture identifiers.
+ *
+ * @return void
+ */
+function fv_nbar_feed_status(array $devices, array $capture_ids): void {
+	$now = time();
+	print '<div class="nbar-feed-status"><strong>' . fv_nbar_h(__('STATUS:', 'flowview')) . '</strong> ';
+	$items = [];
+
+	foreach ($devices as $device) {
+		$id = (int) $device['id'];
+
+		if (!in_array($id, $capture_ids, true)) {
+			continue;
+		}
+		// Indexed lookup independent of historical report filters.
+		$latest = fv_nbar_data_edge($id, true);
+
+		if (!is_array($latest)) {
+			$items[] = '<span class="textError">' . fv_nbar_h($device['name']) . ': ' . fv_nbar_h(__('Unable to load NBAR status. Please try again.', 'flowview')) . '</span>';
+
+			continue;
+		}
+		$last      = isset($latest['minute']) ? (int) $latest['minute'] : 0;
+		$receiving = $last > 0 && $last >= $now - 300 && $last <= $now + 60;
+		$label     = $receiving ? __('Receiving', 'flowview') : __('No recent NBAR', 'flowview');
+		$seen      = $last > 0 ? __('Last NBAR record: %s', date('Y-m-d H:i', $last), 'flowview') : __('No retained NBAR records', 'flowview');
+		$icon      = $receiving ? 'fa-check-circle' : 'fa-times-circle';
+		$color     = $receiving ? '#27852b' : '#d32f2f';
+		$items[]   = '<span title="' . fv_nbar_h($seen) . '"><i class="fa ' . $icon . '" style="color:' . $color . '" aria-hidden="true"></i> ' . fv_nbar_h($device['name']) . ': ' . fv_nbar_h($label) . ' <small>(' . fv_nbar_h($seen) . ')</small></span>';
+	}
+	print implode(' &nbsp; | &nbsp; ', $items);
+
+	if (!$items) {
+		print fv_nbar_h(__('No captures selected', 'flowview'));
+	}
+	print '</div>';
+}
diff --git a/includes/nbar_partition.php b/includes/nbar_partition.php
new file mode 100644
index 0000000..6299938
--- /dev/null
+++ b/includes/nbar_partition.php
@@ -0,0 +1,273 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/*
+ * The raw NBAR records are stored one table per time slice, the same way the raw flow tables
+ * are: plugin_flowview_nbar_data_<year><day of year>[<hour>].  The Database Partitioning Scheme
+ * setting picks hourly (the default) or daily slices, slices are created when the first record
+ * for them arrives, and expired slices are dropped instead of deleted row by row.
+ *
+ * Slices are named by UTC time.  NBAR's hour boundaries are UTC aligned, so a UTC hour is always
+ * inside exactly one hourly slice, and the repeated hour when daylight saving time ends cannot
+ * make two different hours share a table.  Readers never recompute names: they list the slices
+ * that exist and test each slice's time range, so slices from before a scheme change keep working.
+ */
+
+/**
+ * The raw record columns shared by every slice, with the observation dates the summaries expect.
+ *
+ * @return string
+ */
+function fv_nbar_data_columns(): string {
+	return 'listener_id,minute,app_id,src,dst,sport,dport,protocol,bytes,packets,flows,minute first_seen,minute last_seen,router';
+}
+
+/**
+ * Name the slice that holds the records of a given minute.
+ *
+ * @param int $time Unix time of the record.
+ *
+ * @return string
+ */
+function fv_nbar_data_table(int $time): string {
+	$suffix = gmdate('Y', $time) . substr('000' . gmdate('z', $time), -3);
+
+	if ((string) read_config_option('flowview_partition') !== '0') {
+		$suffix .= gmdate('H', $time);
+	}
+
+	return 'plugin_flowview_nbar_data_' . $suffix;
+}
+
+/**
+ * The time range [start, end) covered by a slice, taken from its name.
+ *
+ * @param string $table Slice table name.
+ *
+ * @return array{0: int, 1: int}|null null when the name is not a slice.
+ */
+function fv_nbar_data_bounds(string $table): ?array {
+	if (!preg_match('/^plugin_flowview_nbar_data_([0-9]{4})([0-9]{3})([0-9]{2})?$/D', $table, $match)) {
+		return null;
+	}
+	$hourly = isset($match[3]);
+
+	if ((int) $match[2] > 365 || ($hourly && (int) $match[3] > 23)) {
+		return null;
+	}
+	$start = (int) gmmktime($hourly ? (int) $match[3] : 0, 0, 0, 1, 1 + (int) $match[2], (int) $match[1]);
+
+	return [$start, $start + ($hourly ? 3600 : 86400)];
+}
+
+/**
+ * List the slices that exist, oldest first.
+ *
+ * @throws RuntimeException When the database cannot list its tables, so a failure is never mistaken for "no slices".
+ *
+ * @return list<array{table: string, start: int, end: int}>
+ */
+function fv_nbar_data_tables(): array {
+	$rows = flowview_db_fetch_assoc("SHOW TABLES LIKE 'plugin\\_flowview\\_nbar\\_data\\_%'");
+
+	if (!is_array($rows)) {
+		throw new RuntimeException('Cannot list the NBAR raw tables');
+	}
+	$tables = [];
+
+	foreach ($rows as $row) {
+		$name   = (string) reset($row);
+		$bounds = fv_nbar_data_bounds($name);
+
+		if ($bounds !== null) {
+			$tables[] = ['table' => $name, 'start' => $bounds[0], 'end' => $bounds[1]];
+		}
+	}
+	usort($tables, static fn (array $a, array $b): int => [$a['start'], $a['table']] <=> [$b['start'], $b['table']]);
+
+	return $tables;
+}
+
+/**
+ * The existing slices that overlap a time range.
+ *
+ * @param int                                                   $from   Inclusive range start in Unix seconds.
+ * @param int                                                   $to     Exclusive range end in Unix seconds.
+ * @param list<array{table: string, start: int, end: int}>|null $tables Slices from fv_nbar_data_tables(), or null to list them.
+ *
+ * @return list<string>
+ */
+function fv_nbar_data_slices(int $from, int $to, ?array $tables = null): array {
+	$slices = [];
+
+	foreach ($tables ?? fv_nbar_data_tables() as $slice) {
+		if ($slice['start'] < $to && $slice['end'] > $from) {
+			$slices[] = $slice['table'];
+		}
+	}
+
+	return $slices;
+}
+
+/**
+ * One SELECT per slice that overlaps the range, each carrying the same filter so no slice is read whole.
+ *
+ * @param string                                                $columns Select list.
+ * @param string                                                $where   Trusted filter.
+ * @param int                                                   $from    Inclusive range start in Unix seconds.
+ * @param int                                                   $to      Exclusive range end in Unix seconds.
+ * @param list<array{table: string, start: int, end: int}>|null $tables  Slices from fv_nbar_data_tables(), or null to list them.
+ *
+ * @return list<string>
+ */
+function fv_nbar_data_parts(string $columns, string $where, int $from, int $to, ?array $tables = null): array {
+	return array_map(
+		static fn (string $table): string => "SELECT $columns FROM `$table` WHERE $where",
+		fv_nbar_data_slices($from, $to, $tables)
+	);
+}
+
+/**
+ * A relation over the slices of a range.  An empty relation with the right columns is returned
+ * when no slice exists yet, so reports on a fresh installation still run.
+ *
+ * @param string                                                $columns Select list.
+ * @param string                                                $where   Trusted filter.
+ * @param int                                                   $from    Inclusive range start in Unix seconds.
+ * @param int                                                   $to      Exclusive range end in Unix seconds.
+ * @param list<array{table: string, start: int, end: int}>|null $tables  Slices from fv_nbar_data_tables(), or null to list them.
+ *
+ * @return string
+ */
+function fv_nbar_data_source(string $columns, string $where, int $from, int $to, ?array $tables = null): string {
+	$parts = fv_nbar_data_parts($columns, $where, $from, $to, $tables);
+
+	if (!$parts) {
+		$parts[] = "SELECT $columns FROM (SELECT CAST(0 AS UNSIGNED) listener_id,CAST(0 AS UNSIGNED) minute,CAST('' AS CHAR(32)) app_id,CAST('' AS BINARY(16)) src,CAST('' AS BINARY(16)) dst,CAST(0 AS UNSIGNED) sport,CAST(0 AS UNSIGNED) dport,CAST(0 AS UNSIGNED) protocol,CAST(0 AS UNSIGNED) bytes,CAST(0 AS UNSIGNED) packets,CAST(0 AS UNSIGNED) flows,CAST('' AS CHAR(45)) router) fv_nbar_empty WHERE 1=0";
+	}
+
+	return '(' . implode(' UNION ALL ', $parts) . ')';
+}
+
+/**
+ * Create a slice the first time a record for it arrives.  The answer is remembered for a minute so
+ * the collector does not check for the table on every packet.
+ *
+ * @param string $table Slice table name.
+ *
+ * @return bool
+ */
+function fv_nbar_data_ensure(string $table): bool {
+	if (($GLOBALS['fv_nbar_data_known'][$table] ?? 0) > time() - 60) {
+		return true;
+	}
+
+	if (!flowview_db_create_nbar_data_partition($table)) {
+		return false;
+	}
+	$GLOBALS['fv_nbar_data_known'][$table] = time();
+
+	return true;
+}
+
+/**
+ * Drop the slices that ended before the retention cutoff.
+ *
+ * @param int        $cutoff   Unix time before which records are no longer retained.
+ * @param float|null $deadline Unix time with microseconds after which no further slice is dropped, or null for no limit.
+ *
+ * @return int The number of slices dropped.
+ */
+function fv_nbar_data_drop_expired(int $cutoff, ?float $deadline = null): int {
+	$dropped = 0;
+
+	try {
+		$tables = fv_nbar_data_tables();
+	} catch (RuntimeException $e) {
+		// Nothing is dropped; retention simply runs again on the next maintenance pass.
+		return 0;
+	}
+
+	// Oldest slices first, so an interrupted pass leaves only the newest expired slices for the next one.
+	foreach ($tables as $slice) {
+		if ($deadline !== null && microtime(true) >= $deadline) {
+			break;
+		}
+
+		if ($slice['end'] <= $cutoff && flowview_db_execute('DROP TABLE IF EXISTS `' . $slice['table'] . '`') !== false) {
+			unset($GLOBALS['fv_nbar_data_known'][$slice['table']]);
+			$dropped++;
+		}
+	}
+
+	return $dropped;
+}
+
+/**
+ * The oldest or newest retained record of a capture.
+ *
+ * The slices are probed in batches of 32, one query per batch, so a capture with no records does
+ * not cost a query per retained slice.
+ *
+ * @param int  $listener Capture identifier.
+ * @param bool $latest   True for the newest record instead of the oldest.
+ *
+ * @return array|false A row with the minute, an empty array when the capture has no records, or false when the database cannot be read.
+ */
+function fv_nbar_data_edge(int $listener, bool $latest = false): array|false {
+	try {
+		$tables = fv_nbar_data_tables();
+	} catch (RuntimeException $e) {
+		return false;
+	}
+
+	// Slices from different schemes overlap, so the first slice with a record is not necessarily the
+	// answer.  Keep going until no remaining slice can hold an earlier (or later) minute.
+	if ($latest) {
+		usort($tables, static fn (array $a, array $b): int => [$b['end'], $b['table']] <=> [$a['end'], $a['table']]);
+	}
+	$found = [];
+
+	foreach (array_chunk($tables, 32) as $batch) {
+		if ($found && ($latest ? $batch[0]['end'] <= (int) $found['minute'] : $batch[0]['start'] >= (int) $found['minute'])) {
+			break;
+		}
+		$members = array_map(
+			static fn (array $slice): string => '(SELECT minute FROM `' . $slice['table'] . '` WHERE listener_id=? ORDER BY minute' . ($latest ? ' DESC' : '') . ' LIMIT 1)',
+			$batch
+		);
+		$row = flowview_db_fetch_row_prepared('SELECT ' . ($latest ? 'MAX' : 'MIN') . '(minute) minute FROM (' . implode(' UNION ALL ', $members) . ') edge', array_fill(0, cacti_sizeof($batch), $listener));
+
+		if (!is_array($row)) {
+			return false;
+		}
+
+		if (isset($row['minute']) && (!$found || ($latest ? (int) $row['minute'] > (int) $found['minute'] : (int) $row['minute'] < (int) $found['minute']))) {
+			$found = ['minute' => $row['minute']];
+		}
+	}
+
+	return $found;
+}
diff --git a/includes/nbar_preferences.php b/includes/nbar_preferences.php
new file mode 100644
index 0000000..e9e459c
--- /dev/null
+++ b/includes/nbar_preferences.php
@@ -0,0 +1,201 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+// Personal report preferences; classification only, never router configuration.
+/**
+ * Validate and normalize up to 32 internal network prefixes.
+ *
+ * @param string $text Network prefixes supplied by the account.
+ *
+ * @return array|false
+ */
+function fv_nbar_cidrs(string $text): array|false {
+	$out = [];
+
+	foreach (preg_split('/[\s,]+/', trim($text), -1, PREG_SPLIT_NO_EMPTY) ?: [] as $cidr) {
+		$parts = explode('/', $cidr);
+
+		if (cacti_sizeof($parts) !== 2 || !ctype_digit($parts[1]) || !filter_var($parts[0], FILTER_VALIDATE_IP)) {
+			return false;
+		}
+		$packed = (string) inet_pton($parts[0]);
+		$bits   = (int) $parts[1];
+
+		if ($bits < 0 || $bits > strlen($packed) * 8) {
+			return false;
+		}
+		$out[] = inet_ntop($packed) . '/' . $bits;
+
+		if (cacti_sizeof($out) > 32) {
+			return false;
+		}
+	}
+
+	return array_values(array_unique($out));
+}
+/**
+ * Load account preferences and validate a protected settings submission.
+ *
+ * @param array $devices Available capture definitions.
+ *
+ * @return array
+ */
+function fv_nbar_preferences_init(array $devices): array {
+	$defaults = ['prefixes' => [], 'listeners' => [], 'data_unit' => 'GB', 'rate_unit' => 'Mbps', 'dns' => '1'];
+	$saved    = json_decode((string) read_user_setting('flowview_nbar_preferences', ''), true);
+	$p        = array_replace($defaults, is_array($saved) ? $saved : ($_SESSION['fv_nbar_preferences'] ?? []));
+
+	if (!is_array($p['prefixes']) || !fv_nbar_cidrs(implode("\n", $p['prefixes']))) {
+		$p['prefixes'] = $defaults['prefixes'];
+	}
+	$p['listeners'] = is_array($p['listeners']) ? array_values(array_intersect(array_map('intval', $p['listeners']), array_map('intval', array_column($devices, 'id')))) : $defaults['listeners'];
+
+	if (!$p['listeners']) {
+		$p['listeners'] = $defaults['listeners'];
+	}
+	$message                              = '';
+	$GLOBALS['fv_nbar_preferences_saved'] = false;
+
+	if (($_SERVER['REQUEST_METHOD'] ?? '') === 'POST' && get_nfilter_request_var('prefs_apply') === '1') {
+		if (!function_exists('csrf_check') || !csrf_check(false)) {
+			http_response_code(403);
+			exit;
+		}
+		$candidate = $p;
+		$prefixes  = is_string(get_nfilter_request_var('local_prefixes', null)) ? fv_nbar_cidrs(get_nfilter_request_var('local_prefixes')) : false;
+		$ids       = is_array(get_nfilter_request_var('site_listeners', null)) ? get_nfilter_request_var('site_listeners') : [];
+		$ids       = array_filter($ids, 'is_scalar');
+		$ids       = array_values(array_intersect(array_map('intval', $ids), array_map('intval', array_column($devices, 'id'))));
+
+		if ($prefixes === false) {
+			$message = __('Settings were not saved. Enter valid IPv4/IPv6 networks, or leave the list blank.', 'flowview');
+		} elseif (cacti_sizeof(array_unique($ids)) > 3 || (isset_request_var('combine_apply') && cacti_sizeof(array_unique($ids)) === 1)) {
+			$message = __('Settings were not saved. Choose two or three captures to combine, or clear all selections to save Internal Networks only.', 'flowview');
+		} else {
+			$candidate['prefixes']  = $prefixes;
+			$candidate['listeners'] = array_values(array_unique($ids));
+
+			foreach (['data_unit' => ['Auto', 'MB', 'GB'], 'rate_unit' => ['Auto', 'Kbps', 'Mbps'], 'dns' => ['0', '1']] as $key => $allowed) {
+				if (is_string(get_nfilter_request_var($key, null)) && in_array(get_nfilter_request_var($key), $allowed, true)) {
+					$candidate[$key] = get_nfilter_request_var($key);
+				}
+			}
+			$_SESSION['fv_nbar_preferences']      = $p = $candidate;
+			$GLOBALS['fv_nbar_preferences_saved'] = true;
+			set_user_setting('flowview_nbar_preferences', json_encode($p));
+			$message = '';
+		}
+	}
+	$GLOBALS['fv_nbar_preferences']         = $p;
+	$GLOBALS['fv_nbar_preferences_message'] = $message;
+
+	return $p;
+}
+/**
+ * Build the internal-network predicate for a permitted address column.
+ *
+ * @param string $f Permitted address-column name.
+ *
+ * @return string
+ */
+function fv_nbar_local_sql(string $f): string {
+	if (!in_array($f, ['d.src', 'd.dst'], true)) {
+		throw new InvalidArgumentException('Invalid address field');
+	}
+	$clauses = [];
+
+	foreach ($GLOBALS['fv_nbar_preferences']['prefixes'] as $cidr) {
+		[$ip,$bits] = explode('/', $cidr);
+		$packed     = (string) inet_pton($ip);
+		$bits       = (int) $bits;
+		$whole      = intdiv($bits, 8);
+		$rest       = $bits % 8;
+		$checks     = ['LENGTH(' . $f . ')=' . strlen($packed)];
+
+		if ($whole) {
+			$checks[] = "LEFT(HEX($f)," . ($whole * 2) . ")='" . strtoupper(bin2hex(substr($packed, 0, $whole))) . "'";
+		}
+
+		if ($rest) {
+			$mask     = (255 << (8 - $rest)) & 255;
+			$value    = ord($packed[$whole]) & $mask;
+			$checks[] = "(ORD(SUBSTRING($f," . ($whole + 1) . ",1)) & $mask)=$value";
+		}
+		$clauses[] = '(' . implode(' AND ', $checks) . ')';
+	}
+
+	return $clauses ? '(' . implode(' OR ', $clauses) . ')' : '(0)';
+}
+/**
+ * Render protected capture options, networks and display preferences.
+ *
+ * @param array  $devices    Available capture definitions.
+ * @param string $base       Report base URL.
+ * @param string $mode       Current report mode.
+ * @param string $aid        Current application identifier.
+ * @param string $parent_app Parent application drilldown identifier.
+ *
+ * @return void
+ */
+function fv_nbar_preferences_render(array $devices, string $base, string $mode, string $aid, string $parent_app): void {
+	global $config;
+	$p = $GLOBALS['fv_nbar_preferences'];
+	print '<div id="nbarPreferences"><input type="hidden" name="prefs_apply" value="1">';
+
+	if ($GLOBALS['fv_nbar_preferences_message'] !== '') {
+		print '<p role="status">' . fv_nbar_h($GLOBALS['fv_nbar_preferences_message']) . '</p>';
+	}
+	print '<div class="nbarSettingsRow">';
+
+	foreach (['data_unit' => [__('Data units', 'flowview'), ['Auto', 'MB', 'GB']], 'rate_unit' => [__('Bandwidth units', 'flowview'), ['Auto', 'Kbps', 'Mbps']], 'dns' => [__('DNS names', 'flowview'), ['1' => __('Show', 'flowview'), '0' => __('Hide', 'flowview')]]] as $key => $definition) {
+		print '<div class="nbarSetting"><label for="nbar_' . $key . '">' . html_escape($definition[0]) . '</label><select id="nbar_' . $key . '" name="' . $key . '">';
+
+		foreach ($definition[1] as $v => $label) {
+			if ($key !== 'dns') {
+				$v = $label;
+			}
+			print '<option value="' . fv_nbar_h($v) . '"' . ((string) $p[$key] === (string) $v ? ' selected' : '') . '>' . html_escape($label === 'Auto' ? __('Auto', 'flowview') : $label) . '</option>';
+		}
+		print '</select></div>';
+	}
+	print '</div><dialog id="nbarCombineDialog" class="ui-widget ui-widget-content ui-corner-all" aria-labelledby="nbarCombineTitle"><div class="nbarCombineHeader ui-widget-header"><strong id="nbarCombineTitle">' . html_escape(__('Options', 'flowview')) . '</strong><button type="button" id="nbarCombineClose" class="ui-button ui-corner-all ui-widget">' . html_escape(__('Close', 'flowview')) . '</button></div><div class="nbarCombineBody"><h3>' . html_escape(__('Combine Options', 'flowview')) . '</h3><p id="nbarRouterSelectionCount"></p><div>';
+
+	foreach ($devices as $d) {
+		print '<label style="display:block;white-space:nowrap"><input type="checkbox" name="site_listeners[]" value="' . (int) $d['id'] . '"' . (in_array((int) $d['id'], $p['listeners'], true) ? ' checked' : '') . '> ' . fv_nbar_h($d['name']) . '</label>';
+	}
+	print '<small>' . html_escape(__('Choose two or three captures to combine, normally one LAN capture per router. Leave all captures unticked to save Internal Networks only. Overlapping LAN and WAN captures are added together and can count traffic twice.', 'flowview')) . '</small></div>';
+	print '<div style="margin-top:20px"><h3><label for="nbarPrefixes">' . html_escape(__('Internal Networks', 'flowview')) . '</label></h3><textarea id="nbarPrefixes" name="local_prefixes" rows="5" cols="44">' . fv_nbar_h(implode("\n", $p['prefixes'])) . '</textarea><p>' . html_escape(__('One internal IPv4 or IPv6 network per line. Used to identify internal hosts and upload/download direction in Conversations. Update delegated IPv6 prefixes when they change, and keep old prefixes for retained history. Exported flows do not automatically identify your site networks.', 'flowview')) . '</p><button type="submit" id="nbarCombineSave" name="combine_apply" value="1" class="ui-button ui-corner-all ui-widget">' . html_escape(__('Save', 'flowview')) . '</button> <button type="button" id="nbarCombineCancel" class="ui-button ui-corner-all ui-widget">' . html_escape(__('Cancel', 'flowview')) . '</button></div></div></dialog></div>';
+	print '<script ' . plugin_flowview_csp_nonce() . '>window.fvNbarDisplay=' . json_encode(['data' => $p['data_unit'], 'rate' => $p['rate_unit'], 'dns' => $p['dns'], 'labels' => ['selection' => __('{count} of 3 selected', 'flowview'), 'single' => __(' — select another capture or untick all to save', 'flowview'), 'off' => __(' — combining off', 'flowview'), 'rate' => __('Average rate across the selected timespan.', 'flowview'), 'data' => __('Decimal units: 1 GB = 1,000 MB.', 'flowview')]], JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';</script>';
+	print '<script src="' . plugin_flowview_escape_attr($config['url_path'] . 'plugins/flowview/js/nbar-preferences.js') . '"></script>';
+}
+
+/** Exclude multicast endpoints from internal/external conversations. */
+function fv_nbar_unicast_sql(string $field): string {
+	if (!in_array($field, ['d.src', 'd.dst'], true)) {
+		throw new InvalidArgumentException('Invalid address field');
+	}
+
+	return "NOT ((LENGTH($field)=4 AND (ORD(SUBSTRING($field,1,1)) & 240)=224) OR (LENGTH($field)=16 AND ORD(SUBSTRING($field,1,1))=255))";
+}
diff --git a/includes/nbar_query.php b/includes/nbar_query.php
new file mode 100644
index 0000000..2018904
--- /dev/null
+++ b/includes/nbar_query.php
@@ -0,0 +1,92 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Fetch a bounded report result with a short account-session cache.
+ *
+ * @param string $sql  Trusted SQL statement.
+ * @param array  $args Prepared statement values.
+ *
+ * @return array|false
+ */
+function fv_nbar_query_cached(string $sql, array $args): array|false {
+	if (session_status() !== PHP_SESSION_ACTIVE) {
+		return flowview_db_fetch_assoc_prepared($sql, $args);
+	}
+	// Fetch five adjacent pages together; retain one extra row for Next.
+	$slice = null;
+
+	if (preg_match('/ LIMIT 101 OFFSET ([0-9]+)(?=\)|$)/', $sql, $match)) {
+		$offset = (int) $match[1];
+		$block  = (int) (floor($offset / 500) * 500);
+		$slice  = $offset - $block;
+		$sql    = preg_replace('/ LIMIT 101 OFFSET [0-9]+(?=\)|$)/', ' LIMIT 501 OFFSET ' . $block, $sql);
+	}
+	$now   = time();
+	$key   = hash('sha256', serialize([$_SESSION['sess_user_id'] ?? 0, $sql, $args]));
+	$cache = $_SESSION['fv_nbar_query_cache'] ?? [];
+
+	foreach ($cache as $id => $entry) {
+		if ($entry['until'] <= $now) {
+			unset($cache[$id]);
+		}
+	}
+
+	if (isset($cache[$key])) {
+		$_SESSION['fv_nbar_query_cache'] = $cache;
+
+		return $slice === null ? $cache[$key]['rows'] : array_slice($cache[$key]['rows'], $slice, 101);
+	}
+	$rows = flowview_db_fetch_assoc_prepared($sql, $args);
+
+	// Cache successful, compact result sets only; never retain query failures.
+	if (is_array($rows) && strlen(serialize($rows)) <= 524288) {
+		while (cacti_sizeof($cache) >= 12) {
+			array_shift($cache);
+		}
+		$cache[$key] = ['until' => time() + ($slice === null ? 30 : 120), 'rows' => $rows];
+	}
+	$_SESSION['fv_nbar_query_cache'] = $cache;
+
+	return $slice === null || !is_array($rows) ? $rows : array_slice($rows, $slice, 101);
+}
+
+/**
+ * Build an exact grouped connection-page query over a trusted source.
+ *
+ * @param string $source Trusted summary or raw SQL source.
+ * @param string $where  Validated filter predicate.
+ * @param int    $page   One-based connection page.
+ *
+ * @return string
+ */
+function fv_nbar_connections_sql(string $source, string $where, int $page): string {
+	// Use compact name ranks while grouping; resolve display names after paging.
+	$map   = '(SELECT router,app_id,DENSE_RANK() OVER (ORDER BY name) name_id FROM plugin_flowview_nbar_names)';
+	$group = 'd.app_id,COALESCE(n.name_id,0),d.src,d.dst,d.sport,d.dport,d.protocol,d.router';
+	$inner = 'SELECT d.router,d.app_id,COALESCE(n.name_id,0) name_id,SUM(d.bytes) bytes,SUM(d.packets) packets,SUM(d.flows) records,IF(COUNT(d.first_seen)=COUNT(*),MIN(d.first_seen),NULL) first_seen,IF(COUNT(d.last_seen)=COUNT(*),MAX(d.last_seen),NULL) last_seen,d.src,d.dst,d.sport,d.dport,d.protocol FROM ' . $source . ' d JOIN plugin_flowview_devices l ON l.id=d.listener_id LEFT JOIN ' . $map . ' n ON n.router=COALESCE(NULLIF(d.router,SPACE(0)),l.allowfrom) AND n.app_id=d.app_id WHERE ' . $where . ' GROUP BY ' . $group . ' ORDER BY bytes DESC,' . $group . ' LIMIT 101 OFFSET ' . (($page - 1) * 100);
+
+	return 'SELECT d.router,d.app_id,n.name,d.bytes,d.packets,d.records,d.first_seen,d.last_seen,INET6_NTOA(d.src) src,INET6_NTOA(d.dst) dst,d.sport,d.dport,d.protocol FROM (' . $inner . ') d LEFT JOIN (SELECT name,DENSE_RANK() OVER (ORDER BY name) name_id FROM plugin_flowview_nbar_names GROUP BY name) n ON n.name_id=d.name_id ORDER BY d.bytes DESC,d.app_id,d.name_id,d.src,d.dst,d.sport,d.dport,d.protocol,d.router';
+}
diff --git a/includes/nbar_seen.php b/includes/nbar_seen.php
new file mode 100644
index 0000000..cc4a5ac
--- /dev/null
+++ b/includes/nbar_seen.php
@@ -0,0 +1,205 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Render minute-resolution observation dates or explicit unavailable cells.
+ *
+ * @param array $row Exported tuple or observation fields.
+ *
+ * @return string
+ */
+function fv_nbar_seen_cells(array $row): string {
+	$html = '';
+
+	foreach (['first_seen', 'last_seen'] as $field) {
+		$stamp = (int) ($row[$field] ?? 0);
+		$text  = $stamp > 0 ? date('Y-m-d H:i', $stamp) : __('Unavailable', 'flowview');
+		$hint  = __('FlowView observation within the selected period; minute precision. Time zone: %s', date_default_timezone_get(), 'flowview');
+		$html .= '<td style="white-space:normal" data-text="' . $stamp . '" title="' . fv_nbar_h($hint) . '">' . fv_nbar_h($text) . '</td>';
+	}
+
+	return $html;
+}
+/**
+ * Merge observation dates while preserving missing-date information.
+ *
+ * @param array $total Accumulated dates and missing-date marker.
+ * @param array $row   Exported tuple or observation fields.
+ *
+ * @return void
+ */
+function fv_nbar_seen_merge(array &$total, array $row): void {
+	if (!isset($row['first_seen'],$row['last_seen'])) {
+		$total['_seen_missing'] = true;
+
+		return;
+	}
+	$first               = (int) $row['first_seen'];
+	$last                = (int) $row['last_seen'];
+	$total['first_seen'] = $total['first_seen'] === null ? $first : min($total['first_seen'], $first);
+	$total['last_seen']  = $total['last_seen']  === null ? $last : max($total['last_seen'], $last);
+}
+/**
+ * Backfill dates only where retained counters exactly match source totals.
+ *
+ * @param int $budget Worker time budget in seconds.
+ *
+ * @return int
+ */
+function fv_nbar_seen_backfill(int $budget = 10): int {
+	if ((int) flowview_db_fetch_cell("SELECT GET_LOCK(CONCAT('flowview_nbar_summary:',LEFT(SHA2(DATABASE(),256),16)),0)") !== 1) {
+		return 0;
+	}
+	$daily     = false;
+	$done      = 0;
+	$began     = microtime(true);
+	$old       = null;
+	$isolation = flowview_db_fetch_cell('SELECT @@session.transaction_isolation', '', false);
+
+	if (!in_array($isolation, ['READ-UNCOMMITTED', 'READ-COMMITTED', 'REPEATABLE-READ', 'SERIALIZABLE'], true)) {
+		$isolation = flowview_db_fetch_cell('SELECT @@session.tx_isolation', '', false);
+	}
+
+	try {
+		$daily = (int) flowview_db_fetch_cell("SELECT GET_LOCK(CONCAT('flowview_nbar_daily:',LEFT(SHA2(DATABASE(),256),16)),0)") === 1;
+
+		if (!$daily) {
+			return 0;
+		}
+
+		if (!in_array($isolation, ['READ-UNCOMMITTED', 'READ-COMMITTED', 'REPEATABLE-READ', 'SERIALIZABLE'], true)) {
+			return 0;
+		}
+		$old = fv_nbar_worker_timeout(20);
+
+		if ($old === null || !flowview_db_execute('SET SESSION TRANSACTION ISOLATION LEVEL READ COMMITTED')) {
+			return 0;
+		}
+		$jobs = flowview_db_fetch_assoc('SELECT kind,listener_id,period,phase,app_cursor FROM plugin_flowview_nbar_seen_upgrade WHERE done=0 ORDER BY kind,period DESC,listener_id LIMIT 100');
+
+		foreach ($jobs as $job) {
+			if (microtime(true) - $began >= $budget) {
+				break;
+			}
+			$listener = (int) $job['listener_id'];
+			$period   = (int) $job['period'];
+			$isDay    = (int) $job['kind'] === 1;
+			$end      = $period + 3600;
+			$prefix   = '';
+
+			if ($isDay) {
+				$prefix = 'daily_';
+				$end    = (int) flowview_db_fetch_cell_prepared('SELECT covered_to FROM plugin_flowview_nbar_days WHERE listener_id=? AND day=?', [$listener, $period]);
+			}
+			$ok    = true;
+			$phase = 0;
+
+			foreach (['apps' => 'app_id,LENGTH(src) family', 'pairs' => 'app_id,src,dst', 'connections' => 'app_id,src,dst,sport,dport,protocol'] as $kind => $fields) {
+				if ($isDay && $phase < (int) $job['phase']) {
+					$phase++;
+
+					continue;
+				}
+				$group     = ($kind === 'apps' ? 'app_id,LENGTH(src)' : $fields) . ',router';
+				$keys      = array_merge($kind === 'apps' ? ['app_id', 'family'] : explode(',', $fields), ['router']);
+				$column    = flowview_db_fetch_row("SHOW FULL COLUMNS FROM plugin_flowview_nbar_$prefix$kind LIKE 'app_id'");
+				$collation = $column['Collation'];
+
+				if (!preg_match('/^[a-zA-Z0-9_]+$/D', $collation)) {
+					throw new RuntimeException('Invalid application collation');
+				}
+				$join         = implode(' AND ', array_map(static function (string $k) use ($collation): string {return $k === 'app_id' ? "s.$k=r.$k COLLATE $collation" : "s.$k=r.$k"; }, $keys));
+				$source       = $isDay ? fv_nbar_hourly_source($kind, [$listener], $period, $end) : fv_nbar_data_source(fv_nbar_data_columns(), "listener_id=$listener AND minute>=$period AND minute<$end", $period, $end);
+				$dates        = 'IF(COUNT(first_seen)=COUNT(*),MIN(first_seen),NULL) first_seen,IF(COUNT(last_seen)=COUNT(*),MAX(last_seen),NULL) last_seen';
+				$sql          = "UPDATE plugin_flowview_nbar_$prefix$kind s JOIN (SELECT $fields,router,SUM(bytes) bytes,SUM(packets) packets,SUM(flows) flows,$dates FROM $source d WHERE listener_id=$listener AND minute>=$period AND minute<$end GROUP BY $group) r ON $join SET s.first_seen=r.first_seen,s.last_seen=r.last_seen WHERE s.listener_id=$listener AND s.hour=$period AND s.bytes=r.bytes AND s.packets=r.packets AND s.flows=r.flows AND (s.first_seen IS NULL OR s.last_seen IS NULL)";
+				$applications = [null];
+
+				if ($isDay && $kind === 'connections') {
+					$applications = array_column(flowview_db_fetch_assoc_prepared('SELECT DISTINCT app_id FROM plugin_flowview_nbar_daily_apps WHERE listener_id=? AND hour=? AND app_id>? ORDER BY app_id', [$listener, $period, ($job['app_cursor'] ?? '')]), 'app_id');
+				}
+
+				foreach ($applications as $application) {
+					if (microtime(true) - $began >= $budget) {
+						$ok = false;
+
+						break;
+					}
+					$statement = $sql;
+
+					if ($application !== null) {
+						$value     = 'CONVERT(0x' . bin2hex($application) . ' USING utf8mb4) COLLATE ' . $collation;
+						$statement = str_replace(' GROUP BY ', " AND app_id=$value GROUP BY ", $statement);
+						$statement .= " AND s.app_id=$value";
+					}
+
+					if (flowview_db_execute($statement) === false) {
+						$ok = false;
+
+						break;
+					}
+
+					if ($application !== null) {
+						flowview_db_execute_prepared('UPDATE plugin_flowview_nbar_seen_upgrade SET app_cursor=? WHERE kind=? AND listener_id=? AND period=?', [$application, $job['kind'], $listener, $period]);
+					}
+				}
+
+				if (!$ok) {
+					break;
+				}
+				$phase++;
+
+				if ($isDay) {
+					flowview_db_execute_prepared('UPDATE plugin_flowview_nbar_seen_upgrade SET phase=? WHERE kind=? AND listener_id=? AND period=?', [$phase, $job['kind'], $listener, $period]);
+				}
+			}
+
+			if (!$ok) {
+				break;
+			}
+
+			if (flowview_db_execute_prepared('UPDATE plugin_flowview_nbar_seen_upgrade SET done=1 WHERE kind=? AND listener_id=? AND period=?', [$job['kind'], $listener, $period]) === false) {
+				break;
+			}
+			$done++;
+		}
+	} catch (Throwable $e) {
+		cacti_log('NBAR observation upgrade: ' . $e->getMessage(), false, 'FLOWVIEW');
+	} finally {
+		if ($old !== null) {
+			flowview_db_execute('SET SESSION max_statement_time=' . $old);
+		}
+
+		if (in_array($isolation, ['READ-UNCOMMITTED', 'READ-COMMITTED', 'REPEATABLE-READ', 'SERIALIZABLE'], true)) {
+			flowview_db_execute('SET SESSION TRANSACTION ISOLATION LEVEL ' . str_replace('-', ' ', $isolation));
+		}
+
+		if ($daily) {
+			flowview_db_fetch_cell("SELECT RELEASE_LOCK(CONCAT('flowview_nbar_daily:',LEFT(SHA2(DATABASE(),256),16)))");
+		}
+		flowview_db_fetch_cell("SELECT RELEASE_LOCK(CONCAT('flowview_nbar_summary:',LEFT(SHA2(DATABASE(),256),16)))");
+	}
+
+	return $done;
+}
diff --git a/includes/nbar_summary.php b/includes/nbar_summary.php
new file mode 100644
index 0000000..096318e
--- /dev/null
+++ b/includes/nbar_summary.php
@@ -0,0 +1,255 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+require_once(__DIR__ . '/nbar_daily.php');
+
+/**
+ * Write raw records and invalidate affected hours in one transaction.
+ *
+ * @param list<array{0: string, 1: array}> $statements One prepared INSERT per raw slice, as [sql, values].
+ * @param int                              $listener   Capture identifier.
+ * @param array                            $hours      Affected UTC hour boundaries.
+ *
+ * @return bool
+ */
+function fv_nbar_summary_store(array $statements, int $listener, array $hours): bool {
+	if (flowview_db_execute('START TRANSACTION') === false) {
+		return false;
+	}
+	$ok = true;
+
+	foreach ($statements as [$sql, $args]) {
+		if (flowview_db_execute_prepared($sql, $args) === false) {
+			$ok = false;
+
+			break;
+		}
+	}
+
+	if ($ok) {
+		$values = [];
+
+		foreach (array_keys($hours) as $hour) {
+			$values[] = '(' . (int) $listener . ',' . (int) $hour . ',1,-1)';
+		}
+		$ok = flowview_db_execute('INSERT INTO plugin_flowview_nbar_hours (listener_id,hour,revision,built) VALUES ' . implode(',', $values) . ' ON DUPLICATE KEY UPDATE revision=revision+1') !== false;
+	}
+
+	if (!$ok) {
+		flowview_db_execute('ROLLBACK');
+
+		return false;
+	}
+
+	return flowview_db_execute('COMMIT') !== false;
+}
+
+/**
+ * Maintain closed-hour summaries under a database-scoped worker lock.
+ *
+ * @param int $budget Worker time budget in seconds.
+ *
+ * @return int
+ */
+function fv_nbar_summary_refresh(int $budget = 20, bool $supervised = false): int {
+	$lock = flowview_db_fetch_row("SELECT GET_LOCK(CONCAT('flowview_nbar_summary:',LEFT(SHA2(DATABASE(),256),16)),0) acquired");
+
+	if ((int) ($lock['acquired'] ?? 0) !== 1) {
+		return 0;
+	}
+	$done    = 0;
+	$started = microtime(true);
+
+	try {
+		$cutoff    = time() - fv_nbar_retention_days() * 86400;
+		$closed    = (int) (floor((time() - 300) / 3600) * 3600);
+		$listeners = flowview_db_fetch_assoc('SELECT id FROM plugin_flowview_devices');
+
+		foreach ($listeners as $listener) {
+			$id    = (int) $listener['id'];
+			$first = fv_nbar_data_edge($id);
+
+			if (!isset($first['minute'])) {
+				continue;
+			}
+			$values = [];
+
+			for ($h = (int) (floor(max($cutoff, (int) $first['minute']) / 3600) * 3600); $h < $closed; $h += 3600) {
+				$values[] = "($id,$h,0,-1)";
+			}
+
+			if ($values && flowview_db_execute('INSERT IGNORE INTO plugin_flowview_nbar_hours (listener_id,hour,revision,built) VALUES ' . implode(',', $values)) === false) {
+				return $done;
+			}
+		}
+		$pending = flowview_db_fetch_assoc('SELECT listener_id,hour,revision FROM plugin_flowview_nbar_hours WHERE hour>=' . (int) (ceil($cutoff / 3600) * 3600) . " AND hour<$closed AND (built<0 OR built<>revision OR connection_built<0 OR connection_built<>revision) ORDER BY hour DESC,listener_id LIMIT 100");
+
+		foreach ($pending as $item) {
+			if (microtime(true) - $started >= max(1, (int) $budget)) {
+				break;
+			}
+
+			if (fv_nbar_summary_build((int) $item['listener_id'], (int) $item['hour'], $supervised)) {
+				$done++;
+			}
+		}
+	} finally {
+		flowview_db_fetch_row("SELECT RELEASE_LOCK(CONCAT('flowview_nbar_summary:',LEFT(SHA2(DATABASE(),256),16))) released");
+	}
+
+	return $done + fv_nbar_daily_refresh() + fv_nbar_seen_backfill(5);
+}
+
+/**
+ * Publish an hourly summary only if its raw revision remains unchanged.
+ *
+ * @param int $listener Capture identifier.
+ * @param int $hour     UTC hour boundary in Unix seconds.
+ *
+ * @return bool
+ */
+function fv_nbar_summary_build(int $listener, int $hour, bool $supervised = false): bool {
+	// A MySQL build without DML timeouts is allowed only in the supervised child.
+	$old_timeout = fv_nbar_worker_timeout(20);
+
+	if ($old_timeout === null && !$supervised) {
+		return false;
+	}
+
+	try {
+		// READ COMMITTED avoids holding raw-record locks during INSERT ... SELECT.
+		if (flowview_db_execute('SET TRANSACTION ISOLATION LEVEL READ COMMITTED') === false || flowview_db_execute('START TRANSACTION') === false) {
+			return false;
+		}
+		$state = flowview_db_fetch_row_prepared('SELECT revision FROM plugin_flowview_nbar_hours WHERE listener_id=? AND hour=?', [$listener, $hour]);
+
+		if (!isset($state['revision'])) {
+			throw new RuntimeException('Missing summary state');
+		}
+		$raw   = fv_nbar_data_source('listener_id,minute,app_id,src,dst,sport,dport,protocol,bytes,packets,flows,router', 'listener_id=' . $listener . ' AND minute>=' . $hour . ' AND minute<' . ($hour + 3600), $hour, $hour + 3600);
+		$where = ' FROM ' . $raw . ' fv_nbar_hour';
+		$specs = [
+			'apps'        => 'app_id,LENGTH(src)',
+			'pairs'       => 'app_id,src,dst',
+			'connections' => 'app_id,src,dst,sport,dport,protocol'
+		];
+
+		foreach ($specs as $table => $fields) {
+			if (flowview_db_execute_prepared("DELETE FROM plugin_flowview_nbar_$table WHERE listener_id=? AND hour=?", [$listener, $hour]) === false) {
+				throw new RuntimeException('Summary delete failed');
+			}
+			$sql = "INSERT INTO plugin_flowview_nbar_$table SELECT $listener,$hour,$fields,SUM(bytes),SUM(packets),SUM(flows),MIN(minute),MAX(minute),router$where GROUP BY $fields,router";
+
+			if (flowview_db_execute($sql) === false) {
+				throw new RuntimeException('Summary aggregate failed');
+			}
+		}
+		$latest = flowview_db_fetch_row_prepared('SELECT revision FROM plugin_flowview_nbar_hours WHERE listener_id=? AND hour=?', [$listener, $hour]);
+
+		if (!isset($latest['revision']) || (string) $latest['revision'] !== (string) $state['revision']) {
+			throw new RuntimeException('Hour changed during summary build');
+		}
+
+		if (flowview_db_execute_prepared('UPDATE plugin_flowview_nbar_hours SET built=?,connection_built=? WHERE listener_id=? AND hour=?', [$state['revision'], $state['revision'], $listener, $hour]) === false) {
+			throw new RuntimeException('Summary publish failed');
+		}
+
+		if (flowview_db_execute('COMMIT') === false) {
+			throw new RuntimeException('Summary commit failed');
+		}
+
+		return true;
+	} catch (Throwable $e) {
+		flowview_db_execute('ROLLBACK');
+
+		return false;
+	} finally {
+		if ($old_timeout !== null) {
+			flowview_db_execute('SET SESSION max_statement_time=' . $old_timeout);
+		}
+	}
+}
+
+/**
+ * Choose mutually exclusive ready-summary or raw branches for each block.
+ *
+ * @param string   $kind      Allowlisted summary type.
+ * @param array    $listeners Selected capture identifiers.
+ * @param int      $start     Inclusive range start in Unix seconds.
+ * @param int      $end       Exclusive range end in Unix seconds.
+ * @param int|null $now       Current Unix time, or null to read the clock.
+ *
+ * @return string
+ */
+function fv_nbar_hourly_source(string $kind, array $listeners, int $start, int $end, ?int $now = null): string {
+	if (!in_array($kind, ['apps', 'pairs', 'connections'], true)) {
+		throw new InvalidArgumentException('Unknown summary kind');
+	}
+	$listeners = array_values(array_unique(array_filter(array_map('intval', $listeners), static function (int $id): bool {return $id > 0; })));
+	$start     = (int) $start;
+	$end       = (int) $end;
+	$raw       = fv_nbar_data_columns();
+	$tables    = fv_nbar_data_tables();
+
+	if (!$listeners) {
+		return fv_nbar_data_source($raw, "minute>=$start AND minute<$end", $start, $end, $tables);
+	}
+	$full_start = (int) (ceil($start / 3600) * 3600);
+	$full_end   = min((int) (floor($end / 3600) * 3600), (int) (floor((($now ?? time()) - 300) / 3600) * 3600));
+
+	if ($full_end <= $full_start) {
+		return fv_nbar_data_source($raw, 'listener_id IN (' . implode(',', $listeners) . ") AND minute>=$start AND minute<$end", $start, $end, $tables);
+	}
+	$built_column = $kind === 'connections' ? 'connection_built' : 'built';
+	$parts        = [];
+
+	foreach ($listeners as $listener) {
+		if ($start < $full_start) {
+			array_push($parts, ...fv_nbar_data_parts($raw, "listener_id=$listener AND minute>=$start AND minute<$full_start", $start, $full_start, $tables));
+		}
+
+		if ($full_end < $end) {
+			array_push($parts, ...fv_nbar_data_parts($raw, "listener_id=$listener AND minute>=$full_end AND minute<$end", $full_end, $end, $tables));
+		}
+
+		for ($h = $full_start; $h < $full_end; $h = $to) {
+			$to    = min($h + 21600, $full_end);
+			$count = (int) (($to - $h) / 3600);
+			$ready = "(SELECT COUNT(*) FROM plugin_flowview_nbar_hours WHERE listener_id=$listener AND hour>=$h AND hour<$to AND $built_column>=0 AND $built_column=revision)=$count";
+
+			if ($kind === 'apps') {
+				$fields = 'listener_id,hour minute,app_id,REPEAT(CHAR(0),family) src,REPEAT(CHAR(0),family) dst,0 sport,0 dport,0 protocol,bytes,packets,flows,first_seen,last_seen,router';
+			} elseif ($kind === 'pairs') {
+				$fields = 'listener_id,hour minute,app_id,src,dst,0 sport,0 dport,0 protocol,bytes,packets,flows,first_seen,last_seen,router';
+			} else {
+				$fields = 'listener_id,hour minute,app_id,src,dst,sport,dport,protocol,bytes,packets,flows,first_seen,last_seen,router';
+			}
+			$parts[] = "SELECT $fields FROM plugin_flowview_nbar_$kind WHERE listener_id=$listener AND hour>=$h AND hour<$to AND ($ready)";
+			array_push($parts, ...fv_nbar_data_parts($raw, "listener_id=$listener AND minute>=$h AND minute<$to AND NOT ($ready)", $h, $to, $tables));
+		}
+	}
+
+	return '(' . implode(' UNION ALL ', $parts) . ')';
+}
diff --git a/includes/nbar_timespan.php b/includes/nbar_timespan.php
new file mode 100644
index 0000000..fc44a45
--- /dev/null
+++ b/includes/nbar_timespan.php
@@ -0,0 +1,96 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/**
+ * Limit preset choices to the configured retention window.
+ *
+ * @param array      $presets Cacti timespan labels by identifier.
+ * @param int        $now     Current Unix time.
+ * @param int        $days    Configured retention in days.
+ * @param int|string $weekday Cacti first-weekday setting.
+ *
+ * @return array
+ */
+function fv_nbar_timespan_options(array $presets, int $now, int $days, int|string $weekday): array {
+	$options = [];
+	$cutoff  = $now - $days * 86400;
+
+	foreach ($presets as $id => $label) {
+		$span = [];
+		get_timespan($span, $now, $id, (int) $weekday);
+		$from = strtotime($span['current_value_date1']);
+		$to   = strtotime($span['current_value_date2']);
+
+		if ($from >= $cutoff && $to > $from && $to <= $now) {
+			// The exact retention option below replaces duplicate rolling periods.
+			if ($from === $cutoff && $to === $now) {
+				continue;
+			}
+			$options[$id] = $label;
+		}
+	}
+	$options[1000] = $days === 1 ? __('Last Day', 'flowview') : __('Last %s Days', $days, 'flowview');
+
+	return $options;
+}
+/**
+ * Clamp a requested range to retained history and the current time.
+ *
+ * @param int $start Inclusive range start in Unix seconds.
+ * @param int $end   Exclusive range end in Unix seconds.
+ * @param int $now   Current Unix time.
+ * @param int $days  Configured retention in days.
+ *
+ * @return array
+ */
+function fv_nbar_bound_dates(int $start, int $end, int $now, int $days): array {
+	$cutoff = $now - $days * 86400;
+	$from   = max($cutoff, $start);
+	$to     = min($now, $end);
+
+	if ($to <= $from) {
+		return [$now - 1800, $now, true];
+	}
+
+	return [$from, $to, $from !== $start || $to !== $end];
+}
+
+/** Handle NBAR timespans without mutating legacy Flow Reports session state. */
+function fv_nbar_timespan_request(): bool {
+	if (get_nfilter_request_var('report') !== 'nbar') {
+		return false;
+	}
+	header('Content-Type: application/json');
+
+	if ((int) get_filter_request_var('predefined_timespan') === 1000) {
+		$end   = (int) (floor(time() / 60) * 60);
+		$start = $end - fv_nbar_retention_days() * 86400;
+		print json_encode(['current_value_date1' => date('Y-m-d H:i', $start), 'current_value_date2' => date('Y-m-d H:i', $end), 'begin_now' => $start, 'end_now' => $end]);
+	} else {
+		flowview_gettimespan();
+	}
+
+	return true;
+}
diff --git a/js/nbar-preferences.js b/js/nbar-preferences.js
new file mode 100644
index 0000000..ee5ac7b
--- /dev/null
+++ b/js/nbar-preferences.js
@@ -0,0 +1,96 @@
+/* Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later. */
+
+$(function () {
+	var prefs = window.fvNbarDisplay;
+	var combineDialog = document.getElementById('nbarCombineDialog'),
+		combineSnapshot;
+	$('#nbarCombineOptions').on('click', function () {
+		combineSnapshot = {
+			prefixes: $('#nbarPrefixes').val(),
+			picks: $('#nbarCombineDialog input[type=checkbox]')
+				.map(function () {
+					return this.checked;
+				})
+				.get(),
+		};
+		if (!combineDialog.open) combineDialog.showModal();
+	});
+	$('#nbarCombineClose,#nbarCombineCancel').on('click', function () {
+		combineDialog.close();
+	});
+	$(combineDialog).on('close', function () {
+		if (!combineSnapshot) return;
+		$('#nbarPrefixes').val(combineSnapshot.prefixes);
+		$('#nbarCombineDialog input[type=checkbox]').each(function (i) {
+			this.checked = combineSnapshot.picks[i];
+		});
+		updateRouterSelection();
+	});
+
+	var routerPicks = $('#nbarPreferences input[name="site_listeners[]"]');
+	function updateRouterSelection() {
+		var count = routerPicks.filter(':checked').length;
+		routerPicks.not(':checked').prop('disabled', count >= 3);
+		$('#nbarRouterSelectionCount').text(
+			prefs.labels.selection.replace('{count}', count) +
+				(count === 1 ? prefs.labels.single : count === 0 ? prefs.labels.off : ''),
+		);
+		$('#nbarCombineSave').prop('disabled', count === 1 || count > 3);
+	}
+	$('#nbarCombineSave').on('click', function () {
+		var count = routerPicks.filter(':checked').length;
+		if (count === 1 || count > 3) return false;
+		if (count >= 2) $('#nbar_filter [name=listener]').val('0');
+		$('<input>', { type: 'hidden', name: 'combine_apply', value: '1' }).appendTo('#nbar_filter');
+	});
+	routerPicks.on('change', updateRouterSelection);
+	updateRouterSelection();
+	$('#nbarTable,#nbarConversationTable').each(function () {
+		var table = $(this);
+		table.find('thead th').each(function (index) {
+			var th = $(this),
+				label = th.text(),
+				data = th.attr('data-nbar-unit') === 'data',
+				rate = th.attr('data-nbar-unit') === 'rate',
+				dns = th.attr('data-nbar-unit') === 'dns';
+			if (dns && prefs.dns === '0') {
+				th.hide();
+				table.find('tbody tr').each(function () {
+					$(this).children().eq(index).hide();
+				});
+			}
+			if (!data && !rate) return;
+			var choice = data ? prefs.data : prefs.rate;
+			th.text(
+				label.replace(data ? 'GB' : 'Mbps', choice === 'Auto' ? (data ? 'MB / GB' : 'Kbps / Mbps') : choice),
+			);
+			th.attr('title', rate ? prefs.labels.rate : prefs.labels.data);
+			table.find('tbody tr').each(function () {
+				var cell = $(this).children().eq(index),
+					value = Number(cell.attr('data-text'));
+				if (!cell.is('[data-text]') || !Number.isFinite(value) || value < 0) return;
+				var unit = choice,
+					result = value;
+				if (data) {
+					if (choice === 'Auto') unit = value >= 1 ? 'GB' : 'MB';
+					if (unit === 'MB') result = value * 1000;
+				} else {
+					if (choice === 'Auto') unit = value >= 1 ? 'Mbps' : 'Kbps';
+					if (unit === 'Kbps') result = value * 1000;
+				}
+				var precision = choice === 'Auto' ? 2 : data ? 4 : 3,
+					threshold = Math.pow(10, -precision);
+				var text =
+					result > 0 && result < threshold
+						? '<' + threshold.toFixed(precision)
+						: result.toLocaleString(undefined, {
+								minimumFractionDigits: precision,
+								maximumFractionDigits: precision,
+							});
+				cell.text(text + (choice === 'Auto' ? ' ' + unit : ''));
+				cell.attr('title', data ? (value * 1e9).toLocaleString() + ' bytes' : value.toLocaleString() + ' Mbps');
+			});
+		});
+		if (prefs.dns === '0') table.find('tbody td small').hide();
+	});
+});
diff --git a/js/nbar-report.js b/js/nbar-report.js
new file mode 100644
index 0000000..16b5a33
--- /dev/null
+++ b/js/nbar-report.js
@@ -0,0 +1,45 @@
+/* Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later. */
+$(function () {
+	$('#nbarSetupLink').on('click', function (e) {
+		e.preventDefault();
+		var guide = document.getElementById('nbarSetupGuide');
+		if (!guide.open) guide.showModal();
+	});
+});
+$(function () {
+	$('#nbar_filter [name=mode]').on('change', function () {
+		$('#nbar_filter [name=app],#nbar_filter [name=internal],#nbar_filter [name=external]').remove();
+	});
+});
+
+$(function () {
+	function refreshTimespan() {
+		var v = $('#nbar_period').val();
+		if (v !== '0')
+			$.getJSON('flowview.php', { action: 'gettimespan', report: 'nbar', predefined_timespan: v }, function (d) {
+				$('#nbar_date1').val(d.current_value_date1);
+				$('#nbar_date2').val(d.current_value_date2);
+			});
+	}
+	function flowReturn(report) {
+		var u = new URL($('#nbar_return').attr('href'), location.href);
+		if (report) u.searchParams.set('report', report);
+		u.searchParams.set('device_id', $('#nbar_filter [name=listener]').val());
+		u.searchParams.set('predefined_timespan', $('#nbar_period').val() === '1000' ? '0' : $('#nbar_period').val());
+		u.searchParams.set('date1', $('#nbar_date1').val());
+		u.searchParams.set('date2', $('#nbar_date2').val());
+		location.href = u.href;
+	}
+	$('#nbar_report_select').on('change', function () {
+		if (this.value !== 'nbar') flowReturn(this.value);
+	});
+	$('#nbar_return').on('click', function (e) {
+		e.preventDefault();
+		flowReturn();
+	});
+	$('#nbar_period').on('change', refreshTimespan);
+	$('#nbar_date1,#nbar_date2').on('change', function () {
+		$('#nbar_period').val('0');
+		if (theme !== 'classic') $('#nbar_period').selectmenu('refresh');
+	});
+});
diff --git a/js/nbar-setup-guide.js b/js/nbar-setup-guide.js
new file mode 100644
index 0000000..2eb47d2
--- /dev/null
+++ b/js/nbar-setup-guide.js
@@ -0,0 +1,6 @@
+/* Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later. */
+$(function () {
+	$('#nbarSetupClose').on('click', function () {
+		document.getElementById('nbarSetupGuide').close();
+	});
+});
diff --git a/js/nbar-tables.js b/js/nbar-tables.js
new file mode 100644
index 0000000..bf864c7
--- /dev/null
+++ b/js/nbar-tables.js
@@ -0,0 +1,142 @@
+/* Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later. */
+
+window.flowviewNbarInitTable = function (spec) {
+	$(function () {
+		var table = $(spec.table);
+		if (!table.length || !$.fn.tablesorter) return;
+
+		var columns = table.find('th').length;
+		var firstNumber = spec.conversations ? 3 : columns - 6;
+		var headers = {};
+		var savedSort = [[firstNumber, 1]];
+		var storage;
+		try {
+			storage = spec.conversations ? localStorage : sessionStorage;
+			var saved = JSON.parse(storage.getItem(spec.sortKey));
+			if (
+				Array.isArray(saved) &&
+				saved.length &&
+				saved.every(function (item) {
+					return (
+						Array.isArray(item) &&
+						Number.isInteger(item[0]) &&
+						item[0] >= 0 &&
+						item[0] < columns &&
+						(item[1] === 0 || item[1] === 1)
+					);
+				})
+			)
+				savedSort = saved;
+		} catch (error) {}
+
+		function saveSort() {
+			try {
+				if (storage && table[0].config) {
+					storage.setItem(spec.sortKey, JSON.stringify(table[0].config.sortList));
+				}
+			} catch (error) {}
+		}
+
+		for (var index = firstNumber; index < columns; index++) {
+			headers[index] = { sorter: 'digit', sortInitialOrder: 'desc' };
+		}
+
+		var widths = spec.conversations
+			? [20, 20, 12, 8, 8, 8, 8, 8, 8]
+			: columns === 14
+				? [9, 11, 10, 5, 11, 10, 5, 5, 7, 7, 5, 5, 5, 5]
+				: [28, 14, 18, 10, 10, 10, 10];
+		table
+			.tablesorter({
+				headers: headers,
+				sortList: savedSort,
+				initialized: function (element) {
+					// Cacti also initializes jQuery UI handles. Use the table widget's
+					// handles consistently so saved widths and Safari dragging agree.
+					var config = element.config;
+					var widget = $.tablesorter.getWidgetById('resizable');
+					if (!widget || !$.tablesorter.resizable) return;
+					config.widgetOptions = $.extend({}, widget.options, config.widgetOptions);
+					var options = config.widgetOptions;
+					// Old saved widths can exceed the saved table width, leaving the
+					// last column with no space. Repair them before the widget loads.
+					if ($.tablesorter.storage) {
+						try {
+							var stored = $.tablesorter.storage(element, 'tablesorter-resizable');
+							if (Array.isArray(stored) && stored.length) {
+								var valid =
+									stored.length === columns &&
+									stored.every(function (width) {
+										return typeof width === 'number' && Number.isFinite(width) && width >= 0;
+									});
+								var safe = valid
+									? stored.map(function (width, index) {
+											if (!config.$headerIndexed[index].is(':visible')) return 0;
+											return Math.max(index >= columns - 2 ? 136 : 48, width);
+										})
+									: [];
+								$.tablesorter.storage(element, 'tablesorter-resizable', safe);
+								$.tablesorter.storage(
+									element,
+									'tablesorter-table-resized-width',
+									safe.length
+										? Math.max(
+												$(element).parent().width(),
+												safe.reduce(function (sum, width) {
+													return sum + width + 8;
+												}, 0),
+											)
+										: 'auto',
+								);
+							}
+						} catch (error) {}
+					}
+					$(element).removeClass('hasResizable');
+					$.tablesorter.resizable.init(config, options);
+					config.widgets.push('resizable');
+					config.widgetInit.resizable = true;
+					options.$resizable_container
+						.addClass('flowview-nbar-resize')
+						.children()
+						.attr('title', spec.resizeLabel)
+						.each(function (index) {
+							var header = $(config.$headerIndexed[index]);
+							$(this).css('color', header.find('.textSubHeaderDark').css('color') || header.css('color'));
+						});
+					$(element).trigger('resizableUpdate');
+				},
+				widgets: ['zebra'],
+				widgetOptions: {
+					resizable: true,
+					storage_tableId: spec.conversations
+						? 'flowview-nbar-conversation-columns-v2'
+						: 'flowview-nbar-columns-v2-' + columns,
+					resizable_widths: widths.map(function (width) {
+						return width + '%';
+					}),
+				},
+				widgetZebra: { css: ['even', 'odd'] },
+				headerTemplate: '<div class="textSubHeaderDark">{content} {icon}</div>',
+				cssIconAsc: 'fa-sort-up',
+				cssIconDesc: 'fa-sort-down',
+				cssIconNone: 'fa-sort',
+				cssIcon: 'fa',
+			})
+			.on('sortEnd', saveSort);
+
+		$('.nbarPageLink').on('click', saveSort);
+		$('.nbarPageJump').on('click', function () {
+			var input = $(this).closest('.nbarPagination').find('.nbarPageNumber')[0];
+			if (input && input.checkValidity()) {
+				saveSort();
+				location.href = this.dataset.url + '&page=' + Number.parseInt(input.value, 10);
+			}
+		});
+		$('.nbarPageNumber').on('keydown', function (event) {
+			if (event.key === 'Enter') {
+				event.preventDefault();
+				$(this).closest('.nbarPagination').find('.nbarPageJump').trigger('click');
+			}
+		});
+	});
+};
diff --git a/locales/po/cacti.pot b/locales/po/cacti.pot
index 23efd5d..86e6f5a 100644
--- a/locales/po/cacti.pot
+++ b/locales/po/cacti.pot
@@ -6,11 +6,12 @@
 #, fuzzy
 msgid ""
 msgstr ""
-"Project-Id-Version: Cacti \n"
+"Project-Id-Version: Cacti 5.1\n"
 "Report-Msgid-Bugs-To: developers@cacti.net\n"
-"POT-Creation-Date: 2026-10-12 14:40-0400\n"
+"POT-Creation-Date: 2026-10-19 12:10-0400
+"
 "PO-Revision-Date: YEAR-MO-DA HO:MI+ZONE\n"
-"Last-Translator: Cacti Developers <developers@cacti.net>>\n"
+"Last-Translator: Cacti Developers <developers@cacti.net>\n"
 "Language-Team: Cacti Developers <developers@cacti.net>\n"
 "Language: \n"
 "MIME-Version: 1.0\n"
@@ -480,7 +481,7 @@ msgid "Default"
 msgstr ""
 
