diff --git a/.claude/skills/metric-test/SKILL.md b/.claude/skills/metric-test/SKILL.md
index 52a792d03..db0287aad 100644
--- a/.claude/skills/metric-test/SKILL.md
+++ b/.claude/skills/metric-test/SKILL.md
@@ -9,7 +9,7 @@ allowed-tools: Bash, Read, Write, Edit, Glob, Grep
 # Author a metric test (declarative YAML)
 
 This skill writes and validates `*.test.yaml` fixtures that drive the full
-`bronze → dbt silver → gold view → analytics-api` path and assert the result.
+`bronze → dbt silver → gold view → analytics` path and assert the result.
 
 ## Source of truth (reference — open only if you need the detail)
 
@@ -193,7 +193,7 @@ with a dedicated spec (see `metrics/collab_emails_read.test.yaml`):
 ## Scaffolding a new test
 
 1. **Resolve the metric_id and its shape.** Find it in the seed catalog
-   (`grep -rn "<label>" src/backend/services/analytics-api/src/migration/*.rs`) and
+   (`grep -rn "<label>" src/backend/services/analytics/src/migration/*.rs`) and
    the live `query_ref` rewrite for that metric. Note whether it returns a bullet
    (`metric_key`/`value`/`median`/`range_*`) or per-person rows. For the collaboration
    bullets the median/range is **DEPARTMENT/org_unit-scoped for BOTH** the Team
@@ -316,12 +316,12 @@ connector that isn't there yet:
 ## Gotchas (rig operations + cross-test impact)
 
 - **Stale binary / your migration didn't run.** Historically the biggest trap:
-  `./e2e.sh` builds analytics-api into the `cargo-target` Docker volume, and on
+  `./e2e.sh` builds analytics into the `cargo-target` Docker volume, and on
   Docker Desktop (macOS) the mtimes cargo reads through the bind mount don't
   reliably advance, so cargo relinked a stale object and the binary silently
   lacked new SeaORM migrations (symptoms: `query_ref`/catalog changes have no
   effect, a `find` matches 0 rows, `size(items)` off by your new key). FIXED in
-  `lib/analytics_api.py::build` — it now `touch`es the analytics-api crate
+  `lib/analytics.py::build` — it now `touch`es the analytics crate
   sources before `cargo build`, forcing a recompile every run (~1-2 min, only
   that crate). So a plain `./e2e.sh test` picks up new migrations now; you should
   NOT need `down -v` for this. If you still suspect a stale binary, confirm by
diff --git a/.env.compose.example b/.env.compose.example
index 777e7ac99..38654709d 100644
--- a/.env.compose.example
+++ b/.env.compose.example
@@ -49,13 +49,13 @@ FRONTEND_IMAGE=
 #
 # Equivalent CLI: `./dev-compose.sh up --from-ghcr=api-gateway,identity`
 API_GATEWAY_IMAGE=
-ANALYTICS_API_IMAGE=
+ANALYTICS_IMAGE=
 IDENTITY_IMAGE=
 
 # ── Host port mapping ─────────────────────────────────────────────────
 # Change these if 8080/8081/8082/3000/3306/8123/6379 are already in use.
 API_GATEWAY_PORT=8080
-ANALYTICS_API_PORT=8081
+ANALYTICS_PORT=8081
 IDENTITY_PORT=8082
 FRONTEND_PORT=3000
 
@@ -110,7 +110,7 @@ SEEDED_LOCAL_MARIA=
 SEEDED_LOCAL_CH=
 
 # ── Tenant / OIDC ─────────────────────────────────────────────────────
-# Default tenant for header-less callers (analytics-api + identity).
+# Default tenant for header-less callers (analytics + identity).
 # Replace with the UUID present in your persons.insight_tenant_id.
 TENANT_DEFAULT_ID=00000000-df51-5b42-9538-d2b56b7ee953
 
diff --git a/.github/workflows/build-images.yml b/.github/workflows/build-images.yml
index a8801fee5..f7a114b62 100644
--- a/.github/workflows/build-images.yml
+++ b/.github/workflows/build-images.yml
@@ -57,7 +57,7 @@ jobs:
     runs-on: ubuntu-latest
     outputs:
       api_gateway:   ${{ steps.filter.outputs.api_gateway }}
-      analytics_api: ${{ steps.filter.outputs.analytics_api }}
+      analytics: ${{ steps.filter.outputs.analytics }}
       identity:      ${{ steps.filter.outputs.identity }}
       toolbox:       ${{ steps.filter.outputs.toolbox }}
       umbrella:      ${{ steps.filter.outputs.umbrella }}
@@ -72,8 +72,8 @@ jobs:
               - 'src/backend/services/api-gateway/**'
               - 'src/backend/Cargo.toml'
               - 'src/backend/Cargo.lock'
-            analytics_api:
-              - 'src/backend/services/analytics-api/**'
+            analytics:
+              - 'src/backend/services/analytics/**'
               - 'src/backend/Cargo.toml'
               - 'src/backend/Cargo.lock'
             identity:
@@ -296,10 +296,10 @@ jobs:
           subject-digest: ${{ steps.inspect.outputs.digest }}
           push-to-registry: true
 
-  backend-analytics-api:
+  backend-analytics:
     needs: changes
     if: |
-      needs.changes.outputs.analytics_api == 'true'
+      needs.changes.outputs.analytics == 'true'
       || (github.event_name == 'workflow_dispatch' && inputs.frontend_tag == '')
     strategy:
       fail-fast: false
@@ -325,11 +325,11 @@ jobs:
         id: build
         with:
           context: src/backend
-          file: src/backend/services/analytics-api/Dockerfile
+          file: src/backend/services/analytics/Dockerfile
           platforms: ${{ matrix.platform }}
-          outputs: type=image,name=${{ env.IMAGE_PREFIX }}/insight-analytics-api,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}
-          cache-from: type=gha,scope=analytics-api-${{ matrix.arch }}
-          cache-to: type=gha,mode=max,scope=analytics-api-${{ matrix.arch }},ignore-error=true
+          outputs: type=image,name=${{ env.IMAGE_PREFIX }}/insight-analytics,push-by-digest=true,name-canonical=true,push=${{ github.event_name != 'pull_request' && github.ref == 'refs/heads/main' }}
+          cache-from: type=gha,scope=analytics-${{ matrix.arch }}
+          cache-to: type=gha,mode=max,scope=analytics-${{ matrix.arch }},ignore-error=true
       - name: Export digest
         if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
         run: |
@@ -340,16 +340,16 @@ jobs:
         if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
         uses: actions/upload-artifact@v4
         with:
-          name: digests-analytics-api-${{ matrix.arch }}
+          name: digests-analytics-${{ matrix.arch }}
           path: /tmp/digests/*
           if-no-files-found: error
           retention-days: 1
 
-  merge-analytics-api:
-    needs: [changes, backend-analytics-api]
+  merge-analytics:
+    needs: [changes, backend-analytics]
     if: |
       always()
-      && needs.backend-analytics-api.result == 'success'
+      && needs.backend-analytics.result == 'success'
       && github.event_name != 'pull_request'
       && github.ref == 'refs/heads/main'
     runs-on: ubuntu-latest
@@ -358,7 +358,7 @@ jobs:
         uses: actions/download-artifact@v4
         with:
           path: /tmp/digests
-          pattern: digests-analytics-api-*
+          pattern: digests-analytics-*
           merge-multiple: true
       - uses: docker/setup-buildx-action@v3
       - uses: docker/login-action@v3
@@ -369,7 +369,7 @@ jobs:
       - uses: docker/metadata-action@v5
         id: meta
         with:
-          images: ${{ env.IMAGE_PREFIX }}/insight-analytics-api
+          images: ${{ env.IMAGE_PREFIX }}/insight-analytics
           tags: |
             type=raw,value=${{ needs.changes.outputs.build_tag }}
             type=raw,value=latest
@@ -378,18 +378,18 @@ jobs:
         run: |
           docker buildx imagetools create \
             $(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON") \
-            $(printf '${{ env.IMAGE_PREFIX }}/insight-analytics-api@sha256:%s ' *)
+            $(printf '${{ env.IMAGE_PREFIX }}/insight-analytics@sha256:%s ' *)
       - name: Inspect manifest digest
         id: inspect
         run: |
           DIGEST=$(docker buildx imagetools inspect \
-            ${{ env.IMAGE_PREFIX }}/insight-analytics-api:${{ needs.changes.outputs.build_tag }} \
+            ${{ env.IMAGE_PREFIX }}/insight-analytics:${{ needs.changes.outputs.build_tag }} \
             --format '{{json .Manifest}}' | jq -r .digest)
           echo "digest=$DIGEST" >> "$GITHUB_OUTPUT"
       - name: Attest build provenance
         uses: actions/attest-build-provenance@v2
         with:
-          subject-name: ${{ env.IMAGE_PREFIX }}/insight-analytics-api
+          subject-name: ${{ env.IMAGE_PREFIX }}/insight-analytics
           subject-digest: ${{ steps.inspect.outputs.digest }}
           push-to-registry: true
 
@@ -418,7 +418,7 @@ jobs:
           registry: ${{ env.REGISTRY }}
           username: ${{ github.actor }}
           password: ${{ secrets.GITHUB_TOKEN }}
-      # Context is src/backend/ (uniform with api-gateway + analytics-api)
+      # Context is src/backend/ (uniform with api-gateway + analytics)
       # so the Dockerfile can reach src/backend/docker-entrypoint.sh —
       # the shared ENABLE_AUTO_RELOAD-aware entrypoint added in the
       # docker-compose dev path. Internal COPY paths inside the
@@ -792,7 +792,7 @@ jobs:
       - changes
       - discover-images
       - merge-api-gateway
-      - merge-analytics-api
+      - merge-analytics
       - merge-identity
       - merge-toolbox
       - merge-image
@@ -812,7 +812,7 @@ jobs:
       && needs.discover-images.outputs.any == 'true'
       && needs.merge-image.result == 'success'
       && (needs.merge-api-gateway.result   == 'success' || needs.merge-api-gateway.result   == 'skipped')
-      && (needs.merge-analytics-api.result == 'success' || needs.merge-analytics-api.result == 'skipped')
+      && (needs.merge-analytics.result == 'success' || needs.merge-analytics.result == 'skipped')
       && (needs.merge-identity.result      == 'success' || needs.merge-identity.result      == 'skipped')
       && (needs.merge-toolbox.result       == 'success' || needs.merge-toolbox.result       == 'skipped')
     runs-on: ubuntu-latest
@@ -947,7 +947,7 @@ jobs:
       - changes
       - discover-images
       - merge-api-gateway
-      - merge-analytics-api
+      - merge-analytics
       - merge-identity
       - merge-toolbox
       - merge-image
@@ -957,7 +957,7 @@ jobs:
       && (github.event_name == 'push' || github.event_name == 'workflow_dispatch')
       && github.ref == 'refs/heads/main'
       && (needs.merge-api-gateway.result   == 'success' || needs.merge-api-gateway.result   == 'skipped')
-      && (needs.merge-analytics-api.result == 'success' || needs.merge-analytics-api.result == 'skipped')
+      && (needs.merge-analytics.result == 'success' || needs.merge-analytics.result == 'skipped')
       && (needs.merge-identity.result      == 'success' || needs.merge-identity.result      == 'skipped')
       && (needs.merge-toolbox.result       == 'success' || needs.merge-toolbox.result       == 'skipped')
       && (needs.merge-image.result         == 'success' || needs.merge-image.result         == 'skipped')
@@ -965,7 +965,7 @@ jobs:
       && needs.bump-descriptors.outputs.committed != 'true'
       && (
         needs.changes.outputs.api_gateway   == 'true'
-        || needs.changes.outputs.analytics_api == 'true'
+        || needs.changes.outputs.analytics == 'true'
         || needs.changes.outputs.identity     == 'true'
         || needs.changes.outputs.toolbox      == 'true'
         || needs.changes.outputs.umbrella     == 'true'
@@ -1033,7 +1033,7 @@ jobs:
         env:
           BUILD_TAG:     ${{ needs.changes.outputs.build_tag }}
           API_GATEWAY:   ${{ needs.changes.outputs.api_gateway }}
-          ANALYTICS_API: ${{ needs.changes.outputs.analytics_api }}
+          ANALYTICS: ${{ needs.changes.outputs.analytics }}
           IDENTITY:      ${{ needs.changes.outputs.identity }}
         run: |
           set -euo pipefail
@@ -1041,9 +1041,9 @@ jobs:
             echo "Bumping api-gateway subchart appVersion → $BUILD_TAG"
             yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/api-gateway/helm/Chart.yaml
           fi
-          if [ "$ANALYTICS_API" = "true" ]; then
-            echo "Bumping analytics-api subchart appVersion → $BUILD_TAG"
-            yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/analytics-api/helm/Chart.yaml
+          if [ "$ANALYTICS" = "true" ]; then
+            echo "Bumping analytics subchart appVersion → $BUILD_TAG"
+            yq -i ".appVersion = \"$BUILD_TAG\"" src/backend/services/analytics/helm/Chart.yaml
           fi
           if [ "$IDENTITY" = "true" ]; then
             echo "Bumping identity subchart appVersion → $BUILD_TAG"
@@ -1104,7 +1104,7 @@ jobs:
           # breaks every install (charts 0.1.48–0.1.55 were affected).
           NEW_APP=$(yq -r '.appVersion' \
             src/backend/services/api-gateway/helm/Chart.yaml \
-            src/backend/services/analytics-api/helm/Chart.yaml \
+            src/backend/services/analytics/helm/Chart.yaml \
             src/backend/services/identity/helm/Chart.yaml \
             src/frontend/helm/Chart.yaml \
             | grep -Ev '^(---|null)$' \
@@ -1190,7 +1190,7 @@ jobs:
                   charts/insight/Chart.lock \
                   charts/insight/values.yaml \
                   src/backend/services/api-gateway/helm/Chart.yaml \
-                  src/backend/services/analytics-api/helm/Chart.yaml \
+                  src/backend/services/analytics/helm/Chart.yaml \
                   src/backend/services/identity/helm/Chart.yaml \
                   src/frontend/helm/Chart.yaml \
                   deploy/gitops/.insight-version
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index e253bd77f..b3dee9f60 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -134,7 +134,7 @@ jobs:
         with:
           tool: cargo-llvm-cov
 
-      # DB-backed components (analytics-api) run their #[ignore]d live_tests
+      # DB-backed components (analytics) run their #[ignore]d live_tests
       # against a real MariaDB. Gated on live_db so only those entries pay the
       # ~15s startup. ClickHouse is intentionally not provisioned — CH-gated
       # tests skip themselves (see cf/insight#1564).
@@ -170,9 +170,10 @@ jobs:
           feats=""
           if [ "${{ matrix.entry.all_features }}" = "true" ]; then feats="--all-features"; fi
           if [ "${{ matrix.entry.live_db }}" = "true" ]; then
-            # The gear reads its DB URL from APP__gears__<alias>__config__database_url
-            # (underscore alias bridged to the kebab gear key by fold_gear_env_alias).
-            APP__gears__analytics_api__config__database_url="$INTEGRATION_TESTS_MARIADB_URL" \
+            # The gear reads its DB URL from APP__gears__analytics__config__database_url
+            # (the gear config key is "analytics" — dash-free, so the env var
+            # survives sh/dash entrypoints and k8s envFrom).
+            APP__gears__analytics__config__database_url="$INTEGRATION_TESTS_MARIADB_URL" \
               cargo llvm-cov run --no-report --package "${{ matrix.entry.package }}" $feats -- \
                 -c "services/${{ matrix.entry.name }}/config/insight.yaml" migrate
             cargo llvm-cov --no-report --package "${{ matrix.entry.package }}" $feats -- --include-ignored
@@ -189,6 +190,19 @@ jobs:
           cargo llvm-cov report --cobertura $ignore \
             --output-path "$GITHUB_WORKSPACE/coverage/rust-${{ matrix.entry.name }}.cobertura.xml"
 
+      # Changed crates with cover=false (api-gateway — no unit tests yet) still
+      # run plain `cargo test`: a failure fails this job; only the Cobertura
+      # collection and the coverage gates are skipped. Lint-only fanout entries
+      # (test=false) skip this too — coverage/tests stay per-changed-crate.
+      - name: Test (${{ matrix.entry.name }}, no coverage)
+        if: ${{ matrix.entry.test && !matrix.entry.cover }}
+        working-directory: ${{ matrix.entry.root }}
+        run: |
+          set -euo pipefail
+          feats=""
+          if [ "${{ matrix.entry.all_features }}" = "true" ]; then feats="--all-features"; fi
+          cargo test -p ${{ matrix.entry.package }} $feats
+
       - name: Upload Cobertura
         if: ${{ matrix.entry.cover }}
         uses: actions/upload-artifact@v7
diff --git a/.github/workflows/e2e-bronze-to-api.yml b/.github/workflows/e2e-bronze-to-api.yml
index 33e4049ab..93c9d133a 100644
--- a/.github/workflows/e2e-bronze-to-api.yml
+++ b/.github/workflows/e2e-bronze-to-api.yml
@@ -1,14 +1,14 @@
 name: E2E — Bronze to API
 
 # End-to-end transformation tests covering bronze → dbt → ClickHouse
-# migration views → analytics-api HTTP response → expect rules.
+# migration views → analytics HTTP response → expect rules.
 #
 # Everything (Python, Rust, dbt, pytest) runs inside the runner image
 # defined at src/ingestion/tests/e2e/compose/Dockerfile.runner. The same
 # image is used for local development via src/ingestion/tests/e2e/e2e.sh.
 #
 # Topology: ONE heavy job (`e2e`) boots the stack, runs the suite, and — while
-# analytics-api is already up — snapshots the metric catalog into `.artifacts/`,
+# analytics is already up — snapshots the metric catalog into `.artifacts/`,
 # which it uploads. The metric-coverage-gate job then analyses it as a pure-Python
 # check (no Docker, no app boot). See
 # src/ingestion/tests/e2e/lib/{metric_coverage,collect_metrics}.py.
@@ -55,7 +55,7 @@ jobs:
       - uses: docker/setup-buildx-action@v3
 
       # ─── Build the runner image ─────────────────────────────────────────
-      # The runner bakes in analytics-api + each connector's enrich binary, each
+      # The runner bakes in analytics + each connector's enrich binary, each
       # compiled FROM ITS OWN Dockerfile via build-only services wired as
       # `additional_contexts` (see compose/docker-compose.runner.yml). Nothing is
       # compiled inside the runner at test time.
@@ -74,14 +74,14 @@ jobs:
       # mariadb `depends_on` services — compose pulls their images on demand
       # and waits for `service_healthy` — so no explicit image pre-pull is needed.
       # Serial on purpose: the session rig is not xdist-safe yet (see
-      # conftest.py — per-worker analytics-api spawns race SeaORM migrations
+      # conftest.py — per-worker analytics spawns race SeaORM migrations
       # in the shared MariaDB, non-primary workers don't wait for ClickHouse
       # migrations, and the shared dbt target/ dir is deleted by whichever
       # worker finishes first). Wall-time cost is negligible: the runner image
-      # build (which compiles analytics-api + enrich) dominates the job.
+      # build (which compiles analytics + enrich) dominates the job.
       #
       # The suite ALSO snapshots the metric catalog to .artifacts/catalog_metrics.json
-      # (lib/collect_metrics.py, while analytics-api is up) — the
+      # (lib/collect_metrics.py, while analytics is up) — the
       # metric-coverage-gate job below analyses it, no second app boot.
       - name: Run E2E suite
         run: ./e2e.sh test --tb=short -q
@@ -122,7 +122,7 @@ jobs:
 
   # ─── Gate job — pure-Python analysis of the collected catalog ─────────────
   # Runs after `e2e` (needs), downloads `coverage-inputs`, reads the catalog file.
-  # No Docker, no analytics-api boot. `!cancelled()` so it still reports when the
+  # No Docker, no analytics boot. `!cancelled()` so it still reports when the
   # suite itself failed (the artifact is usually present).
 
   metric-coverage-gate:
diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
index 78a6f3f18..b6bf6d0b6 100644
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -194,7 +194,7 @@ every Deployment is Ready before the chain returns.
 │  Vite dev (HMR) / nginx+dist / ghcr image — port 3000                │
 ├──────────────────────────────────────────────────────────────────────┤
 │  Backend                                                              │
-│  api-gateway (Rust :8080)  analytics-api (Rust :8081)                │
+│  api-gateway (Rust :8080)  analytics (Rust :8081)                    │
 │  identity (.NET 9 :8082)                                              │
 ├──────────────────────────────────────────────────────────────────────┤
 │  Infra                                                                │
@@ -268,7 +268,7 @@ Skip the local Rust/dotnet build for one or more services:
 ```bash
 # Per-run flags
 ./dev-compose.sh up --from-ghcr=api-gateway,identity
-./dev-compose.sh up --build-only=analytics-api     # invert: build only this
+./dev-compose.sh up --build-only=analytics     # invert: build only this
 
 # Or pin in .env.compose
 API_GATEWAY_IMAGE=ghcr.io/constructorfabric/insight-api-gateway:latest
@@ -283,7 +283,7 @@ drops the `build:` + bind-mount for the chosen services.
 
 - **Auto-reload** — `ENABLE_AUTO_RELOAD` (compose-only, never in k8s)
 - **Frontend** — `FRONTEND_MODE`, `INSIGHT_FRONT_PATH`, `FRONTEND_IMAGE`
-- **Backend image overrides** — `API_GATEWAY_IMAGE`, `ANALYTICS_API_IMAGE`, `IDENTITY_IMAGE`
+- **Backend image overrides** — `API_GATEWAY_IMAGE`, `ANALYTICS_IMAGE`, `IDENTITY_IMAGE`
 - **Host ports** — every published port is configurable
 - **Database mode** — `MARIADB_EXTERNAL`/`_HOST`/`_INTERNAL_PORT`/…, ClickHouse equivalents (see [External DBs](#external-mariadb--clickhouse))
 - **Credentials** — local-only, kept in dotenv per project policy
@@ -301,7 +301,7 @@ drops the `build:` + bind-mount for the chosen services.
 | --- | --- | --- |
 | Rust / C# source | `./dev-compose.sh build <service>` | watchexec → ~1s restart |
 | `src/backend/services/api-gateway/config/*.yaml` | save | watchexec → ~1s restart (bind-mounted) |
-| identity / analytics-api env | edit `docker-compose.yml`, `up -d <svc>` | container respawn |
+| identity / analytics env | edit `docker-compose.yml`, `up -d <svc>` | container respawn |
 | Frontend (`dev` mode) | save | Vite HMR |
 | Frontend (`built` mode) | `./dev-compose.sh build frontend` | nginx auto |
 | Frontend (`ghcr` mode) | switch modes | — |
@@ -310,7 +310,7 @@ Build targets:
 
 ```bash
 ./dev-compose.sh build api-gateway     # Rust gateway
-./dev-compose.sh build analytics-api   # Rust analytics
+./dev-compose.sh build analytics   # Rust analytics
 ./dev-compose.sh build identity        # .NET 9 publish
 ./dev-compose.sh build frontend        # pnpm build → dist/
 ./dev-compose.sh build rust            # both Rust services
@@ -344,7 +344,7 @@ watchexec wants, and `useradd -m` ensures `appuser` has a usable
 
 ```bash
 # Tail logs
-docker compose logs -f api-gateway analytics-api identity
+docker compose logs -f api-gateway analytics identity
 
 # Inspect databases
 docker compose exec mariadb mariadb -uinsight -pinsight-local identity
@@ -394,7 +394,7 @@ tables, every `src/ingestion/scripts/migrations/*.sql` applied
 (produces the `insight.*` gold views), ~24k rows across 16 silver
 tables profile-typed per team (`class_git_*` for devs, `class_crm_*`
 for sales, …). The full per-team activity table is in
-[`deploy/seed/profiles.py`](deploy/seed/profiles.py). analytics-api's
+[`deploy/seed/profiles.py`](deploy/seed/profiles.py). analytics's
 schema validator flips from "80 metrics error" to "80 ok".
 
 ### Compose
@@ -442,12 +442,12 @@ PLACEHOLDERS_SQL=./sql/placeholders.sql \
 MIGRATIONS_DIR=../../src/ingestion/scripts/migrations \
   .venv/bin/python seed.py all
 
-# 3. Kick analytics-api so its schema validator re-runs against the
+# 3. Kick analytics so its schema validator re-runs against the
 #    now-populated silver tables. Without this, schema_status stays
 #    cached at boot-time 'table_not_found' and the FE shows "no peer
 #    data" everywhere (cf/insight#1307).
 KUBECONFIG=/path/to/config.yaml kubectl -n insight \
-  rollout restart deploy/insight-analytics-api
+  rollout restart deploy/insight-analytics
 
 # 4. Stop the port-forwards.
 kill %1 %2
diff --git a/README.md b/README.md
index 08c975c76..3e7bc99f3 100644
--- a/README.md
+++ b/README.md
@@ -322,7 +322,7 @@ For cluster deployments image tags flow through automatically: the umbrella char
 | Image | Source repo | Tags |
 |---|---|---|
 | `insight-api-gateway` | `constructorfabric/insight` (this repo) | https://github.com/constructorfabric/insight/pkgs/container/insight-api-gateway |
-| `insight-analytics-api` | this repo | https://github.com/constructorfabric/insight/pkgs/container/insight-analytics-api |
+| `insight-analytics` | this repo | https://github.com/constructorfabric/insight/pkgs/container/insight-analytics |
 | `insight-identity` | this repo | https://github.com/constructorfabric/insight/pkgs/container/insight-identity |
 | `insight-toolbox` | this repo | https://github.com/constructorfabric/insight/pkgs/container/insight-toolbox |
 | `insight-front` | **separate** `constructorfabric/insight-front` | https://github.com/constructorfabric/insight/pkgs/container/insight-front |
diff --git a/charts/insight/Chart.lock b/charts/insight/Chart.lock
index 73090083f..d6170d23a 100644
--- a/charts/insight/Chart.lock
+++ b/charts/insight/Chart.lock
@@ -2,14 +2,14 @@ dependencies:
 - name: insight-api-gateway
   repository: file://../../src/backend/services/api-gateway/helm
   version: 0.1.0
-- name: insight-analytics-api
-  repository: file://../../src/backend/services/analytics-api/helm
-  version: 0.1.0
+- name: insight-analytics
+  repository: file://../../src/backend/services/analytics/helm
+  version: 0.2.0
 - name: insight-identity
   repository: file://../../src/backend/services/identity/helm
   version: 0.1.0
 - name: insight-frontend
   repository: file://../../src/frontend/helm
   version: 0.1.0
-digest: sha256:7556fa96a2d4a77c01f410c944290f88f8bf0d701a7ffe55dbcc7da1cfe58c38
-generated: "2026-06-22T13:27:58.875272+02:00"
+digest: sha256:fe702b3761feeb33328e51945c6f0a6f8c293250b53317e31349b45a4cdf89f3
+generated: "2026-07-03T10:49:33.322019+02:00"
diff --git a/charts/insight/Chart.yaml b/charts/insight/Chart.yaml
index 6b8f5e581..df3376e36 100644
--- a/charts/insight/Chart.yaml
+++ b/charts/insight/Chart.yaml
@@ -5,7 +5,7 @@
 ## Emits almost nothing on its own — it orchestrates subcharts.
 ##
 ## What is INCLUDED here:
-##   - Application: api-gateway, analytics-api, identity, frontend
+##   - Application: api-gateway, analytics, identity, frontend
 ##
 ## What is NOT included (deployed separately):
 ##   - L2 infra (ClickHouse, MariaDB, Redis, Redpanda) — deployed as
@@ -24,7 +24,7 @@ type: application
 # version    — packaging version of the chart. Bump on EVERY chart change.
 # appVersion — product version. Matches the image tag of all insight-* images.
 # Release pipeline: git tag v0.1.0 → version=0.1.0, appVersion="0.1.0".
-version: 0.2.49
+version: 0.3.0
 appVersion: "2026.07.02.16.10-dbe992a"
 kubeVersion: ">=1.27.0-0"
 home: https://github.com/constructorfabric/insight
@@ -64,10 +64,10 @@ dependencies:
     alias: apiGateway
     version: "0.1.0"
     repository: "file://../../src/backend/services/api-gateway/helm"
-  - name: insight-analytics-api
-    alias: analyticsApi
-    version: "0.1.0"
-    repository: "file://../../src/backend/services/analytics-api/helm"
+  - name: insight-analytics
+    alias: analytics
+    version: "0.2.0"
+    repository: "file://../../src/backend/services/analytics/helm"
   # Identity — .NET 9 service that reads from the MariaDB `persons` table
   # (per identity ADR-0002). Gated because it needs `persons` populated
   # by the seed pipeline.
diff --git a/charts/insight/README.md b/charts/insight/README.md
index fc0101d52..9039bcac9 100644
--- a/charts/insight/README.md
+++ b/charts/insight/README.md
@@ -14,7 +14,7 @@ local `file://` subchart:
 | Component             | Kind                 | Source                                       | Toggle                          |
 |-----------------------|----------------------|----------------------------------------------|---------------------------------|
 | API Gateway           | app service (req'd)  | `src/backend/services/api-gateway/helm`      | mandatory (no flag)             |
-| Analytics API         | app service (req'd)  | `src/backend/services/analytics-api/helm`    | mandatory (no flag)             |
+| Analytics             | app service (req'd)  | `src/backend/services/analytics/helm`        | mandatory (no flag)             |
 | Frontend (SPA)        | app service (req'd)  | `src/frontend/helm`                          | mandatory (no flag)             |
 | Identity (.NET 9)     | app service (opt)    | `src/backend/services/identity/helm`         | `identity.deploy`               |
 
@@ -35,7 +35,7 @@ See [`docs/distribution/README.md`](../../docs/distribution/README.md) for the f
 
 **This chart assumes release name = `insight`.**
 
-Internal DNS references between app services (e.g. `http://insight-analytics-api:8081`, `http://insight-identity:8082`) are templated with the `insight-` prefix. Helm subcharts use `{{ .Release.Name }}-{chart-suffix}` for service naming, which produces these exact names when the release is `insight`. (External L2 infra is reached via the explicit `<dep>.host` wiring, not the release-name convention.)
+Internal DNS references between app services (e.g. `http://insight-analytics:8081`, `http://insight-identity:8082`) are templated with the `insight-` prefix. Helm subcharts use `{{ .Release.Name }}-{chart-suffix}` for service naming, which produces these exact names when the release is `insight`. (External L2 infra is reached via the explicit `<dep>.host` wiring, not the release-name convention.)
 
 If you install under a different name, override all cross-service URLs in your own values.yaml. Prefer sticking to the convention.
 
@@ -90,7 +90,7 @@ Key groups:
 - `credentials.autoGenerate` — toggle umbrella-managed `insight-db-creds`
 - `global.*` — cluster-wide defaults (pull secrets, storage class)
 - `<dep>.host` / `<dep>.port` / `<dep>.passwordSecret` (Redpanda: `<dep>.brokers`) — external-infra wiring for ClickHouse, MariaDB, Redis, Redpanda
-- `apiGateway` / `analyticsApi` / `frontend` — **mandatory** app services (no deploy-flag; the gateway is the single entrance and the product is one unit)
+- `apiGateway` / `analytics` / `frontend` — **mandatory** app services (no deploy-flag; the gateway is the single entrance and the product is one unit)
 - `identity.deploy` — **optional** .NET identity service (off by default; not an OIDC provider)
 - `apiGateway.oidc` — OIDC configuration (prefer `existingSecret`; inline requires `issuer` + `clientId` + `redirectUri` together)
 - `apiGateway.proxy.routes` — reverse-proxy config to downstream services
diff --git a/charts/insight/templates/NOTES.txt b/charts/insight/templates/NOTES.txt
index 5e4d0143e..4c99baf11 100644
--- a/charts/insight/templates/NOTES.txt
+++ b/charts/insight/templates/NOTES.txt
@@ -16,7 +16,7 @@ Resolved infra endpoints (external L2, see ConfigMap {{ .Release.Name }}-platfor
 
 Application services (always-on):
   ✓ API Gateway        http://{{ include "insight.apiGateway.host" . }}:8080
-  ✓ Analytics API      http://{{ include "insight.analyticsApi.host" . }}:8081
+  ✓ Analytics          http://{{ include "insight.analytics.host" . }}:8081
   ✓ Frontend           http://{{ include "insight.frontend.host" . }}:80
 {{- if .Values.identity.deploy }}
   ✓ Identity           http://{{ include "insight.identity.host" . }}:8082  (deployed)
diff --git a/charts/insight/templates/_helpers.tpl b/charts/insight/templates/_helpers.tpl
index a96ab3361..5e4388c08 100644
--- a/charts/insight/templates/_helpers.tpl
+++ b/charts/insight/templates/_helpers.tpl
@@ -125,7 +125,7 @@ http://{{ .Values.airbyte.releaseName }}-airbyte-server-svc.{{ .Release.Namespac
 App services are mandatory umbrella components — no deploy flag.
 */}}
 {{- define "insight.apiGateway.host"          -}}{{- printf "%s-api-gateway"          .Release.Name -}}{{- end -}}
-{{- define "insight.analyticsApi.host"        -}}{{- printf "%s-analytics-api"        .Release.Name -}}{{- end -}}
+{{- define "insight.analytics.host"           -}}{{- printf "%s-analytics"            .Release.Name -}}{{- end -}}
 {{- define "insight.identity.host"            -}}{{- printf "%s-identity"             .Release.Name -}}{{- end -}}
 {{- define "insight.frontend.host"            -}}{{- printf "%s-frontend"             .Release.Name -}}{{- end -}}
 
diff --git a/charts/insight/templates/clickhouse-init-svcdbs-job.yaml b/charts/insight/templates/clickhouse-init-svcdbs-job.yaml
index 7336083a2..d3867f0a9 100644
--- a/charts/insight/templates/clickhouse-init-svcdbs-job.yaml
+++ b/charts/insight/templates/clickhouse-init-svcdbs-job.yaml
@@ -15,7 +15,7 @@ separate root in this chart's contract. The external CH MUST grant the
 service user CREATE DATABASE — that's the operator-side contract.
 
 Hook timing: `pre-install,pre-upgrade`. Mirrors the MariaDB Hook —
-the DB must exist BEFORE application pods that read it (analytics-api,
+the DB must exist BEFORE application pods that read it (analytics,
 ingestion workflows) start, otherwise helm `--wait` blocks on their
 CrashLoopBackOff'd pods until timeout and never reaches post-*
 hooks.
diff --git a/charts/insight/templates/clickhouse-migrate-job.yaml b/charts/insight/templates/clickhouse-migrate-job.yaml
index 981da7d15..39bf65613 100644
--- a/charts/insight/templates/clickhouse-migrate-job.yaml
+++ b/charts/insight/templates/clickhouse-migrate-job.yaml
@@ -19,7 +19,7 @@ the HTTP backend in lib/ch-exec.sh).
 Hook timing: `post-install,post-upgrade`. The post-* phase runs after the
 main release (so the `clickhouse-init-svcdbs` pre-install Hook has created
 the app database and the app pods have rolled). post-* over pre-* is safe
-because gold-view consumers (analytics-api) resolve VIEW source tables
+because gold-view consumers (analytics) resolve VIEW source tables
 lazily at query time, so views materialising shortly after pod startup is
 fine. (hook-weight "5" is inert today — it only orders hooks within the
 same phase, and this is currently the only post-* hook; kept as a
diff --git a/charts/insight/templates/platform-config.yaml b/charts/insight/templates/platform-config.yaml
index ce173e8dc..364cbcb9d 100644
--- a/charts/insight/templates/platform-config.yaml
+++ b/charts/insight/templates/platform-config.yaml
@@ -55,10 +55,10 @@ data:
   AIRBYTE_JWT_SECRET_KEY:   {{ .Values.airbyte.jwtSecret.key   | quote }}
 
   # ─── App service hosts (for sidecars and debugging) ───
-  INSIGHT_API_GATEWAY_HOST:   {{ include "insight.apiGateway.host"   . | quote }}
-  INSIGHT_ANALYTICS_API_HOST: {{ include "insight.analyticsApi.host" . | quote }}
-  INSIGHT_IDENTITY_HOST:      {{ include "insight.identity.host"     . | quote }}
-  INSIGHT_FRONTEND_HOST:      {{ include "insight.frontend.host"     . | quote }}
+  INSIGHT_API_GATEWAY_HOST: {{ include "insight.apiGateway.host" . | quote }}
+  INSIGHT_ANALYTICS_HOST:   {{ include "insight.analytics.host"  . | quote }}
+  INSIGHT_IDENTITY_HOST:    {{ include "insight.identity.host"   . | quote }}
+  INSIGHT_FRONTEND_HOST:    {{ include "insight.frontend.host"   . | quote }}
 
   # ─── Observability (emission contract) ───
   # JSON-to-stdout is always on; this is the log level plus, when an OTLP
diff --git a/charts/insight/templates/secrets.yaml b/charts/insight/templates/secrets.yaml
index f21fde310..d6c5d657f 100644
--- a/charts/insight/templates/secrets.yaml
+++ b/charts/insight/templates/secrets.yaml
@@ -8,9 +8,9 @@ The umbrella provisions two (or three) Secrets per install:
      (mariadb, redis, clickhouse). Keys match the field names the app
      services and init-DB Hook Jobs read.
 
-  2. `insight-analytics-api-config` — pre-assembled env vars for the
-     analytics-api Rust service, including a full
-     `APP__gears__analytics_api__config__database_url` that embeds the
+  2. `insight-analytics-config` — pre-assembled env vars for the
+     analytics Rust service, including a full
+     `APP__gears__analytics__config__database_url` that embeds the
      MariaDB password.
 
   3. `insight-identity-config` — identical pattern for the .NET identity
@@ -33,7 +33,7 @@ and SKIPS emitting its own Secret template — Helm therefore never tries
 to take ownership of the customer's Secret and the install no longer
 fails with `invalid ownership metadata`. The chart still uses `lookup`
 to read the BYO values for composing the per-service config Secrets
-(`insight-analytics-api-config`, `insight-identity-config`).
+(`insight-analytics-config`, `insight-identity-config`).
 
 If any of the four required keys is empty or missing on a BYO Secret,
 the install FAILS FAST with a readable message instead of silently
@@ -99,7 +99,7 @@ Secret.
 {{- /* Compose Redis URL: bitnami/redis sets a password by default in the
        umbrella-managed install, but external Redis (deploy=false with
        a stock-config server) may have auth disabled. Emit a userless URL
-       in that case so the analytics-api client doesn't send `AUTH`. */ -}}
+       in that case so the analytics client doesn't send `AUTH`. */ -}}
 {{- $redisHost := include "insight.redis.host" . -}}
 {{- $redisPort := include "insight.redis.port" . -}}
 {{- $redisUrl  := printf "redis://%s:%v" $redisHost $redisPort -}}
@@ -138,43 +138,42 @@ stringData:
 apiVersion: v1
 kind: Secret
 metadata:
-  name: insight-analytics-api-config
+  name: insight-analytics-config
   labels:
     {{- include "insight.labels" . | nindent 4 }}
 type: Opaque
 stringData:
   # gears-rust host config. These APP__* env vars override the leaf values
-  # in the mounted config YAML (the analytics-api chart's configmap.yaml);
-  # the gears structure + auth_disabled host live there. Prefix changed from
-  # `ANALYTICS__*` to `APP__gears__analytics_api__config__*`
-  # (toolkit Env::prefixed("APP__").split("__")). Hyphenated env-var names are
-  # delivered via envFrom, same as api-gateway's `APP__gears__oidc-authn-plugin__*`.
+  # in the mounted config YAML (the analytics chart's configmap.yaml);
+  # the gears structure + auth_disabled host live there. Env prefix is
+  # `APP__gears__analytics__config__*` (gear config key `analytics`,
+  # toolkit Env::prefixed("APP__").split("__")).
   #
   # Full DSN, password interpolated from generated credentials. No silent
   # defaults — `required` on every field the operator MUST supply (username,
   # database). Passwords come from `insight-db-creds`.
   # user/password percent-encoded (urlquery) so operator credentials with
   # `:`/`@`/`/`/`%` produce a valid DSN — matches the identity DSN below.
-  APP__gears__analytics_api__config__database_url: {{ printf "mysql://%s:%s@%s:%v/%s"
+  APP__gears__analytics__config__database_url: {{ printf "mysql://%s:%s@%s:%v/%s"
     (required "mariadb.username is required" .Values.mariadb.username | urlquery)
     ($mdbPass | urlquery)
     (include "insight.mariadb.host" .)
     (include "insight.mariadb.port" .)
     (include "insight.mariadb.database" .)
     | quote }}
-  APP__gears__analytics_api__config__clickhouse_url:      {{ include "insight.clickhouse.url" . | quote }}
-  APP__gears__analytics_api__config__clickhouse_database: {{ include "insight.clickhouse.database" . | quote }}
-  APP__gears__analytics_api__config__clickhouse_user:     {{ required "clickhouse.username is required" .Values.clickhouse.username | quote }}
-  APP__gears__analytics_api__config__clickhouse_password: {{ $chPass | quote }}
-  APP__gears__analytics_api__config__identity_url:        {{ printf "http://%s:8082" (include "insight.identity.host" .) | quote }}
-  APP__gears__analytics_api__config__redis_url:           {{ $redisUrl | quote }}
+  APP__gears__analytics__config__clickhouse_url:      {{ include "insight.clickhouse.url" . | quote }}
+  APP__gears__analytics__config__clickhouse_database: {{ include "insight.clickhouse.database" . | quote }}
+  APP__gears__analytics__config__clickhouse_user:     {{ required "clickhouse.username is required" .Values.clickhouse.username | quote }}
+  APP__gears__analytics__config__clickhouse_password: {{ $chPass | quote }}
+  APP__gears__analytics__config__identity_url:        {{ printf "http://%s:8082" (include "insight.identity.host" .) | quote }}
+  APP__gears__analytics__config__redis_url:           {{ $redisUrl | quote }}
   {{- with (default "" (default dict .Values.global).tenantDefaultId) }}
   # Single-tenant fallback for the Metric Catalog (DESIGN §2.2
   # `cpt-metric-cat-constraint-tenant-default`). Sourced from
   # `global.tenantDefaultId` — single source of truth across api-gateway,
-  # identity, and analytics-api. Only emitted when non-empty so
+  # identity, and analytics. Only emitted when non-empty so
   # multi-tenant installs leave the resolver strict.
-  APP__gears__analytics_api__config__metric_catalog__tenant_default_id: {{ . | quote }}
+  APP__gears__analytics__config__metric_catalog__tenant_default_id: {{ . | quote }}
   {{- end }}
 
 {{- if .Values.identity.deploy }}
@@ -188,7 +187,7 @@ metadata:
 type: Opaque
 stringData:
   # The .NET identity service owns its own MariaDB database (per ADR-0006)
-  # — separate from the analytics-api `insight` database — and applies its
+  # — separate from the analytics `insight` database — and applies its
   # own DbUp migrations against it at startup. The umbrella provisions the
   # empty database against the external L2 MariaDB via the pre-install
   # Hook Job (templates/mariadb-init-svcdbs-job.yaml), which CREATEs the
@@ -211,7 +210,7 @@ stringData:
     | quote }}
   {{- with (default "" (default dict .Values.global).tenantDefaultId) }}
   # Sourced from `global.tenantDefaultId` — see the secrets.yaml comment on
-  # APP__gears__analytics_api__config__metric_catalog__tenant_default_id
+  # APP__gears__analytics__config__metric_catalog__tenant_default_id
   # above for the cross-service contract.
   IDENTITY__identity__tenant_default_id: {{ . | quote }}
   {{- end }}
diff --git a/charts/insight/values.schema.json b/charts/insight/values.schema.json
index 9529843f6..d0cf08f32 100644
--- a/charts/insight/values.schema.json
+++ b/charts/insight/values.schema.json
@@ -115,7 +115,7 @@
       ]
     },
 
-    "analyticsApi":       { "$ref": "#/definitions/appService" },
+    "analytics":          { "$ref": "#/definitions/appService" },
     "identity":           { "$ref": "#/definitions/appService" },
     "frontend":           { "$ref": "#/definitions/appService" },
 
diff --git a/charts/insight/values.yaml b/charts/insight/values.yaml
index dd994fa90..f94c52d20 100644
--- a/charts/insight/values.yaml
+++ b/charts/insight/values.yaml
@@ -33,7 +33,7 @@
 ##    These are just strings the consumers (and the pre-install init-DB
 ##    Hook Jobs) read — the umbrella never runs the dep itself.
 ##
-## 4. Core app services (apiGateway, analyticsApi, frontend) are MANDATORY
+## 4. Core app services (apiGateway, analytics, frontend) are MANDATORY
 ##    components of the umbrella — no deploy-flag. The gateway is the
 ##    only entrance to the cluster internals; the other services are
 ##    reachable only through it. This matches the Constructor Platform
@@ -105,13 +105,13 @@ global:
   #      tenant claim).
   #   2. `IDENTITY__identity__tenant_default_id` env var on the identity
   #      service (its ConfigTenantContext fallback).
-  #   3. `APP__gears__analytics_api__config__metric_catalog__tenant_default_id`
-  #      env var on the analytics-api (Metric Catalog single-tenant fallback).
+  #   3. `APP__gears__analytics__config__metric_catalog__tenant_default_id`
+  #      env var on the analytics (Metric Catalog single-tenant fallback).
   # Set this to the UUID your `persons` / `account_person_map` /
   # `org_chart` data was seeded under (i.e. the
   # `insight_tenant_id` value in ClickHouse `identity_inputs`). Empty =
   # multi-tenant mode: the api-gateway falls back to the chart's hard
-  # default; identity and analytics-api leave the resolver strict and
+  # default; identity and analytics leave the resolver strict and
   # return 400 tenant_unresolved for header-less callers. Visible to all
   # subcharts (Helm propagates `global.*` automatically), so subchart
   # templates read `.Values.global.tenantDefaultId` directly.
@@ -349,26 +349,26 @@ apiGateway:
         # Templated — `tpl` evaluates this at install time so `.Release.Name`
         # resolves to the umbrella's release name. Override with a literal
         # URL (no template syntax) to point at an external service.
-        upstream: 'http://{{ .Release.Name }}-analytics-api:8081'
+        upstream: 'http://{{ .Release.Name }}-analytics:8081'
         public: false
       - prefix: "/identity"
         upstream: 'http://{{ .Release.Name }}-identity:8082'
         public: false
-# ─── Analytics API ───────────────────────────────────────────────────────
-analyticsApi:
+# ─── Analytics ────────────────────────────────────────────────────────────
+analytics:
   replicaCount: 2
   image:
-    repository: ghcr.io/constructorfabric/insight-analytics-api
+    repository: ghcr.io/constructorfabric/insight-analytics
     tag: "" # MUST be set (e.g. "0.1.0")
     pullPolicy: IfNotPresent
   resources:
     requests: {cpu: 100m, memory: 128Mi}
     limits: {cpu: 500m, memory: 512Mi}
-  # The umbrella generates `insight-analytics-api-config` with every
-  # APP__gears__analytics_api__config__* env var filled in from the
+  # The umbrella generates `insight-analytics-config` with every
+  # APP__gears__analytics__config__* env var filled in from the
   # auto-generated credentials (see templates/secrets.yaml). The subchart
   # consumes it via envFrom (overriding its mounted config ConfigMap).
-  existingSecret: "insight-analytics-api-config"
+  existingSecret: "insight-analytics-config"
   # Metric Catalog single-tenant fallback comes from
   # `global.tenantDefaultId` (DESIGN §2.2 cpt-metric-cat-constraint-tenant-
   # default). The session-bound tenant from the gateway ALWAYS wins; this
diff --git a/cypilot/config/artifacts.toml b/cypilot/config/artifacts.toml
index 04b8cced4..16a72cf03 100644
--- a/cypilot/config/artifacts.toml
+++ b/cypilot/config/artifacts.toml
@@ -615,7 +615,7 @@ name = "ADR-0003: Use insight_tenant_id Instead of tenant_id"
 
 [[systems.artifacts]]
 kind = "DESIGN"
-path = "src/backend/services/analytics-api/specs/DESIGN.md"
+path = "docs/components/backend/analytics/DESIGN.md"
 name = "Analytics API Design"
 traceability = "DOCS-ONLY"
 
diff --git a/deploy/compose/clickhouse-user-defaults.xml b/deploy/compose/clickhouse-user-defaults.xml
index bdf63da3a..da1ff7168 100644
--- a/deploy/compose/clickhouse-user-defaults.xml
+++ b/deploy/compose/clickhouse-user-defaults.xml
@@ -2,7 +2,7 @@
 <!--
   ClickHouse profile override mounted into /etc/clickhouse-server/users.d/.
 
-  The analytics-api Rust service issues LEFT JOIN queries against the
+  The analytics Rust service issues LEFT JOIN queries against the
   gold `insight.*` views with `join_use_nulls=1`, but those views are
   CREATEd by our seed-sample migrations with the default (0). When the
   two disagree, CH 24+ rejects the query:
diff --git a/deploy/gitops/README.md b/deploy/gitops/README.md
index 8294226ac..cc1ab2507 100644
--- a/deploy/gitops/README.md
+++ b/deploy/gitops/README.md
@@ -55,7 +55,7 @@ deploy/gitops/
     ├── doctor.sh                # invoked by `make doctor`
     ├── render-diff.sh           # invoked by `make diff`
     ├── secret-fetch.sh          # password-manager stub for `make seal-secret`
-    ├── compose-app-secrets.sh   # derives insight-{analytics-api,identity}-config from insight-db-creds
+    ├── compose-app-secrets.sh   # derives insight-{analytics,identity}-config from insight-db-creds
     └── airbyte-setup.sh         # post-install Airbyte setup-wizard automation
 ```
 
