diff --git a/RdmpCohortBuildBreakdownByGroups/INSTALL.md b/RdmpCohortBuildBreakdownByGroups/INSTALL.md
new file mode 100644
index 0000000000..d86473705b
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/INSTALL.md
@@ -0,0 +1,91 @@
+# RdmpCohortBuildBreakdownByGroups plugin (RDMP 9.2.3)
+
+Reproduces the Cohort Builder's per-set / per-container count tree (the FinalCount and cumulative
+running totals shown as UNION/INTERSECT/EXCEPT are applied) **split by an arbitrary group column**
+(e.g. Scottish health board), labelled and ordered by a user-supplied lookup table. Saved as a wide CSV.
+
+Built against the **released RDMP 9.2.3**. Do not use on a different major.minor RDMP.
+
+## How it works (cache-based recompose, cross-server safe)
+
+It builds the cohort **once** (populating the query cache), then recomposes every count point from the
+cached per-set identifier tables and splits each by the group column with one GROUP BY per node. The
+lookup table is read once up front; the cohort-set source queries are never re-run, and every
+recomposed count query then runs on the query-cache server (each node joins the reference table there,
+which is why it must be on the same server as the cache). Nothing is hard-coded in the engine; the SHARE names live only in the plugin's preset.
+
+## Inputs (4 columns; the tables are derived)
+
+- **group column** - the column to break the counts down by (e.g. `SHARE_Demography.Region`). Its table
+  is the reference table and must contain exactly one IsExtractionIdentifier column (the CHI), which is
+  the join key to the cohort.
+- **lookup key column** - the group code as it appears in the group column (e.g. `z_hb_lookup.Region`).
+  Its table is the lookup table.
+- **lookup label column** - the display name per code (e.g. `z_hb_lookup.HB_Name`).
+- **lookup grouping column** (optional) - a higher grouping used to order the output columns (e.g.
+  `z_hb_lookup.SafeHaven_Region`; NULL values allowed). Being optional it is never prompted for in
+  the GUI; supply it via the preset or the CLI.
+
+Codes present in the data but absent from the lookup go to `Other`; patients missing from the reference
+table (or with a NULL group) go to `NotKnown`.
+
+## Requirements
+
+- **Single-valued mapping**: each identifier must map to AT MOST ONE group in the reference table
+  (e.g. a patient belongs to one health board; many patients per group is fine). Multi-group
+  membership double-counts patients and invalidates the NotKnown residual and the reference
+  denominator.
+
+- The cohort identification configuration must have a **query caching server** configured.
+- The reference table must be on the **same database server as the query cache** (validated with RDMP's
+  single-server check: server, DBMS type and credential compatibility). On **PostgreSQL** it must also
+  be in the **same database** (a PostgreSQL connection cannot cross databases).
+- The patient identifier must be a **plain column** (a transformed expression such as `UPPER(chi)` is
+  refused - the join runs against the raw table column).
+- The lookup table must have **one row per code**, with **unique labels** that do not collide with the
+  report's fixed column headers (`Total`, `Other`, `NotKnown`, ...); violations stop with a clear error.
+- Identifiers, fully-qualified names, commands and set-operation keywords use RDMP/FAnsi dialect
+  helpers; execution is tested on SQL Server and PostgreSQL (on PostgreSQL everything, including the
+  query cache, must be in one database). Oracle is currently blocked upstream: RDMP's cache bookkeeping
+  table name exceeds FAnsi's 30-character Oracle identifier cap.
+
+## Install
+
+**GUI:** RDMP desktop, Plugins node, *Add Plugin* (or drag `RdmpCohortBuildBreakdownByGroups.rdmp` onto
+it), restart RDMP. **Or** drop the `.rdmp` next to `rdmp.exe` / `ResearchDataManagementPlatform.exe`.
+
+Confirm (CLI): `rdmp.exe cmd ListSupportedCommands` lists `ExportCohortBuildBreakDownByGroups`.
+
+## Use
+
+**GUI:** right-click a Cohort Identification Configuration. Two entries:
+- *Export Build Breakdown By Groups (SHARE preset)* - resolves `SHARE_Demography`.`Region` and
+  `z_hb_lookup`.`Region`/`HB_Name` by name; prompts only for a column it cannot resolve. If several
+  tables are named `z_hb_lookup`, the one in the same database as `SHARE_Demography` is chosen. The
+  optional grouping column is not part of the preset (output columns are ordered by label).
+- *Export Build Breakdown By Groups (choose inputs)* - prompts for the group, key and label columns
+  (the optional grouping column is never prompted; supply it via the preset or the CLI).
+
+**CLI:** the inputs are RDMP objects, mapped by id:
+```
+rdmp.exe cmd ExportCohortBuildBreakDownByGroups \
+    CohortIdentificationConfiguration:<id> ColumnInfo:<group> ColumnInfo:<key> ColumnInfo:<label> out.csv ColumnInfo:<grouping>
+```
+`out.csv`, the trailing grouping column and the timeout are optional.
+
+## Output (wide format)
+
+One row per count point (name written once), a `Metric` column (Final and Cumulative), a `Total` column
+(RDMP's national number), one column per group recognised by the lookup, then `Other` and `NotKnown`.
+The column header is repeated above two percentage rows: `% of final cohort` and `% of reference
+population` (each group's share of the whole reference table, a cohort-vs-population sanity check).
