diff --git a/apps/ai/src/mcp/lib/map-warehouse-error.test.ts b/apps/ai/src/mcp/lib/map-warehouse-error.test.ts
index ff56febe66..c2da9cbbe8 100644
--- a/apps/ai/src/mcp/lib/map-warehouse-error.test.ts
+++ b/apps/ai/src/mcp/lib/map-warehouse-error.test.ts
@@ -1,5 +1,10 @@
 import { describe, expect, it } from "vitest"
 import { WarehouseQueryError, WarehouseResultDecodeError, WarehouseSchemaDriftError } from "@maple/domain"
+import {
+	GcpLiveQueryFailedError,
+	GcpLiveQueryRejectedError,
+	GcpLiveQueryUnavailableError,
+} from "@maple/domain/http/gcp-live-query-errors"
 import { toMcpQueryError } from "./map-warehouse-error"
 
 describe("toMcpQueryError", () => {
@@ -37,4 +42,39 @@ describe("toMcpQueryError", () => {
 		expect(mcp.message).toBe("row did not decode")
 		expect(mcp.message).not.toContain("schema apply")
 	})
+
+	it("makes a query Google refused the caller's to fix", () => {
+		const err = new GcpLiveQueryRejectedError({
+			message: "The query reaches 34 projects; filter on project_id",
+			reason: "too_many_projects",
+		})
+		const mcp = toMcpQueryError("query_data")(err)
+		expect(mcp._tag).toBe("@maple/mcp/errors/McpInvalidInputError")
+		expect(mcp.message).toBe("The query reaches 34 projects; filter on project_id")
+	})
+
+	it("reports Google Cloud metrics as unavailable when no connection reads them", () => {
+		const err = new GcpLiveQueryUnavailableError({
+			message: "No Google Cloud connection has metrics on.",
+		})
+		const mcp = toMcpQueryError("query_data")(err)
+		expect(mcp).toMatchObject({
+			_tag: "@maple/mcp/errors/McpUnavailableError",
+			message: "No Google Cloud connection has metrics on.",
+			capability: "google_cloud_metrics",
+		})
+	})
+
+	it("asks for a retry when Google did not answer", () => {
+		const err = new GcpLiveQueryFailedError({
+			message: "Google Cloud could not be read.",
+			failures: [{ scope: "projects/acme", message: "503" }],
+		})
+		const mcp = toMcpQueryError("query_data")(err)
+		expect(mcp).toMatchObject({
+			_tag: "@maple/mcp/errors/McpNotReadyError",
+			message: "Google Cloud could not be read.",
+			retryAfterSeconds: 60,
+		})
+	})
 })
diff --git a/apps/ai/src/mcp/lib/map-warehouse-error.ts b/apps/ai/src/mcp/lib/map-warehouse-error.ts
index d2f8cbd4cc..68cd049628 100644
--- a/apps/ai/src/mcp/lib/map-warehouse-error.ts
+++ b/apps/ai/src/mcp/lib/map-warehouse-error.ts
@@ -1,10 +1,25 @@
 import { Effect } from "effect"
-import { type WarehouseError, WarehouseQuotaExceededError, WarehouseSchemaDriftError } from "@maple/domain"
+import {
+	type WarehouseError,
+	type WarehouseQuotaExceededError,
+	WarehouseSchemaDriftError,
+} from "@maple/domain"
 import {
 	warehouseHandlers,
 	warehouseReadHandlers,
 } from "@maple/backend/services/warehouse/warehouse-error-handlers"
-import { McpQueryBudgetError, McpQueryError } from "../tools/types"
+import type {
+	GcpLiveQueryFailedError,
+	GcpLiveQueryRejectedError,
+	GcpLiveQueryUnavailableError,
+} from "@maple/domain/http/gcp-live-query-errors"
+import {
+	McpInvalidInputError,
+	McpNotReadyError,
+	McpQueryBudgetError,
+	McpQueryError,
+	McpUnavailableError,
+} from "../tools/types"
 
 export { warehouseHandlers, warehouseReadHandlers }
 
@@ -33,23 +48,55 @@ const BUDGET_GUIDANCE = {
 	max_threads: "The query needed more parallelism than it is allowed. Scan less data.",
 } satisfies Record<WarehouseQuotaExceededError["setting"], string>
 
+/** Seconds the model waits before asking Google again. */
+const GCP_RETRY_AFTER_SECONDS = 60
+
+/** The MCP error a warehouse error becomes, per member, so reads that cannot reach Google keep a narrow type. */
+type McpErrorFor<E> = E extends GcpLiveQueryRejectedError
+	? McpInvalidInputError
+	: E extends GcpLiveQueryUnavailableError
+		? McpUnavailableError
+		: E extends GcpLiveQueryFailedError
+			? McpNotReadyError
+			: McpQueryError | McpQueryBudgetError
+
+const toMcpError = (pipe: string, error: WarehouseError) => {
+	switch (error._tag) {
+		case "@maple/http/errors/GcpLiveQueryRejectedError":
+			return new McpInvalidInputError({ message: error.message })
+		case "@maple/http/errors/GcpLiveQueryUnavailableError":
+			return new McpUnavailableError({ message: error.message, capability: "google_cloud_metrics" })
+		case "@maple/http/errors/GcpLiveQueryFailedError":
+			return new McpNotReadyError({
+				message: error.message,
+				retryAfterSeconds: GCP_RETRY_AFTER_SECONDS,
+			})
+		case "@maple/http/errors/WarehouseQuotaExceededError":
+			return new McpQueryBudgetError({
+				message: BUDGET_GUIDANCE[error.setting],
+				pipeName: pipe,
+				setting: error.setting,
+			})
+		default:
+			return new McpQueryError({ message: warehouseErrorText(error), pipeName: pipe, cause: error })
+	}
+}
+
 /**
  * Curry the pipe label so call sites read as
  * `Effect.mapError(toMcpQueryError("service_overview"))`.
  *
  * A budget breach gets its own error with guidance: the raw text is the vendor's ("Upgrade your
- * plan for higher capacity"), which no model can act on.
+ * plan for higher capacity"), which no model can act on. A metrics read answered live by Google
+ * fails like the tool's other dependencies: a refused query is the caller's to fix, no connection
+ * or one Google refuses (a missing role, API or billing account) is unavailable, and Google not
+ * answering is worth a retry.
  */
 export const toMcpQueryError =
 	(pipe: string) =>
-	(error: WarehouseError): McpQueryError | McpQueryBudgetError =>
-		error instanceof WarehouseQuotaExceededError
-			? new McpQueryBudgetError({
-					message: BUDGET_GUIDANCE[error.setting],
-					pipeName: pipe,
-					setting: error.setting,
-				})
-			: new McpQueryError({ message: warehouseErrorText(error), pipeName: pipe, cause: error })
+	<E extends WarehouseError>(error: E): McpErrorFor<E> =>
+		// TypeScript cannot narrow a conditional return type through the switch.
+		toMcpError(pipe, error) as McpErrorFor<E>
 
 /**
  * `Effect.catchTags` handler map that converts every warehouse error tag into an
diff --git a/apps/ai/src/mcp/tools/list-metrics.ts b/apps/ai/src/mcp/tools/list-metrics.ts
index 4869f576cd..405a252aa5 100644
--- a/apps/ai/src/mcp/tools/list-metrics.ts
+++ b/apps/ai/src/mcp/tools/list-metrics.ts
@@ -7,6 +7,8 @@ import { doc } from "../lib/tool-doc"
 import { Effect, Schema } from "effect"
 import { ListMetricsOutput } from "@maple/domain/mcp-outputs"
 import { MetricType } from "@maple/query-engine"
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
+import { QueryEngineService } from "@maple/backend/services/warehouse/QueryEngineService"
 
 const WINDOW = P.timeWindow({ defaultHours: 6, maxHours: MCP_DISCOVERY_MAX_HOURS })
 
@@ -30,7 +32,8 @@ export function registerListMetricsTool(server: McpToolRegistrar) {
 		name: "list_metrics",
 		title: "List Metrics",
 		description:
-			"Discover custom metrics with their type, unit, monotonicity and data volume. Pass a discovered `metric_name` and `metric_type` to query_data source=metrics.",
+			"Discover custom metrics with their type, unit, monotonicity and data volume. Pass a discovered `metric_name` and `metric_type` to query_data source=metrics. " +
+			"Google Cloud Monitoring metrics with data in the last day are listed too, under service `Google Cloud`, in the room the first page leaves (search e.g. `cloudsql.googleapis.com` to find them), and are read live from Google.",
 		parameters: Schema.Struct({
 			...WINDOW.fields,
 			service: P.service(),
@@ -46,6 +49,7 @@ export function registerListMetricsTool(server: McpToolRegistrar) {
 		handler: Effect.fn("McpTool.listMetrics")(function* (params) {
 			const { st, et } = yield* WINDOW.resolve(params, "list_metrics")
 			const tenant = yield* CurrentMcpTenant
+			const queryEngine = yield* QueryEngineService
 			yield* Effect.annotateCurrentSpan({
 				orgId: tenant.orgId,
 				"maple.ai.service": params.service ?? "all",
@@ -54,7 +58,7 @@ export function registerListMetricsTool(server: McpToolRegistrar) {
 				"maple.ai.offset": params.offset,
 			})
 
-			const [metricsResult, summaryResult] = yield* Effect.all(
+			const [metricsResult, summaryResult, gcpMetrics] = yield* Effect.all(
 				[
 					queryWarehouse<MetricListRow>("list_metrics", {
 						start_time: st,
@@ -70,21 +74,32 @@ export function registerListMetricsTool(server: McpToolRegistrar) {
 						end_time: et,
 						service: params.service,
 					}),
+					queryEngine.listGcpMetrics(tenant, {
+						service: params.service,
+						metricType: params.metric_type,
+						search: params.search,
+						limit: params.limit,
+						offset: params.offset,
+					}),
 				],
 				{ concurrency: "unbounded" },
 			)
 
-			const metrics = metricsResult.data
+			// Google rows fill what the first page leaves free; paging counts the warehouse's alone.
+			const hasMore = metricsResult.data.length === params.limit
+			const metrics: ReadonlyArray<MetricListRow> = [
+				...metricsResult.data,
+				...gcpMetrics.slice(0, Math.max(0, params.limit - metricsResult.data.length)),
+			]
 			yield* Effect.annotateCurrentSpan("result.rowCount", metrics.length)
 
-			const hasMore = metrics.length === params.limit
 			return {
 				timeRange: { start: st, end: et },
 				pagination: {
 					offset: params.offset,
 					limit: params.limit,
 					hasMore,
-					...(hasMore ? { nextOffset: params.offset + metrics.length } : undefined),
+					...(hasMore ? { nextOffset: params.offset + metricsResult.data.length } : undefined),
 				},
 				summary: summaryResult.data.map((s) => ({
 					metricType: s.metricType,
@@ -164,7 +179,9 @@ export function registerListMetricsTool(server: McpToolRegistrar) {
 										m.isMonotonic ? "yes" : "-",
 										m.serviceName,
 										m.metricUnit || "-",
-										formatNumber(m.dataPointCount),
+										isGcpMetricType(m.metricName)
+											? "live"
+											: formatNumber(m.dataPointCount),
 									]),
 								),
 							]),
diff --git a/apps/ai/src/mcp/tools/query-data.ts b/apps/ai/src/mcp/tools/query-data.ts
index 1a7c4a8975..85713d6e3c 100644
--- a/apps/ai/src/mcp/tools/query-data.ts
+++ b/apps/ai/src/mcp/tools/query-data.ts
@@ -98,7 +98,9 @@ type Params = typeof queryDataSchema.Type
 const queryDataDescription =
 	"Aggregate traces, logs, metrics or product events into a timeseries or a top-N breakdown. " +
 	"Start here for trends, comparisons and top-N; for errors prefer find_errors and error_detail; " +
-	"for a shape this tool cannot express, run_sql. Applied defaults are listed in the result."
+	"for a shape this tool cannot express, run_sql. Applied defaults are listed in the result. " +
+	"A Google Cloud Monitoring metric type (e.g. cloudsql.googleapis.com/database/cpu/utilization) works as metric_name and is read live from Google; " +
+	"it has no service, so filter and group by its labels with attribute_key (e.g. database_id, project_id, monitored_resource)."
 
 /** Default metric/group_by per source, as `[default, available]` for the decisions list. */
 const DEFAULT_METRIC = {
diff --git a/apps/ai/src/worker.ts b/apps/ai/src/worker.ts
index 9f3b00b65c..f0ca909e9e 100644
--- a/apps/ai/src/worker.ts
+++ b/apps/ai/src/worker.ts
@@ -62,6 +62,8 @@ const configuredEnv = ({ stage, region, domains, profile }: MapleStackContext) =
 		// The source and sandbox tools resolve repositories through the GitHub App, so
 		// they need its reader credentials here too, not only on api.
 		githubAppSourceEnv,
+		// Tools that query Google Cloud metrics read them live; unset leaves them unavailable.
+		optionalSecret("MAPLE_GCP_SERVICE_ACCOUNT_KEY"),
 		// Required wherever a sandbox Worker deploys: without it every sandbox call is refused.
 		...(profile.deploys.sandbox ? [requireSecretEntry("SANDBOX_INTERNAL_SERVICE_TOKEN")] : []),
 		// Dev-only escape hatch from per-org BYO rows (see apps/api/src/resources/env.ts).
diff --git a/apps/api/src/resources/env.ts b/apps/api/src/resources/env.ts
index 0fff70d331..6cb1f45604 100644
--- a/apps/api/src/resources/env.ts
+++ b/apps/api/src/resources/env.ts
@@ -82,4 +82,6 @@ export const apiConfiguredEnv = (stage: MapleStage, region: MapleRegion, domains
 		cloudflareOAuthEnv,
 		planetScaleOAuthEnv,
 		optionalPlain("MAPLE_GCP_SERVICE_ACCOUNT_EMAIL"),
+		// Sign-in for live Google Cloud metrics queries; unset leaves them unavailable.
+		optionalSecret("MAPLE_GCP_SERVICE_ACCOUNT_KEY"),
 	)
diff --git a/apps/api/src/routes/internal/query-engine.http.ts b/apps/api/src/routes/internal/query-engine.http.ts
index 4a4ea9a544..1761c0f48a 100644
--- a/apps/api/src/routes/internal/query-engine.http.ts
+++ b/apps/api/src/routes/internal/query-engine.http.ts
@@ -1484,8 +1484,15 @@ export const HttpQueryEngineLive = HttpApiBuilder.group(MapleInternalApi, "query
 				.handle("listMetrics", ({ payload }) =>
 					Effect.gen(function* () {
 						const tenant = yield* CurrentTenant.Context
-						const rows = yield* runQuery(Queries.listMetrics, tenant, payload)
-						return new ListMetricsResponse({ data: rows })
+						const [rows, gcpRows] = yield* Effect.all(
+							[
+								runQuery(Queries.listMetrics, tenant, payload),
+								queryEngine.listGcpMetrics(tenant, payload),
+							],
+							{ concurrency: "unbounded" },
+						)
+						// One page of `limit`: the table reads `limit + 1` rows to tell whether more exist.
+						return new ListMetricsResponse({ data: [...rows, ...gcpRows].slice(0, payload.limit ?? 100) })
 					}),
 				)
 				.handle("metricsSummary", ({ payload }) =>
diff --git a/apps/api/src/routes/v2/alchemy-provider.integration.test.ts b/apps/api/src/routes/v2/alchemy-provider.integration.test.ts
index 5c918828b8..13bc9be0a1 100644
--- a/apps/api/src/routes/v2/alchemy-provider.integration.test.ts
+++ b/apps/api/src/routes/v2/alchemy-provider.integration.test.ts
@@ -50,6 +50,7 @@ import { HazelOAuthService } from "@maple/backend/services/auth/HazelOAuthServic
 import { OrgClickHouseSettingsService } from "@maple/backend/services/org/OrgClickHouseSettingsService"
 import { OrgMembersService } from "@maple/backend/services/org/OrgMembersService"
 import { QueryEngineService } from "@maple/backend/services/warehouse/QueryEngineService"
+import { GcpLiveMetricsService } from "@maple/backend/services/integrations/GcpLiveMetricsService"
 import { V2TransportErrorBoundaryLive } from "./error-envelope"
 import {
 	AllV2GroupLayersLive,
@@ -105,6 +106,7 @@ const makeHarness = () => {
 	const edgeCacheLive = EdgeCacheService.layer.pipe(Layer.provide(CacheBackendLive))
 	const bucketCacheLive = BucketCacheService.layer.pipe(Layer.provide(edgeCacheLive))
 	const queryEngineLive = Layer.effect(QueryEngineService, QueryEngineService.make).pipe(
+		Layer.provide(Layer.mock(GcpLiveMetricsService, {})),
 		Layer.provide(warehouseLive),
 		Layer.provide(edgeCacheLive),
 		Layer.provide(bucketCacheLive),
diff --git a/apps/api/src/routes/v2/alerts.http.test.ts b/apps/api/src/routes/v2/alerts.http.test.ts
index b209b53cb4..d86f8c9c78 100644
--- a/apps/api/src/routes/v2/alerts.http.test.ts
+++ b/apps/api/src/routes/v2/alerts.http.test.ts
@@ -36,6 +36,7 @@ import { HazelOAuthService, type HazelOAuthServiceApi } from "@maple/backend/ser
 import { OrgClickHouseSettingsService } from "@maple/backend/services/org/OrgClickHouseSettingsService"
 import { OrgMembersService, type OrgMembersServiceApi } from "@maple/backend/services/org/OrgMembersService"
 import { QueryEngineService } from "@maple/backend/services/warehouse/QueryEngineService"
+import { GcpLiveMetricsService } from "@maple/backend/services/integrations/GcpLiveMetricsService"
 import { V2TransportErrorBoundaryLive } from "./error-envelope"
 import {
 	AllV2GroupLayersLive,
@@ -89,6 +90,7 @@ const makeHarness = (
 	const edgeCacheLive = EdgeCacheService.layer.pipe(Layer.provide(CacheBackendLive))
 	const bucketCacheLive = BucketCacheService.layer.pipe(Layer.provide(edgeCacheLive))
 	const queryEngineLive = Layer.effect(QueryEngineService, QueryEngineService.make).pipe(
+		Layer.provide(Layer.mock(GcpLiveMetricsService, {})),
 		Layer.provide(warehouseLive),
 		Layer.provide(edgeCacheLive),
 		Layer.provide(bucketCacheLive),
diff --git a/apps/api/src/routes/v2/telemetry.http.test.ts b/apps/api/src/routes/v2/telemetry.http.test.ts
index 9dbce10cb0..d2d44d7609 100644
--- a/apps/api/src/routes/v2/telemetry.http.test.ts
+++ b/apps/api/src/routes/v2/telemetry.http.test.ts
@@ -2,7 +2,7 @@ import { afterEach, describe, expect, it } from "@effect/vitest"
 import { OrgId, UserId, WarehouseQueryError } from "@maple/domain/http"
 import { MapleApiV2 } from "@maple/domain/http/v2"
 import { QueryEngineExecuteResponse, type QueryEngineExecuteRequest } from "@maple/query-engine"
-import { ConfigProvider, Context, Effect, Layer, ManagedRuntime, Option, Schema } from "effect"
+import { ConfigProvider, Context, DateTime, Effect, Layer, ManagedRuntime, Option, Schema } from "effect"
 import { HttpRouter } from "effect/http"
 import { HttpApiBuilder } from "effect/http-api"
 import { Env } from "@maple/backend/platform/Env"
@@ -296,6 +296,7 @@ const queryEngineStub = {
 	evaluate: () => Effect.die(new Error("not used")),
 	evaluateSeries: () => Effect.die(new Error("not used")),
 	cachedDirect: (_tenant, _route, _payload, effect) => effect,
+	listGcpMetrics: () => Effect.succeed([]),
 } satisfies QueryEngineServiceApi
 
 const makeHarness = (
@@ -697,6 +698,39 @@ describe("v2 telemetry reads over HTTP", () => {
 		await harness.dispose()
 	})
 
+	it("leaves Google Cloud metrics out of /v2/metrics, so its pages stay the warehouse's", async () => {
+		let gcpReads = 0
+		const queryEngine: QueryEngineServiceApi = {
+			...queryEngineStub,
+			listGcpMetrics: () => {
+				gcpReads += 1
+				return Effect.succeed([
+					{
+						metricName: "cloudsql.googleapis.com/database/cpu/utilization",
+						metricType: "gauge",
+						serviceName: "Google Cloud",
+						metricDescription: "CPU utilization",
+						metricUnit: "10^2.%",
+						dataPointCount: 0,
+						firstSeen: DateTime.makeUnsafe("2026-07-14T11:00:00Z"),
+						lastSeen: DateTime.makeUnsafe("2026-07-15T12:00:00Z"),
+						isMonotonic: 0,
+					},
+				])
+			},
+		}
+		const harness = makeHarness(warehouseStub, queryEngine)
+		const key = await harness.bootstrapKey()
+
+		const metrics = await harness.request("GET", `/v2/metrics?${windowQuery}&search=cpu`, key.secret)
+		expect(metrics.status).toBe(200)
+		expect(metrics.body.data.map((metric: { name: string }) => metric.name)).toEqual([
+			"http.server.duration",
+		])
+		expect(gcpReads).toBe(0)
+		await harness.dispose()
+	})
+
 	// Regression: timeseries and breakdowns read the hourly rollups whenever the
 	// filters allow, and those floor their bounds through `toDateTime` or compare
 	// them against plain `DateTime` columns. Millisecond bounds made every
diff --git a/apps/api/src/routes/v2/v2-test-support.ts b/apps/api/src/routes/v2/v2-test-support.ts
index 7d8fb098df..8779d7da38 100644
--- a/apps/api/src/routes/v2/v2-test-support.ts
+++ b/apps/api/src/routes/v2/v2-test-support.ts
@@ -326,6 +326,7 @@ export const TelemetryServiceStubsLayer = Layer.mergeAll(
 		evaluate: die,
 		evaluateSeries: die,
 		cachedDirect: die,
+		listGcpMetrics: die,
 	}),
 )
 
diff --git a/apps/api/src/routes/v2/widget-summary.http.test.ts b/apps/api/src/routes/v2/widget-summary.http.test.ts
index 754ffe64fc..a7bd331428 100644
--- a/apps/api/src/routes/v2/widget-summary.http.test.ts
+++ b/apps/api/src/routes/v2/widget-summary.http.test.ts
@@ -128,6 +128,7 @@ const queryEngineStub = (execute: QueryEngineServiceApi["execute"]): QueryEngine
 	evaluate: () => Effect.die(new Error("not used")),
 	evaluateSeries: () => Effect.die(new Error("not used")),
 	cachedDirect: (_tenant, _route, _payload, effect) => effect,
+	listGcpMetrics: () => Effect.die(new Error("not used")),
 })
 
 /** Grouped requests carry a `service` group-by; the ungrouped one does not. */
diff --git a/apps/ios/Packages/MapleAPI/Sources/MapleAPI/openapi.json b/apps/ios/Packages/MapleAPI/Sources/MapleAPI/openapi.json
index 13bba03ae8..05cfd529eb 100644
--- a/apps/ios/Packages/MapleAPI/Sources/MapleAPI/openapi.json
+++ b/apps/ios/Packages/MapleAPI/Sources/MapleAPI/openapi.json
@@ -5108,7 +5108,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -5140,6 +5140,16 @@
             },
             "description": "The @maple/http/anomalies/AnomalyIncidentNotFoundError failure. HTTP 404."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -5185,7 +5195,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -5260,7 +5270,7 @@
                 }
               }
             },
-            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -5282,6 +5292,16 @@
             },
             "description": "The @maple/http/v2/InsufficientScopeError failure. HTTP 403. | The @maple/http/v2/OrganizationAccessDeniedError failure. HTTP 403."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -5327,7 +5347,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -5541,7 +5561,7 @@
                 }
               }
             },
-            "description": "The @maple/http/v2/CursorInvalidError failure. HTTP 400. | The @maple/http/v2/CursorSortMismatchError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/v2/CursorInvalidError failure. HTTP 400. | The @maple/http/v2/CursorSortMismatchError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -5563,6 +5583,16 @@
             },
             "description": "The @maple/http/v2/InsufficientScopeError failure. HTTP 403. | The @maple/http/v2/OrganizationAccessDeniedError failure. HTTP 403."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -5608,7 +5638,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -5822,7 +5852,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -5854,6 +5884,16 @@
             },
             "description": "The @maple/http/errors/ErrorIssueNotFoundError failure. HTTP 404."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -5899,7 +5939,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -6712,7 +6752,7 @@
                 }
               }
             },
-            "description": "The @maple/http/v2/ParameterInvalidError failure. HTTP 400. | The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/v2/ParameterInvalidError failure. HTTP 400. | The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -6734,6 +6774,16 @@
             },
             "description": "The @maple/http/v2/InsufficientScopeError failure. HTTP 403. | The @maple/http/v2/OrganizationAccessDeniedError failure. HTTP 403."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -6779,7 +6829,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -6862,7 +6912,7 @@
                 }
               }
             },
-            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -6894,6 +6944,16 @@
             },
             "description": "The @maple/http/v2/ServiceNotFoundError failure. HTTP 404."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -6939,7 +6999,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -7039,7 +7099,7 @@
                 }
               }
             },
-            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/v2/TelemetryBucketCountTooLargeError failure. HTTP 400. | The @maple/http/v2/TraceQueryInvalidError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/QueryEngineValidationError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/v2/TelemetryBucketCountTooLargeError failure. HTTP 400. | The @maple/http/v2/TraceQueryInvalidError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/errors/QueryEngineValidationError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -7071,6 +7131,16 @@
             },
             "description": "The @maple/http/v2/ServiceNotFoundError failure. HTTP 404."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -7116,7 +7186,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -7184,7 +7254,7 @@
                 }
               }
             },
-            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/v2/TelemetryBreakdownFilterRequiredError failure. HTTP 400. | The @maple/http/v2/TraceQueryInvalidError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/QueryEngineValidationError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/v2/TelemetryBreakdownFilterRequiredError failure. HTTP 400. | The @maple/http/v2/TraceQueryInvalidError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/errors/QueryEngineValidationError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -7206,6 +7276,16 @@
             },
             "description": "The @maple/http/v2/InsufficientScopeError failure. HTTP 403. | The @maple/http/v2/OrganizationAccessDeniedError failure. HTTP 403."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -7251,7 +7331,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -7319,7 +7399,7 @@
                 }
               }
             },
-            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/v2/TelemetryBucketCountTooLargeError failure. HTTP 400. | The @maple/http/v2/TraceQueryInvalidError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/QueryEngineValidationError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/v2/TimeRangeInvalidError failure. HTTP 400. | The @maple/http/v2/TelemetryRangeTooLargeError failure. HTTP 400. | The @maple/http/v2/TelemetryBucketCountTooLargeError failure. HTTP 400. | The @maple/http/v2/TraceQueryInvalidError failure. HTTP 400. | The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/errors/QueryEngineValidationError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -7341,6 +7421,16 @@
             },
             "description": "The @maple/http/v2/InsufficientScopeError failure. HTTP 403. | The @maple/http/v2/OrganizationAccessDeniedError failure. HTTP 403."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -7386,7 +7476,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
@@ -7715,7 +7805,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/QueryEngineValidationError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
+            "description": "The @maple/http/errors/WarehouseInvalidSqlError failure. HTTP 400. | The @maple/http/errors/GcpLiveQueryRejectedError failure. HTTP 400. | The @maple/http/errors/QueryEngineValidationError failure. HTTP 400. | The @maple/http/v2/InvalidRequestError failure. HTTP 400."
           },
           "401": {
             "content": {
@@ -7737,6 +7827,16 @@
             },
             "description": "The @maple/http/v2/InsufficientScopeError failure. HTTP 403. | The @maple/http/v2/OrganizationAccessDeniedError failure. HTTP 403."
           },
+          "409": {
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/MapleErrorEnvelope"
+                }
+              }
+            },
+            "description": "The @maple/http/errors/GcpLiveQueryUnavailableError failure. HTTP 409."
+          },
           "429": {
             "content": {
               "application/json": {
@@ -7782,7 +7882,7 @@
                 }
               }
             },
-            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502."
+            "description": "The @maple/http/errors/WarehouseQueryError failure. HTTP 502. | The @maple/http/errors/WarehouseAuthError failure. HTTP 502. | The @maple/http/errors/WarehouseConfigError failure. HTTP 502. | The @maple/http/errors/WarehouseClientError failure. HTTP 502. | The @maple/http/errors/WarehouseSchemaDriftError failure. HTTP 502. | The @maple/http/errors/WarehouseResultDecodeError failure. HTTP 502. | The @maple/http/errors/OrgClickHouseSettingsStoredConfigInvalidError failure. HTTP 502. | The @maple/http/errors/GcpLiveQueryFailedError failure. HTTP 502."
           },
           "503": {
             "content": {
diff --git a/apps/landing/src/content/docs/integrations/gcp.md b/apps/landing/src/content/docs/integrations/gcp.md
index 51c27570df..2028ccdb96 100644
--- a/apps/landing/src/content/docs/integrations/gcp.md
+++ b/apps/landing/src/content/docs/integrations/gcp.md
@@ -150,6 +150,16 @@ One-minute resolution, named like OpenTelemetry metrics under `gcp.`:
 
 Every hour Maple lists projects, Cloud Run services and jobs, Cloud Functions, GKE clusters, Compute Engine instances, Cloud SQL instances, Pub/Sub topics and subscriptions, and load balancers from Cloud Asset Inventory, with their location, state and labels.
 