 #: flowview_databases.php flowview_devices.php flowview_filters.php
-#: flowview_schedules.php includes/functions.php
+#: flowview_schedules.php includes/functions.php nbar_report.php
 msgid "Go"
 msgstr ""
 
@@ -490,7 +491,7 @@ msgid "Set/Refresh Filters"
 msgstr ""
 
 #: flowview_databases.php flowview_devices.php flowview_filters.php
-#: flowview_schedules.php includes/functions.php
+#: flowview_schedules.php includes/functions.php nbar_report.php
 msgid "Clear"
 msgstr ""
 
@@ -518,7 +519,7 @@ msgstr[0] ""
 msgstr[1] ""
 
 #: flowview_databases.php flowview_devices.php flowview_filters.php
-#: flowview_schedules.php includes/functions.php
+#: flowview_schedules.php includes/functions.php includes/nbar_preferences.php
 msgid "Cancel"
 msgstr ""
 
@@ -714,6 +715,7 @@ msgid "Port this collector will listen on."
 msgstr ""
 
 #: flowview_devices.php includes/arrays.php includes/functions.php
+#: nbar_report.php
 msgid "Protocol"
 msgstr ""
 
@@ -1240,6 +1242,18 @@ msgstr ""
 msgid "Yes"
 msgstr ""
 
+#: flowview_sections.php
+msgid "FlowView sections"
+msgstr ""
+
+#: flowview_sections.php
+msgid "Cisco Apps (NBAR)"
+msgstr ""
+
+#: flowview_sections.php
+msgid "Flow Reports"
+msgstr ""
+
 #: includes/arrays.php includes/functions.php
 msgid "Select a Report"
 msgstr ""
@@ -1272,11 +1286,11 @@ msgstr ""
 msgid "UDP/TCP Port"
 msgstr ""
 
-#: includes/arrays.php includes/functions.php
+#: includes/arrays.php includes/functions.php nbar_report.php
 msgid "Source IP"
 msgstr ""
 
-#: includes/arrays.php
+#: includes/arrays.php nbar_report.php
 msgid "Destination IP"
 msgstr ""
 
@@ -1398,7 +1412,7 @@ msgstr ""
 msgid "Bytes"
 msgstr ""
 
-#: includes/arrays.php includes/functions.php
+#: includes/arrays.php includes/functions.php nbar_report.php
 msgid "Packets"
 msgstr ""
 
@@ -1913,7 +1927,7 @@ msgstr ""
 msgid "Edit the Flow Filter"
 msgstr ""
 
-#: includes/functions.php
+#: includes/functions.php includes/nbar_preferences.php
 msgid "Save"
 msgstr ""
 
@@ -1992,19 +2006,19 @@ msgstr ""
 msgid "Show the post-NAT (translated) IP/DNS name instead of the original values"
 msgstr ""
 
-#: includes/functions.php
+#: includes/functions.php nbar_report.php
 msgid "Timespan"
 msgstr ""
 
-#: includes/functions.php
+#: includes/functions.php nbar_report.php
 msgid "Custom"
 msgstr ""
 
-#: includes/functions.php
+#: includes/functions.php nbar_report.php
 msgid "From"
 msgstr ""
 
-#: includes/functions.php
+#: includes/functions.php nbar_report.php
 msgid "To"
 msgstr ""
 
@@ -2186,7 +2200,7 @@ msgstr ""
 msgid "No valid report was selected.  Please open a bug on GitHub"
 msgstr ""
 
-#: includes/functions.php
+#: includes/functions.php nbar_report.php
 msgid "Source DNS"
 msgstr ""
 
@@ -2404,6 +2418,474 @@ msgstr ""
 msgid "InnoDB (Slow, High Concurrency)"
 msgstr ""
 
+#: includes/nbar_chart.php
+msgid "Unable to load application chart. Please try again."
+msgstr ""
+
+#: includes/nbar_chart.php
+msgid "Other"
+msgstr ""
+
+#: includes/nbar_chart.php
+msgid "Top 5 applications"
+msgstr ""
+
+#: includes/nbar_chart.php
+msgid "Top 5 applications by data"
+msgstr ""
+
+#: includes/nbar_chart.php
+msgid "Application data share for the selected period"
+msgstr ""
+
+#: includes/nbar_chart.php
+msgid "No application data in this period"
+msgstr ""
+
+#: includes/nbar_dns.php
+msgid "No reverse DNS"
+msgstr ""
+
+#: includes/nbar_dns.php
+msgid "Not resolved"
+msgstr ""
+
+#: includes/nbar_feed_status.php
+msgid "STATUS:"
+msgstr ""
+
+#: includes/nbar_feed_status.php
+msgid "Unable to load NBAR status. Please try again."
+msgstr ""
+
+#: includes/nbar_feed_status.php
+msgid "No recent NBAR"
+msgstr ""
+
+#: includes/nbar_feed_status.php
+msgid "Receiving"
+msgstr ""
+
+#: includes/nbar_feed_status.php
+#, php-format
+msgid "Last NBAR record: %s"
+msgstr ""
+
+#: includes/nbar_feed_status.php
+msgid "No retained NBAR records"
+msgstr ""
+
+#: includes/nbar_feed_status.php
+msgid "No captures selected"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Settings were not saved. Enter valid IPv4/IPv6 networks, or leave the list blank."
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Settings were not saved. Choose two or three captures to combine, or clear all selections to save Internal Networks only."
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Bandwidth units"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "DNS names"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Data units"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Hide"
+msgstr ""
+
+#: includes/nbar_preferences.php nbar_report.php
+msgid "Show"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Auto"
+msgstr ""
+
+#: includes/nbar_preferences.php nbar_setup_guide.php
+msgid "Close"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Combine Options"
+msgstr ""
+
+#: includes/nbar_preferences.php nbar_report.php
+msgid "Options"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Choose two or three captures to combine, normally one LAN capture per router. Leave all captures unticked to save Internal Networks only. Overlapping LAN and WAN captures are added together and can count traffic twice."
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Internal Networks"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "One internal IPv4 or IPv6 network per line. Used to identify internal hosts and upload/download direction in Conversations. Update delegated IPv6 prefixes when they change, and keep old prefixes for retained history. Exported flows do not automatically identify your site networks."
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid " — combining off"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid " — select another capture or untick all to save"
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Average rate across the selected timespan."
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "Decimal units: 1 GB = 1,000 MB."
+msgstr ""
+
+#: includes/nbar_preferences.php
+msgid "{count} of 3 selected"
+msgstr ""
+
+#: includes/nbar_seen.php
+msgid "Unavailable"
+msgstr ""
+
+#: includes/nbar_seen.php
+#, php-format
+msgid "FlowView observation within the selected period; minute precision. Time zone: %s"
+msgstr ""
+
+#: includes/nbar_timespan.php
+#, php-format
+msgid "Last %s Days"
+msgstr ""
+
+#: includes/nbar_timespan.php
+msgid "Last Day"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "Configure your site networks in Application settings to label internal and external devices. Top applications and Connections work directly with exported IPv4 and IPv6 addresses."
+msgstr ""
+
+#: nbar_conversations.php
+msgid "Unable to load conversations. Please try again."
+msgstr ""
+
+#: nbar_conversations.php nbar_report.php
+msgid "← Back to top applications"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "Internal Host ↔ External Host. Click a device to see its individual connections. Bandwidth is averaged over the selected timespan."
+msgstr ""
+
+#: nbar_conversations.php nbar_report.php
+msgid "Application"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "Download (Avg Mbps)"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "Download (GB)"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "External Host"
+msgstr ""
+
+#: nbar_conversations.php nbar_report.php
+msgid "First seen"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "Internal Host"
+msgstr ""
+
+#: nbar_conversations.php nbar_report.php
+msgid "Last seen"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "Upload (Avg Mbps)"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "Upload (GB)"
+msgstr ""
+
+#: nbar_conversations.php nbar_report.php
+#, php-format
+msgid "Awaiting name (%s)"
+msgstr ""
+
+#: nbar_conversations.php
+msgid "No conversations for this period. Allow 1–2 minutes for exports, or choose a longer timespan."
+msgstr ""
+
+#: nbar_conversations.php nbar_report.php
+msgid "First seen and Last seen show the earliest and latest FlowView observations within the selected period, at minute precision. They do not identify continuous activity or exact flow start/end times. Unavailable means the retained summary has no complete observation dates."
+msgstr ""
+
+#: nbar_conversations.php nbar_report.php
+msgid "Report information"
+msgstr ""
+
+#: nbar_conversations.php
+#, php-format
+msgid "Top 100 conversations by combined data volume. Each row groups an Internal Host, External Host and application across both directions. Uses only the selected LAN captures to avoid counting WAN copies. Local and multicast traffic is excluded. DNS names identify servers, not the exact website requested. History retention: %d days."
+msgstr ""
+
+#: nbar_conversations.php nbar_report.php
+msgid "Drag to resize column"
+msgstr ""
+
+#: nbar_report.php
+msgid "NBAR history is being upgraded. Refresh this report shortly."
+msgstr ""
+
+#: nbar_report.php
+#, php-format
+msgid "That period is outside the %s-day NBAR retention setting. Showing the last half hour."
+msgstr ""
+
+#: nbar_report.php
+#, php-format
+msgid "Dates adjusted to the %s-day NBAR retention window."
+msgstr ""
+
+#: nbar_report.php
+msgid "Application Report: Cisco Apps Recognition (NBAR)"
+msgstr ""
+
+#: nbar_report.php
+msgid "Router / capture"
+msgstr ""
+
+#: nbar_report.php
+msgid "Combined routers"
+msgstr ""
+
+#: nbar_report.php
+msgid "Setup guide"
+msgstr ""
+
+#: nbar_report.php
+msgid "IP version"
+msgstr ""
+
+#: nbar_report.php
+msgid "IPv4 and IPv6"
+msgstr ""
+
+#: nbar_report.php
+msgid "Connections"
+msgstr ""
+
+#: nbar_report.php
+msgid "Conversations"
+msgstr ""
+
+#: nbar_report.php
+msgid "Top applications"
+msgstr ""
+
+#: nbar_report.php
+msgid "Any IPv4 or IPv6 address"
+msgstr ""
+
+#: nbar_report.php
+msgid "Filter by IP"
+msgstr ""
+
+#: nbar_report.php
+msgid "Show traffic where this IP is the source or destination. Leave blank to show all."
+msgstr ""
+
+#: nbar_report.php
+msgid "Unable to read the NBAR records. Please try again."
+msgstr ""
+
+#: nbar_report.php
+msgid "← Back to conversations"
+msgstr ""
+
+#: nbar_report.php
+msgid "Unable to load connections. Try a shorter timespan or filter by IP."
+msgstr ""
+
+#: nbar_report.php
+msgid "Unable to load applications. Please try again."
+msgstr ""
+
+#: nbar_report.php
+msgid "Counting total pages…"
+msgstr ""
+
+#: nbar_report.php
+msgid "Page"
+msgstr ""
+
+#: nbar_report.php
+msgid "Up to 100 connections per page, ordered by data volume."
+msgstr ""
+
+#: nbar_report.php
+msgid "Previous"
+msgstr ""
+
+#: nbar_report.php
+msgid "Next"
+msgstr ""
+
+#: nbar_report.php
+#, php-format
+msgid "Application %s"
+msgstr ""
+
+#: nbar_report.php
+msgid "Destination DNS"
+msgstr ""
+
+#: nbar_report.php
+msgid "Destination port"
+msgstr ""
+
+#: nbar_report.php
+msgid "Reverse DNS hostname"
+msgstr ""
+
+#: nbar_report.php
+msgid "Source port"
+msgstr ""
+
+#: nbar_report.php
+msgid "Bandwidth (Avg Mbps)"
+msgstr ""
+
+#: nbar_report.php
+msgid "Data (GB)"
+msgstr ""
+
+#: nbar_report.php
+msgid "First FlowView observation in the selected period"
+msgstr ""
+
+#: nbar_report.php
+msgid "Last FlowView observation in the selected period"
+msgstr ""
+
+#: nbar_report.php
+msgid "Records"
+msgstr ""
+
+#: nbar_report.php
+msgid "No application records in this view yet. Try a longer period or another traffic view."
+msgstr ""
+
+#: nbar_report.php
+msgid "Total pages unavailable"
+msgstr ""
+
+#: nbar_report.php
+msgid "of {pages} pages ({connections} connections)"
+msgstr ""
+
+#: nbar_report.php
+msgid "Results are ordered by data volume; Connections shows up to 100 per page. Column sorting applies to the displayed page. NBAR history uses the configured retention setting. Daily summaries are reused across report selections; partial days use hourly summaries, and partial or changed hours use raw records. Connections pages are read from shared daily history, with nearby pages briefly cached for navigation. Average Mbps covers the selected period; allow 1–2 minutes for exports. Capture visibility depends on the device exporter and observation point. NAT can hide internal IPv4 addresses on a WAN capture. Select one observation point per traffic path to avoid duplicate totals. Cisco NBAR may classify encrypted traffic as SSL, QUIC or Unknown. History starts when export is enabled."
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "1. FlowView listener"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "2. Router configuration example"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "Create and enable a listener with the correct UDP port and allowed router export-source address. Start or restart the capture service after adding a listener. Allow the UDP port through the collector firewall. The export source must reach the collector. An IPv4 exporter can carry both IPv4 and IPv6 records."
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "Replace the red placeholders with your own values:"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "Requirements"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "Setup guide — Cisco Apps (NBAR)"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "This configuration example is based on a Cisco 1100 Series ISR installation using NBAR2, Flexible NetFlow and application export. For other router types, refer to Cisco documentation for your exact router model and IOS XE release for supported commands, features and configuration requirements. Input/output monitoring and licence requirements vary by platform. Protocol packs must match their supported IOS XE release and NBAR engine. This guide does not apply router changes."
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "is a router interface whose address can reach the collector;"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "is the Cacti collector address;"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "is the listener UDP port;"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "is the routed LAN interface to monitor. The export source identifies the router sending flow records; it does not choose which traffic is captured. It may differ from the monitored LAN VLAN. Set the FlowView listener to allow the chosen export-source IP. This example uses NetFlow v9 application records from a Cisco 1100 Series ISR. It omits optional routing metadata. Check Cisco documentation for defaults and supported record fields on your platform. The NBAR decoder currently supports application records exported using NetFlow v9; IPFIX application records are not decoded by this integration."
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "3. Capture and report settings"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "4. Verify collection"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "For example, replace"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "Top applications and Connections use exported addresses directly. Conversations needs internal IPv4 and IPv6 networks in Options to distinguish Internal Hosts from External Hosts. Update delegated IPv6 prefixes when they change; retain old prefixes while viewing their history."
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "Use your monitor and exporter names. Generate traffic and check both caches and export counters. Allow 1-2 minutes for exports to appear. Check QFP load during a speed test; overhead depends on platform, traffic and capture count."
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "if that is the routed gateway interface for your LAN. Apply both the IPv4 and IPv6 monitors in input and output directions on that interface, as shown above. Input captures traffic arriving from that LAN towards the WAN; output captures traffic returning from the WAN to that LAN. This covers LAN-to-WAN traffic routed through that interface without also attaching the same monitors to the WAN. Use your actual routed LAN interface or VLAN interface; Vlan1 is an example, not a requirement. Traffic routed between VLANs can also cross this interface, so the capture is not limited to Internet traffic. Locally switched traffic that does not cross the router is outside this capture. Avoid combining LAN and WAN copies of the same traffic. For combined routers, select up to three captures, normally one LAN capture per router."
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "with"
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "Average bandwidth covers the selected timespan, not an instantaneous or peak rate. Conversations combines both directions for each Internal Host, External Host and application. Classification comes from the router; encrypted traffic can remain SSL or QUIC. DNS names identify hosts, not the exact HTTPS page."
+msgstr ""
+
+#: nbar_setup_guide.php
+msgid "Reading reports"
+msgstr ""
+
 #: setup.php
 msgid "NetFlow User"
 msgstr ""
@@ -2647,6 +3129,34 @@ msgstr ""
 msgid "%d Year"
 msgstr ""
 
