When: DB reachable AND referenced tables exist.

scannedRows = plan.Plan["Plan Rows"]
costUpper   = plan.Plan["Total Cost"]      // planner units, not USD

compute     = (rows / 600,000 / 4 ACUs)   // wall-clock seconds
              × ($0.12/3600) × 4 ACUs     // $/sec × ACUs

io          = (rows × 0.01 / 1,000,000)   // millions of I/Os
              × $0.20                      // $/M-I/Os

USD         = compute + io
              // ≈ $0.002 per million rows on the OLAP profile
              // 0.01 I/Os/row, 600K rows/s/ACU = empirical, tunable
              // $0.12/ACU-hr, $0.20/M-I/O = real Aurora Std rates

When: DB offline, table missing, or compile failure.

scannedRows = 10_000_000
              × 0.1^filterCount       // each filter reduces 10×
              × 1.4^joinCount         // each join amplifies 1.4×
USD         = same formula as Path A

When: A JOIN has blank leftKey or rightKey.

scannedRows = 50_000_000_000     // 1M × 50M cross product
compute     = 5h × 16 ACUs × $0.12 = $9.60
io          = 50B × 0.5 I/Os × $0.20/M = $5,000
                                  // 0.5 I/Os/row models hash spilling
USD         = $5,000              // I/O term dominates
runtime     = 5h

Reachability probe. Used by the connection-status pill in the workspace top nav.

Response 200, always:
{
  backend:    "aurora-dsql"     // env var AURORA_DSQL_CLUSTER_ENDPOINT set
            | "aurora-postgres" // DATABASE_URL points at *.rds.amazonaws.com
            | "remote-postgres" // DATABASE_URL points elsewhere (non-loopback)
            | "local-postgres", // DATABASE_URL on localhost / Docker
  reachable:  boolean,
  error?:     string   // unwrapped pg error code on failure
                        // (e.g. "ECONNREFUSED", "28P01")
}

Times out at 1.5s. Never throws; returns 200 with reachable=false if the probe fails so the UI can render a meaningful state.

Column lookup against information_schema.columns. Used to populate a LOAD stage's dataset from the real DB.

Response:
{
  table:    string,
  schema:   string,        // default "public"
  columns:  Array<{
    name: string,
    type: "integer" | "float" | "string"
        | "boolean" | "date" | "timestamp"
        | "unknown",
  }>,
  backend:  "aurora-postgres" | "aurora-dsql"
          | "remote-postgres" | "local-postgres",
  error?:   string,        // when the DB probe fails
}

Table/schema names validated by ^[A-Za-z_][A-Za-z0-9_]{0,62}$ before reaching SQL. Returns 400 on invalid identifiers. On DB failure returns 200 with empty columns + an error field — the canvas renders an empty dataset and surfaces the cause.

The pre-flight pipeline analysis. Compiles your stage DAG to a CTE chain, runs EXPLAIN against the live DB (or falls back to a heuristic), runs PII lineage traversal, returns findings + denormalized headline facts.

Request:
{ schema: PipelineSchema }

Response:
{
  security: {
    score:    0..100,
    findings: SimulationFinding[],
  },
  performance: {
    findings: SimulationFinding[],
    metrics:  Array<{ label, value, hint? }>,
  },
  // Headline facts for the UI to branch on:
  isPIILeaked:        boolean,
  leakedNodeId:       string | null,
  leakedColumns:      string[],
  estimatedCostRows:  number,
  costlyNodeId:       string | null,
  rawExplainJSON:     unknown,   // null when EXPLAIN unavailable
}

SimulationFinding:
{
  id:       string,
  severity: "critical" | "warning" | "ok",
  title:    string,
  detail:   string,
  stageId?: string,   // drives the heatmap ring on the canvas
}

Always returns 200. The simulate route never propagates DB errors as 5xx — failures land in the heuristic fallback path with an explain-fallback warning finding. leakedColumns drives Auto-Fix Compliance — it tells the client which columns to hash in the inserted CUSTOM stage.