@@ -183,7 +183,7 @@ make system-status       ENV=local   # what's installed in insight-infra
 
 # L3 — the umbrella app. Only touches the `insight` namespace. Applies
 # every L3 sealed manifest, waits for `insight-db-creds` to materialise,
-# composes the derived `insight-analytics-api-config` +
+# composes the derived `insight-analytics-config` +
 # `insight-identity-config` Secrets, then helm-upgrades. Image tags are
 # inherited from the umbrella chart's appVersion — no per-service tag
 # overrides are needed in values.yaml for the sandbox path.
diff --git a/deploy/gitops/environments/functional-ci/values.yaml b/deploy/gitops/environments/functional-ci/values.yaml
index 6c295d1b2..77806a455 100644
--- a/deploy/gitops/environments/functional-ci/values.yaml
+++ b/deploy/gitops/environments/functional-ci/values.yaml
@@ -37,7 +37,7 @@ apiGateway:
   ingress:
     enabled: false
 
-analyticsApi:
+analytics:
   replicaCount: 1
 
 identity:
diff --git a/deploy/gitops/environments/local/sealed-secrets/insight/insight-db-creds-sealedsecret.yaml.template b/deploy/gitops/environments/local/sealed-secrets/insight/insight-db-creds-sealedsecret.yaml.template
index ca4433ff8..7f80791a2 100644
--- a/deploy/gitops/environments/local/sealed-secrets/insight/insight-db-creds-sealedsecret.yaml.template
+++ b/deploy/gitops/environments/local/sealed-secrets/insight/insight-db-creds-sealedsecret.yaml.template
@@ -4,7 +4,7 @@
 # workflow that generates a real, cluster-specific sealed manifest.
 #
 # `insight-db-creds` lives in the L3 `insight` namespace and is
-# consumed by the umbrella's app subcharts (api-gateway, analytics-api,
+# consumed by the umbrella's app subcharts (api-gateway, analytics,
 # identity) via `existingSecret`. The passwords here MUST match the
 # ones used by the L2 services in `insight-infra` for the same env.
 apiVersion: bitnami.com/v1alpha1
diff --git a/deploy/gitops/environments/local/values.yaml.template b/deploy/gitops/environments/local/values.yaml.template
index 8e581a722..1e31687a0 100644
--- a/deploy/gitops/environments/local/values.yaml.template
+++ b/deploy/gitops/environments/local/values.yaml.template
@@ -15,7 +15,7 @@
 # Gitops contract: `insight-db-creds` is pre-sealed in the `insight`
 # namespace, fetched by `scripts/secret-fetch.sh` with resource name
 # `insight-local-insight-db-creds`. The two composed Secrets the chart
-# references via existingSecret — `insight-analytics-api-config` and
+# references via existingSecret — `insight-analytics-config` and
 # `insight-identity-config` — are derived from `insight-db-creds` + the
 # L2 hosts/ports below by `scripts/compose-app-secrets.sh` (invoked
 # from `apply-app-secrets`, a `deploy-insight` prereq). No chart-side
@@ -27,9 +27,9 @@ credentials:
 
 global:
   storageClass: local-path
-  # Single-tenant fallback for the analytics-api metric-catalog resolver
+  # Single-tenant fallback for the analytics metric-catalog resolver
   # (compose-app-secrets.sh reads .global.tenantDefaultId → emits
-  # APP__gears__analytics_api__config__metric_catalog__tenant_default_id).
+  # APP__gears__analytics__config__metric_catalog__tenant_default_id).
   # Set to the seeded demo tenant so the catalog resolves AND dashboards
   # populate. (Note: under the gears-rust auth-disabled host the gateway
   # injects toolkit-security's DEFAULT_TENANT_ID — the same UUID below — and
@@ -106,7 +106,7 @@ apiGateway:
     requests: { cpu: 50m, memory: 128Mi }
     limits:   { cpu: 500m, memory: 512Mi }
 
-analyticsApi:
+analytics:
   replicaCount: 1
   resources:
     requests: { cpu: 50m, memory: 128Mi }
diff --git a/deploy/gitops/scripts/compose-app-secrets.sh b/deploy/gitops/scripts/compose-app-secrets.sh
index 4e1d18bdf..a8dc84c5f 100755
--- a/deploy/gitops/scripts/compose-app-secrets.sh
+++ b/deploy/gitops/scripts/compose-app-secrets.sh
@@ -1,6 +1,6 @@
 #!/usr/bin/env bash
 #
-# compose-app-secrets.sh — derive insight-analytics-api-config and
+# compose-app-secrets.sh — derive insight-analytics-config and
 # insight-identity-config from the credentials already materialised in
 # the cluster's `insight-db-creds` Secret, plus the L2 service hosts
 # declared in environments/<env>/values.yaml.
@@ -27,7 +27,7 @@
 #   .redis.host      .redis.port
 #   .identity.databaseName       (defaults to "identity")
 #   .global.tenantDefaultId      (optional; empty disables the resolver
-#                                 on both identity and analytics-api.
+#                                 on both identity and analytics.
 #                                 Single source of truth for the
 #                                 single-tenant UUID — matches the
 #                                 chart's `global.tenantDefaultId` knob
@@ -113,7 +113,7 @@ fi
 apiVersion: v1
 kind: Secret
 metadata:
-  name: insight-analytics-api-config
+  name: insight-analytics-config
   namespace: $NS_APP
   annotations:
     # Tell helm to leave this Secret alone on upgrade/uninstall — the
@@ -121,32 +121,32 @@ metadata:
     # mode), and this script owns its lifecycle. Without keep, helm
     # sees the Secret in the prior release's manifest, finds it absent
     # from the new release's manifest, and deletes it mid-upgrade —
-    # causing analytics-api init container to fail with "Secret not
+    # causing analytics init container to fail with "Secret not
     # found" and the upgrade to time out + roll back.
     helm.sh/resource-policy: keep
 type: Opaque
 stringData:
   # gears-rust host config: leaf values override the mounted config YAML.
-  # Prefix is APP__gears__analytics_api__config__ (toolkit Env::prefixed),
-  # replacing the old ANALYTICS__ prefix. Note: no backticks in these
-  # heredoc comments -- the heredoc is unquoted (for \${..} expansion), so
-  # backticks would be run as commands.
-  APP__gears__analytics_api__config__database_url: "mysql://${MDB_USER}:${MDB_PW}@${MDB_HOST}:${MDB_PORT}/${MDB_DB}"
-  APP__gears__analytics_api__config__clickhouse_url: "http://${CH_HOST}:${CH_PORT}"
-  APP__gears__analytics_api__config__clickhouse_database: "${CH_DB}"
-  APP__gears__analytics_api__config__clickhouse_user: "${CH_USER}"
-  APP__gears__analytics_api__config__clickhouse_password: "${CH_PW}"
-  APP__gears__analytics_api__config__identity_url: "http://${RELEASE}-identity:8082"
-  APP__gears__analytics_api__config__redis_url: "${REDIS_URL}"
+  # Prefix is APP__gears__analytics__config__ (toolkit Env::prefixed, gear
+  # config key "analytics"). Note: no backticks in these heredoc comments --
+  # the heredoc is unquoted (for \${..} expansion), so backticks would be
+  # run as commands.
+  APP__gears__analytics__config__database_url: "mysql://${MDB_USER}:${MDB_PW}@${MDB_HOST}:${MDB_PORT}/${MDB_DB}"
+  APP__gears__analytics__config__clickhouse_url: "http://${CH_HOST}:${CH_PORT}"
+  APP__gears__analytics__config__clickhouse_database: "${CH_DB}"
+  APP__gears__analytics__config__clickhouse_user: "${CH_USER}"
+  APP__gears__analytics__config__clickhouse_password: "${CH_PW}"
+  APP__gears__analytics__config__identity_url: "http://${RELEASE}-identity:8082"
+  APP__gears__analytics__config__redis_url: "${REDIS_URL}"
 EOF
   # Metric Catalog single-tenant fallback. Mirrors the chart-side block
   # (charts/insight/templates/secrets.yaml) — emit only when set so
   # multi-tenant installs keep the resolver strict.
   if [ -n "$TENANT_DEFAULT" ] && [ "$TENANT_DEFAULT" != "null" ]; then
-    echo "  APP__gears__analytics_api__config__metric_catalog__tenant_default_id: \"${TENANT_DEFAULT}\""
+    echo "  APP__gears__analytics__config__metric_catalog__tenant_default_id: \"${TENANT_DEFAULT}\""
   fi
 } | kubectl -n "$NS_APP" apply -f - >/dev/null
-echo "composed → $NS_APP/insight-analytics-api-config"
+echo "composed → $NS_APP/insight-analytics-config"
 
 # `insight-identity-config` carries the .NET identity service's
 # IDENTITY__* config. The service applies its own DbUp migrations
@@ -162,7 +162,7 @@ metadata:
   name: insight-identity-config
   namespace: $NS_APP
   annotations:
-    helm.sh/resource-policy: keep   # see analytics-api-config rationale above
+    helm.sh/resource-policy: keep   # see analytics-config rationale above
 type: Opaque
 stringData:
   IDENTITY__mariadb__url: "mysql://${MDB_USER}:${MDB_PW}@${MDB_HOST}:${MDB_PORT}/${IDENTITY_DB}"
diff --git a/deploy/gitops/secrets-store.yaml.template b/deploy/gitops/secrets-store.yaml.template
index ae37d3f10..98970fafe 100644
--- a/deploy/gitops/secrets-store.yaml.template
+++ b/deploy/gitops/secrets-store.yaml.template
@@ -51,7 +51,7 @@ insight-local-redis-creds: |
     redis-password: "REPLACE_REDIS_PASSWORD"
 
 ## insight-db-creds — consumed by the L3 umbrella chart's app subcharts
-## (api-gateway, analytics-api, identity). The passwords here MUST match
+## (api-gateway, analytics, identity). The passwords here MUST match
 ## the ones used by the L2 services above for the same env, since the
 ## app dials those services with the same credentials.
 insight-local-insight-db-creds: |
diff --git a/deploy/gitops/system/grafana/values.yaml b/deploy/gitops/system/grafana/values.yaml
index 764cb7f77..60495157c 100644
--- a/deploy/gitops/system/grafana/values.yaml
+++ b/deploy/gitops/system/grafana/values.yaml
@@ -140,7 +140,7 @@ dashboards:
              "datasource": {"type": "loki", "uid": "loki"},
              "options": {"showTime": true, "wrapLogMessage": true, "sortOrder": "Descending"},
              "targets": [
-               {"refId": "A", "expr": "{namespace=\"insight\", container=~\"api-gateway|analytics-api|identity\"} |= \"ERROR\""}
+               {"refId": "A", "expr": "{namespace=\"insight\", container=~\"api-gateway|analytics|identity\"} |= \"ERROR\""}
              ]}
           ]
         }
diff --git a/deploy/gitops/system/redis/SECRETS.md b/deploy/gitops/system/redis/SECRETS.md
index 3ec9127cb..f03d26b4a 100644
--- a/deploy/gitops/system/redis/SECRETS.md
+++ b/deploy/gitops/system/redis/SECRETS.md
@@ -70,5 +70,5 @@ chart picks up the new password from the updated Secret:
 kubectl -n insight-infra rollout restart statefulset/redis-master
 ```
 
-analytics-api reconnects on its next request — no app-side restart
+analytics reconnects on its next request — no app-side restart
 needed if it uses connection pooling with retry.
diff --git a/deploy/gitops/system/redis/values.yaml b/deploy/gitops/system/redis/values.yaml
index aaac856a4..03a7a97bf 100644
--- a/deploy/gitops/system/redis/values.yaml
+++ b/deploy/gitops/system/redis/values.yaml
@@ -9,7 +9,7 @@
 ##
 ## App layer reaches this release as
 ## `redis-master.insight-infra.svc.cluster.local:6379`.
-## Used by analytics-api as query-response cache.
+## Used by analytics as query-response cache.
 ##
 
 fullnameOverride: redis
@@ -24,7 +24,7 @@ image:
   registry: docker.io
   repository: bitnamilegacy/redis
 
-# Standalone (no replicas) — analytics-api only needs a cache; a Redis
+# Standalone (no replicas) — analytics only needs a cache; a Redis
 # failover topology adds complexity without buying much for this use.
 # Flip in a per-env overlay (architecture: replication, replica: …) if
 # a customer requires HA.
diff --git a/deploy/seed/silver.py b/deploy/seed/silver.py
index 1631111f2..fa7674461 100644
--- a/deploy/seed/silver.py
+++ b/deploy/seed/silver.py
@@ -46,7 +46,7 @@ def _ch_client() -> clickhouse_connect.driver.client.Client:
     port = int(os.environ.get("CLICKHOUSE_HTTP_PORT", "8123"))
     user = os.environ.get("CLICKHOUSE_USER", "insight")
     pwd = os.environ.get("CLICKHOUSE_PASSWORD", "insight-local")
-    # CRITICAL: analytics-api queries with join_use_nulls=1, so views must
+    # CRITICAL: analytics queries with join_use_nulls=1, so views must
     # be CREATED with the same setting — otherwise the view's declared
     # column types disagree with what the query sees at runtime
     # ("Nullable column having not Nullable type in structure").
diff --git a/dev-compose.sh b/dev-compose.sh
index c3f28d180..c22ed2beb 100755
--- a/dev-compose.sh
+++ b/dev-compose.sh
@@ -101,7 +101,7 @@ services to ghcr images, then `docker compose up -d`.
 Options:
   --from-ghcr=svc1,svc2     Pull these backend services from ghcr instead
                             of building. Recognised: api-gateway,
-                            analytics-api, identity.
+                            analytics, identity.
   --build-only=svc1,svc2    Build only these; everything else from ghcr.
   --frontend-mode=MODE      Override FRONTEND_MODE for this run.
                             (dev | built | ghcr)
@@ -164,12 +164,12 @@ cmd_up() {
   FRONTEND_MODE="${FRONTEND_MODE:-dev}"
 
   # ── Resolve which services go to ghcr ────────────────────────────
-  local all_backend="api-gateway analytics-api identity"
+  local all_backend="api-gateway analytics identity"
   local ghcr_list=""
   local build_list=""
 
   [[ -n "${API_GATEWAY_IMAGE:-}"   ]] && ghcr_list=$(add "$ghcr_list" api-gateway)
-  [[ -n "${ANALYTICS_API_IMAGE:-}" ]] && ghcr_list=$(add "$ghcr_list" analytics-api)
+  [[ -n "${ANALYTICS_IMAGE:-}" ]] && ghcr_list=$(add "$ghcr_list" analytics)
   [[ -n "${IDENTITY_IMAGE:-}"      ]] && ghcr_list=$(add "$ghcr_list" identity)
 
   if [[ -n "$from_ghcr_csv" ]]; then
@@ -189,7 +189,7 @@ cmd_up() {
   fi
 
   contains "$ghcr_list" api-gateway   && [[ -z "${API_GATEWAY_IMAGE:-}"   ]] && export API_GATEWAY_IMAGE="ghcr.io/constructorfabric/insight-api-gateway:${API_GATEWAY_GHCR_TAG:-latest}"
-  contains "$ghcr_list" analytics-api && [[ -z "${ANALYTICS_API_IMAGE:-}" ]] && export ANALYTICS_API_IMAGE="ghcr.io/constructorfabric/insight-analytics-api:${ANALYTICS_API_GHCR_TAG:-latest}"
+  contains "$ghcr_list" analytics && [[ -z "${ANALYTICS_IMAGE:-}" ]] && export ANALYTICS_IMAGE="ghcr.io/constructorfabric/insight-analytics:${ANALYTICS_GHCR_TAG:-latest}"
   contains "$ghcr_list" identity      && [[ -z "${IDENTITY_IMAGE:-}"      ]] && export IDENTITY_IMAGE="ghcr.io/constructorfabric/insight-identity:${IDENTITY_GHCR_TAG:-latest}"
   true
 
@@ -242,8 +242,8 @@ YML
   if [[ "$skip_build" != "true" ]]; then
     echo "=== Building artefacts (skip with --skip-build) ==="
     local rust_bins=""
-    contains "$ghcr_list" api-gateway   || rust_bins="$rust_bins insight-api-gateway"
-    contains "$ghcr_list" analytics-api || rust_bins="$rust_bins analytics-api"
+    contains "$ghcr_list" api-gateway || rust_bins="$rust_bins insight-api-gateway"
+    contains "$ghcr_list" analytics   || rust_bins="$rust_bins analytics"
     rust_bins=$(trim "$rust_bins")
     if [[ -n "$rust_bins" ]]; then
       echo "--- Rust:$rust_bins"
@@ -256,9 +256,9 @@ YML
           apt-get update && apt-get install -y --no-install-recommends \
             protobuf-compiler libprotobuf-dev pkg-config libssl-dev > /dev/null
           cargo build --release$bin_flags
-          mkdir -p /out/api-gateway /out/analytics-api
+          mkdir -p /out/api-gateway /out/analytics
           [ -f /target/release/insight-api-gateway ] && install -m 0755 /target/release/insight-api-gateway /out/api-gateway/insight-api-gateway || true
-          [ -f /target/release/analytics-api ]       && install -m 0755 /target/release/analytics-api       /out/analytics-api/analytics-api || true
+          [ -f /target/release/analytics ]           && install -m 0755 /target/release/analytics           /out/analytics/analytics || true
         "
     fi
     if ! contains "$ghcr_list" identity; then
@@ -375,7 +375,7 @@ pick it up via ENABLE_AUTO_RELOAD.
 
 Targets:
   api-gateway        Rust gateway binary only.
-  analytics-api      Rust analytics binary only.
+  analytics          Rust analytics binary only.
   identity           .NET 9 publish output.
   frontend           pnpm build → dist/.
   rust               Both Rust services.
@@ -404,20 +404,20 @@ cmd_build() {
       apt-get update && apt-get install -y --no-install-recommends \
         protobuf-compiler libprotobuf-dev pkg-config libssl-dev > /dev/null
       cargo build --release$bin_flags
-      mkdir -p /out/api-gateway /out/analytics-api
+      mkdir -p /out/api-gateway /out/analytics
       [ -f /target/release/insight-api-gateway ] && install -m 0755 /target/release/insight-api-gateway /out/api-gateway/insight-api-gateway || true
-      [ -f /target/release/analytics-api ]       && install -m 0755 /target/release/analytics-api       /out/analytics-api/analytics-api || true
+      [ -f /target/release/analytics ]           && install -m 0755 /target/release/analytics           /out/analytics/analytics || true
     "
   }
 
   case "$target" in
-    api-gateway)   build_rust_bins insight-api-gateway ;;
-    analytics-api) build_rust_bins analytics-api ;;
-    rust)          build_rust_bins insight-api-gateway analytics-api ;;
-    identity)      "${compose_cmd[@]}" run --rm build-dotnet ;;
-    frontend)      "${compose_cmd[@]}" run --rm build-frontend ;;
+    api-gateway) build_rust_bins insight-api-gateway ;;
+    analytics)   build_rust_bins analytics ;;
+    rust)        build_rust_bins insight-api-gateway analytics ;;
+    identity)    "${compose_cmd[@]}" run --rm build-dotnet ;;
+    frontend)    "${compose_cmd[@]}" run --rm build-frontend ;;
     all)
-      build_rust_bins insight-api-gateway analytics-api
+      build_rust_bins insight-api-gateway analytics
       "${compose_cmd[@]}" run --rm build-dotnet
       "${compose_cmd[@]}" run --rm build-frontend
       ;;
@@ -441,7 +441,7 @@ Populate the demo dataset. Stack must be up first.
              ~24k rows of 60-day per-team activity in ClickHouse.
   all        Both (default if no arg).
 
-After `silver` or `all` runs, analytics-api is restarted so its
+After `silver` or `all` runs, analytics is restarted so its
 metric-catalog schema validator re-checks the freshly-populated tables.
 Without that bounce, every metric stays cached at the boot-time
 `schema_status='error'`, the FE flags every bullet row schema_error=true,
@@ -467,22 +467,22 @@ cmd_seed() {
   [[ ${#args[@]} -eq 0 ]] && args=("all")
 
   # Run the seed step itself. NOT `exec` — we still want to bounce
-  # analytics-api after silver/all completes (see cf/insight#1307).
+  # analytics after silver/all completes (see cf/insight#1307).
   "${compose_cmd[@]}" --profile seed run --rm seed-sample "${args[@]}"
   local seed_status=$?
   if [[ $seed_status -ne 0 ]]; then
     return $seed_status
   fi
 
-  # Restart analytics-api when ClickHouse data was touched. Its schema
+  # Restart analytics when ClickHouse data was touched. Its schema
   # validator caches schema_status at startup and never re-checks; without
   # this nudge the catalog keeps serving the pre-seed 'table_not_found'
   # verdict and the FE shows "no peer data" everywhere.
   case "${args[0]}" in
     silver|all)
       echo
-      echo "=== restarting analytics-api so it re-validates schema (cf/insight#1307) ==="
-      "${compose_cmd[@]}" restart analytics-api >/dev/null
+      echo "=== restarting analytics so it re-validates schema (cf/insight#1307) ==="
+      "${compose_cmd[@]}" restart analytics >/dev/null
       ;;
   esac
 }
diff --git a/docker-compose.yml b/docker-compose.yml
index d3eeb2e97..aae5a3803 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -13,7 +13,7 @@
 #
 # Layout:
 #   * infra services  : mariadb, clickhouse, redis, redpanda
-#   * backend         : api-gateway, analytics-api, identity
+#   * backend         : api-gateway, analytics, identity
 #   * frontend        : ONE of insight-front-{dev,built,ghcr}, selected by
 #                       FRONTEND_MODE (profile-gated)
 #   * builders        : build-rust, build-dotnet, build-frontend
@@ -175,7 +175,7 @@ services:
   #
   # All three use the EXISTING service Dockerfiles (modified to bundle
   # docker-entrypoint.sh + watchexec). For ghcr mode, set
-  # API_GATEWAY_IMAGE / ANALYTICS_API_IMAGE / IDENTITY_IMAGE to a registry
+  # API_GATEWAY_IMAGE / ANALYTICS_IMAGE / IDENTITY_IMAGE to a registry
   # ref in .env.compose — the dev-compose.sh up script generates an
   # override that drops `build:` and the bind-mount for affected services.
 
@@ -218,13 +218,13 @@ services:
     ports:
       - "${API_GATEWAY_PORT:-8080}:8080"
 
-  analytics-api:
+  analytics:
     <<: *backend-common
-    image: ${ANALYTICS_API_IMAGE:-insight-analytics-api:dev}
-    container_name: insight-analytics-api
+    image: ${ANALYTICS_IMAGE:-insight-analytics:dev}
+    container_name: insight-analytics
     build:
       context: src/backend
-      dockerfile: services/analytics-api/Dockerfile
+      dockerfile: services/analytics/Dockerfile
     depends_on:
       # required: false → compose skips this dependency when the local
       # profile isn't active (external MariaDB / ClickHouse modes).
@@ -233,33 +233,33 @@ services:
       redis:      { condition: service_healthy }
     environment:
       <<: *backend-env
-      # analytics-api now runs on the gears-rust host: structural config
+      # analytics runs on the gears-rust host: structural config
       # (gears list, api-gateway REST host w/ auth_disabled) lives in the
-      # bind-mounted config/insight.yaml; these APP__* env vars override the
-      # deployment-specific leaf values. Prefix CHANGED from `ANALYTICS__*`
-      # to `APP__gears__analytics_api__config__*` (toolkit `Env::prefixed`).
-      APP__gears__analytics_api__config__database_url:       "mysql://${MARIADB_USER:-insight}:${MARIADB_PASSWORD:-insight-local}@${MARIADB_HOST:-mariadb}:${MARIADB_INTERNAL_PORT:-3306}/analytics"
-      APP__gears__analytics_api__config__clickhouse_url:     "http://${CLICKHOUSE_HOST:-clickhouse}:${CLICKHOUSE_INTERNAL_HTTP_PORT:-8123}"
-      APP__gears__analytics_api__config__clickhouse_database: "${CLICKHOUSE_DATABASE:-insight}"
-      APP__gears__analytics_api__config__clickhouse_user:    "${CLICKHOUSE_USER:-insight}"
-      APP__gears__analytics_api__config__clickhouse_password: "${CLICKHOUSE_PASSWORD:-insight-local}"
-      APP__gears__analytics_api__config__identity_url:       "http://identity:8082"
-      APP__gears__analytics_api__config__redis_url:          "redis://redis:6379"
-      APP__gears__analytics_api__config__metric_catalog__tenant_default_id: "${TENANT_DEFAULT_ID:-00000000-df51-5b42-9538-d2b56b7ee953}"
+      # bind-mounted config/insight.yaml; these APP__gears__analytics__config__*
+      # env vars (toolkit `Env::prefixed`, gear config key `analytics`)
+      # override the deployment-specific leaf values.
+      APP__gears__analytics__config__database_url:       "mysql://${MARIADB_USER:-insight}:${MARIADB_PASSWORD:-insight-local}@${MARIADB_HOST:-mariadb}:${MARIADB_INTERNAL_PORT:-3306}/analytics"
+      APP__gears__analytics__config__clickhouse_url:     "http://${CLICKHOUSE_HOST:-clickhouse}:${CLICKHOUSE_INTERNAL_HTTP_PORT:-8123}"
+      APP__gears__analytics__config__clickhouse_database: "${CLICKHOUSE_DATABASE:-insight}"
+      APP__gears__analytics__config__clickhouse_user:    "${CLICKHOUSE_USER:-insight}"
+      APP__gears__analytics__config__clickhouse_password: "${CLICKHOUSE_PASSWORD:-insight-local}"
+      APP__gears__analytics__config__identity_url:       "http://identity:8082"
+      APP__gears__analytics__config__redis_url:          "redis://redis:6379"
+      APP__gears__analytics__config__metric_catalog__tenant_default_id: "${TENANT_DEFAULT_ID:-00000000-df51-5b42-9538-d2b56b7ee953}"
     volumes:
-      - ./deploy/compose/build/analytics-api/analytics-api:/app/analytics-api:ro
+      - ./deploy/compose/build/analytics/analytics:/app/analytics:ro
       # Mount the gears config so YAML edits don't require an image rebuild
       # (mirrors api-gateway). watchexec restarts the binary on change.
-      - ./src/backend/services/analytics-api/config:/app/config:ro
+      - ./src/backend/services/analytics/config:/app/config:ro
     command:
-      - "/app/analytics-api"   # <watched path>
+      - "/app/analytics"   # <watched path>
       - "--"
-      - "/app/analytics-api"
+      - "/app/analytics"
       - "-c"
       - "/app/config/insight.yaml"
       - "run"
     ports:
-      - "${ANALYTICS_API_PORT:-8081}:8081"
+      - "${ANALYTICS_PORT:-8081}:8081"
 
   identity:
     <<: *backend-common
@@ -412,10 +412,10 @@ services:
       - |
         set -eux
         apt-get update && apt-get install -y --no-install-recommends protobuf-compiler libprotobuf-dev pkg-config libssl-dev > /dev/null
-        cargo build --release --bin insight-api-gateway --bin analytics-api
-        mkdir -p /out/api-gateway /out/analytics-api
+        cargo build --release --bin insight-api-gateway --bin analytics
+        mkdir -p /out/api-gateway /out/analytics
         install -m 0755 /target/release/insight-api-gateway /out/api-gateway/insight-api-gateway
-        install -m 0755 /target/release/analytics-api      /out/analytics-api/analytics-api
+        install -m 0755 /target/release/analytics           /out/analytics/analytics
 
   build-dotnet:
     profiles: ["build"]
diff --git a/docs/components/backend/analytics-api/DESIGN.md b/docs/components/backend/analytics/DESIGN.md
similarity index 99%
rename from docs/components/backend/analytics-api/DESIGN.md
rename to docs/components/backend/analytics/DESIGN.md
index 4582080ba..7258e6aed 100644
--- a/docs/components/backend/analytics-api/DESIGN.md
+++ b/docs/components/backend/analytics/DESIGN.md
@@ -558,7 +558,7 @@ See CLEAR-DESIGN.md section 7 for details.
 
 - **Backend PRD**: `docs/components/backend/specs/PRD.md`
 - **Backend DESIGN**: `docs/components/backend/specs/DESIGN.md`
-- **CLEAR-DESIGN**: `src/backend/services/analytics-api/CLEAR-DESIGN.md`
+- **CLEAR-DESIGN**: `src/backend/services/analytics/CLEAR-DESIGN.md`
 - **Frontend Data Requirements**: `docs/components/backend/specs/analytics-views-api.md`
 
 | Design Element | Requirement |
diff --git a/docs/components/backend/analytics-api/openapi.json b/docs/components/backend/analytics/openapi.json
similarity index 100%
rename from docs/components/backend/analytics-api/openapi.json
rename to docs/components/backend/analytics/openapi.json
diff --git a/docs/components/backend/api-gateway/router/DESIGN.md b/docs/components/backend/api-gateway/router/DESIGN.md
index dbfdc09fb..b5e1ba600 100644
--- a/docs/components/backend/api-gateway/router/DESIGN.md
+++ b/docs/components/backend/api-gateway/router/DESIGN.md
@@ -583,7 +583,7 @@ defaults:
     - Forwarded
 routes:
   - prefix: /api/v1/analytics
-    upstream: http://analytics-api.insight.svc.cluster.local:8080
+    upstream: http://analytics.insight.svc.cluster.local:8080
     timeout_ms: 60000
     strip_prefix: false
 
@@ -606,7 +606,7 @@ routes:
     upstream: http://audit-service.insight.svc.cluster.local:8080
 
   - prefix: /api/v1/stream
-    upstream: http://analytics-api.insight.svc.cluster.local:8080
+    upstream: http://analytics.insight.svc.cluster.local:8080
     websocket: true
     timeout_ms: 0
     # Per-route override for the global gateway.websocket_max_lifetime_seconds.
diff --git a/docs/components/backend/identity-resolution/identity/specs/ADR/0009-post-profile-with-uniqueness-invariant.md b/docs/components/backend/identity-resolution/identity/specs/ADR/0009-post-profile-with-uniqueness-invariant.md
index 8d019f07d..ba42a68b5 100644
--- a/docs/components/backend/identity-resolution/identity/specs/ADR/0009-post-profile-with-uniqueness-invariant.md
+++ b/docs/components/backend/identity-resolution/identity/specs/ADR/0009-post-profile-with-uniqueness-invariant.md
@@ -102,7 +102,7 @@ partition `(tenant, person, source_type, source_id, value_type)`
 ### Consequences
 
 - Phase 1 `GET /v1/persons/{email}` stays unchanged — existing
-  callers (analytics-api, frontend via api-gateway proxy) continue
+  callers (the analytics service, frontend via api-gateway proxy) continue
   to work; migration to POST is a per-caller refactor over time.
 - Data-invariant violations surface as 422 in production — operators
   see real signal when the seed pipeline produces ambiguous rows.
diff --git a/docs/components/backend/identity-resolution/identity/specs/DESIGN.md b/docs/components/backend/identity-resolution/identity/specs/DESIGN.md
index c8473f562..440d69b49 100644
--- a/docs/components/backend/identity-resolution/identity/specs/DESIGN.md
+++ b/docs/components/backend/identity-resolution/identity/specs/DESIGN.md
@@ -91,7 +91,7 @@ Architecture-shaping decisions are captured as ADRs in
 
 | Requirement | Design Response |
 |-------------|-----------------|
-| [`cpt-insightspec-nfr-identity-latency`](PRD.md#p95-lookup-latency) | Single-row covered-index lookup (`idx_value_id`) + connection pooling via MySqlConnector; pool max size tuned to 16 (smaller than analytics-api per design review). |
+| [`cpt-insightspec-nfr-identity-latency`](PRD.md#p95-lookup-latency) | Single-row covered-index lookup (`idx_value_id`) + connection pooling via MySqlConnector; pool max size tuned to 16 (smaller than the analytics service per design review). |
 | [`cpt-insightspec-nfr-identity-memory`](PRD.md#memory-budget-without-caching) | No in-memory cache; helm `resources.limits.memory: 384Mi`; query results streamed via `DbDataReader`. |
 | [`cpt-insightspec-nfr-identity-logging-pii`](PRD.md#structured-json-logs-with-pii-redaction) | Serilog `CompactJsonFormatter`; `UseSerilogRequestLogging` `EnrichDiagnosticContext` callback rewrites `RequestPath` for `/v1/persons/*` to `/v1/persons/<redacted>`; exception handler emits sanitised `db_target` for DB exceptions only. |
 | [`cpt-insightspec-nfr-identity-uuid-roundtrip`](PRD.md#binary16-uuid-round-trip) | All `Guid` parameters bound via `MySqlParameter { MySqlDbType = MySqlDbType.Binary, Size = 16, Value = guid.ToByteArray() }`; reads use `reader.GetBytes` → `new Guid(byte[])`. Integration test pins the round-trip. |
@@ -686,7 +686,7 @@ separate aggregate concept, use the suffix exception.
 | `IDENTITY__mariadb__url` | _none_ (required) | `mysql://user:pass@host:port/db`; percent-encoding allowed for users / passwords. Mutually exclusive with `connection_string`. |
 | `IDENTITY__mariadb__connection_string` | _none_ | Raw MySqlConnector KV form for callers needing options the URL shape cannot express. |
 | `IDENTITY__mariadb__min_pool_size` | 0 | Lazily opens connections. |
-| `IDENTITY__mariadb__max_pool_size` | 16 | Smaller than analytics-api per design review. |
+| `IDENTITY__mariadb__max_pool_size` | 16 | Smaller than the analytics service per design review. |
 | `IDENTITY__identity__bind_addr` | `0.0.0.0:8082` | Listener address. |
 | `IDENTITY__identity__tenant_default_id` | _empty_ | Optional; opt-in for single-tenant clusters. |
 | `IDENTITY__identity__expand_subordinates` | `false` | Phase 2 toggle (recursive supervisor walk). |
diff --git a/docs/components/backend/identity-resolution/identity/specs/PRD.md b/docs/components/backend/identity-resolution/identity/specs/PRD.md
index 7012e0691..b06fea3d8 100644
--- a/docs/components/backend/identity-resolution/identity/specs/PRD.md
+++ b/docs/components/backend/identity-resolution/identity/specs/PRD.md
@@ -393,7 +393,7 @@ across all sources for a tenant". A violation indicates a corrupted
 problem and risk wrong-person responses. 422 (RFC 9110 §15.5.21
 "semantically correct request, server cannot process due to
 data state") matches the cyberfabric platform convention used by
-analytics-api for similar invariant breaches.
+the analytics service for similar invariant breaches.
 
 **Actors**: `cpt-insightspec-actor-platform-sre`
 
diff --git a/docs/components/backend/specs/DESIGN.md b/docs/components/backend/specs/DESIGN.md
index deafc2057..701a3682d 100644
--- a/docs/components/backend/specs/DESIGN.md
+++ b/docs/components/backend/specs/DESIGN.md
@@ -701,7 +701,7 @@ https://insight.customer.com/
 
 Ingress routing rules:
 - `/` → frontend (nginx)
-- `/api/v1/analytics/*` → analytics-api service
+- `/api/v1/analytics/*` → analytics service
 - `/api/v1/connectors/*` → connector-manager service
 - `/api/v1/identity/*` → identity-service
 - `/api/v1/alerts/*` → alerts-service
@@ -1100,7 +1100,7 @@ Bundled Prometheus + Grafana + Alertmanager stack for platform operators.
 
 Each service has its own Helm chart (co-located at `services/{name}/helm/`). Shared infrastructure has separate charts under `infra/`. ArgoCD deploys each as an independent Application. Works on any K8s cluster (AWS EKS, GCP GKE, Azure AKS, on-prem).
 
-**Per-service Helm chart structure** (e.g., `services/analytics-api/helm/`):
+**Per-service Helm chart structure** (e.g., `services/analytics/helm/`):
 