+#: setup.php
+msgid "Cisco Apps (NBAR) History Retention"
+msgstr ""
+
+#: setup.php
+msgid "Days of application history to retain. Reducing this removes older history during scheduled cleanup; increasing it cannot restore expired data."
+msgstr ""
+
+#: setup.php
+msgid "1 Day"
+msgstr ""
+
+#: setup.php
+msgid "14 Days"
+msgstr ""
+
+#: setup.php
+msgid "3 Days"
+msgstr ""
+
+#: setup.php
+msgid "30 Days"
+msgstr ""
+
+#: setup.php
+msgid "7 Days"
+msgstr ""
+
 #: setup.php
 msgid "Database Partitioning Scheme"
 msgstr ""
diff --git a/manifest.json b/manifest.json
index 00e7668..df291f7 100644
--- a/manifest.json
+++ b/manifest.json
@@ -3,6 +3,7 @@
         "arrays.php",
         "database.php",
         "flowview_security.php",
+        "flowview_upgrade.php",
         "functions-pre13.php",
         "functions.php",
         "themes/"
@@ -13,6 +14,7 @@
         "LICENSE",
         "Net/",
         "README.md",
+        "cli/",
         "config.php.dist",
         "css/",
         "fixprivate.php",
@@ -27,16 +29,20 @@
         "flowview_process.php",
         "flowview_runner.php",
         "flowview_schedules.php",
-        "flowview_upgrade.php",
+        "flowview_sections.php",
         "flowview_upgrade_nat_columns.php",
         "images/",
         "import_flows.php",
         "includes/",
         "index.php",
         "irr_tables.php",
+        "js/",
         "locales/",
         "manifest.json",
         "maxscale/",
+        "nbar_conversations.php",
+        "nbar_report.php",
+        "nbar_setup_guide.php",
         "plugin_flowview_ports.sql",
         "repair_tables.php",
         "run_schedule.php",
diff --git a/nbar_conversations.php b/nbar_conversations.php
new file mode 100644
index 0000000..6f52a5c
--- /dev/null
+++ b/nbar_conversations.php
@@ -0,0 +1,129 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+// Conversation direction uses configured site networks and selected listeners.
+
+/**
+ * Report state supplied by nbar_report.php, which includes this file.
+ *
+ * @var array<string, mixed>   $nbar_preferences
+ * @var string                 $listener_scope
+ * @var int                    $lid
+ * @var int                    $start
+ * @var int                    $end
+ * @var int                    $seconds
+ * @var string                 $family
+ * @var string                 $aid
+ * @var string                 $host
+ * @var string                 $base
+ * @var array<int, int|string> $combined_lids
+ */
+if (empty($nbar_preferences['prefixes'])) {
+	print '<p class="textInfo nbarReportText">' . html_escape(__('Configure your site networks in Application settings to label internal and external devices. Top applications and Connections work directly with exported IPv4 and IPv6 addresses.', 'flowview')) . '</p>';
+
+	return;
+}
+$where = $listener_scope . ' AND d.minute>=? AND d.minute<?';
+$args  = $lid === 0 ? [$start, $end] : [$lid, $start, $end];
+
+if ($family !== 'all') {
+	$where .= ' AND LENGTH(d.src)=' . ($family === '6' ? 16 : 4);
+}
+
+if ($aid !== '') {
+	$where .= ' AND d.app_id=?';
+	$args[] = $aid;
+}
+
+if ($host !== '') {
+	$where .= ' AND (d.src=INET6_ATON(?) OR d.dst=INET6_ATON(?))';
+	array_push($args, $host, $host);
+}
+$sl = fv_nbar_local_sql('d.src');
+$dl = fv_nbar_local_sql('d.dst');
+$where .= ' AND ' . fv_nbar_unicast_sql('d.src') . ' AND ' . fv_nbar_unicast_sql('d.dst');
+$where .= " AND (($sl AND NOT $dl) OR ($dl AND NOT $sl))";
+$fields = "d.app_id,n.name,INET6_NTOA(IF($sl,d.src,d.dst)) internal,INET6_NTOA(IF($sl,d.dst,d.src)) external,SUM(IF($sl,d.bytes,0)) upload,SUM(IF($dl,d.bytes,0)) download,SUM(d.bytes) total,IF(COUNT(d.first_seen)=COUNT(*),MIN(d.first_seen),NULL) first_seen,IF(COUNT(d.last_seen)=COUNT(*),MAX(d.last_seen),NULL) last_seen";
+
+try {
+	$nbar_source = fv_nbar_summary_source('pairs', $lid === 0 ? $combined_lids : [$lid], $start, $end);
+} catch (RuntimeException $e) {
+	cacti_log('NBAR conversations: ' . $e->getMessage(), false, 'FLOWVIEW');
+	print '<p class="textInfo nbarReportText">' . fv_nbar_h(__('Unable to load conversations. Please try again.', 'flowview')) . '</p>';
+
+	return;
+}
+$sql  = "SELECT $fields FROM $nbar_source d JOIN plugin_flowview_devices l ON l.id=d.listener_id LEFT JOIN plugin_flowview_nbar_names n ON n.router=COALESCE(NULLIF(d.router,SPACE(0)),l.allowfrom) AND n.app_id=d.app_id WHERE $where GROUP BY d.app_id,n.name,internal,external ORDER BY total DESC LIMIT 100";
+$rows = fv_nbar_query_cached($sql, $args);
+
+if (!is_array($rows)) {
+	print '<p class="textInfo nbarReportText">' . fv_nbar_h(__('Unable to load conversations. Please try again.', 'flowview')) . '</p>';
+
+	return;
+}
+$convbase = $base . '&mode=conversations' . ($aid !== '' ? '&app=' . $aid : '');
+
+if ($aid !== '') {
+	print '<p class="textInfo nbarReportText"><a class="ui-button ui-corner-all ui-widget" href="' . fv_nbar_h($base . '&mode=apps') . '">' . html_escape(__('← Back to top applications', 'flowview')) . '</a></p>';
+}
+print '<p class="textInfo nbarReportText">' . html_escape(__('Internal Host ↔ External Host. Click a device to see its individual connections. Bandwidth is averaged over the selected timespan.', 'flowview')) . '</p>';
+print '<div class="flowview-nbar-table-wrap"><table id="nbarConversationTable" class="cactiTable" style="width:100%"><thead><tr class="tableHeader">';
+
+foreach ([__('Internal Host', 'flowview'), __('External Host', 'flowview'), __('Application', 'flowview'), __('Download (GB)', 'flowview'), __('Upload (GB)', 'flowview'), __('Download (Avg Mbps)', 'flowview'), __('Upload (Avg Mbps)', 'flowview'), __('First seen', 'flowview'), __('Last seen', 'flowview')] as $index => $h) {
+	$unit = [3 => 'data', 4 => 'data', 5 => 'rate', 6 => 'rate'][$index] ?? '';
+	print '<th data-nbar-unit="' . $unit . '">' . fv_nbar_h($h) . '</th>';
+}
+print '</tr></thead><tbody>';
+$i = 0;
+
+foreach ($rows as $r) {
+	$link = $base . '&parent_app=' . rawurlencode($aid) . '&mode=connections&app=' . $r['app_id'] . '&internal=' . rawurlencode($r['internal']) . '&external=' . rawurlencode($r['external']);
+	print '<tr class="' . ($i++ % 2 ? 'even' : 'odd') . '">';
+
+	foreach (['internal', 'external'] as $f) {
+		$dns = fv_nbar_dns($r[$f]);
+		print '<td><a href="' . fv_nbar_h($link) . '">' . fv_nbar_h($r[$f]) . '</a><br><small>' . fv_nbar_h($dns) . '</small></td>';
+	}
+	print '<td>' . fv_nbar_h($r['name'] ?? __('Awaiting name (%s)', $r['app_id'], 'flowview')) . '</td>';
+
+	foreach ([$r['download'] / 1e9, $r['upload'] / 1e9, $r['download'] * 8 / $seconds / 1e6, $r['upload'] * 8 / $seconds / 1e6] as $j => $v) {
+		$precision = $j < 2 ? 4 : 3;
+		$threshold = pow(10, -$precision);
+		print '<td class="right" data-text="' . $v . '">' . ($v > 0 && $v < $threshold ? '&lt;' . number_format($threshold, $precision) : number_format($v, $precision)) . '</td>';
+	}
+	print fv_nbar_seen_cells($r) . '</tr>';
+}
+
+if (!$rows) {
+	print '<tr><td colspan="9">' . html_escape(__('No conversations for this period. Allow 1–2 minutes for exports, or choose a longer timespan.', 'flowview')) . '</td></tr>';
+}
+print '</tbody></table></div><details class="textInfo nbarReportText"><summary>' . html_escape(__('Report information', 'flowview')) . '</summary><p class="textInfo nbarReportText">' . html_escape(__('First seen and Last seen show the earliest and latest FlowView observations within the selected period, at minute precision. They do not identify continuous activity or exact flow start/end times. Unavailable means the retained summary has no complete observation dates.', 'flowview')) . '</p><p class="textInfo nbarReportText">' . html_escape(__('Top 100 conversations by combined data volume. Each row groups an Internal Host, External Host and application across both directions. Uses only the selected LAN captures to avoid counting WAN copies. Local and multicast traffic is excluded. DNS names identify servers, not the exact website requested. History retention: %d days.', fv_nbar_retention_days(), 'flowview')) . '</p></details>';
+
+print '<script ' . plugin_flowview_csp_nonce() . '>flowviewNbarInitTable(' . json_encode([
+	'table'         => '#nbarConversationTable',
+	'sortKey'       => 'flowview_nbar_conversation_sort',
+	'conversations' => true,
+	'resizeLabel'   => __('Drag to resize column', 'flowview')
+], JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ');</script>';
diff --git a/nbar_report.php b/nbar_report.php
new file mode 100644
index 0000000..824f007
--- /dev/null
+++ b/nbar_report.php
@@ -0,0 +1,469 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+// Included only through FlowView's authenticated entry point.
+if (!isset($config) || !function_exists('flowview_connect')) {
+	exit;
+}
+
+require_once($config['base_path'] . '/lib/time.php');
+require_once(__DIR__ . '/includes/nbar_common.php');
+require_once(__DIR__ . '/includes/nbar_dns.php');
+require_once(__DIR__ . '/includes/nbar_preferences.php');
+require_once(__DIR__ . '/includes/nbar_timespan.php');
+require_once(__DIR__ . '/includes/nbar_feed_status.php');
+require_once(__DIR__ . '/includes/nbar_query.php');
+require_once(__DIR__ . '/includes/nbar_chart.php');
+require_once(__DIR__ . '/includes/nbar_count.php');
+require_once(__DIR__ . '/includes/nbar_connections.php');
+
+// arrays.php populates report variables in this scope, so it is included on each request.
+include(__DIR__ . '/includes/arrays.php');
+
+/**
+ * Report arrays supplied by Cacti core and includes/arrays.php.
+ *
+ * @var array<int, string>               $graph_timespans
+ * @var array<int, array<string, mixed>> $stat_report_array
+ * @var array<int, array<string, mixed>> $print_report_array
+ */
+if ((int) read_config_option('flowview_nbar_schema_version') < 2) {
+	plugin_flowview_check_upgrade();
+	print '<p class="textInfo nbarReportText">' . html_escape(__('NBAR history is being upgraded. Refresh this report shortly.', 'flowview')) . '</p>';
+	bottom_footer();
+	exit;
+}
+
+// Report controls use GET links or a protected POST form.
+$nbar_request = [];
+
+foreach (['listener', 'period', 'family', 'mode', 'app', 'host', 'page', 'parent_app', 'context', 'predefined_timespan', 'date1', 'date2', 'lock_range', 'internal', 'external'] as $key) {
+	$value = get_nfilter_request_var($key, null);
+
+	if (is_scalar($value)) {
+		$nbar_request[$key] = (string) $value;
+	}
+}
+
+$devices          = flowview_db_fetch_assoc("SELECT id,name FROM plugin_flowview_devices WHERE enabled='on' ORDER BY id");
+$nbar_preferences = fv_nbar_preferences_init($devices);
+$lid              = (int) ($nbar_request['listener'] ?? ($devices[0]['id'] ?? 0));
+$valid            = array_column($devices, 'id');
+
+if ($lid !== 0 && !in_array($lid, $valid, true)) {
+	$lid = (int) ($valid[0] ?? 0);
+}
+$seconds = (int) ($nbar_request['period'] ?? 300);
+
+if (!in_array($seconds, [300, 900, 3600, 86400, 604800], true)) {
+	$seconds = 300;
+}
+$family = (string) ($nbar_request['family'] ?? 'all');
+
+if (!in_array($family, ['all', '4', '6'], true)) {
+	$family = 'all';
+}
+$mode = (string) ($nbar_request['mode'] ?? 'conversations');
+
+if (!in_array($mode, ['apps', 'conversations', 'connections'], true)) {
+	$mode = 'conversations';
+}
+$combined_lids = array_values(array_intersect($nbar_preferences['listeners'], array_map('intval', $valid)));
+
+if (!empty($GLOBALS['fv_nbar_preferences_saved']) && isset_request_var('combine_apply') && cacti_sizeof($combined_lids) >= 2) {
+	$lid = 0;
+}
+
+if ($lid === 0 && !$combined_lids) {
+	$lid = (int) ($valid[0] ?? 0);
+}
+// Capture ids start at 1, so 0 matches nothing when no capture device exists and IN () is never built.
+$listener_scope = $lid === 0 ? 'd.listener_id IN (' . implode(',', $combined_lids ?: [0]) . ')' : 'd.listener_id=?';
+$aid            = (string) ($nbar_request['app'] ?? '');
+
+if (!preg_match('/^[a-f0-9]{2,32}$/D', $aid)) {
+	$aid = '';
+}
+$host = (string) ($nbar_request['host'] ?? '');
+
+if (!filter_var($host, FILTER_VALIDATE_IP)) {
+	$host = '';
+}
+$page       = max(1, min(1000000, (int) ($nbar_request['page'] ?? 1)));
+$parent_app = (string) ($nbar_request['parent_app'] ?? '');
+
+if (!preg_match('/^[a-f0-9]{2,32}$/D', $parent_app)) {
+	$parent_app = '';
+}
+$end              = (int) (floor(time() / 60) * 60) - 60;
+$start            = $end - $seconds;
+$timespan_context = json_decode((string) ($nbar_request['context'] ?? ''), true);
+$timespan         = (int) ($nbar_request['predefined_timespan'] ?? ($timespan_context['predefined_timespan'] ?? 0));
+$custom_start     = strtotime((string) ($nbar_request['date1'] ?? ''));
+$custom_end       = strtotime((string) ($nbar_request['date2'] ?? ''));
+$has_dates        = $custom_start && $custom_end && $custom_end > $custom_start;
+$custom           = $has_dates;
+
+if (!isset($nbar_request['predefined_timespan']) && !isset($timespan_context['predefined_timespan']) && !$custom) {
+	$legacy = [3600 => GT_LAST_HOUR, 86400 => GT_LAST_DAY, 604800 => GT_LAST_WEEK];
+
+	if (isset($nbar_request['period'])) {
+		$timespan = $legacy[$seconds] ?? 0;
+	} else {
+		$timespan = GT_LAST_HALF_HOUR;
+	}
+}
+
+if ($timespan > 0 && $timespan !== 1000 && !isset($graph_timespans[$timespan])) {
+	$timespan = GT_LAST_HOUR;
+}
+$nbar_now            = (int) (floor(time() / 60) * 60);
+$nbar_retention_days = fv_nbar_retention_days();
+$nbar_timespans      = fv_nbar_timespan_options($graph_timespans, $nbar_now, $nbar_retention_days, read_user_setting('first_weekdayid'));
+$nbar_range_notice   = '';
+
+if ($timespan > 0 && !isset($nbar_timespans[$timespan])) {
+	$timespan          = GT_LAST_HALF_HOUR;
+	$nbar_range_notice = __('That period is outside the %s-day NBAR retention setting. Showing the last half hour.', $nbar_retention_days, 'flowview');
+	unset($nbar_request['lock_range']);
+}
+
+if ($timespan === 1000) {
+	$end    = $nbar_now;
+	$start  = $end - $nbar_retention_days * 86400;
+	$custom = false;
+} elseif ($timespan > 0) {
+	$nbar_span = [];
+	get_timespan($nbar_span, $nbar_now, $timespan, read_user_setting('first_weekdayid'));
+	$start  = strtotime($nbar_span['current_value_date1']);
+	$end    = strtotime($nbar_span['current_value_date2']);
+	$custom = false;
+} else {
+	if ($custom) {
+		$start = $custom_start;
+		$end   = $custom_end;
+	} else {
+		$end   = (int) (floor(time() / 60) * 60);
+		$start = $end - $seconds;
+	}
+	$timespan = 0;
+	$custom   = true;
+}
+
+if ($timespan === 0 && $has_dates) {
+	$start = $custom_start;
+	$end   = $custom_end;
+}
+
+if (!empty($nbar_request['lock_range']) && $has_dates) {
+	$start = $custom_start;
+	$end   = $custom_end;
+}
+[$start, $end, $nbar_dates_adjusted] = fv_nbar_bound_dates($start, $end, $nbar_now, $nbar_retention_days);
+
+if ($nbar_dates_adjusted) {
+	$timespan          = 0;
+	$custom            = true;
+	$nbar_range_notice = __('Dates adjusted to the %s-day NBAR retention window.', $nbar_retention_days, 'flowview');
+}
+// The primary key starts with capture/minute, so each lookup reads its first record.
+$nbar_earliest   = null;
+$nbar_data_error = false;
+
+foreach ($lid === 0 ? $combined_lids : [$lid] as $nbar_capture_id) {
+	$nbar_first = fv_nbar_data_edge($nbar_capture_id);
+
+	if ($nbar_first === false) {
+		$nbar_data_error = true;
+	} elseif (isset($nbar_first['minute'])) {
+		$nbar_first_minute = max($nbar_now - $nbar_retention_days * 86400, (int) $nbar_first['minute']);
+		$nbar_earliest     = $nbar_earliest === null ? $nbar_first_minute : min($nbar_earliest, $nbar_first_minute);
+	}
+}
+$seconds = max(1, $end - $start);
+$context = json_decode((string) ($nbar_request['context'] ?? ''), true);
+
+if (!is_array($context)) {
+	$context = [];
+}
+$allowed = ['query', 'report', 'predefined_timespan', 'ex_addr', 'sortfield', 'cutofflines', 'cutoffoctets', 'exclude', 'graph_type', 'graph_height', 'date1', 'date2', 'domains'];
+$context = array_intersect_key($context, array_flip($allowed));
+
+foreach ($context as $key => $value) {
+	if (!is_scalar($value)) {
+		unset($context[$key]);
+	}
+}
+
+if (!preg_match('/^[sp][0-9]+$/', (string) ($context['report'] ?? ''))) {
+	$context['report'] = 's10';
+}
+$report_key = (int) substr($context['report'], 1);
+
+if (!isset(($context['report'][0] === 's' ? $stat_report_array : $print_report_array)[$report_key])) {
+	$context['report'] = 's10';
+}
+$context_json                  = json_encode($context, JSON_THROW_ON_ERROR);
+$base                          = 'flowview.php?' . http_build_query(['action' => 'view', 'report' => 'nbar', 'listener' => $lid, 'predefined_timespan' => $timespan, 'lock_range' => 1, 'family' => $family, 'date1' => date('Y-m-d H:i', $start), 'date2' => date('Y-m-d H:i', $end), 'context' => $context_json, 'host' => $host]);
+$return                        = $context;
+$return['action']              = 'view';
+$return['device_id']           = $lid;
+$return['date1']               = date('Y-m-d H:i', $start);
+$return['date2']               = date('Y-m-d H:i', $end);
+$return['predefined_timespan'] = $timespan;
+$return['section']             = 'flows';
+$return_url                    = 'flowview.php?' . http_build_query($return);
+parse_str((string) parse_url($base, PHP_URL_QUERY), $section_params);
+$section_params['mode'] = $mode;
+fv_section_save('nbar', $section_params);
+fv_section_navigation('nbar');
+html_start_box(__('Application Report: Cisco Apps Recognition (NBAR)', 'flowview'), '100%', false, 3, 'center', '');
+print '<tr class="even"><td style="padding:4px 8px">';
+fv_nbar_feed_status($devices, array_map('intval', $lid === 0 ? $combined_lids : [$lid]));
+print '</td></tr>';
+print '<tr class="even"><td><div class="nbarReportBar"><form id="nbar_filter" method="post" action="flowview.php">';
+print '<input type="hidden" name="__csrf_magic" value="' . fv_nbar_h(csrf_get_tokens()) . '">';
+
+foreach (['action' => 'view', 'report' => 'nbar', 'context' => $context_json, 'app' => $aid, 'parent_app' => $parent_app] as $key => $value) {
+	print '<input type="hidden" name="' . $key . '" value="' . fv_nbar_h($value) . '">';
+}
+
+foreach (['internal', 'external'] as $f) {
+	if ($mode === 'connections' && filter_var($nbar_request[$f] ?? '', FILTER_VALIDATE_IP)) {
+		print '<input type="hidden" name="' . $f . '" value="' . fv_nbar_h($nbar_request[$f] ?? '') . '">';
+	}
+}
+print '<table class="filterTable"><tr><td>' . html_escape(__('Router / capture', 'flowview')) . '</td><td><select name="listener">';
+
+if (cacti_sizeof($combined_lids) > 1) {
+	print '<option value="0"' . ($lid === 0 ? ' selected' : '') . '>' . html_escape(__('Combined routers', 'flowview')) . '</option>';
+}
+
+foreach ($devices as $d) {
+	print '<option value="' . (int) $d['id'] . '"' . ($lid === (int) $d['id'] ? ' selected' : '') . '>' . fv_nbar_h($d['name']) . '</option>';
+}
+print '</select></td><td><button class="ui-button ui-corner-all ui-widget" type="submit">' . html_escape(__('Go', 'flowview')) . '</button></td><td><a class="ui-button ui-corner-all ui-widget" href="' . fv_nbar_h('flowview.php?action=view&report=nbar&listener=' . $lid . '&context=' . rawurlencode($context_json)) . '">' . html_escape(__('Clear', 'flowview')) . '</a></td><td><button type="button" id="nbarCombineOptions" class="ui-button ui-corner-all ui-widget">' . html_escape(__('Options', 'flowview')) . '</button></td><td><button type="button" id="nbarSetupLink" class="ui-button ui-corner-all ui-widget">' . html_escape(__('Setup guide', 'flowview')) . '</button></td></tr></table>';
+print '<div style="display:flex;flex-wrap:wrap;align-items:center;gap:0 8px"><table class="filterTable" style="width:auto;margin:0"><tr><td>' . html_escape(__('IP version', 'flowview')) . '</td><td><select name="family">';
+
+foreach (['all' => __('IPv4 and IPv6', 'flowview'), '4' => 'IPv4', '6' => 'IPv6'] as $v => $t) {
+	print '<option value="' . $v . '"' . ((string) $v === $family ? ' selected' : '') . '>' . $t . '</option>';
+}
+print '</select></td><td>' . html_escape(__('Show', 'flowview')) . '</td><td><select name="mode"><option value="conversations"' . ($mode === 'conversations' ? ' selected' : '') . '>' . html_escape(__('Conversations', 'flowview')) . '</option><option value="apps"' . ($mode === 'apps' ? ' selected' : '') . '>' . html_escape(__('Top applications', 'flowview')) . '</option><option value="connections"' . ($mode === 'connections' ? ' selected' : '') . '>' . html_escape(__('Connections', 'flowview')) . '</option></select></td></tr></table>';
+print '<table class="filterTable" style="width:auto;margin:0"><tr><td>' . html_escape(__('Filter by IP', 'flowview')) . '</td><td><input type="text" name="host" size="30" placeholder="' . plugin_flowview_escape_attr(__('Any IPv4 or IPv6 address', 'flowview')) . '" title="' . plugin_flowview_escape_attr(__('Show traffic where this IP is the source or destination. Leave blank to show all.', 'flowview')) . '" value="' . fv_nbar_h($host) . '"></td></tr></table></div>';
+print '<table class="filterTable"><tr><td>' . html_escape(__('Timespan', 'flowview')) . '</td><td><select name="predefined_timespan" id="nbar_period"><option value="0"' . ($custom ? ' selected' : '') . '>' . html_escape(__('Custom', 'flowview')) . '</option>';
+
+foreach ($nbar_timespans as $v => $t) {
+	print '<option value="' . $v . '"' . ($v === $timespan ? ' selected' : '') . '>' . fv_nbar_h($t) . '</option>';
+}
+print '</select></td><td>' . html_escape(__('From', 'flowview')) . '</td><td><input type="text" name="date1" id="nbar_date1" size="16" value="' . fv_nbar_h(date('Y-m-d H:i', $start)) . '"></td><td>' . html_escape(__('To', 'flowview')) . '</td><td><input type="text" name="date2" id="nbar_date2" size="16" value="' . fv_nbar_h(date('Y-m-d H:i', $end)) . '"></td></tr></table>';
+
+if ($nbar_range_notice !== '') {
+	print '<p role="status">' . fv_nbar_h($nbar_range_notice) . '</p>';
+}
+fv_nbar_preferences_render($devices, $base, $mode, $aid, $parent_app);
+print '</form>';
+
+if ($nbar_data_error) {
+	print '<p class="alert">' . fv_nbar_h(__('Unable to read the NBAR records. Please try again.', 'flowview')) . '</p>';
+} else {
+	fv_nbar_chart($listener_scope, $lid === 0 ? [$start, $end] : [$lid, $start, $end], $family, $host);
+}
+print '</div></td></tr>';
+html_end_box();
+include(__DIR__ . '/nbar_setup_guide.php');
+
+print '<script src="' . plugin_flowview_escape_attr($config['url_path'] . 'plugins/flowview/js/nbar-report.js') . '"></script>';
+print '<script src="' . $config['url_path'] . 'include/js/jquery.tablesorter.widgets.js"></script>';
+print '<script src="' . plugin_flowview_escape_attr($config['url_path'] . 'plugins/flowview/js/nbar-tables.js') . '"></script>';
+
+if ($nbar_data_error) {
+	bottom_footer();
+
+	return;
+}
+
+if ($mode === 'conversations') {
+	include(__DIR__ . '/nbar_conversations.php');
+	bottom_footer();
+	exit;
+}
+
+if ($mode === 'connections' && $aid !== '' && !filter_var($nbar_request['internal'] ?? '', FILTER_VALIDATE_IP)) {
+	print '<p class="textInfo nbarReportText"><a class="ui-button ui-corner-all ui-widget" href="' . fv_nbar_h($base . '&mode=apps') . '">' . html_escape(__('← Back to top applications', 'flowview')) . '</a></p>';
+}
+$where = $listener_scope . ' AND d.minute>=? AND d.minute<?';
+$args  = $lid === 0 ? [$start, $end] : [$lid, $start, $end];
+
+if ($family !== 'all') {
+	$where .= ' AND LENGTH(d.src)=' . ($family === '6' ? 16 : 4);
+}
+
+if ($aid !== '') {
+	$where .= ' AND d.app_id=?';
+	$args[] = $aid;
+}
+
+if ($host !== '') {
+	$where .= ' AND (d.src=INET6_ATON(?) OR d.dst=INET6_ATON(?))';
+	array_push($args, $host, $host);
+}
+
+$internal = (string) ($nbar_request['internal'] ?? '');
+$external = (string) ($nbar_request['external'] ?? '');
+
+if ($mode === 'connections' && filter_var($internal, FILTER_VALIDATE_IP) && filter_var($external, FILTER_VALIDATE_IP)) {
+	$where .= ' AND ((d.src=INET6_ATON(?) AND d.dst=INET6_ATON(?)) OR (d.src=INET6_ATON(?) AND d.dst=INET6_ATON(?)))';
+	array_push($args, $internal, $external, $external, $internal);
+	print '<p class="textInfo nbarReportText"><a class="ui-button ui-corner-all ui-widget" href="' . fv_nbar_h($base . '&mode=conversations' . ($parent_app !== '' ? '&app=' . $parent_app : '')) . '">' . html_escape(__('← Back to conversations', 'flowview')) . '</a> &nbsp; ' . fv_nbar_h($internal) . ' &harr; ' . fv_nbar_h($external) . '</p>';
+}
+$fields = 'd.app_id,n.name,SUM(d.bytes) bytes,SUM(d.packets) packets,SUM(d.flows) records,IF(COUNT(d.first_seen)=COUNT(*),MIN(d.first_seen),NULL) first_seen,IF(COUNT(d.last_seen)=COUNT(*),MAX(d.last_seen),NULL) last_seen';
+$group  = 'd.app_id,n.name';
+
+if ($mode === 'connections') {
+	$fields .= ',INET6_NTOA(d.src) src,INET6_NTOA(d.dst) dst,d.sport,d.dport,d.protocol';
+	$group .= ',d.src,d.dst,d.sport,d.dport,d.protocol';
+}
+$nbar_source = null;
+
+if ($mode === 'apps') {
+	try {
+		$nbar_source = fv_nbar_summary_source($host === '' ? 'apps' : 'pairs', $lid === 0 ? $combined_lids : [$lid], $start, $end);
+	} catch (RuntimeException $e) {
+		cacti_log('NBAR applications: ' . $e->getMessage(), false, 'FLOWVIEW');
+		print '<p class="alert">' . fv_nbar_h(__('Unable to load applications. Please try again.', 'flowview')) . '</p>';
+		bottom_footer();
+
+		return;
+	}
+}
+
+if ($mode === 'apps') {
+	// Resolve names after reducing raw records to one row per capture/application.
+	$sql = 'SELECT d.app_id,n.name,SUM(d.bytes) bytes,SUM(d.packets) packets,SUM(d.flows) records,IF(COUNT(d.first_seen)=COUNT(*),MIN(d.first_seen),NULL) first_seen,IF(COUNT(d.last_seen)=COUNT(*),MAX(d.last_seen),NULL) last_seen FROM (SELECT d.listener_id,d.app_id,d.router,SUM(d.bytes) bytes,SUM(d.packets) packets,SUM(d.flows) flows,IF(COUNT(d.first_seen)=COUNT(*),MIN(d.first_seen),NULL) first_seen,IF(COUNT(d.last_seen)=COUNT(*),MAX(d.last_seen),NULL) last_seen FROM ' . $nbar_source . ' d WHERE ' . $where . ' GROUP BY d.listener_id,d.app_id,d.router) d JOIN plugin_flowview_devices l ON l.id=d.listener_id LEFT JOIN plugin_flowview_nbar_names n ON n.router=COALESCE(NULLIF(d.router,SPACE(0)),l.allowfrom) AND n.app_id=d.app_id GROUP BY d.app_id,n.name ORDER BY bytes DESC LIMIT 100';
+}
+
+if ($mode === 'connections') {
+	try {
+		$nbar_count_key = fv_nbar_count_context('', $where, $args, $end, $lid === 0 ? $combined_lids : [$lid], $start);
+		$rows           = fv_nbar_connections_cached($lid === 0 ? $combined_lids : [$lid], $start, $end, $where, $args, $page);
+	} catch (Throwable $e) {
+		cacti_log('NBAR connection page: ' . $e->getMessage(), false, 'FLOWVIEW');
+		print '<p class="alert">' . fv_nbar_h(__('Unable to load connections. Try a shorter timespan or filter by IP.', 'flowview')) . '</p>';
+		bottom_footer();
+
+		return;
+	}
+} else {
+	$rows = fv_nbar_query_cached($sql, $args);
+
+	if (!is_array($rows)) {
+		print '<p class="alert">' . fv_nbar_h(__('Unable to load applications. Please try again.', 'flowview')) . '</p>';
+		bottom_footer();
+
+		return;
+	}
+}
+$has_next = $mode === 'connections' && cacti_sizeof($rows) > 100;
+
+if ($has_next) {
+	$rows = array_slice($rows, 0, 100);
+}
+$nbar_pagination = '';
+
+if ($mode === 'connections') {
+	$page_params     = ['mode' => 'connections', 'app' => $aid, 'parent_app' => $parent_app, 'host' => $host, 'internal' => $internal, 'external' => $external];
+	$nbar_page_key   = hash('sha256', $base . '&' . http_build_query($page_params));
+	$nbar_pagination = '<div class="nbarPagination textInfo nbarReportText" style="display:flex;align-items:center;flex-wrap:wrap;gap:8px;margin:8px 4px">';
+	$nbar_page_total = '<span class="nbarPageTotal" data-count-key="' . fv_nbar_h($nbar_count_key) . '" aria-live="polite">' . fv_nbar_h(__('Counting total pages…', 'flowview')) . '</span>';
+	$nbar_pagination .= '<label>' . fv_nbar_h(__('Page', 'flowview')) . ' <input class="nbarPageNumber" type="number" required min="1" max="1000000" value="' . $page . '" style="width:100px"></label><button type="button" class="nbarPageJump ui-button ui-corner-all ui-widget" data-url="' . fv_nbar_h($base . '&' . http_build_query($page_params)) . '">' . __('Go', 'flowview') . '</button>' . $nbar_page_total . '<span>' . fv_nbar_h(__('Up to 100 connections per page, ordered by data volume.', 'flowview')) . '</span>';
+
+	if ($page > 1) {
+		$nbar_pagination .= '<a class="nbarPageLink ui-button ui-corner-all ui-widget" href="' . fv_nbar_h($base . '&' . http_build_query($page_params + ['page' => $page - 1])) . '">' . __('Previous', 'flowview') . '</a>';
+	}
+
+	if ($has_next && $page < 1000000) {
+		$nbar_pagination .= '<a class="nbarPageLink ui-button ui-corner-all ui-widget" href="' . fv_nbar_h($base . '&' . http_build_query($page_params + ['page' => $page + 1])) . '">' . __('Next', 'flowview') . '</a>';
+	}
+	$nbar_pagination .= '</div>';
+	print $nbar_pagination;
+}
+
+if ($mode === 'connections' && $aid !== '') {
+	$selected_name = $rows[0]['name'] ?? __('Application %s', $aid, 'flowview');
+	print '<p class="textInfo nbarReportText"><strong>' . fv_nbar_h(strtoupper($selected_name)) . ' &mdash; Connections</strong></p>';
+}
+print '<div class="flowview-nbar-table-wrap"><table class="cactiTable" id="nbarTable" ><thead><tr class="tableHeader"><th>' . html_escape(__('Application', 'flowview')) . '</th>';
+
+if ($mode === 'connections') {
+	print '<th>' . html_escape(__('Source IP', 'flowview')) . '</th><th data-nbar-unit="dns" title="' . plugin_flowview_escape_attr(__('Reverse DNS hostname', 'flowview')) . '">' . html_escape(__('Source DNS', 'flowview')) . '</th><th>' . html_escape(__('Source port', 'flowview')) . '</th><th>' . html_escape(__('Destination IP', 'flowview')) . '</th><th data-nbar-unit="dns" title="' . plugin_flowview_escape_attr(__('Reverse DNS hostname', 'flowview')) . '">' . html_escape(__('Destination DNS', 'flowview')) . '</th><th>' . html_escape(__('Destination port', 'flowview')) . '</th><th>' . html_escape(__('Protocol', 'flowview')) . '</th>';
+}
+print '<th data-nbar-unit="data">' . html_escape(__('Data (GB)', 'flowview')) . '</th><th data-nbar-unit="rate">' . html_escape(__('Bandwidth (Avg Mbps)', 'flowview')) . '</th><th>' . html_escape(__('Packets', 'flowview')) . '</th><th>' . html_escape(__('Records', 'flowview')) . '</th><th title="' . plugin_flowview_escape_attr(__('First FlowView observation in the selected period', 'flowview')) . '">' . html_escape(__('First seen', 'flowview')) . '</th><th title="' . plugin_flowview_escape_attr(__('Last FlowView observation in the selected period', 'flowview')) . '">' . html_escape(__('Last seen', 'flowview')) . '</th></tr></thead><tbody>';
+$nbar_row = 0;
+
+foreach ($rows as $r) {
+	$name = $r['name'] ?? __('Awaiting name (%s)', $r['app_id'], 'flowview');
+	print '<tr class="' . (($nbar_row++ % 2) ? 'even' : 'odd') . '"><td>';
+
+	if ($mode === 'connections') {
+		print fv_nbar_h($name);
+	} else {
+		print '<a href="' . fv_nbar_h($base . '&mode=conversations&app=' . $r['app_id']) . '">' . fv_nbar_h($name) . '</a>';
+	}
+	print '</td>';
+
+	if ($mode === 'connections') {
+		foreach (['src', 'sport', 'dst', 'dport'] as $f) {
+			print '<td>' . fv_nbar_h($r[$f]) . '</td>';
+
+			if ($f === 'src' || $f === 'dst') {
+				print '<td>' . fv_nbar_h(fv_nbar_dns($r[$f])) . '</td>';
+			}
+		}
+		print '<td>' . fv_nbar_h([6 => 'TCP', 17 => 'UDP', 1 => 'ICMP', 58 => 'ICMPv6'][$r['protocol']] ?? $r['protocol']) . '</td>';
+	}
+
+	print '<td class="right" data-text="' . ($r['bytes'] / 1e9) . '">' . ($r['bytes'] > 0 && $r['bytes'] < 100000 ? '&lt;0.0001' : number_format($r['bytes'] / 1e9, 4)) . '</td><td class="right" data-text="' . ($r['bytes'] * 8 / $seconds / 1e6) . '">' . ($r['bytes'] > 0 && $r['bytes'] * 8 / $seconds / 1e6 < 0.001 ? '&lt;0.001' : number_format($r['bytes'] * 8 / $seconds / 1e6, 3)) . '</td><td class="right" data-text="' . $r['packets'] . '">' . number_format($r['packets']) . '</td><td class="right" data-text="' . $r['records'] . '">' . number_format($r['records']) . '</td>' . fv_nbar_seen_cells($r) . '</tr>';
+}
+
+if (!$rows) {
+	print '<tr><td colspan="14">' . html_escape(__('No application records in this view yet. Try a longer period or another traffic view.', 'flowview')) . '</td></tr>';
+}
+print '</tbody></table></div>';
+print $nbar_pagination;
+
+if ($mode === 'connections') {
+	print '<script ' . plugin_flowview_csp_nonce() . '>$(function(){var key=' . json_encode($nbar_count_key) . ',tries=0,format=' . json_encode(__('of {pages} pages ({connections} connections)', 'flowview'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ',unavailable=' . json_encode(__('Total pages unavailable', 'flowview'), JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ';
+ function labels(){return $(".nbarPageTotal").filter(function(){return this.dataset.countKey===key;});}
+ function countPages(){if(!labels().length)return;$.ajax({url:"flowview.php",data:{action:"nbar_count",key:key},dataType:"json",timeout:100000,global:false}).done(function(r){var el=labels();if(!el.length)return;if(r.status==="ready"){el.text(format.replace("{pages}",r.pages.toLocaleString()).replace("{connections}",r.total.toLocaleString()));el.closest(".nbarPagination").find(".nbarPageNumber").attr("max",Math.max(1,r.pages));}else if(r.status==="busy"&&++tries<36){setTimeout(countPages,5000);}else{el.text(unavailable);}}).fail(function(){labels().text(unavailable);});}countPages();});</script>';
+}
+
+print '<details class="textInfo nbarReportText"><summary>' . html_escape(__('Report information', 'flowview')) . '</summary><p class="textInfo nbarReportText">' . html_escape(__('First seen and Last seen show the earliest and latest FlowView observations within the selected period, at minute precision. They do not identify continuous activity or exact flow start/end times. Unavailable means the retained summary has no complete observation dates.', 'flowview')) . '</p><p class="textInfo nbarReportText">' . html_escape(__('Results are ordered by data volume; Connections shows up to 100 per page. Column sorting applies to the displayed page. NBAR history uses the configured retention setting. Daily summaries are reused across report selections; partial days use hourly summaries, and partial or changed hours use raw records. Connections pages are read from shared daily history, with nearby pages briefly cached for navigation. Average Mbps covers the selected period; allow 1–2 minutes for exports. Capture visibility depends on the device exporter and observation point. NAT can hide internal IPv4 addresses on a WAN capture. Select one observation point per traffic path to avoid duplicate totals. Cisco NBAR may classify encrypted traffic as SSL, QUIC or Unknown. History starts when export is enabled.', 'flowview')) . '</p></details>';
+print '<script ' . plugin_flowview_csp_nonce() . '>flowviewNbarInitTable(' . json_encode([
+	'table'         => '#nbarTable',
+	'sortKey'       => 'flowview-nbar-sort-' . ($nbar_page_key ?? 'apps'),
+	'conversations' => false,
+	'resizeLabel'   => __('Drag to resize column', 'flowview')
+], JSON_HEX_TAG | JSON_HEX_AMP | JSON_HEX_APOS | JSON_HEX_QUOT) . ');</script>';
+bottom_footer();
diff --git a/nbar_setup_guide.php b/nbar_setup_guide.php
new file mode 100644
index 0000000..8ab6bf3
--- /dev/null
+++ b/nbar_setup_guide.php
@@ -0,0 +1,99 @@
+<?php
+
+/*
+ +-------------------------------------------------------------------------+
+ | Copyright (C) 2004-2026 The Cacti Group                                 |
+ |                                                                         |
+ | This program is free software; you can redistribute it and/or           |
+ | modify it under the terms of the GNU General Public License             |
+ | as published by the Free Software Foundation; either version 2          |
+ | of the License, or (at your option) any later version.                  |
+ |                                                                         |
+ | This program is distributed in the hope that it will be useful,         |
+ | but WITHOUT ANY WARRANTY; without even the implied warranty of          |
+ | MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the           |
+ | GNU General Public License for more details.                            |
+ +-------------------------------------------------------------------------+
+ | Cacti: The Complete RRDTool-based Graphing Solution                     |
+ +-------------------------------------------------------------------------+
+ | This code is designed, written, and maintained by the Cacti Group. See  |
+ | about.php and/or the AUTHORS file for specific developer information.   |
+ +-------------------------------------------------------------------------+
+ | http://www.cacti.net/                                                   |
+ +-------------------------------------------------------------------------+
+*/
+
+/** @var array<string, mixed> $config Cacti's global configuration, available in nbar_report.php's scope. */
+if (!function_exists('fv_nbar_h')) {
+	http_response_code(403);
+	exit;
+}
+?>
+<dialog class="ui-dialog ui-widget ui-widget-content ui-corner-all" id="nbarSetupGuide" aria-labelledby="nbarSetupTitle"><div class="nbarGuideHeader ui-widget-header ui-corner-top"><strong id="nbarSetupTitle"><?php print html_escape(__('Setup guide — Cisco Apps (NBAR)', 'flowview')); ?></strong><button type="button" class="ui-button ui-corner-all ui-widget" id="nbarSetupClose"><?php print html_escape(__('Close', 'flowview')); ?></button></div><div class="nbarGuideBody"><h3><?php print html_escape(__('Requirements', 'flowview')); ?></h3><p><?php print html_escape(__('This configuration example is based on a Cisco 1100 Series ISR installation using NBAR2, Flexible NetFlow and application export. For other router types, refer to Cisco documentation for your exact router model and IOS XE release for supported commands, features and configuration requirements. Input/output monitoring and licence requirements vary by platform. Protocol packs must match their supported IOS XE release and NBAR engine. This guide does not apply router changes.', 'flowview')); ?></p><h3><?php print html_escape(__('1. FlowView listener', 'flowview')); ?></h3><p><?php print html_escape(__('Create and enable a listener with the correct UDP port and allowed router export-source address. Start or restart the capture service after adding a listener. Allow the UDP port through the collector firewall. The export source must reach the collector. An IPv4 exporter can carry both IPv4 and IPv6 records.', 'flowview')); ?></p><h3><?php print html_escape(__('2. Router configuration example', 'flowview')); ?></h3><p><?php print html_escape(__('Replace the red placeholders with your own values:', 'flowview')); ?> <strong style="color:#c62828">COLLECTOR_IP</strong> <?php print html_escape(__('is the Cacti collector address;', 'flowview')); ?> <strong style="color:#c62828">LISTENER_PORT</strong> <?php print html_escape(__('is the listener UDP port;', 'flowview')); ?> <strong style="color:#c62828">EXPORT_SOURCE</strong> <?php print html_escape(__('is a router interface whose address can reach the collector;', 'flowview')); ?> <strong style="color:#c62828">VlanXX</strong> <?php print html_escape(__('is the routed LAN interface to monitor. The export source identifies the router sending flow records; it does not choose which traffic is captured. It may differ from the monitored LAN VLAN. Set the FlowView listener to allow the chosen export-source IP. This example uses NetFlow v9 application records from a Cisco 1100 Series ISR. It omits optional routing metadata. Check Cisco documentation for defaults and supported record fields on your platform. The NBAR decoder currently supports application records exported using NetFlow v9; IPFIX application records are not decoded by this integration.', 'flowview')); ?></p><pre class="ui-widget-content ui-corner-all" style="overflow:auto;max-height:420px">flow record CACTI_NBAR4
+ match ipv4 tos
+ match ipv4 protocol
+ match ipv4 source address
+ match ipv4 destination address
+ match transport source-port
+ match transport destination-port
+ match interface input
+ match application name
+ collect transport tcp flags
+ collect interface output
+ collect counter bytes long
+ collect counter packets long
+ collect timestamp sys-uptime first
+ collect timestamp sys-uptime last
+!
+flow record CACTI_NBAR6
+ match ipv6 traffic-class
+ match ipv6 flow-label
+ match ipv6 protocol
+ match ipv6 extension map
+ match ipv6 source address
+ match ipv6 destination address
+ match transport source-port
+ match transport destination-port
+ match interface input
+ match flow direction
+ match application name
+ collect transport tcp flags
+ collect interface output
+ collect counter bytes long
+ collect counter packets long
+ collect timestamp sys-uptime first
+ collect timestamp sys-uptime last
+!
+flow exporter CACTI_LAN
+ destination <strong style="color:#c62828">COLLECTOR_IP</strong>
+ source <strong style="color:#c62828">EXPORT_SOURCE</strong>
+ transport udp <strong style="color:#c62828">LISTENER_PORT</strong>
+ template data timeout 60
+ option application-table timeout 60
+!
+flow monitor CACTI_APP4_LAN
+ exporter CACTI_LAN
+ cache timeout active 60
+ record CACTI_NBAR4
+!
+flow monitor CACTI_APP6_LAN
+ exporter CACTI_LAN
+ cache timeout active 60
+ record CACTI_NBAR6
+!
+interface <strong style="color:#c62828">VlanXX</strong>
+ ip flow monitor CACTI_APP4_LAN input
+ ip flow monitor CACTI_APP4_LAN output
+ ipv6 flow monitor CACTI_APP6_LAN input
+ ipv6 flow monitor CACTI_APP6_LAN output</pre><h3><?php print html_escape(__('3. Capture and report settings', 'flowview')); ?></h3><p><?php print html_escape(__('For example, replace', 'flowview')); ?> <strong style="color:#c62828">VlanXX</strong> <?php print html_escape(__('with', 'flowview')); ?> <code>Vlan1</code> <?php print html_escape(__('if that is the routed gateway interface for your LAN. Apply both the IPv4 and IPv6 monitors in input and output directions on that interface, as shown above. Input captures traffic arriving from that LAN towards the WAN; output captures traffic returning from the WAN to that LAN. This covers LAN-to-WAN traffic routed through that interface without also attaching the same monitors to the WAN. Use your actual routed LAN interface or VLAN interface; Vlan1 is an example, not a requirement. Traffic routed between VLANs can also cross this interface, so the capture is not limited to Internet traffic. Locally switched traffic that does not cross the router is outside this capture. Avoid combining LAN and WAN copies of the same traffic. For combined routers, select up to three captures, normally one LAN capture per router.', 'flowview')); ?></p><p><?php print html_escape(__('Top applications and Connections use exported addresses directly. Conversations needs internal IPv4 and IPv6 networks in Options to distinguish Internal Hosts from External Hosts. Update delegated IPv6 prefixes when they change; retain old prefixes while viewing their history.', 'flowview')); ?></p><h3><?php print html_escape(__('4. Verify collection', 'flowview')); ?></h3><p><?php print html_escape(__('Use your monitor and exporter names. Generate traffic and check both caches and export counters. Allow 1-2 minutes for exports to appear. Check QFP load during a speed test; overhead depends on platform, traffic and capture count.', 'flowview')); ?></p><pre class="ui-widget-content ui-corner-all" style="overflow:auto">show ip nbar version
+show ip nbar protocol-pack active
+show flow interface
+show flow exporter CACTI_LAN statistics
+show flow monitor CACTI_APP4_LAN statistics
+show flow monitor CACTI_APP6_LAN statistics
+show flow monitor CACTI_APP6_LAN cache format table
+show platform hardware qfp active datapath utilization
+</pre><h3><?php print html_escape(__('Reading reports', 'flowview')); ?></h3><p><?php print html_escape(__('Average bandwidth covers the selected timespan, not an instantaneous or peak rate. Conversations combines both directions for each Internal Host, External Host and application. Classification comes from the router; encrypted traffic can remain SSL or QUIC. DNS names identify hosts, not the exact HTTPS page.', 'flowview')); ?></p><hr><small>Copyright (c) 2004-2026 The Cacti Group.</small></div></dialog>
+<?php
+
+print '<script src="' . plugin_flowview_escape_attr($config['url_path'] . 'plugins/flowview/js/nbar-setup-guide.js') . '"></script>';
diff --git a/phpunit.xml b/phpunit.xml
index 2ec8407..ea1e6e4 100644
--- a/phpunit.xml
+++ b/phpunit.xml
@@ -39,6 +39,24 @@
             <file>Net/DNS2/Updater.php</file>
             <file>includes/functions.php</file>
             <file>includes/database.php</file>
+            <file>includes/nbar_chart.php</file>
+            <file>includes/nbar_collector.php</file>
+            <file>includes/nbar_common.php</file>
+            <file>includes/nbar_connections.php</file>
+            <file>nbar_conversations.php</file>
+            <file>includes/nbar_count.php</file>
+            <file>includes/nbar_daily.php</file>
+            <file>includes/nbar_dns.php</file>
+            <file>includes/nbar_feed_status.php</file>
+            <file>includes/nbar_partition.php</file>
+            <file>includes/nbar_preferences.php</file>
+            <file>includes/nbar_query.php</file>
+            <file>nbar_report.php</file>
+            <file>includes/nbar_seen.php</file>
+            <file>nbar_setup_guide.php</file>
+            <file>includes/nbar_summary.php</file>
+            <file>includes/nbar_timespan.php</file>
+            <file>flowview_sections.php</file>
         </include>
     </source>
 </phpunit>
diff --git a/run_schedule.php b/run_schedule.php
index 17c052c..2799c6b 100644
--- a/run_schedule.php
+++ b/run_schedule.php
@@ -124,7 +124,7 @@
 				LIMIT 1',
 				['flowview', 'pending']);
 