+## Query any Cloud Monitoring metric live
+
+With **Metrics and resources** on, you can chart and alert on any Cloud Monitoring metric with numeric, boolean or distribution values that had data in the last day. Maple reads it live from Google. The metrics explorer lists them under the service **Google Cloud**. In dashboards, alert rules and the MCP tools, use the metric type as the metric name, e.g. `cloudsql.googleapis.com/database/cpu/utilization`.
+
+- Filter and group by the metric's labels as `attr.<label>` (e.g. `attr.database_id`, `attr.project_id`). There is no `service.name` or `deployment.environment`.
+- One query reads up to 20 projects and returns up to 500 series. Filter on `project_id` or other labels to stay under.
+- Alerts on these metrics read 4 minutes behind, because Google publishes many metrics a few minutes late.
+
+Google bills these reads per time series returned ([pricing](https://cloud.google.com/stackdriver/pricing)).
+
 ## Infrastructure → Google Cloud
 
 While a connection has **Metrics and resources** on, **Infrastructure → Google Cloud** shows one tab per service with a row per workload, a band that counts saturated, elevated and erroring workloads, and a **Resources** tab with the inventory. Each workload opens a page with its charts and links to its logs, its traces and the Google Cloud console.
diff --git a/apps/web/src/lib/alerts/widget-prefill.test.ts b/apps/web/src/lib/alerts/widget-prefill.test.ts
index fa3271542b..b273dab787 100644
--- a/apps/web/src/lib/alerts/widget-prefill.test.ts
+++ b/apps/web/src/lib/alerts/widget-prefill.test.ts
@@ -195,6 +195,37 @@ describe("createWidgetAlertPrefill", () => {
 	})
 })
 
+describe("createWidgetAlertPrefill on a Google Cloud metric", () => {
+	const metricsChart = (metricName: string) =>
+		createWidgetAlertPrefill(
+			{
+				id: "w1",
+				dataSource: {
+					endpoint: "custom_query_builder_timeseries",
+					params: {
+						queries: [
+							builderQuery({
+								dataSource: "metrics",
+								aggregation: "avg",
+								metricName,
+								metricType: "gauge",
+							}),
+						],
+					},
+				},
+			},
+			defaultRuleForm(),
+		).form.minimumSampleCount
+
+	it("needs one sample, since a window holds a few dozen at most", () => {
+		expect(metricsChart("cloudsql.googleapis.com/database/cpu/utilization")).toBe("1")
+	})
+
+	it("keeps the default for a warehouse metric", () => {
+		expect(metricsChart("http.server.duration")).toBe(defaultRuleForm().minimumSampleCount)
+	})
+})
+
 describe("resolveWidgetAlertPrefill", () => {
 	it("returns a blank alert with a notice when the dashboard id is missing", () => {
 		const result = resolveWidgetAlertPrefill({
diff --git a/apps/web/src/lib/alerts/widget-prefill.ts b/apps/web/src/lib/alerts/widget-prefill.ts
index 1f4851708b..95c2e84f6f 100644
--- a/apps/web/src/lib/alerts/widget-prefill.ts
+++ b/apps/web/src/lib/alerts/widget-prefill.ts
@@ -2,6 +2,7 @@ import type { QueryBuilderQueryDraftPayload } from "@maple/domain/http"
 
 import { normalizeRuleQueryDraft, rawSqlHasValueColumn, type RuleFormState } from "@maple/web-data/alerts/form-utils"
 import { buildTimeseriesQuerySpec } from "@maple/query-engine/query-builder"
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import { SERIES_REDUCER_TO_ALERT_REDUCER, toQueryBuilderDataSource } from "@maple/query-model"
 import { dataSourceQuerySet, dataSourceRawSql, dataSourceTransform } from "@maple/widgets/dashboard"
 
@@ -87,6 +88,12 @@ function queryToForm(
 		// error_rate is entered as a percent in every mode (see formThresholdToDomain),
 		// so the blank form's "5" carries over as 5%.
 		threshold: base.threshold,
+		// A Google metric reports a sample a minute per series: a 5-minute window holds a few dozen,
+		// never the warehouse default of 50.
+		minimumSampleCount:
+			queryBuilderDraft.dataSource === "metrics" && isGcpMetricType(queryBuilderDraft.metricName)
+				? "1"
+				: base.minimumSampleCount,
 		groupBy: [],
 	}
 }
diff --git a/apps/web/src/page/dashboards/widget/metric-options.ts b/apps/web/src/page/dashboards/widget/metric-options.ts
index e963a8e1c7..2e1d5f5b11 100644
--- a/apps/web/src/page/dashboards/widget/metric-options.ts
+++ b/apps/web/src/page/dashboards/widget/metric-options.ts
@@ -1,3 +1,4 @@
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import { QUERY_BUILDER_METRIC_TYPES, toQueryBuilderMetricType } from "@maple/query-model"
 import { getMetricAttributeKeys, listMetrics } from "@maple/web-data/warehouse/metrics"
 import { Effect, Schema } from "effect"
@@ -30,7 +31,9 @@ export const FetchMetricOptions = Command.define("FetchWidgetEditorMetricOptions
 					}))
 					.filter((option, index, all) => all.findIndex((other) => other.value === option.value) === index),
 				// `toNames`: trimmed, non-empty, each once.
+				// Google Cloud metrics carry no service.name to filter on.
 				services: response.data
+					.filter((row) => !isGcpMetricType(row.metricName))
 					.map((row) => row.serviceName.trim())
 					.filter((name, index, all) => name !== "" && all.indexOf(name) === index),
 			})),
diff --git a/apps/web/src/page/kit/query-builder/metrics-body.ts b/apps/web/src/page/kit/query-builder/metrics-body.ts
index 4c8023acbf..5e5fb2638f 100644
--- a/apps/web/src/page/kit/query-builder/metrics-body.ts
+++ b/apps/web/src/page/kit/query-builder/metrics-body.ts
@@ -1,3 +1,4 @@
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import { getMetricsAggregations } from "@maple/query-engine/query-builder"
 import type { WhereClauseAutocompleteValues } from "../../../lib/query-builder/where-clause-autocomplete"
 import type { Html, HtmlBuilder } from "foldkit/html"
@@ -75,7 +76,12 @@ const breakdown = (h: H, model: Model, query: MetricsQuery, keys: ReadonlyArray<
 		view: ComboboxView.view,
 		toParentMessage: (message) => Message.GotMetricBreakdownMessage({ queryId: query.id, message }),
 		viewInputs: {
-			items: [NONE, "service.name", ...keys.map((key) => `attr.${key}`)],
+			items: [
+				NONE,
+				// Google Cloud metrics carry no service.name.
+				...(isGcpMetricType(query.metricName) ? [] : ["service.name"]),
+				...keys.map((key) => `attr.${key}`),
+			],
 			placeholder: "Search fields...",
 			emptyText: "",
 			highlightsSelected: true,
diff --git a/apps/web/src/page/metrics/browse/view-grid.ts b/apps/web/src/page/metrics/browse/view-grid.ts
index 5261e63b75..67bbfa1f04 100644
--- a/apps/web/src/page/metrics/browse/view-grid.ts
+++ b/apps/web/src/page/metrics/browse/view-grid.ts
@@ -1,3 +1,4 @@
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import { validateCssColor } from "@maple/ui/lib/sanitizers"
 import { Option } from "effect"
 import { AsyncData as FoldkitAsyncData } from "foldkit"
@@ -114,11 +115,14 @@ const sparkline = (h: H, theme: ThemeColors, entry: PreviewEntry, values: Readon
 const previewCard = (h: H, theme: ThemeColors, entry: PreviewEntry, sparklines: PageSparklines): Html => {
 	const points = sparklines.pointsByMetric.get(entryKey(entry.metricName, entry.metricType)) ?? []
 	const values = sparklineValues(entry.metricType, points).map(finiteOrZero)
-	const status = sparklines.isLoading
-		? "Loading…"
-		: sparklines.failedTypes.has(entry.metricType)
-			? "Preview unavailable"
-			: "Not enough datapoints for a preview"
+	const isGcp = isGcpMetricType(entry.metricName)
+	const status = isGcp
+		? "Read live from Google Cloud: open to chart"
+		: sparklines.isLoading
+			? "Loading…"
+			: sparklines.failedTypes.has(entry.metricType)
+				? "Preview unavailable"
+				: "Not enough datapoints for a preview"
 	return h.button(
 		[
 			h.Key(entryKey(entry.metricName, entry.metricType)),
@@ -134,11 +138,18 @@ const previewCard = (h: H, theme: ThemeColors, entry: PreviewEntry, sparklines:
 			h.div(
 				[h.Class("flex w-full items-start justify-between gap-2")],
 				[
-					truncatedText(h, {
-						text: entry.metricName,
-						mono: true,
-						className: "text-xs font-medium",
-					}),
+					// Google metric types share a long domain prefix: cut the start, keep the path.
+					isGcp
+						? truncatedText(
+								h,
+								{
+									text: entry.metricName,
+									mono: true,
+									className: "text-xs font-medium [direction:rtl] text-left",
+								},
+								[h.bdi([h.Dir("ltr")], [entry.metricName])],
+							)
+						: truncatedText(h, { text: entry.metricName, mono: true, className: "text-xs font-medium" }),
 					metricTypeBadge(h, entry.metricType),
 				],
 			),
diff --git a/apps/web/src/page/metrics/browse/view-table.ts b/apps/web/src/page/metrics/browse/view-table.ts
index 440bf26b64..4b8bf61ed4 100644
--- a/apps/web/src/page/metrics/browse/view-table.ts
+++ b/apps/web/src/page/metrics/browse/view-table.ts
@@ -1,3 +1,4 @@
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import { EMPTY_VALUE, formatNumber } from "@maple/ui/lib/format"
 import { refreshingClass } from "@maple/ui/lib/refreshing"
 import { cn } from "@maple/ui/lib/utils"
@@ -111,7 +112,12 @@ const metricRow = (h: H, model: Model, metric: MetricRow, timeZone: string): Htm
 				],
 				`${MD_CELL} overflow-hidden`,
 			),
-			tableCell(h, [formatNumber(metric.dataPointCount)], `${MD_CELL} font-mono text-xs`),
+			tableCell(
+				h,
+				// Google metrics are read live: Maple stores no datapoints for them.
+				[isGcpMetricType(metric.metricName) ? EMPTY_VALUE : formatNumber(metric.dataPointCount)],
+				`${MD_CELL} font-mono text-xs`,
+			),
 			tableCell(
 				h,
 				[relativeTime(h, { value: metric.lastSeen, nowMs: model.nowMs, timeZone, tooltip: "title" })],
diff --git a/apps/web/src/page/metrics/detail/detail.scene.test.ts b/apps/web/src/page/metrics/detail/detail.scene.test.ts
index d86733aca2..9f9ffe8589 100644
--- a/apps/web/src/page/metrics/detail/detail.scene.test.ts
+++ b/apps/web/src/page/metrics/detail/detail.scene.test.ts
@@ -90,6 +90,25 @@ describe("metric detail", () => {
 		])
 	})
 
+	test("a Google Cloud metric breaks down by its first label once the labels load", () => {
+		const metricName = "cloudsql.googleapis.com/database/cpu/utilization"
+		const resolved = pageUpdate(
+			init({ metricName, search: {} }, context).model,
+			Message.CompletedResolveWindow({ window, nowMs: NOW, mode: "Load" }),
+		).model
+		const catalog = withCatalog(resolved, [{ ...row("google-cloud", "gauge"), metricName }])
+		expect(names(catalog.commands)).toEqual(["FetchMetricAttributeKeys", "FetchMetricTimeseries"])
+		const labels = pageUpdate(
+			catalog.model,
+			Message.CompletedFetchAttributeKeys({
+				key: catalog.model.attributeKeys.key ?? "",
+				result: Result.succeed([{ attributeKey: "database_id", usageCount: 0 }]),
+			}),
+		)
+		expect(names(labels.commands)).toEqual(["FetchMetricBreakdown"])
+		expect(labels.model.breakdown.key).toContain("attr.database_id")
+	})
+
 	test("counters default to rate and everything else to avg", () => {
 		const sum = withCatalog(windowed(), [row("checkout-api", "sum", true)]).model
 		const histogram = withCatalog(windowed(), [row("checkout-api")]).model
diff --git a/apps/web/src/page/metrics/detail/update.ts b/apps/web/src/page/metrics/detail/update.ts
index 85531b4cf8..264144d75a 100644
--- a/apps/web/src/page/metrics/detail/update.ts
+++ b/apps/web/src/page/metrics/detail/update.ts
@@ -1,3 +1,4 @@
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import { Option } from "effect"
 import { AsyncData, Command, type Update } from "foldkit"
 import * as AddToDashboard from "./add-to-dashboard"
@@ -79,8 +80,21 @@ export const summaryOf = (model: Model): CatalogSummary | null =>
 export const draftOf = (model: Model, summary: CatalogSummary) =>
 	buildMetricExplorerDraft(summary, model.search)
 
-/** `MetricBreakdown`'s key: the URL's `bd`, else `service.name`. */
-export const breakdownKeyOf = (search: Search): string => search.bd ?? SERVICE_KEY
+/**
+ * `MetricBreakdown`'s key: the URL's `bd`, else `service.name`. Google Cloud metrics have no
+ * `service.name`: they break down by their first label, unknown until the labels load.
+ */
+export const breakdownKeyOf = (
+	model: Pick<Model, "metricName" | "search" | "attributeKeys">,
+): string | undefined => {
+	const chosen = model.search.bd
+	if (!isGcpMetricType(model.metricName)) return chosen ?? SERVICE_KEY
+	if (chosen !== undefined && chosen !== SERVICE_KEY) return chosen
+	return Option.match(AsyncData.getData(model.attributeKeys.data), {
+		onNone: () => undefined,
+		onSome: (rows) => rows[0]?.attributeKey,
+	})
+}
 
 type Step<A, E> = Readonly<{ slot: Keyed.Keyed<A, E>; commands: Commands }>
 
@@ -138,10 +152,6 @@ const requestContent = (model: Model, context: PageContext, mode: RequestMode):
 	const draft = draftOf(model, summary)
 	const keysInput = { ...window, metricName: summary.metricName, metricType: summary.metricType }
 	const chartInput = { ...window, query: chartQuery(draft) }
-	const breakdownInput = {
-		...window,
-		query: buildBreakdownDraft(draft, breakdownGroupBy(breakdownKeyOf(model.search))),
-	}
 	const attributeKeys = keyed(
 		model.attributeKeys,
 		requestKey(org, "getMetricAttributeKeys", { data: keysInput }),
@@ -155,12 +165,22 @@ const requestContent = (model: Model, context: PageContext, mode: RequestMode):
 		mode,
 		(key) => FetchTimeseries({ key, input: chartInput }),
 	)
-	const breakdown = keyed(
-		model.breakdown,
-		requestKey(org, "getQueryBuilderBreakdown", { data: { ...window, queries: [breakdownInput.query] } }),
-		mode,
-		(key) => FetchBreakdown({ key, input: breakdownInput }),
-	)
+	const breakdownKey = breakdownKeyOf({ ...model, attributeKeys: attributeKeys.slot })
+	const breakdownInput =
+		breakdownKey === undefined
+			? undefined
+			: { ...window, query: buildBreakdownDraft(draft, breakdownGroupBy(breakdownKey)) }
+	const breakdown =
+		breakdownInput === undefined
+			? { slot: model.breakdown, commands: [] }
+			: keyed(
+					model.breakdown,
+					requestKey(org, "getQueryBuilderBreakdown", {
+						data: { ...window, queries: [breakdownInput.query] },
+					}),
+					mode,
+					(key) => FetchBreakdown({ key, input: breakdownInput }),
+				)
 	return {
 		model: {
 			...syncControls(model),
@@ -203,7 +223,7 @@ const syncControls = (model: Model): Model => {
 		model.search.groupBy === undefined || model.search.groupBy === ""
 			? GROUP_BY_NONE_LABEL
 			: model.search.groupBy
-	const breakdownKey = breakdownKeyOf(model.search)
+	const breakdownKey = breakdownKeyOf(model) ?? ""
 	const syncCombobox = (combobox: Combobox.Model, value: string): Combobox.Model =>
 		combobox.isOpen || combobox.selected[0] === value
 			? combobox
@@ -286,7 +306,7 @@ export const init = (route: Route, context: PageContext): Return => {
 			selected: [route.search.groupBy ?? GROUP_BY_NONE_LABEL],
 		}),
 		breakdownCombobox: Combobox.init("metric-breakdown-key", "single", {
-			selected: [breakdownKeyOf(route.search)],
+			selected: [breakdownKeyOf({ ...route, attributeKeys: Keyed.idle() }) ?? ""],
 		}),
 		copyLink: CopyButton.init(),
 		addToDashboard: AddToDashboard.init(),
@@ -423,9 +443,11 @@ export const update = (model: Model, message: Message, context: PageContext): Re
 						},
 					}
 		},
-		CompletedFetchAttributeKeys: ({ key, result }) => ({
-			model: { ...model, attributeKeys: Keyed.accept(model.attributeKeys, key, result) },
-		}),
+		CompletedFetchAttributeKeys: ({ key, result }) => {
+			const next = { ...model, attributeKeys: Keyed.accept(model.attributeKeys, key, result) }
+			// A Google metric's breakdown key is its first label, so the keys' arrival requests it.
+			return isGcpMetricType(model.metricName) ? requestContent(next, context, "Load") : { model: next }
+		},
 		CompletedFetchTimeseries: ({ key, result }) => ({
 			model: { ...model, timeseries: Keyed.accept(model.timeseries, key, result) },
 		}),
diff --git a/apps/web/src/page/metrics/detail/view-controls.ts b/apps/web/src/page/metrics/detail/view-controls.ts
index 694d018461..6194f4227b 100644
--- a/apps/web/src/page/metrics/detail/view-controls.ts
+++ b/apps/web/src/page/metrics/detail/view-controls.ts
@@ -1,3 +1,4 @@
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import { getMetricsAggregations, type QueryBuilderMetricType } from "@maple/query-engine/query-builder"
 import { cn } from "@maple/ui/lib/utils"
 import {
@@ -190,7 +191,12 @@ export const queryControls = (
 			view: comboboxView,
 			toParentMessage: toGroupBy,
 			viewInputs: {
-				items: [GROUP_BY_NONE_LABEL, SERVICE_KEY, ...scopedKeys(model).map((key) => `attr.${key}`)],
+				items: [
+					GROUP_BY_NONE_LABEL,
+					// Google Cloud metrics carry no service.name.
+					...(isGcpMetricType(model.metricName) ? [] : [SERVICE_KEY]),
+					...scopedKeys(model).map((key) => `attr.${key}`),
+				],
 				placeholder: "Search fields...",
 				emptyText: "",
 				className: "h-8 w-52 text-xs",
diff --git a/apps/web/src/page/metrics/detail/view-panels.ts b/apps/web/src/page/metrics/detail/view-panels.ts
index 4ab0dd3e07..10a76fe60f 100644
--- a/apps/web/src/page/metrics/detail/view-panels.ts
+++ b/apps/web/src/page/metrics/detail/view-panels.ts
@@ -1,5 +1,6 @@
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import type { MetricsQueryDraft } from "@maple/query-engine/query-builder"
-import { countLabel, formatNumber } from "@maple/ui/lib/format"
+import { countLabel, EMPTY_VALUE, formatNumber } from "@maple/ui/lib/format"
 import { Option } from "effect"
 import { AsyncData } from "foldkit"
 import type { Html, HtmlBuilder } from "foldkit/html"
@@ -159,7 +160,8 @@ const attributeKeyNames = (model: Model): ReadonlyArray<string> =>
 
 /** `MetricBreakdown`: top values of one attribute; each bar narrows the where clause. */
 export const metricBreakdown = (h: H, model: Model, draft: MetricsQueryDraft): Html => {
-	const filterKey = breakdownGroupBy(breakdownKeyOf(model.search))
+	const key = breakdownKeyOf(model)
+	const isGcp = isGcpMetricType(model.metricName)
 	return panel(h, {}, [
 		panelHeader(h, {
 			title: `Top values · ${breakdownAggregation(draft.aggregation)} per value`,
@@ -169,7 +171,7 @@ export const metricBreakdown = (h: H, model: Model, draft: MetricsQueryDraft): H
 				view: comboboxView,
 				toParentMessage: toBreakdownKey,
 				viewInputs: {
-					items: [SERVICE_KEY, ...attributeKeyNames(model)],
+					items: [...(isGcp ? [] : [SERVICE_KEY]), ...attributeKeyNames(model)],
 					placeholder: "Break down by...",
 					emptyText: "",
 					className: "h-7 w-52 text-xs",
@@ -177,10 +179,21 @@ export const metricBreakdown = (h: H, model: Model, draft: MetricsQueryDraft): H
 				},
 			}),
 		}),
-		h.div([h.Class("p-3")], [breakdownBars(h, model, filterKey)]),
+		h.div(
+			[h.Class("p-3")],
+			[key === undefined ? breakdownKeysState(h, model) : breakdownBars(h, model, breakdownGroupBy(key))],
+		),
 	])
 }
 
+/** A Google metric's breakdown before it has a label to break down by. */
+const breakdownKeysState = (h: H, model: Model): Html =>
+	AsyncData.matchData(model.attributeKeys.data, {
+		onEmpty: () => skeletonList(h, { rows: 5, rowClassName: "h-6", gap: "2" }),
+		onFailure: (failure) => errorState(h, { failure, title: "Failed to load labels", variant: "inline" }),
+		onData: () => emptyMessage(h, {}, ["No labels to break down by in the selected range."]),
+	})
+
 const attributesList = (h: H, model: Model): Html =>
 	AsyncData.matchData(model.attributeKeys.data, {
 		onEmpty: () => skeleton(h, "h-12 w-full"),
@@ -207,10 +220,15 @@ const attributesList = (h: H, model: Model): Html =>
 								],
 								[
 									h.span([h.Class("truncate font-mono")], [row.attributeKey]),
-									h.span(
-										[h.Class("shrink-0 font-mono text-muted-foreground")],
-										[formatNumber(row.usageCount)],
-									),
+									// Google metrics are read live: no usage count per label.
+									...(isGcpMetricType(model.metricName)
+										? []
+										: [
+												h.span(
+													[h.Class("shrink-0 font-mono text-muted-foreground")],
+													[formatNumber(row.usageCount)],
+												),
+											]),
 								],
 							),
 						),
@@ -245,7 +263,10 @@ export const metadataPanel = (h: H, model: Model, summary: CatalogSummary, timeZ
 			],
 		),
 		keyValueList(h, { className: "gap-2" }, [
-			keyValue(h, { label: "Datapoints in range", mono: true }, [formatNumber(summary.dataPointCount)]),
+			keyValue(h, { label: "Datapoints in range", mono: true }, [
+				// Google metrics are read live: Maple stores no datapoints for them.
+				isGcpMetricType(summary.metricName) ? EMPTY_VALUE : formatNumber(summary.dataPointCount),
+			]),
 			keyValue(h, { label: "First seen", mono: true }, [formatSeen(summary.firstSeen, timeZone)]),
 			keyValue(h, { label: "Last seen", mono: true }, [formatSeen(summary.lastSeen, timeZone)]),
 		]),
diff --git a/apps/web/src/route/route.test.ts b/apps/web/src/route/route.test.ts
index c8de682b8e..342024e7db 100644
--- a/apps/web/src/route/route.test.ts
+++ b/apps/web/src/route/route.test.ts
@@ -21,6 +21,13 @@ describe("routes", () => {
 		expect(hrefOf(route)).toBe("/services/checkout%20api")
 	})
 