 ```text
 helm/
@@ -1221,7 +1221,7 @@ Tenant Admin can trigger Silver/Gold rebuild from Bronze via Connector Manager 
 ```text
 insight/
 ├── services/
-│   ├── analytics-api/
+│   ├── analytics/
 │   │   ├── src/
 │   │   ├── helm/                      # Service-specific Helm chart
 │   │   │   ├── Chart.yaml
diff --git a/docs/components/connectors/support/zendesk/specs/PRD.md b/docs/components/connectors/support/zendesk/specs/PRD.md
index ad1857103..391a26c62 100644
--- a/docs/components/connectors/support/zendesk/specs/PRD.md
+++ b/docs/components/connectors/support/zendesk/specs/PRD.md
@@ -179,7 +179,7 @@ The Zendesk connector closes this gap by ingesting support activity into the sam
 - Extraction of the agent directory (agents and admins) for identity resolution
 - Extraction of per-ticket Ticket Audits (`support_ticket_events`) from `GET /api/v2/tickets/{id}/audits`, driving actor-attributed activity (updates, public/private comments, solved-ticket counts)
 - The slim key-only parent stream (`support_ticket_ids`) that fans the audit substream out (`ticket_id` + `updated_at` only) to keep the CDK parent-record cache small
-- Silver `class_support_activity` person×date rollup + shared dims + Gold support metrics (`support_bullet_rows` / `support_person_period` / `support_company_stats`) + analytics-api Support metric sets + a frontend "Support" dashboard section
+- Silver `class_support_activity` person×date rollup + shared dims + Gold support metrics (`support_bullet_rows` / `support_person_period` / `support_company_stats`) + analytics Support metric sets + a frontend "Support" dashboard section
 - K8s Secret-based credential management following the Insight connector secret format
 - Bronze-layer table schemas for all Phase 1 streams
 
diff --git a/docs/components/connectors/support/zendesk/zendesk.md b/docs/components/connectors/support/zendesk/zendesk.md
index 3362bca41..97d76e4dd 100644
--- a/docs/components/connectors/support/zendesk/zendesk.md
+++ b/docs/components/connectors/support/zendesk/zendesk.md
@@ -324,9 +324,9 @@ Event classification (in `zendesk__support_event`): Comment+public→`public_com
 - 7 metric keys: `support_active`, `support_updates`, `support_public_comments`, `support_private_comments`, `support_solved`, `support_csat_good`, `support_csat_total`. (`support_kb` intentionally not emitted — ComingSoon via catalog.)
 - `support_active` = 1 only when actor activity that day (`updates + public_comments + private_comments + solved > 0`); a CSAT-only day does NOT count as active. Rolls up via max (person) / sum→count-of-active-members (company).
 - `support_solved` = distinct tickets (label "Solved tickets").
-- CSAT % = Σgood / Σtotal, computed in the analytics-api `query_ref`.
+- CSAT % = Σgood / Σtotal, computed in the analytics `query_ref`.
 
-**Downstream (shipped)**: analytics-api Support metric sets (Team/IC) + `metric_catalog` + thresholds; a frontend "Support" dashboard section. Also: ticket-volume / CSAT-distribution analytics from `support_tickets` + `zendesk_satisfaction_ratings`.
+**Downstream (shipped)**: analytics Support metric sets (Team/IC) + `metric_catalog` + thresholds; a frontend "Support" dashboard section. Also: ticket-volume / CSAT-distribution analytics from `support_tickets` + `zendesk_satisfaction_ratings`.
 
 ---
 
diff --git a/docs/components/deployment/gitops/README.md b/docs/components/deployment/gitops/README.md
index a376b6b20..edacdb567 100644
--- a/docs/components/deployment/gitops/README.md
+++ b/docs/components/deployment/gitops/README.md
@@ -131,7 +131,7 @@ Insight on Kubernetes is split into three deploy layers. Each layer has its own
 |------|---------|-----------|---------------|-------------------------------------------|
 | **L0 — Bootstrap** | Cluster prerequisites. Installs sealed-secrets-controller, ingress-nginx, cert-manager (and any cluster-scoped issuers/CRDs); creates the `insight-infra` and `insight` namespaces. | cluster-scoped | `make bootstrap ENV=<env>` (idempotent) | `bootstrap/<env>/` |
 | **L2 — System** | Shared stateful infrastructure: MariaDB, ClickHouse, Redis, Redpanda + Redpanda Console, Airbyte, Argo Workflows. **One Helm release per service.** Each service can also be replaced by a managed external endpoint (RDS, MSK, etc.) — in which case its `system/<service>/` is simply not installed and the app values point at the external host. | `insight-infra` (one per cluster, shared by every app deploy on that cluster) | manually, deliberately. Either `cd system/<service> && helm upgrade --install …` for a values-only release, or `make system-<service> ENV=<env>` when a sealed-secret needs to be created/refreshed in the same step. | `system/<service>/` (base) + `environments/<env>/<service>-values.yaml` (per-env overlay) + `environments/<env>/sealed-secrets/insight-infra/` |
-| **L3 — App** | The Insight platform itself: api-gateway, analytics-api, identity-resolution, frontend. The umbrella chart, app services only — no infra subcharts. | `insight` (one Insight install per cluster; ENV selects the **cluster**, not the namespace) | `make deploy-app ENV=<env>` (alias `make deploy`); pulls the umbrella chart from `oci://ghcr.io/constructorfabric/charts/insight` pinned to `.insight-version`. | `environments/<env>/values.yaml` + `environments/<env>/sealed-secrets/insight/` |
+| **L3 — App** | The Insight platform itself: api-gateway, analytics, identity-resolution, frontend. The umbrella chart, app services only — no infra subcharts. | `insight` (one Insight install per cluster; ENV selects the **cluster**, not the namespace) | `make deploy-app ENV=<env>` (alias `make deploy`); pulls the umbrella chart from `oci://ghcr.io/constructorfabric/charts/insight` pinned to `.insight-version`. | `environments/<env>/values.yaml` + `environments/<env>/sealed-secrets/insight/` |
 
 There is no L1. The numbering is reserved: cluster + node provisioning (k3s install, kubelet config, OS) sit conceptually below L0 and are out of scope for this SPEC.
 
@@ -152,7 +152,7 @@ For one cluster carrying environment `<env>`:
 | `ingress-nginx` | L0 | ingress-nginx controller |
 | `cert-manager` | L0 | cert-manager + webhook + cainjector |
 | `insight-infra` | L2 | mariadb, clickhouse, redis, redpanda, redpanda-console, airbyte, argo-workflows (each as its own Helm release) |
-| `insight` | L3 | the umbrella chart (api-gateway, analytics-api, identity-resolution, frontend) |
+| `insight` | L3 | the umbrella chart (api-gateway, analytics, identity-resolution, frontend) |
 
 Each cluster hosts exactly one Insight install. The cluster's identity (which env it represents) lives in the kube-context name (`insight-<env>`) and the gitops repo's `environments/<env>/` directory — not in the namespace. Operationally this keeps the two well-known namespace names (`insight`, `insight-infra`) the same across every install — including the local cluster (`ENV=local`) — and matches any external chart consumer's expectation of a single `insight` release.
 
@@ -263,7 +263,7 @@ The workflow:
    export TAG="$(date -u +%Y.%m.%d.%H.%M)-$(echo "${GITHUB_SHA}" | cut -c1-7)"
    ```
 3. Logs in to GHCR with the workflow's `GITHUB_TOKEN` (no PAT).
-4. For each service (api-gateway, analytics-api, frontend, identity-resolution, …):
+4. For each service (api-gateway, analytics, frontend, identity-resolution, …):
    - `docker buildx build --platform linux/amd64,linux/arm64 -t ghcr.io/constructorfabric/insight-<service>:${TAG} .`
    - `docker push ghcr.io/constructorfabric/insight-<service>:${TAG}`
 5. Optionally pushes `:latest` for `main` builds (consumed only by local dev, never by the poller).
diff --git a/docs/components/deployment/specs/ADR/0001-chart-publishing-on-merge.md b/docs/components/deployment/specs/ADR/0001-chart-publishing-on-merge.md
index 57d53ff3f..5796a8af6 100644
--- a/docs/components/deployment/specs/ADR/0001-chart-publishing-on-merge.md
+++ b/docs/components/deployment/specs/ADR/0001-chart-publishing-on-merge.md
@@ -109,7 +109,7 @@ The gitops repo's Makefile resolves `$CHART` to `../insight/charts/insight` -- a
 
 ### Per-service OCI chart publishing
 
-Each subchart is published independently to its own OCI repo: `oci://ghcr.io/constructorfabric/charts/insight-api-gateway:<tag>`, `…/insight-analytics-api:<tag>`, etc. The umbrella references them as remote dependencies.
+Each subchart is published independently to its own OCI repo: `oci://ghcr.io/constructorfabric/charts/insight-api-gateway:<tag>`, `…/insight-analytics:<tag>`, etc. The umbrella references them as remote dependencies.
 
 * Good, because finest possible granularity.
 * Good, because subcharts can be consumed outside the umbrella.
diff --git a/docs/components/deployment/specs/DESIGN.md b/docs/components/deployment/specs/DESIGN.md
index 9eee78573..0e2df7979 100644
--- a/docs/components/deployment/specs/DESIGN.md
+++ b/docs/components/deployment/specs/DESIGN.md
@@ -110,7 +110,7 @@ Tenant separation across customers is at the **cluster boundary** for gitops pro
                   │ Insight umbrella chart                              │
                   │  - subcharts: clickhouse, mariadb, redis, redpanda  │
                   │              (gated by <svc>.deploy)                │
-                  │              api-gateway, analytics-api, frontend   │
+                  │              api-gateway, analytics, frontend       │
                   │              identity-resolution (opt)              │
                   │  - bridges:  {release}-platform ConfigMap           │
                   │              ingestion WorkflowTemplates            │
@@ -233,7 +233,7 @@ The published `ghcr.io/constructorfabric/insight-front` image ships only a linux
 
 - [ ] `p3` - **ID**: `cpt-insightspec-constraint-dep-release-name-default`
 
-The canonical `values.yaml` hard-codes the `insight-` prefix in a handful of app-service inline URLs (for example `analyticsApi.database.url`). Installing under a non-default release name requires overriding those URLs in an overlay. The long-term migration to `envFrom: {release}-platform` removes this constraint; noted as an open item.
+The canonical `values.yaml` hard-codes the `insight-` prefix in a handful of app-service inline URLs (for example `analytics.database.url`). Installing under a non-default release name requires overriding those URLs in an overlay. The long-term migration to `envFrom: {release}-platform` removes this constraint; noted as an open item.
 
 **ADRs**: none.
 
@@ -285,7 +285,7 @@ graph TB
         RD[redis]
         RP[redpanda]
         APIGW[apiGateway]
-        AA[analyticsApi]
+        AA[analytics]
         FE[frontend]
         IR[identityResolution]
     end
@@ -453,7 +453,7 @@ Day-to-day backend / frontend work needs a fast loop with no Kubernetes overhead
 
 ##### Responsibility scope
 
-- Runs `docker-compose.yml`: api-gateway + analytics-api (Rust) + identity (.NET 9) + frontend, plus bundled MariaDB / ClickHouse / Redis / Redpanda containers.
+- Runs `docker-compose.yml`: api-gateway + analytics (Rust) + identity (.NET 9) + frontend, plus bundled MariaDB / ClickHouse / Redis / Redpanda containers.
 - Builds the backend services and (optionally) the frontend in builder containers — no Rust / .NET / Node toolchain on the host. Per-service `<SVC>_IMAGE` overrides in `.env.compose` (or `--from-ghcr=<svc>`) pull a published image instead of building.
 - Auto-reloads each backend service in ~1 second on rebuild via `watchexec` when `ENABLE_AUTO_RELOAD=true` (compose-only; never set in a Kubernetes manifest).
 - Auto-seeds a demo dataset (identity + silver) on first `up`, tracked via `SEEDED_LOCAL_*` markers in `.env.compose`.
@@ -493,7 +493,7 @@ Day-to-day backend / frontend work needs a fast loop with no Kubernetes overhead
 | redis | `redis.deploy`, `redis.host`, `redis.port`, `redis.passwordSecret.{name,key}` | Unified shape. | unstable |
 | redpanda | `redpanda.deploy`, `redpanda.brokers`, `redpanda.tls.*`, `redpanda.auth.sasl.*` | Unified shape. | unstable |
 | apiGateway | `apiGateway.replicaCount`, `apiGateway.image.*`, `apiGateway.oidc.*`, `apiGateway.authDisabled`, `apiGateway.ingress.*`, `apiGateway.proxy.routes` | Mandatory API Gateway service. | unstable |
-| analyticsApi | `analyticsApi.replicaCount`, `analyticsApi.image.*` | Mandatory Analytics API service; reads DB/Redis/CH coordinates from auto-generated `insight-analytics-api-config` Secret. | unstable |
+| analytics | `analytics.replicaCount`, `analytics.image.*` | Mandatory Analytics API service; reads DB/Redis/CH coordinates from auto-generated `insight-analytics-config` Secret. | unstable |
 | identityResolution | `identityResolution.deploy`, `identityResolution.replicaCount`, `identityResolution.image.*` | Optional Identity Resolution stub (off by default). | unstable |
 | frontend | `frontend.replicaCount`, `frontend.image.*`, `frontend.ingress.*`, `frontend.oidc.*` | Mandatory Frontend SPA. | unstable |
 
@@ -544,7 +544,7 @@ Per-tag artifacts are immutable; the Chart Publishing CI does not overwrite. GHC
 | Dependency Module | Interface Used | Purpose |
 |-------------------|----------------|---------|
 | `src/backend/services/api-gateway/helm` | Helm subchart | Mandatory app service shipped under `apiGateway` alias. |
-| `src/backend/services/analytics-api/helm` | Helm subchart | Mandatory app service shipped under `analyticsApi` alias. |
+| `src/backend/services/analytics/helm` | Helm subchart | Mandatory app service shipped under `analytics` alias. |
 | `src/backend/services/identity/helm` | Helm subchart | Optional identity-resolution stub under `identityResolution` alias. |
 | `src/frontend/helm` | Helm subchart | Mandatory SPA shipped under `frontend` alias. |
 | `charts/insight/templates/ingestion/*.yaml` | First-class Helm templates | Ingestion WorkflowTemplate sources, gated by `ingestion.templates.enabled`; consume umbrella helpers directly via `include`. |
@@ -745,10 +745,10 @@ Not applicable. The Deployment subsystem stores no data; it produces a chart art
 
 - **Chart publishing auto-commit-back branch-protection token.** The default `GITHUB_TOKEN` cannot bypass branch protection on `main`; until a fine-grained PAT in `RELEASE_PUSH_PAT` or a GitHub App with bypass rights is configured, the version-bump auto-commit must be replayed manually after merge. Tracked.
 - **Frontend image tag in publish CI.** The publish-chart workflow does not bump the frontend image tag because frontend source lives in the separate `constructorfabric/insight-front` repo. Env overlays pin frontend's tag manually. Fix: emit a workflow-dispatch hook in the publish-chart job that accepts a `frontend_tag` input. Tracked as a chart-side SPEC §8 follow-up.
-- **`required` short-circuits subchart `image.tag` defaulting.** Despite the umbrella's design saying "image.tag empty → use chart appVersion", subchart deployment templates use `required` without `default`, so env overlays must pin `image.tag` explicitly for api-gateway / analytics-api / identity-resolution / frontend. Replace `required` with `default .Chart.AppVersion`. Tracked as a chart-side SPEC §8 follow-up.
+- **`required` short-circuits subchart `image.tag` defaulting.** Despite the umbrella's design saying "image.tag empty → use chart appVersion", subchart deployment templates use `required` without `default`, so env overlays must pin `image.tag` explicitly for api-gateway / analytics / identity-resolution / frontend. Replace `required` with `default .Chart.AppVersion`. Tracked as a chart-side SPEC §8 follow-up.
 - **Per-service DB provisioning Helm hook for layered mode.** The chart's `identity-db-init-job.yaml` runs only when `mariadb.deploy: true` (single-namespace fat mode). In the layered model (`mariadb.deploy: false` + external L2 MariaDB), engineers run a one-time `CREATE DATABASE identity` + `GRANT` against L2 mariadb. Fix: pre-install/pre-upgrade Helm hook that works for both bundled and external MariaDB, reading `mariadb-root-password` from `insight-db-creds`. Tracked as a chart-side SPEC §8 follow-up.
-- **`insight-{analytics-api,identity-resolution}-config` composability.** The chart validator forbids `gitops + autoGenerate=true`, so the two composed Secrets are only emitted under `autoGenerate=true`. In gitops production, engineers run `scripts/compose-app-secrets.sh` (in the gitops repo) to derive them from `insight-db-creds` + env values. Fix: either (a) compose them in a separate Helm hook job that ALWAYS runs, reading the db-creds Secret; or (b) document the engineer-side composition as the supported path. Tracked.
-- **Airbyte cross-namespace URL.** The chart's `insight.airbyte.url` helper currently uses `.Release.Namespace` (`insight`). In the layered model Airbyte runs in `insight-infra`, so analytics-api would 404 on real ingestion calls. Parameterise `airbyte.namespace` (or compute the FQDN from a values field). Tracked as a chart-side SPEC §8 follow-up.
+- **`insight-{analytics,identity-resolution}-config` composability.** The chart validator forbids `gitops + autoGenerate=true`, so the two composed Secrets are only emitted under `autoGenerate=true`. In gitops production, engineers run `scripts/compose-app-secrets.sh` (in the gitops repo) to derive them from `insight-db-creds` + env values. Fix: either (a) compose them in a separate Helm hook job that ALWAYS runs, reading the db-creds Secret; or (b) document the engineer-side composition as the supported path. Tracked.
+- **Airbyte cross-namespace URL.** The chart's `insight.airbyte.url` helper currently uses `.Release.Namespace` (`insight`). In the layered model Airbyte runs in `insight-infra`, so analytics would 404 on real ingestion calls. Parameterise `airbyte.namespace` (or compute the FQDN from a values field). Tracked as a chart-side SPEC §8 follow-up.
 - **Cross-namespace host defaults for L2 services.** When `<svc>.deploy: false`, the chart still `required`-s `<svc>.host`. Default it to `<release>.insight-infra.svc.cluster.local` (the layered-model convention) so env values stay minimal. Tracked.
 - **Artifact signing (images + chart).** Neither images nor the chart are cosign-signed today. Plan: sign at publish time, `chart-present` verifies the chart signature before allowing deploy, image admission policy verifies signatures. See the [gitops SPEC §8 open items](../gitops/README.md#8-open-items).
 - **GHCR retention for old umbrella tags.** Long-lived production pins (customer envs) should mirror to a self-hosted registry against GHCR retention deleting the tagged artifact. Documented in the gitops SPEC §8.
diff --git a/docs/components/deployment/specs/PRD.md b/docs/components/deployment/specs/PRD.md
index 0de6e8ea7..bc4f86328 100644
--- a/docs/components/deployment/specs/PRD.md
+++ b/docs/components/deployment/specs/PRD.md
@@ -489,7 +489,7 @@ Every merge to `main` of `constructorfabric/insight` **MUST** publish a new umbr
 
 **Stability**: unstable (pre-1.0 while the chart is at `version: 0.1.x`).
 
-**Description**: The values contract that every chart consumer (Cyberfabric SRE in gitops — production and local, Constructor Platform, external customers) targets. It covers the `credentials` block (`autoGenerate`), the `global` block, the four infra blocks (ClickHouse, MariaDB, Redis, Redpanda) each with the unified flat shape (`deploy`, `host`, `port`, `database`, `username`, `passwordSecret`), the three mandatory app-service blocks (apiGateway, analyticsApi, frontend) plus the optional `identityResolution` (`deploy`-gated), and the `airbyte` + `ingestion.templates` blocks. The `<svc>.deploy` toggles drive the dual-purpose dev-vs-prod split documented in [§5.4](#54-layered-deploy-model-and-customer-envs).
+**Description**: The values contract that every chart consumer (Cyberfabric SRE in gitops — production and local, Constructor Platform, external customers) targets. It covers the `credentials` block (`autoGenerate`), the `global` block, the four infra blocks (ClickHouse, MariaDB, Redis, Redpanda) each with the unified flat shape (`deploy`, `host`, `port`, `database`, `username`, `passwordSecret`), the three mandatory app-service blocks (apiGateway, analytics, frontend) plus the optional `identityResolution` (`deploy`-gated), and the `airbyte` + `ingestion.templates` blocks. The `<svc>.deploy` toggles drive the dual-purpose dev-vs-prod split documented in [§5.4](#54-layered-deploy-model-and-customer-envs).
 
 **Breaking Change Policy**: minor version bump on the umbrella for additive fields; major version bump for removed or renamed values keys; the validator output must name any newly required field.
 
@@ -642,7 +642,7 @@ Every merge to `main` of `constructorfabric/insight` **MUST** publish a new umbr
 | Risk | Impact | Mitigation |
 |------|--------|------------|
 | Chart Publishing CI auto-commit-back fails on branch protection. | A merge that should publish a new umbrella tag publishes the chart but fails to bump `Chart.yaml` on `main`, leaving the repo state out of sync with what was published. | Track in repo settings: fine-grained PAT in `RELEASE_PUSH_PAT` with bypass on protected branch, or a GitHub App with bypass rights. Until either is in place, the auto-commit step is replayed manually after merge. |
-| Inline infra passwords previously had to be duplicated into app-service DSNs. | Drift between infra password and DSN produced a silently-broken install. | Resolved: `credentials.autoGenerate=true` writes `insight-db-creds` once and the umbrella derives all app-service Secrets (`insight-analytics-api-config`, `insight-identity-resolution-config`) from the same passwords. BYO mode reads the customer-supplied `insight-db-creds` instead. |
+| Inline infra passwords previously had to be duplicated into app-service DSNs. | Drift between infra password and DSN produced a silently-broken install. | Resolved: `credentials.autoGenerate=true` writes `insight-db-creds` once and the umbrella derives all app-service Secrets (`insight-analytics-config`, `insight-identity-resolution-config`) from the same passwords. BYO mode reads the customer-supplied `insight-db-creds` instead. |
 | Frontend image is `linux/amd64` only — Apple Silicon hosts rely on QEMU emulation or local rebuild. | Slow first pull and occasional emulation bugs on dev machines. | The Docker Compose stack can build the frontend from source (`FRONTEND_MODE=dev` / `built`) as a workaround; infra team to publish multi-arch images. |
 | Identity Resolution subchart ships as MVP stub that crashloops on empty bronze. | If operator flips `identityResolution.deploy: true` before any BambooHR sync, the release looks broken. | Keep default `identityResolution.deploy: false`; document the prerequisite in README; surface a clearer error message in the service itself (Backend concern). |
 | Airbyte chart 1.9.x was deliberately skipped because its bundled app 2.0.x-alpha is not production-grade. | Consumer asking for 1.9 gets a "no". | Document the policy in the Airbyte README; revisit when 2.0 GA ships. |
diff --git a/docs/domain/bronze-to-api-e2e/specs/DECOMPOSITION.md b/docs/domain/bronze-to-api-e2e/specs/DECOMPOSITION.md
index 92f275f9c..9cd2f9838 100644
--- a/docs/domain/bronze-to-api-e2e/specs/DECOMPOSITION.md
+++ b/docs/domain/bronze-to-api-e2e/specs/DECOMPOSITION.md
@@ -66,7 +66,7 @@ The DESIGN is decomposed into 8 features. The order is deliberate: a foundation
 - **Out of scope**:
   - Reading or interpreting individual fixture folders (that's `fixture-loader`)
   - dbt manifest parsing (that's `dbt-runner`)
-  - analytics-api binary build/spawn (that's `api-spawner`)
+  - analytics binary build/spawn (that's `api-spawner`)
   - CSV diff (that's `csv-asserter`)
   - `--update-snapshots` CLI flag (that's `snapshot-update`)
   - GitHub Actions workflow file (that's `ci-integration`)
@@ -228,20 +228,20 @@ The DESIGN is decomposed into 8 features. The order is deliberate: a foundation
 
 - [ ] `p1` - **ID**: `cpt-bronze-to-api-e2e-feature-api-spawner`
 
-- **Purpose**: Build `analytics-api` once per session with `cargo build --release`, spawn on `127.0.0.1:<random>`, expose a request-builder client. Owns the HTTP boundary.
+- **Purpose**: Build `analytics` once per session with `cargo build --release`, spawn on `127.0.0.1:<random>`, expose a request-builder client. Owns the HTTP boundary.
 
 - **Depends On**: `cpt-bronze-to-api-e2e-feature-test-rig-scaffolding`
 
 - **Scope**:
-  - `cargo build --release -p analytics-api` with `CARGO_TARGET_DIR` cached
-  - Spawn with `INSIGHT_ANALYTICS_API_AUTH_DISABLED=true` and env vars pointing at the test ClickHouse + MariaDB
+  - `cargo build --release -p analytics` with `CARGO_TARGET_DIR` cached
+  - Spawn with env vars pointing at the test ClickHouse + MariaDB
   - Random loopback port allocation
   - Startup wait against `GET /health`
   - Per-test request helper: builds the request from `spec.yaml`, POSTs, returns deserialized `ApiResponse`
   - Session teardown: SIGTERM, wait, SIGKILL on timeout
 
 - **Out of scope**:
-  - The `analytics-api` codebase itself (out of scope for this domain; lives in `src/backend/services/analytics-api`)
+  - The `analytics` codebase itself (out of scope for this domain; lives in `src/backend/services/analytics`)
   - CSV assertion
 
 - **Requirements Covered**:
@@ -326,7 +326,7 @@ The DESIGN is decomposed into 8 features. The order is deliberate: a foundation
 
 - [ ] `p2` - **ID**: `cpt-bronze-to-api-e2e-feature-ci-integration`
 
-- **Purpose**: Run the suite on every PR touching `src/ingestion/`, `src/backend/services/analytics-api/`, or `src/ingestion/scripts/migrations/`. Surface diffs in the job output.
+- **Purpose**: Run the suite on every PR touching `src/ingestion/`, `src/backend/services/analytics/`, or `src/ingestion/scripts/migrations/`. Surface diffs in the job output.
 
 - **Depends On**: `cpt-bronze-to-api-e2e-feature-csv-rig`
 
diff --git a/docs/domain/bronze-to-api-e2e/specs/DESIGN.md b/docs/domain/bronze-to-api-e2e/specs/DESIGN.md
index 81827179c..262155474 100644
--- a/docs/domain/bronze-to-api-e2e/specs/DESIGN.md
+++ b/docs/domain/bronze-to-api-e2e/specs/DESIGN.md
@@ -29,15 +29,15 @@
 ## Changelog
 
 - **v1.1** (current): Authoring format moves from per-folder CSV (`bronze/*.csv` + `spec.yaml` + `expected/response.csv`) to a single declarative `<name>.test.yaml` (see `cpt-bronze-to-api-e2e-feature-yaml-rig`). Adds three components — `ref-resolver` (composition via `$ref` + sibling overrides), `schema-validator` (per-table JSON schema, padding, validation), `expect-engine` (exact-equality `find` + `equal` subset + CEL `assert` over the batch response) — and retires `csv-asserter`. `fixture-loader` is repurposed to load `*.test.yaml`. The API roundtrip targets the batch endpoint `POST /v1/metrics/queries`. The transformation path (bronze→silver→gold→API) is unchanged; only the authoring format and assertion engine change.
-- **v1.0**: Initial design. Establishes 7 components (fixture-loader, ch-seeder, dbt-runner, migration-applier, api-client, csv-asserter, session-rig), the data plane (docker compose with ClickHouse + MariaDB), the service plane (`analytics-api` binary on host with `cargo build --release`), and the assertion plane (pandas). Vertically slices through the bronze→silver→gold→API path defined in `cpt-dataflow-design-pipeline`.
+- **v1.0**: Initial design. Establishes 7 components (fixture-loader, ch-seeder, dbt-runner, migration-applier, api-client, csv-asserter, session-rig), the data plane (docker compose with ClickHouse + MariaDB), the service plane (`analytics` binary on host with `cargo build --release`), and the assertion plane (pandas). Vertically slices through the bronze→silver→gold→API path defined in `cpt-dataflow-design-pipeline`.
 
 ## 1. Architecture Overview
 
 ### 1.1 Architectural Vision
 
-The Bronze-to-API E2E Test Framework wraps Constructor Insight's existing transformation stack — ClickHouse, dbt, the migration view set, the analytics-api binary, MariaDB — and drives it from a declarative fixture format. The defining property is **layer parity**: nothing under test is simulated. The test ClickHouse is the same image as production, the dbt models are the same files dbt runs in Argo, the gold views are applied by the same SQL that runs in deploy, and the `analytics-api` binary is the same compilation artifact the K8s deployment ships. Only Airbyte (data ingress) is bypassed — bronze is seeded by direct CSV INSERT, which is what we want to test against, not Airbyte's correctness.
+The Bronze-to-API E2E Test Framework wraps Constructor Insight's existing transformation stack — ClickHouse, dbt, the migration view set, the analytics binary, MariaDB — and drives it from a declarative fixture format. The defining property is **layer parity**: nothing under test is simulated. The test ClickHouse is the same image as production, the dbt models are the same files dbt runs in Argo, the gold views are applied by the same SQL that runs in deploy, and the `analytics` binary is the same compilation artifact the K8s deployment ships. Only Airbyte (data ingress) is bypassed — bronze is seeded by direct CSV INSERT, which is what we want to test against, not Airbyte's correctness.
 
-The second defining property is **shared session, scoped work**: docker compose, ClickHouse migrations, the dbt manifest parse, and the analytics-api binary all happen once per pytest session and amortize across every test. Per-test work is narrow: TRUNCATE the touched bronze tables, INSERT this test's CSVs, run a dbt selector that touches only the slice this test needs (`--defer --state target/`), call the API, diff the response. The framework is designed so the wall-clock cost of "what changed for this test" stays near the cost of the work that actually changed, not the cost of the whole pipeline.
+The second defining property is **shared session, scoped work**: docker compose, ClickHouse migrations, the dbt manifest parse, and the analytics binary all happen once per pytest session and amortize across every test. Per-test work is narrow: TRUNCATE the touched bronze tables, INSERT this test's CSVs, run a dbt selector that touches only the slice this test needs (`--defer --state target/`), call the API, diff the response. The framework is designed so the wall-clock cost of "what changed for this test" stays near the cost of the work that actually changed, not the cost of the whole pipeline.
 
 ### 1.2 Architecture Drivers
 
@@ -51,7 +51,7 @@ The second defining property is **shared session, scoped work**: docker compose,
 | `cpt-bronze-to-api-e2e-fr-bronze-truncate` | `ch-seeder` records touched tables and `TRUNCATE`s only those in test teardown. Bronze tables themselves are created once at session start by a connector-bootstrap step. |
 | `cpt-bronze-to-api-e2e-fr-dbt-run-scoped` | `dbt-runner` parses the manifest once (`dbt parse` in session fixture) and shells out to `dbt build --select <spec.dbt_selector> --defer --state target/` per test. |
 | `cpt-bronze-to-api-e2e-fr-gold-view-queried` | `migration-applier` shells out `clickhouse-client --multiquery < migrations/*.sql` once per session, in lexical order. Idempotent (`CREATE OR REPLACE VIEW`). |
-| `cpt-bronze-to-api-e2e-fr-api-roundtrip` | `api-client` spawns `analytics-api` once per session, binds to `127.0.0.1:<random>`, drives requests via `requests`. Auth disabled via `--auth-disabled`. |
+| `cpt-bronze-to-api-e2e-fr-api-roundtrip` | `api-client` spawns `analytics` once per session, binds to `127.0.0.1:<random>`, drives requests via `requests`. Auth disabled via `--auth-disabled`. |
 | `cpt-bronze-to-api-e2e-fr-csv-assert` | `csv-asserter` flattens response `items[]` into a `DataFrame`, sorts both sides by `key_columns`, runs `pandas.testing.assert_frame_equal` with the spec's `float_tolerance`. On failure, renders first 20 mismatched cells with row key + column. |
 | `cpt-bronze-to-api-e2e-fr-test-isolation` | `session-rig` injects a `WORKER_ID` env var; `ch-seeder` and `dbt-runner` suffix every schema with `_w{N}`. |
 
@@ -59,9 +59,9 @@ The second defining property is **shared session, scoped work**: docker compose,
 
 | NFR ID | NFR Summary | Allocated To | Design Response | Verification Approach |
 |--------|-------------|--------------|-----------------|----------------------|
-| `cpt-bronze-to-api-e2e-nfr-cold-start` | Cold session ≤ 60 s warm cache | `session-rig` + `migration-applier` + `api-client` | docker compose pulls cached images; migrations idempotent; analytics-api built once with `cargo build --release` and cached in `target/`; dbt manifest parsed once | Session fixture wraps in `time.perf_counter()`; CI step fails if elapsed > 60 s on warm cache or > 180 s on cold cache |
+| `cpt-bronze-to-api-e2e-nfr-cold-start` | Cold session ≤ 60 s warm cache | `session-rig` + `migration-applier` + `api-client` | docker compose pulls cached images; migrations idempotent; analytics built once with `cargo build --release` and cached in `target/`; dbt manifest parsed once | Session fixture wraps in `time.perf_counter()`; CI step fails if elapsed > 60 s on warm cache or > 180 s on cold cache |
 | `cpt-bronze-to-api-e2e-nfr-per-test-latency` | p50 ≤ 5 s, p95 ≤ 15 s | `dbt-runner` + `ch-seeder` + `csv-asserter` | Selector-scoped dbt (only touched models); TRUNCATE-not-DROP between tests; pandas in-process diff | pytest-benchmark fixture records per-test wall clock; CI publishes p50/p95 and fails if budget exceeded over rolling 20-test window |
-| `cpt-bronze-to-api-e2e-nfr-parallel-safe` | Zero cross-worker contamination | `session-rig` + `ch-seeder` + `dbt-runner` | Per-worker schema suffix (`_w0`, `_w1`, …); analytics-api binary is read-only against per-worker schemas | `tests/e2e/meta/test_parallel_isolation.py` runs 100 randomized parallel pairs; CI fails on any contamination |
+| `cpt-bronze-to-api-e2e-nfr-parallel-safe` | Zero cross-worker contamination | `session-rig` + `ch-seeder` + `dbt-runner` | Per-worker schema suffix (`_w0`, `_w1`, …); analytics binary is read-only against per-worker schemas | `tests/e2e/meta/test_parallel_isolation.py` runs 100 randomized parallel pairs; CI fails on any contamination |
 | `cpt-bronze-to-api-e2e-nfr-diff-readability` | Cell-precise diff in pytest captured stdout | `csv-asserter` | Custom `assert_frame_equal` wrapper that catches the assertion, formats first 20 mismatches as `(key, column, expected, actual)` lines, raises a new `AssertionError` with that text — visible in pytest report | `tests/e2e/meta/test_diff_format.py` injects a known mismatch and asserts the captured stdout contains the expected (key, column) pairs |
 
 ### 1.3 Architecture Layers
@@ -88,7 +88,7 @@ flowchart TD
         CA["csv-asserter"]
     end
     subgraph Service["Service plane (host)"]
-        API["analytics-api binary<br/>(auth disabled)"]
+        API["analytics binary<br/>(auth disabled)"]
     end
 
     FX --> FL --> CS --> CH
@@ -108,7 +108,7 @@ flowchart TD
 | Test Runtime | Discovery, parameterization, parallel orchestration, lifecycle | pytest ≥ 8, pytest-xdist |
 | Data Plane | Persistent storage of bronze/staging/silver/gold rows + metric defs | docker compose: ClickHouse 24.x, MariaDB 11.x |
 | Tooling | Per-test work: load, seed, run dbt, call API, assert | Python ≥ 3.12, clickhouse-driver, pandas |
-| Service Plane | Service under test | `analytics-api` Rust/axum binary, built `--release`, run on host |
+| Service Plane | Service under test | `analytics` Rust/axum binary, built `--release`, run on host |
 
 ## 2. Principles & Constraints
 
@@ -124,7 +124,7 @@ Bronze is seeded by direct CSV INSERT. Airbyte is intentionally out of the test
 
 - [ ] `p1` - **ID**: `cpt-bronze-to-api-e2e-principle-shared-session`
 
-Expensive setup (docker compose, ClickHouse migrations, dbt manifest parse, analytics-api spawn) is paid once per pytest session. Per-test cleanup uses `TRUNCATE` on the touched bronze tables, never `DROP`. The lifecycle is `session > worker > test`; nothing more invasive runs between tests.
+Expensive setup (docker compose, ClickHouse migrations, dbt manifest parse, analytics spawn) is paid once per pytest session. Per-test cleanup uses `TRUNCATE` on the touched bronze tables, never `DROP`. The lifecycle is `session > worker > test`; nothing more invasive runs between tests.
 
 #### Fixtures are the source of truth, not snapshots
 
@@ -162,7 +162,7 @@ Tests inject data, not schemas. Migrations are applied once per session by `migr
 
 - [ ] `p1` - **ID**: `cpt-bronze-to-api-e2e-constraint-loopback-only`
 
-The spawned `analytics-api` binds to `127.0.0.1:<random>`. The compose stack publishes ClickHouse / MariaDB ports on loopback only. No port is exposed on `0.0.0.0`.
+The spawned `analytics` binds to `127.0.0.1:<random>`. The compose stack publishes ClickHouse / MariaDB ports on loopback only. No port is exposed on `0.0.0.0`.
 
 ## 3. Technical Architecture
 
@@ -280,7 +280,7 @@ The contract under test is the HTTP boundary. Linking directly against the axum
 
 ##### Responsibility scope
 
-Once per session: `cargo build --release -p analytics-api` (cached via `CARGO_TARGET_DIR`), spawn the binary with `INSIGHT_ANALYTICS_API_AUTH_DISABLED=true`, env vars pointing at the test ClickHouse and MariaDB, bind to `127.0.0.1:<random>`, wait for `/health` to return 200. Per test: build the request from `spec.yaml` (`endpoint`, `method`, `request_body`), POST/GET, deserialize, return an `ApiResponse`. On session teardown: SIGTERM, wait, SIGKILL on timeout.
+Once per session: `cargo build --release -p analytics` (cached via `CARGO_TARGET_DIR`), spawn the binary with `INSIGHT_ANALYTICS_AUTH_DISABLED=true`, env vars pointing at the test ClickHouse and MariaDB, bind to `127.0.0.1:<random>`, wait for `/health` to return 200. Per test: build the request from `spec.yaml` (`endpoint`, `method`, `request_body`), POST/GET, deserialize, return an `ApiResponse`. On session teardown: SIGTERM, wait, SIGKILL on timeout.
 
 ##### Responsibility boundaries
 
@@ -395,11 +395,11 @@ Does **NOT**: call the API; render to a frontend; persist anything except (in up
 
 ##### Why this component exists
 
-The expensive setup must happen exactly once per pytest session and be observable by every test and every worker. The framework needs a single place that owns the lifecycle of compose, ClickHouse, MariaDB, the analytics-api binary, dbt manifest, and worker context.
+The expensive setup must happen exactly once per pytest session and be observable by every test and every worker. The framework needs a single place that owns the lifecycle of compose, ClickHouse, MariaDB, the analytics binary, dbt manifest, and worker context.
 
 ##### Responsibility scope
 
-Declares pytest fixtures with `scope="session"` for: (a) docker compose up + healthcheck wait; (b) ClickHouse bronze schema bootstrap (per-connector); (c) `migration-applier` once; (d) MariaDB metric-catalog seed; (e) `dbt parse` once; (f) `analytics-api` binary build + spawn. Declares a `scope="function"` fixture that injects `Fixture` + `WorkerContext` into each test. Owns the teardown order (reverse).
+Declares pytest fixtures with `scope="session"` for: (a) docker compose up + healthcheck wait; (b) ClickHouse bronze schema bootstrap (per-connector); (c) `migration-applier` once; (d) MariaDB metric-catalog seed; (e) `dbt parse` once; (f) `analytics` binary build + spawn. Declares a `scope="function"` fixture that injects `Fixture` + `WorkerContext` into each test. Owns the teardown order (reverse).
 
 ##### Responsibility boundaries
 
@@ -411,14 +411,14 @@ Does **NOT**: perform any per-test work directly (delegates to other components)
 
 ### 3.3 API Contracts
 
-The framework consumes the existing analytics-api HTTP surface. No new endpoints are introduced.
+The framework consumes the existing analytics HTTP surface. No new endpoints are introduced.
 
 - [ ] `p2` - **ID**: `cpt-bronze-to-api-e2e-interface-pytest-entry` *(defined in PRD §7.1)*
 
 - **Contracts**: `cpt-bronze-to-api-e2e-contract-api-response`
 - **Technology**: HTTP/JSON over loopback
 
-**Endpoints Overview** (consumed; service is `analytics-api`):
+**Endpoints Overview** (consumed; service is `analytics`):
 
 | Method | Path | Description | Stability |
 |--------|------|-------------|-----------|
@@ -436,14 +436,14 @@ The framework consumes the existing analytics-api HTTP surface. No new endpoints
 |-------------------|----------------|---------|
 | `src/ingestion/dbt/` (dbt project) | dbt CLI (subprocess), `target/manifest.json` | Run staging/silver models with selectors |
 | `src/ingestion/scripts/migrations/` | `clickhouse-client --multiquery` | Apply gold views |
-| `src/backend/services/analytics-api/` | HTTP loopback against the built binary | Service under test |
+| `src/backend/services/analytics/` | HTTP loopback against the built binary | Service under test |
 | `src/ingestion/connectors/*/airbyte/connector.yaml` | Read-only — derives the bronze table list (used by session-rig connector bootstrap) | Knows which bronze schemas to create at session start |
 
 **Dependency Rules**:
 
 - No circular dependencies (the framework lives downstream of all the modules above)
 - The framework MUST NOT modify any file under `src/ingestion/dbt/` or `src/ingestion/scripts/migrations/` at runtime
-- The analytics-api binary is the only Rust artifact the framework consumes — it is built from source (no pre-built image dependency)
+- The analytics binary is the only Rust artifact the framework consumes — it is built from source (no pre-built image dependency)
 
 ### 3.5 External Dependencies
 
@@ -457,12 +457,12 @@ The framework consumes the existing analytics-api HTTP surface. No new endpoints
 
 | Dependency | Interface | Purpose |
 |------------|-----------|---------|
-| `mariadb:11.x` | MySQL protocol 3306, `mariadb` CLI | Stores `analytics.metrics`, `analytics.thresholds`, `table_columns` — the catalog the analytics-api reads |
+| `mariadb:11.x` | MySQL protocol 3306, `mariadb` CLI | Stores `analytics.metrics`, `analytics.thresholds`, `table_columns` — the catalog the analytics reads |
 
 **Dependency Rules**:
 
 - Both containers run on the docker compose private bridge network; ports are published on `127.0.0.1` only
-- Credentials are generated at session start (random per-run) and injected into both containers and the spawned `analytics-api` via env vars
+- Credentials are generated at session start (random per-run) and injected into both containers and the spawned `analytics` via env vars
 - No external network is required after image pull — the framework MUST work offline once images are cached
 
 ### 3.6 Interactions & Sequences
@@ -483,7 +483,7 @@ sequenceDiagram
     participant CH as ClickHouse
     participant DR as dbt-runner
     participant AC as api-client
-    participant API as analytics-api
+    participant API as analytics
     participant CA as csv-asserter
 
     pytest->>FL: load fixtures/<name>/
@@ -528,7 +528,7 @@ sequenceDiagram
     SR->>MD: seed analytics.metrics (test catalog)
     SR->>DR: dbt parse
     DR-->>SR: target/manifest.json
-    SR->>AC: build + spawn analytics-api on 127.0.0.1:<random>
+    SR->>AC: build + spawn analytics on 127.0.0.1:<random>
     AC->>API: ready (GET /health)
     SR-->>pytest: ready, total elapsed Tms
 ```
@@ -546,14 +546,14 @@ No new persistent tables are introduced. No DDL on `insight.*` (gold) is perform
 