-			if (cacti_sizeof($report)) {
+			if (is_array($report) && cacti_sizeof($report)) {
 				reports_run($report['id']);
 
 				$run++;
@@ -155,7 +155,7 @@
 		AND rq.id = ?',
 		['flowview', $report_id]);
 
-	if (cacti_sizeof($report)) {
+	if (is_array($report) && cacti_sizeof($report)) {
 		$id = $report['source_id'];
 
 		/* silently end if the registered process is still running, or process table missing */
diff --git a/setup.php b/setup.php
index 8726c0f..0548c8a 100644
--- a/setup.php
+++ b/setup.php
@@ -23,6 +23,8 @@
  +-------------------------------------------------------------------------+
 */
 
+require_once(__DIR__ . '/includes/nbar_common.php');
+
 /**
  * Return the CSP nonce attribute for inline <script> tags, safely across
  * Cacti versions. Newer Cacti releases enforce a Content-Security-Policy that
@@ -39,6 +41,21 @@ function plugin_flowview_csp_nonce(): string {
 	return '';
 }
 
+/**
+ * Escape an HTML attribute on supported Cacti 1.2 and newer installations.
+ *
+ * @param mixed $value Attribute value.
+ *
+ * @return string Escaped attribute value.
+ */
+function plugin_flowview_escape_attr(mixed $value): string {
+	if (function_exists('html_escape_attr')) {
+		return html_escape_attr($value);
+	}
+
+	return htmlspecialchars((string) $value, ENT_QUOTES | ENT_SUBSTITUTE, 'UTF-8');
+}
+
 /**
  * @return bool
  */
@@ -146,10 +163,15 @@ function plugin_flowview_check_upgrade(bool $force = false): void {
 		FROM plugin_config
 		WHERE directory = ?', array('flowview'));
 
-	if ($current != $old || $force) {
+	if ($current != $old || $force || (int) read_config_option('flowview_nbar_schema_version') < 2) {
 		$php_binary = read_config_option('path_php_binary');
 
-		exec_background($php_binary, '-q ' .$config['base_path'] . '/plugins/flowview/flowview_upgrade.php');
+		/* This check runs on every page load. Launch the upgrade once; cli/flowview_upgrade.php takes over this
+		 * registration's PID and releases it when it finishes, and the four hour timeout recovers it if that
+		 * process dies. */
+		if (register_process_start('flowview', 'upgrade_launch', 0, 14400)) {
+			exec_background($php_binary, '-q ' . $config['base_path'] . '/plugins/flowview/cli/flowview_upgrade.php');
+		}
 
 		raise_message('flowview_upgrade', __('Please be advised the Flowview plugins Tables are being upgraded in the background.  This may take some time. Check the Cacti log for more information'), MESSAGE_LEVEL_INFO);
 
@@ -229,6 +251,8 @@ function flowview_draw_navigation_text($nav) {
 		'level' => '0'
 	);
 
+	$nav['flowview.php:applications'] = $nav['flowview.php:'];
+
 	$nav['flowview.php:view'] = array(
 		'title' => __('Dashboard', 'flowview'),
 		'mapping' => 'flowview.php:',
@@ -620,6 +644,12 @@ function flowview_config_settings(): void {
 			),
 			'default' => 30
 		),
+	'flowview_nbar_retention_days' => array(
+        'friendly_name' => __('Cisco Apps (NBAR) History Retention', 'flowview'),
+        'description' => __('Days of application history to retain. Reducing this removes older history during scheduled cleanup; increasing it cannot restore expired data.', 'flowview'),
+        'method' => 'drop_array', 'default' => '7',
+        'array' => array(1 => __('1 Day', 'flowview'), 3 => __('3 Days', 'flowview'), 7 => __('7 Days', 'flowview'), 14 => __('14 Days', 'flowview'), 30 => __('30 Days', 'flowview'))
+    ),
 		'flowview_partition' => array(
 			'friendly_name' => __('Database Partitioning Scheme', 'flowview'),
 			'description' => __('Depending on the number of flows per minute, you may require more tables per day.', 'flowview'),
@@ -772,6 +802,10 @@ function flowview_poller_bottom(): void {
 
 	flowview_connect();
 
+	if ((int) read_config_option('flowview_nbar_schema_version') >= 2) {
+		fv_nbar_launch_maintenance();
+	}
+
 	$retention_days = read_config_option('flowview_retention');
 
 	if (empty($retention_days)) {
@@ -850,7 +884,7 @@ function flowview_query_service_run($request_ids): bool {
 		$timeout = 300;
 	}
 
-	$payload = json_encode(array('query_ids' => array_map('intval', $request_ids)));
+	$payload = (string) json_encode(['query_ids' => array_map('intval', $request_ids)]);
 
 	$headers = array('Content-Type: application/json');
 
@@ -1070,6 +1104,12 @@ function flowview_setup_table(): void {
 
 	flowview_connect();
 
+	if (!flowview_db_create_nbar_tables()) {
+		throw new RuntimeException('Unable to install NBAR history schema');
+	}
+
+	set_config_option('flowview_nbar_schema_version', '2');
+
 	flowview_db_execute("CREATE TABLE IF NOT EXISTS `plugin_flowview_dnscache` (
 		`id` int(11) unsigned NOT NULL AUTO_INCREMENT,
 		`ip` varchar(45) NOT NULL DEFAULT '',
diff --git a/tests/Unit/CspNonceTest.php b/tests/Unit/CspNonceTest.php
index d536c9a..d9a7b7c 100644
--- a/tests/Unit/CspNonceTest.php
+++ b/tests/Unit/CspNonceTest.php
@@ -64,7 +64,7 @@
 
 class CactiSecureHeaders {
 	public static function getNonceAttribute(): string {
-		return ' nonce="pest-controlled-double"';
+		return 'nonce="pest-controlled-double"';
 	}
 }
 