+	test("a Google Cloud metric type keeps its slashes in one path segment", () => {
+		const metricName = "cloudsql.googleapis.com/database/cpu/utilization"
+		const href = "/metrics/cloudsql.googleapis.com%2Fdatabase%2Fcpu%2Futilization"
+		expect(parse(href)).toMatchObject({ _tag: "Metric", metricName })
+		expect(hrefOf(parse(href))).toBe(href)
+	})
+
 	test("a literal sibling wins over a param route", () => {
 		expect(parse("/infra/hosts")._tag).toBe("InfraHosts")
 		expect(parse("/alerts/create")._tag).toBe("AlertsCreate")
diff --git a/packages/backend/src/services/alerts/AlertsService.test.ts b/packages/backend/src/services/alerts/AlertsService.test.ts
index e39bea44a5..f3a45c0879 100644
--- a/packages/backend/src/services/alerts/AlertsService.test.ts
+++ b/packages/backend/src/services/alerts/AlertsService.test.ts
@@ -70,6 +70,7 @@ import { EmailService } from "@maple/backend/platform/EmailService"
 import { OrgClickHouseSettingsService } from "@maple/backend/services/org/OrgClickHouseSettingsService"
 import { OrgMembersService, type OrgMember } from "@maple/backend/services/org/OrgMembersService"
 import { QueryEngineService } from "@maple/backend/services/warehouse/QueryEngineService"
+import { GcpLiveMetricsService } from "@maple/backend/services/integrations/GcpLiveMetricsService"
 import {
 	cleanupTestDbs,
 	createTestDb,
@@ -300,6 +301,7 @@ const makeLayer = (
 	const edgeCacheLive = EdgeCacheService.layer.pipe(Layer.provide(CacheBackendLive))
 	const bucketCacheLive = BucketCacheService.layer.pipe(Layer.provide(edgeCacheLive))
 	const queryEngineLive = Layer.effect(QueryEngineService, QueryEngineService.make).pipe(
+		Layer.provide(Layer.mock(GcpLiveMetricsService, {})),
 		Layer.provide(warehouseLive),
 		Layer.provide(edgeCacheLive),
 		Layer.provide(bucketCacheLive),
diff --git a/packages/backend/src/services/integrations/GcpLiveMetricsService.test.ts b/packages/backend/src/services/integrations/GcpLiveMetricsService.test.ts
new file mode 100644
index 0000000000..7f1d6dafb8
--- /dev/null
+++ b/packages/backend/src/services/integrations/GcpLiveMetricsService.test.ts
@@ -0,0 +1,1196 @@
+import { afterEach, assert, beforeAll, describe, it } from "@effect/vitest"
+import { EdgeCacheService, MemoryCacheBackendLive } from "@maple/cache"
+import { OrgId } from "@maple/domain/primitives"
+import {
+	GcpLiveQueryFailedError,
+	GcpLiveQueryRejectedError,
+	GcpLiveQueryUnavailableError,
+} from "@maple/domain/http/gcp-live-query-errors"
+import { ConfigProvider, Effect, Layer, Schema } from "effect"
+import { TestClock } from "effect/testing"
+import { FetchHttpClient } from "effect/http"
+import { Env } from "@maple/backend/platform/Env"
+import { cleanupTestDbs, createTestDb, executeSql, type TestDb } from "@maple/backend/platform/test-pglite"
+import { GcpLiveMetricsService } from "./GcpLiveMetricsService"
+
+const now = Date.UTC(2026, 9, 15, 12, 0, 0)
+const ORG = Schema.decodeSync(OrgId)("org_gcp")
+const OTHER_ORG = "org_other"
+const TENANT = { orgId: ORG }
+
+// Connector ids and the reader account each one's setup script creates.
+const PROJECT_CONNECTOR = "018f2b3c-4d5e-4f70-8192-a3b4c5d6e7f8"
+const FOLDER_CONNECTOR = "028f2b3c-4d5e-4f70-8192-a3b4c5d6e7f8"
+const OTHER_CONNECTOR = "038f2b3c-4d5e-4f70-8192-a3b4c5d6e7f8"
+const readerOf = (connectorId: string, hostProject: string) =>
+	`maple-${connectorId.replaceAll("-", "").slice(0, 24)}@${hostProject}.iam.gserviceaccount.com`
+const PROJECT_READER = readerOf(PROJECT_CONNECTOR, "acme-prod")
+const FOLDER_READER = readerOf(FOLDER_CONNECTOR, "acme-host")
+
+let encodedKey = ""
+
+beforeAll(async () => {
+	const pair = await crypto.subtle.generateKey(
+		{
+			name: "RSASSA-PKCS1-v1_5",
+			modulusLength: 2048,
+			publicExponent: new Uint8Array([1, 0, 1]),
+			hash: "SHA-256",
+		},
+		true,
+		["sign", "verify"],
+	)
+	const body = Buffer.from(await crypto.subtle.exportKey("pkcs8", pair.privateKey)).toString("base64")
+	encodedKey = Buffer.from(
+		JSON.stringify({
+			private_key_id: "key-1",
+			private_key: `-----BEGIN PRIVATE KEY-----\n${body.match(/.{1,64}/g)!.join("\n")}\n-----END PRIVATE KEY-----\n`,
+			client_email: "collector@maple-prod.iam.gserviceaccount.com",
+		}),
+	).toString("base64")
+})
+
+const trackedDbs: TestDb[] = []
+afterEach(() => cleanupTestDbs(trackedDbs))
+
+const json = (body: unknown, status = 200) =>
+	new Response(JSON.stringify(body), { status, headers: { "content-type": "application/json" } })
+
+const denied = () => json({ error: { code: 403, status: "PERMISSION_DENIED", message: "denied" } }, 403)
+const rateLimited = () =>
+	json({ error: { code: 429, status: "RESOURCE_EXHAUSTED", message: "slow down" } }, 429)
+
+const googleError = (status: number, code: string, reason?: string) =>
+	json(
+		{
+			error: {
+				code: status,
+				status: code,
+				message: "refused",
+				...(reason === undefined
+					? undefined
+					: { details: [{ "@type": "type.googleapis.com/google.rpc.ErrorInfo", reason }] }),
+			},
+		},
+		status,
+	)
+
+interface PromQlCall {
+	readonly project: string
+	/** `query` or `query_range`. */
+	readonly path: string
+	readonly params: Record<string, string>
+	/** The reader account whose token made the call. */
+	readonly reader: string
+	readonly quotaProject: string | null
+}
+
+interface Calls {
+	oauth: number
+	readonly impersonate: Array<string>
+	readonly promql: Array<PromQlCall>
+	/** `project pageToken` per descriptor page read. */
+	readonly descriptors: Array<string>
+	readonly scopes: Array<string>
+	/** `project pageToken` per resource type page read. */
+	readonly resourceTypes: Array<string>
+	/** Requests no stub answers for: every test expects none. */
+	readonly unexpected: Array<string>
+}
+
+interface StubOptions {
+	readonly oauth?: () => Response | undefined
+	readonly impersonate?: (account: string) => Response | undefined
+	/** A rejected promise stands for a transport failure. */
+	readonly promql?: (call: PromQlCall) => Response | Promise<Response> | undefined
+	/** A project's active descriptors, by page token (`""` for the first page). */
+	readonly descriptors?: (project: string, pageToken: string) => Response | undefined
+	/** A project's monitored resource types, by page token (`""` for the first page). */
+	readonly resourceTypes?: (project: string, pageToken: string) => Response | undefined
+	/** Projects a project's metrics scope reads besides itself. */
+	readonly scopes?: Record<string, ReadonlyArray<string>>
+}
+
+/** A stand-in project number: Google names a metrics scope's projects by number. */
+const numberOf = (projectId: string) =>
+	String([...projectId].reduce((hash, char) => (hash * 31 + char.charCodeAt(0)) % 1_000_000_007, 7))
+
+const matrix = (
+	...result: ReadonlyArray<{ metric: Record<string, string>; values: Array<[number, string]> }>
+) => json({ status: "success", data: { resultType: "matrix", result } })
+
+const stubFetch = (calls: Calls, options: StubOptions) =>
+	(async (input: string | URL | Request, init?: RequestInit) => {
+		const url = new URL(
+			typeof input === "string" ? input : input instanceof URL ? input.toString() : input.url,
+		)
+		const headers = new Headers(init?.headers)
+		const reader = (headers.get("authorization") ?? "").replace("Bearer reader:", "")
+		if (url.host === "oauth2.googleapis.com") {
+			calls.oauth += 1
+			return options.oauth?.() ?? json({ access_token: "ya29.maple", expires_in: 600 })
+		}
+		if (url.host === "iamcredentials.googleapis.com") {
+			const account = decodeURIComponent(
+				url.pathname
+					.replace("/v1/projects/-/serviceAccounts/", "")
+					.replace(":generateAccessToken", ""),
+			)
+			calls.impersonate.push(account)
+			return options.impersonate?.(account) ?? json({ accessToken: `reader:${account}` })
+		}
+		const promql = /^\/v1\/projects\/([^/]+)\/location\/global\/prometheus\/api\/v1\/(.+)$/.exec(
+			url.pathname,
+		)
+		if (url.host === "monitoring.googleapis.com" && promql !== null) {
+			const call = {
+				project: promql[1]!,
+				path: promql[2]!,
+				params: Object.fromEntries(
+					new URLSearchParams(await new Response(init?.body ?? null).text()),
+				),
+				reader,
+				quotaProject: headers.get("x-goog-user-project"),
+			}
+			calls.promql.push(call)
+			return (await options.promql?.(call)) ?? matrix()
+		}
+		const scope = /^\/v1\/locations\/global\/metricsScopes\/(.+)$/.exec(url.pathname)
+		if (url.host === "monitoring.googleapis.com" && scope !== null) {
+			const projectId = scope[1]!
+			calls.scopes.push(projectId)
+			return json({
+				name: `locations/global/metricsScopes/${numberOf(projectId)}`,
+				monitoredProjects: [projectId, ...(options.scopes?.[projectId] ?? [])].map((monitored) => ({
+					name: `locations/global/metricsScopes/${numberOf(projectId)}/projects/${numberOf(monitored)}`,
+				})),
+			})
+		}
+		const descriptors = /^\/v3\/projects\/([^/]+)\/metricDescriptors$/.exec(url.pathname)
+		if (
+			url.host === "monitoring.googleapis.com" &&
+			descriptors !== null &&
+			url.searchParams.get("activeOnly") === "true"
+		) {
+			const pageToken = url.searchParams.get("pageToken") ?? ""
+			calls.descriptors.push(`${descriptors[1]} ${pageToken}`.trim())
+			return options.descriptors?.(descriptors[1]!, pageToken) ?? json({})
+		}
+		const resourceTypes = /^\/v3\/projects\/([^/]+)\/monitoredResourceDescriptors$/.exec(url.pathname)
+		if (url.host === "monitoring.googleapis.com" && resourceTypes !== null) {
+			const pageToken = url.searchParams.get("pageToken") ?? ""
+			calls.resourceTypes.push(`${resourceTypes[1]} ${pageToken}`.trim())
+			return options.resourceTypes?.(resourceTypes[1]!, pageToken) ?? json({})
+		}
+		calls.unexpected.push(url.href)
+		return json({}, 418)
+	}) as typeof fetch
+
+const makeCalls = (): Calls => ({
+	oauth: 0,
+	impersonate: [],
+	promql: [],
+	descriptors: [],
+	scopes: [],
+	resourceTypes: [],
+	unexpected: [],
+})
+
+const run = <A, E>(
+	testDb: TestDb,
+	calls: Calls,
+	stub: StubOptions,
+	effect: Effect.Effect<A, E, GcpLiveMetricsService>,
+	options: { readonly key?: string | null } = {},
+) => {
+	const key = options.key === undefined ? encodedKey : options.key
+	return Effect.gen(function* () {
+		yield* TestClock.setTime(now)
+		const result = yield* effect
+		assert.deepStrictEqual(calls.unexpected, [])
+		return result
+	}).pipe(
+		Effect.provide(
+			Layer.effect(GcpLiveMetricsService, GcpLiveMetricsService.make).pipe(
+				Layer.provide(FetchHttpClient.layer),
+				Layer.provide(Layer.succeed(FetchHttpClient.Fetch, stubFetch(calls, stub))),
+				Layer.provide(EdgeCacheService.layer.pipe(Layer.provide(MemoryCacheBackendLive))),
+				Layer.provide(testDb.layer),
+				Layer.provide(Env.layer),
+				Layer.provide(
+					ConfigProvider.layer(
+						ConfigProvider.fromUnknown({
+							PORT: "3472",
+							TINYBIRD_HOST: "https://api.tinybird.co",
+							TINYBIRD_TOKEN: "test-token",
+							MAPLE_AUTH_MODE: "self_hosted",
+							MAPLE_ROOT_PASSWORD: "test-root-password",
+							MAPLE_DEFAULT_ORG_ID: "default",
+							MAPLE_INGEST_KEY_ENCRYPTION_KEY: Buffer.alloc(32, 9).toString("base64"),
+							MAPLE_INGEST_KEY_LOOKUP_HMAC_KEY: "maple-test-lookup-secret",
+							...(key === null ? undefined : { MAPLE_GCP_SERVICE_ACCOUNT_KEY: key }),
+						}),
+					),
+				),
+			),
+		),
+	)
+}
+
+const insertConnector = (
+	testDb: TestDb,
+	id: string,
+	options: {
+		readonly orgId?: string
+		readonly projectId?: string
+		readonly folder?: string
+		/** What the setup script reported: the read-only account is in place. */
+		readonly metricsOn?: boolean | null
+	} = {},
+) => {
+	const projectId = options.projectId ?? "acme-prod"
+	return Effect.promise(() =>
+		executeSql(
+			testDb,
+			`INSERT INTO gcp_connectors
+			   (id, org_id, scope_type, scope_id, project_id, secret_ciphertext, secret_iv, secret_tag,
+			    secret_hash, metrics_enabled, applied_metrics_enabled, created_by, created_at, updated_at)
+			 VALUES ($1, $2, $3, $4, $5, 'c', 'i', 't', $1, true, $6, 'user_1', now(), now())`,
+			[
+				id,
+				options.orgId ?? ORG,
+				options.folder === undefined ? "project" : "folder",
+				options.folder ?? projectId,
+				projectId,
+				options.metricsOn === undefined ? true : options.metricsOn,
+			],
+		),
+	)
+}
+
+/** The projects a folder connection's inventory sync found, as `[projectId, state]`. */
+const insertInventory = (
+	testDb: TestDb,
+	connectorId: string,
+	projects: ReadonlyArray<readonly [string, string | null]>,
+) =>
+	Effect.forEach(projects, ([projectId, state], index) =>
+		Effect.promise(() =>
+			executeSql(
+				testDb,
+				`INSERT INTO gcp_resources
+				   (connector_id, org_id, name, asset_type, project_id, state, labels, last_seen_at)
+				 VALUES ($1, $2, $3, 'cloudresourcemanager.googleapis.com/Project', $4, $5, '{}', now())`,
+				[
+					connectorId,
+					ORG,
+					`//cloudresourcemanager.googleapis.com/projects/${index + 1}0001`,
+					projectId,
+					state,
+				],
+			),
+		),
+	)
+
+const FOLDER_PROJECTS = [
+	["acme-shop", "ACTIVE"],
+	["acme-data", null],
+	["acme-gone", "DELETE_REQUESTED"],
+] as const
+
+/** The org's two connections: project `acme-prod`, and folder 123 hosted in `acme-host`. */
+const insertConnectors = (testDb: TestDb) =>
+	Effect.gen(function* () {
+		yield* insertConnector(testDb, PROJECT_CONNECTOR)
+		yield* insertConnector(testDb, FOLDER_CONNECTOR, { projectId: "acme-host", folder: "123" })
+		yield* insertConnector(testDb, OTHER_CONNECTOR, { orgId: OTHER_ORG, projectId: "rival-prod" })
+		yield* insertInventory(testDb, FOLDER_CONNECTOR, FOLDER_PROJECTS)
+	})
+
+const T0 = Date.UTC(2026, 9, 15, 11, 0) / 1000
+
+const range = (query: string, scope: { projects?: ReadonlyArray<string>; requireComplete?: boolean } = {}) =>
+	GcpLiveMetricsService.use((gcp) =>
+		gcp.queryRange(TENANT, {
+			query,
+			startSeconds: T0,
+			endSeconds: T0 + 3600,
+			stepSeconds: 600,
+			...scope,
+		}),
+	)
+
+const oneSeries = (call: PromQlCall) => matrix({ metric: { project_id: call.project }, values: [[T0, "1"]] })
+
+describe("GcpLiveMetricsService.queryRange", () => {
+	it.effect("reads every project of the org's connections, each with its connection's reader", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{
+				promql: (call) =>
+					call.project === "acme-prod"
+						? // Google left out `project_id`, and two points are not numbers.
+							matrix({
+								metric: { service: "checkout" },
+								values: [
+									[T0, "3"],
+									[T0 + 600, "NaN"],
+									[T0 + 1200, "+Inf"],
+									[T0 + 1800, "1.5"],
+								],
+							})
+						: // Google's own `project_id` stays.
+							matrix({
+								metric: {
+									service: "checkout",
+									project_id:
+										call.project === "acme-shop" ? "acme-monitored" : call.project,
+								},
+								values: [[T0, "7"]],
+							}),
+			},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				const series = yield* range("sum by (service) (rate(x[5m]))")
+				assert.sameDeepMembers(
+					[...series],
+					[
+						{ labels: { service: "checkout", project_id: "acme-data" }, points: [[T0, 7]] },
+						{
+							labels: { service: "checkout", project_id: "acme-prod" },
+							points: [
+								[T0, 3],
+								[T0 + 1800, 1.5],
+							],
+						},
+						{ labels: { service: "checkout", project_id: "acme-monitored" }, points: [[T0, 7]] },
+					],
+				)
+				// The folder's projects come from its inventory: a project pending deletion is not read,
+				// and the other org's connection never is.
+				assert.sameDeepMembers(
+					calls.promql.map(({ project, reader, quotaProject }) => ({
+						project,
+						reader,
+						quotaProject,
+					})),
+					[
+						{ project: "acme-prod", reader: PROJECT_READER, quotaProject: "acme-prod" },
+						{ project: "acme-shop", reader: FOLDER_READER, quotaProject: "acme-host" },
+						{ project: "acme-data", reader: FOLDER_READER, quotaProject: "acme-host" },
+					],
+				)
+				assert.strictEqual(calls.promql[0]!.path, "query_range")
+				assert.deepInclude(calls.promql[0]!.params, {
+					query: "sum by (service) (rate(x[5m]))",
+					start: String(T0),
+					end: String(T0 + 3600),
+					step: "600",
+				})
+			}),
+		)
+	})
+
+	it.effect("reads only the projects asked for, or all when one is not a connection's own", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				yield* range("up", { projects: ["acme-shop"] })
+				assert.deepStrictEqual(
+					calls.promql.map((call) => call.project),
+					["acme-shop"],
+				)
+
+				// `acme-monitored` is reached only through a metrics scope: every project is read,
+				// and the query's own `project_id` matcher keeps it alone.
+				yield* range('up{project_id="acme-monitored"}', { projects: ["acme-shop", "acme-monitored"] })
+				assert.sameMembers(
+					calls.promql.slice(1).map((call) => call.project),
+					["acme-prod", "acme-shop", "acme-data"],
+				)
+			}),
+		)
+	})
+
+	it.effect("refuses to read more than 20 projects unless the query filters on project_id", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		const many = Array.from({ length: 20 }, (_, index) => [`acme-team-${index + 10}`, "ACTIVE"] as const)
+		return run(
+			testDb,
+			calls,
+			{},
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, FOLDER_CONNECTOR, { projectId: "acme-host", folder: "123" })
+				yield* insertInventory(testDb, FOLDER_CONNECTOR, many)
+				yield* range("up")
+				assert.lengthOf(calls.promql, 20)
+
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const error = yield* Effect.flip(range("down"))
+				assert.instanceOf(error, GcpLiveQueryRejectedError)
+				assert.strictEqual(error.reason, "too_many_projects")
+				assert.include(error.message, "21 projects")
+				assert.include(error.message, "project_id")
+				assert.include(error.message, "acme-prod")
+				assert.lengthOf(calls.promql, 20)
+
+				yield* range("up", { projects: ["acme-team-10", "acme-prod"] })
+				assert.sameMembers(
+					calls.promql.slice(20).map((call) => call.project),
+					["acme-prod", "acme-team-10"],
+				)
+
+				// A project reached only through a metrics scope cannot narrow the read.
+				const outside = yield* Effect.flip(range("up", { projects: ["acme-monitored"] }))
+				assert.instanceOf(outside, GcpLiveQueryRejectedError)
+				assert.include(
+					outside.message,
+					"acme-monitored, which no connection reads as its own project",
+				)
+				assert.lengthOf(calls.promql, 22)
+			}),
+		)
+	})
+
+	it.effect("returns what answered when part fails, unless every project must answer", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{ promql: (call) => (call.project === "acme-prod" ? oneSeries(call) : denied()) },
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				const series = yield* range("up")
+				assert.deepStrictEqual(series, [{ labels: { project_id: "acme-prod" }, points: [[T0, 1]] }])
+
+				// An alert must not resolve on the projects that answered.
+				const error = yield* Effect.flip(range("up", { requireComplete: true }))
+				assert.instanceOf(error, GcpLiveQueryUnavailableError)
+				assert.include(error.message, "projects/acme-data: Google denied Maple's read of folder 123")
+				assert.include(error.message, "projects/acme-shop")
+			}),
+		)
+	})
+
+	it.effect("fails by cause when nothing answers: setup, Google's refusal, or worth a retry", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		const answers = new Map<string, () => Response>([
+			["denied", denied],
+			["busy", rateLimited],
+			["down", () => googleError(503, "UNAVAILABLE")],
+			[
+				"slow",
+				() =>
+					json(
+						{
+							status: "error",
+							errorType: "execution",
+							error: "query processing would load too many samples",
+						},
+						422,
+					),
+			],
+			// Google's front end answers a rate limit with a small HTML page.
+			[
+				"html",
+				() =>
+					new Response("<html><body>Too Many Requests</body></html>", {
+						status: 429,
+						headers: { "content-type": "text/html" },
+					}),
+			],
+		])
+		return run(
+			testDb,
+			calls,
+			{
+				promql: (call) =>
+					call.params.query === "unplugged"
+						? Promise.reject(new TypeError("network connection lost"))
+						: call.params.query === "mixed"
+							? call.project === "acme-prod"
+								? denied()
+								: rateLimited()
+							: answers.get(call.params.query)?.(),
+			},
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const setup = yield* Effect.flip(range("denied"))
+				assert.instanceOf(setup, GcpLiveQueryUnavailableError)
+				assert.include(setup.message, "the read-only roles are missing")
+
+				for (const transient of ["busy", "down", "html", "unplugged"]) {
+					const error = yield* Effect.flip(range(transient))
+					assert.instanceOf(error, GcpLiveQueryFailedError)
+					assert.deepStrictEqual(
+						error.failures.map((failure) => failure.scope),
+						["projects/acme-prod"],
+					)
+				}
+				const busy = yield* Effect.flip(range("html"))
+				assert.instanceOf(busy, GcpLiveQueryFailedError)
+				assert.strictEqual(
+					busy.failures[0]?.message,
+					"Google refused the read for the project acme-prod: a rate limit, or an answer past Google's size limit. Narrow the query, or try again in a few minutes. (Cloud Monitoring returned 429)",
+				)
+				const unplugged = yield* Effect.flip(range("unplugged"))
+				assert.instanceOf(unplugged, GcpLiveQueryFailedError)
+				assert.include(unplugged.failures[0]?.message ?? "", "(Cloud Monitoring request failed)")
+
+				const slow = yield* Effect.flip(range("slow"))
+				assert.instanceOf(slow, GcpLiveQueryRejectedError)
+				assert.include(
+					slow.message,
+					"Google could not finish the query on this project. Narrow the query or widen the step. (Cloud Monitoring returned 422 execution: query processing would load too many samples)",
+				)
+
+				// A setup problem anywhere outweighs a retry elsewhere.
+				yield* insertConnector(testDb, FOLDER_CONNECTOR, { projectId: "acme-host", folder: "123" })
+				yield* insertInventory(testDb, FOLDER_CONNECTOR, [["acme-shop", "ACTIVE"]])
+				assert.instanceOf(yield* Effect.flip(range("mixed")), GcpLiveQueryUnavailableError)
+			}),
+		)
+	})
+
+	it.effect("passes Google's refusal of the query on as an invalid query", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		const refusal = `invalid parameter "query": ${"x".repeat(2_000)}`
+		return run(
+			testDb,
+			calls,
+			{ promql: () => json({ status: "error", errorType: "bad_data", error: refusal }, 400) },
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const error = yield* Effect.flip(range('{"serviceruntime.googleapis.com/api/request_count"}'))
+				assert.instanceOf(error, GcpLiveQueryRejectedError)
+				assert.strictEqual(error.reason, "invalid_query")
+				assert.strictEqual(error.message, refusal.slice(0, 1_000))
+			}),
+		)
+	})
+
+	it.effect("refuses an answer of more than 500 series across its projects, never cut short", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{
+				// 250 series from each project: 750 in all, 500 from the folder alone.
+				promql: (call) =>
+					matrix(
+						...Array.from({ length: 250 }, (_, index) => ({
+							metric: { instance: `vm-${index}`, project_id: call.project },
+							values: [[T0, "1"]] as Array<[number, string]>,
+						})),
+					),
+			},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				const error = yield* Effect.flip(range("up"))
+				assert.instanceOf(error, GcpLiveQueryRejectedError)
+				assert.strictEqual(error.reason, "too_many_series")
+				assert.include(error.message, "group by fewer labels")
+
+				const atTheCap = yield* range("up", { projects: ["acme-shop", "acme-data"] })
+				assert.lengthOf(atTheCap, 500)
+			}),
+		)
+	})
+
+	it.effect("refuses a project's answer past 8 MB as too many series", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{ promql: () => matrix({ metric: { pod: "x".repeat(9 * 1024 * 1024) }, values: [[T0, "1"]] }) },
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const error = yield* Effect.flip(range("up"))
+				assert.instanceOf(error, GcpLiveQueryRejectedError)
+				assert.strictEqual(error.reason, "too_many_series")
+				assert.include(error.message, "larger than 8 MB")
+			}),
+		)
+	})
+
+	it.effect("reads a project another target's metrics scope holds through that scope, once", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{
+				scopes: { "acme-data": ["acme-shop"] },
+				// An answer without `project_id`.
+				promql: (call) =>
+					matrix({
+						metric: { service: "checkout" },
+						values: [[T0, call.project === "acme-data" ? "9" : "3"]],
+					}),
+			},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				const series = yield* range("sum by (service) (rate(x[5m]))")
+				assert.sameMembers(
+					calls.promql.map((call) => call.project),
+					["acme-data", "acme-prod"],
+				)
+				// acme-data's sum covers acme-shop too, so it names the scope, not a project.
+				assert.sameDeepMembers(
+					series.map((one) => one.labels),
+					[
+						{ service: "checkout", metrics_scope: "acme-data" },
+						{ service: "checkout", project_id: "acme-prod" },
+					],
+				)
+			}),
+		)
+	})
+
+	it.effect("reads a target whose scope is only partly covered by a wider one", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{
+				// acme-data's scope holds acme-shop, but acme-shop's own holds acme-orders too.
+				scopes: { "acme-data": ["acme-shop", "acme-logs"], "acme-shop": ["acme-orders"] },
+				promql: oneSeries,
+			},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				yield* range("up")
+				assert.sameMembers(
+					calls.promql.map((call) => call.project),
+					["acme-data", "acme-shop", "acme-prod"],
+				)
+			}),
+		)
+	})
+
+	it.effect("fails a folder whose projects are not listed yet, not answering it as empty", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{ promql: oneSeries },
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, FOLDER_CONNECTOR, { projectId: "acme-host", folder: "123" })
+				const empty = yield* Effect.flip(range("up"))
+				assert.instanceOf(empty, GcpLiveQueryUnavailableError)
+				assert.include(
+					empty.message,
+					"folders/123: Maple has not listed this connection's projects yet. They appear after its first resource sync.",
+				)
+
+				yield* Effect.promise(() =>
+					executeSql(testDb, "UPDATE gcp_connectors SET last_resources_error = $1 WHERE id = $2", [
+						"Cloud Asset Viewer is missing.",
+						FOLDER_CONNECTOR,
+					]),
+				)
+				const denied = yield* Effect.flip(range("up"))
+				assert.instanceOf(denied, GcpLiveQueryUnavailableError)
+				assert.include(
+					denied.message,
+					"folders/123: Maple could not list this connection's projects: Cloud Asset Viewer is missing.",
+				)
+
+				// A folder that synced and holds no active project is empty, not a failure.
+				yield* Effect.promise(() =>
+					executeSql(
+						testDb,
+						"UPDATE gcp_connectors SET last_resources_error = NULL, resources_synced_at = now() WHERE id = $1",
+						[FOLDER_CONNECTOR],
+					),
+				)
+				assert.deepStrictEqual(yield* range("up", { requireComplete: true }), [])
+				yield* Effect.promise(() =>
+					executeSql(testDb, "UPDATE gcp_connectors SET resources_synced_at = NULL WHERE id = $1", [
+						FOLDER_CONNECTOR,
+					]),
+				)
+
+				// Another connection still answers, unless every project must.
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const series = yield* range("up")
+				assert.deepStrictEqual(
+					series.map((one) => one.labels.project_id),
+					["acme-prod"],
+				)
+				assert.instanceOf(
+					yield* Effect.flip(range("up", { requireComplete: true })),
+					GcpLiveQueryUnavailableError,
+				)
+			}),
+		)
+	})
+
+	it.effect("reads only connections with metrics on, and is unavailable without one", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		const other = Schema.decodeSync(OrgId)(OTHER_ORG)
+		return run(
+			testDb,
+			calls,
+			{ promql: oneSeries },
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				yield* insertConnector(testDb, FOLDER_CONNECTOR, {
+					projectId: "acme-host",
+					folder: "123",
+					metricsOn: null,
+				})
+				yield* insertInventory(testDb, FOLDER_CONNECTOR, FOLDER_PROJECTS)
+				yield* insertConnector(testDb, OTHER_CONNECTOR, {
+					orgId: OTHER_ORG,
+					projectId: "rival-prod",
+					metricsOn: false,
+				})
+				const series = yield* range("up")
+				assert.deepStrictEqual(
+					series.map((one) => one.labels.project_id),
+					["acme-prod"],
+				)
+				assert.deepStrictEqual(calls.impersonate, [PROJECT_READER])
+
+				const error = yield* Effect.flip(
+					GcpLiveMetricsService.use((gcp) =>
+						gcp.queryRange(
+							{ orgId: other },
+							{ query: "up", startSeconds: T0, endSeconds: T0, stepSeconds: 60 },
+						),
+					),
+				)
+				assert.instanceOf(error, GcpLiveQueryUnavailableError)
+				assert.strictEqual(
+					error.message,
+					"Connect Google Cloud with metrics on to query Google Cloud metrics.",
+				)
+
+				// Switching metrics off stops live reads at once, before the setup removal runs.
+				yield* Effect.promise(() =>
+					executeSql(testDb, "UPDATE gcp_connectors SET metrics_enabled = false WHERE id = $1", [
+						PROJECT_CONNECTOR,
+					]),
+				)
+				assert.instanceOf(yield* Effect.flip(range("up")), GcpLiveQueryUnavailableError)
+			}),
+		)
+	})
+
+	it.effect("is unavailable without Maple's Google key, before any call", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{},
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const error = yield* Effect.flip(range("up"))
+				assert.instanceOf(error, GcpLiveQueryUnavailableError)
+				assert.strictEqual(
+					error.message,
+					"Google Cloud metrics are not available on this Maple deployment.",
+				)
+				assert.deepStrictEqual(calls, makeCalls())
+			}),
+			{ key: null },
+		)
+	})
+
+	it.effect("fails as worth a retry when Maple cannot sign in to Google, before any connection's", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{ oauth: () => googleError(500, "INTERNAL") },
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const error = yield* Effect.flip(range("up"))
+				assert.instanceOf(error, GcpLiveQueryFailedError)
+				assert.include(error.message, "Maple could not sign in to Google Cloud")
+				assert.deepStrictEqual(calls.impersonate, [])
+			}),
+		)
+	})
+
+	it.effect("fails as worth a retry when Maple cannot read its connections", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{},
+			Effect.gen(function* () {
+				yield* Effect.promise(() => executeSql(testDb, "DROP TABLE gcp_connectors CASCADE"))
+				const error = yield* Effect.flip(range("up"))
+				assert.instanceOf(error, GcpLiveQueryFailedError)
+				assert.strictEqual(
+					error.message,
+					"Maple could not read its Google Cloud connections. Try again in a few minutes.",
+				)
+			}),
+		)
+	})
+
+	it.effect("says a refusal of Maple's own project is Maple's, not the connection's setup", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{ impersonate: () => googleError(403, "PERMISSION_DENIED", "SERVICE_DISABLED") },
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const error = yield* Effect.flip(range("up"))
+				assert.instanceOf(error, GcpLiveQueryFailedError)
+				assert.strictEqual(
+					error.failures[0]?.message,
+					"Maple's request to Google's IAM Credentials API failed. Try again in a few minutes. If this repeats, write to support@maple.dev. (IAM Credentials returned 403 PERMISSION_DENIED, SERVICE_DISABLED)",
+				)
+			}),
+		)
+	})
+
+	it.effect("tells a connection whose grant is missing what to do, and reads the rest", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{
+				impersonate: (account) => (account === FOLDER_READER ? denied() : undefined),
+				promql: oneSeries,
+			},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				const series = yield* range("up")
+				assert.deepStrictEqual(
+					series.map((one) => one.labels.project_id),
+					["acme-prod"],
+				)
+				const error = yield* Effect.flip(range("up", { projects: ["acme-shop"] }))
+				assert.instanceOf(error, GcpLiveQueryUnavailableError)
+				assert.include(error.message, "folders/123: ")
+				assert.include(error.message, "run the setup script again")
+			}),
+		)
+	})
+
+	it.effect("signs in once and reuses the tokens for later queries", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				yield* range("up")
+				yield* range("down")
+				assert.strictEqual(calls.oauth, 1)
+				assert.sameMembers(calls.impersonate, [PROJECT_READER, FOLDER_READER])
+				// Each project's metrics scope is read once an hour, not per query.
+				assert.lengthOf(calls.scopes, 3)
+				// Answers are not cached: each query reads Google.
+				assert.lengthOf(calls.promql, 6)
+
+				// Ten minutes on, both tokens have expired.
+				yield* TestClock.adjust("10 minutes")
+				yield* range("sideways")
+				assert.strictEqual(calls.oauth, 2)
+				assert.lengthOf(calls.impersonate, 4)
+			}),
+		)
+	})
+})
+
+describe("GcpLiveMetricsService.queryInstant", () => {
+	it.effect("reads one point per series, and fails on an answer that is not a vector", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		const instant = (query: string) =>
+			GcpLiveMetricsService.use((gcp) => gcp.queryInstant(TENANT, { query, timeSeconds: T0 }))
+		return run(
+			testDb,
+			calls,
+			{
+				promql: (call) =>
+					call.params.query === "up"
+						? json({
+								status: "success",
+								data: {
+									resultType: "vector",
+									result: [
+										{ metric: { project_id: "acme-prod", zone: "a" }, value: [T0, "4"] },
+									],
+								},
+							})
+						: json({ status: "success", data: { resultType: "scalar", result: [T0, "2"] } }),
+			},
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				assert.deepStrictEqual(yield* instant("up"), [
+					{ labels: { project_id: "acme-prod", zone: "a" }, points: [[T0, 4]] },
+				])
+				assert.strictEqual(calls.promql[0]!.path, "query")
+				assert.deepInclude(calls.promql[0]!.params, { query: "up", time: String(T0) })
+
+				const scalar = yield* Effect.flip(instant("1 + 1"))
+				assert.instanceOf(scalar, GcpLiveQueryFailedError)
+				assert.include(scalar.failures[0]?.message ?? "", "answered with an unexpected body")
+			}),
+		)
+	})
+})
+
+const descriptor = (type: string, extra: Record<string, unknown> = {}) => ({
+	type,
+	metricKind: "GAUGE",
+	valueType: "DOUBLE",
+	unit: "1",
+	description: `${type} description`,
+	...extra,
+})
+
+const CPU = "cloudsql.googleapis.com/database/cpu/utilization"
+
+describe("GcpLiveMetricsService.listMetrics", () => {
+	it.effect("lists the active metrics of every project, merged per type, and caches them", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		const list = (scope: { projects?: ReadonlyArray<string> } = {}) =>
+			GcpLiveMetricsService.use((gcp) => gcp.listMetrics(TENANT, scope))
+		return run(
+			testDb,
+			calls,
+			{
+				descriptors: (project, pageToken) => {
+					if (project === "acme-prod") {
+						return pageToken === ""
+							? json({
+									metricDescriptors: [
+										descriptor(CPU, {
+											monitoredResourceTypes: ["cloudsql_database"],
+											labels: [{ key: "database", description: "The database." }],
+										}),
+										// A logging metric: Google lists no resource types.
+										descriptor("logging.googleapis.com/user/checkout_errors", {
+											metricKind: "DELTA",
+											valueType: "INT64",
+											labels: [{ key: "severity" }],
+										}),
+									],
+									nextPageToken: "page-2",
+								})
+							: json({
+									metricDescriptors: [
+										descriptor("run.googleapis.com/request_latencies", {
+											metricKind: "DELTA",
+											valueType: "DISTRIBUTION",
+											monitoredResourceTypes: ["cloud_run_revision"],
+										}),
+									],
+								})
+					}
+					if (project === "acme-shop") {
+						return json({
+							metricDescriptors: [
+								descriptor(CPU, {
+									monitoredResourceTypes: [
+										"cloudsql_instance_database",
+										"cloudsql_database",
+									],
+									labels: [{ key: "replica" }, { key: "database" }],
+								}),
+								// A kind Google leaves unspecified is not a metric Maple can query.
+								descriptor("custom.googleapis.com/odd", {
+									metricKind: "METRIC_KIND_UNSPECIFIED",
+								}),
+							],
+						})
+					}
+					return denied()
+				},
+			},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				const metrics = yield* list()
+				assert.deepStrictEqual(metrics, [
+					{
+						type: CPU,
+						metricKind: "GAUGE",
+						valueType: "DOUBLE",
+						unit: "1",
+						description: `${CPU} description`,
+						monitoredResourceTypes: ["cloudsql_database", "cloudsql_instance_database"],
+						labels: ["database", "replica"],
+					},
+					{
+						type: "logging.googleapis.com/user/checkout_errors",
+						metricKind: "DELTA",
+						valueType: "INT64",
+						unit: "1",
+						description: "logging.googleapis.com/user/checkout_errors description",
+						monitoredResourceTypes: [],
+						labels: ["severity"],
+					},
+					{
+						type: "run.googleapis.com/request_latencies",
+						metricKind: "DELTA",
+						valueType: "DISTRIBUTION",
+						unit: "1",
+						description: "run.googleapis.com/request_latencies description",
+						monitoredResourceTypes: ["cloud_run_revision"],
+						labels: [],
+					},
+				])
+				assert.sameMembers(calls.descriptors, [
+					"acme-prod",
+					"acme-prod page-2",
+					"acme-shop",
+					"acme-data",
+				])
+
+				// From the cache, and only the projects a project_id filter names.
+				const shop = yield* list({ projects: ["acme-shop"] })
+				assert.deepStrictEqual(
+					shop.map((metric) => metric.type),
+					[CPU],
+				)
+				assert.lengthOf(calls.descriptors, 4)
+
+				// acme-data failed and is not cached: it is read again, and an alert's listing fails on it.
+				const error = yield* Effect.flip(
+					GcpLiveMetricsService.use((gcp) => gcp.listMetrics(TENANT, { requireComplete: true })),
+				)
+				assert.instanceOf(error, GcpLiveQueryUnavailableError)
+				assert.include(error.message, "projects/acme-data")
+				assert.lengthOf(calls.descriptors, 5)
+			}),
+		)
+	})
+
+	it.effect("lists the first 20 projects for discovery, and refuses more for a query's lookup", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		const many = Array.from({ length: 25 }, (_, index) => [`acme-team-${index + 10}`, "ACTIVE"] as const)
+		return run(
+			testDb,
+			calls,
+			{
+				descriptors: (project) =>
+					json({ metricDescriptors: project === "acme-team-34" ? [descriptor(CPU)] : [] }),
+			},
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, FOLDER_CONNECTOR, { projectId: "acme-host", folder: "123" })
+				yield* insertInventory(testDb, FOLDER_CONNECTOR, many)
+				// The metrics list reads the first 20 projects only.
+				assert.deepStrictEqual(
+					yield* GcpLiveMetricsService.use((gcp) => gcp.listMetrics(TENANT, { discovery: true })),
+					[],
+				)
+				assert.lengthOf(calls.descriptors, 20)
+				// A query's lookup selects like the query: it would miss acme-team-34, so it is refused.
+				const refused = yield* Effect.flip(
+					GcpLiveMetricsService.use((gcp) => gcp.listMetrics(TENANT, {})),
+				)
+				assert.instanceOf(refused, GcpLiveQueryRejectedError)
+				assert.strictEqual(refused.reason, "too_many_projects")
+				const named = yield* GcpLiveMetricsService.use((gcp) =>
+					gcp.listMetrics(TENANT, { projects: ["acme-team-34"] }),
+				)
+				assert.deepStrictEqual(
+					named.map((metric) => metric.type),
+					[CPU],
+				)
+			}),
+		)
+	})
+
+	it.effect("fails the listing only when no project answered", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		return run(
+			testDb,
+			calls,
+			{ descriptors: rateLimited },
+			Effect.gen(function* () {
+				yield* insertConnector(testDb, PROJECT_CONNECTOR)
+				const error = yield* Effect.flip(
+					GcpLiveMetricsService.use((gcp) => gcp.listMetrics(TENANT, {})),
+				)
+				assert.instanceOf(error, GcpLiveQueryFailedError)
+				assert.deepStrictEqual(
+					error.failures.map((failure) => failure.scope),
+					["projects/acme-prod"],
+				)
+			}),
+		)
+	})
+})
+
+describe("GcpLiveMetricsService.listResourceTypes", () => {
+	it.effect("reads Google's resource types from the first project that answers, cached a day", () => {
+		const testDb = createTestDb(trackedDbs)
+		const calls = makeCalls()
+		const types = () => GcpLiveMetricsService.use((gcp) => gcp.listResourceTypes(TENANT, {}))
+		return run(
+			testDb,
+			calls,
+			{
+				resourceTypes: (project, pageToken) =>
+					project === "acme-data"
+						? denied()
+						: pageToken === ""
+							? json({
+									resourceDescriptors: [
+										{
+											type: "cloudsql_database",
+											labels: [
+												{ key: "project_id" },
+												{ key: "database_id" },
+												{ key: "region" },
+											],
+										},
+									],
+									nextPageToken: "page-2",
+								})
+							: json({ resourceDescriptors: [{ type: "global" }] }),
+			},
+			Effect.gen(function* () {
+				yield* insertConnectors(testDb)
+				const expected = [
+					{ type: "cloudsql_database", labels: ["project_id", "database_id", "region"] },
+					{ type: "global", labels: [] },
+				]
+				// acme-data comes first and is refused; acme-prod answers for every project.
+				assert.deepStrictEqual(yield* types(), expected)
+				assert.deepStrictEqual(calls.resourceTypes, ["acme-data", "acme-prod", "acme-prod page-2"])
+
+				yield* TestClock.adjust("23 hours")
+				assert.deepStrictEqual(yield* types(), expected)
+				assert.lengthOf(calls.resourceTypes, 4)
+			}),
+		)
+	})
+})
diff --git a/packages/backend/src/services/integrations/GcpLiveMetricsService.ts b/packages/backend/src/services/integrations/GcpLiveMetricsService.ts
new file mode 100644
index 0000000000..0d3e5a69e7
--- /dev/null
+++ b/packages/backend/src/services/integrations/GcpLiveMetricsService.ts
@@ -0,0 +1,607 @@
+/**
+ * Google Cloud Monitoring metrics, read live through Google's Prometheus-compatible API: the query
+ * engine's `GcpLiveMetrics` port. A connection with metrics on (its read-only account in place)
+ * is a target: a project scope is its project, a folder or organization the active projects its
+ * last inventory sync found. Each project is read with its connection's read-only account, one
+ * call per metrics scope. What answered is returned, unless the read requires every project.
+ */
+import * as PG from "@maple-dev/effect-orm/postgres"
+import { EdgeCacheService } from "@maple/cache"
+import { GcpConnectors, GcpResources, type GcpConnectorRow } from "@maple/db/tables"
+import {
+	GcpMetricDescriptor,
+	GcpMonitoredResourceType,
+	type GcpPromQlSeries,
+} from "@maple/domain/gcp-live-metrics"
+import { GCP_PROJECT_ASSET_TYPE } from "@maple/domain/gcp-metrics"
+import {
+	GCP_LIVE_METRICS_NOT_AVAILABLE,
+	GcpLiveQueryFailedError,
+	GcpLiveQueryRejectedError,
+	GcpLiveQueryUnavailableError,
+} from "@maple/domain/http/gcp-live-query-errors"
+import { GcpProjectId, type OrgId } from "@maple/domain/primitives"
+import type { GcpLiveMetrics, GcpReadScope, QueryTenant } from "@maple/query-engine/runtime"
+import { Clock, Context, Effect, Layer, Option, Redacted, Schema } from "effect"
+import { FetchHttpClient, HttpClient } from "effect/http"
+import { Database } from "@maple/backend/platform/DatabaseLive"
+import { makeDbExecute } from "@maple/backend/platform/db-execute"
+import { Env } from "@maple/backend/platform/Env"
+import {
+	fetchMapleAccessToken,
+	getMetricsScope,
+	type GcpApiError,
+	type GcpPromQlParams,
+	type GcpReader,
+	importServiceAccountKey,
+	impersonateReader,
+	listActiveMetricDescriptorsPage,
+	listMonitoredResourceTypesPage,
+	MetricsScope,
+	promQlQuery,
+} from "./gcp/api"
+import { describeGcpApiError } from "./gcp/explain"
+
+/** Google's tokens live 600 s. Three minutes to spare outlast the slowest fan-out. */
+const TOKEN_REUSE_MS = 7 * 60_000
+const CONCURRENCY = 4
+/** The engine has no project picker: past this a query must filter on `project_id`. */
+const MAX_PROJECTS = 20
+/** Series Google returns across a query's projects. */
+const MAX_SERIES = 500
+/** Pages a listing reads: 10,000 metric descriptors a page, which a project rarely fills. */
+const MAX_LIST_PAGES = 5
+const HOUR_SECONDS = 3_600
+/** Google's resource types change with its releases, not with the project. */
+const DAY_SECONDS = 86_400
+/** Above the default: a miss here costs a Google call, not a row lookup. */
+const CACHE_READ_TIMEOUT_MS = 250
+const API_ERROR = "@maple/api/integrations/GcpApiError"
+
+const isProjectId = Schema.is(GcpProjectId)
+
+type Connector = Pick<
+	GcpConnectorRow,
+	| "id"
+	| "scopeType"
+	| "scopeId"
+	| "projectId"
+	| "lastMetricsReceivedAt"
+	| "lastResourcesError"
+	| "resourcesSyncedAt"
+>
+type Port = GcpLiveMetrics<QueryTenant>
+interface Target {
+	readonly projectId: GcpProjectId
+	readonly connector: Connector
+}
+
+const scopeName = (connector: Connector) => `${connector.scopeType}s/${connector.scopeId}`
+
+/**
+ * A connection or project that could not be read. `transient`: Google did not answer.
+ * `refusal`: Google would not finish the query (422 `execution`). `setup`: anything a retry
+ * does not fix (a missing role, API or billing account, projects not listed yet).
+ */
+interface Failure {
+	readonly scope: string
+	readonly message: string
+	readonly cause: "transient" | "refusal" | "setup"
+}
+
+const causeOf = (error: GcpApiError): Failure["cause"] =>
+	error.kind === "rate_limited" || error.kind === "upstream"
+		? "transient"
+		: error.kind === "invalid" && error.reason === "QUERY_EXECUTION"
+			? "refusal"
+			: "setup"
+
+/** A `catchTag` handler that records a Google failure and goes on without the answer. */
+const recordFailure =
+	(failures: Array<Failure>, scope: string, connector: Connector) => (error: GcpApiError) => {
+		failures.push({
+			scope,
+			message: describeGcpApiError(error, connector, "live"),
+			cause: causeOf(error),
+		})
+		return Effect.succeed(undefined)
+	}
+
+/**
+ * A read that failed. Worth a retry only when Google did not answer; a query Google would not
+ * finish is the caller's to narrow; anything else (a missing role, API or billing account) is
+ * setup that no retry fixes.
+ */
+const readFailed = (failures: ReadonlyArray<Failure>) => {
+	const text = `Google Cloud could not be read. ${failures.map((failure) => `${failure.scope}: ${failure.message}`).join(" ")}`
+	if (failures.every((failure) => failure.cause === "transient")) {
+		return new GcpLiveQueryFailedError({
+			message: text,
+			failures: failures.map(({ scope, message }) => ({ scope, message })),
+		})
+	}
+	if (failures.every((failure) => failure.cause !== "setup")) {
+		return new GcpLiveQueryRejectedError({ message: text, reason: "invalid_query" })
+	}
+	return new GcpLiveQueryUnavailableError({ message: text })
+}
+
+/** Partial answers have no warnings channel: the failures go to the span and the log. */
+const logFailures = (failures: ReadonlyArray<Failure>) => {
+	const [first] = failures
+	return first === undefined
+		? Effect.void
+		: Effect.annotateCurrentSpan({
+				"maple.gcp.failed_projects": failures.length,
+				"maple.gcp.failure": first.message,
+			}).pipe(
+				Effect.andThen(
+					Effect.logWarning("gcp live read failed in part", {
+						failures: failures.map(({ scope, message }) => ({ scope, message })),
+					}),
+				),
+			)
+}
+
+const mapleSignInFailed = () =>
+	new GcpLiveQueryFailedError({
+		message:
+			"Maple could not sign in to Google Cloud. Try again in a few minutes. If this repeats, write to support@maple.dev.",
+		failures: [],
+	})
+
+/** A folder or organization not synced yet, or whose sync failed: nothing to read it by. */
+const unlisted = (connector: Connector): Failure => ({
+	scope: scopeName(connector),
+	message:
+		connector.lastResourcesError === null
+			? "Maple has not listed this connection's projects yet. They appear after its first resource sync."
+			: `Maple could not list this connection's projects: ${connector.lastResourcesError}`,
+	cause: "setup",
+})
+
+/**
+ * The targets a read covers: the projects it names when each is a target, else all of them, with
+ * the connections whose projects are not known. A project reached only through another's
+ * metrics scope is read through that one, and the query's `project_id` matcher keeps it alone.
+ * Past `MAX_PROJECTS` a query must name its projects; discovery reads the first ones instead.
+ */
+const selectTargets = (
+	all: { readonly targets: ReadonlyArray<Target>; readonly unlisted: ReadonlyArray<Failure> },
+	scope: GcpReadScope,
+): Effect.Effect<
+	{ readonly targets: ReadonlyArray<Target>; readonly failures: ReadonlyArray<Failure> },
+	GcpLiveQueryRejectedError
+> => {
+	const requested = scope.projects
+	const known = new Set<string>(all.targets.map((target) => target.projectId))
+	if (requested !== undefined && requested.every((projectId) => known.has(projectId))) {
+		const named = all.targets.filter((target) => requested.includes(target.projectId))
+		return Effect.succeed({ targets: named, failures: [] })
+	}
+	if (all.targets.length <= MAX_PROJECTS || scope.discovery) {
+		return Effect.succeed({ targets: all.targets.slice(0, MAX_PROJECTS), failures: all.unlisted })
+	}
+	const outside = requested?.filter((projectId) => !known.has(projectId)) ?? []
+	const examples = all.targets
+		.slice(0, 5)
+		.map((target) => target.projectId)
+		.join(", ")
+	return Effect.fail(
+		new GcpLiveQueryRejectedError({
+			message:
+				outside.length > 0
+					? `The project_id filter names ${outside.join(", ")}, which no connection reads as its own project (it is reached through a metrics scope), so Maple cannot narrow the read to it, and the connections reach ${all.targets.length} projects, more than the ${MAX_PROJECTS} one query reads. Filter on the projects whose metrics scopes hold it instead.`
+					: `The Google Cloud connections reach ${all.targets.length} projects, and one query reads at most ${MAX_PROJECTS}. Filter on project_id to choose them, e.g. ${examples}.`,
+			reason: "too_many_projects",
+		}),
+	)
+}
+
+/** Every project's descriptors as one list: a type's resource types and labels are the union. */
+const mergeDescriptors = (lists: ReadonlyArray<ReadonlyArray<GcpMetricDescriptor>>) => {
+	const merged = new Map<
+		string,
+		{ first: GcpMetricDescriptor; resources: Set<string>; labels: Set<string> }
+	>()
+	for (const descriptor of lists.flat()) {
+		const entry = merged.get(descriptor.type)
+		if (entry === undefined) {
+			merged.set(descriptor.type, {
+				first: descriptor,
+				resources: new Set(descriptor.monitoredResourceTypes),
+				labels: new Set(descriptor.labels),
+			})
+			continue
+		}
+		for (const resource of descriptor.monitoredResourceTypes) entry.resources.add(resource)
+		for (const label of descriptor.labels) entry.labels.add(label)
+	}
+	return [...merged.values()]
+		.map(({ first, resources, labels }): GcpMetricDescriptor => ({
+			...first,
+			monitoredResourceTypes: [...resources].sort(),
+			labels: [...labels].sort(),
+		}))
+		.sort((a, b) => a.type.localeCompare(b.type))
+}
+
+export class GcpLiveMetricsService extends Context.Service<GcpLiveMetricsService, Port>()(
+	"@maple/api/services/GcpLiveMetricsService",
+	{
+		make: Effect.gen(function* () {
+			const database = yield* Database
+			const env = yield* Env
+			const httpClient = yield* HttpClient.HttpClient
+			const edgeCache = yield* EdgeCacheService
+			const dbExecute = makeDbExecute(
+				database,
+				"GcpLiveMetricsService",
+				() =>
+					new GcpLiveQueryFailedError({
+						message:
+							"Maple could not read its Google Cloud connections. Try again in a few minutes.",
+						failures: [],
+					}),
+			)
+
+			const signingKey = Option.match(env.MAPLE_GCP_SERVICE_ACCOUNT_KEY, {
+				onNone: () =>
+					Effect.fail(
+						new GcpLiveQueryUnavailableError({ message: GCP_LIVE_METRICS_NOT_AVAILABLE }),
+					),
+				onSome: Effect.succeed,
+			})
+
+			// Tokens are kept for the isolate's lifetime. Only settled values are kept: a pending
+			// sign-in shared across requests would resume in another request's I/O context.
+			let mapleToken: { readonly token: Redacted.Redacted<string>; readonly until: number } | undefined
+			const readers = new Map<Connector["id"], { readonly reader: GcpReader; readonly until: number }>()
+
+			/** A connector's reader. Its own failure is a `GcpApiError`; Maple's sign-in fails the query. */
+			const readerFor = Effect.fnUntraced(function* (
+				key: Redacted.Redacted<string>,
+				connector: Connector,
+			) {
+				const now = yield* Clock.currentTimeMillis
+				const cached = readers.get(connector.id)
+				if (cached !== undefined && cached.until > now) return cached.reader
+				if (mapleToken === undefined || mapleToken.until <= now) {
+					const token = yield* importServiceAccountKey(key).pipe(
+						Effect.flatMap((signer) => fetchMapleAccessToken(httpClient, signer, now)),
+						Effect.tapError((error) =>
+							Effect.logError("gcp sign-in as Maple failed", { error: error.message }),
+						),
+						Effect.mapError(mapleSignInFailed),
+					)
+					mapleToken = { token, until: now + TOKEN_REUSE_MS }
+				}
+				const reader = yield* impersonateReader(httpClient, mapleToken.token, connector)
+				readers.set(connector.id, { reader, until: now + TOKEN_REUSE_MS })
+				return reader
+			})
+
+			/**
+			 * Every project the org's metrics-on connections reach, each with the connection that reads
+			 * it, by id, and the folders and organizations with no project listed.
+			 */
+			const targetsOf = Effect.fnUntraced(function* (orgId: OrgId) {
+				const connectors = yield* dbExecute((db) =>
+					db.run(
+						PG.from(GcpConnectors)
+							.select(
+								"id",
+								"scopeType",
+								"scopeId",
+								"projectId",
+								"lastMetricsReceivedAt",
+								"lastResourcesError",
+								"resourcesSyncedAt",
+							)
+							.where(($) => [
+								$.orgId.eq(orgId),
+								$.metricsEnabled.eq(true),
+								$.appliedMetricsEnabled.eq(true),
+							])
+							.orderBy(($) => [
+								[$.createdAt, "asc"],
+								[$.id, "asc"],
+							]),
+					),
+				)
+				if (connectors.length === 0) {
+					return yield* new GcpLiveQueryUnavailableError({
+						message: "Connect Google Cloud with metrics on to query Google Cloud metrics.",
+					})
+				}
+				const folders = connectors.filter((connector) => connector.scopeType !== "project")
+				// A project pending deletion answers nothing but errors.
+				const inventory =
+					folders.length === 0
+						? []
+						: yield* dbExecute((db) =>
+								db.run(
+									PG.from(GcpResources)
+										.select("connectorId", "projectId")
+										.where(($) => [
+											$.connectorId.in_(...folders.map((connector) => connector.id)),
+											$.assetType.eq(GCP_PROJECT_ASSET_TYPE),
+											PG.or($.state.isNull(), $.state.eq("ACTIVE")),
+										]),
+								),
+							)
+				// Overlapping connections read a project through the oldest.
+				const targets = new Map<string, Target>()
+				const notListed: Array<Failure> = []
+				for (const connector of connectors) {
+					const projectIds =
+						connector.scopeType === "project"
+							? [connector.projectId]
+							: inventory
+									.filter((row) => row.connectorId === connector.id)
+									.map((row) => row.projectId)
+					// A synced folder with no active project is just empty.
+					const unsynced =
+						connector.resourcesSyncedAt === null || connector.lastResourcesError !== null
+					if (projectIds.length === 0 && unsynced) notListed.push(unlisted(connector))
+					for (const projectId of projectIds) {
+						if (isProjectId(projectId) && !targets.has(projectId))
+							targets.set(projectId, { projectId, connector })
+					}
+				}
+				return {
+					targets: [...targets.values()].sort((a, b) => a.projectId.localeCompare(b.projectId)),
+					unlisted: notListed,
+				}
+			})
+
+			/** Signs each connection in once, so one that cannot fails once, not once per project. */
+			const signIn = Effect.fnUntraced(function* (
+				key: Redacted.Redacted<string>,
+				targets: ReadonlyArray<Target>,
+				failures: Array<Failure>,
+			) {
+				const signedIn = new Map<Connector, GcpReader | undefined>()
+				for (const connector of new Set(targets.map((target) => target.connector))) {
+					signedIn.set(
+						connector,
+						yield* readerFor(key, connector).pipe(
+							Effect.catchTag(
+								API_ERROR,
+								recordFailure(failures, scopeName(connector), connector),
+							),
+						),
+					)
+				}
+				return targets.flatMap((target) => {
+					const reader = signedIn.get(target.connector)
+					return reader === undefined ? [] : [{ ...target, reader }]
+				})
+			})
+
+			const runQuery = Effect.fnUntraced(function* (
+				orgId: OrgId,
+				options: GcpReadScope,
+				params: GcpPromQlParams,
+			) {
+				const key = yield* signingKey
+				const selected = yield* selectTargets(yield* targetsOf(orgId), options)
+				yield* Effect.annotateCurrentSpan({ "maple.gcp.project_count": selected.targets.length })
+				const failures: Array<Failure> = [...selected.failures]
+				const signedIn = yield* signIn(key, selected.targets, failures)
+
+				// A query on a project reads its whole metrics scope, so a target whose whole scope wider
+				// ones already read is answered through them, not read again. Partly covered scopes are
+				// read; the engine drops the series two scopes both return.
+				const scoped = yield* Effect.forEach(
+					signedIn,
+					(target) =>
+						edgeCache
+							.getOrCompute(
+								{
+									bucket: "gcp-metrics-scopes",
+									key: `${orgId}:${target.projectId}`,
+									ttlSeconds: HOUR_SECONDS,
+									readTimeoutMs: CACHE_READ_TIMEOUT_MS,
+									schema: MetricsScope,
+								},
+								getMetricsScope(httpClient, target.reader, target.projectId),
+							)
+							.pipe(
+								Effect.map(({ value }) => ({ ...target, scope: value })),
+								Effect.catchTag(
+									API_ERROR,
+									recordFailure(failures, `projects/${target.projectId}`, target.connector),
+								),
+							),
+					{ concurrency: CONCURRENCY },
+				)
+				const covered = new Set<string>()
+				const reads = scoped
+					.filter((target) => target !== undefined)
+					// Widest scopes first.
+					.sort((a, b) => b.scope.monitored.length - a.scope.monitored.length)
+					.filter((target) => {
+						if (target.scope.monitored.every((number) => covered.has(number))) return false
+						for (const number of target.scope.monitored) covered.add(number)
+						return true
+					})
+
+				let seriesCount = 0
+				const answers = yield* Effect.forEach(
+					reads,
+					(read) =>
+						promQlQuery(httpClient, read.reader, read.projectId, params).pipe(
+							// Checked as each project answers, so a broad query stops early.
+							Effect.flatMap((series) => {
+								seriesCount += series.length
+								return seriesCount > MAX_SERIES
+									? Effect.fail(
+											new GcpLiveQueryRejectedError({
+												message: `The query returned more than ${MAX_SERIES} series across its projects. Narrow the query or group by fewer labels.`,
+												reason: "too_many_series",
+											}),
+										)
+									: Effect.succeed({ read, series })
+							}),
+							Effect.catchTag(
+								API_ERROR,
+								recordFailure(failures, `projects/${read.projectId}`, read.connector),
+							),
+						),
+					{ concurrency: CONCURRENCY },
+				)
+				const answered = answers.filter((answer) => answer !== undefined)
+				yield* logFailures(failures)
+				if (failures.length > 0 && (options.requireComplete || answered.length === 0)) {
+					return yield* readFailed(failures)
+				}
+				const series = answered.flatMap(({ read, series }) =>
+					series.map((one): GcpPromQlSeries => ({
+						// A scope of several projects names itself, not a project its series may not come from.
+						labels:
+							one.labels.project_id === undefined
+								? {
+										...one.labels,
+										[read.scope.monitored.length > 1 ? "metrics_scope" : "project_id"]:
+											read.projectId,
+									}
+								: one.labels,
+						points: one.points,
+					})),
+				)
+				yield* Effect.annotateCurrentSpan({ "maple.gcp.series_count": series.length })
+				return series
+			})
+
+			/** Every page of a project's listing, at most `MAX_LIST_PAGES`. */
+			const listAll = Effect.fnUntraced(function* <A>(
+				listPage: (
+					httpClient: HttpClient.HttpClient,
+					reader: GcpReader,
+					projectId: GcpProjectId,
+					pageToken: string | undefined,
+				) => Effect.Effect<
+					{ readonly items: ReadonlyArray<A>; readonly nextPageToken?: string | undefined },
+					GcpApiError
+				>,
+				reader: GcpReader,
+				projectId: GcpProjectId,
+			) {
+				const items: Array<A> = []
+				let pageToken: string | undefined
+				for (let page = 0; page < MAX_LIST_PAGES; page++) {
+					const body = yield* listPage(httpClient, reader, projectId, pageToken)
+					items.push(...body.items)
+					pageToken = body.nextPageToken
+					if (pageToken === undefined) break
+				}
+				return items
+			})
+
+			return {
+				queryRange: Effect.fn("GcpLiveMetricsService.queryRange")(function* (
+					tenant: QueryTenant,
+					request: Parameters<Port["queryRange"]>[1],
+				) {
+					return yield* runQuery(tenant.orgId, request, {
+						query: request.query,
+						start: request.startSeconds,
+						end: request.endSeconds,
+						step: request.stepSeconds,
+					})
+				}),
+				queryInstant: Effect.fn("GcpLiveMetricsService.queryInstant")(function* (
+					tenant: QueryTenant,
+					request: Parameters<Port["queryInstant"]>[1],
+				) {
+					return yield* runQuery(tenant.orgId, request, {
+						query: request.query,
+						time: request.timeSeconds,
+					})
+				}),
+				listMetrics: Effect.fn("GcpLiveMetricsService.listMetrics")(function* (
+					tenant: QueryTenant,
+					options: GcpReadScope,
+				) {
+					const key = yield* signingKey
+					const selected = yield* selectTargets(yield* targetsOf(tenant.orgId), options)
+					yield* Effect.annotateCurrentSpan({ "maple.gcp.project_count": selected.targets.length })
+					const failures: Array<Failure> = [...selected.failures]
+					const signedIn = yield* signIn(key, selected.targets, failures)
+					const listed = yield* Effect.forEach(
+						signedIn,
+						(target) =>
+							edgeCache
+								.getOrCompute(
+									{
+										bucket: "gcp-metric-descriptors",
+										key: `${tenant.orgId}:${target.projectId}`,
+										ttlSeconds: HOUR_SECONDS,
+										readTimeoutMs: CACHE_READ_TIMEOUT_MS,
+										schema: Schema.Array(GcpMetricDescriptor),
+									},
+									listAll(listActiveMetricDescriptorsPage, target.reader, target.projectId),
+								)
+								.pipe(
+									Effect.map(({ value }) => value),
+									Effect.catchTag(
+										API_ERROR,
+										recordFailure(
+											failures,
+											`projects/${target.projectId}`,
+											target.connector,
+										),
+									),
+								),
+						{ concurrency: CONCURRENCY },
+					)
+					const lists = listed.filter((list) => list !== undefined)
+					yield* logFailures(failures)
+					if (failures.length > 0 && (options.requireComplete || lists.length === 0)) {
+						return yield* readFailed(failures)
+					}
+					return mergeDescriptors(lists)
+				}),
+				listResourceTypes: Effect.fn("GcpLiveMetricsService.listResourceTypes")(function* (
+					tenant: QueryTenant,
+					options: GcpReadScope,
+				) {
+					const key = yield* signingKey
+					const selected = yield* selectTargets(yield* targetsOf(tenant.orgId), options)
+					const failures: Array<Failure> = [...selected.failures]
+					const signedIn = yield* signIn(key, selected.targets, failures)
+					// The types are Google's, the same in every project: the first project that answers speaks.
+					for (const target of signedIn) {
+						const types = yield* edgeCache
+							.getOrCompute(
+								{
+									bucket: "gcp-resource-types",
+									key: `${tenant.orgId}:${target.projectId}`,
+									ttlSeconds: DAY_SECONDS,
+									readTimeoutMs: CACHE_READ_TIMEOUT_MS,
+									schema: Schema.Array(GcpMonitoredResourceType),
+								},
+								listAll(listMonitoredResourceTypesPage, target.reader, target.projectId),
+							)
+							.pipe(
+								Effect.map(({ value }) => value),
+								Effect.catchTag(
+									API_ERROR,
+									recordFailure(failures, `projects/${target.projectId}`, target.connector),
+								),
+							)
+						if (types !== undefined) {
+							yield* logFailures(failures)
+							return types
+						}
+					}
+					yield* logFailures(failures)
+					return failures.length > 0 ? yield* readFailed(failures) : []
+				}),
+			} satisfies Port
+		}),
+	},
+) {
+	static readonly layer = Layer.effect(this, this.make).pipe(Layer.provide(FetchHttpClient.layer))
+}
diff --git a/packages/backend/src/services/integrations/GcpMetricsService.test.ts b/packages/backend/src/services/integrations/GcpMetricsService.test.ts
index 26d3fcd29c..db2b1b2884 100644
--- a/packages/backend/src/services/integrations/GcpMetricsService.test.ts
+++ b/packages/backend/src/services/integrations/GcpMetricsService.test.ts
@@ -1117,13 +1117,14 @@ describe("GcpMetricsService", () => {
 				yield* pollAll
 				assert.strictEqual(yield* metricsError, READ_DENIED)
 