 - [ ] `p3` - **ID**: `cpt-bronze-to-api-e2e-topology-localhost`
 
-`docker compose` under `src/ingestion/tests/e2e/compose/`. Two services on a private bridge network; both publish on `127.0.0.1` only. analytics-api binary runs on the developer host (not in a container) to keep the cargo build cache hot across sessions. The host process talks to compose services via published loopback ports.
+`docker compose` under `src/ingestion/tests/e2e/compose/`. Two services on a private bridge network; both publish on `127.0.0.1` only. analytics binary runs on the developer host (not in a container) to keep the cargo build cache hot across sessions. The host process talks to compose services via published loopback ports.
 
 ```text
 ┌─────────── developer host / CI runner ────────────┐
 │                                                   │
 │  pytest worker(s)  ──┐                            │
 │                      │                            │
-│  analytics-api ──────┼───► 127.0.0.1:<random-1>   │
+│  analytics ──────────┼───► 127.0.0.1:<random-1>   │
 │                      │                            │
 │                      └───► 127.0.0.1:30123 ──► CH (compose)
 │                          ► 127.0.0.1:30306 ──► MariaDB (compose)
@@ -565,12 +565,12 @@ No new persistent tables are introduced. No DDL on `insight.*` (gold) is perform
 
 **Why not testcontainers-python in v1**: testcontainers-python is a fine library, but a hand-written docker compose is more transparent for debugging (developers already use `docker compose` directly) and avoids a dependency on a Python testcontainers version pin. If the rig grows ports / services and the compose file becomes unmanageable, switching is a single-component change inside `session-rig`.
 
-**Why a host-side analytics-api binary, not a container**: cargo's incremental compile is the dominant cost in development. Running cargo against `/var/lib/docker/volumes/...` adds I/O latency and complicates cache reuse across branches. Building on the host keeps `target/` warm and fits the typical Rust developer workflow.
+**Why a host-side analytics binary, not a container**: cargo's incremental compile is the dominant cost in development. Running cargo against `/var/lib/docker/volumes/...` adds I/O latency and complicates cache reuse across branches. Building on the host keeps `target/` warm and fits the typical Rust developer workflow.
 
 **Why not Rust-side `axum::Router::oneshot`**: the OData filter parser and auth middleware are wired in `router()` setup but the codepath that calls `axum::Router::oneshot` bypasses any TCP/serialization quirks that the actual deployment would exercise. The per-request HTTP cost (a few ms on loopback) is negligible compared to dbt/ClickHouse work, and the contract fidelity is worth it.
 
 ## 5. Traceability
 
 - **PRD**: [PRD.md](./PRD.md)
-- **ADRs**: none in v1 — create under `ADR/` if a contested decision arises (e.g. compose vs testcontainers, host vs containerized analytics-api)
+- **ADRs**: none in v1 — create under `ADR/` if a contested decision arises (e.g. compose vs testcontainers, host vs containerized analytics)
 - **Features**: enumerated in [DECOMPOSITION.md](./DECOMPOSITION.md)
diff --git a/docs/domain/bronze-to-api-e2e/specs/PRD.md b/docs/domain/bronze-to-api-e2e/specs/PRD.md
index 77a832973..b3a37822f 100644
--- a/docs/domain/bronze-to-api-e2e/specs/PRD.md
+++ b/docs/domain/bronze-to-api-e2e/specs/PRD.md
@@ -39,41 +39,41 @@
 
 ## Changelog
 
-- **v1.0** (current): Initial PRD. Establishes the Bronze-to-API E2E Test Framework as a developer-facing tool: each test is a folder of CSV fixtures (bronze inputs + expected API response) and the runner exercises the full data path bronze → dbt staging/silver → ClickHouse gold views (from migrations) → analytics-api HTTP response → CSV assert. Airbyte sync, Argo/Kestra orchestration, and the frontend are explicitly out of v1 scope. v1 ships pytest + local docker compose with one shared ClickHouse and one shared MariaDB per session.
+- **v1.0** (current): Initial PRD. Establishes the Bronze-to-API E2E Test Framework as a developer-facing tool: each test is a folder of CSV fixtures (bronze inputs + expected API response) and the runner exercises the full data path bronze → dbt staging/silver → ClickHouse gold views (from migrations) → analytics HTTP response → CSV assert. Airbyte sync, Argo/Kestra orchestration, and the frontend are explicitly out of v1 scope. v1 ships pytest + local docker compose with one shared ClickHouse and one shared MariaDB per session.
 
 ## 1. Overview
 
 ### 1.1 Purpose
 
-The Bronze-to-API E2E Test Framework is a developer-facing test harness that exercises Constructor Insight's full data transformation path — from a connector-shaped bronze row to an analytics-api HTTP response — using a declarative, folder-based fixture format. Each test is a folder of CSV files describing what the connector would have written to bronze and what the API is expected to return; the runner seeds bronze, runs dbt, applies the migration-defined gold views, calls the API, and diffs the response against the expected CSV.
+The Bronze-to-API E2E Test Framework is a developer-facing test harness that exercises Constructor Insight's full data transformation path — from a connector-shaped bronze row to an analytics HTTP response — using a declarative, folder-based fixture format. Each test is a folder of CSV files describing what the connector would have written to bronze and what the API is expected to return; the runner seeds bronze, runs dbt, applies the migration-defined gold views, calls the API, and diffs the response against the expected CSV.
 
-It exists so that a developer changing any layer of the pipeline (dbt model, migration view, analytics-api SQL builder, OData filter parser) gets a same-day signal that their change is consistent with the contract the UI consumes — without standing up a kind cluster, without running Airbyte, and without waiting for an external system.
+It exists so that a developer changing any layer of the pipeline (dbt model, migration view, analytics SQL builder, OData filter parser) gets a same-day signal that their change is consistent with the contract the UI consumes — without standing up a kind cluster, without running Airbyte, and without waiting for an external system.
 
 ### 1.2 Background / Problem Statement
 
-Today the only automated coverage of Insight's transformation pipeline is dbt's own generic tests (`unique`, `not_null`) plus a small set of hand-written assertion tests under `src/ingestion/dbt/tests/`. They catch dbt-level invariants on silver tables but they don't observe the gold views (created by ClickHouse migrations in `src/ingestion/scripts/migrations/`) and they don't observe the analytics-api response shape that the UI actually reads. A typical regression — a renamed column in a dbt model, a changed `argMax` in a migration view, a tightened OData filter parser in the Rust service — sneaks past CI and gets caught either by a developer running the stack locally or by a tenant in production.
+Today the only automated coverage of Insight's transformation pipeline is dbt's own generic tests (`unique`, `not_null`) plus a small set of hand-written assertion tests under `src/ingestion/dbt/tests/`. They catch dbt-level invariants on silver tables but they don't observe the gold views (created by ClickHouse migrations in `src/ingestion/scripts/migrations/`) and they don't observe the analytics response shape that the UI actually reads. A typical regression — a renamed column in a dbt model, a changed `argMax` in a migration view, a tightened OData filter parser in the Rust service — sneaks past CI and gets caught either by a developer running the stack locally or by a tenant in production.
 
 The transformation chain has four authoring surfaces:
 
 - **dbt models** under `src/ingestion/silver/` and `src/ingestion/connectors/*/dbt/`
 - **ClickHouse migration views** (~28 gold views, e.g. `insight.people`, `insight.commits_daily`) under `src/ingestion/scripts/migrations/`
-- **analytics-api Rust code** under `src/backend/services/analytics-api/` (metric query builder, OData filter parser, ClickHouse SQL emission)
+- **analytics Rust code** under `src/backend/services/analytics/` (metric query builder, OData filter parser, ClickHouse SQL emission)
 - **Metric catalog rows** in MariaDB (`analytics.metrics.query_ref`)
 
-A change to any one of these surfaces can break the contract `Frontend ← analytics-api ← gold view ← silver`. There is currently no test rig that observes the end-to-end contract on the same machine where the developer is editing.
+A change to any one of these surfaces can break the contract `Frontend ← analytics ← gold view ← silver`. There is currently no test rig that observes the end-to-end contract on the same machine where the developer is editing.
 
 The related "is the data correct?" question (whether a metric value is semantically right for a tenant's situation) is a different problem and is **not** solved by this PRD. This framework checks that the pipeline emits the expected value given a known input; it does not check that the input itself reflects reality.
 
 **Target Users**:
 
 - Data engineers authoring or changing dbt models and migration views
-- Backend developers changing analytics-api endpoints, query builder, or filter parsing
+- Backend developers changing analytics endpoints, query builder, or filter parsing
 - CI pipelines verifying PRs that touch any of the four authoring surfaces above
 
 **Key Problems Solved**:
 
 - No coverage of the gold-view layer (migration-defined views) in current tests
-- No coverage of the analytics-api response shape in current tests
+- No coverage of the analytics response shape in current tests
 - Setting up a full local environment to test a single dbt/view/api change takes minutes; this framework should take seconds per test
 
 ### 1.3 Goals (Business Outcomes)
@@ -90,7 +90,7 @@ The related "is the data correct?" question (whether a metric value is semantica
 - Author a test as `fixtures/<name>/bronze/*.csv` + `spec.yaml` + `expected/response.csv`
 - Seed only the affected bronze tables from CSVs; never run Airbyte
 - Run a dbt selector that builds exactly the silver/staging models needed by the test
-- Query the analytics-api over HTTP loopback and compare the response items against an expected CSV with a cell-precise diff
+- Query the analytics over HTTP loopback and compare the response items against an expected CSV with a cell-precise diff
 - Regenerate expected CSVs from actual output via an explicit flag (golden update — gated behind a follow-on FEATURE)
 - Parallelize via `pytest-xdist` with worker-scoped namespace suffixes
 
@@ -100,9 +100,9 @@ The related "is the data correct?" question (whether a metric value is semantica
 |------|------------|
 | Fixture | A folder under `src/ingestion/tests/e2e/fixtures/<test_name>/` containing `bronze/*.csv`, `spec.yaml`, and `expected/response.csv`. The unit a developer authors. |
 | Bronze input CSV | A CSV file mapping 1-to-1 onto a bronze table (`bronze_<connector>.<entity>`). First row = column names; empty cell = SQL NULL. |
-| Expected response CSV | A CSV file matching the JSON shape of `analytics-api` response `items[]` for the test's request, flattened to columns. |
+| Expected response CSV | A CSV file matching the JSON shape of `analytics` response `items[]` for the test's request, flattened to columns. |
 | Spec YAML | Per-test config: which API endpoint, request body, dbt selector, key columns for sort/diff, float tolerance. |
-| Gold view | A ClickHouse `VIEW` defined in `src/ingestion/scripts/migrations/*.sql` (e.g. `insight.people`). Read by analytics-api. |
+| Gold view | A ClickHouse `VIEW` defined in `src/ingestion/scripts/migrations/*.sql` (e.g. `insight.people`). Read by analytics. |
 | Test rig | The reusable runtime: docker compose, pytest fixtures, dbt runner, API client, CSV asserter. |
 | Session fixture | A pytest fixture with `scope="session"` — runs once per `pytest` invocation across all tests. |
 | Worker namespace | A suffix (e.g. `_w0`, `_w1`) added to schemas/tables when `pytest-xdist` runs tests in parallel. |
@@ -124,7 +124,7 @@ The related "is the data correct?" question (whether a metric value is semantica
 
 **ID**: `cpt-bronze-to-api-e2e-actor-backend-developer`
 
-**Role**: Changes analytics-api code (metric query builder, OData filter parser, ClickHouse SQL emission, MariaDB metric definitions). Adds regression tests on PRs.
+**Role**: Changes analytics code (metric query builder, OData filter parser, ClickHouse SQL emission, MariaDB metric definitions). Adds regression tests on PRs.
 **Needs**: A test rig that observes the HTTP response shape, not just the dbt or SQL output. Wants to run only the affected slice without rebuilding the whole pipeline.
 
 #### Test Author (covering both roles above)
@@ -140,7 +140,7 @@ The related "is the data correct?" question (whether a metric value is semantica
 
 **ID**: `cpt-bronze-to-api-e2e-actor-ci-pipeline`
 
-**Role**: Runs the suite on every PR that touches `src/ingestion/`, `src/backend/services/analytics-api/`, or `src/ingestion/scripts/migrations/`. Reports pass/fail and, on failure, includes the cell-precise diff in the job output.
+**Role**: Runs the suite on every PR that touches `src/ingestion/`, `src/backend/services/analytics/`, or `src/ingestion/scripts/migrations/`. Reports pass/fail and, on failure, includes the cell-precise diff in the job output.
 
 #### dbt CLI
 
@@ -148,7 +148,7 @@ The related "is the data correct?" question (whether a metric value is semantica
 
 **Role**: Subprocess invoked by the test rig with selectors (e.g. `+silver_people+`). Owns DDL of staging/silver models.
 
-#### analytics-api Binary
+#### analytics Binary
 
 **ID**: `cpt-bronze-to-api-e2e-actor-analytics-api`
 
@@ -160,7 +160,7 @@ The related "is the data correct?" question (whether a metric value is semantica
 
 - Requires Docker (Engine ≥ 24) for the compose stack (ClickHouse + MariaDB)
 - Requires Python ≥ 3.12 (matches `dbt` runtime in the repo)
-- Requires `cargo` toolchain to build the `analytics-api` binary once per session
+- Requires `cargo` toolchain to build the `analytics` binary once per session
 - Requires ClickHouse and MariaDB versions pinned to production parity — the framework MUST NOT silently downgrade to an older container image
 - Tests cannot run inside K8s — the framework is local-host only; for K8s integration use the local gitops deploy (`cd deploy/gitops && make deploy ENV=local`)
 
@@ -171,7 +171,7 @@ The related "is the data correct?" question (whether a metric value is semantica
 - Bronze seeding via CSV → ClickHouse direct INSERT
 - dbt staging and silver model execution with selectors
 - ClickHouse migration view application (the ~28 gold views)
-- analytics-api HTTP endpoint invocation: `POST /v1/metrics/{id}/query`, `GET /v1/columns`, `GET /v1/columns/{table}`, and any other endpoint declared in a test's `spec.yaml`
+- analytics HTTP endpoint invocation: `POST /v1/metrics/{id}/query`, `GET /v1/columns`, `GET /v1/columns/{table}`, and any other endpoint declared in a test's `spec.yaml`
 - CSV-based assertion of response payload with pandas-driven cell-precise diff
 - Per-test isolation via TRUNCATE between tests; per-worker isolation via namespace suffix
 - Parallel execution via `pytest-xdist`
@@ -230,18 +230,18 @@ The system **MUST** invoke `dbt build` with a selector taken from `spec.yaml` (`
 
 - [ ] `p1` - **ID**: `cpt-bronze-to-api-e2e-fr-gold-view-queried`
 
-The system **MUST** apply all SQL files in `src/ingestion/scripts/migrations/*.sql` (in lexical order) against the test ClickHouse instance once at session start. Subsequent tests **MUST** read gold views via the analytics-api without re-applying migrations.
+The system **MUST** apply all SQL files in `src/ingestion/scripts/migrations/*.sql` (in lexical order) against the test ClickHouse instance once at session start. Subsequent tests **MUST** read gold views via the analytics without re-applying migrations.
 
 **Rationale**: Migrations are idempotent (`CREATE OR REPLACE VIEW`); they take a few seconds and should run once. Per-test re-application would violate the per-test latency NFR.
 **Actors**: `cpt-bronze-to-api-e2e-actor-dbt-cli`
 
 ### 5.4 API Roundtrip
 
-#### Invoke the analytics-api over HTTP loopback
+#### Invoke the analytics over HTTP loopback
 
 - [ ] `p1` - **ID**: `cpt-bronze-to-api-e2e-fr-api-roundtrip`
 
-The system **MUST** spawn the `analytics-api` binary once per pytest session, bind it to a random loopback port, and route each test's request — described by `spec.yaml` (`endpoint`, `method`, `request_body`) — to that port via HTTP. The system **MUST** disable auth in the spawned binary (test fixtures inject `SecurityContext` directly).
+The system **MUST** spawn the `analytics` binary once per pytest session, bind it to a random loopback port, and route each test's request — described by `spec.yaml` (`endpoint`, `method`, `request_body`) — to that port via HTTP. The system **MUST** disable auth in the spawned binary (test fixtures inject `SecurityContext` directly).
 
 **Rationale**: HTTP-loopback round-trip is the contract the UI consumes. Skipping the HTTP layer (e.g. by linking against the axum router) would not catch regressions in router setup, serialization, or auth-middleware short-circuits.
 **Actors**: `cpt-bronze-to-api-e2e-actor-analytics-api`, `cpt-bronze-to-api-e2e-actor-backend-developer`
@@ -280,7 +280,7 @@ When tests run under `pytest-xdist`, the system **MUST** suffix every bronze sch
 
 - [ ] `p1` - **ID**: `cpt-bronze-to-api-e2e-nfr-cold-start`
 
-The system **MUST** complete cold session startup — `docker compose up`, ClickHouse migrations applied, `analytics-api` binary built and spawned, dbt manifest parsed — within **60 s** on a developer laptop with a warm Docker image cache. With a cold Docker image cache the budget is **180 s**.
+The system **MUST** complete cold session startup — `docker compose up`, ClickHouse migrations applied, `analytics` binary built and spawned, dbt manifest parsed — within **60 s** on a developer laptop with a warm Docker image cache. With a cold Docker image cache the budget is **180 s**.
 
 **Threshold**: 60 s warm cache; 180 s cold cache; measured wall-clock from `pytest` invocation to first test ready to run.
 **Rationale**: A multi-minute startup makes one-test-at-a-time iteration impractical. 60 s is the threshold below which developers will choose to keep the session warm rather than redeploy.
@@ -315,7 +315,7 @@ On failure, the system **MUST** render the cell-precise diff in the pytest captu
 ### 6.2 NFR Exclusions
 
 - **Project-default availability NFR**: Not applicable — the framework is dev-time only and does not need a production SLA.
-- **Project-default security NFR (auth)**: Not applicable — the spawned `analytics-api` runs with auth disabled; the framework MUST NOT expose its loopback port outside `127.0.0.1`.
+- **Project-default security NFR (auth)**: Not applicable — the spawned `analytics` runs with auth disabled; the framework MUST NOT expose its loopback port outside `127.0.0.1`.
 
 ## 7. Public Library Interfaces
 
@@ -348,11 +348,11 @@ On failure, the system **MUST** render the cell-precise diff in the pytest captu
 **Protocol/Format**: ClickHouse table schema as defined by the existing connector descriptors and migrations
 **Compatibility**: forward-compatible additive columns OK; the CSV asserter MUST not require a CSV to list every column — missing columns inserted as NULL.
 
-#### analytics-api response shape contract
+#### analytics response shape contract
 
 - [ ] `p1` - **ID**: `cpt-bronze-to-api-e2e-contract-api-response`
 
-**Direction**: provided by the `analytics-api` service; consumed by the asserter
+**Direction**: provided by the `analytics` service; consumed by the asserter
 **Protocol/Format**: `application/json`, `{"items": [...], "page_info": {...}}` per `POST /v1/metrics/{id}/query`
 **Compatibility**: any change to the response shape is a versioned breaking change to the framework.
 
@@ -409,7 +409,7 @@ On failure, the system **MUST** render the cell-precise diff in the pytest captu
 - [ ] At least one full fixture exists, exercising `insight.people` end-to-end, and passes
 - [ ] `pytest -n auto` runs the smoke suite without cross-worker contamination over 100 randomized runs
 - [ ] On a forced failure (e.g., breaking a silver model), the cell-precise diff appears in the pytest captured stdout
-- [ ] CI integration job runs the suite on every PR that touches `src/ingestion/` or `src/backend/services/analytics-api/`
+- [ ] CI integration job runs the suite on every PR that touches `src/ingestion/` or `src/backend/services/analytics/`
 
 ## 10. Dependencies
 
@@ -419,10 +419,10 @@ On failure, the system **MUST** render the cell-precise diff in the pytest captu
 | ClickHouse 24.x image | Same major version as production | p1 |
 | MariaDB 11.x image | Same major version as production | p1 |
 | Python ≥ 3.12 | Runs pytest, dbt subprocess, pandas asserter | p1 |
-| `cargo` toolchain | Builds `analytics-api` binary once per session | p1 |
+| `cargo` toolchain | Builds `analytics` binary once per session | p1 |
 | dbt project at `src/ingestion/dbt/` | The unit being exercised | p1 |
 | ClickHouse migrations at `src/ingestion/scripts/migrations/` | Define the gold views | p1 |
-| `analytics-api` Cargo workspace member | Service under test | p1 |
+| `analytics` Cargo workspace member | Service under test | p1 |
 | Metric Catalog (MariaDB `analytics.metrics`) | Defines the queries the API executes | p1 |
 | pandas ≥ 2.2 | Cell-precise CSV diff | p1 |
 | `pytest-xdist` | Parallel execution | p2 |
@@ -430,7 +430,7 @@ On failure, the system **MUST** render the cell-precise diff in the pytest captu
 ## 11. Assumptions
 
 - ClickHouse `CREATE OR REPLACE VIEW` semantics in the migration set are idempotent and safe to run against a fresh schema with bronze tables already created.
-- The `analytics-api` binary supports an auth-disabled mode suitable for local/test use.
+- The `analytics` binary supports an auth-disabled mode suitable for local/test use.
 - Per-tenant scoping in production is enforced by `SecurityContext` injection; the test framework either bypasses tenancy (single-tenant tests) or seeds it into the spawned process directly.
 - dbt's `--defer --state target/` works when the test-side manifest is built once per session and pointed back to the prior-state directory.
 - `pytest-xdist` worker IDs are stable within a single test session and can be safely embedded into ClickHouse schema names.
@@ -440,7 +440,7 @@ On failure, the system **MUST** render the cell-precise diff in the pytest captu
 | Risk | Impact | Mitigation |
 |------|--------|------------|
 | dbt selector behavior changes across dbt versions and breaks `--defer --state` reuse | Per-test latency NFR violated; suite slows to minutes | Pin dbt version in `pyproject.toml` / `requirements.txt`; rerun NFR check on dbt upgrade |
-| analytics-api binary spawn becomes slow as it accumulates dependencies | Cold session start NFR violated | Build with `--release`, cache target dir between CI runs; add explicit cargo-cache step in CI |
+| analytics binary spawn becomes slow as it accumulates dependencies | Cold session start NFR violated | Build with `--release`, cache target dir between CI runs; add explicit cargo-cache step in CI |
 | ClickHouse `TRUNCATE` between tests does not actually release storage and disk fills | Long suites OOM the disk on CI runners | Add a session-end `OPTIMIZE TABLE ... FINAL` + observe disk usage; document a periodic full-volume wipe |
 | Float comparison tolerance hides real regressions in aggregate metrics | False negatives — test passes when number is subtly wrong | Default tolerance `1e-6`; require per-test override only with a justification comment |
 | Fixture folder format drifts as the framework evolves; old fixtures stop running | Maintenance debt — every change forces a sweep of all fixtures | Version `spec.yaml` (`spec_version: 1`); the runner refuses unknown major versions; minor changes are additive |
diff --git a/docs/domain/bronze-to-api-e2e/specs/feature-csv-rig/FEATURE.md b/docs/domain/bronze-to-api-e2e/specs/feature-csv-rig/FEATURE.md
index 211363301..83ef7d58d 100644
--- a/docs/domain/bronze-to-api-e2e/specs/feature-csv-rig/FEATURE.md
+++ b/docs/domain/bronze-to-api-e2e/specs/feature-csv-rig/FEATURE.md
@@ -38,13 +38,13 @@ date: 2026-05-21
 
 ### 1.1 Overview
 
-Cut a single working end-to-end test path through every layer of the Bronze-to-API E2E Test Framework. After this feature lands, a developer can author a fixture folder (`bronze/*.csv` + `spec.yaml` + `expected/response.csv`) and watch the runner load it, INSERT typed rows into bronze, run a scoped `dbt build`, call the analytics-api on a loopback port, and diff the response against the expected CSV — with cell-precise output on failure.
+Cut a single working end-to-end test path through every layer of the Bronze-to-API E2E Test Framework. After this feature lands, a developer can author a fixture folder (`bronze/*.csv` + `spec.yaml` + `expected/response.csv`) and watch the runner load it, INSERT typed rows into bronze, run a scoped `dbt build`, call the analytics on a loopback port, and diff the response against the expected CSV — with cell-precise output on failure.
 
 This feature is the integration of every component from DESIGN (`fixture-loader`, `ch-seeder`, `dbt-runner`, `api-client`, `csv-asserter`, `session-rig`) plus one reference fixture (`fixtures/people_smoke/`) that exercises `insight.people` end-to-end. The reference fixture is part of the DoD — without it, the framework has no proof of life.
 
 ### 1.2 Purpose
 
-The framework as a whole exists to give data engineers and backend developers a fast same-day signal that a dbt model, migration view, or analytics-api code change is consistent with the contract the UI consumes (`cpt-bronze-to-api-e2e-fr-bronze-seed-from-csv`, `cpt-bronze-to-api-e2e-fr-csv-assert`, `cpt-bronze-to-api-e2e-fr-api-roundtrip`). This feature is the MVP that delivers that signal for one view and one metric — the smallest scope that lets the framework be evaluated end-to-end.
+The framework as a whole exists to give data engineers and backend developers a fast same-day signal that a dbt model, migration view, or analytics code change is consistent with the contract the UI consumes (`cpt-bronze-to-api-e2e-fr-bronze-seed-from-csv`, `cpt-bronze-to-api-e2e-fr-csv-assert`, `cpt-bronze-to-api-e2e-fr-api-roundtrip`). This feature is the MVP that delivers that signal for one view and one metric — the smallest scope that lets the framework be evaluated end-to-end.
 
 **Requirements**:
 
@@ -241,7 +241,7 @@ The system **MUST** invoke `dbt build` with the selector from `spec.yaml` (e.g.
 
 - [ ] `p1` - **ID**: `cpt-bronze-to-api-e2e-dod-csv-rig-api-roundtrip`
 
-The system **MUST** POST the request derived from `spec.yaml` to the analytics-api over HTTP loopback and deserialize the JSON body into a typed `ApiResponse`. Auth **MUST** be disabled in the spawned binary. The api-client **MUST** be the same instance for every test in the session.
+The system **MUST** POST the request derived from `spec.yaml` to the analytics over HTTP loopback and deserialize the JSON body into a typed `ApiResponse`. Auth **MUST** be disabled in the spawned binary. The api-client **MUST** be the same instance for every test in the session.
 
 **Implements**:
 
diff --git a/docs/domain/identity-resolution/specs/DESIGN.md b/docs/domain/identity-resolution/specs/DESIGN.md
index 03b9f51e8..2afbd2d2f 100644
--- a/docs/domain/identity-resolution/specs/DESIGN.md
+++ b/docs/domain/identity-resolution/specs/DESIGN.md
@@ -753,7 +753,7 @@ Identity-attribute observation history for persons, stored in MariaDB. Each row
 
 Exactly one of `(value_id, value_full_text, value)` is populated per normal row; the other two are NULL. All-three-NULL is reserved for future "attribute unset at source" events (not emitted by the initial seed).
 
-**UUID representation**: all UUID columns are stored as `BINARY(16)` (SeaORM `.uuid()` default on MariaDB, matches `analytics-api` convention). Python clients must pass **`uuid.UUID.bytes`** (the 16-byte raw form) — passing the `uuid.UUID` object directly makes the driver fall back to `str(UUID)` (36 chars) which `BINARY(16)` silently truncates to ASCII, corrupting the column. For human-readable reads in SQL use `CAST(col AS UUID)` (MariaDB 10.7+) or build the textual form from `HEX(col)`. Note: MySQL 8's `BIN_TO_UUID()` is **not** available in MariaDB.
+**UUID representation**: all UUID columns are stored as `BINARY(16)` (SeaORM `.uuid()` default on MariaDB, matches `analytics` convention). Python clients must pass **`uuid.UUID.bytes`** (the 16-byte raw form) — passing the `uuid.UUID` object directly makes the driver fall back to `str(UUID)` (36 chars) which `BINARY(16)` silently truncates to ASCII, corrupting the column. For human-readable reads in SQL use `CAST(col AS UUID)` (MariaDB 10.7+) or build the textual form from `HEX(col)`. Note: MySQL 8's `BIN_TO_UUID()` is **not** available in MariaDB.
 
 **Primary key**: `id` (auto-increment integer — MariaDB convention for append-only observation history).
 
diff --git a/docs/domain/ingestion/specs/ADR/0006-service-owned-migrations.md b/docs/domain/ingestion/specs/ADR/0006-service-owned-migrations.md
index a0e819ce8..6fd82c72f 100644
--- a/docs/domain/ingestion/specs/ADR/0006-service-owned-migrations.md
+++ b/docs/domain/ingestion/specs/ADR/0006-service-owned-migrations.md
@@ -15,13 +15,13 @@ clear rule for **who authors and applies the schema**. Options include:
   directory, invoked at deploy time.
 - Per-service migrations, owned and applied by the service itself.
 
-Our one existing precedent — `analytics-api` — follows the second
+Our one existing precedent — `analytics` — follows the second
 pattern (SeaORM `Migrator` embedded in the Rust service, applied via
 `Migrator::up()` at startup). The open question for this ADR is
 whether to extend that pattern to every other service with MariaDB
 tables, or to introduce a separate mechanism alongside it. Services
 in this project are written in different languages (Rust for
-`analytics-api`, .NET 9 for `identity`); the policy must allow each
+`analytics`, .NET 9 for `identity`); the policy must allow each
 service to pick the idiomatic migration library for its language
 while keeping the ownership rules identical.
 
@@ -119,7 +119,7 @@ while keeping the ownership rules identical.
 
 ## Related
 
-- `docs/components/backend/specs/ADR/` (analytics-api SeaORM Migrator
+- `docs/components/backend/specs/ADR/` (analytics SeaORM Migrator
   is the source pattern this ADR generalises).
 - `src/backend/services/identity/src/Insight.Identity.Infrastructure/Migrations/`
   — first .NET service-owned migration set under this policy.
diff --git a/docs/domain/ingestion/specs/DESIGN.md b/docs/domain/ingestion/specs/DESIGN.md
index 8d1491b3c..593f7eacd 100644
--- a/docs/domain/ingestion/specs/DESIGN.md
+++ b/docs/domain/ingestion/specs/DESIGN.md
@@ -654,7 +654,7 @@ K8s Cluster
     └── Helm release: insight (chart: charts/insight, this repo)
         ├── ClickHouse (StatefulSet — separate L2 release, see §4 below)
         ├── MariaDB (Bitnami subchart — per-service databases:
-        │              analytics-api owns `insight`, identity-resolution
+        │              analytics owns `insight`, identity-resolution
         │              owns `identity` per ADR-0006)
         ├── Redis (Bitnami subchart — cache for API Gateway / Analytics API)
         ├── Redpanda (subchart — Kafka-compatible event broker)
@@ -808,8 +808,8 @@ There is **no global MariaDB migration mechanism** in this project.
 Each backend service that owns MariaDB tables carries its own
 migrations inside the service codebase and applies them at startup.
 
-- **analytics-api** (Rust): SeaORM `Migrator` at
-  `src/backend/services/analytics-api/src/migration/`; tracker table
+- **analytics** (Rust): SeaORM `Migrator` at
+  `src/backend/services/analytics/src/migration/`; tracker table
   `seaql_migrations` in the database referenced by
   `mariadb.database` (umbrella chart, default `insight`).
 - **identity** (.NET 9): DbUp at
diff --git a/docs/domain/metric-catalog/specs/ADR/ADR-001-query-catalog-junction-fk.md b/docs/domain/metric-catalog/specs/ADR/ADR-001-query-catalog-junction-fk.md
index 6346fb24d..e5357b8e5 100644
--- a/docs/domain/metric-catalog/specs/ADR/ADR-001-query-catalog-junction-fk.md
+++ b/docs/domain/metric-catalog/specs/ADR/ADR-001-query-catalog-junction-fk.md
@@ -13,7 +13,7 @@ date: 2026-05-29
 
 ## Context and Problem Statement
 
-`metrics` (the analytics-api MariaDB table holding ClickHouse `query_ref` SQL strings) and `metric_catalog` (the consumer-facing semantic-metadata table introduced in #519) were intentionally linked only by a string match on `metric_key` — DESIGN.md §3.1 phrased it as *"Loose pointer; no FK; opacity preserved per PRD §1.1 layer boundary"*, and §6 integration table reinforced it.
+`metrics` (the analytics MariaDB table holding ClickHouse `query_ref` SQL strings) and `metric_catalog` (the consumer-facing semantic-metadata table introduced in #519) were intentionally linked only by a string match on `metric_key` — DESIGN.md §3.1 phrased it as *"Loose pointer; no FK; opacity preserved per PRD §1.1 layer boundary"*, and §6 integration table reinforced it.
 
 In practice, that left two questions structurally unanswerable from the schema alone:
 
@@ -98,6 +98,6 @@ DESIGN.md §3.1 relationship line, §3.5 dependency table, and §3.7 schema list
 
 ## More Information
 
-- Migration: `src/backend/services/analytics-api/src/migration/m20260529_000001_metric_query_catalog_link.rs`
-- Related migration that anticipated this ADR: `src/backend/services/analytics-api/src/migration/m20260522_000002_metric_threshold.rs` lines 23-31
+- Migration: `src/backend/services/analytics/src/migration/m20260529_000001_metric_query_catalog_link.rs`
+- Related migration that anticipated this ADR: `src/backend/services/analytics/src/migration/m20260522_000002_metric_threshold.rs` lines 23-31
 - DESIGN amendment locations: `docs/domain/metric-catalog/specs/DESIGN.md` §3.1 relationship line, §3.5 dependency table row for `analytics.metrics`, §3.7 new `metric_query_catalog` table block
diff --git a/docs/domain/metric-catalog/specs/ADR/ADR-002-metric-key-on-wire-for-fe-bridge.md b/docs/domain/metric-catalog/specs/ADR/ADR-002-metric-key-on-wire-for-fe-bridge.md
index 5f92a6cfa..a526c2217 100644
--- a/docs/domain/metric-catalog/specs/ADR/ADR-002-metric-key-on-wire-for-fe-bridge.md
+++ b/docs/domain/metric-catalog/specs/ADR/ADR-002-metric-key-on-wire-for-fe-bridge.md
@@ -100,7 +100,7 @@ Per the additive-field stability contract, the field can be added without a majo
 
 ## More Information
 
-- Wire-shape struct: `src/backend/services/analytics-api/src/domain/catalog/response.rs`
+- Wire-shape struct: `src/backend/services/analytics/src/domain/catalog/response.rs`
 - DESIGN amendment: `docs/domain/metric-catalog/specs/DESIGN.md` §3.3 Catalog Consumer Contract — the "MUST NOT be reverse-engineered" sentence is narrowed.
 - FE issue: constructorfabric/insight-front#66 — the consumer that needs this bridge.
 - Companion ADR-003 surfaces the `metric_query_catalog` link map for the same transitional release.
diff --git a/docs/domain/metric-catalog/specs/ADR/ADR-003-link-map-on-catalog-read-response.md b/docs/domain/metric-catalog/specs/ADR/ADR-003-link-map-on-catalog-read-response.md
index 00308307a..2d1aad98f 100644
--- a/docs/domain/metric-catalog/specs/ADR/ADR-003-link-map-on-catalog-read-response.md
+++ b/docs/domain/metric-catalog/specs/ADR/ADR-003-link-map-on-catalog-read-response.md
@@ -94,8 +94,8 @@ Cache integration: `links` is cached as part of the `CatalogResponse` payload 
 
 ## More Information
 
-- Junction migration: `src/backend/services/analytics-api/src/migration/m20260529_000001_metric_query_catalog_link.rs` (introduced by ADR-001).
-- Resolver implementation: `src/backend/services/analytics-api/src/domain/catalog/resolver.rs::fetch_links`.
-- Wire shape: `src/backend/services/analytics-api/src/domain/catalog/response.rs::MetricQueryLink`.
+- Junction migration: `src/backend/services/analytics/src/migration/m20260529_000001_metric_query_catalog_link.rs` (introduced by ADR-001).
+- Resolver implementation: `src/backend/services/analytics/src/domain/catalog/resolver.rs::fetch_links`.
+- Wire shape: `src/backend/services/analytics/src/domain/catalog/response.rs::MetricQueryLink`.
 - FE consumer requirement: constructorfabric/insight-front#66 — Step 3 "Two-layer caching".
 - Companion ADR-002 surfaces `metric_key` on each catalog row for the same transitional release.
diff --git a/docs/domain/metric-catalog/specs/DESIGN.md b/docs/domain/metric-catalog/specs/DESIGN.md
index 06c696278..42562f366 100644
--- a/docs/domain/metric-catalog/specs/DESIGN.md
+++ b/docs/domain/metric-catalog/specs/DESIGN.md
@@ -165,7 +165,7 @@ The catalog's admin write path depends on `is_tenant_admin(tenant_id)` and an `a
 
 - [ ] `p2` - **ID**: `cpt-metric-cat-constraint-tenant-default`
 
-For single-tenant installations (local dev, on-prem deployments with one tenant, the local gitops cluster) the operator MAY configure a `tenantDefaultId` (UUID) in the analytics-api Helm `values.yaml`; when a request does not carry a tenant context (no session-bound `tenant_id`, no upstream tenant header), `cpt-metric-cat-component-auth-trait` falls back to this configured default for both the read and admin paths. Multi-tenant installations leave `tenantDefaultId` unset — in that mode a tenant-less request is rejected with a canonical `invalid_argument` envelope (`field_violations` entry with `field = "tenant_id"`, `reason = "TENANT_UNRESOLVED"`) per §3.3. Mirrors the identity-resolution pattern (`IDENTITY__identity__tenant_default_id` → `ConfigTenantContext` in `src/backend/services/identity`), so operators see the same single-tenant ergonomic across Insight services.
+For single-tenant installations (local dev, on-prem deployments with one tenant, the local gitops cluster) the operator MAY configure a `tenantDefaultId` (UUID) in the analytics Helm `values.yaml`; when a request does not carry a tenant context (no session-bound `tenant_id`, no upstream tenant header), `cpt-metric-cat-component-auth-trait` falls back to this configured default for both the read and admin paths. Multi-tenant installations leave `tenantDefaultId` unset — in that mode a tenant-less request is rejected with a canonical `invalid_argument` envelope (`field_violations` entry with `field = "tenant_id"`, `reason = "TENANT_UNRESOLVED"`) per §3.3. Mirrors the identity-resolution pattern (`IDENTITY__identity__tenant_default_id` → `ConfigTenantContext` in `src/backend/services/identity`), so operators see the same single-tenant ergonomic across Insight services.
 
 **ADRs**: _no ADRs in v1._
 
@@ -190,7 +190,7 @@ Every `metric_catalog.metric_key` (in `table_name.column_name` form) MUST resolv
 ### 3.1 Domain Model
 
 **Technology**: Rust types (SeaORM-backed entities + pure-domain value objects).
-**Location**: `src/backend/services/analytics-api/src/domain/` (entities) and `src/backend/services/analytics-api/src/services/metric_catalog/` (resolver-side value objects).
+**Location**: `src/backend/services/analytics/src/domain/` (entities) and `src/backend/services/analytics/src/services/metric_catalog/` (resolver-side value objects).
 
 The catalog has four first-class types. Three are persisted (`Metric`, `Threshold`, `AuditEvent`); one is a read-side value object (`ResolvedThreshold`) constructed in memory and never written back. All v1 invariants are enforced at both DB layer (CHECK constraints in migrations) and application layer (CRUD validators) per `cpt-metric-cat-principle-dual-validate`.
 
@@ -314,7 +314,7 @@ The catalog has four first-class types. Three are persisted (`Metric`, `Threshol
 
 ### 3.2 Component Model
 
-All components live within `analytics-api`. The diagram below shows logical structure; deployment is a single service per replica (see §3.8). Read and write paths share the `auth-trait` (writes) and `cache-layer` (reads only; writes invalidate it). `seed-migration` runs at service startup, not on the request path.
+All components live within `analytics`. The diagram below shows logical structure; deployment is a single service per replica (see §3.8). Read and write paths share the `auth-trait` (writes) and `cache-layer` (reads only; writes invalidate it). `seed-migration` runs at service startup, not on the request path.
 