@@ -86,8 +86,16 @@ public static function getNonceAttribute(): string {
 
 		preg_match('/<<<(.*)>>>/s', (string) $output, $matches);
 		expect($matches)->toHaveKey(1);
-		expect($matches[1])->toBe(' nonce="pest-controlled-double"');
+		expect($matches[1])->toBe('nonce="pest-controlled-double"');
 	} finally {
 		@unlink($tmp);
 	}
 });
+
+
+test('inline script tags separate the nonce attribute from the tag name', function () {
+	foreach (glob(dirname(__DIR__, 2) . '/*.php') as $file) {
+		$source = file_get_contents($file);
+		expect(preg_match('/[\'"]<script[\'"]\s*\.\s*plugin_flowview_csp_nonce/', $source))->toBe(0, basename($file));
+	}
+});
diff --git a/tests/Unit/NbarBackfillTest.php b/tests/Unit/NbarBackfillTest.php
new file mode 100644
index 0000000..278ec53
--- /dev/null
+++ b/tests/Unit/NbarBackfillTest.php
@@ -0,0 +1,97 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn'] = 'backfill-test';
+
+	foreach ([1, 'REPEATABLE-READ', 1, '7.5'] as $value) {
+		plugin_test_queue_db_result('db_fetch_cell', $value);
+	}
+});
+
+it('backfills hourly dates only when the retained counters match', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', [['kind' => 0, 'listener_id' => 3, 'period' => 1800000000, 'phase' => 0]]);
+
+	foreach (range(1, 3) as $i) {
+		plugin_test_queue_db_result('db_fetch_row', ['Collation' => 'utf8mb4_unicode_ci']);
+	}
+	expect(fv_nbar_seen_backfill())->toBe(1);
+	$calls = $GLOBALS['__test_db_calls'];
+	$sql   = implode(' ', array_column($calls, 'sql'));
+	expect($sql)->toContain('s.bytes=r.bytes AND s.packets=r.packets AND s.flows=r.flows', 'SET done=1', 'max_statement_time=7.5', 'REPEATABLE READ');
+	$updates = array_filter($calls, fn ($call) => str_starts_with($call['sql'], 'UPDATE plugin_flowview_nbar_') && $call['fn'] === 'db_execute');
+	expect($updates)->toHaveCount(3);
+
+	foreach ($updates as $call) {
+		expect($call['sql'])->toContain('minute>=1800000000 AND minute<1800003600');
+		expect($call['conn'])->toBe('backfill-test');
+	}
+});
+
+it('resumes daily connection dates from the saved application cursor', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', [['kind' => 1, 'listener_id' => 2, 'period' => 1800000000, 'phase' => 2, 'app_cursor' => 'previous']]);
+	plugin_test_queue_db_result('db_fetch_cell_prepared', 1800086400);
+	plugin_test_queue_db_result('db_fetch_row', ['Collation' => 'utf8mb4_unicode_ci']);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['app_id' => "app'quoted"], ['app_id' => 'second']]);
+	expect(fv_nbar_seen_backfill())->toBe(1);
+	$calls  = $GLOBALS['__test_db_calls'];
+	$cursor = array_values(array_filter($calls, fn ($call) => str_contains($call['sql'], 'SET app_cursor=?')));
+	expect($cursor)->toHaveCount(2);
+	expect($cursor[0]['params'])->toBe(["app'quoted", 1, 2, 1800000000]);
+	$sql = implode(' ', array_column($calls, 'sql'));
+	expect($sql)->toContain('UPDATE plugin_flowview_nbar_daily_connections', 'CONVERT(0x' . bin2hex("app'quoted"), 'SET phase=?', 'SET done=1');
+	expect($sql)->not->toContain("app'quoted", 'UPDATE plugin_flowview_nbar_daily_apps');
+});
+
+it('leaves failed date jobs pending and restores database session settings', function ($failure) {
+	plugin_test_queue_db_result('db_fetch_assoc', [['kind' => 0, 'listener_id' => 1, 'period' => 1800000000, 'phase' => 0]]);
+	plugin_test_queue_db_result('db_fetch_row', ['Collation' => $failure === 'collation' ? 'unsafe;SQL' : 'utf8mb4_unicode_ci']);
+
+	if ($failure === 'write') {
+		foreach ([true, true, false] as $value) {
+			plugin_test_queue_db_result('db_execute', $value);
+		}
+	}
+	expect(fv_nbar_seen_backfill())->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->not->toContain('SET done=1', 'unsafe;SQL');
+	expect($sql)->toContain('max_statement_time=7.5', 'REPEATABLE READ', 'RELEASE_LOCK');
+})->with(['collation', 'write']);
+
+it('does not begin a job when the backfill budget is exhausted', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', [['kind' => 0, 'listener_id' => 1, 'period' => 1800000000, 'phase' => 0]]);
+	expect(fv_nbar_seen_backfill(0))->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->not->toContain('SHOW FULL COLUMNS', 'SET done=1');
+	expect($sql)->toContain('RELEASE_LOCK');
+});
+
+it('keeps a completed date job pending when its checkpoint cannot be saved', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', [['kind' => 0, 'listener_id' => 1, 'period' => 1800000000, 'phase' => 0]]);
+
+	foreach (range(1, 3) as $i) {
+		plugin_test_queue_db_result('db_fetch_row', ['Collation' => 'utf8mb4_unicode_ci']);
+	}
+	plugin_test_queue_db_result('db_execute_prepared', false);
+	expect(fv_nbar_seen_backfill())->toBe(0);
+	expect(implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql')))->toContain('RELEASE_LOCK', 'SET done=1');
+});
+
+it('leaves a job pending if its application work exhausts the budget', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', [['kind' => 0, 'listener_id' => 1, 'period' => 1800000000, 'phase' => 0]]);
+	plugin_test_queue_db_result('db_fetch_row', static function () {
+		usleep(1100000);
+
+		return ['Collation' => 'utf8mb4_unicode_ci'];
+	});
+	expect(fv_nbar_seen_backfill(1))->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->not->toContain('SET done=1');
+	expect($sql)->toContain('RELEASE_LOCK');
+});
diff --git a/tests/Unit/NbarBehaviorTest.php b/tests/Unit/NbarBehaviorTest.php
new file mode 100644
index 0000000..6db203a
--- /dev/null
+++ b/tests/Unit/NbarBehaviorTest.php
@@ -0,0 +1,175 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_collector.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_connections.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_query.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_preferences.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_timespan.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn'] = 'nbar-test-connection';
+});
+
+it('adds and compares byte totals without floating point rounding', function () {
+	expect(fv_nbar_decimal_add('18446744073709551615', '99'))->toBe('18446744073709551714');
+	expect(fv_nbar_decimal_add('000', '0'))->toBe('0');
+	expect(fv_nbar_decimal_compare('099', '100'))->toBeLessThan(0);
+	expect(fv_nbar_decimal_compare('000123', '123'))->toBe(0);
+});
+
+it('clips requested dates to retention without changing a valid selection', function () {
+	$now = 1800000000;
+	expect(fv_nbar_bound_dates($now - 7200, $now - 60, $now, 7))->toBe([$now - 7200, $now - 60, false]);
+	expect(fv_nbar_bound_dates($now - 9 * 86400, $now + 60, $now, 7))->toBe([$now - 7 * 86400, $now, true]);
+	expect(fv_nbar_bound_dates($now - 9 * 86400, $now - 8 * 86400, $now, 7))->toBe([$now - 1800, $now, true]);
+});
+
+it('uses local calendar days across daylight saving changes', function () {
+	$old = date_default_timezone_get();
+
+	try {
+		date_default_timezone_set('Australia/Adelaide');
+		[$from, $to] = fv_nbar_daily_bounds(strtotime('2026-10-04 12:00'));
+		expect(date('Y-m-d H:i', $from))->toBe('2026-10-04 00:00');
+		expect(date('Y-m-d H:i', $to))->toBe('2026-10-05 00:00');
+		expect($to - $from)->toBe(23 * 3600);
+	} finally {
+		date_default_timezone_set($old);
+	}
+});
+
+it('validates internal IPv4 and IPv6 prefixes and rejects invalid masks', function () {
+	expect(fv_nbar_cidrs("192.0.2.0/24\n2001:db8::/64"))->toBe(['192.0.2.0/24', '2001:db8::/64']);
+	expect(fv_nbar_cidrs('192.0.2.0/33'))->toBeFalse();
+	expect(fv_nbar_cidrs('2001:db8::/129'))->toBeFalse();
+	expect(fv_nbar_cidrs('example.com/24'))->toBeFalse();
+	expect(fv_nbar_cidrs(''))->toBe([]);
+});
+
+it('decodes template-defined IPv4 and IPv6 application records using the dedicated connection', function () {
+	$GLOBALS['listener_id'] = 3;
+	$now                    = time();
+	$slice                  = fv_nbar_data_table((int) (floor($now / 60) * 60));
+	plugin_test_queue_db_result('db_fetch_cell', $slice);
+
+	foreach ([4, 16] as $length) {
+		$src         = inet_pton($length === 4 ? '192.0.2.10' : '2001:db8::10');
+		$dst         = inet_pton($length === 4 ? '198.51.100.20' : '2001:db8:1::20');
+		$fields      = [95 => 4, $length === 4 ? 8 : 27 => $length, $length === 4 ? 12 : 28 => $length, 7 => 2, 11 => 2, 4 => 1, 1 => 4, 2 => 4];
+		$definitions = '';
+
+		foreach ($fields as $id => $size) {
+			$definitions .= pack('nn', $id, $size);
+		}
+		$template = pack('nnnn', 0, 8 + strlen($definitions), 400 + $length, count($fields)) . $definitions;
+		$record   = hex2bin('0d000001') . $src . $dst . pack('nnCNN', 50000, 443, 6, 123456, 120);
+		$data     = pack('nn', 400 + $length, 4 + strlen($record)) . $record;
+		$packet   = pack('nnNNNN', 9, 2, 100000, $now, 1, 100 + $length) . $template . $data;
+		fv_nbar_packet($packet, '192.0.2.1');
+		$calls = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_execute_prepared' && str_contains($c['sql'], 'INSERT INTO `' . $slice . '`')));
+		$call  = end($calls);
+		expect($call['conn'])->toBe('nbar-test-connection');
+		expect($call['params'][2])->toBe('0d000001');
+		expect($call['params'][3])->toBe(bin2hex($src));
+		expect($call['params'][4])->toBe(bin2hex($dst));
+		expect(array_slice($call['params'], 5))->toBe([50000, 443, 6, 123456, 120, '192.0.2.1']);
+	}
+});
+
+it('ignores malformed or unsupported packets without writing data', function () {
+	fv_nbar_packet('short', '192.0.2.1');
+	fv_nbar_packet(pack('nnNNNN', 10, 0, 0, time(), 0, 0), '192.0.2.1');
+	fv_nbar_packet(pack('nnNNNN', 9, 1, 0, time(), 0, 0) . pack('nn', 0, 65535), '192.0.2.1');
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+});
+
+it('saves two or three combined captures without depending on a success message', function () {
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_REQUEST                  = ['prefs_apply' => '1', 'combine_apply' => '1', 'local_prefixes' => '192.0.2.0/24', 'site_listeners' => ['1', '2']];
+	$devices                   = [['id' => 1], ['id' => 2], ['id' => 3]];
+	$saved                     = fv_nbar_preferences_init($devices);
+	expect($GLOBALS['fv_nbar_preferences_saved'])->toBeTrue();
+	expect($saved['listeners'])->toBe([1, 2]);
+	expect($GLOBALS['fv_nbar_preferences_message'])->toBe('');
+	$_REQUEST['site_listeners'] = ['1', '2', '3'];
+	expect(fv_nbar_preferences_init($devices)['listeners'])->toBe([1, 2, 3]);
+	$_SERVER['REQUEST_METHOD'] = 'GET';
+});
+
+it('rejects a single combined capture but permits saving networks with none selected', function () {
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_REQUEST                  = ['prefs_apply' => '1', 'combine_apply' => '1', 'local_prefixes' => '2001:db8::/64', 'site_listeners' => ['1']];
+	$devices                   = [['id' => 1], ['id' => 2]];
+	fv_nbar_preferences_init($devices);
+	expect($GLOBALS['fv_nbar_preferences_saved'])->toBeFalse();
+	$_REQUEST['site_listeners'] = [];
+	$saved                      = fv_nbar_preferences_init($devices);
+	expect($GLOBALS['fv_nbar_preferences_saved'])->toBeTrue();
+	expect($saved['listeners'])->toBe([]);
+	expect($saved['prefixes'])->toBe(['2001:db8::/64']);
+	$_SERVER['REQUEST_METHOD'] = 'GET';
+});
+
+it('rolls back a failed raw batch before publishing a summary revision', function () {
+	plugin_test_queue_db_result('db_execute_prepared', false);
+	expect(fv_nbar_summary_store([['INSERT fixture VALUES (?)', [123]]], 1, [1800000000 => true]))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toBe('ROLLBACK');
+	expect(implode(' ', $sql))->not->toContain('revision=revision+1');
+});
+
+it('escapes quotes and markup in attributes on Cacti 1.2', function () {
+	expect(plugin_flowview_escape_attr('"<host>&'))->toBe('&quot;&lt;host&gt;&amp;');
+});
+
+it('decodes unsigned 64-bit exporter counters without rounding', function () {
+	expect(fv_nbar_uint(hex2bin('7fffffffffffffff')))->toBe(PHP_INT_MAX);
+	expect(fv_nbar_uint(hex2bin('8000000000000000')))->toBe('9223372036854775808');
+	expect(fv_nbar_uint(hex2bin('ffffffffffffffff')))->toBe('18446744073709551615');
+	expect(fv_nbar_uint(hex2bin('00000000000000ff')))->toBe(255);
+});
+
+it('passes full-width byte counters to the database as exact decimal strings', function () {
+	$GLOBALS['listener_id'] = 3;
+	$now                    = time();
+	$slice                  = fv_nbar_data_table((int) (floor($now / 60) * 60));
+	plugin_test_queue_db_result('db_fetch_cell', $slice);
+	$fields      = [95 => 4, 8 => 4, 12 => 4, 1 => 8];
+	$definitions = '';
+
+	foreach ($fields as $id => $size) {
+		$definitions .= pack('nn', $id, $size);
+	}
+	$template = pack('nnnn', 0, 8 + strlen($definitions), 777, count($fields)) . $definitions;
+	$record   = hex2bin('0d000001') . inet_pton('192.0.2.10') . inet_pton('198.51.100.20') . hex2bin('ffffffffffffffff');
+	$data     = pack('nn', 777, 4 + strlen($record)) . $record;
+	fv_nbar_packet(pack('nnNNNN', 9, 2, 100000, $now, 1, 777) . $template . $data, '192.0.2.1');
+	$calls = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_execute_prepared' && str_contains($c['sql'], 'INSERT INTO `' . $slice . '`')));
+	expect($calls)->toHaveCount(1);
+	expect($calls[0]['params'][8])->toBe('18446744073709551615');
+});
+
+it('uses a single grouped fallback before probing a sparse history across every segment', function () {
+	foreach (range(1, 3) as $unused) {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	}
+
+	for ($segment = 0; $segment < 4; $segment++) {
+		$rows = [];
+
+		for ($i = 0; $i < 257; $i++) {
+			$rows[] = ['app_id' => '0d000001', 'src_hex' => 'C000020A', 'dst_hex' => strtoupper(bin2hex(inet_pton('198.18.0.' . ($segment + 1)))), 'sport' => $i, 'dport' => 443, 'protocol' => 6, 'bytes' => '100', 'packets' => '1', 'records' => '1', 'first_seen' => 1800000000, 'last_seen' => 1800000000];
+		}
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', $rows);
+	}
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	expect(fv_nbar_connections_direct([1], 1799971200, 1799985600, '1=1', [], 1))->toBe([]);
+	$calls = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_fetch_assoc_prepared'));
+	expect($calls)->toHaveCount(8);
+	expect(end($calls)['sql'])->toContain('UNION ALL');
+});
diff --git a/tests/Unit/NbarBoundaryTest.php b/tests/Unit/NbarBoundaryTest.php
new file mode 100644
index 0000000..e33daf6
--- /dev/null
+++ b/tests/Unit/NbarBoundaryTest.php
@@ -0,0 +1,81 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_preferences.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+});
+
+it('guards complete daily summaries and raw boundaries against double counting', function ($kind) {
+	$day = strtotime('-2 days midnight');
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['day' => $day, 'covered_to' => $day + 86400, 'timezone' => date_default_timezone_get(), 'revision' => '42']]);
+	$sql = fv_nbar_summary_source($kind, [1], $day - 1800, $day + 88200, time());
+	expect($sql)->toContain('plugin_flowview_nbar_daily_' . $kind, 'fallback_before', 'fallback_after', 'fallback_day', 'NOT (EXISTS', 'revision=42');
+	expect($sql)->toContain('minute>=' . ($day - 1800), 'minute<' . ($day + 88200));
+
+	if ($kind === 'apps') {
+		expect($sql)->toContain('REPEAT(CHAR(0),family)');
+	} elseif ($kind === 'pairs') {
+		expect($sql)->toContain('0 sport,0 dport,0 protocol');
+	} else {
+		expect($sql)->toContain('src,dst,sport,dport,protocol');
+	}
+})->with(['apps', 'pairs', 'connections']);
+
+it('ignores incompatible or overlapping daily checkpoints', function () {
+	$day = strtotime('-2 days midnight');
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [
+		['day' => $day, 'covered_to' => $day + 86400, 'timezone' => 'Other/Zone', 'revision' => '1'],
+		['day' => $day - 86400, 'covered_to' => $day, 'timezone' => date_default_timezone_get(), 'revision' => '1'],
+		['day' => $day, 'covered_to' => time() + 3600, 'timezone' => date_default_timezone_get(), 'revision' => '1']
+	]);
+	$sql = fv_nbar_summary_source('apps', [1], $day, $day + 86400, time());
+	expect($sql)->not->toContain('plugin_flowview_nbar_daily_apps');
+	expect($sql)->toContain('fallback_after', 'minute>=' . $day);
+});
+
+it('uses a raw source when no capture scope exists', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(0), fv_nbar_data_table(7200)]);
+	$summary = fv_nbar_summary_source('apps', [], 0, 3600);
+	expect($summary)->toContain(fv_nbar_data_table(0), 'minute first_seen');
+	expect($summary)->not->toContain(fv_nbar_data_table(7200));
+	plugin_test_queue_slices([fv_nbar_data_table(0)]);
+	expect(fv_nbar_hourly_source('apps', [], 0, 3600))->toContain(fv_nbar_data_table(0), 'minute last_seen');
+});
+
+it('reads an empty typed relation when no raw slice exists yet', function () {
+	$sql = fv_nbar_hourly_source('apps', [], 0, 3600);
+	expect($sql)->toContain('WHERE 1=0', 'minute first_seen', 'fv_nbar_empty');
+});
+
+it('builds exact partial-byte internal-prefix predicates for both address families', function () {
+	$GLOBALS['fv_nbar_preferences'] = ['prefixes' => ['192.0.2.128/25', '2001:db8::/65']];
+	$sql                            = fv_nbar_local_sql('d.src');
+	expect($sql)->toContain('LENGTH(d.src)=4', 'LENGTH(d.src)=16', '(ORD(SUBSTRING(d.src,4,1)) & 128)=128', '(ORD(SUBSTRING(d.src,9,1)) & 128)=0');
+	expect(fn () => fv_nbar_local_sql('d.bytes'))->toThrow(InvalidArgumentException::class);
+});
+
+it('rejects oversized network lists and invalid network submissions without saving', function () {
+	$prefixes = implode("\n", array_map(fn ($i) => '192.0.2.' . $i . '/32', range(1, 33)));
+	expect(fv_nbar_cidrs($prefixes))->toBeFalse();
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_REQUEST                  = ['prefs_apply' => '1', 'local_prefixes' => 'not-a-network', 'site_listeners' => []];
+	fv_nbar_preferences_init([]);
+	expect($GLOBALS['fv_nbar_preferences_saved'])->toBeFalse();
+	expect($GLOBALS['fv_nbar_preferences_message'])->toContain('Enter valid IPv4/IPv6 networks');
+});
+
+it('saves only permitted display options from settings submissions', function () {
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_REQUEST                  = ['prefs_apply' => '1', 'local_prefixes' => '', 'site_listeners' => [], 'data_unit' => 'Auto', 'rate_unit' => 'Kbps', 'dns' => '0'];
+	$saved                     = fv_nbar_preferences_init([]);
+	expect($saved['data_unit'])->toBe('Auto');
+	expect($saved['rate_unit'])->toBe('Kbps');
+	expect($saved['dns'])->toBe('0');
+	expect($GLOBALS['fv_nbar_preferences_saved'])->toBeTrue();
+});
diff --git a/tests/Unit/NbarConnectionPagingTest.php b/tests/Unit/NbarConnectionPagingTest.php
new file mode 100644
index 0000000..4c4ed60
--- /dev/null
+++ b/tests/Unit/NbarConnectionPagingTest.php
@@ -0,0 +1,166 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_query.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_connections.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn'] = 'paging-test';
+	$this->start             = (int) floor((time() - 86400) / 3600) * 3600;
+	$this->tuple             = ['app_id' => '0d000001', 'src_hex' => bin2hex(inet_pton('2001:db8::10')), 'dst_hex' => bin2hex(inet_pton('2001:db8::20')), 'sport' => 1000, 'dport' => 443, 'protocol' => 6, 'bytes' => '9007199254740993', 'packets' => '5', 'records' => '1', 'first_seen' => $this->start, 'last_seen' => $this->start + 60];
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['hour' => $this->start], ['hour' => $this->start + 3600]]);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['listener_id' => 1, 'app_id' => '0d000001', 'name_id' => 1, 'name' => 'youtube']]);
+});
+
+it('totals every candidate across all segments without rounding large counters', function () {
+	$a    = $this->tuple;
+	$b    = array_replace($a, ['sport' => 2000, 'bytes' => '10']);
+	$late = array_replace($a, ['bytes' => '2', 'first_seen' => $this->start + 3600, 'last_seen' => $this->start + 3660]);
+
+	foreach ([[$a, $b], [$late], [$a, $b], [$late]] as $rows) {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', $rows);
+	}
+	$rows = fv_nbar_connections_direct([1], $this->start, $this->start + 7200, 'd.app_id=?', ['0d000001'], 1);
+	expect($rows)->toHaveCount(2);
+	expect($rows[0]['bytes'])->toBe('9007199254740995');
+	expect($rows[0]['packets'])->toBe('10');
+	expect($rows[0]['records'])->toBe('2');
+	expect($rows[0]['name'])->toBe('youtube');
+	expect($rows[0]['src'])->toBe('2001:db8::10');
+	expect($rows[0]['dst'])->toBe('2001:db8::20');
+	expect($rows[0]['first_seen'])->toBe($this->start);
+	expect($rows[0]['last_seen'])->toBe($this->start + 3660);
+	expect($rows[0])->not->toHaveKey('src_hex')->not->toHaveKey('_key');
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toBe('COMMIT');
+	$lookups = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($call) => str_contains($call['sql'], 'UNHEX(?)')));
+	expect($lookups)->toHaveCount(2);
+	expect($lookups[0]['params'][0])->toBe('0d000001');
+});
+
+it('uses deterministic tuple ordering for equal-volume connections and preserves missing dates', function () {
+	$a = array_replace($this->tuple, ['bytes' => '10']);
+	$b = array_replace($a, ['sport' => 999, 'first_seen' => null, 'last_seen' => null]);
+
+	foreach ([[$a, $b], [], [$a, $b], []] as $rows) {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', $rows);
+	}
+	$rows = fv_nbar_connections_direct([1], $this->start, $this->start + 7200, '1=1', [], 1);
+	expect(array_column($rows, 'sport'))->toBe([999, 1000]);
+	expect($rows[0]['first_seen'])->toBeNull();
+	expect($rows[0]['last_seen'])->toBeNull();
+});
+
+it('rolls back if segment reads or candidate total lookups fail', function ($stage) {
+	if ($stage === 'candidate') {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', false);
+	} else {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', [$this->tuple]);
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', false);
+	}
+	expect(fn () => fv_nbar_connections_direct([1], $this->start, $this->start + 7200, '1=1', [], 1))->toThrow(RuntimeException::class);
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toBe('ROLLBACK');
+})->with(['candidate', 'lookup']);
+
+it('rejects invalid capture selections before opening a snapshot', function ($captures) {
+	expect(fn () => fv_nbar_connections_direct($captures, $this->start, $this->start + 7200, '1=1', [], 1))->toThrow(InvalidArgumentException::class);
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+})->with([[[]], [[1, 2, 3, 4]]]);
+
+it('uses a complete daily checkpoint between raw partial-day boundaries', function () {
+	plugin_test_reset();
+	$day = strtotime('-2 days midnight');
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['day' => $day, 'covered_to' => $day + 86400, 'timezone' => date_default_timezone_get(), 'revision' => '10']]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['n' => 24, 'ready' => 24, 'rev' => '10']);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	plugin_test_queue_slices([fv_nbar_data_table($day - 1800)]);
+	plugin_test_queue_slices([fv_nbar_data_table($day + 86400)]);
+	$plan = fv_nbar_connection_plan([2], $day - 1800, $day + 88200, time());
+	expect($plan)->toHaveCount(3);
+	expect(array_column($plan, 'daily'))->toBe([false, true, false]);
+	expect($plan[1]['source'])->toContain('plugin_flowview_nbar_daily_connections', 'listener_id=2', 'hour=' . $day);
+	expect($plan[0]['source'])->toContain('minute>=' . ($day - 1800), 'minute<' . $day, fv_nbar_data_table($day - 1800));
+	expect($plan[2]['source'])->toContain('minute>=' . ($day + 86400), 'minute<' . ($day + 88200), fv_nbar_data_table($day + 86400));
+});
+
+it('falls back to raw hours when a daily checkpoint is stale or uses another timezone', function ($reason) {
+	plugin_test_reset();
+	$day = strtotime('-2 days midnight');
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['day' => $day, 'covered_to' => $day + 86400, 'timezone' => $reason === 'timezone' ? 'Other/Zone' : date_default_timezone_get(), 'revision' => '10']]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['n' => 24, 'ready' => 24, 'rev' => '11']);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	plugin_test_queue_slices(array_map(fn ($hour) => fv_nbar_data_table($day + $hour * 3600), range(-1, 25)));
+	$plan = fv_nbar_connection_plan([2], $day, $day + 86400, time());
+	expect($plan)->toHaveCount(24);
+
+	foreach ($plan as $i => $part) {
+		expect($part['daily'])->toBeFalse();
+		expect($part['source'])->toContain('`' . fv_nbar_data_table($day + $i * 3600) . '`');
+		expect($part['source'])->not->toContain('`' . fv_nbar_data_table($day + ($i + 1) * 3600) . '`');
+	}
+})->with(['timezone', 'revision']);
+
+it('rejects failed planning metadata instead of returning an empty report', function ($stage) {
+	plugin_test_reset();
+
+	if ($stage === 'hour') {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	}
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', false);
+	expect(fn () => fv_nbar_connection_plan([1], $this->start, $this->start + 7200, time()))->toThrow(RuntimeException::class);
+})->with(['day', 'hour']);
+
+it('keeps exporter name ranks ahead of endpoints when candidate pages contain ties', function () {
+	plugin_test_reset();
+	$names  = [];
+	$ranks  = [3, 1, 0, 2];
+	$labels = ['Zulu', 'Alpha', null, 'Bravo'];
+
+	foreach ([0, 1, 3] as $i) {
+		$names[] = ['listener_id' => 1, 'router' => '192.0.2.' . (201 + $i), 'app_id' => '0d000001', 'name_id' => $ranks[$i], 'name' => $labels[$i]];
+	}
+	$tuples = [];
+
+	for ($i = 0; $i < 256; $i++) {
+		$tuples[] = array_replace($this->tuple, ['router' => '192.0.2.' . (201 + $i % 4), 'sport' => 1000 + intdiv($i, 4), 'bytes' => $i < 101 ? '10' : '1']);
+	}
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['hour' => $this->start]]);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', $names);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', array_merge($tuples, [array_replace($this->tuple, ['sport' => 9000, 'bytes' => '1'])]));
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', $tuples);
+	$rows     = fv_nbar_connections_direct([1], $this->start, $this->start + 3600, '1=1', [], 1);
+	$expected = array_slice($tuples, 0, 101);
+	usort($expected, function ($a, $b) use ($ranks) {
+		$ai = (int) substr($a['router'], -3) - 201;
+		$bi = (int) substr($b['router'], -3) - 201;
+
+		return ($ranks[$ai] <=> $ranks[$bi]) ?: ($a['sport'] <=> $b['sport']);
+	});
+	expect(array_column($rows, 'router'))->toBe(array_column($expected, 'router'));
+	expect(array_column($rows, 'sport'))->toBe(array_column($expected, 'sport'));
+	expect($rows[0]['name'])->toBeNull()->and($rows[100]['name'])->toBe('Zulu');
+
+	foreach ($GLOBALS['__test_db_calls'] as $call) {
+		expect($call['sql'])->not->toContain('OFFSET');
+	}
+});
+
+it('does not add an unrequested tuple returned by a candidate lookup', function () {
+	$unexpected = array_replace($this->tuple, ['sport' => 9999, 'bytes' => '9999999999999999999']);
+
+	foreach ([[$this->tuple], [], [$this->tuple, $unexpected], []] as $rows) {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', $rows);
+	}
+	$rows = fv_nbar_connections_direct([1], $this->start, $this->start + 7200, '1=1', [], 1);
+	expect($rows)->toHaveCount(1)->and($rows[0]['sport'])->toBe($this->tuple['sport'])->and($rows[0]['bytes'])->toBe($this->tuple['bytes']);
+});
diff --git a/tests/Unit/NbarCountRequestTest.php b/tests/Unit/NbarCountRequestTest.php
new file mode 100644
index 0000000..15bc3ea
--- /dev/null
+++ b/tests/Unit/NbarCountRequestTest.php
@@ -0,0 +1,60 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+require_once(dirname(__DIR__) . '/helpers/request.php');
+
+it('handles terminating count requests and preserves bounded account cache state', function ($scenario, $status) {
+	$directory = sys_get_temp_dir() . '/flowview-count-' . bin2hex(random_bytes(8));
+	mkdir($directory, 0700);
+
+	try {
+		[$stdout, $result] = flowview_test_request(dirname(__DIR__) . '/fixtures/nbar-count-request.php', $scenario, $directory);
+		$payload           = json_decode($stdout, true, 512, JSON_THROW_ON_ERROR);
+		expect($payload['status'])->toBe($status);
+		$sql   = implode(' ', array_column($result['calls'], 'sql'));
+		$entry = $result['session']['fv_nbar_counts'][str_repeat('a', 64)] ?? [];
+
+		if (in_array($scenario, ['scoped', 'scoped-listing-failed'], true)) {
+			expect($sql)->toContain('GET_LOCK', 'RELEASE_LOCK');
+			$counts = array_values(array_filter($result['calls'], fn ($c) => $c['fn'] === 'db_fetch_row_prepared'));
+
+			if ($scenario === 'scoped') {
+				// The SQL that runs is built from the criteria and the slices that exist now, not the saved text.
+				expect($counts)->toHaveCount(1);
+				expect($counts[0]['sql'])->toContain('max_statement_time=90', 'COUNT(DISTINCT', 'plugin_flowview_nbar_data_2027')->not->toContain('before_the_slice_existed');
+				expect($entry['total'])->toBe(12345);
+			} else {
+				expect($counts)->toBe([]);
+				expect($entry['failed_until'])->toBeGreaterThan(time());
+				expect($entry)->not->toHaveKey('total');
+			}
+		} elseif (in_array($scenario, ['ready', 'failed', 'background-ready', 'background-failed'], true)) {
+			expect($sql)->toContain('GET_LOCK', 'max_statement_time=90', 'RELEASE_LOCK');
+			$counts = array_values(array_filter($result['calls'], fn ($c) => $c['fn'] === 'db_fetch_row_prepared'));
+			expect($counts[0]['params'])->toBe([3]);
+
+			if (str_contains($scenario, 'failed')) {
+				expect($entry['failed_until'])->toBeGreaterThan(time());
+				expect($entry)->not->toHaveKey('total');
+			} else {
+				expect($entry['total'])->toBe(12345);
+				expect($entry['until'])->toBeGreaterThan(time() + 590);
+			}
+		} else {
+			expect($sql)->not->toContain('max_statement_time=90');
+		}
+
+		if ($status === 'ready') {
+			expect($payload)->toMatchArray(['pages' => 124, 'total' => 12345]);
+		}
+	} finally {
+		foreach (glob($directory . '/*') as $file) {
+			unlink($file);
+		}
+		rmdir($directory);
+	}
+})->with([
+	['malformed', 'expired'], ['missing', 'expired'], ['expired', 'expired'], ['retry', 'unavailable'],
+	['cached', 'ready'], ['busy', 'busy'], ['ready', 'ready'], ['failed', 'unavailable'],
+	['background-ready', 'busy'], ['background-failed', 'busy'], ['scoped', 'ready'], ['scoped-listing-failed', 'unavailable']
+]);
diff --git a/tests/Unit/NbarDailyWorkerTest.php b/tests/Unit/NbarDailyWorkerTest.php
new file mode 100644
index 0000000..71ef9af
--- /dev/null
+++ b/tests/Unit/NbarDailyWorkerTest.php
@@ -0,0 +1,157 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn'] = 'daily-worker-test';
+});
+
+it('appends the next hour to a valid daily checkpoint without resetting totals', function () {
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['timezone' => date_default_timezone_get(), 'covered_to' => 1800003600, 'revision' => '3']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['n' => 1, 'ready' => 1, 'rev' => '3']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['n' => 2, 'ready' => 2, 'rev' => '4']);
+	plugin_test_queue_db_result('db_fetch_cell', '6.25');
+	expect(fv_nbar_daily_build(2, 1800000000, 1800007200))->toBe(1);
+	$calls = $GLOBALS['__test_db_calls'];
+	$sql   = implode(' ', array_column($calls, 'sql'));
+	expect($sql)->not->toContain('DELETE FROM');
+	expect($sql)->toContain('minute>=1800003600 AND d.minute<1800007200', 'bytes=bytes+VALUES(bytes)', 'SET SESSION max_statement_time=6.25');
+	$checkpoint = array_values(array_filter($calls, fn ($c) => str_contains($c['sql'], 'INSERT INTO plugin_flowview_nbar_days')));
+	expect(array_slice($checkpoint[0]['params'], 0, 4))->toBe([2, 1800000000, 1800007200, '4']);
+});
+
+it('does not rebuild a completed daily checkpoint', function () {
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['timezone' => date_default_timezone_get(), 'covered_to' => 1800003600, 'revision' => '3']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['n' => 1, 'ready' => 1, 'rev' => '3']);
+	expect(fv_nbar_daily_build(2, 1800000000, 1800003600))->toBe(0);
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toBe('ROLLBACK');
+	expect(implode(' ', $sql))->not->toContain('INSERT INTO', 'DELETE FROM');
+});
+
+it('does not publish a day when any daily mutation fails', function ($stage) {
+	plugin_test_queue_db_result('db_fetch_row_prepared', []);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['n' => 1, 'ready' => 1, 'rev' => '7']);
+	plugin_test_queue_db_result('db_fetch_cell', '4.5');
+
+	if ($stage === 'reset') {
+		plugin_test_queue_db_result('db_execute_prepared', false);
+	} elseif ($stage === 'aggregate') {
+		foreach ([true, true, false] as $value) {
+			plugin_test_queue_db_result('db_execute', $value);
+		}
+	} elseif ($stage === 'checkpoint') {
+		foreach ([true, true, true, false] as $value) {
+			plugin_test_queue_db_result('db_execute_prepared', $value);
+		}
+	} else {
+		foreach ([true, true, true, true, true, false] as $value) {
+			plugin_test_queue_db_result('db_execute', $value);
+		}
+	}
+	expect(fv_nbar_daily_build(1, 1800000000, 1800003600))->toBe(0);
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect($sql)->toContain('ROLLBACK');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=4.5');
+})->with(['reset', 'aggregate', 'checkpoint', 'commit']);
+
+it('skips daily maintenance when another worker owns the lock', function () {
+	plugin_test_queue_db_result('db_fetch_cell', 0);
+	expect(fv_nbar_daily_refresh())->toBe(0);
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1);
+});
+
+it('plans retained calendar days and seeds only empty hours before the first record', function () {
+	plugin_test_queue_db_result('db_fetch_cell', 1);
+	$first = strtotime('yesterday') + 3 * 3600;
+	plugin_test_queue_db_result('db_fetch_assoc', [['listener_id' => 2, 'first_hour' => $first], ['listener_id' => 3, 'first_hour' => $first]]);
+	plugin_test_queue_slices([fv_nbar_data_table($first)]);
+	plugin_test_queue_slices([fv_nbar_data_table($first)]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $first]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', []);
+	expect(fv_nbar_daily_refresh())->toBe(0);
+	$calls = $GLOBALS['__test_db_calls'];
+	$seeds = array_values(array_filter($calls, fn ($c) => str_contains($c['sql'], 'INSERT IGNORE INTO plugin_flowview_nbar_hours')));
+	expect($seeds)->toHaveCount(3);
+	expect($seeds[0]['params'])->toBe([2, strtotime('yesterday')]);
+	$sql = implode(' ', array_column($calls, 'sql'));
+	expect($sql)->toContain('START TRANSACTION WITH CONSISTENT SNAPSHOT', 'RELEASE_LOCK');
+	expect($sql)->not->toContain('INSERT INTO plugin_flowview_nbar_days');
+});
+
+it('seeds and publishes closed hours before handing off to the daily worker', function () {
+	$hour = (int) floor((time() - 7200) / 3600) * 3600;
+	plugin_test_queue_db_result('db_fetch_row', ['acquired' => 1]);
+	plugin_test_queue_db_result('db_fetch_assoc', [['id' => 1], ['id' => 2]]);
+	plugin_test_queue_slices([fv_nbar_data_table($hour)]);
+	plugin_test_queue_slices([fv_nbar_data_table($hour)]);
+	plugin_test_queue_db_result('db_fetch_assoc', [['listener_id' => 1, 'hour' => $hour, 'revision' => 4]]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $hour]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', []);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => 4]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => 4]);
+	expect(fv_nbar_summary_refresh())->toBe(1);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->toContain('INSERT IGNORE INTO plugin_flowview_nbar_hours', 'SET built=?,connection_built=?', 'RELEASE_LOCK', 'flowview_nbar_daily:');
+});
+
+it('releases the hourly worker lock when checkpoint seeding fails', function () {
+	plugin_test_queue_db_result('db_fetch_row', ['acquired' => 1]);
+	plugin_test_queue_db_result('db_fetch_assoc', [['id' => 1]]);
+	plugin_test_queue_slices([fv_nbar_data_table(time() - 7200)]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => time() - 7200]);
+	plugin_test_queue_db_result('db_execute', false);
+	expect(fv_nbar_summary_refresh())->toBe(0);
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toContain('RELEASE_LOCK');
+	expect(implode(' ', $sql))->not->toContain('START TRANSACTION');
+});
+
+it('stops the hourly work queue when its time budget expires', function () {
+	plugin_test_queue_db_result('db_fetch_row', ['acquired' => 1]);
+	plugin_test_queue_db_result('db_fetch_assoc', static function () {
+		usleep(1100000);
+
+		return [];
+	});
+	plugin_test_queue_db_result('db_fetch_assoc', [['listener_id' => 1, 'hour' => time() - 7200, 'revision' => 4]]);
+	expect(fv_nbar_summary_refresh(1))->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->toContain('RELEASE_LOCK');
+	expect($sql)->not->toContain('START TRANSACTION');
+});
+
+it('stops daily work after the worker deadline while releasing its lock', function () {
+	plugin_test_queue_db_result('db_fetch_cell', 1);
+	plugin_test_queue_db_result('db_fetch_assoc', static function () {
+		usleep(1100000);
+
+		return [['listener_id' => 1, 'first_hour' => time() - 7200]];
+	});
+	plugin_test_queue_slices([fv_nbar_data_table(time() - 7200)]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => time() - 7200]);
+	expect(fv_nbar_daily_refresh(1))->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->toContain('RELEASE_LOCK');
+	expect($sql)->not->toContain('START TRANSACTION');
+});
+
+it('does not materialize a calendar day that begins before the retention cutoff', function () {
+	$cutoff = time() - fv_nbar_retention_days() * 86400;
+	plugin_test_queue_db_result('db_fetch_cell', 1);
+	plugin_test_queue_db_result('db_fetch_assoc', [['listener_id' => 2, 'first_hour' => $cutoff - 86400]]);
+	plugin_test_queue_slices([fv_nbar_data_table($cutoff - 86400)]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $cutoff - 86400]);
+	expect(fv_nbar_daily_refresh())->toBe(0);
+	$lookups = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($call) => str_starts_with($call['sql'], 'SELECT * FROM plugin_flowview_nbar_days')));
+	expect($lookups)->not->toBe([]);
+
+	foreach ($lookups as $lookup) {
+		expect($lookup['params'][1])->toBeGreaterThanOrEqual($cutoff);
+	}
+});
diff --git a/tests/Unit/NbarDirectRequestTest.php b/tests/Unit/NbarDirectRequestTest.php
new file mode 100644
index 0000000..24d4b0c
--- /dev/null
+++ b/tests/Unit/NbarDirectRequestTest.php
@@ -0,0 +1,22 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+require_once(dirname(__DIR__) . '/helpers/request.php');
+
+it('rejects direct requests without the Cacti bootstrap', function ($scenario, $expected) {
+	$directory = sys_get_temp_dir() . '/flowview-report-' . bin2hex(random_bytes(8));
+	mkdir($directory, 0700);
+
+	try {
+		[$stdout, $result] = flowview_test_request(dirname(__DIR__) . '/fixtures/nbar-direct-request.php', $scenario, $directory);
+		expect($stdout)->toBe('');
+		expect($result['status'])->toBe($expected);
+	} finally {
+		foreach (glob($directory . '/*') as $file) {
+			unlink($file);
+		}
+		rmdir($directory);
+	}
+})->with([
+	['guide', 403], ['report', false]
+]);
diff --git a/tests/Unit/NbarDnsTest.php b/tests/Unit/NbarDnsTest.php
new file mode 100644
index 0000000..b32682a
--- /dev/null
+++ b/tests/Unit/NbarDnsTest.php
@@ -0,0 +1,83 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+// Resolver double: these tests never send DNS packets.
+if (!class_exists('Net_DNS2_Resolver')) {
+	class Net_DNS2_Resolver {
+		public $timeout;
+		public static array $results = [];
+		public static array $queries = [];
+		public function __construct(array $options) {
+		}
+		public function query(string $ip, string $type): mixed {
+			self::$queries[] = [$ip, $type];
+			$result          = array_shift(self::$results);
+
+			if ($result instanceof Throwable) {
+				throw $result;
+			}
+
+			return (object) ['answer' => $result];
+		}
+	}
+}
+
+it('uses persistent DNS results and bounded positive and negative resolver caches', function () {
+	plugin_test_reset();
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_dns.php');
+	$GLOBALS['fv_nbar_preferences'] = ['dns' => '1'];
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['host' => 'cached.example']);
+	expect(fv_nbar_dns('192.0.2.201'))->toBe('cached.example');
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['host' => '192.0.2.202']);
+	expect(fv_nbar_dns('192.0.2.202'))->toBe('No reverse DNS');
+	$_SESSION['fv_nbar_dns_negative']['192.0.2.203'] = ['until' => time() + 30, 'name' => 'Not resolved'];
+	expect(fv_nbar_dns('192.0.2.203'))->toBe('Not resolved');
+	Net_DNS2_Resolver::$results = [
+		[(object) ['ptrdname' => 'resolved.example.']],
+		[],
+		new Exception('NXDOMAIN', 3),
+		new Exception('Timeout', 1),
+	];
+	expect(fv_nbar_dns('192.0.2.204'))->toBe('resolved.example');
+	expect(fv_nbar_dns('192.0.2.204'))->toBe('resolved.example');
+	expect(fv_nbar_dns('192.0.2.205'))->toBe('No reverse DNS');
+	expect(fv_nbar_dns('192.0.2.206'))->toBe('No reverse DNS');
+	expect(fv_nbar_dns('192.0.2.207'))->toBe('Not resolved');
+	expect(Net_DNS2_Resolver::$queries)->toHaveCount(4);
+	expect($_SESSION['fv_nbar_dns_negative']['192.0.2.206']['until'])->toBeGreaterThan(time() + 290);
+	expect($_SESSION['fv_nbar_dns_negative']['192.0.2.207']['until'])->toBeLessThanOrEqual(time() + 30);
+	$calls = array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_execute_prepared');
+	expect(array_values($calls)[0]['params'][1])->toBe('resolved.example');
+});
+
+it('expires negative DNS entries and retains at most 512 addresses', function () {
+	plugin_test_reset();
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_dns.php');
+	$_SESSION['fv_nbar_dns_negative']['old'] = ['until' => time() - 1, 'name' => 'Old'];
+
+	foreach (range(1, 512) as $i) {
+		$_SESSION['fv_nbar_dns_negative']['host' . $i] = ['until' => time() + 100, 'name' => 'Not resolved'];
+	}
+	expect(fv_nbar_dns_negative('192.0.2.208', 'Not resolved', 30))->toBe('Not resolved');
+	expect($_SESSION['fv_nbar_dns_negative'])->toHaveCount(512);
+	expect($_SESSION['fv_nbar_dns_negative'])->not->toHaveKey('old')->not->toHaveKey('host1');
+	expect($_SESSION['fv_nbar_dns_negative'])->toHaveKey('192.0.2.208');
+});
+
+require_once(dirname(__DIR__) . '/helpers/request.php');
+it('stops further DNS lookups after the report lookup budget is exhausted', function () {
+	$directory = sys_get_temp_dir() . '/flowview-dns-' . bin2hex(random_bytes(8));
+	mkdir($directory, 0700);
+
+	try {
+		[$stdout] = flowview_test_request(dirname(__DIR__) . '/fixtures/nbar-dns-budget.php', 'budget', $directory);
+		expect(json_decode($stdout, true, 512, JSON_THROW_ON_ERROR))->toBe(['name' => 'Not resolved', 'queries' => 1]);
+	} finally {
+		foreach (glob($directory . '/*') as $file) {
+			unlink($file);
+		}
+		rmdir($directory);
+	}
+});
diff --git a/tests/Unit/NbarFailurePathsTest.php b/tests/Unit/NbarFailurePathsTest.php
new file mode 100644
index 0000000..3985a1d
--- /dev/null
+++ b/tests/Unit/NbarFailurePathsTest.php
@@ -0,0 +1,74 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_query.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_connections.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_chart.php');
+	$_REQUEST = ['report' => 'nbar'];
+	flowview_test_load(dirname(__DIR__, 2) . '/flowview_sections.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+});
+
+it('compares identical connection tuples consistently', function () {
+	$row = ['bytes' => '9007199254740993', '_key' => ['0d000001', 1, 'C0000201', 'C6336401', 1000, 443, 6]];
+	expect(fv_nbar_connection_compare($row, $row))->toBe(0);
+	expect(fv_nbar_connection_compare($row, array_replace($row, ['bytes' => '9007199254740994'])))->toBeGreaterThan(0);
+});
+
+it('normalizes saved navigation fields without restoring NBAR into Flow Reports', function () {
+	$GLOBALS['__test_user_settings']['flowview_section_flows'] = json_encode(['report' => 'nbar', 'query' => ['bad'], 'mode' => 'apps']);
+	$params                                                    = fv_section_params('flows');
+	expect($params)->not->toHaveKey('report')->not->toHaveKey('query');
+	expect($params['section'])->toBe('flows');
+});
+
+it('does not draw a chart slice for a zero-byte application', function () {
+	$GLOBALS['lid'] = 1;
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['name' => 'Empty app', 'bytes' => 0]]);
+	ob_start();
+	fv_nbar_chart('d.listener_id=?', [1, time() - 1200, time()], 'all');
+	$html = ob_get_clean();
+	expect($html)->not->toContain('Empty app');
+});
+
+it('does not build summaries when transaction creation or commit fails', function ($stage) {
+	if ($stage === 'start') {
+		plugin_test_queue_db_result('db_execute', false);
+		expect(fv_nbar_summary_build(1, 1800000000))->toBeFalse();
+		plugin_test_queue_db_result('db_execute', false);
+		expect(fv_nbar_daily_build(1, 1800000000, 1800003600))->toBe(0);
+	} else {
+		plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => 4]);
+		plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => 4]);
+
+		foreach ([true, true, true, false] as $result) {
+			plugin_test_queue_db_result('db_execute', $result);
+		}
+		expect(fv_nbar_summary_build(1, 1800000000))->toBeFalse();
+		expect(array_column($GLOBALS['__test_db_calls'], 'sql'))->toContain('ROLLBACK');
+	}
+})->with(['start', 'commit']);
+
+it('does not turn failed name or deep-page queries into an empty report', function ($stage) {
+	foreach (range(1, 2) as $unused) {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	}
+
+	if ($stage === 'page') {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	}
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', false);
+	expect(fn () => fv_nbar_connections_direct([1], 1800000000, 1800001800, '1=1', [], $stage === 'page' ? 500 : 1))->toThrow(RuntimeException::class);
+	expect(array_column($GLOBALS['__test_db_calls'], 'sql'))->toContain('ROLLBACK');
+})->with(['names', 'page']);
+
+it('rejects a nonpositive capture identifier inside the snapshot planner', function () {
+	expect(fn () => fv_nbar_connections_direct([0], 1800000000, 1800001800, '1=1', [], 1))->toThrow(InvalidArgumentException::class);
+	expect(array_column($GLOBALS['__test_db_calls'], 'sql'))->toContain('ROLLBACK');
+});
diff --git a/tests/Unit/NbarLatestReviewTest.php b/tests/Unit/NbarLatestReviewTest.php
new file mode 100644
index 0000000..ded57d6
--- /dev/null
+++ b/tests/Unit/NbarLatestReviewTest.php
@@ -0,0 +1,82 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+beforeEach(function () {
+	plugin_test_reset();
+	global $config;
+	$constants = file_get_contents($config['base_path'] . '/include/global_constants.php');
+	preg_match_all("/define\\('((?:GT_|GTS_)[A-Z0-9_]+)', ([0-9]+)\\);/", $constants, $matches, PREG_SET_ORDER);
+
+	foreach ($matches as $match) {
+		if (!defined($match[1])) {
+			define($match[1], (int) $match[2]);
+		}
+	}
+
+	if (!defined('DEFAULT_TIMESPAN')) {
+		define('DEFAULT_TIMESPAN', 1800);
+	}
+	require_once($config['base_path'] . '/lib/time.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_timespan.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_preferences.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_feed_status.php');
+});
+it('handles all NBAR timespans without replacing legacy sessions', function ($preset) {
+	$_SESSION = ['sess_fv_7' => ['report' => 7, 'predefined_timespan' => 4]];
+	$_REQUEST = ['report' => 'nbar', 'predefined_timespan' => $preset, 'date1' => '2026-10-10 00:00', 'date2' => '2026-10-10 01:00'];
+	$session  = $_SESSION;
+	ob_start();
+	expect(fv_nbar_timespan_request())->toBeTrue();
+	$payload = json_decode(ob_get_clean(), true);
+	expect($payload)->toHaveKeys(['begin_now', 'end_now']);
+	expect($_SESSION)->toBe($session);
+})->with([0, 1, 4, 1000, 'invalid']);
+it('leaves legacy timespan dispatch to its original handler', function () {
+	$_REQUEST = ['report' => '7'];
+	expect(fv_nbar_timespan_request())->toBeFalse();
+});
+it('distinguishes a status read failure from an empty feed and keeps other captures visible', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(time())]);
+	plugin_test_queue_slices([fv_nbar_data_table(time())]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', false);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => time()]);
+	ob_start();
+	fv_nbar_feed_status([['id' => 1, 'name' => 'Broken'], ['id' => 2, 'name' => 'Healthy']], [1, 2]);
+	$html = ob_get_clean();
+	expect($html)->toContain('Broken: Unable to load NBAR status. Please try again.', 'Healthy: Receiving')->not->toContain('No retained NBAR records', 'No recent NBAR');
+});