-				// Signing in as the reader does not go through the host project.
+				// Signing in as the reader does not go through the host project: a refusal for
+				// Maple's own project is Maple's to fix, not the connection's setup.
 				impersonate = () => googleError(403, "PERMISSION_DENIED", [errorInfo("SERVICE_DISABLED")])
 				yield* TestClock.setTime(now + 15 * minute)
 				yield* pollAll
 				assert.strictEqual(
 					yield* metricsError,
-					CANNOT_SIGN_IN.replace("DENIED)", "DENIED, SERVICE_DISABLED)"),
+					"Maple's request to Google's IAM Credentials API failed. Maple retries in 5 minutes. If this repeats, write to support@maple.dev. (IAM Credentials returned 403 PERMISSION_DENIED, SERVICE_DISABLED)",
 				)
 
 				// Details of another form cost neither the status code nor the poll.
diff --git a/packages/backend/src/services/integrations/GcpMetricsService.ts b/packages/backend/src/services/integrations/GcpMetricsService.ts
index 425bdb28ec..dc29ea0948 100644
--- a/packages/backend/src/services/integrations/GcpMetricsService.ts
+++ b/packages/backend/src/services/integrations/GcpMetricsService.ts
@@ -44,6 +44,7 @@ import {
 	type GcpTimeSeriesQuery,
 } from "./gcp/api"
 import { gcpSqlSettings } from "./gcp/cloud-sql"
+import { describeGcpApiError, RETRIES } from "./gcp/explain"
 import {
 	gcpTopKey,
 	gcpTopSeries,
@@ -116,7 +117,6 @@ const halts = (outcome: ReadOutcome) =>
 
 const SYSTEM_USER_ID = Schema.decodeUnknownSync(UserId)("system-gcp-metrics")
 
-const RETRIES = "Maple retries in 5 minutes."
 const NOT_STORED = `${RETRIES} Nothing to do.`
 
 /** What helps a scope too large for one read. A project has no parts to connect instead. */
@@ -125,50 +125,6 @@ const whenTooLarge = (connector: GcpConnectorRow) =>
 		? "write to support@maple.dev"
 		: "connect its folders or projects separately"
 
-/** Why a failed call failed and what to do about it, in the customer's terms. */
-const explainApiError = (
-	error: GcpApiError,
-	connector: GcpConnectorRow,
-	reading: "metrics" | "resources",
-) => {
-	// The host project is the one Google checks for billing, enabled APIs and quota. A project
-	// scope is its own host, and reads as "the project".
-	const host = `${connector.scopeType === "project" ? "project" : "host project"} ${connector.projectId}`
-	const scope = `${connector.scopeType} ${connector.scopeId}`
-	if (error.reason === "BILLING_DISABLED") {
-		return `The ${host} has no active billing account, and ${error.api} only answers for projects that have one. Link one: https://console.cloud.google.com/billing/linkedaccount?project=${connector.projectId} Maple retries every 5 minutes.`
-	}
-	if (error.reason === "SERVICE_DISABLED") {
-		return `The ${error.api} API is switched off in the ${host}. Switch it on in the console, or run the setup script again.`
-	}
-	if (error.kind === "denied" || error.kind === "not_found") {
-		if (error.api === "IAM Credentials") {
-			// A connection that has been read before lost its account or its grant.
-			if (connector.lastMetricsReceivedAt !== null) {
-				return "Maple can no longer sign in as this connection's read-only service account. The account was deleted, or the grant to Maple was removed or is blocked by an organization policy. Run the setup script again or redo the read-only steps: either restores both."
-			}
-			// Shown both before any setup and for the minutes after one in which Google does not
-			// accept the new grant yet, so it has to read right in both.
-			return "Maple can't sign in as this connection's read-only service account yet. Google needs a few minutes to accept a new grant, and Maple retries every 5 minutes. If this stays, the account does not exist, or the grant to Maple is missing or blocked by an organization policy: finish the read-only account steps of a manual setup, or run the setup script again."
-		}
-		return reading === "metrics"
-			? `Google denied Maple's read of ${scope}: the read-only roles are missing. Grant them with the setup script, the console steps or your Terraform. A new grant can take a few minutes.`
-			: `Google denied the resource listing for ${scope}. Cloud Asset Viewer is missing. Grant it with the setup script, the console steps or your Terraform.`
-	}
-	// Signing in is counted against Maple's own project, not the host project.
-	if (error.kind === "rate_limited" && error.api !== "IAM Credentials") {
-		return `Google rate-limited the ${error.api} API for the ${host}. ${RETRIES} If this repeats, raise that API's quota on the project.`
-	}
-	return `Maple's request to Google's ${error.api} API failed. ${RETRIES} If this repeats, write to support@maple.dev.`
-}
-
-/**
- * What the connection shows for a failed call: one sentence of cause, one of what to do, and
- * Google's status at the end.
- */
-const describeApiError = (error: GcpApiError, connector: GcpConnectorRow, reading: "metrics" | "resources") =>
-	`${explainApiError(error, connector, reading)} (${error.message})`
-
 const toPersistenceError = makePersistenceErrorMapper(
 	IntegrationsPersistenceError,
 	"Google Cloud metrics database error",
@@ -445,7 +401,7 @@ export class GcpMetricsService extends Context.Service<GcpMetricsService, GcpMet
 					Effect.catchTags({
 						"@maple/api/integrations/GcpApiError": (error) =>
 							Effect.succeed({
-								lastResourcesError: describeApiError(error, connector, "resources"),
+								lastResourcesError: describeGcpApiError(error, connector, "poll"),
 							}),
 						"@maple/http/errors/IntegrationsPersistenceError": () =>
 							Effect.succeed({
@@ -655,7 +611,7 @@ export class GcpMetricsService extends Context.Service<GcpMetricsService, GcpMet
 							? []
 							: [
 									firstFailure.error.kind === "rate_limited"
-										? describeApiError(firstFailure.error, connector, "metrics")
+										? describeGcpApiError(firstFailure.error, connector, "poll")
 										: `${failed} of ${METRIC_COUNT} metric queries failed, first ${firstFailure.type}. The rest were stored. ${RETRIES} (${firstFailure.error.message})`,
 								]),
 					]
@@ -702,7 +658,7 @@ export class GcpMetricsService extends Context.Service<GcpMetricsService, GcpMet
 						}),
 						Effect.catchTags({
 							"@maple/api/integrations/GcpApiError": (error) =>
-								recordFailure(connector, describeApiError(error, connector, "metrics")),
+								recordFailure(connector, describeGcpApiError(error, connector, "poll")),
 							"@maple/api/integrations/GcpMetricsIngestError": (error) =>
 								error.status === 402
 									? recordFailure(
diff --git a/packages/backend/src/services/integrations/gcp/api.ts b/packages/backend/src/services/integrations/gcp/api.ts
index df22b4c964..be6b74e468 100644
--- a/packages/backend/src/services/integrations/gcp/api.ts
+++ b/packages/backend/src/services/integrations/gcp/api.ts
@@ -4,7 +4,8 @@
  * here may leak a credential: tokens stay `Redacted`, and a failure carries the HTTP status and
  * Google's error code and reason only, never a response body, transport error or schema issue.
  * The one sentence of Google's that is read, to tell a missing billing account from a missing
- * role, chooses a reason and is dropped.
+ * role, chooses a reason and is dropped. The exception is PromQL: Google's explanation of why
+ * the caller's own query was refused or did not finish is passed on.
  * Untraced on purpose: the HTTP client records a span per request, and "not set up yet" is not an
  * exception.
  */
@@ -15,8 +16,14 @@ import {
 	type GcpMetric,
 	type GcpMetricGroup,
 } from "@maple/domain/gcp-metrics"
+import {
+	GcpMetricDescriptor,
+	type GcpMonitoredResourceType,
+	type GcpPromQlSeries,
+} from "@maple/domain/gcp-live-metrics"
+import { GcpLiveQueryRejectedError } from "@maple/domain/http/gcp-live-query-errors"
 import type { GcpConnectorId, GcpProjectId } from "@maple/domain/primitives"
-import { Duration, Effect, Option, Redacted, Schema } from "effect"
+import { Duration, Effect, Option, Redacted, Schema, Stream } from "effect"
 import { HttpClient, HttpClientRequest } from "effect/http"
 
 const TOKEN_URL = "https://oauth2.googleapis.com/token"
@@ -116,36 +123,80 @@ const errorReason = (body: unknown, kind: GcpApiError["kind"]): string | undefin
 		.flatMap((detail) => Option.toArray(decodeErrorInfo(detail)))[0]?.reason ??
 	(kind === "denied" ? reasonFromMessage(body) : undefined)
 
+/**
+ * The largest answer a live query reads: four in flight stay far below the Worker's 128 MB.
+ * The poller's calls are not capped.
+ */
+const MAX_BODY_BYTES = 8 * 1024 * 1024
+const parseJson = Schema.decodeUnknownOption(Schema.fromJsonString(Schema.Unknown))
+
+interface CallOptions<E> {
+	/** Turns a failed answer into the caller's own error. */
+	readonly refuse?: (status: number, body: unknown) => E | undefined
+	/** Reads at most this many bytes of the answer (default: all of it). */
+	readonly maxBytes?: number
+	/** The caller's error for an answer past `maxBytes`. */
+	readonly tooLarge?: () => E
+}
+
 /** One JSON call. `api` names the Google service in the error. */
-const call = <A>(
+const call = <A, E = never>(
 	httpClient: HttpClient.HttpClient,
 	api: GcpApiError["api"],
 	request: HttpClientRequest.HttpClientRequest,
 	decode: (body: unknown) => Effect.Effect<A, Schema.SchemaError>,
-): Effect.Effect<A, GcpApiError> => {
-	const failed = (what: string) => () =>
-		Effect.fail(new GcpApiError({ message: `${api} ${what}`, api, kind: "upstream" }))
+	options: CallOptions<E> = {},
+): Effect.Effect<A, GcpApiError | E> => {
+	const failed = (what: string) => new GcpApiError({ message: `${api} ${what}`, api, kind: "upstream" })
+	const maxBytes = options.maxBytes ?? Infinity
 	return Effect.gen(function* () {
 		const response = yield* httpClient.execute(request)
-		const body = yield* response.json.pipe(Effect.orElseSucceed(() => null))
-		if (response.status >= 300) {
-			const kind = errorKind(response.status)
-			const reason = errorReason(body, kind)
-			return yield* new GcpApiError({
-				message: `${api} returned ${response.status}${errorCode(body)}${reason === undefined ? "" : `, ${reason}`}`,
-				api,
-				kind,
-				...(reason === undefined ? undefined : { reason }),
-			})
-		}
-		return yield* decode(body)
+		// Read as it arrives, never trusting Content-Length: past the cap the rest is left unread.
+		const chunks: Array<Uint8Array> = []
+		let size = 0
+		yield* Stream.runForEachWhile(response.stream, (chunk) =>
+			Effect.sync(() => {
+				size += chunk.byteLength
+				if (size > maxBytes) return false
+				chunks.push(chunk)
+				return true
+			}),
+		)
+		const overflow = size > maxBytes
+		// A non-JSON body (an HTML error page) is no body, never an overflow.
+		const body = overflow ? null : Option.getOrNull(parseJson(Buffer.concat(chunks).toString("utf8")))
+		return { status: response.status, body, overflow }
 	}).pipe(
 		Effect.timeout(REQUEST_TIMEOUT),
 		Effect.catchTags({
-			HttpClientError: failed("request failed"),
-			TimeoutError: failed("request timed out"),
-			SchemaError: failed("answered with an unexpected body"),
+			HttpClientError: () => Effect.fail(failed("request failed")),
+			TimeoutError: () => Effect.fail(failed("request timed out")),
 		}),
+		Effect.flatMap(({ status, body, overflow }) =>
+			Effect.gen(function* () {
+				if (status >= 300) {
+					const refused = options.refuse?.(status, body)
+					if (refused !== undefined) return yield* Effect.fail(refused)
+					const kind = errorKind(status)
+					const reason = errorReason(body, kind)
+					return yield* new GcpApiError({
+						message: `${api} returned ${status}${errorCode(body)}${reason === undefined ? "" : `, ${reason}`}`,
+						api,
+						kind,
+						...(reason === undefined ? undefined : { reason }),
+					})
+				}
+				if (overflow) {
+					return yield* Effect.fail(
+						options.tooLarge?.() ??
+							failed(`answered with more than ${maxBytes / 1024 / 1024} MB`),
+					)
+				}
+				return yield* decode(body).pipe(
+					Effect.mapError(() => failed("answered with an unexpected body")),
+				)
+			}),
+		),
 		Effect.annotateSpans("peer.service", "google-cloud"),
 	)
 }
@@ -241,6 +292,8 @@ const decodeImpersonatedToken = Schema.decodeUnknownEffect(
 	Schema.Struct({ accessToken: Schema.RedactedFromValue(Schema.String) }),
 )
 
+const MAPLE_SIDE_REASONS = new Set(["SERVICE_DISABLED", "BILLING_DISABLED", "USER_PROJECT_DENIED"])
+
 /** A connector's reader account, signed in. Its project pays the quota for what it reads. */
 export interface GcpReader {
 	readonly accessToken: Redacted.Redacted<string>
@@ -279,8 +332,16 @@ export const impersonateReader = Effect.fnUntraced(function* (
 		),
 		decodeImpersonatedToken,
 	).pipe(
-		// Not made through the host project, so its reason says nothing about that project.
-		Effect.mapError(({ message, api, kind }) => new GcpApiError({ message, api, kind })),
+		// Not made through the host project, so its reason says nothing about that project: a
+		// refusal for Maple's own (API off, no billing, no quota grant) is Maple's to fix.
+		Effect.mapError(
+			({ message, api, kind, reason }) =>
+				new GcpApiError({
+					message,
+					api,
+					kind: reason !== undefined && MAPLE_SIDE_REASONS.has(reason) ? "upstream" : kind,
+				}),
+		),
 	)
 	return { accessToken: response.accessToken, quotaProject: connector.projectId } satisfies GcpReader
 })
@@ -390,6 +451,244 @@ export const listTimeSeriesPage = (
 		decodeTimeSeriesPage,
 	)
 