 ```mermaid
 flowchart LR
@@ -535,7 +535,7 @@ Sole writer of `threshold_lock_audit` rows and the corresponding structured log
 - Does NOT make policy decisions — it accepts events and emits them; the lock-bypass decision lives in `cpt-metric-cat-component-lock-enforcer`.
 - Does NOT read or update older audit rows — `threshold_lock_audit` is append-only.
 - Does NOT manage retention — lifecycle is external to the service.
-- Does NOT validate event content beyond shape; callers are trusted within the analytics-api process.
+- Does NOT validate event content beyond shape; callers are trusted within the analytics process.
 
 ##### Related components (by ID)
 
@@ -579,7 +579,7 @@ Owns the contract that every `metric_key` (in `table_name.column_name` form) res
 
 ##### Responsibility scope
 
-- At service startup (after `cpt-metric-cat-component-seed-migration` finishes), spawn a **background task** that walks every `metric_catalog` row, parses `metric_key` as `table.column`, and queries ClickHouse `system.columns` for existence. The task runs **post-readiness** — the analytics-api readiness probe MUST succeed without it, so a ClickHouse outage cannot block deploys or restart-storm the service.
+- At service startup (after `cpt-metric-cat-component-seed-migration` finishes), spawn a **background task** that walks every `metric_catalog` row, parses `metric_key` as `table.column`, and queries ClickHouse `system.columns` for existence. The task runs **post-readiness** — the analytics readiness probe MUST succeed without it, so a ClickHouse outage cannot block deploys or restart-storm the service.
 - ClickHouse queries MUST use bound parameters: `SELECT count() FROM system.columns WHERE database = ? AND table = ? AND name = ?`. The `metric_key` is parsed in Rust and the two halves are passed as parameters; raw `metric_key` is NEVER string-interpolated into SQL even though the v1 CHECK regex constrains its shape (defense in depth).
 - The ClickHouse principal used here MUST be a read-only role scoped to `system.columns` filtered to the analytics database — principle of least privilege.
 - On ClickHouse unreachable, set `schema_status = 'unchecked'` and `schema_error_code = 'clickhouse_unreachable'`, then retry the affected row(s) with exponential backoff. Emit a metric so operators see degraded mode.
@@ -756,7 +756,7 @@ Fields `type`, `title`, `status`, `detail`, `context` are always present; `insta
 #### Catalog Consumer Contract
 
 - **References**: `cpt-metric-cat-contract-consumer` (defined in PRD §7.2)
-- **Direction**: provided by `analytics-api`
+- **Direction**: provided by `analytics`
 - **Technology**: REST / JSON over HTTPS (mirrors `cpt-metric-cat-interface-read`)
 - **Location**: in this DESIGN — full FEATURE-level spec lands later
 - **Stability**: stable
@@ -769,12 +769,12 @@ Consumers MUST NOT hardcode any catalog-provided field (label, sublabel, descrip
 
 ### 3.4 Internal Dependencies
 
-All nine components live inside the `analytics-api` crate; the catalog has no inbound dependencies from other Insight services. The only internal dependencies that cross a service boundary are the Auth contract (a Rust trait) and the existing analytics-api structured logging stream.
+All nine components live inside the `analytics` crate; the catalog has no inbound dependencies from other Insight services. The only internal dependencies that cross a service boundary are the Auth contract (a Rust trait) and the existing analytics structured logging stream.
 
 | Dependency Module | Interface Used | Purpose |
 |-------------------|----------------|----------|
-| analytics-api Auth | `TenantAuthorization` trait (`cpt-metric-cat-component-auth-trait`) | Provides `actor_subject`, `tenant_id`, and `is_tenant_admin(tenant_id)` to `cpt-metric-cat-component-admin-crud` and `cpt-metric-cat-component-lock-enforcer`; bound by `cpt-metric-cat-constraint-auth-trait`. |
-| analytics-api structured logging | Structured-log stream (existing Loki / ELK sink) | Receives the real-time half of every audit event emitted by `cpt-metric-cat-component-audit-emitter` (dual sink alongside `threshold_lock_audit`) and every schema-validation state transition emitted by `cpt-metric-cat-component-schema-validator`. |
+| analytics Auth | `TenantAuthorization` trait (`cpt-metric-cat-component-auth-trait`) | Provides `actor_subject`, `tenant_id`, and `is_tenant_admin(tenant_id)` to `cpt-metric-cat-component-admin-crud` and `cpt-metric-cat-component-lock-enforcer`; bound by `cpt-metric-cat-constraint-auth-trait`. |
+| analytics structured logging | Structured-log stream (existing Loki / ELK sink) | Receives the real-time half of every audit event emitted by `cpt-metric-cat-component-audit-emitter` (dual sink alongside `threshold_lock_audit`) and every schema-validation state transition emitted by `cpt-metric-cat-component-schema-validator`. |
 
 **Dependency Rules** (per project conventions):
 
@@ -792,11 +792,11 @@ All nine components live inside the `analytics-api` crate; the catalog has no in
 | `analytics.metrics` table | Read-only (string pointer) + M:N referential link | Holds the existing `query_ref` rows; `metric_catalog.metric_key` aligns by string with the metric keys each query emits. A separate `metric_query_catalog` junction table (§3.7) carries M:N FKs `(metrics.id, metric_catalog.id)` to make "which catalog rows does this query emit" structurally enforced. Catalog still never opens `query_ref`; opacity per PRD §1.1 layer boundary is preserved (the junction carries only IDs, not the SQL payload). |
 | ClickHouse `system.columns` | Read-only schema introspection | Used by `cpt-metric-cat-component-schema-validator` to confirm each metric's `table.column` reference exists; result is cached on `metric_catalog.schema_status` so reads never hit ClickHouse on the request path. |
 | `modkit-canonical-errors` (cyberfabric-core Rust crate) | `CanonicalError` enum + RFC 9457 `Problem` serializer + `#[resource_error]` macro | Every 4xx / 5xx response across catalog endpoints is constructed through this crate per the §3.3 error envelope. Aligns the catalog's wire shape with DNA `REST/API.md §7` and other cyberfabric services so a shared client error handler works across the platform. |
-| analytics-api Helm chart (`src/backend/services/analytics-api/helm/values.yaml`) | `tenantDefaultId` (UUID, optional) → env var `ANALYTICS__metric_catalog__tenant_default_id` → Rust config `metric_catalog.tenant_default_id` | Single-tenant fallback consumed by `cpt-metric-cat-component-auth-trait.resolve_tenant` per `cpt-metric-cat-constraint-tenant-default`. Multi-tenant installs leave it unset. Mirrors `IDENTITY__identity__tenant_default_id` in the identity service. |
+| analytics Helm chart (`src/backend/services/analytics/helm/values.yaml`) | `tenantDefaultId` (UUID, optional) → env var `ANALYTICS__metric_catalog__tenant_default_id` → Rust config `metric_catalog.tenant_default_id` | Single-tenant fallback consumed by `cpt-metric-cat-component-auth-trait.resolve_tenant` per `cpt-metric-cat-constraint-tenant-default`. Multi-tenant installs leave it unset. Mirrors `IDENTITY__identity__tenant_default_id` in the identity service. |
 
 **Dependency Rules** (per project conventions):
 
-- No circular dependencies — analytics-api is the sole writer to its MariaDB schema and the only consumer of the cache; `analytics.metrics` and ClickHouse `system.columns` are read-only here.
+- No circular dependencies — analytics is the sole writer to its MariaDB schema and the only consumer of the cache; `analytics.metrics` and ClickHouse `system.columns` are read-only here.
 - All inter-system traffic crosses versioned contracts (SeaORM entities, `CacheLayer` trait); the catalog never opens or parses external opaque payloads (e.g., `query_ref`).
 - Only `cpt-metric-cat-component-cache-layer` talks to the cache backend; only `cpt-metric-cat-component-seed-migration` and `cpt-metric-cat-component-admin-crud` write to MariaDB tables owned by the catalog.
 - Tenant context is propagated across every external call — cache keys are tenant-prefixed; MariaDB writes carry `tenant_id` even when v1 CHECK constrains it to NULL.
@@ -1130,9 +1130,9 @@ Both rows point at the same catalog row because both queries pivot the same `tas
 
 - [ ] `p3` - **ID**: `cpt-metric-cat-topology-analytics-api`
 
-The catalog ships entirely inside the existing `analytics-api` service; v1 introduces **no new deployment unit**. Every analytics-api replica carries the nine components from §3.2 and, at startup, runs the SeaORM migration runner (`cpt-metric-cat-component-seed-migration`) followed by the schema-validation pass (`cpt-metric-cat-component-schema-validator`). The cache backend (Redis OR pub-sub channel), MariaDB, and the ClickHouse warehouse (queried read-only via `system.columns`) are shared across replicas. Cross-replica invalidation MUST observe `cpt-metric-cat-nfr-cross-replica-invalidation` (≤ 2 s p99) — that bound is the load-bearing reason this layer is not purely in-process.
+The catalog ships entirely inside the existing `analytics` service; v1 introduces **no new deployment unit**. Every analytics replica carries the nine components from §3.2 and, at startup, runs the SeaORM migration runner (`cpt-metric-cat-component-seed-migration`) followed by the schema-validation pass (`cpt-metric-cat-component-schema-validator`). The cache backend (Redis OR pub-sub channel), MariaDB, and the ClickHouse warehouse (queried read-only via `system.columns`) are shared across replicas. Cross-replica invalidation MUST observe `cpt-metric-cat-nfr-cross-replica-invalidation` (≤ 2 s p99) — that bound is the load-bearing reason this layer is not purely in-process.
 