+it('excludes multicast in both endpoint predicates', function () {
+	foreach (['d.src', 'd.dst'] as $field) {
+		$sql = fv_nbar_unicast_sql($field);
+		expect($sql)->toContain("LENGTH($field)=4", '& 240)=224', "LENGTH($field)=16", '=255');
+	}
+	expect(fn () => fv_nbar_unicast_sql('unsafe'))->toThrow(InvalidArgumentException::class);
+});
+it('drains more than one batch fairly across retention tables', function () {
+	foreach ([50000, 50000, 1, 1] as $count) {
+		plugin_test_queue_db_result('db_affected_rows', $count);
+	}
+	fv_nbar_cleanup_batches([['DELETE fixtureA LIMIT 50000', 50000], ['DELETE fixtureB LIMIT 50000', 50000]], microtime(true) + 1);
+	expect(array_column($GLOBALS['__test_db_calls'], 'sql'))->toBe(['DELETE fixtureA LIMIT 50000', 'DELETE fixtureB LIMIT 50000', 'DELETE fixtureA LIMIT 50000', 'DELETE fixtureB LIMIT 50000']);
+});
+it('stops cleanup at its deadline and drops failed batches', function () {
+	fv_nbar_cleanup_batches([['expired', 1]], microtime(true) - 1);
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+	plugin_test_queue_db_result('db_execute', false);
+	fv_nbar_cleanup_batches([['failed', 1]], microtime(true) + 1);
+	expect(array_column($GLOBALS['__test_db_calls'], 'sql'))->toBe(['failed']);
+});
+it('checks the shared deadline between cleanup statements', function () {
+	plugin_test_queue_db_result('db_execute', function () {
+		usleep(3000);
+
+		return true;
+	});
+	fv_nbar_cleanup_batches([['first', 1], ['second', 1]], microtime(true) + 0.001);
+	expect(array_column($GLOBALS['__test_db_calls'], 'sql'))->toBe(['first']);
+});
+it('drains the daily retention tables through the shared worker', function () {
+	fv_nbar_daily_cleanup();
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(4);
+});
diff --git a/tests/Unit/NbarMaintenanceTest.php b/tests/Unit/NbarMaintenanceTest.php
new file mode 100644
index 0000000..ecfe529
--- /dev/null
+++ b/tests/Unit/NbarMaintenanceTest.php
@@ -0,0 +1,309 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_connections.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_query.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn'] = 'maintenance-test-connection';
+});
+
+it('publishes raw data and revision invalidation in one transaction', function () {
+	expect(fv_nbar_summary_store([['INSERT fixture VALUES (?)', [42]]], 3, [1800000000 => true, 1800003600 => true]))->toBeTrue();
+	$calls = $GLOBALS['__test_db_calls'];
+	expect(array_column($calls, 'sql')[0])->toBe('START TRANSACTION');
+	expect($calls[1]['params'])->toBe([42]);
+	expect($calls[2]['sql'])->toContain('(3,1800000000,1,-1)', '(3,1800003600,1,-1)', 'revision=revision+1');
+	expect(end($calls)['sql'])->toBe('COMMIT');
+
+	foreach ($calls as $call) {
+		expect($call['conn'])->toBe('maintenance-test-connection');
+	}
+});
+
+it('does not publish revisions when transaction creation fails', function () {
+	plugin_test_queue_db_result('db_execute', false);
+	expect(fv_nbar_summary_store([['INSERT fixture VALUES (?)', [42]]], 3, [1800000000 => true]))->toBeFalse();
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1);
+});
+
+it('rolls back when invalidation fails after the raw write', function () {
+	plugin_test_queue_db_result('db_execute', true);
+	plugin_test_queue_db_result('db_execute', false);
+	expect(fv_nbar_summary_store([['INSERT fixture VALUES (?)', [42]]], 3, [1800000000 => true]))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toBe('ROLLBACK');
+	expect($sql)->not->toContain('COMMIT');
+});
+
+it('writes every slice in one transaction and rolls back when any slice fails', function () {
+	$statements = [['INSERT slice_a VALUES (?)', [1]], ['INSERT slice_b VALUES (?)', [2]]];
+	expect(fv_nbar_summary_store($statements, 3, [1800000000 => true]))->toBeTrue();
+	$prepared = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_execute_prepared'));
+	expect(array_column($prepared, 'sql'))->toBe(['INSERT slice_a VALUES (?)', 'INSERT slice_b VALUES (?)']);
+
+	plugin_test_reset();
+	plugin_test_queue_db_result('db_execute_prepared', true);
+	plugin_test_queue_db_result('db_execute_prepared', false);
+	expect(fv_nbar_summary_store($statements, 3, [1800000000 => true]))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toBe('ROLLBACK');
+	expect(implode(' ', $sql))->not->toContain('revision=revision+1');
+});
+
+it('rebuilds all hourly tables and publishes only a matching revision', function () {
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+	expect(fv_nbar_summary_build(3, 1800000000))->toBeTrue();
+	$calls = $GLOBALS['__test_db_calls'];
+	$sql   = array_column($calls, 'sql');
+	expect($sql[count($sql) - 2])->toBe('COMMIT');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=0');
+	$publish = array_values(array_filter($calls, fn ($c) => str_starts_with($c['sql'], 'UPDATE plugin_flowview_nbar_hours')));
+	expect($publish[0]['params'])->toBe(['123', '123', 3, 1800000000]);
+});
+
+it('rolls back each failed hourly mutation without committing partial totals', function ($function, $failure) {
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+
+	// db_execute runs the timeout, isolation level and START TRANSACTION before the three aggregates.
+	$passes = $function === 'db_execute' ? 3 + $failure : $failure;
+
+	for ($i = 0; $i < $passes; $i++) {
+		plugin_test_queue_db_result($function, true);
+	}
+	plugin_test_queue_db_result($function, false);
+	expect(fv_nbar_summary_build(3, 1800000000))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect($sql[count($sql) - 2])->toBe('ROLLBACK');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=0');
+	expect($sql)->not->toContain('COMMIT');
+})->with([
+	['db_execute_prepared', 0], ['db_execute_prepared', 1], ['db_execute_prepared', 2], ['db_execute_prepared', 3],
+	['db_execute', 0], ['db_execute', 1], ['db_execute', 2],
+]);
+
+it('rejects an hourly build whose commit fails', function () {
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+
+	// The timeout, isolation level, START TRANSACTION and three aggregates precede the COMMIT.
+	for ($i = 0; $i < 6; $i++) {
+		plugin_test_queue_db_result('db_execute', true);
+	}
+	plugin_test_queue_db_result('db_execute', false);
+	expect(fv_nbar_summary_build(3, 1800000000))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect($sql[count($sql) - 2])->toBe('ROLLBACK');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=0');
+});
+
+it('rolls back an hourly build when the raw slices cannot be listed instead of publishing an empty hour', function () {
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	expect(fv_nbar_summary_build(3, 1800000000))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect($sql[count($sql) - 2])->toBe('ROLLBACK');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=0');
+	expect(implode(' ', $sql))->not->toContain('DELETE FROM plugin_flowview_nbar_')->not->toContain('built=?');
+});
+
+it('stores the selection criteria so the count rebuilds its source when it runs', function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_count.php');
+	$_SESSION['sess_user_id'] = 1;
+	plugin_test_queue_slices([]);
+	$key = fv_nbar_count_context('', 'd.listener_id=?', [1], 1800001800, [1], 1800000000);
+	expect($_SESSION['fv_nbar_counts'][$key]['scope'])->toBe(['where' => 'd.listener_id=?', 'listeners' => [1], 'start' => 1800000000, 'end' => 1800001800]);
+	// A slice that appears later changes the SQL text but must not change the cache key.
+	plugin_test_queue_slices([fv_nbar_data_table(1800000000)]);
+	expect(fv_nbar_count_context('', 'd.listener_id=?', [1], 1800001800, [1], 1800000000))->toBe($key);
+	expect($_SESSION['fv_nbar_counts'])->toHaveCount(1);
+	$other = fv_nbar_count_context('(SELECT fixture)', 'd.listener_id=?', [1], 1800001800);
+	expect($_SESSION['fv_nbar_counts'][$other])->not->toHaveKey('scope');
+});
+
+it('aggregates an hour from only the slices that cover it', function () {
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+	plugin_test_queue_slices([fv_nbar_data_table(1799996400), fv_nbar_data_table(1800000000), fv_nbar_data_table(1800003600)]);
+	expect(fv_nbar_summary_build(3, 1800000000))->toBeTrue();
+	$inserts = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($c) => str_starts_with($c['sql'], 'INSERT INTO plugin_flowview_nbar_')));
+	expect($inserts)->toHaveCount(3);
+
+	foreach ($inserts as $insert) {
+		expect($insert['sql'])->toContain(fv_nbar_data_table(1800000000));
+		expect($insert['sql'])->not->toContain(fv_nbar_data_table(1799996400));
+		expect($insert['sql'])->not->toContain(fv_nbar_data_table(1800003600));
+		expect($insert['sql'])->toContain('listener_id=3 AND minute>=1800000000 AND minute<1800003600');
+	}
+});
+
+it('rejects hourly builds with missing or changed revisions', function ($latest) {
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => '123']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', $latest);
+	expect(fv_nbar_summary_build(3, 1800000000))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect($sql[count($sql) - 2])->toBe('ROLLBACK');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=0');
+	expect(implode(' ', $sql))->not->toContain('UPDATE plugin_flowview_nbar_hours SET built');
+})->with([[['revision' => '124']], [[]]]);
+
+it('rejects a build with no initial hourly state', function () {
+	expect(fv_nbar_summary_build(3, 1800000000))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect($sql[count($sql) - 2])->toBe('ROLLBACK');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=0');
+});
+
+it('skips hourly maintenance while another worker holds its lock', function () {
+	expect(fv_nbar_summary_refresh())->toBe(0);
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1);
+});
+
+it('requires all overlapping hours to be ready before using a daily revision', function ($state, $expected) {
+	plugin_test_queue_db_result('db_fetch_row_prepared', $state);
+	expect(fv_nbar_daily_signature(3, 1800000000, 1800007200))->toBe($expected);
+})->with([
+	[['n' => 2, 'ready' => 2, 'rev' => '18446744073709551616'], '18446744073709551616'],
+	[['n' => 1, 'ready' => 1, 'rev' => '1'], null],
+	[['n' => 2, 'ready' => 1, 'rev' => '1'], null],
+	[[], null],
+]);
+
+it('fails closed for untrusted daily signature text', function () {
+	$sql = fv_nbar_daily_guard(3, 1800000000, 1800007200, '1 OR 1=1');
+	expect($sql)->toContain('revision=-1');
+	expect($sql)->not->toContain('OR 1=1');
+});
+
+it('keeps observation dates unknown when any contributing row lacks dates', function () {
+	$total = ['first_seen' => null, 'last_seen' => null, '_seen_missing' => false];
+	fv_nbar_seen_merge($total, ['first_seen' => 20, 'last_seen' => 30]);
+	fv_nbar_seen_merge($total, ['first_seen' => 10, 'last_seen' => 25]);
+	expect($total['first_seen'])->toBe(10);
+	expect($total['last_seen'])->toBe(30);
+	fv_nbar_seen_merge($total, ['first_seen' => null, 'last_seen' => 50]);
+	expect($total['_seen_missing'])->toBeTrue();
+});
+
+it('does not start date backfill without both scoped locks', function () {
+	plugin_test_queue_db_result('db_fetch_cell', 1);
+	plugin_test_queue_db_result('db_fetch_cell', 'REPEATABLE-READ');
+	plugin_test_queue_db_result('db_fetch_cell', 0);
+	expect(fv_nbar_seen_backfill())->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->toContain('RELEASE_LOCK', 'REPEATABLE READ');
+	expect($sql)->not->toContain('UPDATE plugin_flowview_nbar_');
+});
+
+it('expires all summary levels with bounded database deletions and drops raw slices', function () {
+	fv_nbar_cleanup();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect($sql[0])->toStartWith('SHOW TABLES');
+	$deletes = array_slice($sql, 1);
+	expect($deletes)->toHaveCount(8);
+
+	foreach ($deletes as $statement) {
+		expect($statement)->toStartWith('DELETE FROM plugin_flowview_nbar_');
+		expect($statement)->toContain(' LIMIT ');
+		expect($statement)->not->toContain('plugin_flowview_nbar_data');
+	}
+});
+
+it('stops dropping raw slices and summary batches once the maintenance deadline passes', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(0, 0, 0, 1, 1, 2000)), fv_nbar_data_table(gmmktime(1, 0, 0, 1, 1, 2000))]);
+	fv_nbar_cleanup(0);
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect($sql)->toBe(["SHOW TABLES LIKE 'plugin\\_flowview\\_nbar\\_data\\_%'"]);
+});
+
+it('shares one deadline between the raw slice drops and the summary deletions', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(0, 0, 0, 1, 1, 2000)), fv_nbar_data_table(gmmktime(1, 0, 0, 1, 1, 2000))]);
+	fv_nbar_cleanup(30);
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(array_slice($sql, 1, 2))->toBe(['DROP TABLE IF EXISTS `plugin_flowview_nbar_data_200000000`', 'DROP TABLE IF EXISTS `plugin_flowview_nbar_data_200000001`']);
+	expect(implode(' ', array_slice($sql, 3)))->toContain('DELETE FROM plugin_flowview_nbar_apps');
+});
+
+it('drops expired slices oldest first and leaves the rest for the next pass at the deadline', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(0, 0, 0, 1, 1, 2000)), fv_nbar_data_table(gmmktime(1, 0, 0, 1, 1, 2000))]);
+	expect(fv_nbar_data_drop_expired(PHP_INT_MAX, microtime(true) - 1))->toBe(0);
+	expect(array_column($GLOBALS['__test_db_calls'], 'fn'))->not->toContain('db_execute');
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(0, 0, 0, 1, 1, 2000)), fv_nbar_data_table(gmmktime(1, 0, 0, 1, 1, 2000))]);
+	expect(fv_nbar_data_drop_expired(PHP_INT_MAX, microtime(true) + 60))->toBe(2);
+});
+
+it('rejects unknown summary types before constructing SQL', function () {
+	expect(fn () => fv_nbar_hourly_source('untrusted', [1], 0, 3600))->toThrow(InvalidArgumentException::class);
+	expect(fn () => fv_nbar_summary_source('untrusted', [1], 0, 3600))->toThrow(InvalidArgumentException::class);
+});
+
+it('keeps summary and raw branches mutually exclusive for complete hours', function () {
+	foreach (['apps', 'pairs', 'connections'] as $kind) {
+		plugin_test_queue_slices([fv_nbar_data_table(1800000000), fv_nbar_data_table(1800003600), fv_nbar_data_table(1800007200), fv_nbar_data_table(1800010800), fv_nbar_data_table(1800090000)]);
+		$sql = fv_nbar_hourly_source($kind, [3], 1800000010, 1800010810, 1800100000);
+		expect($sql)->toContain('UNION ALL', 'NOT (', 'listener_id=3');
+		expect($sql)->toContain('minute>=1800000010', 'minute<1800010810');
+		expect($sql)->toContain('`' . fv_nbar_data_table(1800000000) . '`', '`' . fv_nbar_data_table(1800003600) . '`', '`' . fv_nbar_data_table(1800010800) . '`');
+		expect($sql)->not->toContain(fv_nbar_data_table(1800090000));
+	}
+});
+
+it('restores the database timeout after building or rolling back a daily block', function ($fail) {
+	plugin_test_queue_db_result('db_fetch_row_prepared', []);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['n' => 1, 'ready' => 1, 'rev' => '42']);
+	plugin_test_queue_db_result('db_fetch_cell', '7.5');
+
+	if ($fail) {
+		plugin_test_queue_db_result('db_execute', true);
+		plugin_test_queue_db_result('db_execute', true);
+		plugin_test_queue_db_result('db_execute', false);
+	}
+	expect(fv_nbar_daily_build(3, 1800000000, 1800003600))->toBe($fail ? 0 : 1);
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=7.5');
+	expect($sql)->toContain($fail ? 'ROLLBACK' : 'COMMIT');
+})->with([false, true]);
+
+it('caches exact-count contexts separately by account and filter', function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_count.php');
+	$_SESSION['sess_user_id'] = 1;
+	$a                        = fv_nbar_count_context('(SELECT fixture)', 'd.listener_id=?', [1], time());
+	$b                        = fv_nbar_count_context('(SELECT fixture)', 'd.listener_id=?', [2], time() - 3600);
+	$_SESSION['sess_user_id'] = 2;
+	$c                        = fv_nbar_count_context('(SELECT fixture)', 'd.listener_id=?', [1], time());
+	expect($a)->not->toBe($b)->not->toBe($c);
+	expect($_SESSION['fv_nbar_counts'][$a]['ttl'])->toBe(60);
+	expect($_SESSION['fv_nbar_counts'][$b]['ttl'])->toBe(600);
+	expect($_SESSION['fv_nbar_counts'][$a]['sql'])->toContain('COUNT(DISTINCT', 'd.listener_id=?');
+	expect($_SESSION['fv_nbar_counts'][$a]['args'])->toBe([1]);
+	expect(fv_nbar_count_context('(SELECT fixture)', 'd.listener_id=?', [1], time()))->toBe($c);
+});
+
+it('expires old count contexts and bounds the account cache', function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_count.php');
+	$_SESSION['fv_nbar_counts'] = ['expired' => ['expires' => time() - 1]];
+
+	foreach (range(1, 12) as $i) {
+		$_SESSION['fv_nbar_counts']['context' . $i] = ['expires' => time() + 3600];
+	}
+	$key = fv_nbar_count_context('(SELECT fixture)', '1=1', [], time());
+	expect($_SESSION['fv_nbar_counts'])->toHaveCount(12);
+	expect($_SESSION['fv_nbar_counts'])->not->toHaveKey('expired')->not->toHaveKey('context1');
+	expect($_SESSION['fv_nbar_counts'])->toHaveKey($key);
+});
+
+it('uses summary tuple fields for counts without aggregating traffic counters', function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_count.php');
+	plugin_test_queue_slices([fv_nbar_data_table(1800000000)]);
+	$key = fv_nbar_count_context('', 'd.listener_id=? AND d.minute>=? AND d.minute<?', [1, 1800000000, 1800001800], 1800001800, [1], 1800000000);
+	$sql = $_SESSION['fv_nbar_counts'][$key]['sql'];
+	expect($sql)->toContain('COUNT(DISTINCT', fv_nbar_data_table(1800000000), 'd.listener_id=?');
+	expect($sql)->not->toContain('SUM(d.bytes)');
+});
diff --git a/tests/Unit/NbarPacketTest.php b/tests/Unit/NbarPacketTest.php
new file mode 100644
index 0000000..494a53f
--- /dev/null
+++ b/tests/Unit/NbarPacketTest.php
@@ -0,0 +1,166 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_collector.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['listener_id'] = 1;
+	$this->header           = pack('nnNNNN', 9, 2, 100000, time(), 1, 902);
+});
+
+it('learns an application name from a v9 options template', function () {
+	$definitions = pack('nnnnnn', 1, 4, 95, 4, 96, 32);
+	$template    = pack('nnnnn', 1, 10 + strlen($definitions), 901, 4, 8) . $definitions;
+	$record      = inet_pton('192.0.2.1') . hex2bin('0d000001') . str_pad('youtube', 32, chr(0));
+	$data        = pack('nn', 901, 4 + strlen($record)) . $record;
+	fv_nbar_packet($this->header . $template . $data, '192.0.2.91');
+	$calls = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_execute_prepared'));
+	expect($calls)->toHaveCount(1);
+	expect($calls[0]['sql'])->toContain('INSERT INTO plugin_flowview_nbar_names');
+	expect(array_slice($calls[0]['params'], 0, 3))->toBe(['192.0.2.91', '0d000001', 'youtube']);
+});
+
+it('ignores malformed template definitions without writing records', function ($definition) {
+	fv_nbar_packet($this->header . $definition, '192.0.2.92');
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+})->with([pack('nnnn', 0, 8, 12, 1), pack('nnnn', 0, 8, 902, 1), pack('nnnnn', 1, 10, 903, 1, 0)]);
+
+it('uses exporter uptime to date records and rejects expired observations', function ($expired) {
+	$fields      = [95 => 4, 8 => 4, 12 => 4, 1 => 4, 21 => 4];
+	$definitions = '';
+
+	foreach ($fields as $id => $size) {
+		$definitions .= pack('nn', $id, $size);
+	}
+	$template = pack('nnnn', 0, 8 + strlen($definitions), 904, count($fields)) . $definitions;
+	$record   = hex2bin('0d000001') . inet_pton('192.0.2.10') . inet_pton('198.51.100.20') . pack('NN', 1000, 95000);
+	$data     = pack('nn', 904, 4 + strlen($record)) . $record;
+	$now      = time();
+	$slice    = fv_nbar_data_table((int) (floor(($now - 5) / 60) * 60));
+	plugin_test_queue_db_result('db_fetch_cell', $slice);
+	fv_nbar_packet(pack('nnNNNN', 9, 2, 100000, $expired ? $now - 8 * 86400 : $now, 1, 904) . $template . $data, '192.0.2.94');
+	$calls = array_values(array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_execute_prepared'));
+
+	if ($expired) {
+		expect($calls)->toBe([]);
+	} else {
+		expect($calls)->toHaveCount(1);
+		expect($calls[0]['sql'])->toStartWith('INSERT INTO `' . $slice . '`');
+		expect($calls[0]['params'][1])->toBe((int) (floor(($now - 5) / 60) * 60));
+	}
+})->with([false, true]);
+
+it('ignores incomplete records and reports a failed record transaction', function ($reason) {
+	$fields      = $reason === 'application' ? [8 => 4, 12 => 4, 1 => 4] : [95 => 4, 8 => $reason === 'address' ? 1 : 4, 12 => 4, 1 => 4];
+	$definitions = '';
+	$record      = '';
+
+	foreach ($fields as $id => $size) {
+		$definitions .= pack('nn', $id, $size);
+		$record .= str_repeat(chr(1), $size);
+	}
+	$template = pack('nnnn', 0, 8 + strlen($definitions), 905, count($fields)) . $definitions;
+	$data     = pack('nn', 905, 4 + strlen($record)) . $record;
+
+	if ($reason === 'transaction') {
+		// The first database call creates the slice; the next one starts the record transaction.
+		plugin_test_queue_db_result('db_fetch_cell', fv_nbar_data_table((int) (floor(time() / 60) * 60)));
+		plugin_test_queue_db_result('db_execute', true);
+		plugin_test_queue_db_result('db_execute', false);
+	}
+	fv_nbar_packet($this->header . $template . $data, '192.0.2.95');
+
+	if ($reason === 'transaction') {
+		expect(end($GLOBALS['__test_cacti_log']))->toBe('WARNING: NBAR record transaction failed');
+	} else {
+		expect($GLOBALS['__test_db_calls'])->toBe([]);
+	}
+})->with(['application', 'address', 'transaction']);
+
+it('invalidates cached templates containing any zero-length field and recovers on a valid refresh', function ($options, $position) {
+	$tid    = 960 + $position + ($options ? 10 : 0);
+	$router = '192.0.2.96';
+	$fields = $options ? [[1, 4], [95, 4], [96, 32]] : [[95, 4], [8, 4], [12, 4], [1, 4]];
+	$record = $options ? inet_pton('192.0.2.1') . hex2bin('0d000001') . str_pad('youtube', 32, chr(0)) : hex2bin('0d000001') . inet_pton('192.0.2.10') . inet_pton('198.51.100.20') . pack('N', 1000);
+	$encode = static function ($fields) use ($options, $tid) {
+		$definitions = implode('', array_map(fn ($f) => pack('nn', ...$f), $fields));
+
+		return ($options ? pack('nnnnn', 1, 10 + strlen($definitions), $tid, 4, strlen($definitions) - 4) : pack('nnnn', 0, 8 + strlen($definitions), $tid, count($fields))) . $definitions;
+	};
+	$data = pack('nn', $tid, 4 + strlen($record)) . $record;
+	fv_nbar_packet($this->header . $encode($fields) . $data, $router);
+	expect($GLOBALS['__test_db_calls'])->not->toBe([]);
+	plugin_test_reset();
+	$invalid = $fields;
+	array_splice($invalid, $position, 0, [[999, 0]]);
+	fv_nbar_packet($this->header . $encode($invalid) . $data, $router);
+	fv_nbar_packet($this->header . $data, $router);
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+	fv_nbar_packet($this->header . $encode($fields) . $data, $router);
+	expect($GLOBALS['__test_db_calls'])->not->toBe([]);
+})->with([[false, 0], [false, 2], [false, 4], [true, 0], [true, 2], [true, 3]]);
+
+it('rejects a large zero-length template before repeatedly parsing its data', function () {
+	$definitions = str_repeat(pack('nn', 999, 0), 1999) . pack('nn', 95, 1);
+	$template    = pack('nnnn', 0, 8 + strlen($definitions), 990, 2000) . $definitions;
+	$data        = pack('nn', 990, 56004) . str_repeat('x', 56000);
+	fv_nbar_packet($this->header . $template . $data, '192.0.2.99');
+	fv_nbar_packet($this->header . $data, '192.0.2.99');
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+});
+
+it('invalidates data templates with oversized numeric fields before decoding', function ($field, $width) {
+	$tid    = 1100 + $field;
+	$router = '192.0.2.110';
+	$fields = [[95, 4], [8, 4], [12, 4], [1, 4]];
+	$encode = static function ($fields) use ($tid) {
+		$def = implode('', array_map(fn ($f) => pack('nn', ...$f), $fields));
+
+		return pack('nnnn', 0, 8 + strlen($def), $tid, count($fields)) . $def;
+	};
+	$record = hex2bin('0d000001') . inet_pton('192.0.2.1') . inet_pton('198.51.100.1') . pack('N', 10);
+	$normal = pack('nn', $tid, 4 + strlen($record)) . $record;
+	fv_nbar_packet($this->header . $encode($fields) . $normal, $router);
+	plugin_test_reset();
+	$invalid   = $fields;
+	$invalid[] = [$field, $width];
+	$data      = pack('nn', $tid, 4 + strlen($record) + $width) . $record . str_repeat('x', $width);
+	fv_nbar_packet($this->header . $encode($invalid) . $data, $router);
+	fv_nbar_packet($this->header . $normal, $router);
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+})->with([[1, 4096], [2, 4096], [4, 4096], [7, 4096], [11, 4096], [21, 4096], [4, 2], [7, 3], [11, 3], [21, 5]]);
+
+it('keeps wide options scopes separate from numeric data field widths', function () {
+	$def      = pack('nnnnnn', 1, 16, 95, 4, 96, 32);
+	$template = pack('nnnnn', 1, 10 + strlen($def), 1190, 4, 8) . $def;
+	$record   = inet_pton('2001:db8::1') . hex2bin('0d000001') . str_pad('youtube', 32, chr(0));
+	fv_nbar_packet($this->header . $template . pack('nn', 1190, 4 + strlen($record)) . $record, '192.0.2.119');
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1)->and($GLOBALS['__test_db_calls'][0]['params'][2])->toBe('youtube');
+});
+
+it('does not interpret options scopes as flow counters when names are absent', function () {
+	$def      = pack('nnnnnnnn', 1, 16, 95, 4, 8, 4, 12, 4);
+	$template = pack('nnnnn', 1, 10 + strlen($def), 1191, 4, 12) . $def;
+	$record   = inet_pton('2001:db8::1') . hex2bin('0d000001') . inet_pton('192.0.2.1') . inet_pton('198.51.100.1');
+	fv_nbar_packet($this->header . $template . pack('nn', 1191, 4 + strlen($record)) . $record, '192.0.2.119');
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+});
+
+it('bounds packet-controlled source IDs while continuing to decode recent templates', function () {
+	$def      = pack('nnnnnnnn', 95, 4, 8, 4, 12, 4, 1, 4);
+	$template = pack('nnnn', 0, 8 + strlen($def), 1300, 4) . $def;
+	$record   = hex2bin('0d000001') . inet_pton('192.0.2.1') . inet_pton('198.51.100.1') . pack('N', 10);
+	$data     = pack('nn', 1300, 4 + strlen($record)) . $record;
+
+	for ($i = 0; $i < 70; $i++) {
+		fv_nbar_packet(pack('nnNNNN', 9, 1, 100000, time(), 1, 1000 + $i) . $template, '192.0.2.130');
+	}
+	fv_nbar_packet(pack('nnNNNN', 9, 1, 100000, time(), 1, 1000) . $data, '192.0.2.130');
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+	fv_nbar_packet(pack('nnNNNN', 9, 1, 100000, time(), 1, 1069) . $data, '192.0.2.130');
+	expect($GLOBALS['__test_db_calls'])->not->toBe([]);
+});
diff --git a/tests/Unit/NbarPartitionTest.php b/tests/Unit/NbarPartitionTest.php
new file mode 100644
index 0000000..8f4a13d
--- /dev/null
+++ b/tests/Unit/NbarPartitionTest.php
@@ -0,0 +1,365 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_partition.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn'] = 'nbar-partition-test';
+});
+
+it('names hourly slices by default and daily slices when the scheme is daily', function () {
+	$time = gmmktime(5, 30, 0, 3, 1, 2026);
+	expect(fv_nbar_data_table($time))->toBe('plugin_flowview_nbar_data_202605905');
+	$GLOBALS['__test_config']['flowview_partition'] = '1';
+	expect(fv_nbar_data_table($time))->toBe('plugin_flowview_nbar_data_202605905');
+	$GLOBALS['__test_config']['flowview_partition'] = '0';
+	expect(fv_nbar_data_table($time))->toBe('plugin_flowview_nbar_data_2026059');
+	expect(fv_nbar_data_table(gmmktime(23, 59, 59, 12, 31, 2024)))->toBe('plugin_flowview_nbar_data_2024365');
+	expect(fv_nbar_data_table(gmmktime(0, 0, 0, 1, 1, 2026)))->toBe('plugin_flowview_nbar_data_2026000');
+});
+
+it('names slices by UTC so the repeated daylight saving hour cannot share a table', function () {
+	$old = date_default_timezone_get();
+
+	try {
+		foreach (['Australia/Adelaide', 'America/New_York', 'UTC'] as $zone) {
+			date_default_timezone_set($zone);
+			expect(fv_nbar_data_table(gmmktime(5, 30, 0, 3, 1, 2026)))->toBe('plugin_flowview_nbar_data_202605905');
+		}
+		date_default_timezone_set('America/New_York');
+		$first  = gmmktime(5, 30, 0, 11, 1, 2026);
+		$second = $first + 3600;
+		expect(fv_nbar_data_table($first))->not->toBe(fv_nbar_data_table($second));
+	} finally {
+		date_default_timezone_set($old);
+	}
+});
+
+it('reads the time range of a slice from its name and rejects names that are not slices', function () {
+	$hour = gmmktime(5, 0, 0, 3, 1, 2026);
+	expect(fv_nbar_data_bounds('plugin_flowview_nbar_data_202605905'))->toBe([$hour, $hour + 3600]);
+	$day = gmmktime(0, 0, 0, 3, 1, 2026);
+	expect(fv_nbar_data_bounds('plugin_flowview_nbar_data_2026059'))->toBe([$day, $day + 86400]);
+	expect(fv_nbar_data_bounds('plugin_flowview_nbar_data_2024365'))->toBe([gmmktime(0, 0, 0, 12, 31, 2024), gmmktime(0, 0, 0, 12, 31, 2024) + 86400]);
+
+	foreach (['plugin_flowview_nbar_data', 'plugin_flowview_nbar_data_x', 'plugin_flowview_nbar_data_2026366', 'plugin_flowview_nbar_data_202605924', 'plugin_flowview_nbar_data_2026059123', 'plugin_flowview_nbar_data_2026059' . "\n", 'plugin_flowview_nbar_hours', 'plugin_flowview_raw_202605905'] as $name) {
+		expect(fv_nbar_data_bounds($name))->toBeNull();
+	}
+});
+
+it('lists the slices oldest first and ignores unrelated tables', function () {
+	$rows = array_map(fn ($name) => ['Tables_in_cacti (plugin\_flowview\_nbar\_data\_%)' => $name], [
+		'plugin_flowview_nbar_data_202605907',
+		'plugin_flowview_nbar_data_2026058',
+		'plugin_flowview_nbar_data_garbage',
+		'plugin_flowview_nbar_data_202605905',
+	]);
+	plugin_test_queue_db_result('db_fetch_assoc', $rows);
+	$tables = fv_nbar_data_tables();
+	expect(array_column($tables, 'table'))->toBe(['plugin_flowview_nbar_data_2026058', 'plugin_flowview_nbar_data_202605905', 'plugin_flowview_nbar_data_202605907']);
+	expect($tables[0])->toBe(['table' => 'plugin_flowview_nbar_data_2026058', 'start' => gmmktime(0, 0, 0, 2, 28, 2026), 'end' => gmmktime(0, 0, 0, 3, 1, 2026)]);
+	expect($GLOBALS['__test_db_calls'][0]['sql'])->toBe("SHOW TABLES LIKE 'plugin\\_flowview\\_nbar\\_data\\_%'");
+	expect($GLOBALS['__test_db_calls'][0]['conn'])->toBe('nbar-partition-test');
+});
+
+/**
+ * The slice list fv_nbar_data_tables() would return for hourly slices starting at the given UTC hours of 2026-03-01.
+ *
+ * @param list<int> $hours UTC hours.
+ *
+ * @return list<array{table: string, start: int, end: int}>
+ */
+function flowview_test_hourly_slices(array $hours): array {
+	$tables = [];
+
+	foreach ($hours as $hour) {
+		$start    = gmmktime($hour, 0, 0, 3, 1, 2026);
+		$tables[] = ['table' => fv_nbar_data_table($start), 'start' => $start, 'end' => $start + 3600];
+	}
+
+	return $tables;
+}
+
+it('selects only the slices that overlap a range, with the range end exclusive', function () {
+	$tables = flowview_test_hourly_slices([4, 5, 6, 7]);
+	$h5     = gmmktime(5, 0, 0, 3, 1, 2026);
+	expect(fv_nbar_data_slices($h5, $h5 + 3600, $tables))->toBe(['plugin_flowview_nbar_data_202605905']);
+	expect(fv_nbar_data_slices($h5 + 1, $h5 + 3601, $tables))->toBe(['plugin_flowview_nbar_data_202605905', 'plugin_flowview_nbar_data_202605906']);
+	expect(fv_nbar_data_slices($h5 - 7200, $h5 - 3600, $tables))->toBe([]);
+	expect(fv_nbar_data_slices($h5 + 86400, $h5 + 90000, $tables))->toBe([]);
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+});
+
+it('lists the slices itself when none are supplied', function () {
+	$name = fv_nbar_data_table(gmmktime(5, 0, 0, 3, 1, 2026));
+	plugin_test_queue_slices([$name]);
+	expect(fv_nbar_data_slices(gmmktime(5, 0, 0, 3, 1, 2026), gmmktime(6, 0, 0, 3, 1, 2026)))->toBe([$name]);
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1);
+});
+
+it('reads a daily slice for an hourly range that falls inside it, so a scheme change keeps old data readable', function () {
+	$daily = 'plugin_flowview_nbar_data_2026059';
+	plugin_test_queue_slices([$daily, fv_nbar_data_table(gmmktime(0, 0, 0, 3, 2, 2026))]);
+	$from = gmmktime(5, 0, 0, 3, 1, 2026);
+	expect(fv_nbar_data_slices($from, $from + 3600))->toBe([$daily]);
+});
+
+it('builds one filtered select per overlapping slice so no slice is read whole', function () {
+	$tables = flowview_test_hourly_slices([4, 5, 6]);
+	$from   = gmmktime(4, 30, 0, 3, 1, 2026);
+	$to     = gmmktime(5, 30, 0, 3, 1, 2026);
+	$parts  = fv_nbar_data_parts('a,b', "listener_id=3 AND minute>=$from AND minute<$to", $from, $to, $tables);
+	expect($parts)->toBe([
+		"SELECT a,b FROM `plugin_flowview_nbar_data_202605904` WHERE listener_id=3 AND minute>=$from AND minute<$to",
+		"SELECT a,b FROM `plugin_flowview_nbar_data_202605905` WHERE listener_id=3 AND minute>=$from AND minute<$to",
+	]);
+	$source = fv_nbar_data_source('a,b', "listener_id=3 AND minute>=$from AND minute<$to", $from, $to, $tables);
+	expect($source)->toBe('(' . implode(' UNION ALL ', $parts) . ')');
+});
+
+it('uses a single select without a union when one slice covers the range', function () {
+	$tables = flowview_test_hourly_slices([5]);
+	$from   = gmmktime(5, 0, 0, 3, 1, 2026);
+	$source = fv_nbar_data_source(fv_nbar_data_columns(), 'minute>=1', $from, $from + 3600, $tables);
+	expect($source)->toStartWith('(SELECT listener_id,minute,')->not->toContain('UNION ALL');
+	expect($source)->toContain('minute first_seen,minute last_seen,router FROM `plugin_flowview_nbar_data_202605905` WHERE minute>=1');
+});
+
+it('returns an empty typed relation when no slice overlaps the range', function () {
+	$columns = fv_nbar_data_columns();
+	$from    = gmmktime(5, 0, 0, 3, 1, 2026);
+
+	foreach ([[], flowview_test_hourly_slices([9])] as $tables) {
+		$source = fv_nbar_data_source($columns, 'listener_id=3', $from, $from + 3600, $tables);
+		expect($source)->toContain('WHERE 1=0', 'fv_nbar_empty', 'CAST(0 AS UNSIGNED) listener_id', 'CAST(\'\' AS CHAR(45)) router');
+		expect($source)->toStartWith('(SELECT ' . $columns . ' FROM (SELECT CAST');
+		expect($source)->not->toContain('listener_id=3');
+	}
+});
+
+it('exposes the raw columns the summaries expect including observation dates', function () {
+	expect(fv_nbar_data_columns())->toBe('listener_id,minute,app_id,src,dst,sport,dport,protocol,bytes,packets,flows,minute first_seen,minute last_seen,router');
+});
+
+it('creates a slice once and remembers it for a minute', function () {
+	$name = 'plugin_flowview_nbar_data_202605905';
+	plugin_test_queue_db_result('db_fetch_cell', $name);
+	expect(fv_nbar_data_ensure($name))->toBeTrue();
+	$first = count($GLOBALS['__test_db_calls']);
+	expect($first)->toBeGreaterThan(0);
+	expect(fv_nbar_data_ensure($name))->toBeTrue();
+	expect($GLOBALS['__test_db_calls'])->toHaveCount($first);
+
+	$GLOBALS['fv_nbar_data_known'][$name] = time() - 61;
+	plugin_test_queue_db_result('db_fetch_cell', $name);
+	expect(fv_nbar_data_ensure($name))->toBeTrue();
+	expect(count($GLOBALS['__test_db_calls']))->toBeGreaterThan($first);
+});
+
+it('does not remember a slice that could not be created', function () {
+	$name = 'plugin_flowview_nbar_data_202605905';
+	plugin_test_queue_db_result('db_fetch_cell', '');
+	expect(fv_nbar_data_ensure($name))->toBeFalse();
+	expect($GLOBALS['fv_nbar_data_known'] ?? [])->not->toHaveKey($name);
+	plugin_test_queue_db_result('db_fetch_cell', $name);
+	expect(fv_nbar_data_ensure($name))->toBeTrue();
+});
+
+it('drops only the slices that ended before the retention cutoff', function () {
+	$cutoff = gmmktime(6, 0, 0, 3, 1, 2026);
+	plugin_test_queue_slices([
+		fv_nbar_data_table(gmmktime(4, 0, 0, 3, 1, 2026)),
+		fv_nbar_data_table(gmmktime(5, 0, 0, 3, 1, 2026)),
+		fv_nbar_data_table(gmmktime(6, 0, 0, 3, 1, 2026)),
+		fv_nbar_data_table(gmmktime(7, 0, 0, 3, 1, 2026)),
+	]);
+	$GLOBALS['fv_nbar_data_known']['plugin_flowview_nbar_data_202605904'] = time();
+	expect(fv_nbar_data_drop_expired($cutoff))->toBe(2);
+	$drops = array_column(array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_execute'), 'sql');
+	expect($drops)->toBe(['DROP TABLE IF EXISTS `plugin_flowview_nbar_data_202605904`', 'DROP TABLE IF EXISTS `plugin_flowview_nbar_data_202605905`']);
+	expect($GLOBALS['fv_nbar_data_known'])->not->toHaveKey('plugin_flowview_nbar_data_202605904');
+});
+
+it('keeps a daily slice until the whole day is outside retention', function () {
+	plugin_test_queue_slices(['plugin_flowview_nbar_data_2026059']);
+	expect(fv_nbar_data_drop_expired(gmmktime(23, 0, 0, 3, 1, 2026)))->toBe(0);
+	plugin_test_queue_slices(['plugin_flowview_nbar_data_2026059']);
+	expect(fv_nbar_data_drop_expired(gmmktime(0, 0, 0, 3, 2, 2026)))->toBe(1);
+});
+
+it('does not count a slice whose drop failed', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(4, 0, 0, 3, 1, 2026))]);
+	plugin_test_queue_db_result('db_execute', false);
+	expect(fv_nbar_data_drop_expired(gmmktime(9, 0, 0, 3, 1, 2026)))->toBe(0);
+});
+
+/**
+ * Hourly slices of 2026-03-01 onwards, one per hour, for as many hours as requested.
+ *
+ * @param int $count Number of consecutive hourly slices.
+ *
+ * @return list<array{table: string, start: int, end: int}>
+ */
+function flowview_test_many_slices(int $count): array {
+	return flowview_test_hourly_slices_from(gmmktime(0, 0, 0, 3, 1, 2026), $count);
+}
+
+/**
+ * @param int $first Unix time of the first slice.
+ * @param int $count Number of consecutive hourly slices.
+ *
+ * @return list<array{table: string, start: int, end: int}>
+ */
+function flowview_test_hourly_slices_from(int $first, int $count): array {
+	$tables = [];
+
+	for ($i = 0; $i < $count; $i++) {
+		$start    = $first + $i * 3600;
+		$tables[] = ['table' => fv_nbar_data_table($start), 'start' => $start, 'end' => $start + 3600];
+	}
+
+	return $tables;
+}
+
+/**
+ * Queue the slice list the way SHOW TABLES returns it.
+ *
+ * @param list<array{table: string, start: int, end: int}> $slices
+ */
+function flowview_test_queue_slice_list(array $slices): void {
+	plugin_test_queue_slices(array_column($slices, 'table'));
+}
+
+/**
+ * @return list<array{sql: string, params: array}>
+ */
+function flowview_test_edge_reads(): array {
+	return array_values(array_filter($GLOBALS['__test_db_calls'], fn ($c) => $c['fn'] === 'db_fetch_row_prepared'));
+}
+
+it('finds the oldest record of a capture with one query for a small set of slices', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(4, 0, 0, 3, 1, 2026)), fv_nbar_data_table(gmmktime(5, 0, 0, 3, 1, 2026)), fv_nbar_data_table(gmmktime(6, 0, 0, 3, 1, 2026))]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => 1772341260]);
+	expect(fv_nbar_data_edge(3))->toBe(['minute' => 1772341260]);
+	$reads = flowview_test_edge_reads();
+	expect($reads)->toHaveCount(1);
+	expect($reads[0]['sql'])->toStartWith('SELECT MIN(minute) minute FROM ((SELECT minute FROM `plugin_flowview_nbar_data_202605904` WHERE listener_id=? ORDER BY minute LIMIT 1) UNION ALL (SELECT minute FROM `plugin_flowview_nbar_data_202605905`');
+	expect($reads[0]['sql'])->toEndWith(') edge');
+	expect($reads[0]['params'])->toBe([3, 3, 3]);
+	expect($reads[0]['conn'])->toBe('nbar-partition-test');
+});
+
+it('finds the newest record of a capture with the slices ordered newest first', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(4, 0, 0, 3, 1, 2026)), fv_nbar_data_table(gmmktime(5, 0, 0, 3, 1, 2026))]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => 1772341260]);
+	expect(fv_nbar_data_edge(3, true))->toBe(['minute' => 1772341260]);
+	$reads = flowview_test_edge_reads();
+	expect($reads)->toHaveCount(1);
+	expect($reads[0]['sql'])->toStartWith('SELECT MAX(minute) minute FROM ((SELECT minute FROM `plugin_flowview_nbar_data_202605905` WHERE listener_id=? ORDER BY minute DESC LIMIT 1) UNION ALL');
+});
+
+it('resolves a daily slice that overlaps hourly slices inside the query', function () {
+	plugin_test_queue_slices(['plugin_flowview_nbar_data_2026059', fv_nbar_data_table(gmmktime(5, 0, 0, 3, 1, 2026))]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => gmmktime(5, 10, 0, 3, 1, 2026)]);
+	expect(fv_nbar_data_edge(3))->toBe(['minute' => gmmktime(5, 10, 0, 3, 1, 2026)]);
+	expect(flowview_test_edge_reads())->toHaveCount(1);
+});
+
+it('batches a capture with no records into bounded queries instead of one per slice', function ($latest) {
+	$slices = flowview_test_many_slices(720);
+	flowview_test_queue_slice_list($slices);
+
+	for ($i = 0; $i < 23; $i++) {
+		plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => null]);
+	}
+	expect(fv_nbar_data_edge(7, $latest))->toBe([]);
+	$reads = flowview_test_edge_reads();
+	expect($reads)->toHaveCount(23);
+
+	foreach ($reads as $i => $read) {
+		expect(count($read['params']))->toBe($i < 22 ? 32 : 16);
+		expect(substr_count($read['sql'], 'UNION ALL'))->toBe(count($read['params']) - 1);
+	}
+})->with([false, true]);
+
+it('stops probing further batches once no remaining slice can hold an earlier record', function () {
+	flowview_test_queue_slice_list(flowview_test_many_slices(100));
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => gmmktime(0, 5, 0, 3, 1, 2026)]);
+	expect(fv_nbar_data_edge(3))->toBe(['minute' => gmmktime(0, 5, 0, 3, 1, 2026)]);
+	expect(flowview_test_edge_reads())->toHaveCount(1);
+});
+
+it('stops probing further batches once no remaining slice can hold a later record', function () {
+	flowview_test_queue_slice_list(flowview_test_many_slices(100));
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => gmmktime(0, 0, 0, 3, 1, 2026) + 99 * 3600 + 120]);
+	expect(fv_nbar_data_edge(3, true))->toBe(['minute' => gmmktime(0, 0, 0, 3, 1, 2026) + 99 * 3600 + 120]);
+	expect(flowview_test_edge_reads())->toHaveCount(1);
+});
+
+it('keeps looking in later batches when an earlier batch only holds a record that a later slice could beat', function () {
+	// A daily slice sorts by its start, so it can sit ahead of hourly slices that start later but hold older minutes.
+	$slices = flowview_test_many_slices(40);
+	flowview_test_queue_slice_list($slices);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $slices[39]['end'] + 1000]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $slices[33]['start'] + 60]);
+	expect(fv_nbar_data_edge(3))->toBe(['minute' => $slices[33]['start'] + 60]);
+	expect(flowview_test_edge_reads())->toHaveCount(2);
+});
+
+it('ignores a later batch that only holds a newer record when looking for the oldest', function () {
+	$slices = flowview_test_many_slices(40);
+	flowview_test_queue_slice_list($slices);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $slices[39]['end'] + 1000]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $slices[39]['end'] + 5000]);
+	expect(fv_nbar_data_edge(3))->toBe(['minute' => $slices[39]['end'] + 1000]);
+});
+
+it('keeps the newest record found when a later batch only holds an older one', function () {
+	$slices = flowview_test_many_slices(40);
+	flowview_test_queue_slice_list($slices);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $slices[7]['start'] - 100]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $slices[3]['start'] - 500]);
+	expect(fv_nbar_data_edge(3, true))->toBe(['minute' => $slices[7]['start'] - 100]);
+});
+
+it('reports no record when the capture has none and no slice exists', function () {
+	plugin_test_queue_slices([]);
+	expect(fv_nbar_data_edge(3))->toBe([]);
+	expect(flowview_test_edge_reads())->toBe([]);
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(4, 0, 0, 3, 1, 2026))]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => null]);
+	expect(fv_nbar_data_edge(3))->toBe([]);
+});
+
+it('reports a database failure instead of an empty capture', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(gmmktime(4, 0, 0, 3, 1, 2026))]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', false);
+	expect(fv_nbar_data_edge(3))->toBeFalse();
+});
+
+it('reports a failure to list the slices as a failure, never as an empty history', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	expect(fv_nbar_data_edge(3))->toBeFalse();
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	expect(fv_nbar_data_edge(3, true))->toBeFalse();
+	expect(flowview_test_edge_reads())->toBe([]);
+});
+
+it('throws when the slices cannot be listed so no reader sees an empty relation', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	expect(fn () => fv_nbar_data_tables())->toThrow(RuntimeException::class, 'Cannot list the NBAR raw tables');
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	expect(fn () => fv_nbar_data_source('a', '1=1', 0, 3600))->toThrow(RuntimeException::class);
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	expect(fn () => fv_nbar_hourly_source('apps', [1], 0, 3600))->toThrow(RuntimeException::class);
+});
+
+it('drops nothing and does not fail when the slices cannot be listed', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	expect(fv_nbar_data_drop_expired(PHP_INT_MAX))->toBe(0);
+	expect(array_column($GLOBALS['__test_db_calls'], 'fn'))->not->toContain('db_execute');
+});
diff --git a/tests/Unit/NbarRenderingTest.php b/tests/Unit/NbarRenderingTest.php
new file mode 100644
index 0000000..4ae7a71
--- /dev/null
+++ b/tests/Unit/NbarRenderingTest.php
@@ -0,0 +1,195 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_query.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_chart.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_feed_status.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_preferences.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_dns.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn']  = 'render-test-connection';
+	$GLOBALS['lid']           = 1;
+	$GLOBALS['combined_lids'] = [1, 2, 3];
+});
+
+it('escapes router names and reports freshness separately for three selected captures', function () {
+	foreach ([1, 2, 3] as $unused) {
+		plugin_test_queue_slices([fv_nbar_data_table(time())]);
+	}
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => time()]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => time() - 600]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', []);
+	ob_start();
+	fv_nbar_feed_status([
+		['id' => 1, 'name' => '<router>'], ['id' => 2, 'name' => 'Second'],
+		['id' => 3, 'name' => 'Third'], ['id'    => 4, 'name' => 'Excluded'],
+	], [1, 2, 3]);
+	$html = ob_get_clean();
+	expect($html)->toContain('&lt;router&gt;: Receiving', 'Second: No recent NBAR', 'Third: No recent NBAR', 'No retained NBAR records');
+	expect($html)->not->toContain('<router>', 'Excluded');
+	expect(substr_count($html, 'fa-check-circle'))->toBe(1);
+	expect(substr_count($html, 'fa-times-circle'))->toBe(2);
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(6);
+});
+
+it('renders an explicit empty status when no capture is selected', function () {
+	ob_start();
+	fv_nbar_feed_status([['id' => 1, 'name' => 'Router']], []);
+	expect(ob_get_clean())->toContain('No captures selected');
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+});
+
+it('does not mark future-dated records as a receiving feed', function () {
+	plugin_test_queue_slices([fv_nbar_data_table(time() + 600)]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => time() + 600]);
+	ob_start();
+	fv_nbar_feed_status([['id' => 1, 'name' => 'Router']], [1]);
+	$html = ob_get_clean();
+	// The record is read (a slice exists and the lookup runs) but must not count as recent.
+	expect(array_column($GLOBALS['__test_db_calls'], 'fn'))->toContain('db_fetch_row_prepared');
+	expect($html)->toContain('No recent NBAR')->not->toContain('Receiving', 'No retained NBAR records');
+});
+
+it('shows the chart error instead of aborting when the raw slices cannot be listed', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	ob_start();
+	fv_nbar_chart('d.listener_id=?', [1, 1800000000, 1800001800], 'all');
+	$html = ob_get_clean();
+	expect($html)->toContain('Unable to load application chart. Please try again.')->not->toContain('conic-gradient');
+	expect(array_column($GLOBALS['__test_db_calls'], 'fn'))->not->toContain('db_fetch_assoc_prepared');
+	expect(end($GLOBALS['__test_cacti_log']))->toBe('NBAR chart: Cannot list the NBAR raw tables');
+});
+
+it('shows the conversations error and returns to the caller when the raw slices cannot be listed', function () {
+	$nbar_preferences               = ['prefixes' => ['2001:db8::/64']];
+	$GLOBALS['fv_nbar_preferences'] = $nbar_preferences;
+	$listener_scope                 = 'd.listener_id=?';
+	$lid                            = 1;
+	$start                          = 1800000000;
+	$end                            = 1800001800;
+	$seconds                        = 1800;
+	$family                         = 'all';
+	$aid                            = '';
+	$host                           = '';
+	$base                           = 'flowview.php?action=view&report=nbar';
+	$combined_lids                  = [1];
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+	ob_start();
+	include(dirname(__DIR__, 2) . '/nbar_conversations.php');