+// Cloud Monitoring PromQL
+
+/** Google's own limit is 120 s; this one answers before `REQUEST_TIMEOUT` gives up. */
+const PROMQL_TIMEOUT = "18s"
+
+const Labels = Schema.Record(Schema.String, Schema.String)
+/** Prometheus sends values as strings: `"1.5"`, `"NaN"`, `"+Inf"`. */
+const Sample = Schema.Tuple([Schema.Number, Schema.String])
+
+const decodePromQlResult = Schema.decodeUnknownEffect(
+	Schema.Struct({
+		data: Schema.Union([
+			Schema.Struct({
+				resultType: Schema.Literal("matrix"),
+				result: Schema.Array(Schema.Struct({ metric: Labels, values: Schema.Array(Sample) })),
+			}),
+			Schema.Struct({
+				resultType: Schema.Literal("vector"),
+				result: Schema.Array(Schema.Struct({ metric: Labels, value: Sample })),
+			}),
+		]),
+	}),
+)
+
+const toPoints = (samples: ReadonlyArray<typeof Sample.Type>): Array<readonly [number, number]> =>
+	samples.flatMap(([time, raw]) => {
+		const value = Number(raw)
+		return Number.isFinite(value) ? [[time, value] as const] : []
+	})
+
+const decodePromQlError = Schema.decodeUnknownOption(
+	Schema.Struct({ status: Schema.Literal("error"), errorType: Schema.String, error: Schema.String }),
+)
+
+/**
+ * Google's own error for a query: 400 `bad_data` refuses the query itself. 422 `execution` and
+ * 503 `timeout` (too many samples, out of time) are the project's alone and stay a
+ * `GcpApiError`, carrying Google's text.
+ */
+const refuseQuery = (status: number, body: unknown) =>
+	Option.match(decodePromQlError(body), {
+		onNone: () => undefined,
+		onSome: ({ errorType, error }) =>
+			status === 400
+				? new GcpLiveQueryRejectedError({ message: error.slice(0, 1_000), reason: "invalid_query" })
+				: status === 422 || status === 503
+					? new GcpApiError({
+							message: `Cloud Monitoring returned ${status} ${errorType}: ${error.slice(0, 500)}`,
+							api: "Cloud Monitoring",
+							kind: status === 422 ? "invalid" : "upstream",
+							reason: "QUERY_EXECUTION",
+						})
+					: undefined,
+	})
+
+export type GcpPromQlParams =
+	| { readonly query: string; readonly time: number }
+	| { readonly query: string; readonly start: number; readonly end: number; readonly step: number }
+
+/** One instant or range query against one project, times in epoch seconds. */
+export const promQlQuery = (
+	httpClient: HttpClient.HttpClient,
+	reader: GcpReader,
+	projectId: GcpProjectId,
+	params: GcpPromQlParams,
+): Effect.Effect<ReadonlyArray<GcpPromQlSeries>, GcpApiError | GcpLiveQueryRejectedError> =>
+	call(
+		httpClient,
+		"Cloud Monitoring",
+		// A form body: a 4,000-character query would make a long URL.
+		HttpClientRequest.post(
+			`https://monitoring.googleapis.com/v1/projects/${projectId}/location/global/prometheus/api/v1/${"time" in params ? "query" : "query_range"}`,
+		).pipe(asReader(reader), HttpClientRequest.bodyUrlParams({ ...params, timeout: PROMQL_TIMEOUT })),
+		decodePromQlResult,
+		{
+			refuse: refuseQuery,
+			maxBytes: MAX_BODY_BYTES,
+			tooLarge: () =>
+				new GcpLiveQueryRejectedError({
+					message: `Google's answer for project ${projectId} is larger than 8 MB: too many series or points. Narrow the query or group by fewer labels.`,
+					reason: "too_many_series",
+				}),
+		},
+	).pipe(
+		Effect.map(({ data }) =>
+			data.resultType === "matrix"
+				? data.result.map((series): GcpPromQlSeries => ({
+						labels: series.metric,
+						points: toPoints(series.values),
+					}))
+				: data.result.map((series): GcpPromQlSeries => ({
+						labels: series.metric,
+						points: toPoints([series.value]),
+					})),
+		),
+	)
+
+const decodeMetricsScope = Schema.decodeUnknownEffect(
+	Schema.Struct({
+		name: Schema.String,
+		monitoredProjects: Schema.optionalKey(Schema.Array(Schema.Struct({ name: Schema.String }))),
+	}),
+)
+
+const lastSegment = (name: string) => name.slice(name.lastIndexOf("/") + 1)
+
+/** A project's metrics scope: its number, and the numbers of the projects it reads, itself included. */
+export const MetricsScope = Schema.Struct({ number: Schema.String, monitored: Schema.Array(Schema.String) })
+
+/**
+ * The metrics scope a query on the project reads: its own project number, and the numbers of
+ * the projects it monitors, itself included. Needs `resourcemanager.projects.get`, which
+ * Monitoring Viewer holds.
+ */
+export const getMetricsScope = (
+	httpClient: HttpClient.HttpClient,
+	reader: GcpReader,
+	projectId: GcpProjectId,
+) =>
+	call(
+		httpClient,
+		"Cloud Monitoring",
+		HttpClientRequest.get(
+			`https://monitoring.googleapis.com/v1/locations/global/metricsScopes/${projectId}`,
+		).pipe(asReader(reader)),
+		decodeMetricsScope,
+		{ maxBytes: MAX_BODY_BYTES },
+	).pipe(
+		Effect.map((scope): typeof MetricsScope.Type => ({
+			number: lastSegment(scope.name),
+			monitored: (scope.monitoredProjects ?? []).map((project) => lastSegment(project.name)),
+		})),
+	)
+
+// A kind or value type Google leaves unspecified is neither.
+const isMetricKind = Schema.is(GcpMetricDescriptor.fields.metricKind)
+const isValueType = Schema.is(GcpMetricDescriptor.fields.valueType)
+
+const decodeMetricDescriptorsPage = Schema.decodeUnknownEffect(
+	Schema.Struct({
+		metricDescriptors: Schema.optionalKey(
+			Schema.Array(
+				Schema.Struct({
+					type: Schema.String,
+					metricKind: Schema.optionalKey(Schema.String),
+					valueType: Schema.optionalKey(Schema.String),
+					unit: Schema.optionalKey(Schema.String),
+					description: Schema.optionalKey(Schema.String),
+					monitoredResourceTypes: Schema.optionalKey(Schema.Array(Schema.String)),
+					labels: Schema.optionalKey(Schema.Array(Schema.Struct({ key: Schema.String }))),
+				}),
+			),
+		),
+		nextPageToken: Schema.optionalKey(Schema.String),
+	}),
+)
+
+/**
+ * One page of the metrics with data in the project's last ~25 hours. A descriptor of a kind or
+ * value type Google leaves unspecified is dropped.
+ */
+export const listActiveMetricDescriptorsPage = (
+	httpClient: HttpClient.HttpClient,
+	reader: GcpReader,
+	projectId: GcpProjectId,
+	pageToken: string | undefined,
+) =>
+	call(
+		httpClient,
+		"Cloud Monitoring",
+		HttpClientRequest.get(
+			`https://monitoring.googleapis.com/v3/projects/${projectId}/metricDescriptors`,
+		).pipe(
+			asReader(reader),
+			HttpClientRequest.setUrlParams({ activeOnly: true, pageSize: 10_000, pageToken }),
+		),
+		decodeMetricDescriptorsPage,
+		{ maxBytes: MAX_BODY_BYTES },
+	).pipe(
+		Effect.map((page) => ({
+			items: (page.metricDescriptors ?? []).flatMap((descriptor): Array<GcpMetricDescriptor> => {
+				const { metricKind = "", valueType = "" } = descriptor
+				if (!isMetricKind(metricKind) || !isValueType(valueType)) return []
+				return [
+					{
+						type: descriptor.type,
+						metricKind,
+						valueType,
+						unit: descriptor.unit ?? "",
+						description: descriptor.description ?? "",
+						monitoredResourceTypes: descriptor.monitoredResourceTypes ?? [],
+						labels: (descriptor.labels ?? []).map((label) => label.key),
+					},
+				]
+			}),
+			nextPageToken: page.nextPageToken,
+		})),
+	)
+
+const decodeResourceDescriptorsPage = Schema.decodeUnknownEffect(
+	Schema.Struct({
+		resourceDescriptors: Schema.optionalKey(
+			Schema.Array(
+				Schema.Struct({
+					type: Schema.String,
+					labels: Schema.optionalKey(Schema.Array(Schema.Struct({ key: Schema.String }))),
+				}),
+			),
+		),
+		nextPageToken: Schema.optionalKey(Schema.String),
+	}),
+)
+
+/** One page of Google's monitored resource types, each with its label keys. */
+export const listMonitoredResourceTypesPage = (
+	httpClient: HttpClient.HttpClient,
+	reader: GcpReader,
+	projectId: GcpProjectId,
+	pageToken: string | undefined,
+) =>
+	call(
+		httpClient,
+		"Cloud Monitoring",
+		HttpClientRequest.get(
+			`https://monitoring.googleapis.com/v3/projects/${projectId}/monitoredResourceDescriptors`,
+		).pipe(asReader(reader), HttpClientRequest.setUrlParams({ pageToken })),
+		decodeResourceDescriptorsPage,
+		{ maxBytes: MAX_BODY_BYTES },
+	).pipe(
+		Effect.map((page) => ({
+			items: (page.resourceDescriptors ?? []).map((descriptor): GcpMonitoredResourceType => ({
+				type: descriptor.type,
+				labels: (descriptor.labels ?? []).map((label) => label.key),
+			})),
+			nextPageToken: page.nextPageToken,
+		})),
+	)
+
 // Cloud Asset Inventory
 
 const ResourceSearchResult = Schema.Struct({
diff --git a/packages/backend/src/services/integrations/gcp/explain.ts b/packages/backend/src/services/integrations/gcp/explain.ts
new file mode 100644
index 0000000000..f05ed014b5
--- /dev/null
+++ b/packages/backend/src/services/integrations/gcp/explain.ts
@@ -0,0 +1,65 @@
+import type { GcpConnectorRow } from "@maple/db/tables"
+import type { GcpApiError } from "./api"
+
+export const RETRIES = "Maple retries in 5 minutes."
+
+type ExplainedConnector = Pick<
+	GcpConnectorRow,
+	"scopeType" | "scopeId" | "projectId" | "lastMetricsReceivedAt"
+>
+
+/** Whose call failed: the poller's, or a live query's that a person is waiting on and nothing retries. */
+export type GcpCaller = "poll" | "live"
+
+/** Why a failed call failed and what to do about it, in the customer's terms. */
+const explainGcpApiError = (error: GcpApiError, connector: ExplainedConnector, caller: GcpCaller) => {
+	// The host project is the one Google checks for billing, enabled APIs and quota. A project
+	// scope is its own host, and reads as "the project".
+	const host = `${connector.scopeType === "project" ? "project" : "host project"} ${connector.projectId}`
+	const scope = `${connector.scopeType} ${connector.scopeId}`
+	const live = caller === "live"
+	const retries = live ? "Try again in a few minutes." : RETRIES
+	if (error.reason === "BILLING_DISABLED") {
+		return `The ${host} has no active billing account, and ${error.api} only answers for projects that have one. Link one: https://console.cloud.google.com/billing/linkedaccount?project=${connector.projectId}${live ? "" : " Maple retries every 5 minutes."}`
+	}
+	// A PromQL query that ran out of samples or time; Google's text, in the status, says which.
+	if (error.reason === "QUERY_EXECUTION") {
+		return "Google could not finish the query on this project. Narrow the query or widen the step."
+	}
+	if (error.reason === "SERVICE_DISABLED") {
+		return `The ${error.api} API is switched off in the ${host}. Switch it on in the console, or run the setup script again.`
+	}
+	if (error.kind === "denied" || error.kind === "not_found") {
+		if (error.api === "IAM Credentials") {
+			if (live) {
+				return "Maple can't sign in as this connection's read-only service account, which live queries read with. Google needs a few minutes to accept a new grant. If this stays, the account does not exist, or the grant to Maple is missing or blocked by an organization policy: finish the read-only account steps of a manual setup, or run the setup script again."
+			}
+			// A connection that has been read before lost its account or its grant.
+			if (connector.lastMetricsReceivedAt !== null) {
+				return "Maple can no longer sign in as this connection's read-only service account. The account was deleted, or the grant to Maple was removed or is blocked by an organization policy. Run the setup script again or redo the read-only steps: either restores both."
+			}
+			// Shown both before any setup and for the minutes after one in which Google does not
+			// accept the new grant yet, so it has to read right in both.
+			return "Maple can't sign in as this connection's read-only service account yet. Google needs a few minutes to accept a new grant, and Maple retries every 5 minutes. If this stays, the account does not exist, or the grant to Maple is missing or blocked by an organization policy: finish the read-only account steps of a manual setup, or run the setup script again."
+		}
+		return error.api === "Cloud Asset Inventory"
+			? `Google denied the resource listing for ${scope}. Cloud Asset Viewer is missing. Grant it with the setup script, the console steps or your Terraform.`
+			: `Google denied Maple's read of ${scope}: the read-only roles are missing. Grant them with the setup script, the console steps or your Terraform. A new grant can take a few minutes.`
+	}
+	// Signing in is counted against Maple's own project, not the host project.
+	if (error.kind === "rate_limited" && error.api !== "IAM Credentials") {
+		// Google answers a query past its size limit the same way as a spent quota.
+		if (live) {
+			return `Google refused the read for the ${host}: a rate limit, or an answer past Google's size limit. Narrow the query, or try again in a few minutes.`
+		}
+		return `Google rate-limited the ${error.api} API for the ${host}. ${RETRIES} If this repeats, raise that API's quota on the project.`
+	}
+	return `Maple's request to Google's ${error.api} API failed. ${retries} If this repeats, write to support@maple.dev.`
+}
+
+/**
+ * What the customer sees for a failed call: one sentence of cause, one of what to do, and
+ * Google's status at the end.
+ */
+export const describeGcpApiError = (error: GcpApiError, connector: ExplainedConnector, caller: GcpCaller) =>
+	`${explainGcpApiError(error, connector, caller)} (${error.message})`
diff --git a/packages/backend/src/services/warehouse/QueryEngineCacheHitRate.test.ts b/packages/backend/src/services/warehouse/QueryEngineCacheHitRate.test.ts
index ed901b7d6d..e9151aa7f4 100644
--- a/packages/backend/src/services/warehouse/QueryEngineCacheHitRate.test.ts
+++ b/packages/backend/src/services/warehouse/QueryEngineCacheHitRate.test.ts
@@ -5,6 +5,7 @@ import { OrgId, UserId } from "@maple/domain"
 import { baselineWarehouseCapabilities, QueryEngineExecuteRequest, type QuerySpec } from "@maple/query-engine"
 import type { CompiledQuery } from "@maple/query-engine/ch"
 import { QueryEngineService } from "./QueryEngineService"
+import { GcpLiveMetricsService } from "@maple/backend/services/integrations/GcpLiveMetricsService"
 import type { TenantContext } from "@maple/backend/services/auth/AuthService"
 import { WarehouseQueryService, type WarehouseQueryServiceApi } from "./WarehouseQueryService"
 import { BucketCacheService } from "@maple/query-engine/caching"
@@ -151,6 +152,7 @@ const makeLayer = (
 	config = makeConfig(),
 ) =>
 	Layer.effect(QueryEngineService, QueryEngineService.make).pipe(
+		Layer.provide(Layer.mock(GcpLiveMetricsService, {})),
 		Layer.provide(Layer.succeed(WarehouseQueryService, makeStub(counter))),
 		Layer.provide(edge.layer),
 		Layer.provide(BucketCacheService.layer.pipe(Layer.provide(edge.layer))),
diff --git a/packages/backend/src/services/warehouse/QueryEngineEvaluateCache.test.ts b/packages/backend/src/services/warehouse/QueryEngineEvaluateCache.test.ts
index 00759ce2e9..108afb90cd 100644
--- a/packages/backend/src/services/warehouse/QueryEngineEvaluateCache.test.ts
+++ b/packages/backend/src/services/warehouse/QueryEngineEvaluateCache.test.ts
@@ -10,6 +10,7 @@ import {
 	type AlertEvaluateRequest,
 } from "@maple/query-engine/runtime"
 import { QueryEngineService } from "./QueryEngineService"
+import { GcpLiveMetricsService } from "@maple/backend/services/integrations/GcpLiveMetricsService"
 import type { TenantContext } from "@maple/backend/services/auth/AuthService"
 import {
 	WarehouseQueryService,
@@ -313,6 +314,7 @@ describe("QueryEngineService.cachedDirect TTL", () => {
 		const recordingEdge = Layer.succeed(EdgeCacheService, makeRecordingEdge(calls))
 		const counter = { n: 0 }
 		const layer = Layer.effect(QueryEngineService, QueryEngineService.make).pipe(
+			Layer.provide(Layer.mock(GcpLiveMetricsService, {})),
 			Layer.provide(Layer.succeed(WarehouseQueryService, makeFullStub([], counter))),
 			Layer.provide(recordingEdge),
 			Layer.provide(BucketCacheService.layer.pipe(Layer.provide(recordingEdge))),
@@ -347,6 +349,7 @@ describe("QueryEngineService.cachedDirect TTL", () => {
 		const recordingEdge = Layer.succeed(EdgeCacheService, makeRecordingEdge(calls))
 		const counter = { n: 0 }
 		const layer = Layer.effect(QueryEngineService, QueryEngineService.make).pipe(
+			Layer.provide(Layer.mock(GcpLiveMetricsService, {})),
 			Layer.provide(Layer.succeed(WarehouseQueryService, makeFullStub([], counter))),
 			Layer.provide(recordingEdge),
 			Layer.provide(BucketCacheService.layer.pipe(Layer.provide(recordingEdge))),
@@ -400,6 +403,7 @@ describe("QueryEngineService.cachedDirect TTL", () => {
 		const recordingEdge = Layer.succeed(EdgeCacheService, makeRecordingEdge(calls))
 		const counter = { n: 0 }
 		const layer = Layer.effect(QueryEngineService, QueryEngineService.make).pipe(
+			Layer.provide(Layer.mock(GcpLiveMetricsService, {})),
 			Layer.provide(Layer.succeed(WarehouseQueryService, makeFullStub([], counter))),
 			Layer.provide(recordingEdge),
 			Layer.provide(BucketCacheService.layer.pipe(Layer.provide(recordingEdge))),
diff --git a/packages/backend/src/services/warehouse/QueryEngineService.ts b/packages/backend/src/services/warehouse/QueryEngineService.ts
index a51e13056b..7aa3f7206f 100644
--- a/packages/backend/src/services/warehouse/QueryEngineService.ts
+++ b/packages/backend/src/services/warehouse/QueryEngineService.ts
@@ -1,5 +1,6 @@
 // BOUNDARY: This module owns unparsed external values and narrows them before domain use.
 import { Clock, Context, Effect, Layer, Metric, type Schema } from "effect"
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
 import { QueryEngineExecuteResponse, type QueryEngineExecuteRequest } from "@maple/query-engine"
 import type { QueryEngineTimeoutError } from "@maple/domain/http"
 import {
@@ -41,6 +42,12 @@ import {
 import { EdgeCacheService } from "@maple/cache"
 import { WarehouseQueryService } from "@maple/backend/services/warehouse/WarehouseQueryService"
 import * as QueryEngineMetrics from "@maple/backend/observability/QueryEngineMetrics"
+import { GcpLiveMetricsService } from "@maple/backend/services/integrations/GcpLiveMetricsService"
+import {
+	listGcpMetricCatalog,
+	type GcpMetricCatalogRequest,
+	type GcpMetricCatalogRow,
+} from "@maple/backend/services/warehouse/gcp-metric-catalog"
 
 // QueryEngineService — caching + orchestration. The pure lowering (validation,
 // QuerySpec → CH, evaluate/raw-SQL) lives in `@maple/query-engine/runtime`; this
@@ -89,6 +96,11 @@ export interface QueryEngineServiceApi {
 		/** How the value crosses the cache's JSON round trip, when plain JSON would change it. */
 		schema?: Schema.Codec<A, unknown, never, never>,
 	) => Effect.Effect<A, E | QueryEngineTimeoutError>
+	/** Google Cloud metrics as `listMetrics` rows, for discovery surfaces to append to theirs. */
+	readonly listGcpMetrics: (
+		tenant: TenantContext,
+		request: GcpMetricCatalogRequest,
+	) => Effect.Effect<ReadonlyArray<GcpMetricCatalogRow>>
 }
 export class QueryEngineService extends Context.Service<QueryEngineService, QueryEngineServiceApi>()(
 	"@maple/api/services/QueryEngineService",
@@ -97,9 +109,10 @@ export class QueryEngineService extends Context.Service<QueryEngineService, Quer
 			const warehouse = yield* WarehouseQueryService
 			const edgeCache = yield* EdgeCacheService
 			const bucketCache = yield* BucketCacheService
-			const executeImpl = makeQueryEngineExecute(warehouse)
-			const evaluateImpl = makeQueryEngineEvaluate(warehouse)
-			const evaluateSeriesImpl = makeQueryEngineEvaluateSeries(warehouse)
+			const gcp = yield* GcpLiveMetricsService
+			const executeImpl = makeQueryEngineExecute(warehouse, gcp)
+			const evaluateImpl = makeQueryEngineEvaluate(warehouse, gcp)
+			const evaluateSeriesImpl = makeQueryEngineEvaluateSeries(warehouse, gcp)
 
 			// A request that has moved onto a registry definition. `apply` keeps the
 			// definition and its input paired under one type parameter, so the cache
@@ -339,6 +352,13 @@ export class QueryEngineService extends Context.Service<QueryEngineService, Quer
 
 						if (!bucketCache.enabled) return yield* useBlobPath("bucket_cache_disabled")
 						if (request.query.kind !== "timeseries") return yield* useBlobPath("not_timeseries")
+						// Google settles recent points minutes late; settled-bucket caching would freeze gaps.
+						if (
+							request.query.source === "metrics" &&
+							isGcpMetricType(request.query.filters.metricName)
+						) {
+							return yield* useBlobPath("gcp_live")
+						}
 
 						const startEpochMs = toEpochMs(request.startTime)
 						const endEpochMs = toEpochMs(request.endTime)
@@ -491,11 +511,18 @@ export class QueryEngineService extends Context.Service<QueryEngineService, Quer
 				evaluate: cachedEvaluate,
 				evaluateSeries,
 				cachedDirect,
+				listGcpMetrics: (tenant, request) => listGcpMetricCatalog(gcp, tenant, request),
 			} satisfies QueryEngineServiceApi
 		}),
 	},
 ) {
 	static readonly layer = Layer.effect(this, this.make).pipe(
-		Layer.provide(Layer.mergeAll(WarehouseQueryService.layer, BucketCacheService.layer)),
+		Layer.provide(
+			Layer.mergeAll(
+				WarehouseQueryService.layer,
+				BucketCacheService.layer,
+				GcpLiveMetricsService.layer,
+			),
+		),
 	)
 }
diff --git a/packages/backend/src/services/warehouse/gcp-metric-catalog.test.ts b/packages/backend/src/services/warehouse/gcp-metric-catalog.test.ts
new file mode 100644
index 0000000000..6ca7e4ae07
--- /dev/null
+++ b/packages/backend/src/services/warehouse/gcp-metric-catalog.test.ts
@@ -0,0 +1,154 @@
+import { assert, describe, it } from "@effect/vitest"
+import { DateTime, Effect, Exit, Schema } from "effect"
+import { TestClock } from "effect/testing"
+import type { GcpMetricDescriptor } from "@maple/domain/gcp-live-metrics"
+import {
+	GcpLiveQueryFailedError,
+	GcpLiveQueryRejectedError,
+	GcpLiveQueryUnavailableError,
+	type GcpLiveQueryError,
+} from "@maple/domain/http/gcp-live-query-errors"
+import { OrgId } from "@maple/domain/primitives"
+import type { GcpLiveMetrics, GcpReadScope } from "@maple/query-engine/runtime"
+import { listGcpMetricCatalog } from "./gcp-metric-catalog"
+
+const NOW = Date.UTC(2026, 9, 15, 12, 0, 0)
+const TENANT = { orgId: Schema.decodeSync(OrgId)("org_gcp") }
+
+const descriptor = (type: string, overrides: Partial<GcpMetricDescriptor> = {}): GcpMetricDescriptor => ({
+	type,
+	metricKind: "GAUGE",
+	valueType: "DOUBLE",
+	unit: "1",
+	description: `${type} description`,
+	monitoredResourceTypes: [],
+	labels: [],
+	...overrides,
+})
+
+const DESCRIPTORS = [
+	descriptor("cloudsql.googleapis.com/database/cpu/utilization", { unit: "10^2.%" }),
+	descriptor("cloudsql.googleapis.com/database/network/connections", {
+		metricKind: "CUMULATIVE",
+		valueType: "INT64",
+	}),
+	descriptor("run.googleapis.com/request_latencies", {
+		metricKind: "DELTA",
+		valueType: "DISTRIBUTION",
+		unit: "ms",
+	}),
+	descriptor("run.googleapis.com/container/instance_state", { valueType: "STRING" }),
+]
+
+/** A port answering `listMetrics` with `answer`, counting the calls. */
+const fakePort = (answer: Effect.Effect<ReadonlyArray<GcpMetricDescriptor>, GcpLiveQueryError>) => {
+	const calls = { listMetrics: 0, scopes: [] as Array<GcpReadScope> }
+	const unused = () => Effect.die("not used")
+	const port: GcpLiveMetrics = {
+		queryRange: unused,
+		queryInstant: unused,
+		listResourceTypes: unused,
+		listMetrics: (_tenant, scope) => {
+			calls.listMetrics += 1
+			calls.scopes.push(scope)
+			return answer
+		},
+	}
+	return { port, calls }
+}
+
+const run = <A, E>(effect: Effect.Effect<A, E>) =>
+	Effect.gen(function* () {
+		yield* TestClock.setTime(NOW)
+		return yield* effect
+	})
+
+describe("listGcpMetricCatalog", () => {
+	it.effect("lists Google's chartable metrics as Google Cloud catalog rows", () =>
+		run(
+			Effect.gen(function* () {
+				const { port, calls } = fakePort(Effect.succeed(DESCRIPTORS))
+				const rows = yield* listGcpMetricCatalog(port, TENANT, {})
+				// The list reads the first 20 projects rather than refusing more.
+				assert.deepStrictEqual(calls.scopes, [{ discovery: true }])
+				assert.deepStrictEqual(
+					rows.map((row) => [row.metricName, row.metricType, row.isMonotonic]),
+					[
+						["cloudsql.googleapis.com/database/cpu/utilization", "gauge", 0],
+						["cloudsql.googleapis.com/database/network/connections", "sum", 1],
+						["run.googleapis.com/request_latencies", "histogram", 1],
+					],
+				)
+				const first = rows[0]!
+				assert.strictEqual(first.serviceName, "Google Cloud")
+				assert.strictEqual(first.metricUnit, "10^2.%")
+				assert.strictEqual(
+					first.metricDescription,
+					"cloudsql.googleapis.com/database/cpu/utilization description",
+				)
+				assert.strictEqual(first.dataPointCount, 0)
+				assert.strictEqual(DateTime.toEpochMillis(first.lastSeen), NOW)
+				assert.strictEqual(DateTime.toEpochMillis(first.firstSeen), NOW - 25 * 3_600_000)
+			}),
+		),
+	)
+
+	it.effect("filters by name substring regardless of case, by type, and caps at the limit", () =>
+		run(
+			Effect.gen(function* () {
+				const { port } = fakePort(Effect.succeed(DESCRIPTORS))
+				const names = (request: Parameters<typeof listGcpMetricCatalog>[2]) =>
+					listGcpMetricCatalog(port, TENANT, request).pipe(
+						Effect.map((rows) => rows.map((row) => row.metricName)),
+					)
+				assert.deepStrictEqual(yield* names({ search: "CloudSQL" }), [
+					"cloudsql.googleapis.com/database/cpu/utilization",
+					"cloudsql.googleapis.com/database/network/connections",
+				])
+				assert.deepStrictEqual(yield* names({ metricType: "histogram" }), [
+					"run.googleapis.com/request_latencies",
+				])
+				assert.deepStrictEqual(yield* names({ service: "Google Cloud", limit: 1 }), [
+					"cloudsql.googleapis.com/database/cpu/utilization",
+				])
+			}),
+		),
+	)
+
+	it.effect("asks Google nothing for a later page or another service", () =>
+		run(
+			Effect.gen(function* () {
+				const { port, calls } = fakePort(Effect.succeed(DESCRIPTORS))
+				assert.deepStrictEqual(yield* listGcpMetricCatalog(port, TENANT, { offset: 100 }), [])
+				assert.deepStrictEqual(yield* listGcpMetricCatalog(port, TENANT, { service: "checkout" }), [])
+				assert.strictEqual(calls.listMetrics, 0)
+			}),
+		),
+	)
+
+	it.effect("lists no Google rows when Google cannot answer, so the warehouse list still renders", () =>
+		run(
+			Effect.gen(function* () {
+				const failures = [
+					new GcpLiveQueryUnavailableError({ message: "not connected" }),
+					new GcpLiveQueryFailedError({ message: "Google is down", failures: [] }),
+					new GcpLiveQueryRejectedError({ message: "refused", reason: "invalid_query" }),
+				]
+				for (const failure of failures) {
+					const { port } = fakePort(Effect.fail(failure))
+					assert.deepStrictEqual(yield* listGcpMetricCatalog(port, TENANT, {}), [])
+				}
+			}),
+		),
+	)
+
+	it.effect("lets a defect through: a bug is not Google being unavailable", () =>
+		run(
+			Effect.gen(function* () {
+				const { port } = fakePort(Effect.die("bug"))
+				const exit = yield* Effect.exit(listGcpMetricCatalog(port, TENANT, {}))
+				assert.isTrue(Exit.hasDies(exit))
+			}),
+		),
+	)
+})
diff --git a/packages/backend/src/services/warehouse/gcp-metric-catalog.ts b/packages/backend/src/services/warehouse/gcp-metric-catalog.ts
new file mode 100644
index 0000000000..0c1d4e9483
--- /dev/null
+++ b/packages/backend/src/services/warehouse/gcp-metric-catalog.ts
@@ -0,0 +1,67 @@
+import { Clock, DateTime, Effect } from "effect"
+import { gcpMetricMapleType } from "@maple/domain/gcp-live-metrics"
+import type { ListMetricsOutput } from "@maple/query-engine/ch"
+import type { GcpLiveMetrics, QueryTenant } from "@maple/query-engine/runtime"
+
+/** The service name Google Cloud metrics list under. */
+const GCP_METRICS_SERVICE_NAME = "Google Cloud"
+
+/** Google lists a metric when it has data in the last ~25 hours. */
+const ACTIVE_WINDOW_MS = 25 * 3_600_000
+
+/** A `listMetrics` row. `Pick` makes it a plain object type, which passes as a wire row; the interface does not. */
+export type GcpMetricCatalogRow = Pick<ListMetricsOutput, keyof ListMetricsOutput>
+
+/** The `listMetrics` filters Google rows answer. */
+export interface GcpMetricCatalogRequest {
+	readonly service?: string | undefined
+	readonly metricType?: string | undefined
+	readonly search?: string | undefined
+	readonly limit?: number | undefined
+	readonly offset?: number | undefined
+}
+
+/**
+ * Active Google metrics as `listMetrics` rows to append to a metrics list, filtered like the
+ * warehouse query and capped at `limit`. Only the first page carries them, and only for no
+ * service or Google's. Discovery never fails on Google: a failure (logged where it happens) is
+ * no rows.
+ */
+export const listGcpMetricCatalog = Effect.fn("QueryEngineService.listGcpMetrics")(function* (
+	gcp: GcpLiveMetrics,
+	tenant: QueryTenant,
+	request: GcpMetricCatalogRequest,
+) {
+	if ((request.offset ?? 0) !== 0) return []
+	if (request.service !== undefined && request.service !== GCP_METRICS_SERVICE_NAME) return []
+	// Typed failures only: a defect is a bug, not Google being unavailable.
+	const descriptors = yield* gcp
+		.listMetrics(tenant, { discovery: true })
+		.pipe(Effect.orElseSucceed(() => []))
+	const nowMs = yield* Clock.currentTimeMillis
+	const search = request.search?.toLowerCase()
+	const lastSeen = DateTime.makeUnsafe(nowMs)
+	const firstSeen = DateTime.makeUnsafe(nowMs - ACTIVE_WINDOW_MS)
+	return descriptors
+		.flatMap((descriptor): ReadonlyArray<GcpMetricCatalogRow> => {
+			const metricType = gcpMetricMapleType(descriptor)
+			if (metricType === undefined) return []
+			if (request.metricType !== undefined && metricType !== request.metricType) return []
+			if (search !== undefined && !descriptor.type.toLowerCase().includes(search)) return []
+			return [
+				{
+					metricName: descriptor.type,
+					metricType,
+					serviceName: GCP_METRICS_SERVICE_NAME,
+					metricDescription: descriptor.description,
+					metricUnit: descriptor.unit,
+					dataPointCount: 0,
+					firstSeen,
+					lastSeen,
+					// The warehouse column's encoding, which callers compare against 0.
+					isMonotonic: descriptor.metricKind === "GAUGE" ? 0 : 1,
+				},
+			]
+		})
+		.slice(0, request.limit ?? 100)
+})
diff --git a/packages/domain/package.json b/packages/domain/package.json
index 681b1dd3bc..107d611c8f 100644
--- a/packages/domain/package.json
+++ b/packages/domain/package.json
@@ -14,10 +14,12 @@
 		"./format": "./src/format.ts",
 		"./gcp": "./src/gcp.ts",
 		"./gcp-infra": "./src/gcp-infra.ts",
+		"./gcp-live-metrics": "./src/gcp-live-metrics.ts",
 		"./gcp-metrics": "./src/gcp-metrics.ts",
 		"./gen-ai": "./src/gen-ai.ts",
 		"./glob": "./src/glob.ts",
 		"./http": "./src/http/index.ts",
+		"./http/gcp-live-query-errors": "./src/http/gcp-live-query-errors.ts",
 		"./incident-context": "./src/incident-context.ts",
 		"./http/v2": "./src/http/v2/index.ts",
 		"./http/vcs": "./src/http/vcs.ts",
diff --git a/packages/domain/src/gcp-live-metrics.test.ts b/packages/domain/src/gcp-live-metrics.test.ts
new file mode 100644
index 0000000000..630a4c46b7
--- /dev/null
+++ b/packages/domain/src/gcp-live-metrics.test.ts
@@ -0,0 +1,30 @@
+import { describe, expect, it } from "vitest"
+import { isGcpMetricType } from "./gcp-live-metrics"
+
+describe("isGcpMetricType", () => {
+	it("reads Cloud Monitoring metric types as Google's", () => {
+		for (const name of [
+			"compute.googleapis.com/instance/cpu/utilization",
+			"cloudsql.googleapis.com/database/postgresql/transaction_count",
+			"kubernetes.io/container/cpu/core_usage_time",
+			"istio.io/service/server/request_count",
+			"knative.dev/serving/revision/request_count",
+			"custom.googleapis.com/checkout/orders",
+		]) {
+			expect(isGcpMetricType(name), name).toBe(true)
+		}
+	})
+
+	it("leaves OpenTelemetry and Prometheus names on the warehouse", () => {
+		for (const name of [
+			"app.kafka/consumer_lag",
+			"http.server.request.duration",
+			"gcp.cloudsql.cpu.utilization",
+			"example.com/requests",
+			"googleapis.com.evil/x",
+			"process_cpu_seconds_total",
+		]) {
+			expect(isGcpMetricType(name), name).toBe(false)
+		}
+	})
+})
diff --git a/packages/domain/src/gcp-live-metrics.ts b/packages/domain/src/gcp-live-metrics.ts
new file mode 100644
index 0000000000..23401573bc
--- /dev/null
+++ b/packages/domain/src/gcp-live-metrics.ts
@@ -0,0 +1,46 @@
+import { Schema } from "effect"
+import type { MetricType } from "./query-engine"
+
+/**
+ * A Cloud Monitoring metric type: one of Google's metric domains, a slash, then a path, e.g.
+ * `compute.googleapis.com/instance/cpu/utilization` or `kubernetes.io/container/cpu/core_usage_time`.
+ * The query engine reads these live from Google instead of from the warehouse.
+ */
+const GCP_METRIC_TYPE =
+	/^(?:[a-z0-9-]+\.)*(?:googleapis\.com|kubernetes\.io|istio\.io|knative\.dev)\/[A-Za-z0-9_.\-/]+$/
+
+export const isGcpMetricType = (metricName: string): boolean => GCP_METRIC_TYPE.test(metricName)
+
+/** A metric with data in the last ~25 hours (Cloud Monitoring `metricDescriptors?activeOnly=true`). */
+export const GcpMetricDescriptor = Schema.Struct({
+	type: Schema.String,
+	metricKind: Schema.Literals(["GAUGE", "DELTA", "CUMULATIVE"]),
+	valueType: Schema.Literals(["BOOL", "INT64", "DOUBLE", "STRING", "DISTRIBUTION", "MONEY"]),
+	unit: Schema.String,
+	description: Schema.String,
+	/** Resource types with recent data. Empty when Google does not list them (e.g. logging metrics). */
+	monitoredResourceTypes: Schema.Array(Schema.String),
+	/** Metric label keys. Resource labels (project_id, region, ...) are not listed here. */
+	labels: Schema.Array(Schema.String),
+})
+export type GcpMetricDescriptor = typeof GcpMetricDescriptor.Type
+
+/** A monitored resource type (Cloud Monitoring `monitoredResourceDescriptors`) and its label keys. */
+export const GcpMonitoredResourceType = Schema.Struct({
+	type: Schema.String,
+	labels: Schema.Array(Schema.String),
+})
+export type GcpMonitoredResourceType = typeof GcpMonitoredResourceType.Type
+
+/** How Maple's query builder treats a Cloud Monitoring metric; undefined for value types PromQL cannot chart. */
+export const gcpMetricMapleType = (descriptor: GcpMetricDescriptor): MetricType | undefined => {
+	if (descriptor.valueType === "STRING" || descriptor.valueType === "MONEY") return undefined
+	if (descriptor.valueType === "DISTRIBUTION") return "histogram"
+	return descriptor.metricKind === "GAUGE" ? "gauge" : "sum"
+}
+
+/** One series of a PromQL answer. Points are `[epochSeconds, value]`, NaN and infinities dropped. */
+export interface GcpPromQlSeries {
+	readonly labels: Readonly<Record<string, string>>
+	readonly points: ReadonlyArray<readonly [number, number]>
+}
diff --git a/packages/domain/src/generated/anticipated-error-identifiers.ts b/packages/domain/src/generated/anticipated-error-identifiers.ts
index e734e3627b..8b4d6d61fd 100644
--- a/packages/domain/src/generated/anticipated-error-identifiers.ts
+++ b/packages/domain/src/generated/anticipated-error-identifiers.ts
@@ -47,6 +47,8 @@ export const ANTICIPATED_ERROR_IDENTIFIER_LIST: ReadonlyArray<string> = [
 	"@maple/http/errors/ErrorIssuePullRequestNotFoundError",
 	"@maple/http/errors/ErrorIssueTransitionError",
 	"@maple/http/errors/ErrorValidationError",
+	"@maple/http/errors/GcpLiveQueryRejectedError",
+	"@maple/http/errors/GcpLiveQueryUnavailableError",
 	"@maple/http/errors/GcpMetricsUnavailableError",
 	"@maple/http/errors/GcpScopeAlreadyConnectedError",
 	"@maple/http/errors/IncidentTriageUnauthorizedError",
diff --git a/packages/domain/src/http/gcp-live-query-errors.ts b/packages/domain/src/http/gcp-live-query-errors.ts
new file mode 100644
index 0000000000..9593d7e3c2
--- /dev/null
+++ b/packages/domain/src/http/gcp-live-query-errors.ts
@@ -0,0 +1,74 @@
+import { Schema } from "effect"
+import { HttpTaggedError } from "./error-policy"
+
+// Failures of a metrics query the engine answered live from Google Cloud Monitoring.
+// Error-only module (no effect/http-api), so the query engine can import it.
+
+/** Why a deployment without a Google identity cannot read Google Cloud metrics. */
+export const GCP_LIVE_METRICS_NOT_AVAILABLE =
+	"Google Cloud metrics are not available on this Maple deployment."
+
+/** The query cannot run as asked: Google refused it, or it reaches too many projects or series. */
+export class GcpLiveQueryRejectedError extends HttpTaggedError<GcpLiveQueryRejectedError>()(
+	"@maple/http/errors/GcpLiveQueryRejectedError",
+	{
+		message: Schema.String,
+		reason: Schema.Literals(["invalid_query", "too_many_projects", "too_many_series"]),
+	},
+	{
+		status: 400,
+		code: "gcp_live_query_rejected",
+		title: "Google Cloud could not run this query",
+		retry: "never",
+		recovery: "fix_request",
+		exposure: "public_message",
+	},
+) {}
+
+/**
+ * Nothing to read with, or nothing Maple can fix by retrying: no connection with metrics on, no
+ * Google identity in this deployment, or a connection Google refuses (a missing role, API or
+ * billing account).
+ */
+export class GcpLiveQueryUnavailableError extends HttpTaggedError<GcpLiveQueryUnavailableError>()(
+	"@maple/http/errors/GcpLiveQueryUnavailableError",
+	{
+		message: Schema.String,
+	},
+	{
+		status: 409,
+		code: "gcp_live_query_unavailable",
+		title: "Google Cloud metrics are not available",
+		retry: "never",
+		recovery: "none",
+		exposure: "public_message",
+	},
+) {}
+
+/** Google did not answer (errors, rate limits): worth a retry. */
+export class GcpLiveQueryFailedError extends HttpTaggedError<GcpLiveQueryFailedError>()(
+	"@maple/http/errors/GcpLiveQueryFailedError",
+	{
+		message: Schema.String,
+		failures: Schema.Array(Schema.Struct({ scope: Schema.String, message: Schema.String })),
+	},
+	{
+		status: 502,
+		code: "gcp_live_query_failed",
+		title: "Google Cloud did not answer",
+		retry: "backoff",
+		recovery: "retry",
+		exposure: "public_message",
+	},
+) {}
+
+export const gcpLiveQueryHttpErrors = [
+	GcpLiveQueryRejectedError,
+	GcpLiveQueryUnavailableError,
+	GcpLiveQueryFailedError,
+] as const
+
+export type GcpLiveQueryError =
+	| GcpLiveQueryRejectedError
+	| GcpLiveQueryUnavailableError
+	| GcpLiveQueryFailedError
diff --git a/packages/domain/src/http/index.ts b/packages/domain/src/http/index.ts
index f830945690..bfcd524597 100644
--- a/packages/domain/src/http/index.ts
+++ b/packages/domain/src/http/index.ts
@@ -58,3 +58,4 @@ export * from "./vcs"
 export * from "./api-boundary"
 export * from "./warehouse"
 export * from "./widget-types"
+export * from "./gcp-live-query-errors"
diff --git a/packages/domain/src/http/warehouse-errors.ts b/packages/domain/src/http/warehouse-errors.ts
index 534b25e84e..de3ca70bef 100644
--- a/packages/domain/src/http/warehouse-errors.ts
+++ b/packages/domain/src/http/warehouse-errors.ts
@@ -1,5 +1,6 @@
 import { Schema } from "effect"
 import { HttpTaggedError, publicHttpErrorDefinitionFor } from "./error-policy"
+import { gcpLiveQueryHttpErrors } from "./gcp-live-query-errors"
 import {
 	OrgClickHouseSettingsEncryptionError,
 	OrgClickHouseSettingsPersistenceError,
@@ -330,10 +331,14 @@ export const warehouseSettingsRouteHttpErrors = [
 /** Errors unique to minting an org-scoped token for user-authored raw SQL. */
 export const warehouseTokenRouteHttpErrors = [TinybirdOrgTokenConfigError, TinybirdOrgTokenMintError] as const
 