-**Tenancy mode**: a deployment is **single-tenant** when the analytics-api Helm values `tenantDefaultId` is set to a UUID (the auth-trait falls back to it on every tenant-less request) and **multi-tenant** when `tenantDefaultId` is unset (tenant-less requests are rejected per `cpt-metric-cat-constraint-tenant-default`). The catalog itself is identical in both modes — only the auth-trait resolution shape differs.
+**Tenancy mode**: a deployment is **single-tenant** when the analytics Helm values `tenantDefaultId` is set to a UUID (the auth-trait falls back to it on every tenant-less request) and **multi-tenant** when `tenantDefaultId` is unset (tenant-less requests are rejected per `cpt-metric-cat-constraint-tenant-default`). The catalog itself is identical in both modes — only the auth-trait resolution shape differs.
 
 ```
                   ┌─────────────────────────┐
@@ -1142,7 +1142,7 @@ The catalog ships entirely inside the existing `analytics-api` service; v1 intro
                              │ HTTPS
                              ▼
    ┌───────────────────────────────────────────────────┐
-   │   analytics-api replicas (N, behind LB)           │
+   │   analytics replicas (N, behind LB)               │
    │   ┌────────┐  ┌────────┐   ...   ┌────────┐       │
    │   │ rep-1  │  │ rep-2  │         │ rep-N  │       │
    │   └───┬────┘  └───┬────┘         └───┬────┘       │
@@ -1193,10 +1193,10 @@ Three DESIGN-phase Open Questions carry forward from PRD §13. Each is sized to
 
 **Options**:
 
-- **Redis shared cache** with a tenant-keyed namespace — writes invalidate the shared key; reads on any replica see the change on next fetch. Adds Redis as a runtime dependency for analytics-api.
+- **Redis shared cache** with a tenant-keyed namespace — writes invalidate the shared key; reads on any replica see the change on next fetch. Adds Redis as a runtime dependency for analytics.
 - **Pub-sub broadcast on top of in-process LRU** — each replica keeps an in-process cache; admin-write triggers a pub-sub message that peers consume to drop their keys. Keeps the hit path purely in-process (lowest latency) but doubles cache reasoning (in-process state + broadcast bus).
 
-**Recommendation**: Redis with a tenant-keyed namespace — operationally simpler, and analytics-api already runs alongside other Redis-using services in the cluster. The pub-sub variant only wins if Redis is judged too heavy or unavailable in the target environment.
+**Recommendation**: Redis with a tenant-keyed namespace — operationally simpler, and analytics already runs alongside other Redis-using services in the cluster. The pub-sub variant only wins if Redis is judged too heavy or unavailable in the target environment.
 
 **Resolution-Target**: DESIGN review (before implementation kicks off). The `CacheLayer` trait hides the choice from every other component, so resolution is a single-component swap.
 
diff --git a/docs/domain/metric-catalog/specs/PRD.md b/docs/domain/metric-catalog/specs/PRD.md
index 2c0115dc8..59d1a63f7 100644
--- a/docs/domain/metric-catalog/specs/PRD.md
+++ b/docs/domain/metric-catalog/specs/PRD.md
@@ -54,8 +54,8 @@
 - **v1.10**: Reframed tenant-custom metrics from "out of scope, cross-layer PRD required" to "additive follow-on, v1 schema pre-wired". **`metric_catalog` gains a nullable `tenant_id` column in v1** with a CHECK constraint forcing `tenant_id IS NULL` — identical pattern to `lock_expires_at`. All v1 rows remain global (product-owned); the column ships dead, ready for the follow-on FR that lifts the CHECK and adds CRUD for tenant-custom metrics. This chooses path (a) from the v1.9 §13 OQ (nullable `tenant_id` on the existing table) over path (b) (separate `metric_catalog_tenant_custom` table). Rationale: architectural symmetry with thresholds — product-owned global baseline + tenant-owned additive overlay — without the footgun of making product metadata tenant-editable. Cross-tenant comparability preserved because product-owned metrics stay product-owned (`cpt-metric-cat-fr-metadata-writes` unchanged); tenant customization becomes additive (append a row with `tenant_id = X`), never a replacement. **§4.2 bullet on tenant-custom rewritten** from "warrants its own PRD" to "ships in a follow-on PRD; v1 schema ready". **§13 OQ on tenant-custom closed**: path (a) chosen. **Three new §13 OQs opened for the follow-on scope**: (i) query-layer storage model for tenant-custom — tenant-scoped rows in `analytics.metrics` vs a formula DSL poverh existing metrics (prototype demonstrated both UX shapes) vs both; (ii) disable-for-me slot — additive table letting a tenant hide a product-owned metric for themselves without affecting others; (iii) PK evolution strategy — keep v1 `PK = metric_key` and rebuild when tenant-custom lands, or ship v1 with synthetic `id` + `UNIQUE(tenant_id, metric_key)` to avoid PK rebuild. **New §11 Assumption** and **§12 Risk** on tenant maintenance burden: when tenant-custom lands, product commits silver backward-compat only for metrics in the global catalog; tenants owning custom metrics accept responsibility for updating them when depended-upon silver columns change. This is the contract that makes silver evolution tractable — append-only-forever obligation on product-owned silver coverage only, not on every field a tenant might have bound to. Read endpoint response shape is unchanged in v1; when the follow-on lifts the CHECK, resolution filters rows by `tenant_id IN (caller, NULL)` and optionally surfaces `owner: 'product' | 'tenant'` as an additive field.
 - **v1.9**: Disambiguated two previously-conflated metadata restrictions: (a) *editing* existing metric metadata per-tenant (labels, units, formats) — covered by the global `metric_catalog` keying choice in v1.7 and by `cpt-metric-cat-fr-metadata-writes`; (b) *adding* tenant-specific custom metrics that exist only for one tenant — not addressed by v1.7 and genuinely out of v1 scope. Custom per-tenant metrics require tenant-specific `query_ref` rows in `analytics.metrics`, tenant-aware catalog rows, and potentially tenant-specific silver/gold transforms — a cross-layer design reaching well beyond the catalog. Added explicit Out-of-Scope bullet in §4.2, new Open Question in §13 with two additive extension paths (nullable `tenant_id` column vs dedicated `metric_catalog_tenant_custom` table), and a parallel note in `PRD_human_readable.md`. No schema or API change in v1 — the global `metric_catalog` shape keeps both extension paths available as additive follow-ons. Also added a pointer from PRD.md to the new human-readable companion document.
 - **v1.8**: Audit-tightening, Glossary cleanup, and DESIGN-handoff hardening. (1) `lock_reason` is now NOT NULL whenever `is_locked = true` (enforced via DB CHECK `is_locked = false OR lock_reason IS NOT NULL`). Empty `lock_reason` in an audit event would be a red flag for SOC2 / ISO auditors; requiring it at write-time keeps the audit trail useful. (2) New `p2` follow-on FR `cpt-metric-cat-fr-integrity-check` — periodic background job flagging `metric_threshold` rows whose `role_slug` / `team_id` no longer matches any live taxonomy. Gated on `role_catalog` delivery; v1 accepts the v1-only dangling-reference window explicitly in §12. (3) Extended the closed OQ on product-default locks with emergency-migration mitigation: migration-only override policy stands, but pipelines for compliance-emergency migrations may skip non-essential gates to compress hours-to-days down to ~1 hour while preserving git audit trail. Runtime feature-flag bypass explicitly rejected. (4) **Glossary cleanup**: rewrote `Metric threshold`, `Threshold scope`, `Role-scoped override` to match the v1.4 scope model (they were still v1.3 `dashboard`-based); added `Role`, `Team`, `Dashboard scope (rejected)` entries. (5) Added implementation note to `cpt-metric-cat-fr-scoped-thresholds`: `POST /v1/catalog/get_metrics` must resolve via one bulk fetch plus in-memory walk; N+1 fanout fails the read-latency NFR. (6) **Constraint enforcement requires both DB CHECK and app-layer validation** (not either-or): DB is ultimate backstop against writes bypassing the API; app layer owns user-facing errors and covers old-MariaDB / SeaORM-bug edge cases. (7) **Closed OQ on audit destination** — ship dedicated `threshold_lock_audit` MariaDB table in v1 alongside structured logs. Table gives queryable long-term retention (≥ 1 year default) independent of log-aggregation retention policy, unblocks future CSV / JSON export from admin UI, and decouples audit retention from log-cost economics. Full lifecycle (`lock_set` / `lock_cleared` / `bypass_attempt`) lands in the same table. (8) Added risk and mitigation for Auth service delivery slipping and blocking the catalog write path — decouple via a Rust trait + test-double stub for staging / local-dev; production gates on the real Auth implementation.
-- **v1.7**: Five Enterprise-grade hardening changes. (1) Promoted cross-replica cache invalidation from Open Question to a `p1` NFR (`cpt-metric-cat-nfr-cross-replica-invalidation`); DESIGN must pick a mechanism (shared cache, pub-sub broadcast, or equivalent) that makes admin-write visibility observable across all analytics-api replicas within the NFR threshold. Pure in-process caching is no longer compliant. (2) Added a minimum authentication contract to §11 Assumptions — the auth layer must provide `actor_id`, `tenant_id`, and an `is_tenant_admin(tenant_id)` predicate; override-lock and bypass-lock permissions are separate capabilities owned by the Auth PRD. (3) **Changed `metric_catalog` keying from `(tenant_id, metric_key)` to global `metric_key`**. Per-tenant metadata duplication was a tax on a feature v1 forbids (metadata writes are migration-only). Threshold table remains per-tenant — it is local policy, not product-level metadata. An additive per-tenant metadata-override table can land later if the "per-tenant localization" use case ever becomes real. (4) Added `lock_expires_at` nullable timestamp column to `metric_threshold` with a v1 CHECK constraint enforcing `NULL`; expiry semantics ship in a follow-on when a concrete temporal-lock FR lands. Avoids a breaking migration later. (5) Promoted `source_tag` to `source_tags: string[]` in the API contract (`POST /v1/catalog/get_metrics` response shape). Storage shape (JSON column vs join-table) remains a DESIGN question, but the API is forward-compatible. Also closed the `product-default` locks OQ with an explicit answer: product-default locks are migrations-only, there is no runtime override mechanism; legitimate legal-override requests flow through backend code migrations.
-- **v1.6**: Tightened `is_locked` lock placement to `product-default` and `tenant` scopes only in v1 — locks at `role` / `team` / `team+role` are deferred until there is a real use case. Promoted audit fields `locked_by` / `locked_at` / `lock_reason` from Open Question to required columns in `cpt-metric-cat-fr-threshold-storage`, because emitting a structured "lock-bypass attempt" audit event (the new compliance FR `cpt-metric-cat-fr-threshold-lock-bypass-audit`) requires knowing who authored the lock and when — the event would be incomplete without those fields. Added a `p2` FR `cpt-metric-cat-fr-threshold-lock-bypass-audit` that emits a structured audit event on every 403 `threshold_locked` response, so security / compliance teams can see who tried to bypass locks. Added `locked_at` to the 403 error body. Added OQ on lock granularity (row-level atomic vs per-field), with v1 default being atomic. Added OQ on audit-log destination (analytics-api structured logs vs a dedicated `threshold_lock_audit` table vs both) and retention.
+- **v1.7**: Five Enterprise-grade hardening changes. (1) Promoted cross-replica cache invalidation from Open Question to a `p1` NFR (`cpt-metric-cat-nfr-cross-replica-invalidation`); DESIGN must pick a mechanism (shared cache, pub-sub broadcast, or equivalent) that makes admin-write visibility observable across all analytics replicas within the NFR threshold. Pure in-process caching is no longer compliant. (2) Added a minimum authentication contract to §11 Assumptions — the auth layer must provide `actor_id`, `tenant_id`, and an `is_tenant_admin(tenant_id)` predicate; override-lock and bypass-lock permissions are separate capabilities owned by the Auth PRD. (3) **Changed `metric_catalog` keying from `(tenant_id, metric_key)` to global `metric_key`**. Per-tenant metadata duplication was a tax on a feature v1 forbids (metadata writes are migration-only). Threshold table remains per-tenant — it is local policy, not product-level metadata. An additive per-tenant metadata-override table can land later if the "per-tenant localization" use case ever becomes real. (4) Added `lock_expires_at` nullable timestamp column to `metric_threshold` with a v1 CHECK constraint enforcing `NULL`; expiry semantics ship in a follow-on when a concrete temporal-lock FR lands. Avoids a breaking migration later. (5) Promoted `source_tag` to `source_tags: string[]` in the API contract (`POST /v1/catalog/get_metrics` response shape). Storage shape (JSON column vs join-table) remains a DESIGN question, but the API is forward-compatible. Also closed the `product-default` locks OQ with an explicit answer: product-default locks are migrations-only, there is no runtime override mechanism; legitimate legal-override requests flow through backend code migrations.
+- **v1.6**: Tightened `is_locked` lock placement to `product-default` and `tenant` scopes only in v1 — locks at `role` / `team` / `team+role` are deferred until there is a real use case. Promoted audit fields `locked_by` / `locked_at` / `lock_reason` from Open Question to required columns in `cpt-metric-cat-fr-threshold-storage`, because emitting a structured "lock-bypass attempt" audit event (the new compliance FR `cpt-metric-cat-fr-threshold-lock-bypass-audit`) requires knowing who authored the lock and when — the event would be incomplete without those fields. Added a `p2` FR `cpt-metric-cat-fr-threshold-lock-bypass-audit` that emits a structured audit event on every 403 `threshold_locked` response, so security / compliance teams can see who tried to bypass locks. Added `locked_at` to the 403 error body. Added OQ on lock granularity (row-level atomic vs per-field), with v1 default being atomic. Added OQ on audit-log destination (analytics structured logs vs a dedicated `threshold_lock_audit` table vs both) and retention.
 - **v1.5**: Added `is_locked` mechanism on `metric_threshold` rows to support compliance use cases (regulated tenants pinning a metric at a given scope so narrower scopes cannot override). `is_locked` is a `p2` FR on the write side and a resolution-logic rule on the read side. Resolution walks least-specific to most-specific and stops at the first locked row; a tenant admin locking the `tenant` row blocks team/role/team+role overrides for that metric in that tenant. Write CRUD rejects narrower-scope writes that would be shadowed by a locked row with a structured `403 threshold_locked` error identifying the blocking scope. `is_locked` is **not** exposed in the v1 `POST /v1/catalog/get_metrics` response — Dashboard Configurator does not need it for rendering, and admin UI is out of v1 scope. It becomes an additive field when admin UI ships. Governance questions (who can set locks, audit fields, lock expiry, product-default locks) tracked as Open Questions.
 - **v1.4**: Narrowed v1 scope to what actually unblocks Dashboard Configurator and removes the frontend-backend metadata duplication. **Calculation rules, invariant tests, `primary_query_id` linkage, admin-diagnostics endpoint, and reverse-lookup endpoint are deferred out of v1** — pushed to a follow-on revision (or to the upcoming silver-plugin-manifest workstream) once there is a real consumer that reads them. The v1 calculation-rule pitch over-promised readability it could not deliver without exposing the silver/gold dependency chain, which lives outside the catalog boundary. **Reshaped the threshold-scope model to match real axes of variance: `team + role → team → role → tenant → product-default`**. All four scopes ship in v1 (not follow-on) because role-level and team-level threshold variance is a motivating v1 use case — "different bars for PMs vs Backend Devs" and "our team's threshold is different" are the actual support calls the catalog exists to solve. `role_slug` and `team_id` are v1 string columns with no FK constraint; the FK onto `role_catalog` / future team-catalog tables lands in a follow-on migration once those tables exist. **The `dashboard` scope from v1.3 is explicitly removed**: it was a proxy for role scope (since dashboards in Dashboard Configurator are keyed by `(view_type, role)`), and once role is a first-class scope, the `dashboard` proxy is redundant. Admins do not naturally think "change threshold on this dashboard"; they think in role / team / company terms. Reframed the catalog as a projection surface: v1 is seeded via migration, but the table shape is kept friendly to future population from silver-plugin manifests (per Roman Mitasov's plugin proposal) without schema change. Added §14 Gap Analysis mirroring Dashboard Configurator's.
 - **v1.3**: Extended the threshold scope model to include `team` as a first-class scope, with precedence `team + dashboard → team → dashboard → tenant → product-default`. Role-scoped overrides remain implicit — they happen through the `dashboard` scope because dashboards are already keyed by `(view_type, role)` in the Dashboard Configurator; no separate `role` scope is introduced. Team scope lands at `p2` and is gated on the Dashboard Configurator's team-lead customization feature, since without an admin path to edit team-scoped thresholds the column is just shelf-ware.
@@ -80,7 +80,7 @@ It replaces the status quo where metric metadata is duplicated between the front
 
 ### 1.2 Background / Problem Statement
 
-Insight's analytics-api today stores only `analytics.metrics` (`id`, `query_ref`, `name`, `description`) and an empty `analytics.thresholds` table. Semantic metadata about each metric — the label a user reads, the unit suffix, whether higher is better, the `good`/`warn` thresholds that drive bullet color — lives on the frontend, hardcoded in TypeScript. Three consequences:
+Insight's analytics today stores only `analytics.metrics` (`id`, `query_ref`, `name`, `description`) and an empty `analytics.thresholds` table. Semantic metadata about each metric — the label a user reads, the unit suffix, whether higher is better, the `good`/`warn` thresholds that drive bullet color — lives on the frontend, hardcoded in TypeScript. Three consequences:
 
 - **Drift**: a metric rename or a unit change requires synchronized edits in two repos; the product has already seen cases where a backend UUID added a new row without a frontend entry and the bullet rendered with generic fallbacks.
 - **Per-tenant threshold tuning is impossible without a frontend deploy**: a compliance team that wants `focus_time_pct` target stricter than engineering has no path shorter than a code change.
@@ -179,7 +179,7 @@ The related "how is this calculated?" opacity — calculation logic living exclu
 
 ### 3.1 Module-Specific Environment Constraints
 
-None beyond project defaults (Rust, Axum, SeaORM, MariaDB). The catalog inherits the analytics-api service runtime.
+None beyond project defaults (Rust, Axum, SeaORM, MariaDB). The catalog inherits the analytics service runtime.
 
 ## 4. Scope
 
@@ -356,7 +356,7 @@ The system **SHOULD** support pinning a threshold row with `is_locked = true` so
 
 When a write to `metric_threshold` is rejected with `403 threshold_locked` per `cpt-metric-cat-fr-threshold-lock`, the system **MUST** emit a structured audit event containing at least: `actor_id` (who attempted the write), `tenant_id`, `metric_key`, `attempted_scope`, `attempted_values` (the `good` / `warn` / etc. the admin tried to set), `blocking_scope`, `blocking_row_id`, `locked_by` (author of the blocking lock), `locked_at` (when the blocking lock was set), and the event's own timestamp. Every event **MUST** be persisted to **both**:
 
-- The analytics-api **structured log stream** — for real-time observability, alerting, and operational dashboards.
+- The analytics **structured log stream** — for real-time observability, alerting, and operational dashboards.
 - A dedicated **`threshold_lock_audit` MariaDB table** (columns: `id`, `event_type` enum `{ bypass_attempt, lock_set, lock_cleared }`, `actor_id`, `tenant_id`, `metric_key`, `attempted_scope` nullable, `attempted_values` JSON nullable, `blocking_scope` nullable, `blocking_row_id` UUID nullable, `locked_by` nullable, `locked_at` nullable, `lock_reason` nullable, `event_at` NOT NULL, `created_at` NOT NULL) — for long-term audit retention and queryable export from a future admin UI.
 
 The table **MUST** support retention of at least 1 year out of the box; tenants with stricter regulatory cycles (banking, healthcare) may require longer. Exact retention policy is an Open Question. A successful lock set or clear **MUST** also emit a corresponding `lock_set` / `lock_cleared` event to both sinks, so the full lifecycle is visible.
@@ -419,7 +419,7 @@ This FR is gated on Dashboard Configurator delivering `role_catalog` (no canonic
 
 `POST /v1/catalog/get_metrics` p95 response time **MUST** be ≤ 100ms on a cache hit and ≤ 500ms on a cache miss for a tenant with up to 200 catalog rows.
 
-**Threshold**: p95 ≤ 100ms (hit), ≤ 500ms (miss), measured at the analytics-api service level.
+**Threshold**: p95 ≤ 100ms (hit), ≤ 500ms (miss), measured at the analytics service level.
 
 #### Consistency — Write-After-Read Visibility
 
@@ -433,11 +433,11 @@ A successful threshold write **MUST** be visible to subsequent `POST /v1/catalog
 
 - [ ] `p1` - **ID**: `cpt-metric-cat-nfr-cross-replica-invalidation`
 
-When an admin write on one analytics-api replica invalidates the cache for a tenant, the invalidation **MUST** be observable across all replicas within the NFR threshold. Pure in-process caching (where each replica holds its own LRU and does not coordinate with peers) **MUST NOT** be used; DESIGN picks between a shared cache (e.g., Redis with a tenant-keyed namespace) and a pub-sub broadcast that invalidates peer replicas' in-process caches.
+When an admin write on one analytics replica invalidates the cache for a tenant, the invalidation **MUST** be observable across all replicas within the NFR threshold. Pure in-process caching (where each replica holds its own LRU and does not coordinate with peers) **MUST NOT** be used; DESIGN picks between a shared cache (e.g., Redis with a tenant-keyed namespace) and a pub-sub broadcast that invalidates peer replicas' in-process caches.
 
 **Threshold**: 99th-percentile cross-replica invalidation latency ≤ 2 seconds after the admin write commits.
 
-**Rationale**: With multi-replica analytics-api, in-process caching would silently fail the write-visibility promise in `cpt-metric-cat-nfr-write-visibility` — a user hitting a different replica from the one that served their admin write would see stale data for up to a full TTL. For a compliance-facing product where admin writes are auditable actions, that staleness is a support-call generator and a regulatory red flag. Committing to a cross-replica mechanism in v1 forces DESIGN to pick a concrete path (Redis vs pub-sub) rather than kicking the problem to production.
+**Rationale**: With multi-replica analytics, in-process caching would silently fail the write-visibility promise in `cpt-metric-cat-nfr-write-visibility` — a user hitting a different replica from the one that served their admin write would see stale data for up to a full TTL. For a compliance-facing product where admin writes are auditable actions, that staleness is a support-call generator and a regulatory red flag. Committing to a cross-replica mechanism in v1 forces DESIGN to pick a concrete path (Redis vs pub-sub) rather than kicking the problem to production.
 
 ### 6.2 NFR Exclusions
 
@@ -559,7 +559,7 @@ When an admin write on one analytics-api replica invalidates the cache for a ten
 
 ## 9. Acceptance Criteria
 
-- [ ] `metric_catalog` and `metric_threshold` tables exist in analytics-api's MariaDB, with sea-orm migrations that seed the frontend metadata one-to-one
+- [ ] `metric_catalog` and `metric_threshold` tables exist in analytics's MariaDB, with sea-orm migrations that seed the frontend metadata one-to-one
 - [ ] `metric_catalog` has a nullable `tenant_id` column with a v1 CHECK constraint enforcing `tenant_id IS NULL`; every v1 row is a global product-owned row and no v1 behavior depends on the column; the column exists so the tenant-custom follow-on lifts the CHECK additively without a breaking migration
 - [ ] v1 write paths (seed migrations, any internal row-creation code) never produce a row with `tenant_id IS NOT NULL`; the DB CHECK rejects such a row as a backstop
 - [ ] `metric_catalog.source_tags` is an array of strings in the API response (one-element for single-source metrics); storage shape is DESIGN's choice but the API contract does not change
@@ -580,7 +580,7 @@ When an admin write on one analytics-api replica invalidates the cache for a ten
 - [ ] Setting `is_locked = true` populates `locked_by` (from the authenticated actor), `locked_at` (server timestamp), and `lock_reason` (non-empty string from the caller); clearing the lock resets all three to NULL
 - [ ] A lock-set write without `lock_reason` is rejected by the API with HTTP 400; an attempt to insert a row into `metric_threshold` with `is_locked = true` and `lock_reason IS NULL` is rejected by the DB CHECK constraint
 - [ ] The follow-on release that introduces FK constraints on `role_slug` / `team_id` also ships `cpt-metric-cat-fr-integrity-check`; the integrity job runs on a schedule and flags orphaned references in admin diagnostics
-- [ ] Every rejected write returning `403 threshold_locked` also emits a structured audit event containing `actor_id`, `tenant_id`, `metric_key`, `attempted_scope`, `attempted_values`, `blocking_scope`, `blocking_row_id`, `locked_by`, `locked_at`, and event timestamp, persisted to **both** the analytics-api structured log stream and a dedicated `threshold_lock_audit` MariaDB table
+- [ ] Every rejected write returning `403 threshold_locked` also emits a structured audit event containing `actor_id`, `tenant_id`, `metric_key`, `attempted_scope`, `attempted_values`, `blocking_scope`, `blocking_row_id`, `locked_by`, `locked_at`, and event timestamp, persisted to **both** the analytics structured log stream and a dedicated `threshold_lock_audit` MariaDB table
 - [ ] A successful lock-set and a successful lock-clear each emit corresponding `lock_set` / `lock_cleared` events to both sinks, so full lifecycle is queryable from the audit table
 - [ ] `threshold_lock_audit` table retention is ≥ 1 year; retention is enforced either by partition lifecycle or a scheduled pruning job (exact mechanism is DESIGN's choice)
 - [ ] All CHECK constraints declared in `cpt-metric-cat-fr-threshold-storage` (including `is_locked = false OR lock_reason IS NOT NULL` and `lock_expires_at IS NULL`) are enforced at **both** the DB layer (via migration DDL) and the application layer (via CRUD validation with structured error responses)
@@ -603,8 +603,8 @@ When an admin write on one analytics-api replica invalidates the cache for a ten
 - Tenants are single-region; the catalog does not need multi-region replication.
 - v1 stores plain-English strings in `label`, `sublabel`, `description` and ships no i18n loader. Localization is a follow-on (see §6.2 NFR Exclusions).
 - The product team is the owner of metric semantics in v1; tenants cannot rename labels or change units without a code change. This is intentional per `cpt-metric-cat-fr-metadata-writes`.
-- Auth plumbing (tenant admin detection) exists or will be provided alongside this work; modelling new auth primitives is outside scope. Specifically, this PRD assumes the auth layer exposes at minimum: (a) `actor_id` — stable identifier for the authenticated caller, used in audit events; (b) `tenant_id` — the tenant context of the request; (c) `is_tenant_admin(tenant_id)` — boolean predicate gating writes in `cpt-metric-cat-fr-threshold-crud` and lock-set writes in `cpt-metric-cat-fr-threshold-lock`. Additional capabilities — `can_override_lock(metric_key, blocking_scope)`, `can_bypass_lock_as_compliance_admin` — are modelled in the Auth PRD (not this one); this PRD assumes they exist as predicates the analytics-api can query.
-- Cache layer (Redis or equivalent shared cache, or a pub-sub broadcast on top of in-process caches) is available in the analytics-api service stack; pure in-process caching is incompatible with `cpt-metric-cat-nfr-cross-replica-invalidation`.
+- Auth plumbing (tenant admin detection) exists or will be provided alongside this work; modelling new auth primitives is outside scope. Specifically, this PRD assumes the auth layer exposes at minimum: (a) `actor_id` — stable identifier for the authenticated caller, used in audit events; (b) `tenant_id` — the tenant context of the request; (c) `is_tenant_admin(tenant_id)` — boolean predicate gating writes in `cpt-metric-cat-fr-threshold-crud` and lock-set writes in `cpt-metric-cat-fr-threshold-lock`. Additional capabilities — `can_override_lock(metric_key, blocking_scope)`, `can_bypass_lock_as_compliance_admin` — are modelled in the Auth PRD (not this one); this PRD assumes they exist as predicates the analytics can query.
+- Cache layer (Redis or equivalent shared cache, or a pub-sub broadcast on top of in-process caches) is available in the analytics service stack; pure in-process caching is incompatible with `cpt-metric-cat-nfr-cross-replica-invalidation`.
 - **Tenant-custom maintenance contract** (applies when the tenant-custom follow-on ships; moot in v1): the product commits silver-layer backward-compat guarantees only for metrics in the **global** (`tenant_id IS NULL`) catalog. Tenants that add custom metrics (`tenant_id = X`) whose `query_ref` or formula depends on silver-layer columns accept responsibility for updating their custom metrics when those columns change in a product release. Product release notes list silver-schema changes in a machine-readable format so tenants can audit impact. This assumption is what makes silver evolution tractable: append-only / no-destructive-changes applies to fields that the **product-owned** catalog depends on; it does not extend to every field a tenant might have bound to. Without this contract, tenant-custom inflates the "append-only silver forever" obligation from a finite product surface to an unbounded union of tenant choices.
 
 ## 12. Risks
@@ -662,7 +662,7 @@ This section is informative, not normative. It captures the delta between today'
 
 ### Present
 
-- `services/analytics-api` is a running Rust / Axum service with a working `/v1/metrics`, `/v1/metrics/{id}/query`, `/v1/thresholds`, `/v1/persons/{email}`, `/v1/columns` surface. SeaORM entities cover `metrics`, `thresholds`, `table_columns`. Sea-orm migrations run at service startup.
+- `services/analytics` is a running Rust / Axum service with a working `/v1/metrics`, `/v1/metrics/{id}/query`, `/v1/thresholds`, `/v1/persons/{email}`, `/v1/columns` surface. SeaORM entities cover `metrics`, `thresholds`, `table_columns`. Sea-orm migrations run at service startup.
 - `analytics.metrics` table holds `query_ref` rows keyed by UUID; one `query_ref` can emit multiple `metric_key` values. Untouched by this PRD.
 - `analytics.thresholds` table exists but is empty; its fate is explicitly resolved in this PRD's migration series per `cpt-metric-cat-fr-thresholds-table-resolution`.
 - Frontend `src/screensets/insight/api/thresholdConfig.ts` defines `BULLET_DEFS` and `IC_KPI_DEFS`; `src/screensets/insight/types/index.ts` defines `METRIC_KEYS`. These are the canonical sources of current metadata and the seed input for `cpt-metric-cat-fr-seed-from-frontend`.
@@ -671,7 +671,7 @@ This section is informative, not normative. It captures the delta between today'
 
 - No `metric_catalog` or `metric_threshold` tables, nor their SeaORM entities.
 - No `/v1/catalog/metrics` or `/v1/admin/metric-thresholds` endpoints.
-- No cache layer in analytics-api dedicated to catalog reads; the shape of the layer (in-process vs shared) is a DESIGN question.
+- No cache layer in analytics dedicated to catalog reads; the shape of the layer (in-process vs shared) is a DESIGN question.
 - No seed migration that imports current frontend metadata.
 - RBAC for admin-scope endpoints (tenant-admin only) is not modelled today; `auth.rs` authenticates but does not carry a role claim that threshold CRUD can gate on.
 
diff --git a/docs/domain/metric-catalog/specs/PRD_human_readable.md b/docs/domain/metric-catalog/specs/PRD_human_readable.md
index 45dbb9d2b..17a535ead 100644
--- a/docs/domain/metric-catalog/specs/PRD_human_readable.md
+++ b/docs/domain/metric-catalog/specs/PRD_human_readable.md
@@ -118,7 +118,7 @@ Locks are the feature that turns the catalog from a config store into a complian
 
 **Where locks can be set (v1):** only at `product-default` (by the product team, via seed migration) and at `tenant` (by tenant admins, via API). Narrower-scope locks are explicitly out of v1 — they'd be more nuance than the feature currently needs. If someone has a real use case, we widen later.
 
-**What gets recorded:** every lock set, every lock cleared, and every rejected bypass attempt lands in the `threshold_lock_audit` MariaDB table, **and** in the analytics-api structured log stream. The table is the source of truth for long-term audit (≥ 1 year), because log retention tends to be shorter than regulatory cycles; the log stream is for real-time observability.
+**What gets recorded:** every lock set, every lock cleared, and every rejected bypass attempt lands in the `threshold_lock_audit` MariaDB table, **and** in the analytics structured log stream. The table is the source of truth for long-term audit (≥ 1 year), because log retention tends to be shorter than regulatory cycles; the log stream is for real-time observability.
 
 **What's required on a lock:** `locked_by` (the authenticated actor), `locked_at` (server timestamp), and `lock_reason` (human-authored justification). All three are DB-enforced — a lock without a reason is rejected both by the API and by the DB CHECK constraint. This is deliberate: an audit trail that says "someone locked this, no idea why" fails at audit time.
 
diff --git a/scripts/ci/changed.py b/scripts/ci/changed.py
index f05f2d0e6..04ba07782 100644
--- a/scripts/ci/changed.py
+++ b/scripts/ci/changed.py
@@ -29,15 +29,18 @@
 _SHARED_BACKEND_DIRS = ("src/backend/libs/", "src/backend/plugins/")
 
 
-def _matrix_entry(comp: dict, *, lint: bool = False, cover: bool = True) -> dict:
+def _matrix_entry(comp: dict, *, lint: bool = False, cover: bool = True,
+                  test: bool = False) -> dict:
     """The fields a producer CI job needs for one component. Rust entries also
-    carry lint/cover flags (a rust crate may appear lint-only)."""
+    carry lint/cover/test flags (a rust crate may appear lint-only; a changed
+    crate with cover=false still runs plain `cargo test`)."""
     entry = {"name": comp["name"], "root": comp["root"]}
     if comp["lang"] == "rust":
         entry["package"] = comp.get("package", comp["name"])
         entry["all_features"] = comp.get("all_features", True)
         entry["lint"] = lint
         entry["cover"] = cover
+        entry["test"] = test
         entry["clippy"] = comp.get("clippy", True)  # False ⇒ fmt-only (see #1512)
         entry["live_db"] = comp.get("live_db", False)  # DB-backed live_tests (see #1564)
         # Exclude dependency-crate files from this component's coverage report so
@@ -84,10 +87,14 @@ def changed_components(compare_branch: str, components: list[dict]) -> dict[str,
         name, lang = comp["name"], comp["lang"]
         if lang == "rust":
             is_backend = comp.get("root") == BACKEND_RUST_ROOT
-            cover = name in changed
-            lint = cover or (fanout_lint and is_backend)
+            # cover=False in the registry ⇒ plain tests + lint still run on
+            # change, but no Cobertura is produced or gated (api-gateway — no
+            # unit tests yet; 0% would hard-fail the overall gate).
+            cover = name in changed and comp.get("cover", True)
+            lint = name in changed or (fanout_lint and is_backend)
             if lint or cover:
-                result["rust"].append(_matrix_entry(comp, lint=lint, cover=cover))
+                result["rust"].append(_matrix_entry(
+                    comp, lint=lint, cover=cover, test=name in changed))
         elif name in changed:  # dotnet / python: in the matrix iff changed
             result[lang].append(_matrix_entry(comp))
     return result
@@ -99,7 +106,8 @@ def all_components(components: list[dict]) -> dict[str, list]:
     result: dict[str, list] = {lang: [] for lang in ("rust", "dotnet", "python")}
     for comp in components:
         if comp["lang"] == "rust":
-            result["rust"].append(_matrix_entry(comp, lint=True, cover=True))
+            result["rust"].append(_matrix_entry(
+                comp, lint=True, cover=comp.get("cover", True), test=True))
         else:
             result[comp["lang"]].append(_matrix_entry(comp))
     return result
diff --git a/scripts/ci/components.py b/scripts/ci/components.py
index 2fd162451..4ddc3fbde 100644
--- a/scripts/ci/components.py
+++ b/scripts/ci/components.py
@@ -33,10 +33,10 @@
     {"name": "oidc-authn-plugin", "lang": "rust", "root": "src/backend",
      "package": "oidc-authn-plugin",
      "paths": ["src/backend/plugins/oidc-authn-plugin"]},
-    {"name": "analytics-api", "lang": "rust", "root": "src/backend",
-     "package": "analytics-api",
+    {"name": "analytics", "lang": "rust", "root": "src/backend",
+     "package": "analytics",
      # DB-backed integration tests: the CI rust job provisions a MariaDB
-     # service, runs `analytics-api migrate` once up front, then runs the
+     # service, runs `analytics migrate` once up front, then runs the
      # `#[ignore]`d live_tests (INTEGRATION_TESTS_MARIADB_URL). ClickHouse
      # tests skip (no INTEGRATION_TESTS_CLICKHOUSE_URL — see cf/insight#1564).
      "live_db": True,
@@ -46,9 +46,18 @@
      # would let this service's report drag their number down to whatever this
      # service happens to exercise. Scope the report to this service's code.
      "cover_ignore_regex": "src/backend/libs/",
-     "paths": ["src/backend/services/analytics-api"]},
+     "paths": ["src/backend/services/analytics"]},
+    # cover=False: the gateway has no unit tests yet (its behavior is covered
+    # by the e2e suite), so a coverage report would gate it at 0% the moment
+    # any file under its paths changes. Tests + lint still run; re-enable
+    # coverage when unit tests land. Mirrors the identity decision below.
     {"name": "api-gateway", "lang": "rust", "root": "src/backend",
      "package": "insight-api-gateway",
+     "cover": False,
+     # When coverage is re-enabled: scope out linked dependency crates
+     # (oidc-authn-plugin, libs) — they self-report in their own jobs, and
+     # zero-hit dependency files would gate THOSE components at 0%.
+     "cover_ignore_regex": "src/backend/(libs|plugins)/",
      "paths": ["src/backend/services/api-gateway"]},
     # jira-enrich is a standalone workspace; its `io` feature needs a live
     # ClickHouse, so cover with default features only (core tests are io-free).
diff --git a/src/backend/.dockerignore b/src/backend/.dockerignore
index ecc364a53..6b420940e 100644
--- a/src/backend/.dockerignore
+++ b/src/backend/.dockerignore
@@ -1,5 +1,5 @@
 # Build context = src/backend/ for all three backend services
-# (api-gateway, analytics-api, identity). This file mirrors the union of
+# (api-gateway, analytics, identity). This file mirrors the union of
 # the per-service ignore patterns. Without it, host build artifacts leak
 # into the image and Linux builds fail on Windows-built `project.assets.json`
 # or stale Rust target trees.
diff --git a/src/backend/Cargo.lock b/src/backend/Cargo.lock
index e56c96397..545d15171 100644
--- a/src/backend/Cargo.lock
+++ b/src/backend/Cargo.lock
@@ -70,7 +70,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "683d7910e743518b0e34f1186f92494becacb047c7b6bf616c96772180fef923"
 
 [[package]]
-name = "analytics-api"
+name = "analytics"
 version = "0.1.0"
 dependencies = [
  "anyhow",
diff --git a/src/backend/Cargo.toml b/src/backend/Cargo.toml
index fc80cdf93..da95c4f27 100644
--- a/src/backend/Cargo.toml
+++ b/src/backend/Cargo.toml
@@ -3,7 +3,7 @@ members = [
     "libs/insight-clickhouse",
     "plugins/oidc-authn-plugin",
     "services/api-gateway",
-    "services/analytics-api",
+    "services/analytics",
 ]
 resolver = "3"
 
@@ -42,7 +42,7 @@ async-trait = "0.1"
 futures = "0.3"
 # `Stream` + `StreamExt::next` for driving SeaORM result cursors. Already
 # pulled in transitively by sea-orm; declared at workspace scope so
-# consumers (today: analytics-api schema-validator) can use it explicitly
+# consumers (today: analytics schema-validator) can use it explicitly
 # without leaning on a transitive dep.
 futures-util = { version = "0.3", default-features = false, features = ["std"] }
 
@@ -101,6 +101,6 @@ figment = { version = "0.10", features = ["yaml", "env"] }
 # Internal crates
 insight-clickhouse = { path = "libs/insight-clickhouse" }
 
-# CI rebuild marker — bumped to retrigger the api-gateway + analytics-api
+# CI rebuild marker — bumped to retrigger the api-gateway + analytics
 # image builds on the cf → gears crate migration (2026-06-12).
 
diff --git a/src/backend/docker-entrypoint.sh b/src/backend/docker-entrypoint.sh
index 00493e276..37d37bcc9 100755
--- a/src/backend/docker-entrypoint.sh
+++ b/src/backend/docker-entrypoint.sh
@@ -2,7 +2,7 @@
 # Shared entrypoint for the Insight backend service containers.
 #
 # Copied into the image by each service Dockerfile (api-gateway,
-# analytics-api, identity). Behaviour switches on ENABLE_AUTO_RELOAD:
+# analytics, identity). Behaviour switches on ENABLE_AUTO_RELOAD:
 #
 #   unset / anything else  : exec the command directly (prod default)
 #   true | 1               : wrap the command in `watchexec` so that a
diff --git a/src/backend/services/analytics-api/helm/Chart.yaml b/src/backend/services/analytics-api/helm/Chart.yaml
deleted file mode 100644
index e803e72e6..000000000
--- a/src/backend/services/analytics-api/helm/Chart.yaml
+++ /dev/null
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: insight-analytics-api
-description: Insight Analytics API — query service over ClickHouse views
-version: 0.1.0
-appVersion: "2026.07.02.16.10-dbe992a"
-type: application
diff --git a/src/backend/services/analytics-api/helm/templates/_helpers.tpl b/src/backend/services/analytics-api/helm/templates/_helpers.tpl
deleted file mode 100644
index 7429cfa0e..000000000
--- a/src/backend/services/analytics-api/helm/templates/_helpers.tpl
+++ /dev/null
@@ -1,13 +0,0 @@
-{{- define "insight-analytics-api.fullname" -}}
-{{ .Release.Name }}-analytics-api
-{{- end }}
-
-{{- define "insight-analytics-api.labels" -}}
-app.kubernetes.io/name: analytics-api
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{- define "insight-analytics-api.selectorLabels" -}}
-app.kubernetes.io/name: analytics-api
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
diff --git a/src/backend/services/analytics-api/src/main.rs b/src/backend/services/analytics-api/src/main.rs
deleted file mode 100644
index 806c0411a..000000000
--- a/src/backend/services/analytics-api/src/main.rs
+++ /dev/null
@@ -1,216 +0,0 @@
-//! Analytics API — read-only query service over predefined `ClickHouse` metrics.
-//!
-//! Serves admin-defined metrics (SQL queries stored in `MariaDB`) with tenant-scoped,
-//! org-scoped security filters and `OData`-style querying.
-//!
-//! # Architecture
-//!
-//! Runs as a gears-rust host on [`toolkit::bootstrap::run_server`]. The
-//! `api-gateway` system gear is the REST host; the analytics functionality is
-//! the [`gear::AnalyticsApiGear`] (`rest` + `stateful`). Auth is **disabled** on
-//! this host — the platform api-gateway is the sole authenticator and proxies
-//! to us — so the host injects a single-tenant `SecurityContext` and a thin
-//! layer overrides the tenant from `X-Insight-Tenant-Id` (see [`crate::auth`]).
-//!
-//! The MariaDB connection, its 45 sea-orm migrations, and the startup CHECK /
-//! product-default probes remain self-managed inside the gear (we do not use
-//! the toolkit `db` capability — `ClickHouse` is not a toolkit-db backend
-//! anyway).
-//!
-//! # Usage
-//!
-//! ```text
-//! analytics-api --config config.yaml          # run the host
-//! analytics-api --config config.yaml migrate  # run migrations + probes and exit
-//! ```
-
-mod api;
-mod auth;
-mod config;
-mod domain;
-mod gear;
-mod infra;
-mod migration;
-
-// System gears — linked via inventory for the REST host and the (disabled)
-// auth pipeline. Mirrors the api-gateway service's no-auth gear set, minus the
-// OIDC plugin / proxy / auth-info (this host never authenticates).
-use api_gateway as _;
-use authn_resolver as _;
-use authz_resolver as _;
-use gear_orchestrator as _;
-use grpc_hub as _;
-use single_tenant_tr_plugin as _;
-use static_authz_plugin as _;
-use tenant_resolver as _;
-use types_registry as _;
-
-use std::path::PathBuf;
-
-use anyhow::Result;
-use clap::{Parser, Subcommand};
-use toolkit::bootstrap::{AppConfig, run_server};
-
-/// Analytics API service.
-#[derive(Parser)]
-#[command(name = "analytics-api")]
-#[command(about = "Insight Analytics API — query service over `ClickHouse` metrics")]
-#[command(version = env!("CARGO_PKG_VERSION"))]
-struct Cli {
-    /// Path to YAML configuration file.
-    #[arg(short, long)]
-    config: Option<PathBuf>,
-
-    /// Print the effective configuration and exit.
-    #[arg(long)]
-    print_config: bool,
-
-    /// Increase log verbosity (-v = debug, -vv = trace).
-    #[arg(short, long, action = clap::ArgAction::Count)]
-    verbose: u8,
-
-    #[command(subcommand)]
-    command: Option<Commands>,
-}
-
-#[derive(Subcommand)]
-enum Commands {
-    /// Start the server (default).
-    Run,
-    /// Run database migrations + startup probes and exit.
-    Migrate,
-    /// Validate configuration and exit.
-    Check,
-}
-
-#[tokio::main]
-async fn main() -> Result<()> {
-    let cli = Cli::parse();
-
-    // Layered config: defaults -> YAML -> env (APP__*) -> CLI overrides.
-    // Logging/OTel are initialized by the bootstrap runtime, not here.
-    let mut config = AppConfig::load_or_default(cli.config.as_ref())?;
-    config.apply_cli_overrides(cli.verbose);
-    fold_gear_env_alias(&mut config);
-
-    if cli.print_config {
-        println!("Effective configuration:\n{}", config.to_yaml()?);
-        return Ok(());
-    }
-
-    match cli.command.unwrap_or(Commands::Run) {
-        Commands::Run => run_server(config).await,
-        Commands::Migrate => gear::run_migrate(&config).await,
-        // Validate the gear config (section present, deserializes, required
-        // URLs set) without connecting to any backend.
-        Commands::Check => gear::check_config(&config),
-    }
-}
-
-/// Fold the identifier-safe `analytics_api` gears alias into the kebab-case
-/// gear key `analytics-api`.
-///
-/// The gear name is macro-locked to kebab-case (`analytics-api`), so its config
-/// lives under `gears.analytics-api`. But config overrides arrive as env vars,
-/// and hyphenated names (`APP__gears__analytics-api__config__*`) are silently
-/// dropped by the compose `sh`/dash entrypoint (dash discards env names that
-/// aren't valid identifiers) and skipped by Kubernetes `envFrom`. Operators
-/// therefore set the identifier-safe `APP__gears__analytics_api__config__*`,
-/// which figment lands under a separate `gears.analytics_api` key. The toolkit
-/// does no kebab/snake normalization, so we bridge it here: deep-merge the
-/// `analytics_api` alias into `analytics-api` (alias values win on leaves), so
-/// the overrides reach the gear regardless of how they were delivered.
-fn fold_gear_env_alias(config: &mut AppConfig) {
-    const ALIAS: &str = "analytics_api";
-    const CANONICAL: &str = "analytics-api";
-
-    let Some(alias) = config.gears.remove(ALIAS) else {
-        return;
-    };
-    match config.gears.get_mut(CANONICAL) {
-        Some(existing) => deep_merge(existing, alias),
-        None => {
-            config.gears.insert(CANONICAL.to_owned(), alias);
-        }
-    }
-}
-
-/// Recursively merge `overlay` into `base`; objects merge key-by-key, and any
-/// non-object (leaf) in `overlay` replaces the value in `base`.
-fn deep_merge(base: &mut serde_json::Value, overlay: serde_json::Value) {
-    match (base, overlay) {
-        (serde_json::Value::Object(base_map), serde_json::Value::Object(overlay_map)) => {
-            for (key, value) in overlay_map {
-                match base_map.get_mut(&key) {
-                    Some(base_value) => deep_merge(base_value, value),
-                    None => {
-                        base_map.insert(key, value);
-                    }
-                }
-            }
-        }
-        (base_slot, overlay_value) => *base_slot = overlay_value,
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use serde_json::json;
-
-    fn cfg_with(gears: serde_json::Value) -> AppConfig {
-        let mut c = AppConfig::default();
-        if let serde_json::Value::Object(map) = gears {
-            for (k, v) in map {
-                c.gears.insert(k, v);
-            }
-        }
-        c
-    }
-
-    #[test]
-    fn deep_merge_merges_objects_and_overwrites_leaves() {
-        let mut base = json!({"a": {"x": 1, "y": 2}, "b": 3});
-        deep_merge(&mut base, json!({"a": {"y": 20, "z": 30}, "c": 4}));
-        assert_eq!(
-            base,
-            json!({"a": {"x": 1, "y": 20, "z": 30}, "b": 3, "c": 4})
-        );
-    }
-
-    #[test]
-    fn deep_merge_leaf_replaces_object() {
-        let mut base = json!({"a": {"x": 1}});
-        deep_merge(&mut base, json!({"a": "scalar"}));
-        assert_eq!(base, json!({"a": "scalar"}));
-    }
-
-    #[test]
-    fn fold_merges_alias_into_canonical_alias_wins() {
-        let mut c = cfg_with(json!({
-            "analytics-api": {"config": {"database_url": "yaml", "clickhouse_url": "ch"}},
-            "analytics_api": {"config": {"database_url": "env", "redis_url": "r"}},
-        }));
-        fold_gear_env_alias(&mut c);
-        assert!(!c.gears.contains_key("analytics_api"));
-        let config = &c.gears["analytics-api"]["config"];
-        assert_eq!(config["database_url"], "env"); // alias overrides
-        assert_eq!(config["clickhouse_url"], "ch"); // preserved from yaml
-        assert_eq!(config["redis_url"], "r"); // added from alias
-    }
-
-    #[test]
-    fn fold_inserts_alias_when_canonical_absent() {
-        let mut c = cfg_with(json!({"analytics_api": {"config": {"database_url": "env"}}}));
-        fold_gear_env_alias(&mut c);
-        assert!(!c.gears.contains_key("analytics_api"));
-        assert_eq!(c.gears["analytics-api"]["config"]["database_url"], "env");
-    }
-
-    #[test]
-    fn fold_is_noop_without_alias() {
-        let mut c = cfg_with(json!({"analytics-api": {"config": {"database_url": "yaml"}}}));
-        fold_gear_env_alias(&mut c);
-        assert_eq!(c.gears["analytics-api"]["config"]["database_url"], "yaml");
-    }
-}
diff --git a/src/backend/services/analytics-api/Cargo.toml b/src/backend/services/analytics/Cargo.toml
similarity index 96%
rename from src/backend/services/analytics-api/Cargo.toml
rename to src/backend/services/analytics/Cargo.toml
index 28439a566..4d81f8beb 100644
--- a/src/backend/services/analytics-api/Cargo.toml
+++ b/src/backend/services/analytics/Cargo.toml
@@ -1,5 +1,5 @@
 [package]
-name = "analytics-api"
+name = "analytics"
 version = "0.1.0"
 description = "Analytics API — read-only query service over predefined ClickHouse metrics"
 edition.workspace = true
@@ -21,7 +21,7 @@ clickhouse = { workspace = true }
 axum = { workspace = true }
 sea-orm = { workspace = true }
 sea-orm-migration = { workspace = true }
-# ToolKit host runtime. analytics-api runs as a gears-rust host: routes are
+# ToolKit host runtime. analytics runs as a gears-rust host: routes are
 # declared via `OperationBuilder` and served by the `api-gateway` system gear
 # (the REST host) under `toolkit::bootstrap::run_server`. Auth is disabled on
 # this host (the platform api-gateway is the sole authenticator; see
diff --git a/src/backend/services/analytics-api/Dockerfile b/src/backend/services/analytics/Dockerfile
similarity index 75%
rename from src/backend/services/analytics-api/Dockerfile
rename to src/backend/services/analytics/Dockerfile
index 4c18585cd..cb899c0dc 100644
--- a/src/backend/services/analytics-api/Dockerfile
+++ b/src/backend/services/analytics/Dockerfile
@@ -6,7 +6,7 @@
 # Multi-stage build for Insight Analytics API
 #
 # Build context: src/backend/
-# Usage: cd src/backend && docker build -f services/analytics-api/Dockerfile -t insight-analytics-api:dev .
+# Usage: cd src/backend && docker build -f services/analytics/Dockerfile -t insight-analytics:dev .
 
 # Stage 1: Builder
 FROM rust:1.95-bookworm AS builder
@@ -23,25 +23,25 @@ COPY Cargo.toml Cargo.lock ./
 COPY libs/insight-clickhouse/Cargo.toml ./libs/insight-clickhouse/Cargo.toml
 COPY plugins/oidc-authn-plugin/Cargo.toml ./plugins/oidc-authn-plugin/Cargo.toml
 COPY services/api-gateway/Cargo.toml ./services/api-gateway/Cargo.toml
-COPY services/analytics-api/Cargo.toml ./services/analytics-api/Cargo.toml
+COPY services/analytics/Cargo.toml ./services/analytics/Cargo.toml
 
 RUN mkdir -p libs/insight-clickhouse/src && echo "" > libs/insight-clickhouse/src/lib.rs && \
     mkdir -p plugins/oidc-authn-plugin/src && echo "" > plugins/oidc-authn-plugin/src/lib.rs && \
     mkdir -p services/api-gateway/src && echo "fn main() {}" > services/api-gateway/src/main.rs && \
-    mkdir -p services/analytics-api/src && echo "fn main() {}" > services/analytics-api/src/main.rs
+    mkdir -p services/analytics/src && echo "fn main() {}" > services/analytics/src/main.rs
 
-RUN cargo build --release --bin analytics-api 2>/dev/null || true
+RUN cargo build --release --bin analytics 2>/dev/null || true
 
 # --- Source layer ---
-RUN rm -rf libs/insight-clickhouse/src services/analytics-api/src \
-    target/release/analytics-api target/release/deps/analytics_api* \
+RUN rm -rf libs/insight-clickhouse/src services/analytics/src \
+    target/release/analytics target/release/deps/analytics* \
     target/release/deps/insight_clickhouse* target/release/deps/libinsight_clickhouse*
 
 COPY libs/insight-clickhouse/src/ ./libs/insight-clickhouse/src/
-COPY services/analytics-api/src/ ./services/analytics-api/src/
-COPY services/analytics-api/config/ ./services/analytics-api/config/
+COPY services/analytics/src/ ./services/analytics/src/
+COPY services/analytics/config/ ./services/analytics/config/
 
-RUN cargo build --release --bin analytics-api
+RUN cargo build --release --bin analytics
 
 # Stage 2: Runtime
 FROM debian:bookworm-slim
@@ -71,11 +71,11 @@ RUN chmod +x /usr/local/bin/docker-entrypoint.sh
 
 WORKDIR /app
 
-COPY --from=builder /build/target/release/analytics-api /app/analytics-api
+COPY --from=builder /build/target/release/analytics /app/analytics
 # Gears config baked at /app/config/. Compose bind-mounts over it for hot
 # edits; k8s mounts a ConfigMap at the same path. Env (APP__*) overrides
 # the deployment-specific leaf values (DB/tenant).
-COPY --from=builder /build/services/analytics-api/config/ /app/config/
+COPY --from=builder /build/services/analytics/config/ /app/config/
 
 RUN useradd -U -u 1000 -m appuser && \
     chown -R 1000:1000 /app
@@ -84,4 +84,4 @@ USER 1000
 EXPOSE 8081
 
 ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
-CMD ["/app/analytics-api", "--", "/app/analytics-api", "-c", "/app/config/insight.yaml", "run"]
+CMD ["/app/analytics", "--", "/app/analytics", "-c", "/app/config/insight.yaml", "run"]
diff --git a/src/backend/services/analytics-api/config/insight.yaml b/src/backend/services/analytics/config/insight.yaml
similarity index 73%
rename from src/backend/services/analytics-api/config/insight.yaml
rename to src/backend/services/analytics/config/insight.yaml
index a1ac191a4..1af381fd2 100644
--- a/src/backend/services/analytics-api/config/insight.yaml
+++ b/src/backend/services/analytics/config/insight.yaml
@@ -1,23 +1,23 @@
 # Insight Analytics API — gears-rust host config.
 #
-# Usage: analytics-api --config config/insight.yaml
-#        analytics-api --config config/insight.yaml migrate
+# Usage: analytics --config config/insight.yaml
+#        analytics --config config/insight.yaml migrate
 #
 # The `api-gateway` system gear is the REST host with auth DISABLED — the
 # platform api-gateway is the sole authenticator and proxies to us, so this
 # host injects a single-tenant SecurityContext (DEFAULT_TENANT_ID). The
-# `analytics-api` gear then optionally overrides the tenant from the
+# `analytics` gear then optionally overrides the tenant from the
 # `X-Insight-Tenant-Id` header (see crate::auth). NO oidc plugin is registered.
 #
 # Env overrides (prefix CHANGED from the old `ANALYTICS__*`):
-#   APP__gears__analytics_api__config__database_url
-#   APP__gears__analytics_api__config__clickhouse_url
-#   APP__gears__analytics_api__config__clickhouse_database
-#   APP__gears__analytics_api__config__clickhouse_user
-#   APP__gears__analytics_api__config__clickhouse_password
-#   APP__gears__analytics_api__config__identity_url
-#   APP__gears__analytics_api__config__redis_url
-#   APP__gears__analytics_api__config__metric_catalog__tenant_default_id
+#   APP__gears__analytics__config__database_url
+#   APP__gears__analytics__config__clickhouse_url
+#   APP__gears__analytics__config__clickhouse_database
+#   APP__gears__analytics__config__clickhouse_user
+#   APP__gears__analytics__config__clickhouse_password
+#   APP__gears__analytics__config__identity_url
+#   APP__gears__analytics__config__redis_url
+#   APP__gears__analytics__config__metric_catalog__tenant_default_id
 
 server:
   home_dir: "~/.insight"
@@ -29,7 +29,7 @@ logging:
 gears:
   api-gateway:
     config:
-      # analytics-api is addressed directly (the platform gateway proxies
+      # analytics is addressed directly (the platform gateway proxies
       # `/analytics` → here), so no prefix_path is set.
       bind_addr: "0.0.0.0:8081"
       enable_docs: true
@@ -71,12 +71,12 @@ gears:
       vendor: "hyperspot"
       priority: 20
 
-  analytics-api:
+  analytics:
     config:
       # HTTP bind is owned by api-gateway above; retained for diagnostics only.
       bind_addr: "0.0.0.0:8081"
       # Connection strings are injected per-deployment via env overrides
-      # (APP__gears__analytics_api__config__*) from the umbrella Secret /
+      # (APP__gears__analytics__config__*) from the umbrella Secret /
       # compose. Left empty here so no credential is committed and the
       # runnable `-c` path can't silently point at a shared default.
       database_url: ""
diff --git a/src/backend/services/analytics-api/fix-seed-aggregation.sql b/src/backend/services/analytics/fix-seed-aggregation.sql
similarity index 100%
rename from src/backend/services/analytics-api/fix-seed-aggregation.sql
rename to src/backend/services/analytics/fix-seed-aggregation.sql
diff --git a/src/backend/services/analytics/helm/Chart.yaml b/src/backend/services/analytics/helm/Chart.yaml
new file mode 100644
index 000000000..54d5d722a
--- /dev/null
+++ b/src/backend/services/analytics/helm/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: insight-analytics
+description: Insight Analytics — query service over ClickHouse views
+version: 0.2.0
+appVersion: "2026.07.02.16.10-dbe992a"
+type: application
diff --git a/src/backend/services/analytics/helm/templates/_helpers.tpl b/src/backend/services/analytics/helm/templates/_helpers.tpl
new file mode 100644
index 000000000..d1c01183e
--- /dev/null
+++ b/src/backend/services/analytics/helm/templates/_helpers.tpl
@@ -0,0 +1,13 @@
+{{- define "insight-analytics.fullname" -}}
+{{ .Release.Name }}-analytics
+{{- end }}
+
+{{- define "insight-analytics.labels" -}}
+app.kubernetes.io/name: analytics
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{- define "insight-analytics.selectorLabels" -}}
+app.kubernetes.io/name: analytics
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
diff --git a/src/backend/services/analytics-api/helm/templates/configmap.yaml b/src/backend/services/analytics/helm/templates/configmap.yaml
similarity index 84%
rename from src/backend/services/analytics-api/helm/templates/configmap.yaml
rename to src/backend/services/analytics/helm/templates/configmap.yaml
index 5b6678aea..260e9c97f 100644
--- a/src/backend/services/analytics-api/helm/templates/configmap.yaml
+++ b/src/backend/services/analytics/helm/templates/configmap.yaml
@@ -1,20 +1,20 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: {{ include "insight-analytics-api.fullname" . }}-config
+  name: {{ include "insight-analytics.fullname" . }}-gears-config
   labels:
-    {{- include "insight-analytics-api.labels" . | nindent 4 }}
+    {{- include "insight-analytics.labels" . | nindent 4 }}
 data:
   # gears-rust host config. Structural only — the deployment-specific leaf
   # values (database_url / clickhouse_* / redis_url / identity_url /
   # tenant_default_id) are injected as APP__* env vars from the
-  # `insight-analytics-api-config` Secret (see deployment.yaml `envFrom`),
+  # `insight-analytics-config` Secret (see deployment.yaml `envFrom`),
   # which override this YAML at load time.
   #
   # The `api-gateway` system gear is the REST host with auth DISABLED: the
   # platform api-gateway is the sole authenticator and proxies `/analytics`
   # here, so this host injects a single-tenant SecurityContext
-  # (DEFAULT_TENANT_ID) and the analytics-api gear overrides the tenant from
+  # (DEFAULT_TENANT_ID) and the analytics gear overrides the tenant from
   # X-Insight-Tenant-Id when present. NO oidc plugin is registered.
   analytics.yaml: |
     server:
@@ -28,7 +28,7 @@ data:
       api-gateway:
         config:
           bind_addr: "0.0.0.0:{{ .Values.service.port }}"
-          # analytics-api is addressed directly (the platform gateway proxies
+          # analytics is addressed directly (the platform gateway proxies
           # `/analytics` → here), so no prefix_path.
           auth_disabled: true
           cors_enabled: false
@@ -71,5 +71,5 @@ data:
 
       # Leaf values (database_url, clickhouse_*, redis_url, identity_url,
       # metric_catalog.tenant_default_id) come from the Secret via envFrom.
-      analytics-api:
+      analytics:
         config: {}
diff --git a/src/backend/services/analytics-api/helm/templates/deployment.yaml b/src/backend/services/analytics/helm/templates/deployment.yaml
similarity index 80%
rename from src/backend/services/analytics-api/helm/templates/deployment.yaml
rename to src/backend/services/analytics/helm/templates/deployment.yaml
index f9d6d23ca..4df2e06be 100644
--- a/src/backend/services/analytics-api/helm/templates/deployment.yaml
+++ b/src/backend/services/analytics/helm/templates/deployment.yaml
@@ -1,18 +1,18 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: {{ include "insight-analytics-api.fullname" . }}
+  name: {{ include "insight-analytics.fullname" . }}
   labels:
-    {{- include "insight-analytics-api.labels" . | nindent 4 }}
+    {{- include "insight-analytics.labels" . | nindent 4 }}
 spec:
   replicas: {{ .Values.replicaCount }}
   selector:
     matchLabels:
-      {{- include "insight-analytics-api.selectorLabels" . | nindent 6 }}
+      {{- include "insight-analytics.selectorLabels" . | nindent 6 }}
   template:
     metadata:
       labels:
-        {{- include "insight-analytics-api.selectorLabels" . | nindent 8 }}
+        {{- include "insight-analytics.selectorLabels" . | nindent 8 }}
       annotations:
         # Roll pods when the gears config changes.
         checksum/config: {{ include (print $.Template.BasePath "/configmap.yaml") . | sha256sum }}
@@ -36,12 +36,12 @@ spec:
         runAsUser: 1000
         fsGroup: 1000
       containers:
-        - name: analytics-api
+        - name: analytics
           image: "{{ required "image.repository is required" .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
           # gears-rust host: structural config from the mounted ConfigMap;
           # leaf values (DB/tenant) from the Secret via envFrom below.
-          command: ["/app/analytics-api"]
+          command: ["/app/analytics"]
           args: ["-c", "/app/config/analytics.yaml", "run"]
           volumeMounts:
             - name: analytics-config
@@ -54,10 +54,10 @@ spec:
               protocol: TCP
           envFrom:
             # Operator MUST pre-create this Secret (umbrella does it
-            # automatically as `insight-analytics-api-config`). Provides the
-            # APP__gears__analytics_api__config__* leaf overrides.
+            # automatically as `insight-analytics-config`). Provides the
+            # APP__gears__analytics__config__* leaf overrides.
             - secretRef:
-                name: {{ required "existingSecret is required (umbrella provides `insight-analytics-api-config`; standalone installs supply their own)" .Values.existingSecret | quote }}
+                name: {{ required "existingSecret is required (umbrella provides `insight-analytics-config`; standalone installs supply their own)" .Values.existingSecret | quote }}
           securityContext:
             allowPrivilegeEscalation: false
           {{- with .Values.livenessProbe }}
@@ -74,7 +74,7 @@ spec:
         - name: migrate
           image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
           imagePullPolicy: {{ .Values.image.pullPolicy }}
-          command: ["/app/analytics-api"]
+          command: ["/app/analytics"]
           args: ["-c", "/app/config/analytics.yaml", "migrate"]
           volumeMounts:
             - name: analytics-config
@@ -89,4 +89,4 @@ spec:
       volumes:
         - name: analytics-config
           configMap:
-            name: {{ include "insight-analytics-api.fullname" . }}-config
+            name: {{ include "insight-analytics.fullname" . }}-gears-config
diff --git a/src/backend/services/analytics-api/helm/templates/service.yaml b/src/backend/services/analytics/helm/templates/service.yaml
similarity index 52%
rename from src/backend/services/analytics-api/helm/templates/service.yaml
rename to src/backend/services/analytics/helm/templates/service.yaml
index 85ba035a7..63ce72507 100644
--- a/src/backend/services/analytics-api/helm/templates/service.yaml
+++ b/src/backend/services/analytics/helm/templates/service.yaml
@@ -1,9 +1,9 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: {{ include "insight-analytics-api.fullname" . }}
+  name: {{ include "insight-analytics.fullname" . }}
   labels:
-    {{- include "insight-analytics-api.labels" . | nindent 4 }}
+    {{- include "insight-analytics.labels" . | nindent 4 }}
 spec:
   type: {{ .Values.service.type }}
   ports:
@@ -12,4 +12,4 @@ spec:
       protocol: TCP
       name: http
   selector:
-    {{- include "insight-analytics-api.selectorLabels" . | nindent 4 }}
+    {{- include "insight-analytics.selectorLabels" . | nindent 4 }}
diff --git a/src/backend/services/analytics-api/helm/values.yaml b/src/backend/services/analytics/helm/values.yaml
similarity index 71%
rename from src/backend/services/analytics-api/helm/values.yaml
rename to src/backend/services/analytics/helm/values.yaml
index b1e5e0dcc..3a64b15dd 100644
--- a/src/backend/services/analytics-api/helm/values.yaml
+++ b/src/backend/services/analytics/helm/values.yaml
@@ -3,7 +3,7 @@ replicaCount: 1
 podAnnotations: {}
 
 image:
-  repository: ghcr.io/constructorfabric/insight-analytics-api
+  repository: ghcr.io/constructorfabric/insight-analytics
   tag: ""                  # MUST be set by the operator. No `:latest` default.
   pullPolicy: IfNotPresent
 
@@ -21,23 +21,23 @@ resources:
 
 # Pre-provisioned Secret carrying the gears-rust host's leaf-config overrides
 # (injected via envFrom; they override the mounted config ConfigMap):
-#   APP__gears__analytics_api__config__database_url
-#   APP__gears__analytics_api__config__clickhouse_url|_database|_user|_password
-#   APP__gears__analytics_api__config__redis_url
-#   APP__gears__analytics_api__config__identity_url
-#   APP__gears__analytics_api__config__metric_catalog__tenant_default_id (optional)
+#   APP__gears__analytics__config__database_url
+#   APP__gears__analytics__config__clickhouse_url|_database|_user|_password
+#   APP__gears__analytics__config__redis_url
+#   APP__gears__analytics__config__identity_url
+#   APP__gears__analytics__config__metric_catalog__tenant_default_id (optional)
 #
 # `..._metric_catalog__tenant_default_id` (UUID, optional): single-tenant
 # fallback for the Metric Catalog per DESIGN §2.2
 # `cpt-metric-cat-constraint-tenant-default`. Under the auth-disabled host the
 # platform api-gateway is the sole authenticator and this host injects a
 # single-tenant SecurityContext (toolkit-security's DEFAULT_TENANT_ID); the
-# analytics-api gear overrides the tenant from the `X-Insight-Tenant-Id`
+# analytics gear overrides the tenant from the `X-Insight-Tenant-Id`
 # header when present. The session-bound tenant ALWAYS wins over the
 # configured default (security invariant; see
 # `domain::auth::TenantAuthorization`).
 #
-# The umbrella populates `insight-analytics-api-config` automatically; for
+# The umbrella populates `insight-analytics-config` automatically; for
 # standalone installs the operator pre-creates an equivalent Secret and
 # sets `existingSecret` to its name.
 existingSecret: ""
diff --git a/src/backend/services/analytics-api/src/api/admin/error_map.rs b/src/backend/services/analytics/src/api/admin/error_map.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/api/admin/error_map.rs
rename to src/backend/services/analytics/src/api/admin/error_map.rs
diff --git a/src/backend/services/analytics-api/src/api/admin/handlers.rs b/src/backend/services/analytics/src/api/admin/handlers.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/api/admin/handlers.rs
rename to src/backend/services/analytics/src/api/admin/handlers.rs
diff --git a/src/backend/services/analytics-api/src/api/admin/mod.rs b/src/backend/services/analytics/src/api/admin/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/api/admin/mod.rs
rename to src/backend/services/analytics/src/api/admin/mod.rs
diff --git a/src/backend/services/analytics-api/src/api/canonical_json.rs b/src/backend/services/analytics/src/api/canonical_json.rs
similarity index 99%
rename from src/backend/services/analytics-api/src/api/canonical_json.rs
rename to src/backend/services/analytics/src/api/canonical_json.rs
index 8f7596ed0..f915e502d 100644
--- a/src/backend/services/analytics-api/src/api/canonical_json.rs
+++ b/src/backend/services/analytics/src/api/canonical_json.rs
@@ -7,7 +7,7 @@
 //! `axum::Json<T>` enforces `Content-Type: application/json` and handles
 //! body deserialization — but its rejection responses use Axum's default
 //! plain-text body, which fails the canonical-envelope contract every
-//! analytics-api endpoint is supposed to honor. Hand-rolling
+//! analytics endpoint is supposed to honor. Hand-rolling
 //! content-type checks and `serde_json::from_slice` at every handler
 //! call site (a) duplicates code, (b) drifts between handlers, and
 //! (c) reimplements something Axum already does correctly.
diff --git a/src/backend/services/analytics-api/src/api/catalog.rs b/src/backend/services/analytics/src/api/catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/api/catalog.rs
rename to src/backend/services/analytics/src/api/catalog.rs
diff --git a/src/backend/services/analytics-api/src/api/error.rs b/src/backend/services/analytics/src/api/error.rs
similarity index 98%
rename from src/backend/services/analytics-api/src/api/error.rs
rename to src/backend/services/analytics/src/api/error.rs
index b49ec693a..be74c6989 100644
--- a/src/backend/services/analytics-api/src/api/error.rs
+++ b/src/backend/services/analytics/src/api/error.rs
@@ -1,4 +1,4 @@
-//! Resource-scoped canonical error types for analytics-api handlers.
+//! Resource-scoped canonical error types for analytics handlers.
 //!
 //! Each unit struct binds a GTS resource namespace and exposes builder-style
 //! constructors (`not_found`, `invalid_argument`, …) from the
@@ -63,7 +63,7 @@ pub struct TenantError;
 
 #[cfg(test)]
 mod tests {
-    //! Wire-shape contract for analytics-api error responses.
+    //! Wire-shape contract for analytics error responses.
     //!
     //! These tests pin the §3.3 / RFC 9457 envelope: status code,
     //! `Content-Type: application/problem+json`, `type` GTS URI, and
@@ -74,7 +74,7 @@ mod tests {
     //! Tests assert against `Problem` JSON rather than spinning up an Axum
     //! router so they stay free of the production `AppState` (which needs
     //! MariaDB + `ClickHouse` + `IdentityClient`). The crate's own tests cover
-    //! the `IntoResponse` wiring end-to-end; here we verify analytics-api's
+    //! the `IntoResponse` wiring end-to-end; here we verify the analytics gear's
     //! namespaces and field shapes.
 
     use axum::body::to_bytes;
diff --git a/src/backend/services/analytics-api/src/api/handlers.rs b/src/backend/services/analytics/src/api/handlers.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/api/handlers.rs
rename to src/backend/services/analytics/src/api/handlers.rs
diff --git a/src/backend/services/analytics-api/src/api/http_live_tests.rs b/src/backend/services/analytics/src/api/http_live_tests.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/api/http_live_tests.rs
rename to src/backend/services/analytics/src/api/http_live_tests.rs
diff --git a/src/backend/services/analytics-api/src/api/mod.rs b/src/backend/services/analytics/src/api/mod.rs
similarity index 98%
rename from src/backend/services/analytics-api/src/api/mod.rs
rename to src/backend/services/analytics/src/api/mod.rs
index 414deb508..a32295d53 100644
--- a/src/backend/services/analytics-api/src/api/mod.rs
+++ b/src/backend/services/analytics/src/api/mod.rs
@@ -59,11 +59,11 @@ pub struct AppState {
     pub admin_threshold: AdminThresholdService,
 }
 
-/// Register all analytics-api routes onto the host's stateless router.
+/// Register all analytics routes onto the host's stateless router.
 ///
 /// Builds the analytics endpoints on a fresh sub-router (via
 /// [`build_operations`]) so the tenant-override middleware + `AppState`
-/// extension scope to analytics-api's routes only — not the host's `/health`,
+/// extension scope to the analytics gear's routes only — not the host's `/health`,
 /// `/healthz`, `/openapi.json`, `/docs` — then merges it into the host router.
 ///
 /// The shared `Arc<AppState>` is attached via `router.layer(Extension(state))`
diff --git a/src/backend/services/analytics-api/src/api/tenant_resolution_tests.rs b/src/backend/services/analytics/src/api/tenant_resolution_tests.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/api/tenant_resolution_tests.rs
rename to src/backend/services/analytics/src/api/tenant_resolution_tests.rs
diff --git a/src/backend/services/analytics-api/src/auth.rs b/src/backend/services/analytics/src/auth.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/auth.rs
rename to src/backend/services/analytics/src/auth.rs
diff --git a/src/backend/services/analytics-api/src/config.rs b/src/backend/services/analytics/src/config.rs
similarity index 90%
rename from src/backend/services/analytics-api/src/config.rs
rename to src/backend/services/analytics/src/config.rs
index 7f30edb3a..62d29a025 100644
--- a/src/backend/services/analytics-api/src/config.rs
+++ b/src/backend/services/analytics/src/config.rs
@@ -1,17 +1,17 @@
 //! Gear configuration.
 //!
 //! Loaded via `GearCtx::config::<GearConfig>()` (toolkit serde path), which
-//! deserializes the YAML under `gears.analytics-api.config`. The figment
+//! deserializes the YAML under `gears.analytics.config`. The figment
 //! loader was removed in the gears-rust migration — the toolkit host owns
-//! config layering (defaults -> YAML -> env -> CLI). Env overrides are now
-//! `APP__gears__analytics_api__config__<field>` (the prefix changed from the
+//! config layering (defaults -> YAML -> env -> CLI). Env overrides are
+//! `APP__gears__analytics__config__<field>` (the prefix changed from the
 //! old `ANALYTICS__*`).
 
 use serde::Deserialize;
 use uuid::Uuid;
 
-/// Configuration consumed by the analytics-api gear. Deserialized from
-/// `gears.analytics-api.config`.
+/// Configuration consumed by the analytics gear. Deserialized from
+/// `gears.analytics.config`.
 #[derive(Debug, Clone, Deserialize)]
 #[serde(default)]
 pub struct GearConfig {
@@ -82,7 +82,7 @@ pub struct MetricCatalogConfig {
     /// catalog-resolution hint. The session-bound tenant ALWAYS wins over
     /// this default (security invariant — see `domain::auth::TenantAuthorization`).
     ///
-    /// Env: `APP__gears__analytics_api__config__metric_catalog__tenant_default_id`.
+    /// Env: `APP__gears__analytics__config__metric_catalog__tenant_default_id`.
     pub tenant_default_id: Option<Uuid>,
 }
 
diff --git a/src/backend/services/analytics-api/src/domain/admin_threshold/audit_emitter.rs b/src/backend/services/analytics/src/domain/admin_threshold/audit_emitter.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/admin_threshold/audit_emitter.rs
rename to src/backend/services/analytics/src/domain/admin_threshold/audit_emitter.rs
diff --git a/src/backend/services/analytics-api/src/domain/admin_threshold/dto.rs b/src/backend/services/analytics/src/domain/admin_threshold/dto.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/admin_threshold/dto.rs
rename to src/backend/services/analytics/src/domain/admin_threshold/dto.rs
diff --git a/src/backend/services/analytics-api/src/domain/admin_threshold/live_tests.rs b/src/backend/services/analytics/src/domain/admin_threshold/live_tests.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/admin_threshold/live_tests.rs
rename to src/backend/services/analytics/src/domain/admin_threshold/live_tests.rs
diff --git a/src/backend/services/analytics-api/src/domain/admin_threshold/lock_enforcer.rs b/src/backend/services/analytics/src/domain/admin_threshold/lock_enforcer.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/admin_threshold/lock_enforcer.rs
rename to src/backend/services/analytics/src/domain/admin_threshold/lock_enforcer.rs
diff --git a/src/backend/services/analytics-api/src/domain/admin_threshold/mod.rs b/src/backend/services/analytics/src/domain/admin_threshold/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/admin_threshold/mod.rs
rename to src/backend/services/analytics/src/domain/admin_threshold/mod.rs
diff --git a/src/backend/services/analytics-api/src/domain/admin_threshold/repository.rs b/src/backend/services/analytics/src/domain/admin_threshold/repository.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/admin_threshold/repository.rs
rename to src/backend/services/analytics/src/domain/admin_threshold/repository.rs
diff --git a/src/backend/services/analytics-api/src/domain/admin_threshold/service.rs b/src/backend/services/analytics/src/domain/admin_threshold/service.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/admin_threshold/service.rs
rename to src/backend/services/analytics/src/domain/admin_threshold/service.rs
diff --git a/src/backend/services/analytics-api/src/domain/auth.rs b/src/backend/services/analytics/src/domain/auth.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/auth.rs
rename to src/backend/services/analytics/src/domain/auth.rs
diff --git a/src/backend/services/analytics-api/src/domain/catalog/live_tests.rs b/src/backend/services/analytics/src/domain/catalog/live_tests.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/catalog/live_tests.rs
rename to src/backend/services/analytics/src/domain/catalog/live_tests.rs
diff --git a/src/backend/services/analytics-api/src/domain/catalog/mod.rs b/src/backend/services/analytics/src/domain/catalog/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/catalog/mod.rs
rename to src/backend/services/analytics/src/domain/catalog/mod.rs
diff --git a/src/backend/services/analytics-api/src/domain/catalog/reader.rs b/src/backend/services/analytics/src/domain/catalog/reader.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/catalog/reader.rs
rename to src/backend/services/analytics/src/domain/catalog/reader.rs
diff --git a/src/backend/services/analytics-api/src/domain/catalog/resolver.rs b/src/backend/services/analytics/src/domain/catalog/resolver.rs
similarity index 99%
rename from src/backend/services/analytics-api/src/domain/catalog/resolver.rs
rename to src/backend/services/analytics/src/domain/catalog/resolver.rs
index 21fe0ab3c..8257255cb 100644
--- a/src/backend/services/analytics-api/src/domain/catalog/resolver.rs
+++ b/src/backend/services/analytics/src/domain/catalog/resolver.rs
@@ -9,7 +9,7 @@
 //!
 //! Five separate `SELECT`s would be five round-trips and (per `cpt-metric-cat-nfr-read-latency`)
 //! a ≤ 500 ms miss-path budget that's hard to hit with a multi-replica
-//! analytics-api over a multi-AZ MariaDB. The single SELECT joins
+//! analytics over a multi-AZ MariaDB. The single SELECT joins
 //! `metric_catalog` (enabled rows) with every `metric_threshold` row whose
 //! scope matches the request context for the tenant — at most 5 candidates
 //! per metric, so the row count is `O(metrics × scopes)` = `O(≤ 200 × 5)`.
diff --git a/src/backend/services/analytics-api/src/domain/catalog/response.rs b/src/backend/services/analytics/src/domain/catalog/response.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/catalog/response.rs
rename to src/backend/services/analytics/src/domain/catalog/response.rs
diff --git a/src/backend/services/analytics-api/src/domain/metric.rs b/src/backend/services/analytics/src/domain/metric.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/metric.rs
rename to src/backend/services/analytics/src/domain/metric.rs
diff --git a/src/backend/services/analytics-api/src/domain/mod.rs b/src/backend/services/analytics/src/domain/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/mod.rs
rename to src/backend/services/analytics/src/domain/mod.rs
diff --git a/src/backend/services/analytics-api/src/domain/query.rs b/src/backend/services/analytics/src/domain/query.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/query.rs
rename to src/backend/services/analytics/src/domain/query.rs
diff --git a/src/backend/services/analytics-api/src/domain/schema_validator/backoff.rs b/src/backend/services/analytics/src/domain/schema_validator/backoff.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/schema_validator/backoff.rs
rename to src/backend/services/analytics/src/domain/schema_validator/backoff.rs
diff --git a/src/backend/services/analytics-api/src/domain/schema_validator/error_code.rs b/src/backend/services/analytics/src/domain/schema_validator/error_code.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/schema_validator/error_code.rs
rename to src/backend/services/analytics/src/domain/schema_validator/error_code.rs
diff --git a/src/backend/services/analytics-api/src/domain/schema_validator/live_tests.rs b/src/backend/services/analytics/src/domain/schema_validator/live_tests.rs
similarity index 99%
rename from src/backend/services/analytics-api/src/domain/schema_validator/live_tests.rs
rename to src/backend/services/analytics/src/domain/schema_validator/live_tests.rs
index dcc7cd05c..1ddd89ed6 100644
--- a/src/backend/services/analytics-api/src/domain/schema_validator/live_tests.rs
+++ b/src/backend/services/analytics/src/domain/schema_validator/live_tests.rs
@@ -6,7 +6,7 @@
 //! and `INTEGRATION_TESTS_CLICKHOUSE_URL` (for the ClickHouse-touching tests)
 //! against throwaway services to exercise them.
 //!
-//! Migrations are applied once, up front (the `analytics-api migrate` step /
+//! Migrations are applied once, up front (the `analytics migrate` step /
 //! the CI job) — tests never migrate or reset the DB. Each test owns a unique
 //! `metric_key` (see `unique_metric_key`), so they run in parallel against the
 //! shared catalog without colliding.
diff --git a/src/backend/services/analytics-api/src/domain/schema_validator/mod.rs b/src/backend/services/analytics/src/domain/schema_validator/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/schema_validator/mod.rs
rename to src/backend/services/analytics/src/domain/schema_validator/mod.rs
diff --git a/src/backend/services/analytics-api/src/domain/schema_validator/parse.rs b/src/backend/services/analytics/src/domain/schema_validator/parse.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/schema_validator/parse.rs
rename to src/backend/services/analytics/src/domain/schema_validator/parse.rs
diff --git a/src/backend/services/analytics-api/src/domain/schema_validator/probe.rs b/src/backend/services/analytics/src/domain/schema_validator/probe.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/schema_validator/probe.rs
rename to src/backend/services/analytics/src/domain/schema_validator/probe.rs
diff --git a/src/backend/services/analytics-api/src/domain/schema_validator/repository.rs b/src/backend/services/analytics/src/domain/schema_validator/repository.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/schema_validator/repository.rs
rename to src/backend/services/analytics/src/domain/schema_validator/repository.rs
diff --git a/src/backend/services/analytics-api/src/domain/schema_validator/status.rs b/src/backend/services/analytics/src/domain/schema_validator/status.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/schema_validator/status.rs
rename to src/backend/services/analytics/src/domain/schema_validator/status.rs
diff --git a/src/backend/services/analytics-api/src/domain/threshold.rs b/src/backend/services/analytics/src/domain/threshold.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/domain/threshold.rs
rename to src/backend/services/analytics/src/domain/threshold.rs
diff --git a/src/backend/services/analytics-api/src/gear.rs b/src/backend/services/analytics/src/gear.rs
similarity index 90%
rename from src/backend/services/analytics-api/src/gear.rs
rename to src/backend/services/analytics/src/gear.rs
index 95dd6de40..b00bdaf91 100644
--- a/src/backend/services/analytics-api/src/gear.rs
+++ b/src/backend/services/analytics/src/gear.rs
@@ -1,4 +1,4 @@
-//! The `analytics-api` gear.
+//! The `analytics` gear.
 //!
 //! Hosts the analytics REST surface on the `api-gateway` system gear (the REST
 //! host) under `toolkit::bootstrap::run_server`. All runtime construction that
@@ -29,12 +29,10 @@ use crate::{api, infra};
 /// Analytics API gear. Capabilities: `rest` only (the startup schema-validator
 /// scan is a one-shot `tokio::spawn` in `init`, faithful to the old
 /// `run_server`; no `stateful`/`RunnableCapability`).
-// Config key is the kebab gear name `analytics-api`. Its env overrides use the
-// identifier-safe alias `APP__gears__analytics_api__config__*` (hyphenated names
-// are dropped by the compose `sh`/dash entrypoint and skipped by k8s `envFrom`);
-// `main::fold_gear_env_alias` folds that `analytics_api` alias into this key.
+// Config key is the gear name `analytics`; env overrides are
+// `APP__gears__analytics__config__*`.
 #[toolkit::gear(
-    name = "analytics-api",
+    name = "analytics",
     capabilities = [rest]
 )]
 pub struct AnalyticsApiGear {
@@ -53,7 +51,7 @@ impl Default for AnalyticsApiGear {
 impl Gear for AnalyticsApiGear {
     async fn init(&self, ctx: &GearCtx) -> anyhow::Result<()> {
         let cfg: GearConfig = ctx.config()?;
-        tracing::info!("starting analytics-api gear");
+        tracing::info!("starting analytics gear");
 
         // Connect to MariaDB (self-managed pool — LOCKED DECISION).
         let db = infra::db::connect(&cfg.database_url).await?;
@@ -177,14 +175,14 @@ impl RestApiCapability for AnalyticsApiGear {
         let state = self
             .state
             .get()
-            .ok_or_else(|| anyhow::anyhow!("analytics-api gear not initialized"))?
+            .ok_or_else(|| anyhow::anyhow!("analytics gear not initialized"))?
             .clone();
 
         Ok(api::register_routes(router, openapi, state))
     }
 }
 
-/// `analytics-api migrate`: run migrations + both startup probes + a
+/// `analytics migrate`: run migrations + both startup probes + a
 /// best-effort cache flush, then exit. Mirrors the old `main.rs::run_migrate`,
 /// reading the gear config out of the loaded `AppConfig` (toolkit owns config
 /// layering; the figment loader is gone).
@@ -231,22 +229,22 @@ pub async fn run_migrate(app: &toolkit::bootstrap::AppConfig) -> anyhow::Result<
     Ok(())
 }
 
-/// Pull `gears.analytics-api.config` out of the loaded `AppConfig` and
+/// Pull `gears.analytics.config` out of the loaded `AppConfig` and
 /// deserialize it into [`GearConfig`].
 fn extract_gear_config(app: &toolkit::bootstrap::AppConfig) -> anyhow::Result<GearConfig> {
     let raw = app
         .gears
-        .get("analytics-api")
+        .get("analytics")
         .and_then(|v| v.get("config"))
         .ok_or_else(|| {
-            anyhow::anyhow!("missing `gears.analytics-api.config` section in configuration")
+            anyhow::anyhow!("missing `gears.analytics.config` section in configuration")
         })?;
     let cfg: GearConfig = serde_json::from_value(raw.clone())?;
     Ok(cfg)
 }
 
 /// Validate the analytics gear config without touching the database — used by
-/// the `check` subcommand. Proves `gears.analytics-api.config` is present,
+/// the `check` subcommand. Proves `gears.analytics.config` is present,
 /// deserializes, and carries the connection strings the gear needs at boot.
 ///
 /// # Errors
@@ -257,14 +255,14 @@ pub fn check_config(app: &toolkit::bootstrap::AppConfig) -> anyhow::Result<()> {
     let cfg = extract_gear_config(app)?;
     if cfg.database_url.trim().is_empty() {
         anyhow::bail!(
-            "gears.analytics-api.config.database_url is empty (set \
-             APP__gears__analytics_api__config__database_url)"
+            "gears.analytics.config.database_url is empty (set \
+             APP__gears__analytics__config__database_url)"
         );
     }
     if cfg.clickhouse_url.trim().is_empty() {
         anyhow::bail!(
-            "gears.analytics-api.config.clickhouse_url is empty (set \
-             APP__gears__analytics_api__config__clickhouse_url)"
+            "gears.analytics.config.clickhouse_url is empty (set \
+             APP__gears__analytics__config__clickhouse_url)"
         );
     }
     Ok(())
@@ -291,10 +289,8 @@ mod tests {
         let mut c = AppConfig::default();
         let mut section = serde_json::Map::new();
         section.insert("config".to_owned(), config);
-        c.gears.insert(
-            "analytics-api".to_owned(),
-            serde_json::Value::Object(section),
-        );
+        c.gears
+            .insert("analytics".to_owned(), serde_json::Value::Object(section));
         c
     }
 
diff --git a/src/backend/services/analytics-api/src/infra/cache/catalog_cache.rs b/src/backend/services/analytics/src/infra/cache/catalog_cache.rs
similarity index 99%
rename from src/backend/services/analytics-api/src/infra/cache/catalog_cache.rs
rename to src/backend/services/analytics/src/infra/cache/catalog_cache.rs
index baf8ae0a9..0145eb6fb 100644
--- a/src/backend/services/analytics-api/src/infra/cache/catalog_cache.rs
+++ b/src/backend/services/analytics/src/infra/cache/catalog_cache.rs
@@ -188,7 +188,7 @@ pub trait CatalogCache: Send + Sync {
     async fn invalidate(&self, tenant_id: Uuid, mode: InvalidateMode) -> anyhow::Result<()>;
 
     /// Purge every key under [`CACHE_KEY_PREFIX`]. Used by the seed migration
-    /// at boot and by `analytics-api migrate` after applying migrations.
+    /// at boot and by `analytics migrate` after applying migrations.
     ///
     /// # Errors
     ///
diff --git a/src/backend/services/analytics-api/src/infra/cache/live_tests.rs b/src/backend/services/analytics/src/infra/cache/live_tests.rs
similarity index 98%
rename from src/backend/services/analytics-api/src/infra/cache/live_tests.rs
rename to src/backend/services/analytics/src/infra/cache/live_tests.rs
index 5b84243f7..286576ba0 100644
--- a/src/backend/services/analytics-api/src/infra/cache/live_tests.rs
+++ b/src/backend/services/analytics/src/infra/cache/live_tests.rs
@@ -19,7 +19,7 @@
 //! - `DoD` #6 (≤ 2 s p99 cross-replica invalidation) — exercised by
 //!   [`cross_instance_invalidation_is_visible_immediately`]. Two separate
 //!   `RedisCatalogCache` instances against the SAME Redis URL stand in for
-//!   two analytics-api replicas: replica A invalidates → replica B's `get`
+//!   two analytics replicas: replica A invalidates → replica B's `get`
 //!   sees the absence immediately. (The "2 s" budget is a Redis-side
 //!   property — Redis is the shared backend; the test exercises the
 //!   contract that the cache is in fact shared, not the network latency.)
@@ -230,7 +230,7 @@ async fn lock_bypass_window_expires() -> anyhow::Result<()> {
 #[ignore = "requires live Redis; set INTEGRATION_TESTS_REDIS_URL to enable"]
 async fn cross_instance_invalidation_is_visible_immediately() -> anyhow::Result<()> {
     // `DoD` #6: two `RedisCatalogCache` instances against the SAME Redis URL
-    // (= two analytics-api replicas in prod) MUST see each other's
+    // (= two analytics replicas in prod) MUST see each other's
     // invalidations. Replica A invalidates → replica B's `get` returns None
     // within the read.
     let Ok(url) = std::env::var(ENV_VAR) else {
diff --git a/src/backend/services/analytics-api/src/infra/cache/mod.rs b/src/backend/services/analytics/src/infra/cache/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/infra/cache/mod.rs
rename to src/backend/services/analytics/src/infra/cache/mod.rs
diff --git a/src/backend/services/analytics-api/src/infra/db/check_probe.rs b/src/backend/services/analytics/src/infra/db/check_probe.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/infra/db/check_probe.rs
rename to src/backend/services/analytics/src/infra/db/check_probe.rs
diff --git a/src/backend/services/analytics-api/src/infra/db/entities.rs b/src/backend/services/analytics/src/infra/db/entities.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/infra/db/entities.rs
rename to src/backend/services/analytics/src/infra/db/entities.rs
diff --git a/src/backend/services/analytics-api/src/infra/db/mod.rs b/src/backend/services/analytics/src/infra/db/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/infra/db/mod.rs
rename to src/backend/services/analytics/src/infra/db/mod.rs
diff --git a/src/backend/services/analytics-api/src/infra/db/product_default_probe.rs b/src/backend/services/analytics/src/infra/db/product_default_probe.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/infra/db/product_default_probe.rs
rename to src/backend/services/analytics/src/infra/db/product_default_probe.rs
diff --git a/src/backend/services/analytics-api/src/infra/identity/mod.rs b/src/backend/services/analytics/src/infra/identity/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/infra/identity/mod.rs
rename to src/backend/services/analytics/src/infra/identity/mod.rs
diff --git a/src/backend/services/analytics-api/src/infra/mod.rs b/src/backend/services/analytics/src/infra/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/infra/mod.rs
rename to src/backend/services/analytics/src/infra/mod.rs
diff --git a/src/backend/services/analytics/src/main.rs b/src/backend/services/analytics/src/main.rs
new file mode 100644
index 000000000..90cf38a1d
--- /dev/null
+++ b/src/backend/services/analytics/src/main.rs
@@ -0,0 +1,107 @@
+//! Analytics API — read-only query service over predefined `ClickHouse` metrics.
+//!
+//! Serves admin-defined metrics (SQL queries stored in `MariaDB`) with tenant-scoped,
+//! org-scoped security filters and `OData`-style querying.
+//!
+//! # Architecture
+//!
+//! Runs as a gears-rust host on [`toolkit::bootstrap::run_server`]. The
+//! `api-gateway` system gear is the REST host; the analytics functionality is
+//! the [`gear::AnalyticsApiGear`] (`rest` + `stateful`). Auth is **disabled** on
+//! this host — the platform api-gateway is the sole authenticator and proxies
+//! to us — so the host injects a single-tenant `SecurityContext` and a thin
+//! layer overrides the tenant from `X-Insight-Tenant-Id` (see [`crate::auth`]).
+//!
+//! The MariaDB connection, its 45 sea-orm migrations, and the startup CHECK /
+//! product-default probes remain self-managed inside the gear (we do not use
+//! the toolkit `db` capability — `ClickHouse` is not a toolkit-db backend
+//! anyway).
+//!
+//! # Usage
+//!
+//! ```text
+//! analytics --config config.yaml          # run the host
+//! analytics --config config.yaml migrate  # run migrations + probes and exit
+//! ```
+
+mod api;
+mod auth;
+mod config;
+mod domain;
+mod gear;
+mod infra;
+mod migration;
+
+// System gears — linked via inventory for the REST host and the (disabled)
+// auth pipeline. Mirrors the api-gateway service's no-auth gear set, minus the
+// OIDC plugin / proxy / auth-info (this host never authenticates).
+use api_gateway as _;
+use authn_resolver as _;
+use authz_resolver as _;
+use gear_orchestrator as _;
+use grpc_hub as _;
+use single_tenant_tr_plugin as _;
+use static_authz_plugin as _;
+use tenant_resolver as _;
+use types_registry as _;
+
+use std::path::PathBuf;
+
+use anyhow::Result;
+use clap::{Parser, Subcommand};
+use toolkit::bootstrap::{AppConfig, run_server};
+
+/// Analytics API service.
+#[derive(Parser)]
+#[command(name = "analytics")]
+#[command(about = "Insight Analytics API — query service over `ClickHouse` metrics")]
+#[command(version = env!("CARGO_PKG_VERSION"))]
+struct Cli {
+    /// Path to YAML configuration file.
+    #[arg(short, long)]
+    config: Option<PathBuf>,
+
+    /// Print the effective configuration and exit.
+    #[arg(long)]
+    print_config: bool,
+
+    /// Increase log verbosity (-v = debug, -vv = trace).
+    #[arg(short, long, action = clap::ArgAction::Count)]
+    verbose: u8,
+
+    #[command(subcommand)]
+    command: Option<Commands>,
+}
+
+#[derive(Subcommand)]
+enum Commands {
+    /// Start the server (default).
+    Run,
+    /// Run database migrations + startup probes and exit.
+    Migrate,
+    /// Validate configuration and exit.
+    Check,
+}
+
+#[tokio::main]
+async fn main() -> Result<()> {
+    let cli = Cli::parse();
+
+    // Layered config: defaults -> YAML -> env (APP__*) -> CLI overrides.
+    // Logging/OTel are initialized by the bootstrap runtime, not here.
+    let mut config = AppConfig::load_or_default(cli.config.as_ref())?;
+    config.apply_cli_overrides(cli.verbose);
+
+    if cli.print_config {
+        println!("Effective configuration:\n{}", config.to_yaml()?);
+        return Ok(());
+    }
+
+    match cli.command.unwrap_or(Commands::Run) {
+        Commands::Run => run_server(config).await,
+        Commands::Migrate => gear::run_migrate(&config).await,
+        // Validate the gear config (section present, deserializes, required
+        // URLs set) without connecting to any backend.
+        Commands::Check => gear::check_config(&config),
+    }
+}
diff --git a/src/backend/services/analytics-api/src/migration/m20260414_000001_init.rs b/src/backend/services/analytics/src/migration/m20260414_000001_init.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260414_000001_init.rs
rename to src/backend/services/analytics/src/migration/m20260414_000001_init.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260422_000001_seed_metrics.rs b/src/backend/services/analytics/src/migration/m20260422_000001_seed_metrics.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260422_000001_seed_metrics.rs
rename to src/backend/services/analytics/src/migration/m20260422_000001_seed_metrics.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260423_000001_seed_metrics_honest_nulls.rs b/src/backend/services/analytics/src/migration/m20260423_000001_seed_metrics_honest_nulls.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260423_000001_seed_metrics_honest_nulls.rs
rename to src/backend/services/analytics/src/migration/m20260423_000001_seed_metrics_honest_nulls.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260428_000001_collab_metrics_update.rs b/src/backend/services/analytics/src/migration/m20260428_000001_collab_metrics_update.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260428_000001_collab_metrics_update.rs
rename to src/backend/services/analytics/src/migration/m20260428_000001_collab_metrics_update.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260429_000001_task_delivery_silver_rewrite.rs b/src/backend/services/analytics/src/migration/m20260429_000001_task_delivery_silver_rewrite.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260429_000001_task_delivery_silver_rewrite.rs
rename to src/backend/services/analytics/src/migration/m20260429_000001_task_delivery_silver_rewrite.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260430_000001_update_git_bullet.rs b/src/backend/services/analytics/src/migration/m20260430_000001_update_git_bullet.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260430_000001_update_git_bullet.rs
rename to src/backend/services/analytics/src/migration/m20260430_000001_update_git_bullet.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260507_000001_seed_crm_metrics.rs b/src/backend/services/analytics/src/migration/m20260507_000001_seed_crm_metrics.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260507_000001_seed_crm_metrics.rs
rename to src/backend/services/analytics/src/migration/m20260507_000001_seed_crm_metrics.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260515_000001_task_delivery_bullet_rewrite.rs b/src/backend/services/analytics/src/migration/m20260515_000001_task_delivery_bullet_rewrite.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260515_000001_task_delivery_bullet_rewrite.rs
rename to src/backend/services/analytics/src/migration/m20260515_000001_task_delivery_bullet_rewrite.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260518_000001_collab_bullet_rewrite.rs b/src/backend/services/analytics/src/migration/m20260518_000001_collab_bullet_rewrite.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260518_000001_collab_bullet_rewrite.rs
rename to src/backend/services/analytics/src/migration/m20260518_000001_collab_bullet_rewrite.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260519_000001_ai_bullet_rewrite.rs b/src/backend/services/analytics/src/migration/m20260519_000001_ai_bullet_rewrite.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260519_000001_ai_bullet_rewrite.rs
rename to src/backend/services/analytics/src/migration/m20260519_000001_ai_bullet_rewrite.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260520_000001_code_quality_bullet_rewrite.rs b/src/backend/services/analytics/src/migration/m20260520_000001_code_quality_bullet_rewrite.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260520_000001_code_quality_bullet_rewrite.rs
rename to src/backend/services/analytics/src/migration/m20260520_000001_code_quality_bullet_rewrite.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260522_000001_metric_catalog.rs b/src/backend/services/analytics/src/migration/m20260522_000001_metric_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260522_000001_metric_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260522_000001_metric_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260522_000002_metric_threshold.rs b/src/backend/services/analytics/src/migration/m20260522_000002_metric_threshold.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260522_000002_metric_threshold.rs
rename to src/backend/services/analytics/src/migration/m20260522_000002_metric_threshold.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260522_000003_threshold_lock_audit.rs b/src/backend/services/analytics/src/migration/m20260522_000003_threshold_lock_audit.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260522_000003_threshold_lock_audit.rs
rename to src/backend/services/analytics/src/migration/m20260522_000003_threshold_lock_audit.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260527_000001_seed_metric_catalog.rs b/src/backend/services/analytics/src/migration/m20260527_000001_seed_metric_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260527_000001_seed_metric_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260527_000001_seed_metric_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260527_000002_seed_metric_views.rs b/src/backend/services/analytics/src/migration/m20260527_000002_seed_metric_views.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260527_000002_seed_metric_views.rs
rename to src/backend/services/analytics/src/migration/m20260527_000002_seed_metric_views.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260529_000001_metric_query_catalog_link.rs b/src/backend/services/analytics/src/migration/m20260529_000001_metric_query_catalog_link.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260529_000001_metric_query_catalog_link.rs
rename to src/backend/services/analytics/src/migration/m20260529_000001_metric_query_catalog_link.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260601_000001_ai_claude_team_metrics.rs b/src/backend/services/analytics/src/migration/m20260601_000001_ai_claude_team_metrics.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260601_000001_ai_claude_team_metrics.rs
rename to src/backend/services/analytics/src/migration/m20260601_000001_ai_claude_team_metrics.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260601_000002_seed_claude_team_metrics_catalog.rs b/src/backend/services/analytics/src/migration/m20260601_000002_seed_claude_team_metrics_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260601_000002_seed_claude_team_metrics_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260601_000002_seed_claude_team_metrics_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260603_000001_seed_crm_metric_catalog.rs b/src/backend/services/analytics/src/migration/m20260603_000001_seed_crm_metric_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260603_000001_seed_crm_metric_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260603_000001_seed_crm_metric_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260603_000002_link_crm_query_catalog.rs b/src/backend/services/analytics/src/migration/m20260603_000002_link_crm_query_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260603_000002_link_crm_query_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260603_000002_link_crm_query_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260604_000001_task_delivery_bullet_distribution.rs b/src/backend/services/analytics/src/migration/m20260604_000001_task_delivery_bullet_distribution.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260604_000001_task_delivery_bullet_distribution.rs
rename to src/backend/services/analytics/src/migration/m20260604_000001_task_delivery_bullet_distribution.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260604_000002_collab_bullet_distribution.rs b/src/backend/services/analytics/src/migration/m20260604_000002_collab_bullet_distribution.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260604_000002_collab_bullet_distribution.rs
rename to src/backend/services/analytics/src/migration/m20260604_000002_collab_bullet_distribution.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260604_000004_code_quality_bullet_distribution.rs b/src/backend/services/analytics/src/migration/m20260604_000004_code_quality_bullet_distribution.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260604_000004_code_quality_bullet_distribution.rs
rename to src/backend/services/analytics/src/migration/m20260604_000004_code_quality_bullet_distribution.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260604_000005_git_bullet_distribution.rs b/src/backend/services/analytics/src/migration/m20260604_000005_git_bullet_distribution.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260604_000005_git_bullet_distribution.rs
rename to src/backend/services/analytics/src/migration/m20260604_000005_git_bullet_distribution.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260604_000006_ic_kpis_peer_median.rs b/src/backend/services/analytics/src/migration/m20260604_000006_ic_kpis_peer_median.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260604_000006_ic_kpis_peer_median.rs
rename to src/backend/services/analytics/src/migration/m20260604_000006_ic_kpis_peer_median.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260604_000009_member_metric_values.rs b/src/backend/services/analytics/src/migration/m20260604_000009_member_metric_values.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260604_000009_member_metric_values.rs
rename to src/backend/services/analytics/src/migration/m20260604_000009_member_metric_values.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260606_000001_dept_metric_distributions.rs b/src/backend/services/analytics/src/migration/m20260606_000001_dept_metric_distributions.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260606_000001_dept_metric_distributions.rs
rename to src/backend/services/analytics/src/migration/m20260606_000001_dept_metric_distributions.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260609_000001_ai_chatgpt_team_metrics.rs b/src/backend/services/analytics/src/migration/m20260609_000001_ai_chatgpt_team_metrics.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260609_000001_ai_chatgpt_team_metrics.rs
rename to src/backend/services/analytics/src/migration/m20260609_000001_ai_chatgpt_team_metrics.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260609_000002_seed_chatgpt_team_metrics_catalog.rs b/src/backend/services/analytics/src/migration/m20260609_000002_seed_chatgpt_team_metrics_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260609_000002_seed_chatgpt_team_metrics_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260609_000002_seed_chatgpt_team_metrics_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260610_000001_fix_ai_label_drift.rs b/src/backend/services/analytics/src/migration/m20260610_000001_fix_ai_label_drift.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260610_000001_fix_ai_label_drift.rs
rename to src/backend/services/analytics/src/migration/m20260610_000001_fix_ai_label_drift.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260611_000001_ai_bullet_dept_reconcile.rs b/src/backend/services/analytics/src/migration/m20260611_000001_ai_bullet_dept_reconcile.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260611_000001_ai_bullet_dept_reconcile.rs
rename to src/backend/services/analytics/src/migration/m20260611_000001_ai_bullet_dept_reconcile.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260612_000001_support_metrics.rs b/src/backend/services/analytics/src/migration/m20260612_000001_support_metrics.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260612_000001_support_metrics.rs
rename to src/backend/services/analytics/src/migration/m20260612_000001_support_metrics.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260612_000001_team_git_bullet.rs b/src/backend/services/analytics/src/migration/m20260612_000001_team_git_bullet.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260612_000001_team_git_bullet.rs
rename to src/backend/services/analytics/src/migration/m20260612_000001_team_git_bullet.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260612_000002_seed_support_catalog.rs b/src/backend/services/analytics/src/migration/m20260612_000002_seed_support_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260612_000002_seed_support_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260612_000002_seed_support_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260612_000003_link_support_query_catalog.rs b/src/backend/services/analytics/src/migration/m20260612_000003_link_support_query_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260612_000003_link_support_query_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260612_000003_link_support_query_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260618_000001_ai_claude_team_overage_metric.rs b/src/backend/services/analytics/src/migration/m20260618_000001_ai_claude_team_overage_metric.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260618_000001_ai_claude_team_overage_metric.rs
rename to src/backend/services/analytics/src/migration/m20260618_000001_ai_claude_team_overage_metric.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260618_000002_seed_claude_team_overage_catalog.rs b/src/backend/services/analytics/src/migration/m20260618_000002_seed_claude_team_overage_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260618_000002_seed_claude_team_overage_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260618_000002_seed_claude_team_overage_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260620_000001_seed_wiki_metrics.rs b/src/backend/services/analytics/src/migration/m20260620_000001_seed_wiki_metrics.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260620_000001_seed_wiki_metrics.rs
rename to src/backend/services/analytics/src/migration/m20260620_000001_seed_wiki_metrics.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260620_000002_seed_wiki_catalog.rs b/src/backend/services/analytics/src/migration/m20260620_000002_seed_wiki_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260620_000002_seed_wiki_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260620_000002_seed_wiki_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260623_000001_ai_personal_queries.rs b/src/backend/services/analytics/src/migration/m20260623_000001_ai_personal_queries.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260623_000001_ai_personal_queries.rs
rename to src/backend/services/analytics/src/migration/m20260623_000001_ai_personal_queries.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260623_000002_seed_ai_personal_metric_catalog.rs b/src/backend/services/analytics/src/migration/m20260623_000002_seed_ai_personal_metric_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260623_000002_seed_ai_personal_metric_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260623_000002_seed_ai_personal_metric_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260624_000001_collab_zulip_chat.rs b/src/backend/services/analytics/src/migration/m20260624_000001_collab_zulip_chat.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260624_000001_collab_zulip_chat.rs
rename to src/backend/services/analytics/src/migration/m20260624_000001_collab_zulip_chat.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260624_000002_seed_zulip_collab_catalog.rs b/src/backend/services/analytics/src/migration/m20260624_000002_seed_zulip_collab_catalog.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260624_000002_seed_zulip_collab_catalog.rs
rename to src/backend/services/analytics/src/migration/m20260624_000002_seed_zulip_collab_catalog.rs
diff --git a/src/backend/services/analytics-api/src/migration/m20260624_000003_ic_chart_loc_git_breakdown.rs b/src/backend/services/analytics/src/migration/m20260624_000003_ic_chart_loc_git_breakdown.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/m20260624_000003_ic_chart_loc_git_breakdown.rs
rename to src/backend/services/analytics/src/migration/m20260624_000003_ic_chart_loc_git_breakdown.rs
diff --git a/src/backend/services/analytics-api/src/migration/mod.rs b/src/backend/services/analytics/src/migration/mod.rs
similarity index 100%
rename from src/backend/services/analytics-api/src/migration/mod.rs
rename to src/backend/services/analytics/src/migration/mod.rs
diff --git a/src/backend/services/api-gateway/Dockerfile b/src/backend/services/api-gateway/Dockerfile
index 15e8aa751..b7609a625 100644
--- a/src/backend/services/api-gateway/Dockerfile
+++ b/src/backend/services/api-gateway/Dockerfile
@@ -24,12 +24,12 @@ COPY Cargo.toml Cargo.lock ./
 COPY libs/insight-clickhouse/Cargo.toml ./libs/insight-clickhouse/Cargo.toml
 COPY plugins/oidc-authn-plugin/Cargo.toml ./plugins/oidc-authn-plugin/Cargo.toml
 COPY services/api-gateway/Cargo.toml ./services/api-gateway/Cargo.toml
-COPY services/analytics-api/Cargo.toml ./services/analytics-api/Cargo.toml
+COPY services/analytics/Cargo.toml ./services/analytics/Cargo.toml
 
 RUN mkdir -p libs/insight-clickhouse/src && echo "" > libs/insight-clickhouse/src/lib.rs && \
     mkdir -p plugins/oidc-authn-plugin/src && echo "" > plugins/oidc-authn-plugin/src/lib.rs && \
     mkdir -p services/api-gateway/src && echo "fn main() {}" > services/api-gateway/src/main.rs && \
-    mkdir -p services/analytics-api/src && echo "fn main() {}" > services/analytics-api/src/main.rs
+    mkdir -p services/analytics/src && echo "fn main() {}" > services/analytics/src/main.rs
 
 # Cache dependencies
 RUN cargo build --release --bin insight-api-gateway 2>/dev/null || true
diff --git a/src/backend/services/api-gateway/config/insight.yaml b/src/backend/services/api-gateway/config/insight.yaml
index 0f14a6372..2115d15d1 100644
--- a/src/backend/services/api-gateway/config/insight.yaml
+++ b/src/backend/services/api-gateway/config/insight.yaml
@@ -109,7 +109,7 @@ gears:
     config:
       routes:
         - prefix: "/analytics"
-          upstream: "${PROXY_ANALYTICS_URL:=http://analytics-api:8081}"
+          upstream: "${PROXY_ANALYTICS_URL:=http://analytics:8081}"
 
 # ─── Local development ──────────────────────────────────────
 # To run without OIDC (auth disabled), override:
diff --git a/src/backend/services/api-gateway/config/no-auth.yaml b/src/backend/services/api-gateway/config/no-auth.yaml
index ea0734598..fb9c298bb 100644
--- a/src/backend/services/api-gateway/config/no-auth.yaml
+++ b/src/backend/services/api-gateway/config/no-auth.yaml
@@ -76,6 +76,6 @@ gears:
     config:
       routes:
         - prefix: "/analytics"
-          upstream: "http://analytics-api:8081"
+          upstream: "http://analytics:8081"
         - prefix: "/identity"
           upstream: "http://identity:8082"
diff --git a/src/backend/services/api-gateway/src/proxy.rs b/src/backend/services/api-gateway/src/proxy.rs
index e3aff80de..e497f63f3 100644
--- a/src/backend/services/api-gateway/src/proxy.rs
+++ b/src/backend/services/api-gateway/src/proxy.rs
@@ -15,7 +15,7 @@
 //!     config:
 //!       routes:
 //!         - prefix: "/analytics"
-//!           upstream: "http://analytics-api:8081"
+//!           upstream: "http://analytics:8081"
 //!         - prefix: "/public-api"
 //!           upstream: "http://public-service:8080"
 //!           public: true
@@ -40,7 +40,7 @@ use toolkit_canonical_errors::CanonicalError;
 pub struct RouteConfig {
     /// URL path prefix to match (e.g. "/analytics").
     pub prefix: String,
-    /// Upstream service base URL (e.g. `http://analytics-api:8081`).
+    /// Upstream service base URL (e.g. `http://analytics:8081`).
     pub upstream: String,
     /// If true, this route does NOT require authentication.
     /// Default: false (all routes require auth).
diff --git a/src/ingestion/connectors/ai/chatgpt-team/README.md b/src/ingestion/connectors/ai/chatgpt-team/README.md
index 92733dea8..b051f6e91 100644
--- a/src/ingestion/connectors/ai/chatgpt-team/README.md
+++ b/src/ingestion/connectors/ai/chatgpt-team/README.md
@@ -77,7 +77,7 @@ Shipped (this connector's `dbt/`):
 - `chatgpt_team_codex_user_daily` → `chatgpt_team__ai_dev_usage` → **`class_ai_dev_usage`** (`tool='codex'`, alongside Claude Code / Cursor).
 - `chatgpt_team_chat_activity` → `chatgpt_team__ai_assistant_usage` → **`class_ai_assistant_usage`** (`tool='chatgpt'`, `surface='chat'`).
 
-Plus the bronze→RMT promotion (`chatgpt_team__bronze_promoted`). The keys then flow to Gold (`ai_bullet_rows`) and the analytics-api query_ref / `metric_catalog`.
+Plus the bronze→RMT promotion (`chatgpt_team__bronze_promoted`). The keys then flow to Gold (`ai_bullet_rows`) and the analytics query_ref / `metric_catalog`.
 
 ## Related
 
diff --git a/src/ingestion/tests/e2e/README.md b/src/ingestion/tests/e2e/README.md
index ac7cf4c6f..5396ece5e 100644
--- a/src/ingestion/tests/e2e/README.md
+++ b/src/ingestion/tests/e2e/README.md
@@ -4,7 +4,7 @@ Test framework that exercises the full data path:
 