+	$html = ob_get_clean();
+	expect($html)->toContain('Unable to load conversations. Please try again.')->not->toContain('nbarConversationTable');
+	expect(array_column($GLOBALS['__test_db_calls'], 'fn'))->not->toContain('db_fetch_assoc_prepared');
+	expect(end($GLOBALS['__test_cacti_log']))->toBe('NBAR conversations: Cannot list the NBAR raw tables');
+});
+
+it('shows the top five application totals plus Other without exposing application markup', function () {
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [
+		['name' => '<script>alert(1)</script>', 'bytes' => 2000000000],
+		['name' => 'Two', 'bytes' => 4000000], ['name'  => 'Three', 'bytes' => 3000000],
+		['name' => 'Four', 'bytes' => 2000000], ['name' => 'Five', 'bytes' => 1000000],
+		['name' => 'Six', 'bytes' => 500000], ['name'   => 'Zero', 'bytes' => 0],
+	]);
+	ob_start();
+	fv_nbar_chart('d.listener_id=?', [1, 1800000000, 1800001800], 'all');
+	$html = ob_get_clean();
+	expect($html)->toContain('&lt;script&gt;', '2.00 GB', 'Other', '0.50 MB', 'conic-gradient');
+	expect($html)->not->toContain('<script>', '>Six<');
+	expect(substr_count($html, '<li>'))->toBe(6);
+});
+
+it('uses the host and IP version filters in the chart query', function () {
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	ob_start();
+	fv_nbar_chart('d.listener_id=?', [1, 1800000000, 1800001800], '6', '2001:db8::10');
+	expect(ob_get_clean())->toContain('No application data in this period');
+	$call = end($GLOBALS['__test_db_calls']);
+	expect($call['sql'])->toContain('LENGTH(d.src)=16', 'd.src=INET6_ATON(?) OR d.dst=INET6_ATON(?)');
+	expect($call['params'])->toBe([1, 1800000000, 1800001800, '2001:db8::10', '2001:db8::10']);
+});
+
+it('renders date cells with escaped labels and explicit unavailable observations', function () {
+	ob_start();
+	$html = fv_nbar_seen_cells(['first_seen' => 1800000000, 'last_seen' => null]);
+	ob_end_clean();
+	expect($html)->toContain('data-text="1800000000"', 'minute precision', 'Unavailable');
+	expect(substr_count($html, '<td '))->toBe(2);
+});
+
+it('escapes names, prefixes and dynamic settings in the Options markup', function () {
+	$GLOBALS['fv_nbar_preferences']         = ['prefixes' => ['192.0.2.0/24'], 'listeners' => [1, 2], 'data_unit' => 'Auto', 'rate_unit' => 'Mbps', 'dns' => '0'];
+	$GLOBALS['fv_nbar_preferences_message'] = '<failure>';
+	ob_start();
+	fv_nbar_preferences_render([['id' => 1, 'name' => '<router>'], ['id' => 2, 'name' => 'Second']], '', '', '', '');
+	$html = ob_get_clean();
+	expect($html)->toContain('&lt;router&gt;', '&lt;failure&gt;', 'Internal Networks', '192.0.2.0/24', 'window.fvNbarDisplay=', '"selection":"{count} of 3 selected"');
+	expect($html)->not->toContain('<router>', '<failure>');
+	expect(substr_count($html, ' checked'))->toBe(2);
+});
+
+it('labels conversation directions, observation dates and the application drilldown', function () {
+	$GLOBALS['__test_translations']['flowview']['Top 100 conversations by combined data volume. Each row groups an Internal Host, External Host and application across both directions. Uses only the selected LAN captures to avoid counting WAN copies. Local and multicast traffic is excluded. DNS names identify servers, not the exact website requested. History retention: %d days.'] = '<localized> retention %d days.';
+	$GLOBALS['fv_nbar_preferences']                                                                                                                                                                                                                                                                                                                                                           = ['prefixes' => ['192.0.2.0/24'], 'dns' => '0'];
+	$nbar_preferences                                                                                                                                                                                                                                                                                                                                                                         = $GLOBALS['fv_nbar_preferences'];
+	$listener_scope                                                                                                                                                                                                                                                                                                                                                                           = 'd.listener_id=?';
+	$lid                                                                                                                                                                                                                                                                                                                                                                                      = 1;
+	$combined_lids                                                                                                                                                                                                                                                                                                                                                                            = [];
+	$start                                                                                                                                                                                                                                                                                                                                                                                    = 1800000000;
+	$end                                                                                                                                                                                                                                                                                                                                                                                      = 1800001800;
+	$seconds                                                                                                                                                                                                                                                                                                                                                                                  = 1800;
+	$family                                                                                                                                                                                                                                                                                                                                                                                   = '4';
+	$aid                                                                                                                                                                                                                                                                                                                                                                                      = '0d000001';
+	$host                                                                                                                                                                                                                                                                                                                                                                                     = '192.0.2.10';
+	$base                                                                                                                                                                                                                                                                                                                                                                                     = 'flowview.php?report=nbar';
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['app_id' => $aid, 'name' => '<app>', 'internal' => $host, 'external' => '198.51.100.20', 'download' => 2000000, 'upload' => 10000, 'first_seen' => $start, 'last_seen' => $end - 60]]);
+	ob_start();
+	include(dirname(__DIR__, 2) . '/nbar_conversations.php');
+	$html = ob_get_clean();
+	expect($html)->toContain('Internal Host', 'External Host', '&lt;app&gt;', 'parent_app=0d000001', 'mode=connections', 'Back to top applications', 'First seen', 'Last seen');
+	expect($html)->toContain('&lt;localized&gt; retention ' . fv_nbar_retention_days() . ' days.')->not->toContain('<localized>', 'Top 100 conversations by combined data volume.');
+	expect($html)->not->toContain('<app>');
+	$call = end($GLOBALS['__test_db_calls']);
+	expect($call['params'])->toBe([1, $start, $end, $aid, $host, $host]);
+	expect($call['sql'])->toContain('NOT', 'LENGTH(d.src)=4');
+});
+
+it('explains why conversation classification needs internal networks', function () {
+	$nbar_preferences = ['prefixes' => []];
+	ob_start();
+	include(dirname(__DIR__, 2) . '/nbar_conversations.php');
+	expect(ob_get_clean())->toContain('Configure your site networks');
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+});
+
+it('shows an empty conversation table when no matching records exist', function () {
+	$GLOBALS['fv_nbar_preferences'] = ['prefixes' => ['2001:db8::/64'], 'dns' => '0'];
+	$nbar_preferences               = $GLOBALS['fv_nbar_preferences'];
+	$listener_scope                 = 'd.listener_id=?';
+	$lid                            = 1;
+	$combined_lids                  = [];
+	$start                          = 1800000000;
+	$end                            = 1800001800;
+	$seconds                        = 1800;
+	$family                         = 'all';
+	$aid                            = '';
+	$host                           = '';
+	$base                           = 'flowview.php?report=nbar';
+	ob_start();
+	include(dirname(__DIR__, 2) . '/nbar_conversations.php');
+	expect(ob_get_clean())->toContain('No conversations for this period');
+});
+
+it('groups chart rows by the complete fallback label for missing names', function () {
+	ob_start();
+	fv_nbar_chart('d.listener_id=?', [1, 1800000000, 1800001800], 'all');
+	ob_end_clean();
+	$queries = array_column($GLOBALS['__test_db_calls'], 'sql');
+	$sql     = implode(' ', $queries);
+	expect($sql)->toContain("GROUP BY COALESCE(NULLIF(n.name,''),CONCAT('Application ',d.app_id)) ORDER BY bytes DESC");
+	expect($sql)->not->toContain('GROUP BY name ORDER BY');
+});
diff --git a/tests/Unit/NbarReportPageTest.php b/tests/Unit/NbarReportPageTest.php
new file mode 100644
index 0000000..9d8320b
--- /dev/null
+++ b/tests/Unit/NbarReportPageTest.php
@@ -0,0 +1,135 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+it('renders combined IPv6 reports with protected controls and escaped rows', function ($view) {
+	global $config, $graph_timespans, $lid, $combined_lids;
+	plugin_test_reset();
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	// Import only time constants; the unit harness already defines poller constants.
+	$constants = file_get_contents($config['base_path'] . '/include/global_constants.php');
+	preg_match_all("/define\('((?:GT_|GTS_)[A-Z0-9_]+)', ([0-9]+)\);/", $constants, $matches, PREG_SET_ORDER);
+
+	foreach ($matches as $match) {
+		if (!defined($match[1])) {
+			define($match[1], (int) $match[2]);
+		}
+	}
+
+	if (!function_exists('csrf_get_tokens')) {
+		function csrf_get_tokens(): string {
+			return 'unit-csrf-token';
+		}
+	}
+
+	if (!function_exists('html_start_box')) {
+		function html_start_box(mixed ...$args): void {
+			print '<table>';
+		}
+	}
+
+	if (!function_exists('html_end_box')) {
+		function html_end_box(mixed ...$args): void {
+			print '</table>';
+		}
+	}
+
+	if (!function_exists('bottom_footer')) {
+		function bottom_footer(): void {
+			$GLOBALS['__test_footer_rendered'] = true;
+		}
+	}
+	$empty                                                        = $view === 'no-devices';
+	$GLOBALS['__test_config']['flowview_nbar_schema_version']     = '2';
+	$GLOBALS['__test_user_settings']['flowview_nbar_preferences'] = json_encode(['listeners' => $empty ? [] : [1, 2, 3], 'prefixes' => ['2001:db8::/64'], 'dns' => '0']);
+	$graph_timespans                                              = [GT_LAST_HALF_HOUR => 'Last Half Hour', GT_LAST_HOUR => 'Last Hour', GT_LAST_DAY => 'Last Day', GT_LAST_WEEK => 'Last Week'];
+	$now                                                          = (int) floor(time() / 60) * 60;
+	$_REQUEST                                                     = ['mode' => in_array($view, ['no-devices', 'listing-failed', 'apps-late-failed'], true) ? 'apps' : $view, 'page' => '500', 'listener' => '0', 'family' => '6', 'host' => '2001:db8::10', 'app' => '0d000001', 'predefined_timespan' => '0', 'date1' => date('Y-m-d H:i', $now - 1200), 'date2' => date('Y-m-d H:i', $now), 'lock_range' => '1', 'context' => json_encode(['report' => 's10', 'unexpected' => ['nested']])];
+	$_SERVER['REQUEST_METHOD']                                    = 'GET';
+
+	if ($empty) {
+		// No capture device exists: the report must still build valid SQL instead of IN ().
+		ob_start();
+		require_once(dirname(__DIR__, 2) . '/flowview_sections.php');
+		require(dirname(__DIR__, 2) . '/nbar_report.php');
+		ob_end_clean();
+		$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+		expect($lid)->toBe(0);
+		expect($sql)->not->toContain('IN ()');
+		expect(implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql')))->toContain('d.listener_id IN (0)');
+
+		return;
+	}
+
+	for ($i = 0; $i < 3; $i++) {
+		plugin_test_queue_db_result('db_fetch_assoc', []);
+	}
+	plugin_test_queue_db_result('db_fetch_assoc', [['id' => 1, 'name' => '<router>'], ['id' => 2, 'name' => 'Second'], ['id' => 3, 'name' => 'Third']]);
+
+	for ($i = 0; $i < 3; $i++) {
+		// A failed slice listing must stop the page instead of reading as an empty history.
+		$view === 'listing-failed' ? plugin_test_queue_db_result('db_fetch_assoc', false) : plugin_test_queue_slices([fv_nbar_data_table($now - 60)]);
+	}
+
+	for ($i = 0; $i < 6; $i++) {
+		plugin_test_queue_db_result('db_fetch_row_prepared', ['minute' => $now - 60]);
+	}
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['name' => '<app>', 'bytes' => 1000000]]);
+
+	if ($view === 'listing-failed') {
+		$GLOBALS['__test_footer_rendered'] = false;
+		ob_start();
+		require_once(dirname(__DIR__, 2) . '/flowview_sections.php');
+		require(dirname(__DIR__, 2) . '/nbar_report.php');
+		$html = ob_get_clean();
+		expect($html)->toContain('Unable to read the NBAR records. Please try again.', 'Setup guide');
+		expect($html)->not->toContain('&lt;app&gt;', 'nbarPageNumber');
+		expect($GLOBALS['__test_footer_rendered'])->toBeTrue();
+		$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+		expect($sql)->not->toContain('UNION ALL', 'GROUP BY d.app_id');
+
+		return;
+	}
+
+	if ($view === 'apps-late-failed') {
+		// The record checks and the feed status succeed, then the chart and the applications table each fail to list the slices.
+		for ($i = 0; $i < 3; $i++) {
+			plugin_test_queue_slices([fv_nbar_data_table($now - 60)]);
+		}
+		plugin_test_queue_db_result('db_fetch_assoc', false);
+		plugin_test_queue_db_result('db_fetch_assoc', false);
+		$GLOBALS['__test_footer_rendered'] = false;
+		ob_start();
+		require_once(dirname(__DIR__, 2) . '/flowview_sections.php');
+		require(dirname(__DIR__, 2) . '/nbar_report.php');
+		$html = ob_get_clean();
+		expect($html)->toContain('Unable to load application chart. Please try again.', 'Unable to load applications. Please try again.');
+		expect($html)->not->toContain('&lt;app&gt;', 'Unable to read the NBAR records', 'Unable to load NBAR status');
+		expect($GLOBALS['__test_footer_rendered'])->toBeTrue();
+		expect(implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql')))->not->toContain('GROUP BY d.app_id');
+
+		return;
+	}
+
+	if ($view === 'connections') {
+		for ($i = 0; $i < 7; $i++) {
+			plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+		}
+	}
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['src' => '2001:db8::10', 'dst' => '2001:db8::20', 'sport' => 12345, 'dport' => 443, 'protocol' => 6, 'app_id' => '0d000001', 'name' => '<app>', 'bytes' => 1000000, 'packets' => 20, 'records' => 2, 'first_seen' => $now - 600, 'last_seen' => $now - 60]]);
+	ob_start();
+	require_once(dirname(__DIR__, 2) . '/flowview_sections.php');
+	require(dirname(__DIR__, 2) . '/nbar_report.php');
+	$html = ob_get_clean();
+	expect($html)->toContain('unit-csrf-token', 'method="post"', '&lt;router&gt;', '&lt;app&gt;', '2001:db8::10', 'First seen', 'Last seen', 'Setup guide', 'flowviewNbarInitTable');
+	expect($html)->not->toContain('<app>', '<router>', 'unexpected', '<scriptnonce');
+	expect($lid)->toBe(0);
+	expect($combined_lids)->toBe([1, 2, 3]);
+	expect($GLOBALS['__test_footer_rendered'])->toBeTrue();
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->toContain('LENGTH(d.src)=16', 'd.app_id=?', 'INET6_ATON(?)');
+
+	if ($view === 'connections') {
+		expect($html)->toContain('Source IP', 'Destination IP', 'TCP', 'Counting total pages', 'Previous', 'nbarPageNumber', 'Back to top applications');
+		expect($html)->not->toContain('All conversations');
+	}
+})->with(['apps', 'connections', 'no-devices', 'listing-failed', 'apps-late-failed']);
diff --git a/tests/Unit/NbarReportRequestTest.php b/tests/Unit/NbarReportRequestTest.php
new file mode 100644
index 0000000..2f174c4
--- /dev/null
+++ b/tests/Unit/NbarReportRequestTest.php
@@ -0,0 +1,49 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+require_once(dirname(__DIR__) . '/helpers/request.php');
+
+it('renders report boundaries without leaking unsafe parameters', function ($scenario, $expected) {
+	$directory = sys_get_temp_dir() . '/flowview-report-' . bin2hex(random_bytes(8));
+	mkdir($directory, 0700);
+
+	try {
+		[$stdout, $result] = flowview_test_request(dirname(__DIR__) . '/fixtures/nbar-report-request.php', $scenario, $directory);
+
+		if (str_starts_with($scenario, 'nav-redirect')) {
+			expect($stdout)->toBe('');
+			expect($result['footer'])->toBeFalse();
+			parse_str(parse_url($result['redirect'], PHP_URL_QUERY), $redirect);
+			expect($redirect['section'])->toBe($scenario === 'nav-redirect-fragment-flows' ? 'flows' : 'nbar');
+
+			if (str_contains($scenario, 'fragment')) {
+				expect($redirect['header'])->toBe('false');
+			} else {
+				expect($redirect)->not->toHaveKey('header');
+			}
+
+			if (in_array($scenario, ['nav-redirect-header', 'nav-redirect-fragment-header'], true)) {
+				expect($redirect['headercontent'])->toBe('true');
+			}
+		} elseif ($scenario === 'csrf') {
+			expect($stdout)->toBe('');
+			expect($result['status'])->toBe(403);
+		} else {
+			expect($stdout)->toContain($expected);
+			expect($stdout)->not->toContain('injected', 'not-an-ip', 'nested', '<scriptnonce');
+			expect($result['footer'])->toBeTrue();
+		}
+	} finally {
+		foreach (glob($directory . '/*') as $file) {
+			unlink($file);
+		}
+		rmdir($directory);
+	}
+})->with([
+	['nav-redirect', ''], ['nav-redirect-header', ''], ['nav-redirect-fragment', ''], ['nav-redirect-fragment-header', ''], ['nav-redirect-fragment-flows', ''], ['nav-select', 'Cisco Apps'], ['combine', 'Combined routers'],
+	['default', 'Last Half Hour'], ['invalid', 'Fixture router'], ['retention', 'outside the 7-day'],
+	['fallback-span', 'Last Hour'], ['all-history', 'Last 7 Days'], ['clamped', 'Dates adjusted'],
+	['legacy', 'Last Hour'], ['drilldown', 'Back to conversations'], ['conversations', 'Internal Host'],
+	['invalid-mode', 'Internal Host'], ['no-combined', 'Fixture router'], ['unknown-context', 'Cisco Apps'], ['more-pages', 'Next'],
+	['apps-failure', 'Unable to load applications'], ['conversation-failure', 'Unable to load conversations'], ['failure', 'Unable to load connections'], ['upgrade', 'history is being upgraded'], ['csrf', '']
+]);
diff --git a/tests/Unit/NbarReviewRegressionTest.php b/tests/Unit/NbarReviewRegressionTest.php
new file mode 100644
index 0000000..cb07414
--- /dev/null
+++ b/tests/Unit/NbarReviewRegressionTest.php
@@ -0,0 +1,66 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+beforeEach(function () {
+	plugin_test_reset();
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_count.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_connections.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_query.php');
+	$GLOBALS['flowview_cnn'] = 'review-database';
+});
+it('selects an exact count deadline for the actual flow database', function ($version, $fragment) {
+	plugin_test_queue_db_result('db_fetch_cell', $version);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['total' => 17]);
+	expect(fv_nbar_count_query('SELECT COUNT(*) total FROM fixture', [3]))->toBe(['total' => 17]);
+	$call = end($GLOBALS['__test_db_calls']);
+	expect($call['sql'])->toContain($fragment)->and($call['params'])->toBe([3])->and($call['conn'])->toBe('review-database');
+})->with([['11.8.9-MariaDB', 'SET STATEMENT max_statement_time=90 FOR SELECT'], ['8.0.44', 'SELECT /*+ MAX_EXECUTION_TIME(90000) */']]);
+it('does not execute an unbounded count when the backend is unknown', function () {
+	expect(fv_nbar_count_query('SELECT 1', []))->toBeFalse();
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1);
+});
+it('defers DML when a deadline is unsupported or cannot be set', function ($value) {
+	plugin_test_queue_db_result('db_fetch_cell', $value);
+	plugin_test_queue_db_result('db_execute', false);
+	expect(fv_nbar_worker_timeout(20))->toBeNull();
+})->with([false, '-1', '4.5']);
+it('does not mutate daily data without a verified statement deadline', function () {
+	plugin_test_queue_db_result('db_fetch_cell', false);
+	plugin_test_queue_db_result('db_fetch_row_prepared', []);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['n' => 1, 'ready' => 1, 'rev' => '1']);
+	expect(fv_nbar_daily_build(1, 1800000000, 1800003600))->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->toContain('ROLLBACK')->not->toContain('INSERT INTO', 'DELETE FROM');
+});
+it('does not merge matching connection tuples from distinct exporters', function () {
+	$row           = ['app_id' => 'a1', 'src_hex' => 'C0000201', 'dst_hex' => 'C6336401', 'sport' => 10, 'dport' => 443, 'protocol' => 6, 'router' => '192.0.2.1'];
+	$names         = [1 => ['192.0.2.1:a1' => ['name_id' => 1], '192.0.2.2:a1' => ['name_id' => 2]]];
+	$key           = fv_nbar_connection_key($row, $names, 1);
+	$row['router'] = '192.0.2.2';
+	expect($key)->not->toBe(fv_nbar_connection_key($row, $names, 1));
+});
+it('renders a chart failure without aborting the report', function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_chart.php');
+	$GLOBALS['lid'] = 1;
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', false);
+	ob_start();
+	fv_nbar_chart('d.listener_id=?', [1, 100, 200], 'all');
+	expect(ob_get_clean())->toContain('Unable to load application chart');
+});
+it('does not change session isolation when its original value is unavailable', function () {
+	foreach ([1, false, false, 1] as $value) {
+		plugin_test_queue_db_result('db_fetch_cell', $value);
+	}
+	expect(fv_nbar_seen_backfill())->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->toContain('transaction_isolation', 'tx_isolation', 'RELEASE_LOCK')->not->toContain('SET SESSION');
+});
+it('defers date backfill when DML limits are unsupported', function () {
+	foreach ([1, 'REPEATABLE-READ', 1, false] as $value) {
+		plugin_test_queue_db_result('db_fetch_cell', $value);
+	}
+	expect(fv_nbar_seen_backfill())->toBe(0);
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->not->toContain('READ COMMITTED', 'UPDATE plugin_flowview');
+});
diff --git a/tests/Unit/NbarSchemaTest.php b/tests/Unit/NbarSchemaTest.php
new file mode 100644
index 0000000..b6b64cd
--- /dev/null
+++ b/tests/Unit/NbarSchemaTest.php
@@ -0,0 +1,126 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+/**
+ * Run flowview_db_create_nbar_tables() against the stubbed database, reporting every table as present.
+ *
+ * @return array<string, string> The CREATE statement issued for each table.
+ */
+function flowview_test_create_nbar_tables(): array {
+	foreach (flowview_test_nbar_tables() as $table) {
+		plugin_test_queue_db_result('db_fetch_cell', $table);
+	}
+
+	expect(flowview_db_create_nbar_tables())->toBeTrue();
+
+	$created = [];
+
+	foreach ($GLOBALS['__test_db_calls'] as $call) {
+		if ($call['fn'] === 'db_execute' && str_starts_with($call['sql'], 'CREATE TABLE')) {
+			preg_match('/`(plugin_flowview_nbar_[a-z_]+)`/', $call['sql'], $match);
+			$created[$match[1]] = $call['sql'];
+		}
+	}
+
+	return $created;
+}
+
+/**
+ * The NBAR tables, in creation order.
+ *
+ * @return list<string>
+ */
+function flowview_test_nbar_tables(): array {
+	return array_map(
+		fn ($suffix) => 'plugin_flowview_nbar_' . $suffix,
+		['names', 'hours', 'apps', 'pairs', 'connections', 'daily_apps', 'daily_pairs', 'daily_connections', 'days', 'seen_upgrade']
+	);
+}
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn'] = 'nbar-schema-test';
+});
+
+it('creates every NBAR table with one standard CREATE TABLE IF NOT EXISTS on the flow connection', function () {
+	$created = flowview_test_create_nbar_tables();
+
+	expect(array_keys($created))->toBe(flowview_test_nbar_tables());
+
+	foreach ($GLOBALS['__test_db_calls'] as $call) {
+		if ($call['fn'] === 'db_execute') {
+			expect($call['conn'])->toBe('nbar-schema-test');
+		}
+	}
+
+	foreach ($created as $table => $sql) {
+		expect($sql)->toStartWith('CREATE TABLE IF NOT EXISTS `' . $table . '`')
+			->toContain('PRIMARY KEY (', 'ENGINE=InnoDB', "COMMENT='Plugin Flowview - NBAR");
+	}
+});
+
+it('creates the final schema directly with no follow-up ALTER, ownership or column upgrade calls', function () {
+	flowview_test_create_nbar_tables();
+
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->not->toContain('ALTER TABLE', 'plugin_db_changes', 'INSERT IGNORE');
+	expect(array_column($GLOBALS['__test_db_calls'], 'fn'))->not->toContain('db_add_column');
+});
+
+it('keeps the exporter identity as the last primary key column of every raw and summary table', function ($suffix) {
+	$sql = flowview_test_create_nbar_tables()['plugin_flowview_nbar_' . $suffix];
+
+	expect($sql)->toMatch('/PRIMARY KEY \([^)]*,`router`\)/')
+		->toContain("`router` varchar(45) NOT NULL DEFAULT ''");
+})->with(['apps', 'pairs', 'connections', 'daily_apps', 'daily_pairs', 'daily_connections']);
+
+it('does not create the raw table with the fixed tables because raw records live in time slices', function () {
+	expect(array_keys(flowview_test_create_nbar_tables()))->not->toContain('plugin_flowview_nbar_data');
+});
+
+it('creates a raw slice with the standard layout and the exporter as the last key column', function ($table) {
+	plugin_test_queue_db_result('db_fetch_cell', $table);
+	expect(flowview_db_create_nbar_data_partition($table))->toBeTrue();
+	$call = $GLOBALS['__test_db_calls'][0];
+	expect($call['conn'])->toBe('nbar-schema-test');
+	expect($call['sql'])->toStartWith('CREATE TABLE IF NOT EXISTS `' . $table . '`')
+		->toContain('ENGINE=InnoDB', "COMMENT='Plugin Flowview - NBAR raw", 'KEY `minute` (`minute`)', '`bytes` bigint(20) unsigned NOT NULL')
+		->toMatch('/PRIMARY KEY \(`listener_id`,`minute`,[^)]*,`router`\)/');
+	$verify = end($GLOBALS['__test_db_calls']);
+	expect($verify['sql'])->toBe("SHOW TABLES LIKE '$table'");
+})->with(['plugin_flowview_nbar_data_202601412', 'plugin_flowview_nbar_data_2026014']);
+
+it('refuses to create a raw slice for a name that is not a slice', function ($table) {
+	expect(flowview_db_create_nbar_data_partition($table))->toBeFalse();
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+})->with(['plugin_flowview_nbar_data', 'plugin_flowview_nbar_data_x', 'plugin_flowview_nbar_data_2026014123', 'plugin_flowview_nbar_data_2026014; DROP TABLE x', "plugin_flowview_nbar_data_2026014\n", 'other_2026014']);
+
+it('reports a raw slice that cannot be verified after creation', function () {
+	plugin_test_queue_db_result('db_fetch_cell', '');
+	expect(flowview_db_create_nbar_data_partition('plugin_flowview_nbar_data_202601412'))->toBeFalse();
+});
+
+it('includes the observation dates and indexes that earlier builds added with ALTER TABLE', function () {
+	$created = flowview_test_create_nbar_tables();
+
+	foreach (['apps', 'pairs', 'connections', 'daily_apps', 'daily_pairs', 'daily_connections'] as $suffix) {
+		expect($created['plugin_flowview_nbar_' . $suffix])->toContain('`first_seen` int(10) unsigned DEFAULT NULL', '`last_seen` int(10) unsigned DEFAULT NULL');
+	}
+	expect($created['plugin_flowview_nbar_hours'])->toContain('`connection_built` bigint(20) DEFAULT -1');
+	expect($created['plugin_flowview_nbar_daily_connections'])->toContain('KEY `capture_day_bytes` (`listener_id`,`hour`,`bytes`)');
+	expect($created['plugin_flowview_nbar_seen_upgrade'])->toContain('`phase` tinyint(3) unsigned NOT NULL DEFAULT 0', '`app_cursor` varchar(32) DEFAULT NULL');
+});
+
+it('stops and reports failure as soon as a table cannot be verified', function () {
+	plugin_test_queue_db_result('db_fetch_cell', 'plugin_flowview_nbar_names');
+	plugin_test_queue_db_result('db_fetch_cell', '');
+
+	expect(flowview_db_create_nbar_tables())->toBeFalse();
+
+	$creates = array_filter($GLOBALS['__test_db_calls'], fn ($call) => $call['fn'] === 'db_execute' && str_starts_with($call['sql'], 'CREATE TABLE'));
+	expect($creates)->toHaveCount(2);
+});
diff --git a/tests/Unit/NbarSessionCacheTest.php b/tests/Unit/NbarSessionCacheTest.php
new file mode 100644
index 0000000..5d9abf2
--- /dev/null
+++ b/tests/Unit/NbarSessionCacheTest.php
@@ -0,0 +1,109 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+beforeAll(function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_query.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_connections.php');
+});
+
+beforeEach(function () {
+	plugin_test_reset();
+	$GLOBALS['flowview_cnn'] = 'session-cache-test';
+	$this->oldSessionPath    = session_save_path();
+	$this->oldSessionCookies = ini_get('session.use_cookies');
+	$this->oldSessionLimiter = session_cache_limiter();
+	session_save_path(sys_get_temp_dir());
+	ini_set('session.use_cookies', '0');
+	session_cache_limiter('');
+	session_start();
+	session_regenerate_id(true);
+});
+
+afterEach(function () {
+	session_destroy();
+	session_save_path($this->oldSessionPath);
+	ini_set('session.use_cookies', $this->oldSessionCookies);
+	session_cache_limiter($this->oldSessionLimiter);
+});
+
+it('reuses adjacent page blocks while slicing only the requested rows', function () {
+	$rows = array_map(fn ($i) => ['id' => $i], range(0, 500));
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', $rows);
+	expect(fv_nbar_query_cached('SELECT fixture LIMIT 101 OFFSET 200', [1]))->toBe(array_slice($rows, 200, 101));
+	expect(fv_nbar_query_cached('SELECT fixture LIMIT 101 OFFSET 300', [1]))->toBe(array_slice($rows, 300, 101));
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1);
+	expect($GLOBALS['__test_db_calls'][0]['sql'])->toBe('SELECT fixture LIMIT 501 OFFSET 0');
+});
+
+it('does not share cached results between accounts or different filters', function () {
+	$_SESSION['sess_user_id'] = 1;
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['bytes' => 10]]);
+	expect(fv_nbar_query_cached('SELECT fixture', [1]))->toBe([['bytes' => 10]]);
+	$_SESSION['sess_user_id'] = 2;
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['bytes' => 20]]);
+	expect(fv_nbar_query_cached('SELECT fixture', [1]))->toBe([['bytes' => 20]]);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['bytes' => 30]]);
+	expect(fv_nbar_query_cached('SELECT fixture', [2]))->toBe([['bytes' => 30]]);
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(3);
+});
+
+it('expires stale cache entries and evicts the oldest compact result', function () {
+	$_SESSION['fv_nbar_query_cache'] = ['expired' => ['until' => time() - 1, 'rows' => []]];
+
+	foreach (range(1, 12) as $i) {
+		$_SESSION['fv_nbar_query_cache']['item' . $i] = ['until' => time() + 100, 'rows' => []];
+	}
+	fv_nbar_query_cached('SELECT fresh', []);
+	expect($_SESSION['fv_nbar_query_cache'])->toHaveCount(12);
+	expect($_SESSION['fv_nbar_query_cache'])->not->toHaveKey('expired')->not->toHaveKey('item1');
+});
+
+it('does not retain failed or oversized query results', function () {
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', false);
+	expect(fv_nbar_query_cached('SELECT failure LIMIT 101 OFFSET 0', []))->toBeFalse();
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', [['large' => str_repeat('x', 600000)]]);
+	$result = fv_nbar_query_cached('SELECT large', []);
+	expect(strlen($result[0]['large']))->toBe(600000);
+	expect($_SESSION['fv_nbar_query_cache'])->toBe([]);
+});
+
+it('reuses connection pages only for the same account and page', function () {
+	$_SESSION['sess_user_id'] = 1;
+	expect(fv_nbar_connections_cached([1], 100, 100, '1=1', [], 1))->toBe([]);
+	$calls = count($GLOBALS['__test_db_calls']);
+	expect(fv_nbar_connections_cached([1], 100, 100, '1=1', [], 1))->toBe([]);
+	expect($GLOBALS['__test_db_calls'])->toHaveCount($calls);
+	fv_nbar_connections_cached([1], 100, 100, '1=1', [], 2);
+	expect(count($GLOBALS['__test_db_calls']))->toBeGreaterThan($calls);
+	$calls                    = count($GLOBALS['__test_db_calls']);
+	$_SESSION['sess_user_id'] = 2;
+	fv_nbar_connections_cached([1], 100, 100, '1=1', [], 1);
+	expect(count($GLOBALS['__test_db_calls']))->toBeGreaterThan($calls);
+	expect($_SESSION['fv_nbar_connection_pages'])->toHaveCount(3);
+});
+
+it('expires old connection pages and retains at most three requested pages', function () {
+	$_SESSION['fv_nbar_connection_pages'] = ['expired' => ['until' => time() - 1, 'rows' => []]];
+
+	foreach (range(1, 3) as $i) {
+		$_SESSION['fv_nbar_connection_pages']['page' . $i] = ['until' => time() + 100, 'rows' => []];
+	}
+	fv_nbar_connections_cached([1], 100, 100, '1=1', [], 1);
+	expect($_SESSION['fv_nbar_connection_pages'])->toHaveCount(3);
+	expect($_SESSION['fv_nbar_connection_pages'])->not->toHaveKey('expired')->not->toHaveKey('page1');
+	$entry = end($_SESSION['fv_nbar_connection_pages']);
+	expect($entry['until'])->toBeGreaterThanOrEqual(time() + 119);
+});
+
+it('keeps recent connection page caching short and never caches a failed snapshot', function () {
+	$now = time();
+	fv_nbar_connections_cached([1], $now, $now, '1=1', [], 1);
+	$entry = end($_SESSION['fv_nbar_connection_pages']);
+	expect($entry['until'])->toBeLessThanOrEqual(time() + 30);
+	$_SESSION['fv_nbar_connection_pages'] = [];
+	plugin_test_queue_db_result('db_execute', false);
+	expect(fn () => fv_nbar_connections_cached([1], $now, $now, '1=1', [], 2))->toThrow(RuntimeException::class);
+	expect($_SESSION['fv_nbar_connection_pages'])->toBe([]);
+});
diff --git a/tests/Unit/NbarTemplateCacheTest.php b/tests/Unit/NbarTemplateCacheTest.php
new file mode 100644
index 0000000..69c6daf
--- /dev/null
+++ b/tests/Unit/NbarTemplateCacheTest.php
@@ -0,0 +1,60 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+beforeEach(function () {
+	plugin_test_reset();
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_collector.php');
+});
+it('bounds source-ID churn and keeps the most recently used templates', function () {
+	$cache    = new FlowviewNbarTemplateCache();
+	$template = [[[95, 4]], 4, false];
+
+	for ($i = 0; $i < 64; $i++) {
+		expect($cache->store('192.0.2.1', (string) $i, 256, $template, 100))->toBeTrue();
+	}
+	expect($cache->get('192.0.2.1', '0', 256, 101))->toBe($template);
+	$cache->store('192.0.2.1', '64', 256, $template, 101);
+	expect($cache->get('192.0.2.1', '1', 256, 101))->toBeNull()->and($cache->get('192.0.2.1', '0', 256, 101))->toBe($template);
+
+	for ($i = 65; $i < 500; $i++) {
+		$cache->store('192.0.2.1', (string) $i, 256, $template, 101);
+	}
+	expect($cache->usage('192.0.2.1')['exporter_templates'])->toBe(64);
+});
+it('bounds global template count independently of per-exporter churn', function () {
+	$cache    = new FlowviewNbarTemplateCache();
+	$template = [[[95, 4]], 4, false];
+
+	for ($i = 0; $i < 300; $i++) {
+		$cache->store('192.0.2.' . ($i % 5), (string) $i, 256, $template, 100);
+	}
+	expect($cache->usage('192.0.2.0')['templates'])->toBe(256);
+	expect($cache->get('192.0.2.0', '0', 256, 101))->toBeNull();
+});
+it('bounds retained field definitions globally and per exporter and rejects oversized templates', function () {
+	$cache = new FlowviewNbarTemplateCache();
+	$large = [array_fill(0, 2048, [1, 1]), 2048, false];
+	$cache->store('192.0.2.1', 'a', 256, $large, 100);
+	$cache->store('192.0.2.1', 'b', 256, $large, 100);
+	expect($cache->get('192.0.2.1', 'a', 256, 101))->toBeNull();
+
+	for ($i = 2; $i < 7; $i++) {
+		$cache->store('192.0.2.' . $i, 'a', 256, $large, 100);
+	}
+	expect($cache->usage('192.0.2.6')['fields'])->toBe(8192)->and($cache->usage('192.0.2.6')['exporter_fields'])->toBe(2048);
+	expect($cache->store('192.0.2.6', 'a', 256, [array_fill(0, 2049, [1, 1]), 2049, false], 101))->toBeFalse();
+	expect($cache->get('192.0.2.6', 'a', 256, 102))->toBeNull();
+});
+it('expires inactive templates and refreshes activity on successful use', function () {
+	$cache    = new FlowviewNbarTemplateCache();
+	$template = [[[95, 4]], 4, false];
+	$cache->store('192.0.2.1', 'a', 256, $template, 100);
+	$cache->store('192.0.2.1', 'b', 256, $template, 100);
+	$cache->get('192.0.2.1', 'a', 256, 1800);
+	$cache->prune(1900);
+	expect($cache->usage('192.0.2.1')['templates'])->toBe(1);
+	expect($cache->get('192.0.2.1','a',256,3600))->toBeNull();
+});
+it('rejects numeric values wider than unsigned 64-bit before conversion',function () {
+	expect(fn () => fv_nbar_uint(str_repeat('x',4096)))->toThrow(InvalidArgumentException::class);
+});
diff --git a/tests/Unit/NbarWorkerDeadlineTest.php b/tests/Unit/NbarWorkerDeadlineTest.php
new file mode 100644
index 0000000..efc48de
--- /dev/null
+++ b/tests/Unit/NbarWorkerDeadlineTest.php
@@ -0,0 +1,99 @@
+<?php
+beforeEach(function () {
+	plugin_test_reset();
+	flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+});
+it('launches maintenance without running aggregation in the poller process', function () {
+	$GLOBALS['__test_config']['path_php_binary'] = '/usr/bin/php';
+	expect(fv_nbar_launch_maintenance())->toBeTrue();
+	$calls = $GLOBALS['__test_db_calls'];
+	expect($calls)->toHaveCount(1)->and($calls[0]['fn'])->toBe('exec_background')->and($calls[0]['params'][0])->toContain('--nbar-worker=supervise');
+});
+it('does not launch maintenance with a missing PHP binary', function () {
+	expect(fv_nbar_launch_maintenance())->toBeFalse();
+	expect($GLOBALS['__test_db_calls'])->toBe([]);
+});
+it('supervises a direct PHP child and releases registration after success or failure', function ($status, $invalidPhp) {
+	global $config;
+	$oldBase = $config['base_path'];
+	$root    = sys_get_temp_dir() . "/flowview supervisor '" . bin2hex(random_bytes(8));
+	mkdir($root . '/plugins/flowview/cli', 0700, true);
+	$script = $root . '/plugins/flowview/cli/flowview_upgrade.php';
+	$marker = $root . '/args.json';
+	file_put_contents($script, '<?php file_put_contents(' . var_export($marker, true) . ', json_encode($argv)); exit(' . $status . ');');
+
+	try {
+		$config['base_path']                         = $root;
+		$GLOBALS['__test_config']['path_php_binary'] = $invalidPhp ? $root . '/missing-php' : PHP_BINARY;
+		$GLOBALS['__test_cacti_log']                 = [];
+		fv_nbar_supervise_maintenance();
+		expect(array_column($GLOBALS['__test_db_calls'], 'fn'))->toBe(['register_process_start', 'unregister_process']);
+
+		if ($invalidPhp) {
+			expect(file_exists($marker))->toBeFalse();
+		} else {
+			expect(json_decode(file_get_contents($marker), true))->toBe([$script, '--nbar-worker=build']);
+		}
+
+		if ($invalidPhp || $status !== 0) {
+			expect(implode(' ', $GLOBALS['__test_cacti_log']))->toContain('failed or exceeded');
+		}
+	} finally {
+		$config['base_path'] = $oldBase;
+
+		if (file_exists($marker)) {
+			unlink($marker);
+		}
+		unlink($script);
+		rmdir($root . '/plugins/flowview/cli');
+		rmdir($root . '/plugins/flowview');
+		rmdir($root . '/plugins');
+		rmdir($root);
+	}
+})->with([[0, false], [7, false], [0, true]]);
+it('does not start another child while maintenance is registered', function () {
+	plugin_test_queue_db_result('register_process_start', false);
+	fv_nbar_supervise_maintenance();
+	expect($GLOBALS['__test_db_calls'])->toHaveCount(1);
+});
+it('defers unsupported hourly mutations outside a supervised child', function () {
+	plugin_test_queue_db_result('db_fetch_cell', false);
+	expect(fv_nbar_summary_build(1, 1800000000))->toBeFalse();
+	expect(implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql')))->not->toContain('START TRANSACTION', 'INSERT INTO');
+});
+it('preserves MySQL hourly aggregation inside a supervised child', function () {
+	plugin_test_queue_db_result('db_fetch_cell', false);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => 1]);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['revision' => 1]);
+	expect(fv_nbar_summary_build(1, 1800000000, true))->toBeTrue();
+	$sql = implode(' ', array_column($GLOBALS['__test_db_calls'], 'sql'));
+	expect($sql)->toContain('INSERT INTO plugin_flowview_nbar_apps', 'COMMIT')->not->toContain('SET SESSION max_statement_time');
+});
+it('restores an established hourly deadline after a failed transaction setup', function () {
+	plugin_test_queue_db_result('db_fetch_cell', '7.5');
+	plugin_test_queue_db_result('db_execute', true);
+	plugin_test_queue_db_result('db_execute', false);
+	expect(fv_nbar_summary_build(1, 1800000000))->toBeFalse();
+	$sql = array_column($GLOBALS['__test_db_calls'], 'sql');
+	expect(end($sql))->toBe('SET SESSION max_statement_time=7.5');
+});
+it('uses identical tie ordering before and after SQL pagination', function () {
+	flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_query.php');
+	$sql = fv_nbar_connections_sql('fixture', '1=1', 2);
+	expect($sql)->toContain('ORDER BY bytes DESC,d.app_id,COALESCE(n.name_id,0),d.src,d.dst,d.sport,d.dport,d.protocol,d.router LIMIT 101 OFFSET 100');
+	expect($sql)->toContain('ORDER BY d.bytes DESC,d.app_id,d.name_id,d.src,d.dst,d.sport,d.dport,d.protocol,d.router');
+});
+
+it('returns a startup error for an invalid direct command', function () {
+	expect(fv_nbar_run_child([], 1))->toBe(125);
+	expect(fv_nbar_run_child([PHP_BINARY, "\0"], 1))->toBe(125);
+});
+it('drains both output pipes without letting them block child completion', function () {
+	expect(fv_nbar_run_child([PHP_BINARY, '-r', 'fwrite(STDOUT,str_repeat("x",81920));fwrite(STDERR,str_repeat("y",81920));exit(0);'], 5))->toBe(0);
+});
+it('terminates the actual child at the deadline', function () {
+	$started = microtime(true);
+	expect(fv_nbar_run_child([PHP_BINARY, '-r', 'usleep(5000000);'], 1))->toBe(124);
+	expect(microtime(true) - $started)->toBeLessThan(4);
+});
diff --git a/tests/Unit/PreexistingCodeGuardsTest.php b/tests/Unit/PreexistingCodeGuardsTest.php
new file mode 100644
index 0000000..6a98744
--- /dev/null
+++ b/tests/Unit/PreexistingCodeGuardsTest.php
@@ -0,0 +1,90 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+// Regression coverage for the PHPStan level 8 and cacti_sizeof() fixes in pre-existing code.
+
+beforeEach(function () {
+	plugin_test_reset();
+	date_default_timezone_set('UTC');
+	$GLOBALS['__test_db_calls'] = [];
+});
+
+it('maps table column definitions and tolerates a failed column lookup', function () {
+	plugin_test_queue_db_result('db_fetch_assoc', [
+		['Field' => 'id', 'Type' => 'int(11)', 'Null' => 'NO', 'Default' => null, 'Extra' => 'auto_increment'],
+		['Field' => 'name', 'Type' => 'varchar(64)', 'Null' => 'YES', 'Default' => '', 'Extra' => ''],
+	]);
+
+	expect(flowview_db_get_table_column_types('plugin_flowview_devices'))->toBe([
+		'id'   => ['type' => 'int(11)', 'null' => 'NO', 'default' => null, 'extra' => 'auto_increment'],
+		'name' => ['type' => 'varchar(64)', 'null' => 'YES', 'default' => '', 'extra' => ''],
+	]);
+
+	plugin_test_queue_db_result('db_fetch_assoc', false);
+
+	expect(flowview_db_get_table_column_types('plugin_flowview_devices'))->toBe([]);
+});
+
+it('raises the parallel query timeout at error level with an empty message body', function () {
+	if (!function_exists('raise_message_javascript')) {
+		function raise_message_javascript(string $title, string $header, string $message, int $level = 0): void {
+			throw new RuntimeException(json_encode([$title, $header, $message, $level]));
+		}
+	}
+	$GLOBALS['__test_config']['flowview_parallel_runlimit'] = 0;
+
+	try {
+		parallel_database_query_run([]);
+		$raised = null;
+	} catch (RuntimeException $e) {
+		$raised = json_decode($e->getMessage(), true);
+	}
+
+	expect($raised)->toBe([
+		'parallel_query_timeout',
+		__('The Parallel Query Timed Out.  Please contact your administrator', 'flowview'),
+		'',
+		MESSAGE_LEVEL_ERROR,
+	]);
+});
+
+it('passes the report format loader a boolean report tag', function () {
+	global $config;
+
+	$constants = file_get_contents($config['base_path'] . '/include/global_constants.php');
+	preg_match_all("/define\\('((?:GT_|GTS_)[A-Z0-9_]+)', ([0-9]+)\\);/", $constants, $matches, PREG_SET_ORDER);
+
+	foreach ($matches as $match) {
+		if (!defined($match[1])) {
+			define($match[1], (int) $match[2]);
+		}
+	}
+
+	if (!defined('DEFAULT_TIMESPAN')) {
+		define('DEFAULT_TIMESPAN', 1800);
+	}
+	require_once($config['base_path'] . '/lib/time.php');
+
+	if (!function_exists('reports_load_format_file')) {
+		function reports_load_format_file($format_file, &$output, &$report_tag_included, &$theme): bool {
+			$GLOBALS['__test_report_tag_argument'] = $report_tag_included;
+
+			throw new RuntimeException('format loader reached');
+		}
+	}
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['id' => 1, 'title' => 'Nightly', 'query_id' => 0, 'format_file' => '']);
+	plugin_test_queue_db_result('db_fetch_row_prepared', ['id' => 1, 'name' => 'Top talkers', 'timespan' => GT_LAST_HOUR]);
+
+	expect(fn () => plugin_flowview_run_schedule(1, 1))->toThrow(RuntimeException::class, 'format loader reached');
+	expect($GLOBALS['__test_report_tag_argument'])->toBeFalse();
+});
+
+it('returns no data for a saved query that does not exist and no report was requested', function () {
+	if (!function_exists('cacti_session_close')) {
+		function cacti_session_close(): void {
+		}
+	}
+	$_REQUEST = ['cutofflines' => '999999'];
+
+	expect(run_flow_query(false, 1, 1000, 2000))->toBeFalse();
+});
diff --git a/tests/bin/patch-coverage.php b/tests/bin/patch-coverage.php
index ecbcd77..8401301 100644
--- a/tests/bin/patch-coverage.php
+++ b/tests/bin/patch-coverage.php
@@ -179,11 +179,15 @@ function changed_lines($base_ref) {
 	'flowview_process.php',
 	'flowview_runner.php',
 	'flowview_schedules.php',
-	'flowview_upgrade.php',
+	'cli/flowview_upgrade.php',
 	'flowview_upgrade_nat_columns.php',
 	'import_flows.php',
 	'repair_tables.php',
 	'run_schedule.php',
+	// Compatibility shim for pre-1.3 Cacti cores (reports_log_and_notify() and
+	// friends). It only loads on those cores and needs the legacy reports,
+	// mailer and process tables, so it cannot run in the isolated unit process.
+	'includes/functions-pre13.php',
 ];
 $unmeasured            = array_values(array_diff(array_keys($changed), array_keys($measured)));
 $unexpected_unmeasured = array_values(array_diff($unmeasured, $unmeasured_allowlist));
diff --git a/tests/bootstrap-unit.php b/tests/bootstrap-unit.php
index c83ff97..e0231ee 100644
--- a/tests/bootstrap-unit.php
+++ b/tests/bootstrap-unit.php
@@ -95,6 +95,10 @@ function plugin_test_reset() {
 		$GLOBALS['__test_db_results'] = array();
 		$GLOBALS['__test_config']     = array();
 		$GLOBALS['__test_messages']   = array();
+		$GLOBALS['__test_user_settings'] = array();
+		$GLOBALS['__test_csrf_valid'] = true;
+		$GLOBALS['__test_translations'] = array();
+		$GLOBALS['fv_nbar_data_known']  = array();
 		$_GET     = array();
 		$_POST    = array();
 		$_REQUEST = array();
@@ -111,10 +115,18 @@ function plugin_test_queue_db_result($function, $result) {
 	}
 }
 