-/** Normal reads resolve saved settings but never mint a raw-SQL token. */
+/**
+ * Normal reads resolve saved settings but never mint a raw-SQL token. A metrics read on a
+ * Cloud Monitoring metric type is answered live from Google, so its failures ride here too.
+ */
 export const warehouseReadHttpErrors = [
 	...managedWarehouseHttpErrors,
 	...warehouseSettingsRouteHttpErrors,
+	...gcpLiveQueryHttpErrors,
 ] as const
 
 /** Failures that can escape compiled or raw execution into public v2 query routes. */
diff --git a/packages/query-engine/src/promql/compile.test.ts b/packages/query-engine/src/promql/compile.test.ts
new file mode 100644
index 0000000000..9a78ca43dd
--- /dev/null
+++ b/packages/query-engine/src/promql/compile.test.ts
@@ -0,0 +1,507 @@
+import { assert, describe, it } from "@effect/vitest"
+import { DeploymentEnvironment, MetricName, ServiceName } from "@maple/domain"
+import type { GcpMetricDescriptor } from "@maple/domain/gcp-live-metrics"
+import type { AttributeFilter, MetricsFilters, MetricsMetric } from "@maple/domain/query-engine"
+import { Effect } from "effect"
+import { QueryEngineValidationError } from "@maple/domain/http"
+import {
+	compileGcpLabelValues,
+	compileGcpMetricQuery,
+	compileGcpSampleCount,
+	gcpFilterProjects,
+	gcpPointBucket,
+	gcpRangeWindow,
+	type GcpPromQl,
+} from "./compile"
+
+const descriptor = (overrides: Partial<GcpMetricDescriptor> & Pick<GcpMetricDescriptor, "type">) =>
+	({
+		metricKind: "GAUGE",
+		valueType: "DOUBLE",
+		unit: "1",
+		description: "",
+		monitoredResourceTypes: ["cloudsql_database"],
+		labels: [],
+		...overrides,
+	}) satisfies GcpMetricDescriptor
+
+const cpu = descriptor({ type: "cloudsql.googleapis.com/database/cpu/utilization" })
+const transactions = descriptor({
+	type: "cloudsql.googleapis.com/database/postgresql/transaction_count",
+	metricKind: "DELTA",
+	valueType: "INT64",
+})
+const coreUsage = descriptor({
+	type: "kubernetes.io/container/cpu/core_usage_time",
+	metricKind: "CUMULATIVE",
+	monitoredResourceTypes: ["k8s_container"],
+})
+const latencies = descriptor({
+	type: "serviceruntime.googleapis.com/api/request_latencies",
+	metricKind: "DELTA",
+	valueType: "DISTRIBUTION",
+	monitoredResourceTypes: ["consumed_api"],
+})
+
+interface CompileOptions {
+	readonly filters?: Partial<MetricsFilters>
+	readonly groupLabel?: string
+	readonly windowSeconds?: number
+}
+
+const request = (d: GcpMetricDescriptor, metric: MetricsMetric, options: CompileOptions = {}) => ({
+	metric,
+	filters: { metricName: MetricName.make(d.type), metricType: "gauge" as const, ...options.filters },
+	groupLabel: options.groupLabel,
+	windowSeconds: options.windowSeconds ?? 60,
+})
+
+const compile = (d: GcpMetricDescriptor, metric: MetricsMetric, options?: CompileOptions) =>
+	compileGcpMetricQuery(request(d, metric, options), d)
+
+const query = (d: GcpMetricDescriptor, metric: MetricsMetric, options?: CompileOptions) =>
+	compile(d, metric, options).pipe(Effect.map((compiled) => compiled.query))
+
+const rejection = (d: GcpMetricDescriptor, metric: MetricsMetric, options?: CompileOptions) =>
+	compile(d, metric, options).pipe(
+		Effect.flip,
+		Effect.map((error) => {
+			assert.instanceOf(error, QueryEngineValidationError)
+			return error.message
+		}),
+	)
+
+const withFilters = (attributeFilters: ReadonlyArray<AttributeFilter>) => ({ filters: { attributeFilters } })
+
+const CPU = `{"cloudsql.googleapis.com/database/cpu/utilization", monitored_resource="cloudsql_database"}`
+const TX = `{"cloudsql.googleapis.com/database/postgresql/transaction_count", monitored_resource="cloudsql_database"}`
+const CORE = `{"kubernetes.io/container/cpu/core_usage_time", monitored_resource="k8s_container"}`
+const LAT = (suffix: string) =>
+	`{"serviceruntime.googleapis.com/api/request_latencies_${suffix}", monitored_resource="consumed_api"}`
+const avgParts = (sum: string, count: string) =>
+	`label_replace(${sum}, "maple_part", "sum", "", "") or label_replace(${count}, "maple_part", "count", "", "")`
+
+const cases = (
+	d: GcpMetricDescriptor,
+	expected: ReadonlyArray<readonly [MetricsMetric, string, GcpPromQl["merge"]]>,
+	windowSeconds?: number,
+) => {
+	for (const [metric, promQl, merge] of expected) {
+		it.effect(metric, () =>
+			Effect.gen(function* () {
+				const compiled = yield* compile(d, metric, { windowSeconds })
+				assert.deepStrictEqual(compiled, { query: promQl, merge })
+			}),
+		)
+	}
+}
+
+describe("compileGcpMetricQuery", () => {
+	describe("GAUGE", () =>
+		cases(cpu, [
+			[
+				"avg",
+				avgParts(
+					`sum by (project_id) (sum_over_time(${CPU}[59999ms]))`,
+					`sum by (project_id) (count_over_time(${CPU}[59999ms]))`,
+				),
+				"avg",
+			],
+			["min", `min by (project_id) (min_over_time(${CPU}[59999ms]))`, "min"],
+			["max", `max by (project_id) (max_over_time(${CPU}[59999ms]))`, "max"],
+			["sum", `sum by (project_id) (sum_over_time(${CPU}[59999ms]))`, "sum"],
+			["count", `sum by (project_id) (count_over_time(${CPU}[59999ms]))`, "sum"],
+			["rate", `sum by (project_id) (rate(${CPU}[119999ms]))`, "sum"],
+			["increase", `sum by (project_id) (rate(${CPU}[119999ms])) * 60`, "sum"],
+		]))
+
+	describe("DELTA", () =>
+		cases(
+			transactions,
+			[
+				// Summing the deltas is exact; `increase` would extrapolate.
+				["sum", `sum by (project_id) (sum_over_time(${TX}[299999ms]))`, "sum"],
+				["increase", `sum by (project_id) (sum_over_time(${TX}[299999ms]))`, "sum"],
+				["rate", `sum by (project_id) (sum_over_time(${TX}[299999ms])) / 300`, "sum"],
+				["count", `sum by (project_id) (count_over_time(${TX}[299999ms]))`, "sum"],
+				["max", `max by (project_id) (max_over_time(${TX}[299999ms]))`, "max"],
+			],
+			300,
+		))
+
+	describe("CUMULATIVE", () => {
+		// A 60 s step reads two minutes, so the window holds two samples.
+		cases(coreUsage, [
+			["rate", `sum by (project_id) (rate(${CORE}[119999ms]))`, "sum"],
+			["increase", `sum by (project_id) (rate(${CORE}[119999ms])) * 60`, "sum"],
+			["sum", `sum by (project_id) (rate(${CORE}[119999ms])) * 60`, "sum"],
+			["count", `sum by (project_id) (count_over_time(${CORE}[59999ms]))`, "sum"],
+			["max", `max by (project_id) (max_over_time(${CORE}[59999ms]))`, "max"],
+		])
+		it.effect("reads a step wider than two minutes as its own window", () =>
+			Effect.gen(function* () {
+				assert.strictEqual(
+					yield* query(coreUsage, "increase", { windowSeconds: 300 }),
+					`sum by (project_id) (rate(${CORE}[299999ms])) * 300`,
+				)
+			}),
+		)
+	})
+
+	describe("DISTRIBUTION", () => {
+		it.effect("averages as the sum over the count, both kept per group and project", () =>
+			Effect.gen(function* () {
+				assert.deepStrictEqual(yield* compile(latencies, "avg", { groupLabel: "method" }), {
+					query: avgParts(
+						`sum by (method, project_id) (sum_over_time(${LAT("sum")}[59999ms]))`,
+						`sum by (method, project_id) (sum_over_time(${LAT("count")}[59999ms]))`,
+					),
+					merge: "avg",
+				})
+			}),
+		)
+		it.effect("sums the _sum series and counts the _count series", () =>
+			Effect.gen(function* () {
+				assert.strictEqual(
+					yield* query(latencies, "sum"),
+					`sum by (project_id) (sum_over_time(${LAT("sum")}[59999ms]))`,
+				)
+				assert.strictEqual(
+					yield* query(latencies, "count"),
+					`sum by (project_id) (sum_over_time(${LAT("count")}[59999ms]))`,
+				)
+			}),
+		)
+		it.effect("rates a delta _count per second of the window", () =>
+			Effect.gen(function* () {
+				assert.strictEqual(
+					yield* query(latencies, "rate"),
+					`sum by (project_id) (sum_over_time(${LAT("count")}[59999ms])) / 60`,
+				)
+			}),
+		)
+		it.effect("rates a cumulative _count and sums it as rate times the step", () =>
+			Effect.gen(function* () {
+				const cumulative = { ...latencies, metricKind: "CUMULATIVE" as const }
+				assert.strictEqual(
+					yield* query(cumulative, "rate"),
+					`sum by (project_id) (rate(${LAT("count")}[119999ms]))`,
+				)
+				assert.strictEqual(
+					yield* query(cumulative, "sum"),
+					`sum by (project_id) (rate(${LAT("sum")}[119999ms])) * 60`,
+				)
+			}),
+		)
+		for (const metric of ["min", "max"] as const) {
+			it.effect(`refuses ${metric}`, () =>
+				Effect.gen(function* () {
+					assert.include(yield* rejection(latencies, metric), `${metric} is not available`)
+				}),
+			)
+		}
+	})
+
+	it.effect("groups by the flat label and project, quoting names PromQL cannot spell bare", () =>
+		Effect.gen(function* () {
+			assert.strictEqual(
+				yield* query(transactions, "sum", { groupLabel: "database_id" }),
+				`sum by (database_id, project_id) (sum_over_time(${TX}[59999ms]))`,
+			)
+			assert.strictEqual(
+				yield* query(cpu, "max", { groupLabel: "k8s.pod.name" }),
+				`max by ("k8s.pod.name", project_id) (max_over_time(${CPU}[59999ms]))`,
+			)
+			assert.strictEqual(
+				yield* query(cpu, "max", { groupLabel: "project_id" }),
+				`max by (project_id) (max_over_time(${CPU}[59999ms]))`,
+			)
+		}),
+	)
+
+	it.effect("refuses values PromQL cannot chart", () =>
+		Effect.gen(function* () {
+			assert.include(yield* rejection({ ...cpu, valueType: "STRING" }, "avg"), "cannot be charted")
+		}),
+	)
+
+	it.effect("refuses service.name and deployment.environment filters", () =>
+		Effect.gen(function* () {
+			assert.include(
+				yield* rejection(cpu, "avg", { filters: { serviceName: ServiceName.make("api") } }),
+				"no service.name",
+			)
+			assert.include(
+				yield* rejection(cpu, "avg", {
+					filters: { environments: [DeploymentEnvironment.make("production")] },
+				}),
+				"no deployment.environment",
+			)
+		}),
+	)
+
+	describe("monitored_resource", () => {
+		const entries = descriptor({
+			type: "logging.googleapis.com/log_entry_count",
+			metricKind: "DELTA",
+			valueType: "INT64",
+			monitoredResourceTypes: ["gce_instance", "k8s_container"],
+		})
+		const entriesIn = (type: string) =>
+			`sum_over_time({"logging.googleapis.com/log_entry_count", monitored_resource="${type}"}[59999ms])`
+
+		it.effect("unions one exact selector per listed resource type inside the aggregation", () =>
+			Effect.gen(function* () {
+				assert.strictEqual(
+					yield* query(entries, "sum", { groupLabel: "severity" }),
+					`sum by (severity, project_id) (${entriesIn("gce_instance")} or ${entriesIn("k8s_container")})`,
+				)
+			}),
+		)
+
+		it.effect("uses a monitored_resource equals filter instead of the listed types", () =>
+			Effect.gen(function* () {
+				assert.strictEqual(
+					yield* query(entries, "sum", {
+						filters: {
+							resourceAttributeFilters: [
+								{ key: "monitored_resource", mode: "equals", value: "k8s_container" },
+							],
+						},
+					}),
+					`sum by (project_id) (${entriesIn("k8s_container")})`,
+				)
+			}),
+		)
+
+		it.effect("asks for a monitored_resource filter when Google lists no type", () =>
+			Effect.gen(function* () {
+				const unlisted = { ...entries, monitoredResourceTypes: [] }
+				assert.include(
+					yield* rejection(unlisted, "sum"),
+					"is reported for several resource types. Filter on one",
+				)
+				assert.strictEqual(
+					yield* query(unlisted, "sum", {
+						filters: {
+							resourceAttributeFilters: [
+								{ key: "monitored_resource", mode: "equals", value: "gce_instance" },
+							],
+						},
+					}),
+					`sum by (project_id) (${entriesIn("gce_instance")})`,
+				)
+			}),
+		)
+	})
+
+	describe("filters", () => {
+		const matchers = (filters: ReadonlyArray<AttributeFilter>) =>
+			query(cpu, "max", withFilters(filters)).pipe(
+				Effect.map((promQl) =>
+					promQl.slice(
+						`max by (project_id) (max_over_time({"cloudsql.googleapis.com/database/cpu/utilization", monitored_resource="cloudsql_database", `
+							.length,
+						-"}[59999ms]))".length,
+					),
+				),
+			)
+
+		it.effect("lowers equals, in, contains and exists", () =>
+			Effect.gen(function* () {
+				assert.strictEqual(
+					yield* matchers([{ key: "database_id", mode: "equals", value: "p:db" }]),
+					`database_id="p:db"`,
+				)
+				assert.strictEqual(
+					yield* matchers([{ key: "database_id", mode: "equals", value: "p:db", negated: true }]),
+					`database_id!="p:db"`,
+				)
+				assert.strictEqual(
+					yield* matchers([{ key: "region", mode: "in", values: ["us-east1", "eu.west"] }]),
+					`region=~"(?:us-east1|eu\\\\.west)"`,
+				)
+				assert.strictEqual(
+					yield* matchers([{ key: "region", mode: "in", values: ["a"], negated: true }]),
+					`region!~"(?:a)"`,
+				)
+				assert.strictEqual(
+					yield* matchers([{ key: "region", mode: "contains", value: "us" }]),
+					`region=~".*us.*"`,
+				)
+				assert.strictEqual(yield* matchers([{ key: "region", mode: "exists" }]), `region=~".+"`)
+				assert.strictEqual(
+					yield* matchers([{ key: "region", mode: "exists", negated: true }]),
+					`region=""`,
+				)
+			}),
+		)
+
+		it.effect("escapes string values and regex metacharacters", () =>
+			Effect.gen(function* () {
+				assert.strictEqual(
+					yield* matchers([{ key: "query", mode: "equals", value: 'say "hi"\\\nbye' }]),
+					`query="say \\"hi\\"\\\\\\nbye"`,
+				)
+				assert.strictEqual(
+					yield* matchers([{ key: "query", mode: "contains", value: "a+b(c)" }]),
+					`query=~".*a\\\\+b\\\\(c\\\\).*"`,
+				)
+				assert.strictEqual(
+					yield* matchers([{ key: "cloud.region", mode: "equals", value: "x" }]),
+					`"cloud.region"="x"`,
+				)
+			}),
+		)
+
+		it.effect("folds an OR group of equals/in on one label into one regex", () =>
+			Effect.gen(function* () {
+				assert.strictEqual(
+					yield* matchers([
+						{
+							key: "state",
+							mode: "equals",
+							value: "idle",
+							or: [{ key: "state", mode: "in", values: ["active", "waiting"] }],
+						},
+					]),
+					`state=~"(?:idle|active|waiting)"`,
+				)
+			}),
+		)
+
+		it.effect("refuses OR groups across labels and numeric comparisons", () =>
+			Effect.gen(function* () {
+				assert.include(
+					yield* rejection(
+						cpu,
+						"avg",
+						withFilters([
+							{
+								key: "a",
+								mode: "equals",
+								value: "1",
+								or: [{ key: "b", mode: "equals", value: "2" }],
+							},
+						]),
+					),
+					"OR filters",
+				)
+				assert.include(
+					yield* rejection(cpu, "avg", withFilters([{ key: "a", mode: "gt", value: "1" }])),
+					"Google Cloud labels are strings",
+				)
+			}),
+		)
+
+		it.effect("refuses an in filter without values, which ClickHouse would match nothing with", () =>
+			Effect.gen(function* () {
+				assert.include(
+					yield* rejection(cpu, "avg", withFilters([{ key: "region", mode: "in", values: [] }])),
+					"in filter on region",
+				)
+				assert.include(
+					yield* rejection(
+						cpu,
+						"avg",
+						withFilters([
+							{
+								key: "region",
+								mode: "equals",
+								value: "a",
+								or: [{ key: "region", mode: "in", values: [] }],
+							},
+						]),
+					),
+					"in filter on region",
+				)
+			}),
+		)
+	})
+})
+
+describe("gcpFilterProjects", () => {
+	const projects = (attributeFilters: ReadonlyArray<AttributeFilter>) =>
+		gcpFilterProjects({ metricName: MetricName.make(cpu.type), metricType: "gauge", attributeFilters })
+
+	it("narrows to the projects a positive equals or in filter names", () => {
+		assert.deepStrictEqual(projects([{ key: "project_id", mode: "in", values: ["alpha", "beta"] }]), [
+			"alpha",
+			"beta",
+		])
+		assert.deepStrictEqual(projects([{ key: "project_id", mode: "equals", value: "alpha" }]), ["alpha"])
+	})
+
+	it("reads every project for a negated, contains, OR or absent project filter", () => {
+		for (const filters of [
+			[{ key: "project_id", mode: "equals", value: "alpha", negated: true }],
+			[{ key: "project_id", mode: "contains", value: "alp" }],
+			[
+				{
+					key: "project_id",
+					mode: "equals",
+					value: "alpha",
+					or: [{ key: "region", mode: "equals", value: "eu" }],
+				},
+			],
+			[{ key: "region", mode: "equals", value: "eu" }],
+		] satisfies ReadonlyArray<ReadonlyArray<AttributeFilter>>) {
+			assert.isUndefined(projects(filters))
+		}
+	})
+})
+
+describe("compileGcpSampleCount", () => {
+	it.effect("counts a distribution's samples on its _count series, not its observations", () =>
+		Effect.gen(function* () {
+			const compiled = yield* compileGcpSampleCount(
+				request(latencies, "avg", { groupLabel: "method", windowSeconds: 300 }),
+				latencies,
+			)
+			assert.deepStrictEqual(compiled, {
+				query: `sum by (method, project_id) (count_over_time(${LAT("count")}[299999ms]))`,
+				merge: "sum",
+			})
+		}),
+	)
+
+	it.effect("counts a plain metric's samples", () =>
+		Effect.gen(function* () {
+			const compiled = yield* compileGcpSampleCount(request(cpu, "avg"), cpu)
+			assert.strictEqual(compiled.query, `sum by (project_id) (count_over_time(${CPU}[59999ms]))`)
+		}),
+	)
+})
+
+describe("discovery", () => {
+	it.effect("counts series per label value and project", () =>
+		Effect.gen(function* () {
+			assert.strictEqual(
+				yield* compileGcpLabelValues(cpu, "database_id", 86400),
+				`count by (database_id, project_id) (last_over_time(${CPU}[86399999ms]))`,
+			)
+		}),
+	)
+})
+
+describe("bucket alignment", () => {
+	const at = (iso: string) => Date.parse(iso)
+
+	it("evaluates from the first bucket's end to the last bucket's end", () => {
+		const window = gcpRangeWindow(at("2026-10-19T10:02:30Z"), at("2026-10-19T10:30:10Z"), 300)
+		assert.deepStrictEqual(window, {
+			stepSeconds: 300,
+			startSeconds: at("2026-10-19T10:05:00Z") / 1000,
+			endSeconds: at("2026-10-19T10:35:00Z") / 1000,
+		})
+	})
+
+	it("labels a point by the bucket it closes", () =>
+		assert.strictEqual(
+			gcpPointBucket(at("2026-10-19T10:05:00Z") / 1000, 300),
+			"2026-10-19T10:00:00.000Z",
+		))
+
+	it("never steps below Google's one-minute sample period", () =>
+		assert.strictEqual(gcpRangeWindow(0, 600_000, 15).stepSeconds, 60))
+})
diff --git a/packages/query-engine/src/promql/compile.ts b/packages/query-engine/src/promql/compile.ts
new file mode 100644
index 0000000000..a663c4b385
--- /dev/null
+++ b/packages/query-engine/src/promql/compile.ts
@@ -0,0 +1,322 @@
+// Metrics spec → PromQL for Google Cloud Monitoring's Prometheus-compatible API.
+//
+// Google flattens metric and resource labels onto one label set, so `attr.X` and `resource.X`
+// both read the label `X`. A metric written for several monitored resource types only answers a
+// selector with an exact `monitored_resource` matcher, so each type gets its own range function
+// and the outer aggregation unions them with `or`. Every aggregation keeps `project_id`: the
+// engine reads each project separately and combines a group's projects itself (`GcpPromQl.merge`).
+
+import { DateTime, Effect } from "effect"
+import { absurd } from "effect/Function"
+import type { GcpMetricDescriptor } from "@maple/domain/gcp-live-metrics"
+import { gcpMetricMapleType } from "@maple/domain/gcp-live-metrics"
+import { QueryEngineValidationError } from "@maple/domain/http"
+import type {
+	AttributeFilter,
+	AttributeFilterLeaf,
+	MetricsFilters,
+	MetricsMetric,
+} from "@maple/domain/query-engine"
+
+/** A Google Cloud metrics query the engine cannot run, the reason as its message. */
+export const reject = (message: string) => new QueryEngineValidationError({ message, details: [] })
+
+/** A double-quoted PromQL string literal. */
+export const promQlString = (value: string): string =>
+	`"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"').replaceAll("\n", "\\n")}"`
+
+const PLAIN_LABEL = /^[a-zA-Z_][a-zA-Z0-9_]*$/
+const labelName = (name: string): string => (PLAIN_LABEL.test(name) ? name : promQlString(name))
+
+const escapeRegex = (value: string): string => value.replace(/[\\.+*?()|[\]{}^$]/g, "\\$&")
+const anyOf = (values: ReadonlyArray<string>): string => `(?:${values.map(escapeRegex).join("|")})`
+
+interface Matcher {
+	readonly label: string
+	readonly op: "=" | "!=" | "=~" | "!~"
+	readonly value: string
+}
+
+const renderSelector = (metricName: string, matchers: ReadonlyArray<Matcher>): string =>
+	`{${[promQlString(metricName), ...matchers.map((m) => `${labelName(m.label)}${m.op}${promQlString(m.value)}`)].join(", ")}}`
+
+/** The values of a plain positive `equals` / `in` filter, else undefined. */
+const positiveValues = (filter: AttributeFilterLeaf): ReadonlyArray<string> | undefined => {
+	if (filter.negated) return undefined
+	if (filter.mode === "equals") return [filter.value ?? ""]
+	if (filter.mode === "in") return filter.values ?? []
+	return undefined
+}
+
+const leafMatcher = (filter: AttributeFilterLeaf): Effect.Effect<Matcher, QueryEngineValidationError> => {
+	const label = filter.key
+	const negated = filter.negated === true
+	switch (filter.mode) {
+		case "equals":
+			return Effect.succeed({ label, op: negated ? "!=" : "=", value: filter.value ?? "" })
+		case "in":
+			return Effect.succeed({ label, op: negated ? "!~" : "=~", value: anyOf(filter.values ?? []) })
+		case "contains":
+			return Effect.succeed({
+				label,
+				op: negated ? "!~" : "=~",
+				value: `.*${escapeRegex(filter.value ?? "")}.*`,
+			})
+		case "exists":
+			return Effect.succeed(negated ? { label, op: "=", value: "" } : { label, op: "=~", value: ".+" })
+		default:
+			return Effect.fail(
+				reject(
+					`Label ${label} cannot be compared with ${filter.mode}: Google Cloud labels are strings`,
+				),
+			)
+	}
+}
+
+const filterMatcher = (filter: AttributeFilter): Effect.Effect<Matcher, QueryEngineValidationError> => {
+	if (!filter.or?.length) return leafMatcher(filter)
+	const alternatives = [filter, ...filter.or]
+	const values = alternatives.map((alternative) =>
+		alternative.key === filter.key ? positiveValues(alternative) : undefined,
+	)
+	if (values.some((v) => v === undefined)) {
+		return Effect.fail(
+			reject(`OR filters on Google Cloud metrics must all be equals/in on one label (${filter.key})`),
+		)
+	}
+	return Effect.succeed({ label: filter.key, op: "=~", value: anyOf(values.flatMap((v) => v ?? [])) })
+}
+
+const labelFilters = (filters: MetricsFilters): ReadonlyArray<AttributeFilter> => [
+	...(filters.attributeFilters ?? []),
+	...(filters.resourceAttributeFilters ?? []),
+]
+
+/**
+ * The projects a plain positive `project_id` filter names, which the engine reads instead of
+ * all; undefined reads all. Narrowing only: the filter's matcher stays in the query.
+ */
+export const gcpFilterProjects = (filters: MetricsFilters): ReadonlyArray<string> | undefined => {
+	let projects: ReadonlyArray<string> | undefined
+	for (const filter of labelFilters(filters)) {
+		const values = filter.key === "project_id" && !filter.or?.length ? positiveValues(filter) : undefined
+		if (values?.length) projects = values
+	}
+	return projects
+}
+
+/**
+ * A range of `seconds`, open at its start. Google's ranges include a sample exactly `seconds`
+ * back, and its samples sit on the minute, so `[300s]` would also count the previous step's last
+ * sample: one millisecond less keeps adjacent steps apart.
+ */
+const range = (seconds: number): string => `[${seconds * 1000 - 1}ms]`
+
+/** `fn` over one selector of `metricName` per monitored resource type, unioned with `or`. */
+type Union = (metricName: string, fn: string, windowSeconds: number) => string
+
+const compileUnion = Effect.fnUntraced(function* (
+	descriptor: GcpMetricDescriptor,
+	filters: ReadonlyArray<AttributeFilter>,
+) {
+	const matchers: Matcher[] = []
+	let resourceTypes: ReadonlyArray<string> | undefined
+	for (const filter of filters) {
+		// ClickHouse's `IN ()` matches nothing; the empty regex would match series without the label.
+		const empty = [filter, ...(filter.or ?? [])].find(
+			(leaf) => leaf.mode === "in" && !leaf.values?.length,
+		)
+		if (empty !== undefined) return yield* reject(`The in filter on ${empty.key} lists no values`)
+		const values = filter.or?.length ? undefined : positiveValues(filter)
+		if (filter.key === "monitored_resource" && values) {
+			resourceTypes = values
+			continue
+		}
+		matchers.push(yield* filterMatcher(filter))
+	}
+	const types = resourceTypes ?? descriptor.monitoredResourceTypes
+	if (types.length === 0) {
+		return yield* reject(
+			`${descriptor.type} is reported for several resource types. Filter on one, e.g. resource.monitored_resource = "cloudsql_database".`,
+		)
+	}
+	const union: Union = (metricName, fn, windowSeconds) =>
+		types
+			.map(
+				(type) =>
+					`${fn}(${renderSelector(metricName, [{ label: "monitored_resource", op: "=", value: type }, ...matchers])}${range(windowSeconds)})`,
+			)
+			.join(" or ")
+	return union
+})
+
+/** The `by` labels: the group's, and always `project_id`. */
+const byLabels = (groupLabel: string | undefined): string =>
+	groupLabel === undefined || groupLabel === "project_id"
+		? "project_id"
+		: `${labelName(groupLabel)}, project_id`
+
+/** The series label values and sample counts read: a distribution answers as `_count` / `_sum`. */
+const seriesName = (descriptor: GcpMetricDescriptor): string =>
+	descriptor.valueType === "DISTRIBUTION" ? `${descriptor.type}_count` : descriptor.type
+
+/** An average's two parts, each summed across projects before the engine divides them. */
+const avgParts = (sum: string, count: string) =>
+	`label_replace(${sum}, "maple_part", "sum", "", "") or label_replace(${count}, "maple_part", "count", "", "")`
+
+export interface GcpPromQlRequest {
+	readonly metric: MetricsMetric
+	readonly filters: MetricsFilters
+	/** Flat label the result is grouped by; undefined is one ungrouped series. */
+	readonly groupLabel: string | undefined
+	/** Range-function window, in seconds: the step, or the whole range for an instant query. */
+	readonly windowSeconds: number
+}
+
+export interface GcpPromQl {
+	readonly query: string
+	/**
+	 * How the engine combines a group's series across projects. `avg` answers as two parts,
+	 * `maple_part="sum"` and `maple_part="count"`, and is their summed ratio.
+	 */
+	readonly merge: "sum" | "min" | "max" | "avg"
+}
+
+/** One value per group per evaluation step, matching the ClickHouse metrics semantics. */
+export const compileGcpMetricQuery = Effect.fnUntraced(function* (
+	request: GcpPromQlRequest,
+	descriptor: GcpMetricDescriptor,
+) {
+	const { filters, metric } = request
+	if (filters.serviceName !== undefined) {
+		return yield* reject(
+			"Google Cloud metrics have no service.name; filter on a label such as service_name or project_id",
+		)
+	}
+	if (filters.environments?.length) {
+		return yield* reject(
+			"Google Cloud metrics have no deployment.environment; filter on a label such as project_id",
+		)
+	}
+	if (gcpMetricMapleType(descriptor) === undefined) {
+		return yield* reject(`${descriptor.type} has ${descriptor.valueType} values, which cannot be charted`)
+	}
+
+	const union = yield* compileUnion(descriptor, labelFilters(filters))
+	const w = request.windowSeconds
+	const by = byLabels(request.groupLabel)
+	const aggregate = (aggregation: string, metricName: string, fn: string, window = w) =>
+		`${aggregation} by (${by}) (${union(metricName, fn, window)})`
+
+	// A cumulative counter needs two samples in its window, so its rate reads at least two
+	// minutes, and its increase is that rate times the step: adjacent steps' `increase` windows
+	// would overlap and count a sample twice.
+	const cumulative = descriptor.metricKind === "CUMULATIVE"
+	const counterWindow = Math.max(w, 120)
+	// A delta counter's samples are already increments: summing them is exact, unlike `increase`.
+	const total = (metricName: string) =>
+		cumulative
+			? `${aggregate("sum", metricName, "rate", counterWindow)} * ${w}`
+			: aggregate("sum", metricName, "sum_over_time")
+	const perSecond = (metricName: string) =>
+		cumulative ? aggregate("sum", metricName, "rate", counterWindow) : `${total(metricName)} / ${w}`
+
+	const type = descriptor.type
+	if (descriptor.valueType === "DISTRIBUTION") {
+		switch (metric) {
+			case "min":
+			case "max":
+				return yield* reject(
+					`${metric} is not available for the distribution ${type}; use avg, sum, count or rate`,
+				)
+			case "avg":
+				return {
+					query: avgParts(total(`${type}_sum`), total(`${type}_count`)),
+					merge: "avg",
+				} satisfies GcpPromQl
+			case "sum":
+				return { query: total(`${type}_sum`), merge: "sum" } satisfies GcpPromQl
+			case "count":
+			case "increase":
+				return { query: total(`${type}_count`), merge: "sum" } satisfies GcpPromQl
+			case "rate":
+				return { query: perSecond(`${type}_count`), merge: "sum" } satisfies GcpPromQl
+			default:
+				return absurd<GcpPromQl>(metric)
+		}
+	}
+
+	const gauge = descriptor.metricKind === "GAUGE"
+	switch (metric) {
+		case "avg":
+			// Every sample weighs the same, as in ClickHouse: not a mean of per-series means.
+			return {
+				query: avgParts(
+					aggregate("sum", type, "sum_over_time"),
+					aggregate("sum", type, "count_over_time"),
+				),
+				merge: "avg",
+			} satisfies GcpPromQl
+		case "min":
+		case "max":
+			return {
+				query: aggregate(metric, type, `${metric}_over_time`),
+				merge: metric,
+			} satisfies GcpPromQl
+		case "count":
+			return { query: aggregate("sum", type, "count_over_time"), merge: "sum" } satisfies GcpPromQl
+		case "sum":
+			return { query: total(type), merge: "sum" } satisfies GcpPromQl
+		case "increase":
+			return {
+				query: gauge ? `${aggregate("sum", type, "rate", counterWindow)} * ${w}` : total(type),
+				merge: "sum",
+			} satisfies GcpPromQl
+		case "rate":
+			return {
+				query: gauge ? aggregate("sum", type, "rate", counterWindow) : perSecond(type),
+				merge: "sum",
+			} satisfies GcpPromQl
+		default:
+			return absurd<GcpPromQl>(metric)
+	}
+})
+
+/** Samples per group per step, an alert's sample count: a distribution's are its `_count` samples. */
+export const compileGcpSampleCount = Effect.fnUntraced(function* (
+	request: GcpPromQlRequest,
+	descriptor: GcpMetricDescriptor,
+) {
+	const union = yield* compileUnion(descriptor, labelFilters(request.filters))
+	return {
+		query: `sum by (${byLabels(request.groupLabel)}) (${union(seriesName(descriptor), "count_over_time", request.windowSeconds)})`,
+		merge: "sum",
+	} satisfies GcpPromQl
+})
+
+/** Series per value of one label (and project) over the window. */
+export const compileGcpLabelValues = Effect.fnUntraced(function* (
+	descriptor: GcpMetricDescriptor,
+	label: string,
+	windowSeconds: number,
+) {
+	const union = yield* compileUnion(descriptor, [])
+	return `count by (${byLabels(label)}) (${union(seriesName(descriptor), "last_over_time", windowSeconds)})`
+})
+
+/**
+ * Range-query bounds for a bucketed timeseries. Google evaluates a point at `t` over
+ * `(t - step, t]` while Maple labels a bucket by its start, so the query runs from the first
+ * bucket's end to the last bucket's end and a point at `t` belongs to the bucket at `t - step`.
+ * The last bucket's end may lie in the future; Google answers it with what has arrived so far.
+ */
+export const gcpRangeWindow = (startMs: number, endMs: number, bucketSeconds: number) => {
+	const stepSeconds = Math.max(60, bucketSeconds)
+	const firstBucket = Math.floor(startMs / 1000 / stepSeconds) * stepSeconds
+	const lastBucket = Math.floor(endMs / 1000 / stepSeconds) * stepSeconds
+	return { stepSeconds, startSeconds: firstBucket + stepSeconds, endSeconds: lastBucket + stepSeconds }
+}
+
+/** The ISO bucket a range-query point at `pointSeconds` belongs to. */
+export const gcpPointBucket = (pointSeconds: number, stepSeconds: number): string =>
+	DateTime.formatIso(DateTime.makeUnsafe((pointSeconds - stepSeconds) * 1000))
diff --git a/packages/query-engine/src/runtime/gcp-metrics.test.ts b/packages/query-engine/src/runtime/gcp-metrics.test.ts
new file mode 100644
index 0000000000..4dc3f073f9
--- /dev/null
+++ b/packages/query-engine/src/runtime/gcp-metrics.test.ts
@@ -0,0 +1,602 @@
+import { assert, describe, it } from "@effect/vitest"
+import { MetricName, OrgId } from "@maple/domain"
+import type { GcpMetricDescriptor, GcpPromQlSeries } from "@maple/domain/gcp-live-metrics"
+import { GcpLiveQueryUnavailableError } from "@maple/domain/http/gcp-live-query-errors"
+import { QueryEngineValidationError } from "@maple/domain/http"
+import { QueryEngineExecuteRequest, type QueryEngineResult, type QuerySpec } from "@maple/domain/query-engine"
+import { Effect } from "effect"
+import type { GcpLiveMetrics, GcpReadScope } from "./live-metrics"
+import {
+	makeQueryEngineEvaluate,
+	makeQueryEngineEvaluateSeries,
+	makeQueryEngineExecute,
+	type AlertEvaluateRequest,
+	type QueryEngineWarehouse,
+} from "./query-engine"
+
+const tenant = { orgId: OrgId.make("org_gcp_live_test") }
+
+const TX = "cloudsql.googleapis.com/database/postgresql/transaction_count"
+const transactions: GcpMetricDescriptor = {
+	type: TX,
+	metricKind: "DELTA",
+	valueType: "INT64",
+	unit: "1",
+	description: "",
+	monitoredResourceTypes: ["cloudsql_database"],
+	labels: ["transaction_type"],
+}
+const LAT = "serviceruntime.googleapis.com/api/request_latencies"
+const latencies: GcpMetricDescriptor = {
+	...transactions,
+	type: LAT,
+	valueType: "DISTRIBUTION",
+	monitoredResourceTypes: ["consumed_api"],
+	labels: [],
+}
+const SELECTOR = `{"${TX}", monitored_resource="cloudsql_database"}`
+
+const seconds = (iso: string) => Date.parse(iso) / 1000
+
+interface Calls {
+	readonly range: Array<Parameters<GcpLiveMetrics["queryRange"]>[1]>
+	readonly instant: Array<Parameters<GcpLiveMetrics["queryInstant"]>[1]>
+	readonly listed: Array<GcpReadScope>
+	readonly resourceTypes: Array<GcpReadScope>
+	warehouse: number
+}
+
+const makeFakes = (answer: (query: string) => ReadonlyArray<GcpPromQlSeries> = () => []) => {
+	const calls: Calls = { range: [], instant: [], listed: [], resourceTypes: [], warehouse: 0 }
+	const gcp: GcpLiveMetrics = {
+		queryRange: (_tenant, request) => {
+			calls.range.push(request)
+			return Effect.succeed(answer(request.query))
+		},
+		queryInstant: (_tenant, request) => {
+			calls.instant.push(request)
+			return Effect.succeed(answer(request.query))
+		},
+		listMetrics: (_tenant, request) => {
+			calls.listed.push(request)
+			return Effect.succeed([transactions, latencies])
+		},
+		listResourceTypes: (_tenant, request) => {
+			calls.resourceTypes.push(request)
+			return Effect.succeed([
+				{ type: "cloudsql_database", labels: ["project_id", "database_id", "region"] },
+				{ type: "gce_instance", labels: ["project_id", "instance_id", "zone"] },
+			])
+		},
+	}
+	const warehouse: QueryEngineWarehouse = {
+		rawSqlQuery: () => Effect.die("unexpected rawSqlQuery"),
+		compiledQuery: () => {
+			calls.warehouse++
+			return Effect.succeed([])
+		},
+		compiledQueryWithCapabilities: () => Effect.die("unexpected capability-aware query"),
+	}
+	return { calls, gcp, warehouse }
+}
+
+const series = (labels: Record<string, string>, points: ReadonlyArray<readonly [string, number]>) => ({
+	labels,
+	points: points.map(([iso, value]) => [seconds(iso), value] as const),
+})
+
+const execute = (
+	fakes: { readonly warehouse: QueryEngineWarehouse; readonly gcp?: GcpLiveMetrics },
+	query: QuerySpec,
+) =>
+	makeQueryEngineExecute(fakes.warehouse, fakes.gcp)(
+		tenant,
+		new QueryEngineExecuteRequest({
+			startTime: "2026-10-19 10:00:00",
+			endTime: "2026-10-19 10:15:00",
+			query,
+		}),
+	)
+
+type DataOf<Kind> =
+	Extract<QueryEngineResult, { kind: Kind }> extends { readonly data: infer Data } ? Data : never
+
+const dataOf = <Kind extends QueryEngineResult["kind"]>(
+	response: { readonly result: QueryEngineResult },
+	kind: Kind,
+): DataOf<Kind> =>