 ```
 metrics/<name>.test.yaml (bronze records)  →  bronze tables  →  dbt staging/silver  →
-ClickHouse migration gold-views  →  analytics-api HTTP (POST /v1/metrics/queries)  →  expect rules
+ClickHouse migration gold-views  →  analytics HTTP (POST /v1/metrics/queries)  →  expect rules
 ```
 
 Airbyte / Kestra / Argo are NOT exercised — bronze is seeded by direct INSERT of the
@@ -31,7 +31,7 @@ cd src/ingestion/tests/e2e
 
 The same image (and the same `./e2e.sh test` invocation) is used in CI — see `.github/workflows/e2e-bronze-to-api.yml`.
 
-First session bootstraps `cargo build --release -p analytics-api` (~3-5 min). Subsequent sessions reuse the named volume so cargo is incremental (~10s).
+First session bootstraps `cargo build --release -p analytics` (~3-5 min). Subsequent sessions reuse the named volume so cargo is incremental (~10s).
 
 ## Run (advanced — host-local)
 
@@ -61,7 +61,7 @@ e2e/
 │   ├── clickhouse.py           # CH HTTP client wrapper
 │   ├── mariadb.py              # MariaDB connection helper
 │   ├── migration_applier.py    # applies src/ingestion/scripts/migrations/*.sql
-│   ├── analytics_api.py        # builds + spawns the analytics-api binary
+│   ├── analytics.py        # builds + spawns the analytics binary
 │   ├── worker.py               # WorkerContext (resolves pytest-xdist worker id)
 │   ├── metric_coverage.py      # metric-coverage gate: SKIP_TABLES + SKIP_LIST (--universe-file)
 │   ├── collect_metrics.py      # script: snapshot the metric catalog → .artifacts/
@@ -75,7 +75,7 @@ e2e/
 
 ## Metric coverage gate
 
-A job (`metric-coverage-gate`) in the **E2E — Bronze to API** workflow, *not* a pytest test. The `e2e` job runs the suite and, while analytics-api is up, snapshots the metric catalog (`POST /v1/catalog/get_metrics`) to `.artifacts/catalog_metrics.json` (uploaded as `coverage-inputs`); the gate job then checks every product `metric_key` the catalog exposes is value-asserted by a test or covered by a `SKIP_TABLES`/`SKIP_LIST` entry — pure Python, no Docker, no second app boot.
+A job (`metric-coverage-gate`) in the **E2E — Bronze to API** workflow, *not* a pytest test. The `e2e` job runs the suite and, while analytics is up, snapshots the metric catalog (`POST /v1/catalog/get_metrics`) to `.artifacts/catalog_metrics.json` (uploaded as `coverage-inputs`); the gate job then checks every product `metric_key` the catalog exposes is value-asserted by a test or covered by a `SKIP_TABLES`/`SKIP_LIST` entry — pure Python, no Docker, no second app boot.
 
 Locally, after a run:
 
@@ -93,8 +93,8 @@ The verdict per **metric_key** (each individual number) is **binary**:
 Catalog keys are dotted (`collab_bullet_rows.m365_emails_sent`); a test asserts the bare response key (`m365_emails_sent`). The column suffix is unique across the catalog, so the gate maps bare→dotted by suffix (a future collision raises). `SKIP_LIST` is the accepted baseline and single source of truth (no side-car file — just `(metric_key, reason)`). Kept honest: a **stale** entry (key no longer in the catalog), a **redundant** one (now value-tested), or a test asserting a **non-catalog** key (typo / unseeded → matches 0 rows) all fail. PASS iff no FAILs.
 