+if (!function_exists('plugin_test_queue_slices')) {
+	// Queue the answer to the SHOW TABLES that lists the raw NBAR slices.
+	function plugin_test_queue_slices(array $tables) {
+		plugin_test_queue_db_result('db_fetch_assoc', array_map(fn ($table) => array('Tables_in_cacti (plugin_flowview_nbar_data_%)' => $table), $tables));
+	}
+}
+
 if (!function_exists('plugin_test_db_result')) {
 	function plugin_test_db_result($function, $default) {
 		if (!empty($GLOBALS['__test_db_results'][$function])) {
-			return array_shift($GLOBALS['__test_db_results'][$function]);
+			$result = array_shift($GLOBALS['__test_db_results'][$function]);
+			return $result instanceof Closure ? $result() : $result;
 		}
 		return $default;
 	}
@@ -123,14 +135,14 @@ function plugin_test_db_result($function, $default) {
 if (!function_exists('db_execute')) {
 	function db_execute($sql, $log = true, $conn = false) {
 		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_execute', 'sql' => $sql, 'params' => array(), 'conn' => $conn);
-		return true;
+		return plugin_test_db_result('db_execute', true);
 	}
 }
 
 if (!function_exists('db_execute_prepared')) {
 	function db_execute_prepared($sql, $params = array(), $log = true, $conn = false) {
 		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_execute_prepared', 'sql' => $sql, 'params' => $params, 'conn' => $conn);
-		return true;
+		return plugin_test_db_result('db_execute_prepared', true);
 	}
 }
 
@@ -165,7 +177,7 @@ function db_fetch_row_prepared($sql, $params = array(), $log = true, $conn = fal
 if (!function_exists('db_fetch_cell')) {
 	function db_fetch_cell($sql, $column = '', $log = true, $conn = false) {
 		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_fetch_cell', 'sql' => $sql, 'params' => array(), 'conn' => $conn);
-		return plugin_test_db_result('db_fetch_cell', '');
+		return plugin_test_db_result('db_fetch_cell', str_contains($sql, '@@session.max_statement_time') ? '0' : '');
 	}
 }
 
@@ -199,6 +211,13 @@ function db_index_exists($table, $index) {
 	}
 }
 
+if (!function_exists('db_add_column')) {
+	function db_add_column($table, $column, $log = true, $conn = false) {
+		$GLOBALS['__test_db_calls'][] = array('fn' => 'db_add_column', 'sql' => $table, 'params' => $column, 'conn' => $conn);
+		return plugin_test_db_result('db_add_column', true);
+	}
+}
+
 if (!function_exists('db_column_exists')) {
 	function db_column_exists($table, $column) {
 		return false;
@@ -267,8 +286,12 @@ function html_escape($string) {
 }
 
 if (!function_exists('__')) {
-	function __($text, $domain = '') {
-		return $text;
+	function __($text, ...$args) {
+		if ($args) {
+			$domain = array_pop($args); // Cacti passes the text domain last.
+			$text = $GLOBALS['__test_translations'][$domain][$text] ?? $text;
+		}
+		return $args ? vsprintf($text, $args) : $text;
 	}
 }
 
@@ -297,6 +320,12 @@ function cacti_sizeof($array) {
 	}
 }
 
+if (!function_exists('cacti_count')) {
+	function cacti_count($array) {
+		return is_array($array) ? count($array) : 0;
+	}
+}
+
 if (!function_exists('is_realm_allowed')) {
 	function is_realm_allowed($realm) {
 		return true;
@@ -310,14 +339,14 @@ function raise_message($id, $text = '', $level = 0) {
 }
 
 if (!function_exists('get_request_var')) {
-	function get_request_var($name) {
-		return isset($_REQUEST[$name]) ? $_REQUEST[$name] : '';
+	function get_request_var($name, $default = '') {
+		return isset($_REQUEST[$name]) ? $_REQUEST[$name] : $default;
 	}
 }
 
 if (!function_exists('get_nfilter_request_var')) {
-	function get_nfilter_request_var($name) {
-		return get_request_var($name);
+	function get_nfilter_request_var($name, $default = '') {
+		return get_request_var($name, $default);
 	}
 }
 
@@ -366,6 +395,16 @@ function cacti_pton($cidr) {
 	}
 }
 
+if (!function_exists('array_rekey')) {
+	function array_rekey($array, $key, $value) {
+		$out = [];
+		foreach (is_array($array) ? $array : [] as $row) {
+			$out[$row[$key]] = is_array($value) ? array_intersect_key($row, array_flip($value)) : $row[$value];
+		}
+		return $out;
+	}
+}
+
 if (!function_exists('db_format_index_create')) {
 	function db_format_index_create($columns) {
 		return implode(', ', array_map(function ($column) {
@@ -471,3 +510,50 @@ function flowview_test_load($path) {
 
 require_once dirname(__DIR__) . '/includes/functions.php';
 require_once dirname(__DIR__) . '/includes/database.php';
+
+// Account preferences and CSRF use configurable fixtures, never a real account.
+if (!function_exists('read_user_setting')) {
+    function read_user_setting($name, $default = '', $force = false) {
+        return $GLOBALS['__test_user_settings'][$name] ?? $default;
+    }
+}
+if (!function_exists('set_user_setting')) {
+    function set_user_setting($name, $value) {
+        $GLOBALS['__test_user_settings'][$name] = $value;
+    }
+}
+if (!function_exists('csrf_check')) {
+    function csrf_check($fatal = true) {
+        return $GLOBALS['__test_csrf_valid'] ?? true;
+    }
+}
+
+if (!function_exists('exec_background')) {
+	function exec_background($filename, $args = '', $redirect_args = '') {
+		$GLOBALS['__test_db_calls'][] = ['fn' => 'exec_background', 'sql' => $filename, 'params' => [$args]];
+	}
+}
+if (!function_exists('register_process_start')) {
+	function register_process_start($name, $type, $id, $timeout) {
+		$GLOBALS['__test_db_calls'][] = ['fn' => 'register_process_start', 'sql' => $name, 'params' => [$type, $id, $timeout]];
+		return plugin_test_db_result('register_process_start', true);
+	}
+}
+if (!function_exists('unregister_process')) {
+	function unregister_process($name, $type, $id = 0, $pid = -1) {
+		$GLOBALS['__test_db_calls'][] = ['fn' => 'unregister_process', 'sql' => $name, 'params' => [$type, $id, $pid]];
+	}
+}
+if (!function_exists('exec_with_timeout')) {
+	function exec_with_timeout($command, &$output, &$status, $timeout = 5) {
+		$GLOBALS['__test_db_calls'][] = ['fn' => 'exec_with_timeout', 'sql' => '', 'params' => [$command, $timeout]];
+		$status = plugin_test_db_result('exec_with_timeout', 0);
+		return plugin_test_db_result('exec_with_timeout_result', null);
+	}
+}
+
+if (!function_exists('db_affected_rows')) {
+	function db_affected_rows($conn = false) {
+		return plugin_test_db_result('db_affected_rows', 0);
+	}
+}
diff --git a/tests/fixtures/nbar-count-request.php b/tests/fixtures/nbar-count-request.php
new file mode 100644
index 0000000..423f714
--- /dev/null
+++ b/tests/fixtures/nbar-count-request.php
@@ -0,0 +1,79 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+// Run only as a child process of the isolated unit test suite.
+if (PHP_SAPI !== 'cli' || count($argv) !== 3) {
+	exit(1);
+}
+require(dirname(__DIR__) . '/bootstrap-unit.php');
+$scenario  = $argv[1];
+$directory = $argv[2];
+$driver    = function_exists('pcov\\start') ? 'pcov' : (function_exists('xdebug_start_code_coverage') ? 'xdebug' : '');
+
+if ($driver === 'pcov') {
+	\pcov\start();
+} elseif ($driver === 'xdebug') {
+	xdebug_start_code_coverage(XDEBUG_CC_UNUSED | XDEBUG_CC_DEAD_CODE);
+}
+register_shutdown_function(static function () use ($directory, $driver) {
+	$coverage = [];
+
+	if ($driver === 'pcov') {
+		\pcov\stop();
+		$coverage = \pcov\collect();
+	} elseif ($driver === 'xdebug') {
+		$coverage = xdebug_get_code_coverage();
+		xdebug_stop_code_coverage();
+	}
+	file_put_contents($directory . '/result.json', json_encode(['session' => $_SESSION ?? [], 'calls' => $GLOBALS['__test_db_calls'], 'coverage' => $coverage]));
+});
+flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_count.php');
+$GLOBALS['flowview_cnn'] = 'count-endpoint-test';
+ini_set('session.use_cookies', '0');
+session_cache_limiter('');
+session_save_path($directory);
+session_start();
+$key                        = str_repeat('a', 64);
+$_REQUEST                   = ['key' => $key];
+$entry                      = ['expires' => time() + 3600, 'sql' => 'SELECT COUNT(*) total FROM fixture WHERE listener_id=?', 'args' => [3], 'ttl' => 600];
+$_SESSION['fv_nbar_counts'] = [$key => $entry];
+
+if ($scenario === 'malformed') {
+	$_REQUEST['key'] = ['nested'];
+} elseif ($scenario === 'missing') {
+	$_SESSION['fv_nbar_counts'] = [];
+} elseif ($scenario === 'expired') {
+	$_SESSION['fv_nbar_counts'][$key]['expires'] = time() - 1;
+} elseif ($scenario === 'retry') {
+	$_SESSION['fv_nbar_counts'][$key]['failed_until'] = time() + 60;
+} elseif ($scenario === 'cached') {
+	$_SESSION['fv_nbar_counts'][$key] += ['total' => 12345, 'until' => time() + 60];
+} elseif ($scenario === 'busy') {
+	plugin_test_queue_db_result('db_fetch_cell', 0);
+} elseif (str_starts_with($scenario, 'scoped')) {
+	// Saved criteria, not saved SQL: the slice list is read again when the count runs.
+	$_SESSION['fv_nbar_counts'][$key]['sql']   = 'SELECT stale FROM before_the_slice_existed';
+	$_SESSION['fv_nbar_counts'][$key]['scope'] = ['where' => 'd.listener_id=?', 'listeners' => [1], 'start' => 1800000000, 'end' => 1800001800];
+	plugin_test_queue_db_result('db_fetch_cell', 1);
+	plugin_test_queue_db_result('db_fetch_cell', '11.8.9-MariaDB');
+
+	if ($scenario === 'scoped-listing-failed') {
+		plugin_test_queue_db_result('db_fetch_assoc', false);
+	} else {
+		plugin_test_queue_slices([fv_nbar_data_table(1800000000)]);
+		plugin_test_queue_db_result('db_fetch_row_prepared', ['total' => 12345]);
+	}
+} else {
+	plugin_test_queue_db_result('db_fetch_cell', 1);
+	plugin_test_queue_db_result('db_fetch_cell', '11.8.9-MariaDB');
+	plugin_test_queue_db_result('db_fetch_row_prepared', str_contains($scenario, 'failed') ? false : ['total' => 12345]);
+
+	if (str_starts_with($scenario, 'background')) {
+		function fastcgi_finish_request(): bool {
+			$GLOBALS['__test_response_finished'] = true;
+
+			return true;
+		}
+	}
+}
+fv_nbar_count_request();
diff --git a/tests/fixtures/nbar-direct-request.php b/tests/fixtures/nbar-direct-request.php
new file mode 100644
index 0000000..5996c71
--- /dev/null
+++ b/tests/fixtures/nbar-direct-request.php
@@ -0,0 +1,34 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+// Run only as a child process of the isolated unit test suite.
+if (PHP_SAPI !== 'cli' || count($argv) !== 3) {
+	exit(1);
+}
+$scenario  = $argv[1];
+$directory = $argv[2];
+$driver    = function_exists('pcov\\start') ? 'pcov' : (function_exists('xdebug_start_code_coverage') ? 'xdebug' : '');
+
+if ($driver === 'pcov') {
+	\pcov\start();
+} elseif ($driver === 'xdebug') {
+	xdebug_start_code_coverage(XDEBUG_CC_UNUSED | XDEBUG_CC_DEAD_CODE);
+}
+register_shutdown_function(static function () use ($directory, $driver) {
+	$coverage = [];
+
+	if ($driver === 'pcov') {
+		\pcov\stop();
+		$coverage = \pcov\collect();
+	} elseif ($driver === 'xdebug') {
+		$coverage = xdebug_get_code_coverage();
+		xdebug_stop_code_coverage();
+	}
+	file_put_contents($directory . '/result.json', json_encode(['session' => $_SESSION ?? [], 'calls' => $GLOBALS['__test_db_calls'] ?? [], 'coverage' => $coverage, 'status' => http_response_code()]));
+});
+$files = ['guide' => 'nbar_setup_guide.php', 'report' => 'nbar_report.php'];
+
+if (!isset($files[$scenario])) {
+	exit(1);
+}
+
+require(dirname(__DIR__, 2) . '/' . $files[$scenario]);
diff --git a/tests/fixtures/nbar-dns-budget.php b/tests/fixtures/nbar-dns-budget.php
new file mode 100644
index 0000000..4730b34
--- /dev/null
+++ b/tests/fixtures/nbar-dns-budget.php
@@ -0,0 +1,47 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+// Run only as a child process of the isolated unit test suite.
+if (PHP_SAPI !== 'cli' || count($argv) !== 3) {
+	exit(1);
+}
+require(dirname(__DIR__) . '/bootstrap-unit.php');
+$scenario  = $argv[1];
+$directory = $argv[2];
+$driver    = function_exists('pcov\\start') ? 'pcov' : (function_exists('xdebug_start_code_coverage') ? 'xdebug' : '');
+
+if ($driver === 'pcov') {
+	\pcov\start();
+} elseif ($driver === 'xdebug') {
+	xdebug_start_code_coverage(XDEBUG_CC_UNUSED | XDEBUG_CC_DEAD_CODE);
+}
+register_shutdown_function(static function () use ($directory, $driver) {
+	$coverage = [];
+
+	if ($driver === 'pcov') {
+		\pcov\stop();
+		$coverage = \pcov\collect();
+	} elseif ($driver === 'xdebug') {
+		$coverage = xdebug_get_code_coverage();
+		xdebug_stop_code_coverage();
+	}
+	file_put_contents($directory . '/result.json', json_encode(['session' => $_SESSION ?? [], 'calls' => $GLOBALS['__test_db_calls'] ?? [], 'coverage' => $coverage, 'status' => http_response_code()]));
+});
+
+class Net_DNS2_Resolver {
+	public $timeout;
+	public static int $queries = 0;
+	public function __construct(array $options) {
+	}
+	public function query(string $ip, string $type): object {
+		self::$queries++;
+
+		return (object) ['answer' => []];
+	}
+}
+flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_common.php');
+flowview_test_load(dirname(__DIR__, 2) . '/includes/nbar_dns.php');
+$GLOBALS['fv_nbar_preferences'] = ['dns' => '1'];
+fv_nbar_dns('192.0.2.249');
+usleep(1100000);
+print json_encode(['name' => fv_nbar_dns('192.0.2.250'), 'queries' => Net_DNS2_Resolver::$queries]);
diff --git a/tests/fixtures/nbar-report-request.php b/tests/fixtures/nbar-report-request.php
new file mode 100644
index 0000000..3a5aa05
--- /dev/null
+++ b/tests/fixtures/nbar-report-request.php
@@ -0,0 +1,155 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+// Run only as a child process of the isolated unit test suite.
+if (PHP_SAPI !== 'cli' || count($argv) !== 3) {
+	exit(1);
+}
+require(dirname(__DIR__) . '/bootstrap-unit.php');
+$scenario  = $argv[1];
+$directory = $argv[2];
+$driver    = function_exists('pcov\\start') ? 'pcov' : (function_exists('xdebug_start_code_coverage') ? 'xdebug' : '');
+
+if ($driver === 'pcov') {
+	\pcov\start();
+} elseif ($driver === 'xdebug') {
+	xdebug_start_code_coverage(XDEBUG_CC_UNUSED | XDEBUG_CC_DEAD_CODE);
+}
+register_shutdown_function(static function () use ($directory, $driver) {
+	$coverage = [];
+
+	if ($driver === 'pcov') {
+		\pcov\stop();
+		$coverage = \pcov\collect();
+	} elseif ($driver === 'xdebug') {
+		$coverage = xdebug_get_code_coverage();
+		xdebug_stop_code_coverage();
+	}
+	file_put_contents($directory . '/result.json', json_encode(['session' => $_SESSION ?? [], 'calls' => $GLOBALS['__test_db_calls'], 'coverage' => $coverage, 'status' => http_response_code(), 'footer' => $GLOBALS['__test_footer_rendered'] ?? false, 'redirect' => $GLOBALS['restore'] ?? null]));
+});
+flowview_test_load(dirname(__DIR__, 2) . '/setup.php');
+$constants = file_get_contents($config['base_path'] . '/include/global_constants.php');
+preg_match_all("/define\('((?:GT_|GTS_)[A-Z0-9_]+)', ([0-9]+)\);/", $constants, $matches, PREG_SET_ORDER);
+
+foreach ($matches as $match) {
+	if (!defined($match[1])) {
+		define($match[1], (int) $match[2]);
+	}
+}
+/**
+ * Supply a test token without a real account or authentication cookie.
+ *
+ * @return string
+ */
+function csrf_get_tokens(): string {
+	return 'unit-csrf-token';
+}
+/**
+ * Render the minimum Cacti report-box markup needed by this fixture.
+ *
+ * @param mixed ...$args Cacti box options.
+ *
+ * @return void
+ */
+function html_start_box(mixed ...$args): void {
+	print '<table>';
+}
+/**
+ * Close the fixture report-box markup.
+ *
+ * @param mixed ...$args Cacti box options.
+ *
+ * @return void
+ */
+function html_end_box(mixed ...$args): void {
+	print '</table>';
+}
+/**
+ * Record completion without loading Cacti's real page footer.
+ *
+ * @return void
+ */
+function bottom_footer(): void {
+	$GLOBALS['__test_footer_rendered'] = true;
+}
+$GLOBALS['__test_config']['flowview_nbar_schema_version']     = '2';
+$GLOBALS['__test_user_settings']['flowview_nbar_preferences'] = json_encode(['prefixes' => ['192.0.2.0/24'], 'listeners' => [], 'dns' => '0']);
+$graph_timespans                                              = [GT_LAST_HALF_HOUR => 'Last Half Hour', GT_LAST_HOUR => 'Last Hour', GT_LAST_DAY => 'Last Day', GT_LAST_YEAR => 'Last Year'];
+$_REQUEST                                                     = ['action' => 'view', 'report' => 'nbar', 'mode' => 'apps', 'listener' => '1'];
+$_SERVER['REQUEST_METHOD']                                    = 'GET';
+
+if (str_starts_with($scenario, 'nav-redirect')) {
+	$_REQUEST = in_array($scenario, ['nav-redirect-header', 'nav-redirect-fragment-header'], true) ? ['headercontent' => 'true'] : [];
+
+	if (str_contains($scenario, 'fragment')) {
+		$_REQUEST += ['action' => 'view', 'header' => 'false'];
+	}
+	$GLOBALS['__test_user_settings']['flowview_last_section'] = $scenario === 'nav-redirect-fragment-flows' ? 'flows' : 'nbar';
+} elseif ($scenario === 'nav-select') {
+	$_REQUEST = ['section' => 'nbar', 'mode' => 'apps'];
+} elseif ($scenario === 'combine') {
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_REQUEST += ['prefs_apply' => '1', 'combine_apply' => '1', 'local_prefixes' => '192.0.2.0/24', 'site_listeners' => ['1', '2']];
+} elseif ($scenario === 'invalid-mode') {
+	$_REQUEST['mode'] = 'invalid';
+} elseif ($scenario === 'no-combined') {
+	$_REQUEST['listener'] = '0';
+} elseif ($scenario === 'unknown-context') {
+	$_REQUEST['context'] = json_encode(['report' => 's99999', 'sortfield' => ['bad']]);
+} elseif ($scenario === 'invalid') {
+	$_REQUEST += ['period' => '7', 'family' => 'bad', 'app' => 'injected', 'host' => 'not-an-ip', 'context' => 'false'];
+	$_REQUEST['listener'] = '999';
+} elseif ($scenario === 'retention') {
+	$_REQUEST['predefined_timespan'] = (string) GT_LAST_YEAR;
+} elseif ($scenario === 'fallback-span') {
+	$_REQUEST['predefined_timespan'] = '9999';
+} elseif ($scenario === 'all-history') {
+	$_REQUEST['predefined_timespan'] = '1000';
+} elseif ($scenario === 'clamped') {
+	$_REQUEST += ['predefined_timespan' => '0', 'date1' => date('Y-m-d H:i', time() - 10 * 86400), 'date2' => date('Y-m-d H:i', time() + 3600)];
+} elseif ($scenario === 'legacy') {
+	$_REQUEST['period'] = '3600';
+} elseif ($scenario === 'drilldown') {
+	$_REQUEST = array_replace($_REQUEST, ['mode' => 'connections', 'app' => '0d000001', 'parent_app' => '0d000001', 'internal' => '192.0.2.10', 'external' => '198.51.100.20', 'context' => json_encode(['report' => 'bad', 'nested' => ['bad']])]);
+} elseif ($scenario === 'conversations') {
+	$_REQUEST['mode'] = 'conversations';
+} elseif ($scenario === 'apps-failure') {
+	$_REQUEST['mode'] = 'apps';
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', false);
+} elseif ($scenario === 'conversation-failure') {
+	$_REQUEST['mode'] = 'conversations';
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', false);
+} elseif ($scenario === 'failure') {
+	$_REQUEST['mode'] = 'connections';
+	plugin_test_queue_db_result('db_execute', false);
+} elseif ($scenario === 'upgrade') {
+	$GLOBALS['__test_config']['flowview_nbar_schema_version'] = '0';
+	$_SERVER['PHP_SELF']                                      = 'fixture.php';
+} elseif ($scenario === 'more-pages') {
+	$_REQUEST['mode'] = 'connections';
+	$from             = (int) floor(time() / 3600) * 3600 - 3600;
+	$_REQUEST += ['predefined_timespan' => '0', 'date1' => date('Y-m-d H:i', $from), 'date2' => date('Y-m-d H:i', $from + 1200), 'lock_range' => '1'];
+
+	foreach (range(1, 4) as $unused) {
+		plugin_test_queue_db_result('db_fetch_assoc_prepared', []);
+	}
+	$rows = [];
+
+	foreach (range(1, 101) as $i) {
+		$rows[] = ['app_id' => '0d000001', 'src_hex' => bin2hex(inet_pton('192.0.2.' . $i)), 'dst_hex' => bin2hex(inet_pton('198.51.100.20')), 'sport' => $i, 'dport' => 443, 'protocol' => 6, 'bytes' => '10', 'packets' => '1', 'records' => '1', 'first_seen' => $from, 'last_seen' => $from + 60];
+	}
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', $rows);
+	plugin_test_queue_db_result('db_fetch_assoc_prepared', $rows);
+} elseif ($scenario === 'csrf') {
+	$_SERVER['REQUEST_METHOD'] = 'POST';
+	$_REQUEST += ['prefs_apply' => '1', 'local_prefixes' => ''];
+	$GLOBALS['__test_csrf_valid'] = false;
+}
+
+foreach (range(1, 3) as $unused) {
+	plugin_test_queue_db_result('db_fetch_assoc', []);
+}
+plugin_test_queue_db_result('db_fetch_assoc', $scenario === 'combine' ? [['id' => 1, 'name' => 'Fixture router'], ['id' => 2, 'name' => 'Second']] : [['id' => 1, 'name' => 'Fixture router']]);
+require(dirname(__DIR__, 2) . '/flowview_sections.php');
+require(dirname(__DIR__, 2) . '/nbar_report.php');
diff --git a/tests/helpers/request.php b/tests/helpers/request.php
new file mode 100644
index 0000000..de8fa89
--- /dev/null
+++ b/tests/helpers/request.php
@@ -0,0 +1,35 @@
+<?php
+// Copyright (C) 2004-2026 The Cacti Group. GPL-2.0-or-later.
+
+/** Execute an isolated request and merge endpoint coverage into the parent run. */
+function flowview_test_request(string $fixture, string $scenario, string $directory): array {
+	$command   = [PHP_BINARY, '-d', 'xdebug.mode=coverage'];
+	$extension = getenv('FLOWVIEW_TEST_COVERAGE_EXTENSION');
+
+	if ($extension !== false && $extension !== '') {
+		array_push($command, '-d', 'extension=' . $extension, '-d', 'pcov.directory=' . dirname(__DIR__, 2));
+	}
+	$zendExtension = getenv('FLOWVIEW_TEST_COVERAGE_ZEND_EXTENSION');
+
+	if ($zendExtension !== false && $zendExtension !== '') {
+		array_push($command, '-d', 'zend_extension=' . $zendExtension);
+	}
+	array_push($command, $fixture, $scenario, $directory);
+	$process = proc_open($command, [0 => ['pipe', 'r'], 1 => ['pipe', 'w'], 2 => ['pipe', 'w']], $pipes);
+	expect(is_resource($process))->toBeTrue();
+	fclose($pipes[0]);
+	$stdout = stream_get_contents($pipes[1]);
+	$stderr = stream_get_contents($pipes[2]);
+	fclose($pipes[1]);
+	fclose($pipes[2]);
+	expect(proc_close($process))->toBe(0);
+	expect($stderr)->toBe('');
+	$result   = json_decode(file_get_contents($directory . '/result.json'), true, 512, JSON_THROW_ON_ERROR);
+	$coverage = \PHPUnit\Runner\CodeCoverage::instance();
+
+	if ($result['coverage'] && $coverage->isActive()) {
+		$coverage->codeCoverage()->append(\SebastianBergmann\CodeCoverage\Data\RawCodeCoverageData::fromXdebugWithoutPathCoverage($result['coverage']));
+	}
+
+	return [$stdout, $result];
+}