+	response.result.kind === kind
+		? (response.result.data as DataOf<Kind>)
+		: assert.fail(`expected a ${kind} result, got ${response.result.kind}`)
+
+const metricFilters = (metricName: string) => ({
+	metricName: MetricName.make(metricName),
+	metricType: "sum" as const,
+})
+
+const timeseries = (overrides: Partial<Extract<QuerySpec, { kind: "timeseries"; source: "metrics" }>> = {}) =>
+	({
+		kind: "timeseries",
+		source: "metrics",
+		metric: "sum",
+		filters: metricFilters(TX),
+		bucketSeconds: 300,
+		...overrides,
+	}) satisfies QuerySpec
+
+const byDatabase = (overrides: Partial<Extract<QuerySpec, { kind: "timeseries"; source: "metrics" }>> = {}) =>
+	timeseries({
+		groupBy: ["attribute"],
+		filters: { ...metricFilters(TX), groupByAttributeKey: "database_id" },
+		...overrides,
+	})
+
+describe("Google Cloud metrics routing", () => {
+	it.effect(
+		"answers a Cloud Monitoring metric from Google and labels points by the bucket they close",
+		() =>
+			Effect.gen(function* () {
+				const fakes = makeFakes(() => [
+					series({ database_id: "p:main", project_id: "alpha" }, [
+						["2026-10-19T10:05:00Z", 4],
+						["2026-10-19T10:10:00Z", 7],
+					]),
+					series({ project_id: "alpha" }, [["2026-10-19T10:10:00Z", 1]]),
+				])
+
+				const response = yield* execute(fakes, byDatabase())
+
+				assert.strictEqual(fakes.calls.warehouse, 0)
+				assert.deepStrictEqual(fakes.calls.range, [
+					{
+						query: `sum by (database_id, project_id) (sum_over_time(${SELECTOR}[299999ms]))`,
+						startSeconds: seconds("2026-10-19T10:05:00Z"),
+						endSeconds: seconds("2026-10-19T10:20:00Z"),
+						stepSeconds: 300,
+						projects: undefined,
+						requireComplete: undefined,
+						discovery: undefined,
+					},
+				])
+				assert.deepStrictEqual(dataOf(response, "timeseries"), [
+					{ bucket: "2026-10-19T10:00:00.000Z", series: { "p:main": 4 } },
+					{ bucket: "2026-10-19T10:05:00.000Z", series: { "p:main": 7, "(empty)": 1 } },
+					{ bucket: "2026-10-19T10:10:00.000Z", series: {} },
+					{ bucket: "2026-10-19T10:15:00.000Z", series: {} },
+				])
+			}),
+	)
+
+	it.effect("keeps every other metric on the warehouse", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes()
+			yield* execute(fakes, timeseries({ filters: metricFilters("http.server.duration") }))
+			assert.strictEqual(fakes.calls.warehouse, 1)
+			assert.strictEqual(fakes.calls.range.length, 0)
+		}),
+	)
+
+	it.effect("returns one ungrouped series, ignoring a service group-by", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(() => [series({ project_id: "alpha" }, [["2026-10-19T10:05:00Z", 3]])])
+			const response = yield* execute(fakes, timeseries({ groupBy: ["service"] }))
+			assert.deepStrictEqual(dataOf(response, "timeseries")[0], {
+				bucket: "2026-10-19T10:00:00.000Z",
+				series: { all: 3 },
+			})
+			assert.include(fakes.calls.range[0]?.query ?? "", "sum by (project_id) (")
+		}),
+	)
+
+	it.effect("sums a group across projects, and reads a project two metrics scopes answer once", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(() => [
+				series({ database_id: "main", project_id: "alpha" }, [["2026-10-19T10:05:00Z", 4]]),
+				series({ database_id: "main", project_id: "beta" }, [["2026-10-19T10:05:00Z", 3]]),
+				// beta again, from a second scope that also monitors it.
+				series({ project_id: "beta", database_id: "main" }, [["2026-10-19T10:05:00Z", 3]]),
+				series({ database_id: "replica", project_id: "beta" }, [["2026-10-19T10:05:00Z", 1]]),
+			])
+			const response = yield* execute(fakes, byDatabase())
+			assert.deepStrictEqual(dataOf(response, "timeseries")[0], {
+				bucket: "2026-10-19T10:00:00.000Z",
+				series: { main: 7, replica: 1 },
+			})
+		}),
+	)
+
+	it.effect("merges min, max and avg across projects by their own reducer", () =>
+		Effect.gen(function* () {
+			const at = (value: number) => [["2026-10-19T10:05:00Z", value]] as const
+			const merged = (metric: "min" | "max" | "avg", answer: ReadonlyArray<GcpPromQlSeries>) =>
+				execute(
+					makeFakes(() => answer),
+					timeseries({ metric }),
+				).pipe(Effect.map((response) => dataOf(response, "timeseries")[0]?.series))
+
+			const extremes = [
+				series({ project_id: "alpha" }, at(4)),
+				series({ project_id: "beta" }, at(9)),
+				series({ project_id: "gamma" }, at(2)),
+			]
+			assert.deepStrictEqual(yield* merged("min", extremes), { all: 2 })
+			assert.deepStrictEqual(yield* merged("max", extremes), { all: 9 })
+			// alpha averages 4 over 2 series, beta 2 over 1: 6 / 3, not the mean of 2 and 2.
+			assert.deepStrictEqual(
+				yield* merged("avg", [
+					series({ project_id: "alpha", maple_part: "sum" }, at(4)),
+					series({ project_id: "alpha", maple_part: "count" }, at(2)),
+					series({ project_id: "beta", maple_part: "sum" }, at(2)),
+					series({ project_id: "beta", maple_part: "count" }, at(1)),
+				]),
+				{ all: 2 },
+			)
+		}),
+	)
+
+	it.effect("averages every sample alike, not each series' mean", () =>
+		Effect.gen(function* () {
+			// One series with a single 0 and another with five 10s: Google sums 50 over 6 samples.
+			const fakes = makeFakes(() => [
+				series({ project_id: "alpha", maple_part: "sum" }, [["2026-10-19T10:05:00Z", 50]]),
+				series({ project_id: "alpha", maple_part: "count" }, [["2026-10-19T10:05:00Z", 6]]),
+			])
+			const response = yield* execute(fakes, timeseries({ metric: "avg" }))
+			assert.include(fakes.calls.range[0]?.query ?? "", "sum by (project_id) (count_over_time(")
+			assert.deepStrictEqual(dataOf(response, "timeseries")[0]?.series, { all: 50 / 6 })
+		}),
+	)
+
+	it.effect("caps the merged groups to the highest peaks", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(() => [
+				series({ database_id: "low", project_id: "alpha" }, [["2026-10-19T10:05:00Z", 6]]),
+				// Highest across projects only once alpha and beta are summed.
+				series({ database_id: "split", project_id: "alpha" }, [["2026-10-19T10:05:00Z", 5]]),
+				series({ database_id: "split", project_id: "beta" }, [["2026-10-19T10:05:00Z", 5]]),
+				series({ database_id: "mid", project_id: "beta" }, [["2026-10-19T10:10:00Z", 7]]),
+			])
+			const response = yield* execute(fakes, byDatabase({ seriesLimit: 2 }))
+			const names = new Set(
+				dataOf(response, "timeseries").flatMap((point) => Object.keys(point.series)),
+			)
+			assert.deepStrictEqual([...names].sort(), ["mid", "split"])
+		}),
+	)
+
+	it.effect("reads an unknown metric as no data, with every bucket still present", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes()
+			const response = yield* execute(
+				fakes,
+				timeseries({ filters: metricFilters("cloudsql.googleapis.com/database/never_reported") }),
+			)
+			assert.strictEqual(fakes.calls.range.length, 0)
+			const data = dataOf(response, "timeseries")
+			assert.strictEqual(data.length, 4)
+			assert.isTrue(data.every((point) => Object.keys(point.series).length === 0))
+		}),
+	)
+
+	it.effect("fails as unavailable when the deployment has no Google port", () =>
+		Effect.gen(function* () {
+			const error = yield* Effect.flip(execute({ warehouse: makeFakes().warehouse }, timeseries()))
+			assert.instanceOf(error, GcpLiveQueryUnavailableError)
+			assert.strictEqual(
+				error.message,
+				"Google Cloud metrics are not available on this Maple deployment.",
+			)
+		}),
+	)
+
+	it.effect("narrows the metric listing and the query to the filtered projects", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes()
+			yield* execute(
+				fakes,
+				timeseries({
+					filters: {
+						...metricFilters(TX),
+						resourceAttributeFilters: [{ key: "project_id", mode: "equals", value: "alpha" }],
+					},
+				}),
+			)
+			// A chart lists with the query's own project selection, never discovery's first 20.
+			assert.deepStrictEqual(fakes.calls.listed, [
+				{ projects: ["alpha"], requireComplete: undefined, discovery: undefined },
+			])
+			assert.deepStrictEqual(fakes.calls.range[0]?.projects, ["alpha"])
+			assert.include(fakes.calls.range[0]?.query ?? "", `project_id="alpha"`)
+		}),
+	)
+
+	it.effect("says why a query is refused in the message", () =>
+		Effect.gen(function* () {
+			const error = yield* Effect.flip(
+				execute(
+					makeFakes(),
+					timeseries({
+						filters: {
+							...metricFilters(TX),
+							attributeFilters: [{ key: "database_id", mode: "in", values: [] }],
+						},
+					}),
+				),
+			)
+			assert.instanceOf(error, QueryEngineValidationError)
+			assert.include(error.message, "database_id")
+		}),
+	)
+})
+
+describe("Google Cloud metrics breakdown", () => {
+	const breakdown = (
+		overrides: Partial<Extract<QuerySpec, { kind: "breakdown"; source: "metrics" }>> = {},
+	) =>
+		({
+			kind: "breakdown",
+			source: "metrics",
+			metric: "rate",
+			groupBy: "attribute",
+			filters: { ...metricFilters(TX), groupByAttributeKey: "database_id" },
+			...overrides,
+		}) satisfies QuerySpec
+
+	it.effect("ranks groups, summed across projects, from one instant query over the whole range", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(() => [
+				series({ database_id: "a", project_id: "alpha" }, [["2026-10-19T10:15:00Z", 2]]),
+				series({ database_id: "a", project_id: "beta" }, [["2026-10-19T10:15:00Z", 4]]),
+				series({ database_id: "b", project_id: "alpha" }, [["2026-10-19T10:15:00Z", 5]]),
+				series({ database_id: "c", project_id: "alpha" }, [["2026-10-19T10:15:00Z", 1]]),
+			])
+			const response = yield* execute(fakes, breakdown({ limit: 2 }))
+			assert.deepStrictEqual(fakes.calls.instant, [
+				{
+					query: `sum by (database_id, project_id) (sum_over_time(${SELECTOR}[899999ms])) / 900`,
+					timeSeconds: seconds("2026-10-19T10:15:00Z"),
+					projects: undefined,
+					requireComplete: undefined,
+					discovery: undefined,
+				},
+			])
+			assert.deepStrictEqual(dataOf(response, "breakdown"), [
+				{ name: "a", value: 6 },
+				{ name: "b", value: 5 },
+			])
+		}),
+	)
+
+	it.effect("asks for a label group instead of service", () =>
+		Effect.gen(function* () {
+			const error = yield* Effect.flip(execute(makeFakes(), breakdown({ groupBy: "service" })))
+			assert.instanceOf(error, QueryEngineValidationError)
+			assert.include(error.message, "no service.name")
+		}),
+	)
+})
+
+const ENTRIES = "logging.googleapis.com/log_entry_count"
+const entries: GcpMetricDescriptor = {
+	...transactions,
+	type: ENTRIES,
+	monitoredResourceTypes: [],
+	labels: ["severity", "log"],
+}
+
+describe("Google Cloud metric discovery", () => {
+	it.effect("reads labels as discovery: the first 20 projects past the cap, not a refusal", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes()
+			yield* execute(fakes, { kind: "attributeKeys", source: "metrics", metricName: TX })
+			yield* execute(fakes, {
+				kind: "attributeValues",
+				source: "metrics",
+				scope: "metric",
+				attributeKey: "database_id",
+				metricName: TX,
+			})
+			assert.isTrue(
+				[...fakes.calls.listed, ...fakes.calls.resourceTypes, ...fakes.calls.instant].every(
+					(call) => call.discovery === true,
+				),
+			)
+		}),
+	)
+
+	it.effect("lists a metric without resource types by its labels, without reading Google", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes()
+			const gcp: GcpLiveMetrics = { ...fakes.gcp, listMetrics: () => Effect.succeed([entries]) }
+			const keys = yield* execute(
+				{ warehouse: fakes.warehouse, gcp },
+				{ kind: "attributeKeys", source: "metrics", metricName: ENTRIES },
+			)
+			assert.deepStrictEqual(
+				dataOf(keys, "attributeKeys").map((item) => item.key),
+				["severity", "log", "project_id", "monitored_resource"],
+			)
+			const values = yield* execute(
+				{ warehouse: fakes.warehouse, gcp },
+				{
+					kind: "attributeValues",
+					source: "metrics",
+					scope: "metric",
+					attributeKey: "severity",
+					metricName: ENTRIES,
+				},
+			)
+			assert.deepStrictEqual(dataOf(values, "attributeValues"), [])
+			assert.lengthOf(fakes.calls.instant, 0)
+			assert.lengthOf(fakes.calls.resourceTypes, 0)
+
+			// A chart still asks for the resource type.
+			const chart = yield* Effect.flip(
+				execute({ warehouse: fakes.warehouse, gcp }, timeseries({ filters: metricFilters(ENTRIES) })),
+			)
+			assert.instanceOf(chart, QueryEngineValidationError)
+			assert.strictEqual(
+				chart.message,
+				`${ENTRIES} is reported for several resource types. Filter on one, e.g. resource.monitored_resource = "cloudsql_database".`,
+			)
+		}),
+	)
+
+	it.effect("lists the metric's labels, then its resource types' labels, without reading series", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes()
+			const all = yield* execute(fakes, { kind: "attributeKeys", source: "metrics", metricName: TX })
+			assert.deepStrictEqual(dataOf(all, "attributeKeys"), [
+				{ key: "transaction_type", count: 0 },
+				{ key: "project_id", count: 0 },
+				{ key: "database_id", count: 0 },
+				{ key: "region", count: 0 },
+				{ key: "monitored_resource", count: 0 },
+			])
+			const resource = yield* execute(fakes, {
+				kind: "attributeKeys",
+				source: "metrics",
+				metricName: TX,
+				scope: "resource",
+			})
+			assert.deepStrictEqual(
+				dataOf(resource, "attributeKeys").map((item) => item.key),
+				["project_id", "database_id", "region", "monitored_resource"],
+			)
+			assert.lengthOf(fakes.calls.instant, 0)
+		}),
+	)
+
+	it.effect("lists a label's values with their series counts summed across projects", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(() => [
+				series({ database_id: "a", project_id: "alpha" }, [["2026-10-19T10:15:00Z", 1]]),
+				series({ database_id: "b", project_id: "alpha" }, [["2026-10-19T10:15:00Z", 1]]),
+				series({ database_id: "b", project_id: "beta" }, [["2026-10-19T10:15:00Z", 2]]),
+				series({ project_id: "beta" }, [["2026-10-19T10:15:00Z", 9]]),
+			])
+			const response = yield* execute(fakes, {
+				kind: "attributeValues",
+				source: "metrics",
+				scope: "metric",
+				attributeKey: "database_id",
+				metricName: TX,
+			})
+			assert.strictEqual(
+				fakes.calls.instant[0]?.query,
+				`count by (database_id, project_id) (last_over_time(${SELECTOR}[899999ms]))`,
+			)
+			assert.deepStrictEqual(dataOf(response, "attributeValues"), [
+				{ value: "b", count: 3 },
+				{ value: "a", count: 1 },
+			])
+		}),
+	)
+})
+
+describe("Google Cloud metric alerts", () => {
+	const alertRequest = (query: QuerySpec): AlertEvaluateRequest => ({
+		startTime: "2026-10-19 10:00:00",
+		endTime: "2026-10-19 10:05:00",
+		source: { kind: "spec", query },
+		reducer: "identity",
+		sampleCountStrategy: "metric_data_points",
+	})
+	const answer = (query: string) =>
+		query.includes("count_over_time")
+			? [
+					series({ database_id: "a", project_id: "alpha" }, [["2026-10-19T10:05:00Z", 3]]),
+					series({ database_id: "a", project_id: "beta" }, [["2026-10-19T10:05:00Z", 2]]),
+				]
+			: [
+					series({ database_id: "a", project_id: "alpha" }, [["2026-10-19T10:05:00Z", 40]]),
+					series({ database_id: "a", project_id: "beta" }, [["2026-10-19T10:05:00Z", 2]]),
+					series({ database_id: "b", project_id: "alpha" }, [["2026-10-19T10:05:00Z", 7]]),
+				]
+	const grouped = byDatabase({ bucketSeconds: 60 })
+
+	// The window's end, four minutes back: Google's ingestion delay.
+	it.effect("evaluates the window as one instant query per group, merged across projects", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(answer)
+			const result = yield* makeQueryEngineEvaluate(fakes.warehouse, fakes.gcp)(
+				tenant,
+				alertRequest(grouped),
+			)
+			assert.deepStrictEqual(
+				fakes.calls.instant.map((call) => [call.query, call.timeSeconds]),
+				[
+					[
+						`sum by (database_id, project_id) (sum_over_time(${SELECTOR}[299999ms]))`,
+						seconds("2026-10-19T10:01:00Z"),
+					],
+					[
+						`sum by (database_id, project_id) (count_over_time(${SELECTOR}[299999ms]))`,
+						seconds("2026-10-19T10:01:00Z"),
+					],
+				],
+			)
+			assert.deepStrictEqual(result, [
+				{ groupKey: "a", value: 42, sampleCount: 5, hasData: true },
+				{ groupKey: "b", value: null, sampleCount: 0, hasData: false },
+			])
+		}),
+	)
+
+	it.effect("requires every project to answer, for the listing and both queries", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(answer)
+			yield* makeQueryEngineEvaluate(fakes.warehouse, fakes.gcp)(tenant, alertRequest(grouped))
+			yield* makeQueryEngineEvaluateSeries(fakes.warehouse, fakes.gcp)(tenant, alertRequest(grouped))
+			assert.isTrue(
+				[...fakes.calls.listed, ...fakes.calls.instant, ...fakes.calls.range].every(
+					(call) => call.requireComplete === true,
+				),
+			)
+			assert.lengthOf(fakes.calls.listed, 2)
+		}),
+	)
+
+	it.effect("counts a distribution's samples, not its observations", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(() => [])
+			yield* makeQueryEngineEvaluate(fakes.warehouse, fakes.gcp)(
+				tenant,
+				alertRequest(timeseries({ metric: "avg", filters: metricFilters(LAT) })),
+			)
+			assert.strictEqual(
+				fakes.calls.instant[1]?.query,
+				`sum by (project_id) (count_over_time({"${LAT}_count", monitored_resource="consumed_api"}[299999ms]))`,
+			)
+		}),
+	)
+
+	it.effect("previews the alert as bucketed range queries", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(answer)
+			const result = yield* makeQueryEngineEvaluateSeries(fakes.warehouse, fakes.gcp)(
+				tenant,
+				alertRequest(grouped),
+			)
+			assert.strictEqual(fakes.calls.range.length, 2)
+			// The preview charts what has arrived, like the chart itself: no ingestion-delay shift.
+			assert.strictEqual(fakes.calls.range[0]?.endSeconds, seconds("2026-10-19T10:06:00Z"))
+			assert.deepStrictEqual(result[0], {
+				bucket: "2026-10-19T10:04:00.000Z",
+				groupKey: "a",
+				value: 42,
+				sampleCount: 5,
+			})
+		}),
+	)
+
+	it.effect("fails as unavailable without a Google port", () =>
+		Effect.gen(function* () {
+			const fakes = makeFakes(answer)
+			const error = yield* Effect.flip(
+				makeQueryEngineEvaluate(fakes.warehouse)(tenant, alertRequest(grouped)),
+			)
+			assert.instanceOf(error, GcpLiveQueryUnavailableError)
+		}),
+	)
+})
diff --git a/packages/query-engine/src/runtime/gcp-metrics.ts b/packages/query-engine/src/runtime/gcp-metrics.ts
new file mode 100644
index 0000000000..ca9a1b6ca7
--- /dev/null
+++ b/packages/query-engine/src/runtime/gcp-metrics.ts
@@ -0,0 +1,332 @@
+// Metrics queries on a Cloud Monitoring metric type, answered live from Google (see
+// `../promql/compile`). Each returns rows the engine shapes exactly like its ClickHouse results.
+
+import { DateTime, Effect } from "effect"
+import type { GcpPromQlSeries } from "@maple/domain/gcp-live-metrics"
+import {
+	GCP_LIVE_METRICS_NOT_AVAILABLE,
+	GcpLiveQueryUnavailableError,
+} from "@maple/domain/http/gcp-live-query-errors"
+import type { MetricsFilters, QuerySpec } from "@maple/domain/query-engine"
+import { ENGINE_UNGROUPED_GROUP_KEY } from "../group-key"
+import {
+	compileGcpLabelValues,
+	compileGcpMetricQuery,
+	compileGcpSampleCount,
+	gcpFilterProjects,
+	gcpPointBucket,
+	gcpRangeWindow,
+	reject,
+	type GcpPromQl,
+} from "../promql/compile"
+import type { GcpLiveMetrics } from "./live-metrics"
+import type { BucketGroupObs, QueryTenant } from "./query-engine"
+
+type MetricsTimeseriesSpec = Extract<QuerySpec, { readonly source: "metrics"; readonly kind: "timeseries" }>
+type MetricsBreakdownSpec = Extract<QuerySpec, { readonly source: "metrics"; readonly kind: "breakdown" }>
+
+export interface GcpTimeseriesRow {
+	readonly bucket: string
+	readonly groupName: string
+	readonly value: number
+}
+
+/** The metric's descriptor, read from the projects the query reads. */
+const describe = Effect.fnUntraced(function* <T extends QueryTenant>(
+	gcp: GcpLiveMetrics<T> | undefined,
+	tenant: T,
+	metricName: string,
+	scope: {
+		readonly filters?: MetricsFilters
+		readonly requireComplete?: boolean
+		readonly discovery?: boolean
+	} = {},
+) {
+	if (gcp === undefined) {
+		return yield* new GcpLiveQueryUnavailableError({ message: GCP_LIVE_METRICS_NOT_AVAILABLE })
+	}
+	const read = {
+		projects: scope.filters === undefined ? undefined : gcpFilterProjects(scope.filters),
+		requireComplete: scope.requireComplete,
+		discovery: scope.discovery,
+	}
+	const metrics = yield* gcp.listMetrics(tenant, read)
+	return { port: gcp, read, descriptor: metrics.find((metric) => metric.type === metricName) }
+})
+
+const annotate = (promQl: string) =>
+	Effect.annotateCurrentSpan({ "maple.query.backend": "gcp", "maple.gcp.promql": promQl })
+
+const groupLabelOf = (groupBy: ReadonlyArray<string>, filters: MetricsFilters): string | undefined => {
+	if (groupBy.includes("none")) return undefined
+	if (groupBy.includes("attribute")) return filters.groupByAttributeKey
+	if (groupBy.includes("resource_attribute")) return filters.groupByResourceAttributeKey
+	return undefined
+}
+
+/**
+ * Google can take up to ~4 minutes to make a sample visible. An alert evaluating a short window
+ * at its end would read it empty, so its read ends this much earlier.
+ */
+const GCP_INGESTION_DELAY_SECONDS = 240
+
+/** A whole-range window: whole seconds, at least one Google sample period. */
+const wholeWindowSeconds = (rangeSeconds: number): number => Math.max(60, Math.ceil(rangeSeconds))
+
+/** A series' group: ungrouped, or its label's value, `empty` when the series lacks it. */
+const groupOf = (groupLabel: string | undefined, empty: string) => (labels: GcpPromQlSeries["labels"]) =>
+	groupLabel === undefined ? ENGINE_UNGROUPED_GROUP_KEY : labels[groupLabel] || empty
+
+interface MergedPoint {
+	readonly seconds: number
+	readonly group: string
+	readonly value: number
+}
+
+/**
+ * One value per point time and group across projects. Overlapping metrics scopes answer a
+ * project twice, so a label set seen before is skipped; the rest combine with `merge`.
+ */
+const mergeGcpSeries = (
+	series: ReadonlyArray<GcpPromQlSeries>,
+	merge: GcpPromQl["merge"],
+	groupOfLabels: (labels: GcpPromQlSeries["labels"]) => string,
+): ReadonlyArray<MergedPoint> => {
+	const seen = new Set<string>()
+	const cells = new Map<string, { seconds: number; group: string; value?: number; count: number }>()
+	for (const one of series) {
+		const key = JSON.stringify(Object.entries(one.labels).sort(([a], [b]) => a.localeCompare(b)))
+		if (seen.has(key)) continue
+		seen.add(key)
+		const name = groupOfLabels(one.labels)
+		const isCount = merge === "avg" && one.labels.maple_part === "count"
+		for (const [seconds, value] of one.points) {
+			const cellKey = `${seconds} ${name}`
+			const cell = cells.get(cellKey) ?? { seconds, group: name, count: 0 }
+			cells.set(cellKey, cell)
+			if (isCount) cell.count += value
+			else if (cell.value === undefined) cell.value = value
+			else
+				cell.value =
+					merge === "min"
+						? Math.min(cell.value, value)
+						: merge === "max"
+							? Math.max(cell.value, value)
+							: cell.value + value
+		}
+	}
+	return [...cells.values()].flatMap(({ seconds, group, value, count }) => {
+		if (value === undefined) return []
+		if (merge !== "avg") return [{ seconds, group, value }]
+		return count > 0 ? [{ seconds, group, value: value / count }] : []
+	})
+}
+
+/** Keep the `limit` groups with the highest peak, ties by name, like `finalizeTimeseries`. */
+const capSeries = (rows: ReadonlyArray<GcpTimeseriesRow>, limit: number): ReadonlyArray<GcpTimeseriesRow> => {
+	const peaks = new Map<string, number>()
+	for (const row of rows)
+		peaks.set(row.groupName, Math.max(peaks.get(row.groupName) ?? -Infinity, row.value))
+	const kept = new Set(
+		[...peaks]
+			.sort(([leftName, left], [rightName, right]) => right - left || leftName.localeCompare(rightName))
+			.slice(0, limit)
+			.map(([name]) => name),
+	)
+	return rows.filter((row) => kept.has(row.groupName))
+}
+
+/** Bucketed series; `stepSeconds` is the bucket width the points sit on. */
+export const gcpMetricsTimeseries = Effect.fnUntraced(function* <T extends QueryTenant>(
+	gcp: GcpLiveMetrics<T> | undefined,
+	tenant: T,
+	query: MetricsTimeseriesSpec,
+	range: { readonly startMs: number; readonly endMs: number; readonly bucketSeconds: number },
+) {
+	const window = gcpRangeWindow(range.startMs, range.endMs, range.bucketSeconds)
+	const { port, read, descriptor } = yield* describe(gcp, tenant, query.filters.metricName, {
+		filters: query.filters,
+	})
+	if (descriptor === undefined || window.startSeconds > window.endSeconds) {
+		return { stepSeconds: window.stepSeconds, rows: [] }
+	}
+	const groupLabel = groupLabelOf(query.groupBy ?? [], query.filters)
+	const compiled = yield* compileGcpMetricQuery(
+		{ metric: query.metric, filters: query.filters, groupLabel, windowSeconds: window.stepSeconds },
+		descriptor,
+	)
+	yield* annotate(compiled.query)
+	const series = yield* port.queryRange(tenant, { ...read, query: compiled.query, ...window })
+	const rows = mergeGcpSeries(series, compiled.merge, groupOf(groupLabel, "(empty)")).map(
+		(point): GcpTimeseriesRow => ({
+			bucket: gcpPointBucket(point.seconds, window.stepSeconds),
+			groupName: point.group,
+			value: point.value,
+		}),
+	)
+	return {
+		stepSeconds: window.stepSeconds,
+		rows: groupLabel !== undefined && query.seriesLimit ? capSeries(rows, query.seriesLimit) : rows,
+	}
+})
+
+/** One value per group over the whole range, ranked descending. */
+export const gcpMetricsBreakdown = Effect.fnUntraced(function* <T extends QueryTenant>(
+	gcp: GcpLiveMetrics<T> | undefined,
+	tenant: T,
+	query: MetricsBreakdownSpec,
+	range: { readonly endMs: number; readonly rangeSeconds: number },
+) {
+	if (query.groupBy === "service") {
+		return yield* reject(
+			"Google Cloud metrics have no service.name; break down by a label (groupBy attribute or resource_attribute)",
+		)
+	}
+	const { port, read, descriptor } = yield* describe(gcp, tenant, query.filters.metricName, {
+		filters: query.filters,
+	})
+	if (descriptor === undefined) return []
+	const groupLabel = groupLabelOf([query.groupBy], query.filters)
+	const compiled = yield* compileGcpMetricQuery(
+		{
+			metric: query.metric,
+			filters: query.filters,
+			groupLabel,
+			windowSeconds: wholeWindowSeconds(range.rangeSeconds),
+		},
+		descriptor,
+	)
+	yield* annotate(compiled.query)
+	const series = yield* port.queryInstant(tenant, {
+		...read,
+		query: compiled.query,
+		timeSeconds: Math.floor(range.endMs / 1000),
+	})
+	return mergeGcpSeries(series, compiled.merge, groupOf(groupLabel, "(empty)"))
+		.map((point) => ({ name: point.group, value: point.value }))
+		.sort((a, b) => b.value - a.value)
+		.slice(0, query.limit ?? 10)
+})
+
+/**
+ * Alert observations: the value and its sample count per group, as the ClickHouse path's
+ * `dataPointCount`. `wholeRange` is one instant query over the window at its end. Every project
+ * must answer: an alert must not resolve on the ones that did not.
+ */
+export const gcpMetricsAlertBuckets = Effect.fnUntraced(function* <T extends QueryTenant>(
+	gcp: GcpLiveMetrics<T> | undefined,
+	tenant: T,
+	query: MetricsTimeseriesSpec,
+	range: {
+		readonly startMs: number
+		readonly endMs: number
+		readonly bucketSeconds: number
+		readonly wholeRange?: boolean
+	},
+) {
+	const { port, read, descriptor } = yield* describe(gcp, tenant, query.filters.metricName, {
+		filters: query.filters,
+		requireComplete: true,
+	})
+	const window = range.wholeRange
+		? undefined
+		: gcpRangeWindow(range.startMs, range.endMs, range.bucketSeconds)
+	if (descriptor === undefined || (window && window.startSeconds > window.endSeconds)) return []
+	const groupLabel = groupLabelOf(query.groupBy ?? [], query.filters)
+	const request = {
+		metric: query.metric,
+		filters: query.filters,
+		groupLabel,
+		windowSeconds: window?.stepSeconds ?? wholeWindowSeconds((range.endMs - range.startMs) / 1000),
+	}
+	const value = yield* compileGcpMetricQuery(request, descriptor)
+	const samples = yield* compileGcpSampleCount(request, descriptor)
+	yield* annotate(value.query)
+
+	const endSeconds = Math.floor(range.endMs / 1000) - GCP_INGESTION_DELAY_SECONDS
+	const run = (compiled: GcpPromQl) =>
+		window
+			? port.queryRange(tenant, { ...read, query: compiled.query, ...window })
+			: port.queryInstant(tenant, { ...read, query: compiled.query, timeSeconds: endSeconds })
+	const [values, counts] = yield* Effect.all([run(value), run(samples)], { concurrency: 2 })
+
+	// An empty label groups as "all", like the ClickHouse alert path.
+	const group = groupOf(groupLabel, ENGINE_UNGROUPED_GROUP_KEY)
+	const rangeStart = DateTime.formatIso(DateTime.makeUnsafe(range.startMs))
+	const bucketOf = (seconds: number) => (window ? gcpPointBucket(seconds, window.stepSeconds) : rangeStart)
+	const sampleCounts = new Map(
+		mergeGcpSeries(counts, samples.merge, group).map((point) => [
+			`${point.seconds} ${point.group}`,
+			point.value,
+		]),
+	)
+	return mergeGcpSeries(values, value.merge, group).map((point): BucketGroupObs => {
+		const sampleCount = sampleCounts.get(`${point.seconds} ${point.group}`) ?? 0
+		return {
+			bucket: bucketOf(point.seconds),
+			groupKey: point.group,
+			value: sampleCount > 0 ? point.value : null,
+			sampleCount,
+		}
+	})
+})
+
+/**
+ * Label keys from Google's descriptors, without reading series: the metric's own labels, then
+ * the labels of its active resource types, `project_id` and `monitored_resource`. `scope:
+ * "resource"` asks for the latter alone. Google has no usage count; each key counts 0.
+ */
+export const gcpMetricAttributeKeys = Effect.fnUntraced(function* <T extends QueryTenant>(
+	gcp: GcpLiveMetrics<T> | undefined,
+	tenant: T,
+	request: {
+		readonly metricName: string
+		readonly scope?: "span" | "resource"
+		readonly limit?: number
+	},
+) {
+	const { port, read, descriptor } = yield* describe(gcp, tenant, request.metricName, { discovery: true })
+	if (descriptor === undefined) return []
+	const active = new Set(descriptor.monitoredResourceTypes)
+	const resourceTypes = active.size === 0 ? [] : yield* port.listResourceTypes(tenant, read)
+	const resourceLabels = resourceTypes.flatMap((type) => (active.has(type.type) ? type.labels : []))
+	const keys = new Set([
+		...(request.scope === "resource" ? [] : descriptor.labels),
+		...resourceLabels,
+		"project_id",
+		"monitored_resource",
+	])
+	return [...keys].slice(0, request.limit ?? 200).map((key) => ({ key, count: 0 }))
+})
+
+/** Values of one label with their series counts over the range, summed across projects. */
+export const gcpMetricAttributeValues = Effect.fnUntraced(function* <T extends QueryTenant>(
+	gcp: GcpLiveMetrics<T> | undefined,
+	tenant: T,
+	request: {
+		readonly metricName: string
+		readonly attributeKey: string
+		readonly limit?: number
+		readonly endMs: number
+		readonly rangeSeconds: number
+	},
+) {
+	const { port, read, descriptor } = yield* describe(gcp, tenant, request.metricName, { discovery: true })
+	// Without a resource type to select by, values are read only through a filtered chart.
+	if (descriptor === undefined || descriptor.monitoredResourceTypes.length === 0) return []
+	const promQl = yield* compileGcpLabelValues(
+		descriptor,
+		request.attributeKey,
+		wholeWindowSeconds(request.rangeSeconds),
+	)
+	yield* annotate(promQl)
+	const series = yield* port.queryInstant(tenant, {
+		...read,
+		query: promQl,
+		timeSeconds: Math.floor(request.endMs / 1000),
+	})
+	return mergeGcpSeries(series, "sum", (labels) => labels[request.attributeKey] ?? "")
+		.flatMap((point) => (point.group === "" ? [] : [{ value: point.group, count: point.value }]))
+		.sort((a, b) => b.count - a.count)
+		.slice(0, request.limit ?? 50)
+})
diff --git a/packages/query-engine/src/runtime/index.ts b/packages/query-engine/src/runtime/index.ts
index 4ab4f69d5d..a13a6ca212 100644
--- a/packages/query-engine/src/runtime/index.ts
+++ b/packages/query-engine/src/runtime/index.ts
@@ -1,4 +1,5 @@
 export * from "./query-engine"
+export * from "./live-metrics"
 export * from "./raw-sql"
 export * from "./cache-policy"
 export * from "./query-definition-runner"
diff --git a/packages/query-engine/src/runtime/live-metrics.ts b/packages/query-engine/src/runtime/live-metrics.ts
new file mode 100644
index 0000000000..6f910a17ff
--- /dev/null
+++ b/packages/query-engine/src/runtime/live-metrics.ts
@@ -0,0 +1,56 @@
+import type { Effect } from "effect"
+import type {
+	GcpMetricDescriptor,
+	GcpMonitoredResourceType,
+	GcpPromQlSeries,
+} from "@maple/domain/gcp-live-metrics"
+import type { GcpLiveQueryError } from "@maple/domain/http/gcp-live-query-errors"
+import type { QueryTenant } from "./query-engine"
+
+/**
+ * Which projects a read covers. `projects` narrows it to those (from a `project_id` filter) when
+ * the org's connections reach each directly; otherwise every project is read, and past 20 the
+ * read is refused, except for `discovery` (the metrics list), which reads the first 20.
+ * `requireComplete` fails the read when any project or connection fails, instead of answering
+ * with the rest: an alert must not resolve on a project it could not read.
+ */
+export interface GcpReadScope {
+	readonly projects?: ReadonlyArray<string> | undefined
+	readonly requireComplete?: boolean | undefined
+	readonly discovery?: boolean | undefined
+}
+
+/**
+ * Google Cloud Monitoring, read live through its Prometheus-compatible API. The engine compiles a
+ * metrics query on a Cloud Monitoring metric type (`isGcpMetricType`) to PromQL and runs it here,
+ * once per project the org's metrics-on connections reach; each series carries its `project_id`.
+ * Absent in deployments without a Google identity (local mode, the CLI); a Google metric then
+ * fails as unavailable.
+ */
+export interface GcpLiveMetrics<T extends QueryTenant = QueryTenant> {
+	/** Range query, times in epoch seconds. */
+	readonly queryRange: (
+		tenant: T,
+		request: GcpReadScope & {
+			readonly query: string
+			readonly startSeconds: number
+			readonly endSeconds: number
+			readonly stepSeconds: number
+		},
+	) => Effect.Effect<ReadonlyArray<GcpPromQlSeries>, GcpLiveQueryError>
+	/** Instant query at `timeSeconds`; each series carries one point. */
+	readonly queryInstant: (
+		tenant: T,
+		request: GcpReadScope & { readonly query: string; readonly timeSeconds: number },
+	) => Effect.Effect<ReadonlyArray<GcpPromQlSeries>, GcpLiveQueryError>
+	/** Active metrics across the projects read (cached), resource types and labels merged per type. */
+	readonly listMetrics: (
+		tenant: T,
+		request: GcpReadScope,
+	) => Effect.Effect<ReadonlyArray<GcpMetricDescriptor>, GcpLiveQueryError>
+	/** Google's monitored resource types with their label keys (cached a day). */
+	readonly listResourceTypes: (
+		tenant: T,
+		request: GcpReadScope,
+	) => Effect.Effect<ReadonlyArray<GcpMonitoredResourceType>, GcpLiveQueryError>
+}
diff --git a/packages/query-engine/src/runtime/query-engine.ts b/packages/query-engine/src/runtime/query-engine.ts
index f3de0c3a2c..38e3fb6305 100644
--- a/packages/query-engine/src/runtime/query-engine.ts
+++ b/packages/query-engine/src/runtime/query-engine.ts
@@ -71,6 +71,15 @@ import {
 } from "../registry/product-events"
 import { runQueryDefinition } from "./query-definition-runner"
 import { resolveDirectRouteCachePolicy, type DirectRouteCachePolicyInput } from "./cache-policy"
+import { isGcpMetricType } from "@maple/domain/gcp-live-metrics"
+import type { GcpLiveMetrics } from "./live-metrics"
+import {
+	gcpMetricAttributeKeys,
+	gcpMetricAttributeValues,
+	gcpMetricsAlertBuckets,
+	gcpMetricsBreakdown,
+	gcpMetricsTimeseries,
+} from "./gcp-metrics"
 