 ```bash
-# ad hoc against a running analytics-api (instead of the collected artifact):
-ANALYTICS_API_URL=http://localhost:18081 python3 lib/metric_coverage.py
+# ad hoc against a running analytics (instead of the collected artifact):
+ANALYTICS_URL=http://localhost:18081 python3 lib/metric_coverage.py
 ```
 
 Coverage is **per metric_key**, so every number on a bullet is validated independently — one tested key of a metric does not cover the rest. Today: **44/96** value-tested; the rest are skip-listed with a reason (`reachable — …` entries are the backlog where fixtures already exist).
@@ -106,14 +106,14 @@ Coverage is **per metric_key**, so every number on a bullet is validated indepen
 | ClickHouse HTTP | `127.0.0.1:30523` | 8123 |
 | ClickHouse native | `127.0.0.1:30529` | 9000 |
 | MariaDB | `127.0.0.1:30506` | 3306 |
-| analytics-api | `127.0.0.1:<random>` | — |
+| analytics | `127.0.0.1:<random>` | — |
 
 These ports avoid conflict with a local gitops dev cluster (which forwards 8123 / 3306) and the dbt local profile (30123).
 
 ## Notes for fixture authors
 
-- Auth in `analytics-api` requires no Bearer token, but its tenant middleware rejects requests without a non-nil tenant. The harness sends `X-Insight-Tenant-Id` with `lib.config.TEST_TENANT_ID` on every request and re-homes seeded metric definitions onto that tenant (`metric_seed.py`). The ClickHouse query path does not filter by tenant yet, so seeded bronze rows may use any tenant value.
-- Metric definitions are auto-seeded by the analytics-api binary's SeaORM migrations. Look up the metric UUID with `GET /v1/metrics` once the session is up, or add overrides in `seed/metrics.yaml`.
+- Auth in `analytics` requires no Bearer token, but its tenant middleware rejects requests without a non-nil tenant. The harness sends `X-Insight-Tenant-Id` with `lib.config.TEST_TENANT_ID` on every request and re-homes seeded metric definitions onto that tenant (`metric_seed.py`). The ClickHouse query path does not filter by tenant yet, so seeded bronze rows may use any tenant value.
+- Metric definitions are auto-seeded by the analytics binary's SeaORM migrations. Look up the metric UUID with `GET /v1/metrics` once the session is up, or add overrides in `seed/metrics.yaml`.
 
 ## `cases` / `expect` (declarative YAML rig)
 
diff --git a/src/ingestion/tests/e2e/api/test_session_smoke.py b/src/ingestion/tests/e2e/api/test_session_smoke.py
index a44b27d60..809bfd5ea 100644
--- a/src/ingestion/tests/e2e/api/test_session_smoke.py
+++ b/src/ingestion/tests/e2e/api/test_session_smoke.py
@@ -14,7 +14,7 @@
 
 from lib import clickhouse as ch
 from lib import mariadb
-from lib.analytics_api import AnalyticsApiProcess
+from lib.analytics import AnalyticsProcess
 from lib.config import SessionConfig
 
 
@@ -47,20 +47,20 @@ def test_migrations_create_insight_database(
     assert len(views) >= 20, f"expected many gold views, got {len(views)}: {views!r}"
 
 
-def test_analytics_api_health(analytics_api: AnalyticsApiProcess) -> None:
-    """analytics-api responds 200 on /health.
+def test_analytics_health(analytics: AnalyticsProcess) -> None:
+    """analytics responds 200 on /health.
 
     Requires a cargo/rustc satisfying `rust-version` in src/backend/Cargo.toml.
     An older toolchain now FAILS (not skips) — run `rustup update stable`.
     """
-    with analytics_api.client() as c:
+    with analytics.client() as c:
         r = c.get("/health")
         assert r.status_code == 200
 
 
-def test_analytics_api_lists_metrics(analytics_api: AnalyticsApiProcess) -> None:
+def test_analytics_lists_metrics(analytics: AnalyticsProcess) -> None:
     """SeaORM auto-migrations seed metrics on binary startup — list them."""
-    with analytics_api.client() as c:
+    with analytics.client() as c:
         r = c.get("/v1/metrics")
         assert r.status_code == 200, f"status={r.status_code} body={r.text}"
         payload = r.json()
diff --git a/src/ingestion/tests/e2e/compose/Dockerfile.runner b/src/ingestion/tests/e2e/compose/Dockerfile.runner
index dbe879f03..104658724 100644
--- a/src/ingestion/tests/e2e/compose/Dockerfile.runner
+++ b/src/ingestion/tests/e2e/compose/Dockerfile.runner
@@ -2,7 +2,7 @@
 #
 # Bakes in:
 #   - Python 3.12 + lib deps (pytest, clickhouse-connect, pandas, dbt-clickhouse, …)
-#   - the analytics-api binary and each connector's enrich binary, each COMPILED
+#   - the analytics binary and each connector's enrich binary, each COMPILED
 #     FROM ITS OWN Dockerfile and pulled in via `COPY --from=<ctx>` (the contexts
 #     are wired in docker-compose.runner.yml `runner.build.additional_contexts`).
 #
@@ -39,10 +39,10 @@ RUN mkdir -p lib && touch lib/__init__.py \
 
 # ── Pre-built binaries (baked from each component's OWN Dockerfile) ───────
 # Named build contexts come from docker-compose.runner.yml build-only services;
-# the rig RUNS these (analytics-api as a spawned service; enrich between the
+# the rig RUNS these (analytics as a spawned service; enrich between the
 # staging and silver dbt builds) but never compiles them. One COPY per binary
 # (matches the `additional_contexts` entries).
-COPY --from=analytics-api /app/analytics-api /usr/local/bin/analytics-api
+COPY --from=analytics /app/analytics /usr/local/bin/analytics
 COPY --from=jira-enrich /usr/local/bin/jira-enrich /usr/local/bin/jira-enrich
 
 # ── Defaults ────────────────────────────────────────────────────────────
diff --git a/src/ingestion/tests/e2e/compose/docker-compose.cache.yml b/src/ingestion/tests/e2e/compose/docker-compose.cache.yml
index 5583ee418..a9bdb65ca 100644
--- a/src/ingestion/tests/e2e/compose/docker-compose.cache.yml
+++ b/src/ingestion/tests/e2e/compose/docker-compose.cache.yml
@@ -2,7 +2,7 @@
 #
 # Wires each build-only service (and the runner) to the GitHub Actions BuildKit
 # cache backend so the expensive layers persist across workflow runs: the Rust
-# dependency-compile layers for analytics-api + jira-enrich, and the runner's
+# dependency-compile layers for analytics + jira-enrich, and the runner's
 # pip-install layer. On a warm cache with an unchanged Cargo.lock/pyproject.toml,
 # those layers restore instead of rebuilding.
 #
@@ -21,12 +21,12 @@ services:
       cache_to:
         - type=gha,mode=max,scope=e2e-jira-enrich
 
-  analytics-api:
+  analytics:
     build:
       cache_from:
-        - type=gha,scope=e2e-analytics-api
+        - type=gha,scope=e2e-analytics
       cache_to:
-        - type=gha,mode=max,scope=e2e-analytics-api
+        - type=gha,mode=max,scope=e2e-analytics
 
   runner:
     build:
diff --git a/src/ingestion/tests/e2e/compose/docker-compose.runner.yml b/src/ingestion/tests/e2e/compose/docker-compose.runner.yml
index 36c97ef2e..a80c10b74 100644
--- a/src/ingestion/tests/e2e/compose/docker-compose.runner.yml
+++ b/src/ingestion/tests/e2e/compose/docker-compose.runner.yml
@@ -27,15 +27,15 @@ services:
       dockerfile: Dockerfile
     image: insight-e2e-enrich-jira:local
 
-  # Build-only helper: compiles analytics-api FROM ITS OWN Dockerfile (same as the
+  # Build-only helper: compiles analytics FROM ITS OWN Dockerfile (same as the
   # prod image, build context src/backend). Consumed by the runner via
   # additional_contexts (COPY --from) and baked in — the runner no longer compiles
   # anything, so its image carries no Rust toolchain.
-  analytics-api:
+  analytics:
     build:
       context: ${INSIGHT_REPO_ROOT:-../../../..}/src/backend
-      dockerfile: services/analytics-api/Dockerfile
-    image: insight-e2e-analytics-api:local
+      dockerfile: services/analytics/Dockerfile
+    image: insight-e2e-analytics:local
 
   runner:
     build:
@@ -49,7 +49,7 @@ services:
       # `COPY --from=<name>` in Dockerfile.runner pulls the compiled binary.
       additional_contexts:
         jira-enrich: "service:jira-enrich"
-        analytics-api: "service:analytics-api"
+        analytics: "service:analytics"
     image: insight-e2e-runner:latest
     container_name: insight-e2e-runner
     working_dir: /workspace/src/ingestion/tests/e2e
diff --git a/src/ingestion/tests/e2e/conftest.py b/src/ingestion/tests/e2e/conftest.py
index 22fd0900b..954c83cb7 100644
--- a/src/ingestion/tests/e2e/conftest.py
+++ b/src/ingestion/tests/e2e/conftest.py
@@ -5,8 +5,8 @@
   pytest_sessionstart:
     1. docker compose up (ClickHouse + MariaDB)
     2. apply ClickHouse migrations
-    3. MariaDB is seeded later by the analytics-api binary's own auto-migrations
-    4. spawn analytics-api on a free loopback port
+    3. MariaDB is seeded later by the analytics binary's own auto-migrations
+    4. spawn analytics on a free loopback port
 
   pytest_sessionfinish:
     teardown in reverse order
@@ -17,7 +17,7 @@
 When pytest-xdist is active, pytest_sessionstart runs in each worker — but
 docker-compose containers are shared (same names). The compose lifecycle
 is therefore idempotent: subsequent workers attach to the already-running
-stack. The analytics-api binary spawn happens in the master only (gated on
+stack. The analytics binary spawn happens in the master only (gated on
 PYTEST_XDIST_WORKER) to avoid N processes on N workers.
 """
 
@@ -31,7 +31,7 @@
 
 from lib import clickhouse as ch
 from lib import compose, mariadb
-from lib.analytics_api import AnalyticsApiProcess, find_free_port, locate_binary
+from lib.analytics import AnalyticsProcess, find_free_port, locate_binary
 from lib.ch_seeder import CHSeeder
 from lib.config import SessionConfig, TEST_TENANT_ID
 from lib.dbt_runner import DbtRunner
@@ -49,7 +49,7 @@
 # ----------------------------------------------------------------------
 
 # When running under xdist, all workers share the same compose stack and the
-# same analytics-api process. We elect the first worker as the "owner" of the
+# same analytics process. We elect the first worker as the "owner" of the
 # shared resources; the others wait until the owner reports ready.
 #
 # For the scaffolding MVP we keep it simple: do NOT support xdist yet (the
@@ -196,13 +196,13 @@ def dbt_runner(ch_migrations_applied: SessionConfig):
     runner.cleanup()
 
 
-def _collect_metrics(proc: AnalyticsApiProcess) -> None:
+def _collect_metrics(proc: AnalyticsProcess) -> None:
     """Run `lib/collect_metrics.py` (a script — NOT a test) against the
     live API, primary worker only. Snapshots the metric catalog into `.artifacts/`
     so the metric-coverage gate analyses a file with no second app boot.
     Best-effort: a failure just means the gate finds no artifact and fails loudly —
     never abort the session for it. Must run while the API is up (called from
-    analytics_api teardown, before proc.stop())."""
+    analytics teardown, before proc.stop())."""
     if not _IS_PRIMARY:
         return
     import subprocess
@@ -231,25 +231,25 @@ def _collect_metrics(proc: AnalyticsApiProcess) -> None:
 
 
 @pytest.fixture(scope="session")
-def analytics_api(ch_migrations_applied: SessionConfig):
-    """Spawn the analytics-api binary baked into the runner image. Its SeaORM
+def analytics(ch_migrations_applied: SessionConfig):
+    """Spawn the analytics binary baked into the runner image. Its SeaORM
     migrations run on startup; we then upsert test-specific metrics from
     seed/metrics.yaml.
 
     If the binary is missing, this is a hard FAIL — identical locally and in CI.
     A skip here would make the whole transformation suite silently green while
     testing nothing. The binary is built FROM ITS OWN Dockerfile and baked into the
-    runner image (see lib.analytics_api.locate_binary); if it isn't there the
+    runner image (see lib.analytics.locate_binary); if it isn't there the
     bronze→API tests cannot run, so the only honest result is red.
     """
     cfg = ch_migrations_applied
-    from lib.analytics_api import ApiSpawnError  # local import to keep top clean
+    from lib.analytics import ApiSpawnError  # local import to keep top clean
     try:
         binary = locate_binary(cfg)
     except ApiSpawnError as e:
-        pytest.fail(f"analytics-api binary not available: {e}", pytrace=False)
+        pytest.fail(f"analytics binary not available: {e}", pytrace=False)
     port = find_free_port()
-    proc = AnalyticsApiProcess(cfg, binary, port)
+    proc = AnalyticsProcess(cfg, binary, port)
     proc.start()
     seed_test_metrics(cfg)
     yield proc
diff --git a/src/ingestion/tests/e2e/lib/analytics_api.py b/src/ingestion/tests/e2e/lib/analytics.py
similarity index 77%
rename from src/ingestion/tests/e2e/lib/analytics_api.py
rename to src/ingestion/tests/e2e/lib/analytics.py
index 3c011c392..3809ec099 100644
--- a/src/ingestion/tests/e2e/lib/analytics_api.py
+++ b/src/ingestion/tests/e2e/lib/analytics.py
@@ -1,10 +1,10 @@
-"""analytics-api binary lifecycle: build, spawn, health-check, terminate.
+"""analytics binary lifecycle: build, spawn, health-check, terminate.
 
 We build once per session (cargo's incremental compile keeps it fast across
 sessions) and spawn the binary directly on the host (per DESIGN §4: a host
 binary keeps target/ warm and avoids container I/O on the cargo hot path).
 
-analytics-api runs auth-disabled (auth happens at the API Gateway, which we
+analytics runs auth-disabled (auth happens at the API Gateway, which we
 bypass), so the gears host injects a default-tenant SecurityContext. `/health`
 is served by the api-gateway host gear (public, off the tenant path). For data
 routes the harness sends `X-Insight-Tenant-Id: config.TEST_TENANT_ID`, which the
@@ -35,7 +35,7 @@
 
 @dataclass(frozen=True)
 class ApiResponse:
-    """Deserialized analytics-api response.
+    """Deserialized analytics response.
 
     For metric-query endpoints the body is `{items: [...], page_info: {...}}`.
     For other endpoints (e.g. /v1/metrics) the body is a bare list — we
@@ -75,31 +75,31 @@ class ApiSpawnError(RuntimeError):
 
 
 def locate_binary(cfg: SessionConfig) -> Path:
-    """Locate the analytics-api binary baked into the runner image.
+    """Locate the analytics binary baked into the runner image.
 
-    The rig no longer compiles analytics-api. The binary is built FROM ITS OWN
-    Dockerfile (`src/backend/services/analytics-api/Dockerfile`, the same one that
+    The rig no longer compiles analytics. The binary is built FROM ITS OWN
+    Dockerfile (`src/backend/services/analytics/Dockerfile`, the same one that
     ships the prod image — no build-recipe duplication) and baked onto PATH at
-    `/usr/local/bin/analytics-api` via docker-compose.runner.yml `additional_contexts`
-    + a Dockerfile.runner `COPY --from=analytics-api …`. Same pattern as the connector
+    `/usr/local/bin/analytics` via docker-compose.runner.yml `additional_contexts`
+    + a Dockerfile.runner `COPY --from=analytics …`. Same pattern as the connector
     enrich binaries (see lib/enrich.py).
 
     Falls back to a PATH lookup and a host-mode cargo target (for running pytest
     directly on the host with a manual `cargo build`), then fails clearly.
     """
     candidates: list[Path] = []
-    which = shutil.which("analytics-api")
+    which = shutil.which("analytics")
     if which:
         candidates.append(Path(which))
-    candidates.append(Path("/usr/local/bin/analytics-api"))  # baked into the runner image
-    candidates.append(cfg.repo_root / "src/backend/target/release/analytics-api")  # host-mode manual build
+    candidates.append(Path("/usr/local/bin/analytics"))  # baked into the runner image
+    candidates.append(cfg.repo_root / "src/backend/target/release/analytics")  # host-mode manual build
     for c in candidates:
         if c.exists():
-            LOG.info("using analytics-api binary at %s", c)
+            LOG.info("using analytics binary at %s", c)
             return c
     raise ApiSpawnError(
-        "analytics-api binary not found — it should be baked into the runner image at "
-        "/usr/local/bin/analytics-api (docker-compose.runner.yml `analytics-api` service "
+        "analytics binary not found — it should be baked into the runner image at "
+        "/usr/local/bin/analytics (docker-compose.runner.yml `analytics` service "
         "+ Dockerfile.runner COPY --from). Rebuild with `./e2e.sh build`."
     )
 
@@ -111,8 +111,8 @@ def find_free_port() -> int:
         return s.getsockname()[1]
 
 
-class AnalyticsApiProcess:
-    """A spawned, health-checked analytics-api process bound to loopback."""
+class AnalyticsProcess:
+    """A spawned, health-checked analytics process bound to loopback."""
 
     def __init__(self, cfg: SessionConfig, binary: Path, port: int):
         self.cfg = cfg
@@ -125,13 +125,13 @@ def __init__(self, cfg: SessionConfig, binary: Path, port: int):
 
     def start(self) -> None:
         env = os.environ.copy()
-        # analytics-api is now a gears-rust host (toolkit::bootstrap::run_server):
+        # analytics is now a gears-rust host (toolkit::bootstrap::run_server):
         # the `api-gateway` system gear is the REST host and structural config
         # (gears list, auth_disabled, resolvers, grpc-hub) lives in the checked-in
         # config file, which we pass with `-c`. Per-run values are injected as
         # `APP__*` env overrides (direct Popen execve preserves the hyphenated
         # gear-name segments, unlike the compose sh entrypoint).
-        config_path = self.cfg.analytics_api_manifest_dir / "config" / "insight.yaml"
+        config_path = self.cfg.analytics_manifest_dir / "config" / "insight.yaml"
         # bind_addr: loopback-only (PRD cpt-bronze-to-api-e2e-constraint-loopback-only).
         # The REST host bind belongs to the api-gateway gear, so override it there.
         bind_addr = f"127.0.0.1:{self.port}"
@@ -141,11 +141,11 @@ def start(self) -> None:
                 # Per-spawn UDS so parallel workers / re-runs don't collide on
                 # the config's fixed grpc-hub socket path.
                 "APP__gears__grpc-hub__config__listen_addr": f"uds:///tmp/analytics-grpc-{self.port}.sock",
-                "APP__gears__analytics_api__config__database_url": self.cfg.mariadb_dsn,
-                "APP__gears__analytics_api__config__clickhouse_url": self.cfg.ch_http_url,
-                "APP__gears__analytics_api__config__clickhouse_database": self.cfg.ch_database,
-                "APP__gears__analytics_api__config__clickhouse_user": self.cfg.ch_user,
-                "APP__gears__analytics_api__config__clickhouse_password": self.cfg.ch_password,
+                "APP__gears__analytics__config__database_url": self.cfg.mariadb_dsn,
+                "APP__gears__analytics__config__clickhouse_url": self.cfg.ch_http_url,
+                "APP__gears__analytics__config__clickhouse_database": self.cfg.ch_database,
+                "APP__gears__analytics__config__clickhouse_user": self.cfg.ch_user,
+                "APP__gears__analytics__config__clickhouse_password": self.cfg.ch_password,
                 # Single-tenant catalog-resolution hint. Under auth_disabled the
                 # host injects DEFAULT_TENANT_ID; the rig additionally sends
                 # `X-Insight-Tenant-Id: TEST_TENANT_ID` on every request, which
@@ -153,12 +153,12 @@ def start(self) -> None:
                 # seed under GLOBAL_TENANT (nil) and stay visible via
                 # `InsightTenantId IN [tenant, nil]`, so this need not match the
                 # seeded bronze tenant.
-                "APP__gears__analytics_api__config__metric_catalog__tenant_default_id": "00000000-0000-0000-0000-000000000001",
+                "APP__gears__analytics__config__metric_catalog__tenant_default_id": "00000000-0000-0000-0000-000000000001",
                 # No identity_url / redis_url — leave config defaults (empty).
                 "RUST_LOG": env.get("RUST_LOG", "info"),
             },
         )
-        LOG.info("spawning analytics-api (gears host) on 127.0.0.1:%d", self.port)
+        LOG.info("spawning analytics (gears host) on 127.0.0.1:%d", self.port)
         self._proc = subprocess.Popen(
             [str(self.binary), "-c", str(config_path), "run"],
             env=env,
@@ -173,12 +173,12 @@ def start(self) -> None:
     def stop(self) -> None:
         if self._proc is None:
             return
-        LOG.info("terminating analytics-api (pid=%d)", self._proc.pid)
+        LOG.info("terminating analytics (pid=%d)", self._proc.pid)
         self._proc.terminate()
         try:
             self._proc.wait(timeout=5)
         except subprocess.TimeoutExpired:
-            LOG.warning("analytics-api did not exit on SIGTERM; killing")
+            LOG.warning("analytics did not exit on SIGTERM; killing")
             self._proc.kill()
             self._proc.wait(timeout=5)
         self._proc = None
@@ -227,7 +227,7 @@ def _wait_healthy(self, *, timeout_s: float) -> None:
             if not self.is_running():
                 stdout = self._proc.stdout.read() if self._proc and self._proc.stdout else ""
                 raise ApiSpawnError(
-                    f"analytics-api exited during startup (code={self._proc.returncode if self._proc else '?'}):\n"
+                    f"analytics exited during startup (code={self._proc.returncode if self._proc else '?'}):\n"
                     f"{stdout[-2000:]}"
                 )
             try:
@@ -238,13 +238,13 @@ def _wait_healthy(self, *, timeout_s: float) -> None:
                 ) as c:
                     r = c.get("/health")
                     if r.status_code == 200:
-                        LOG.info("analytics-api is healthy at %s", self.base_url)
+                        LOG.info("analytics is healthy at %s", self.base_url)
                         return
             except Exception as e:
                 last_err = e
             time.sleep(0.5)
         raise ApiSpawnError(
-            f"analytics-api did not become healthy in {timeout_s}s; last error: {last_err}"
+            f"analytics did not become healthy in {timeout_s}s; last error: {last_err}"
         )
 
 
@@ -253,7 +253,7 @@ def spawn(cfg: SessionConfig):
     """Context manager: build (if needed), spawn, yield, stop."""
     binary = build(cfg)
     port = find_free_port()
-    proc = AnalyticsApiProcess(cfg, binary, port)
+    proc = AnalyticsProcess(cfg, binary, port)
     proc.start()
     try:
         yield proc
diff --git a/src/ingestion/tests/e2e/lib/collect_metrics.py b/src/ingestion/tests/e2e/lib/collect_metrics.py
index 18b5104b1..3f0310903 100755
--- a/src/ingestion/tests/e2e/lib/collect_metrics.py
+++ b/src/ingestion/tests/e2e/lib/collect_metrics.py
@@ -1,8 +1,8 @@
 #!/usr/bin/env python3
-"""Snapshot the metric catalog from a running analytics-api.
+"""Snapshot the metric catalog from a running analytics.
 
 NOT a pytest test — a plain script, run (via subprocess) by conftest's
-`analytics_api` fixture while the suite's analytics-api is up, so the
+`analytics` fixture while the suite's analytics is up, so the
 metric-coverage gate can read a file with no second app boot. Writes
 ``catalog_metrics.json`` (← POST /v1/catalog/get_metrics) into ``--out-dir``.
 
@@ -47,9 +47,9 @@ def collect(base_url: str, out_dir: str | Path, tenant_id: str | None) -> None:
 
 def main(argv: list[str] | None = None) -> int:
     p = argparse.ArgumentParser(
-        description="Snapshot the analytics-api metric catalog for the coverage gate."
+        description="Snapshot the analytics metric catalog for the coverage gate."
     )
-    p.add_argument("--url", required=True, help="analytics-api base URL")
+    p.add_argument("--url", required=True, help="analytics base URL")
     p.add_argument("--out-dir", required=True, help="directory to write the artifact into")
     p.add_argument("--tenant", help="X-Insight-Tenant-Id header (the catalog read is tenant-gated)")
     args = p.parse_args(argv)
diff --git a/src/ingestion/tests/e2e/lib/config.py b/src/ingestion/tests/e2e/lib/config.py
index 35c42f7b9..c4fc25afe 100644
--- a/src/ingestion/tests/e2e/lib/config.py
+++ b/src/ingestion/tests/e2e/lib/config.py
@@ -20,11 +20,11 @@
 _REPO_ROOT = Path(__file__).resolve().parents[5]
 
 
-# Header analytics-api's tenant middleware reads to resolve the request tenant
+# Header the analytics service's tenant middleware reads to resolve the request tenant
 # (auth.rs::TENANT_HEADER). The harness sends it on EVERY request.
 TENANT_HEADER = "X-Insight-Tenant-Id"
 
-# Session tenant for the whole e2e run. analytics-api's tenant middleware
+# Session tenant for the whole e2e run. The analytics service's tenant middleware
 # rejects the nil UUID (a non-identity value must not pin tenant context), so
 # the harness cannot use 0000…0. Instead it seeds metric definitions under this
 # non-nil tenant and sends it as `X-Insight-Tenant-Id` on every request. The
@@ -58,7 +58,7 @@ class SessionConfig:
     compose_dir: Path
     migrations_dir: Path
     dbt_project_dir: Path
-    analytics_api_manifest_dir: Path
+    analytics_manifest_dir: Path
 
     # Runtime mode (where pytest runs relative to CH/MariaDB)
     run_mode: str = "host"  # "host" | "docker"
@@ -91,7 +91,7 @@ def from_env(cls) -> "SessionConfig":
                 compose_dir=repo_root / "src/ingestion/tests/e2e/compose",
                 migrations_dir=repo_root / "src/ingestion/scripts/migrations",
                 dbt_project_dir=repo_root / "src/ingestion/dbt",
-                analytics_api_manifest_dir=repo_root / "src/backend/services/analytics-api",
+                analytics_manifest_dir=repo_root / "src/backend/services/analytics",
                 run_mode="docker",
                 ch_host=os.environ.get("E2E_CH_HOST", "clickhouse"),
                 ch_http_port=int(os.environ.get("E2E_CH_HTTP_PORT", 8123)),
@@ -110,7 +110,7 @@ def from_env(cls) -> "SessionConfig":
             compose_dir=repo_root / "src/ingestion/tests/e2e/compose",
             migrations_dir=repo_root / "src/ingestion/scripts/migrations",
             dbt_project_dir=repo_root / "src/ingestion/dbt",
-            analytics_api_manifest_dir=repo_root / "src/backend/services/analytics-api",
+            analytics_manifest_dir=repo_root / "src/backend/services/analytics",
             ch_http_port=int(os.environ.get("E2E_CH_HTTP_PORT", 30523)),
             ch_native_port=int(os.environ.get("E2E_CH_NATIVE_PORT", 30529)),
             mariadb_port=int(os.environ.get("E2E_MARIADB_PORT", 30506)),
@@ -122,7 +122,7 @@ def ch_http_url(self) -> str:
 
     @property
     def mariadb_dsn(self) -> str:
-        """SeaORM / SQLAlchemy-style URL for analytics-api."""
+        """SeaORM / SQLAlchemy-style URL for analytics."""
         return (
             f"mysql://{self.mariadb_user}:{self.mariadb_password}"
             f"@{self.mariadb_host}:{self.mariadb_port}/{self.mariadb_database}"
diff --git a/src/ingestion/tests/e2e/lib/mariadb.py b/src/ingestion/tests/e2e/lib/mariadb.py
index fa748c776..16c64ed6b 100644
--- a/src/ingestion/tests/e2e/lib/mariadb.py
+++ b/src/ingestion/tests/e2e/lib/mariadb.py
@@ -1,7 +1,7 @@
 """MariaDB connection helper.
 
 Used to verify MariaDB readiness in smoke tests and (later) inspect/seed the
-`metrics` table that analytics-api consumes.
+`metrics` table that analytics consumes.
 """
 
 from __future__ import annotations
diff --git a/src/ingestion/tests/e2e/lib/metric_coverage.py b/src/ingestion/tests/e2e/lib/metric_coverage.py
index 8d185bb37..324c9b66c 100644
--- a/src/ingestion/tests/e2e/lib/metric_coverage.py
+++ b/src/ingestion/tests/e2e/lib/metric_coverage.py
@@ -1,8 +1,8 @@
 """Metric-coverage gate: every metric_key the catalog exposes has its value tested.
 
 Cross-checks, **by metric_key**, the metric universe — read over HTTP from a
-running analytics-api (`POST /v1/catalog/get_metrics`: the enabled product
-metric_keys, each a `<storage_table>.<column>` seeded by the analytics-api
+running analytics (`POST /v1/catalog/get_metrics`: the enabled product
+metric_keys, each a `<storage_table>.<column>` seeded by the analytics
 migrations) — against the metric_keys whose VALUE the tests assert
 (`find: {metric_key: …}` paired with `equal`/`assert` in the same rule). Binary
 verdict per metric_key:
@@ -20,11 +20,11 @@
 truth, no side-car file). Kept honest: a STALE entry (key no longer in the
 catalog) or a REDUNDANT one (now value-tested) also fails. PASS iff no FAILs.
 
-This module never spawns analytics-api. CI: the `metric-coverage-gate` job reads
+This module never spawns analytics. CI: the `metric-coverage-gate` job reads
 the universe from `--universe-file catalog_metrics.json` — the artifact the e2e
 run collects (lib/collect_metrics.py) — so no app boot. Locally:
 `./e2e.sh test` then `./e2e.sh gates`. Ad hoc against a running API:
-`ANALYTICS_API_URL=http://… python3 lib/metric_coverage.py [--md]`.
+`ANALYTICS_URL=http://… python3 lib/metric_coverage.py [--md]`.
 """
 
 from __future__ import annotations
@@ -159,7 +159,7 @@ def universe_from_url(base_url: str, tenant_id: str = DEFAULT_TENANT_ID) -> dict
 def universe_from_file(path: str | Path) -> dict[str, str]:
     """`{metric_key: label}` from a saved `POST /v1/catalog/get_metrics` response
     — the `catalog_metrics.json` artifact the e2e run collects. Lets the CI gate
-    analyse the universe from a file without booting analytics-api.
+    analyse the universe from a file without booting analytics.
     """
     return _universe_from_body(json.loads(Path(path).read_text(encoding="utf-8")))
 
@@ -418,26 +418,26 @@ def main(argv: list[str] | None = None) -> int:
 
     Two universe sources:
       --universe-file <catalog_metrics.json>  the artifact the e2e run collects
-                                               (CI gate — no analytics-api boot)
-      else $ANALYTICS_API_URL                  fetch live (local standalone runs)
-    This module never spawns analytics-api itself.
+                                               (CI gate — no analytics boot)
+      else $ANALYTICS_URL                  fetch live (local standalone runs)
+    This module never spawns analytics itself.
     """
     p = argparse.ArgumentParser(description="Metric-coverage gate (by metric_key).")
     p.add_argument(
         "--universe-file",
         help="catalog_metrics.json (a saved POST /v1/catalog/get_metrics response); "
-        "default: fetch from $ANALYTICS_API_URL",
+        "default: fetch from $ANALYTICS_URL",
     )
     args = p.parse_args(argv)
 
     if args.universe_file:
         universe = universe_from_file(args.universe_file)
     else:
-        url = os.environ.get("ANALYTICS_API_URL")
+        url = os.environ.get("ANALYTICS_URL")
         if not url:
             print(
                 "metric coverage: pass --universe-file <catalog_metrics.json> or set "
-                "ANALYTICS_API_URL to a running analytics-api.",
+                "ANALYTICS_URL to a running analytics.",
                 file=sys.stderr,
             )
             return 2
diff --git a/src/ingestion/tests/e2e/lib/metric_seed.py b/src/ingestion/tests/e2e/lib/metric_seed.py
index 4374d4292..23c4ca8c0 100644
--- a/src/ingestion/tests/e2e/lib/metric_seed.py
+++ b/src/ingestion/tests/e2e/lib/metric_seed.py
@@ -1,6 +1,6 @@
 """Seed test-specific metric definitions into MariaDB.
 
-Runs AFTER the analytics-api binary's SeaORM auto-migrations populate prod
+Runs AFTER the analytics binary's SeaORM auto-migrations populate prod
 metrics. Reads `seed/metrics.yaml` and upserts each entry into the `metrics`
 table. Idempotent — re-runs replace existing rows by id.
 
@@ -22,7 +22,7 @@
 
 LOG = logging.getLogger("e2e.metric_seed")
 
-# All e2e metric definitions live under TEST_TENANT_ID. The analytics-api tenant
+# All e2e metric definitions live under TEST_TENANT_ID. The analytics tenant
 # middleware rejects the nil UUID, and `find_enabled_metric` filters the
 # `metrics` table by tenant, so both the prod metrics seeded by the binary's
 # migrations (under the nil tenant) and our overrides must sit under the tenant
@@ -36,7 +36,7 @@
 def seed_test_metrics(cfg: SessionConfig, seed_path: Path | None = None) -> int:
     """Align MariaDB.metrics with the e2e tenant, then upsert seed overrides.
 
-    Runs after the analytics-api binary's SeaORM migrations have seeded the prod
+    Runs after the analytics binary's SeaORM migrations have seeded the prod
     metric catalog (under the nil tenant). Returns the number of override rows.
     """
     seed_path = seed_path or (cfg.repo_root / "src/ingestion/tests/e2e/seed/metrics.yaml")
diff --git a/src/ingestion/tests/e2e/metrics/test_fixtures.py b/src/ingestion/tests/e2e/metrics/test_fixtures.py
index e83c1e35f..e9317a987 100644
--- a/src/ingestion/tests/e2e/metrics/test_fixtures.py
+++ b/src/ingestion/tests/e2e/metrics/test_fixtures.py
@@ -20,7 +20,7 @@
 
 import pytest
 
-from lib.analytics_api import AnalyticsApiProcess
+from lib.analytics import AnalyticsProcess
 from lib.ch_seeder import CHSeeder
 from lib.dbt_runner import DbtRunner
 from lib.enrich import EnrichRunner
@@ -38,7 +38,7 @@ def test_metric_smoke(
     ch_seeder: CHSeeder,
     dbt_runner: DbtRunner,
     enrich_runner: EnrichRunner,
-    analytics_api: AnalyticsApiProcess,
+    analytics: AnalyticsProcess,
     worker_ctx: WorkerContext,
 ) -> None:
     # 1. Clear what the prior test wrote (no-op on the first test).
@@ -112,7 +112,7 @@ def test_metric_smoke(
 
     # 5. Run each case's batch request and evaluate its expect rules.
     for case in test_yaml.cases:
-        status, payload = analytics_api.call_request(case["request"])
+        status, payload = analytics.call_request(case["request"])
         if status != 200:
             LOG.warning("HTTP %d; body: %r", status, payload)
         evaluate_case(case, payload, status)
diff --git a/src/ingestion/tests/e2e/seed/metrics.yaml b/src/ingestion/tests/e2e/seed/metrics.yaml
index 968886908..88f316d1c 100644
--- a/src/ingestion/tests/e2e/seed/metrics.yaml
+++ b/src/ingestion/tests/e2e/seed/metrics.yaml
@@ -1,12 +1,12 @@
 # Test-specific metric overrides.
 #
-# Inserted into MariaDB.metrics AFTER the analytics-api binary's SeaORM
+# Inserted into MariaDB.metrics AFTER the analytics binary's SeaORM
 # auto-migrations seed prod metrics. Use these for fixtures that need a
 # narrow metric not in the prod catalog (e.g. a direct read of insight.people
 # without the heavier joins of "Team Members").
 #
 # Each row is inserted under config.TEST_TENANT_ID — the tenant the harness
-# sends as X-Insight-Tenant-Id on every request (the analytics-api tenant
+# sends as X-Insight-Tenant-Id on every request (the analytics tenant
 # middleware rejects nil/absent tenants, see lib/metric_seed.py).
 
 overrides: []