 export {
 	makeDirectRouteCachePolicy,
@@ -1448,7 +1457,11 @@ const withTraceFacetsFallback = <A, E, R>(
 			)
 		: run(true)
 
-export const makeQueryEngineExecute = <T extends QueryTenant>(warehouse: QueryEngineWarehouse<T>) =>
+/** `gcp` answers metrics on a Cloud Monitoring metric type; absent, those fail as unavailable. */
+export const makeQueryEngineExecute = <T extends QueryTenant>(
+	warehouse: QueryEngineWarehouse<T>,
+	gcp?: GcpLiveMetrics<T>,
+) =>
 	Effect.fn("QueryEngineService.execute")(function* (
 		tenant: T,
 		request: QueryEngineExecuteRequest,
@@ -1639,6 +1652,29 @@ export const makeQueryEngineExecute = <T extends QueryTenant>(warehouse: QueryEn
 			})
 		}
 
+		if (
+			request.query.source === "metrics" &&
+			request.query.kind === "timeseries" &&
+			isGcpMetricType(request.query.filters.metricName)
+		) {
+			const { rows, stepSeconds } = yield* gcpMetricsTimeseries(gcp, tenant, request.query, {
+				startMs: range.startMs,
+				endMs: range.endMs,
+				bucketSeconds,
+			})
+			return new QueryEngineExecuteResponse({
+				result: {
+					kind: "timeseries",
+					source: "metrics",
+					data: groupTimeSeriesRows(rows, (row) => row.value, {
+						startMs: range.startMs,
+						endMs: range.endMs,
+						bucketSeconds: stepSeconds,
+					}),
+				},
+			})
+		}
+
 		if (request.query.source === "metrics" && request.query.kind === "timeseries") {
 			const execution = yield* executeMetricsTimeseriesRows(
 				warehouse,
@@ -1859,6 +1895,20 @@ export const makeQueryEngineExecute = <T extends QueryTenant>(warehouse: QueryEn
 			})
 		}
 
+		if (
+			request.query.source === "metrics" &&
+			request.query.kind === "breakdown" &&
+			isGcpMetricType(request.query.filters.metricName)
+		) {
+			const data = yield* gcpMetricsBreakdown(gcp, tenant, request.query, {
+				endMs: range.endMs,
+				rangeSeconds: range.rangeSeconds,
+			})
+			return new QueryEngineExecuteResponse({
+				result: { kind: "breakdown", source: "metrics", data },
+			})
+		}
+
 		if (request.query.source === "metrics" && request.query.kind === "breakdown") {
 			const data = yield* executeMetricsBreakdownRows(warehouse, tenant, request.query, {
 				startTime: request.startTime,
@@ -2095,6 +2145,22 @@ export const makeQueryEngineExecute = <T extends QueryTenant>(warehouse: QueryEn
 			})
 		}
 
+		if (
+			request.query.source === "metrics" &&
+			request.query.kind === "attributeKeys" &&
+			request.query.metricName !== undefined &&
+			isGcpMetricType(request.query.metricName)
+		) {
+			const data = yield* gcpMetricAttributeKeys(gcp, tenant, {
+				metricName: request.query.metricName,
+				scope: request.query.scope,
+				limit: request.query.limit,
+			})
+			return new QueryEngineExecuteResponse({
+				result: { kind: "attributeKeys", source: "metrics", data },
+			})
+		}
+
 		if (request.query.kind === "attributeKeys") {
 			const scope = resolveAttributeScope(request.query.source, request.query.scope)
 			// Per-metric scoping reads the raw metric table (the hourly rollup has no
@@ -2318,6 +2384,24 @@ export const makeQueryEngineExecute = <T extends QueryTenant>(warehouse: QueryEn
 			})
 		}
 
+		if (
+			request.query.source === "metrics" &&
+			request.query.kind === "attributeValues" &&
+			request.query.metricName !== undefined &&
+			isGcpMetricType(request.query.metricName)
+		) {
+			const data = yield* gcpMetricAttributeValues(gcp, tenant, {
+				metricName: request.query.metricName,
+				attributeKey: request.query.attributeKey,
+				limit: request.query.limit,
+				endMs: range.endMs,
+				rangeSeconds: range.rangeSeconds,
+			})
+			return new QueryEngineExecuteResponse({
+				result: { kind: "attributeValues", source: "metrics", data },
+			})
+		}
+
 		if (request.query.kind === "attributeValues") {
 			// Per-metric scoping reads the raw metric table (see attributeKeys above).
 			const { metricName, metricNames, metricType } = request.query
@@ -2487,6 +2571,7 @@ export const computeAlertBuckets = Effect.fnUntraced(function* <T extends QueryT
 	tenant: T,
 	request: AlertBucketRequest,
 	bucketSeconds: number,
+	gcp?: GcpLiveMetrics<T>,
 ) {
 	if (request.source.kind === "raw_sql") {
 		return yield* computeRawSqlBuckets(warehouse, tenant, request.source, request)
@@ -2591,6 +2676,15 @@ export const computeAlertBuckets = Effect.fnUntraced(function* <T extends QueryT
 				sampleCount,
 			})
 		}
+	} else if (isGcpMetricType(query.filters.metricName)) {
+		obs.push(
+			...(yield* gcpMetricsAlertBuckets(gcp, tenant, query, {
+				startMs: toEpochMs(request.startTime),
+				endMs: toEpochMs(request.endTime),
+				bucketSeconds,
+				wholeRange: request.wholeRange,
+			})),
+		)
 	} else {
 		const execution = yield* executeMetricsTimeseriesRows(
 			warehouse,
@@ -2833,7 +2927,10 @@ const prepareAlertEvaluation = Effect.fnUntraced(function* (request: AlertEvalua
 	return query.bucketSeconds ?? computeBucketSeconds(startMs, endMs, BUCKET_POLICIES.alert)
 })
 
-export const makeQueryEngineEvaluate = <T extends QueryTenant>(warehouse: QueryEngineWarehouse<T>) =>
+export const makeQueryEngineEvaluate = <T extends QueryTenant>(
+	warehouse: QueryEngineWarehouse<T>,
+	gcp?: GcpLiveMetrics<T>,
+) =>
 	Effect.fn("QueryEngineService.evaluate")(function* (
 		tenant: T,
 		request: AlertEvaluateRequest,
@@ -2852,7 +2949,7 @@ export const makeQueryEngineEvaluate = <T extends QueryTenant>(warehouse: QueryE
 			endTime: request.endTime,
 			wholeRange: true,
 		}
-		const load = computeAlertBuckets(warehouse, tenant, bucketRequest, bucketSeconds)
+		const load = computeAlertBuckets(warehouse, tenant, bucketRequest, bucketSeconds, gcp)
 		// Raw SQL may contain volatile functions. Keep its existing whole-result
 		// cache policy; only structured queries share buckets across reducers.
 		const obs = yield* request.source.kind === "spec"
@@ -2876,7 +2973,10 @@ export const makeQueryEngineEvaluate = <T extends QueryTenant>(warehouse: QueryE
  *
  * Preview requests are ad-hoc form states and execute directly.
  */
-export const makeQueryEngineEvaluateSeries = <T extends QueryTenant>(warehouse: QueryEngineWarehouse<T>) =>
+export const makeQueryEngineEvaluateSeries = <T extends QueryTenant>(
+	warehouse: QueryEngineWarehouse<T>,
+	gcp?: GcpLiveMetrics<T>,
+) =>
 	Effect.fn("QueryEngineService.evaluateSeries")(function* (
 		tenant: T,
 		request: AlertEvaluateRequest,
@@ -2889,6 +2989,7 @@ export const makeQueryEngineEvaluateSeries = <T extends QueryTenant>(warehouse:
 			tenant,
 			{ source: request.source, startTime: request.startTime, endTime: request.endTime },
 			bucketSeconds,
+			gcp,
 		)
 		yield* Effect.annotateCurrentSpan("result.pointCount", series.length)
 		return series
diff --git a/packages/web-data/src/warehouse/effect-utils.ts b/packages/web-data/src/warehouse/effect-utils.ts
index 312febcec7..38db55ce9f 100644
--- a/packages/web-data/src/warehouse/effect-utils.ts
+++ b/packages/web-data/src/warehouse/effect-utils.ts
@@ -75,12 +75,14 @@ export class WarehouseInvalidInputError extends Schema.TaggedError<WarehouseInva
 	{
 		operation: Schema.String,
 		message: Schema.String,
+		/** The failed query's own title, when the API gave one. */
+		title: Schema.optional(Schema.String),
 	},
 ) {
 	readonly error = makeClientErrorBody({
 		_tag: this._tag,
 		code: "warehouse_input_invalid",
-		title: "Invalid query",
+		title: this.title ?? "Invalid query",
 		message: this.message,
 		retryable: false,
 		recovery: "fix_request",
@@ -280,13 +282,14 @@ export function runWarehouseQueryV2<A, E>(
 export function querySetFailure(
 	operation: string,
 	message: string,
+	title?: string,
 ): Effect.Effect<never, WarehouseInvalidInputError | WarehouseUnreachableError> {
 	return Effect.flatMap(
 		isApiBlipping,
 		(blipping): Effect.Effect<never, WarehouseInvalidInputError | WarehouseUnreachableError> =>
 			blipping
 				? Effect.fail(new WarehouseUnreachableError({ operation, message }))
-				: invalidWarehouseInput(operation, message),
+				: Effect.fail(new WarehouseInvalidInputError({ operation, message, title })),
 	)
 }
 
diff --git a/packages/web-data/src/warehouse/query-builder-breakdown.test.ts b/packages/web-data/src/warehouse/query-builder-breakdown.test.ts
index 4ba224530b..47254f901f 100644
--- a/packages/web-data/src/warehouse/query-builder-breakdown.test.ts
+++ b/packages/web-data/src/warehouse/query-builder-breakdown.test.ts
@@ -3,6 +3,13 @@ import { describe, expect, it } from "vitest"
 
 import { QuerySetNoDataError } from "@maple/query-engine/query-set"
 import * as breakdownModule from "./query-builder-breakdown"
+import { makeWarehouseExecutor, recordingFailureTitle } from "./query-set-executor"
+import { WarehouseExecutor } from "./warehouse-services"
+import {
+	GcpLiveQueryRejectedError,
+	GcpLiveQueryUnavailableError,
+} from "@maple/domain/http/gcp-live-query-errors"
+import { displayError } from "../lib/error-messages"
 
 /**
  * The timeseries adapter stopped failing on an empty window — an empty window is
@@ -37,3 +44,32 @@ describe("empty window", () => {
 		expect(Exit.isFailure(exit)).toBe(true)
 	})
 })
+
+describe("a failed query's title", () => {
+	it("titles the chart error with the reported failure's own title", async () => {
+		const executor = Effect.runSync(
+			makeWarehouseExecutor("test").pipe(
+				Effect.provideService(WarehouseExecutor, { enqueue: () => Effect.die("not called") }),
+			),
+		)
+		const run = recordingFailureTitle(executor)
+		// The runner describes each failed query as text; the reported text picks the title.
+		run.executor.describeError(
+			new GcpLiveQueryRejectedError({
+				message: "Label region cannot be compared with gt.",
+				reason: "invalid_query",
+			}),
+		)
+		const unavailable = "Connect Google Cloud with metrics on to query Google Cloud metrics."
+		run.executor.describeError(new GcpLiveQueryUnavailableError({ message: unavailable }))
+		const error = await Effect.runPromise(
+			Effect.flip(
+				breakdownModule.__testables.onNoData(
+					new QuerySetNoDataError({ message: unavailable, details: [unavailable] }),
+					run.failureTitle(unavailable),
+				),
+			),
+		)
+		expect(displayError(error).title).toBe("Google Cloud metrics are not available")
+	})
+})
diff --git a/packages/web-data/src/warehouse/query-builder-breakdown.ts b/packages/web-data/src/warehouse/query-builder-breakdown.ts
index 5ef8eec880..491165f4e9 100644
--- a/packages/web-data/src/warehouse/query-builder-breakdown.ts
+++ b/packages/web-data/src/warehouse/query-builder-breakdown.ts
@@ -12,7 +12,7 @@ import {
 	type WarehouseInvalidInputError,
 	type WarehouseUnreachableError,
 } from "./effect-utils"
-import { makeWarehouseExecutor } from "./query-set-executor"
+import { makeWarehouseExecutor, recordingFailureTitle } from "./query-set-executor"
 
 const executor = makeWarehouseExecutor("queryEngine.breakdownQuery")
 
@@ -44,10 +44,11 @@ export type QueryBuilderBreakdownInput = Schema.Schema.Type<typeof QueryBuilderB
  */
 const onNoData = (
 	error: QuerySetNoDataError,
+	failureTitle?: string,
 ): Effect.Effect<BreakdownQuerySetResult, WarehouseInvalidInputError | WarehouseUnreachableError> =>
 	error.details.length === 0
 		? Effect.succeed({ rows: [], diagnostics: [] })
-		: querySetFailure("getQueryBuilderBreakdown", error.message)
+		: querySetFailure("getQueryBuilderBreakdown", error.message, failureTitle)
 
 export function getQueryBuilderBreakdown({ data }: { data: QueryBuilderBreakdownInput }) {
 	return getQueryBuilderBreakdownEffect({ data })
@@ -60,7 +61,8 @@ const getQueryBuilderBreakdownEffect = Effect.fn("QueryEngine.getQueryBuilderBre
 }) {
 	const input = yield* decodeInput(QueryBuilderBreakdownInputSchema, data, "getQueryBuilderBreakdown")
 
-	const outcome = yield* runBreakdownQuerySet(yield* executor, {
+	const run = recordingFailureTitle(yield* executor)
+	const outcome = yield* runBreakdownQuerySet(run.executor, {
 		querySet: { queries: input.queries },
 		startTime: input.startTime,
 		endTime: input.endTime,
@@ -69,7 +71,8 @@ const getQueryBuilderBreakdownEffect = Effect.fn("QueryEngine.getQueryBuilderBre
 		Effect.catchTags({
 			"@maple/query-engine/query-set/QuerySetInputError": (error) =>
 				invalidWarehouseInput("getQueryBuilderBreakdown", error.message),
-			"@maple/query-engine/query-set/QuerySetNoDataError": onNoData,
+			"@maple/query-engine/query-set/QuerySetNoDataError": (error) =>
+				onNoData(error, run.failureTitle(error.message)),
 		}),
 	)
 
diff --git a/packages/web-data/src/warehouse/query-builder-timeseries.ts b/packages/web-data/src/warehouse/query-builder-timeseries.ts
index 414da87624..3385b9712c 100644
--- a/packages/web-data/src/warehouse/query-builder-timeseries.ts
+++ b/packages/web-data/src/warehouse/query-builder-timeseries.ts
@@ -10,7 +10,7 @@ import {
 	runTimeseriesQuerySet,
 } from "@maple/query-engine/query-set"
 import { decodeInput, invalidWarehouseInput, querySetFailure } from "./effect-utils"
-import { makeWarehouseExecutor } from "./query-set-executor"
+import { makeWarehouseExecutor, recordingFailureTitle } from "./query-set-executor"
 
 /**
  * The browser-side adapter for `runTimeseriesQuerySet`.
@@ -118,7 +118,8 @@ const getQueryBuilderTimeseriesEffect = Effect.fn("QueryEngine.getQueryBuilderTi
 	const input = yield* decodeInput(QueryBuilderTimeseriesInputSchema, data, "getQueryBuilderTimeseries")
 	const strategy = resolveStrategy(input)
 
-	const outcome = yield* runTimeseriesQuerySet(yield* executor, {
+	const run = recordingFailureTitle(yield* executor)
+	const outcome = yield* runTimeseriesQuerySet(run.executor, {
 		querySet: {
 			queries: input.queries,
 			...(!(input.formulas === undefined) ? { formulas: input.formulas } : undefined),
@@ -148,7 +149,11 @@ const getQueryBuilderTimeseriesEffect = Effect.fn("QueryEngine.getQueryBuilderTi
 							rows: [],
 							diagnostics: emptyTimeseriesResponse(input).diagnostics,
 						} satisfies TimeseriesQuerySetResult)
-					: querySetFailure("getQueryBuilderTimeseries", error.message),
+					: querySetFailure(
+							"getQueryBuilderTimeseries",
+							error.message,
+							run.failureTitle(error.message),
+						),
 		}),
 	)
 
diff --git a/packages/web-data/src/warehouse/query-set-executor.ts b/packages/web-data/src/warehouse/query-set-executor.ts
index 9191b88f1e..671d057444 100644
--- a/packages/web-data/src/warehouse/query-set-executor.ts
+++ b/packages/web-data/src/warehouse/query-set-executor.ts
@@ -36,3 +36,24 @@ export const makeWarehouseExecutor = (
 			}).pipe(Effect.provide(context)),
 		describeError: (error) => displayError(error).message,
 	}))
+
+/**
+ * `executor` for one run that remembers each failure's own title. The runner reports a failed
+ * query as text; `failureTitle(reported)` gives the title of the failure that text came from, so
+ * the chart's error card says e.g. "Google Cloud metrics are not available", not "Invalid query".
+ */
+export const recordingFailureTitle = (executor: QuerySetExecutor<QuerySetExecuteError>) => {
+	const failures: Array<{ readonly message: string; readonly title: string }> = []
+	return {
+		executor: {
+			...executor,
+			describeError: (error: QuerySetExecuteError) => {
+				const message = executor.describeError(error)
+				failures.push({ message, title: displayError(error).title })
+				return message
+			},
+		} satisfies QuerySetExecutor<QuerySetExecuteError>,
+		failureTitle: (reported: string) =>
+			failures.find((failure) => reported.includes(failure.message))?.title,
+	}
+}