+Groups + Other + NotKnown reconcile to Total on every row. (If the final cohort is empty the two
+percentage rows are omitted - a share of zero patients is undefined.)
+
+## Validation
+
+Verified end-to-end on a deterministic synthetic fixture (top EXCEPT over an inclusion INTERSECT minus
+four exclusion sets, driven by a synthetic `z_hb_lookup` table with the 14 Scottish boards plus
+E/O/K/X): the key national and per-group counts and cumulatives are asserted explicitly, the unfiltered column
+equals RDMP's own CohortCompiler counts, and a reconciliation invariant (groups + Other + NotKnown
+== Total) is asserted on every row.
diff --git a/RdmpCohortBuildBreakdownByGroups/README.md b/RdmpCohortBuildBreakdownByGroups/README.md
new file mode 100644
index 0000000000..194ba1f140
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/README.md
@@ -0,0 +1,65 @@
+# RdmpCohortBuildBreakdownByGroups (RDMP 9.2.3 plugin)
+
+Reproduces the Cohort Builder's per-set / per-container count tree (the `FinalCount` and cumulative
+running totals shown as UNION/INTERSECT/EXCEPT are applied) **split by an arbitrary group column**
+(e.g. Scottish health board, GP practice, age band), plus an unfiltered national total, and writes it
+to a wide CSV. Groups are labelled and ordered by a user-supplied lookup table; nothing is hard-coded
+in the engine (the SHARE-specific names live only in the plugin's preset file).
+
+This folder is a self-contained package: the ready-to-install plugin, install/usage notes, and the source.
+
+## Contents
+
+| Path | What it is |
+|---|---|
+| `RdmpCohortBuildBreakdownByGroups.rdmp` | the built plugin (drop into RDMP / add via the Plugins node) |
+| `INSTALL.md` | install + usage (GUI right-click and CLI), including the lookup-table expectations |
+| `src/` | plugin source (command, report, group lookup, models, SHARE preset, UI hook, csproj, nuspec) |
+
+## How it works (in one paragraph)
+
+It builds the national cohort once (which populates RDMP's query cache) and reads the lookup table
+once, then recomposes every count point from the cached per-set identifier tables and splits each by
+the group column with one
+`GROUP BY` per node, all groups at once. No per-group rebuild; the cohort-set source queries are never re-run after the single build - only
+the query-cache server is queried (each node joins the reference table there), so it is cross-server
+safe for the cohort's catalogues. Inputs are four `ColumnInfo` objects: the group-by
+column (its table is the reference table, whose single IsExtractionIdentifier column is the join key to
+the cohort) and the lookup table's key/label/optional-grouping columns. Requires a query-caching server,
+with the reference table on the same server as the cache, and a single-valued identifier-to-group
+mapping in the reference table (each identifier maps to at most one group, e.g. a patient belongs to
+one health board).
+
+## The SHARE preset
+
+`src/SharePreset.cs` is deliberately the only place any deployment-specific name lives: it resolves
+`SHARE_Demography`.`Region` and `z_hb_lookup`.`Region`/`HB_Name` by name at runtime (the optional
+grouping column is not part of the preset; output columns are ordered by label).
+The GUI offers two right-click entries on a cohort identification configuration: "(SHARE preset)"
+(one click; prompts only for a column it cannot resolve) and "(choose inputs)" (prompts for the group,
+key and label columns).
+
+## Output
+
+Wide CSV: one row per count point (name once), a `Metric` column (Final + Cumulative), a `Total`
+column (RDMP's national number), one column per group recognised by the lookup, then `Other` (present
+codes the lookup does not recognise) and `NotKnown` (not in the reference table / null group). The
+column header is repeated above a `% of final cohort` row and a `% of reference population` row (each
+group's share of the whole reference table, for a cohort-vs-population sanity check). Groups + Other +
+NotKnown reconcile to Total on every row. (Both percentage rows are omitted if the final cohort is
+empty.)
+
+## Validation
+
+Verified end-to-end against a deterministic synthetic fixture (top EXCEPT over an inclusion INTERSECT
+minus four exclusion sets, driven by a synthetic z_hb_lookup table): the key national and per-group
+counts and cumulatives are asserted explicitly, the unfiltered column equals RDMP's own
+`CohortCompiler` counts, and a reconciliation invariant (groups + Other + NotKnown == Total) is
+asserted on every row. The fixture runs end-to-end on both SQL Server and PostgreSQL.
+
+## Build from source (optional)
+
+`src/` builds standalone from any checkout: it references the released `HIC.RDMP.Plugin 9.2.3` NuGet
+package (no in-tree RDMP source needed). `dotnet build src/RdmpCohortBuildBreakdownByGroups.csproj`,
+then package the resulting DLL + nuspec into a `.rdmp` zip (`<nuspec>` at root, DLL under
+`lib/net10.0/`).
diff --git a/RdmpCohortBuildBreakdownByGroups/RdmpCohortBuildBreakdownByGroups.rdmp b/RdmpCohortBuildBreakdownByGroups/RdmpCohortBuildBreakdownByGroups.rdmp
new file mode 100644
index 0000000000..4782ce1d74
Binary files /dev/null and b/RdmpCohortBuildBreakdownByGroups/RdmpCohortBuildBreakdownByGroups.rdmp differ
diff --git a/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownByGroupsPluginUserInterface.cs b/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownByGroupsPluginUserInterface.cs
new file mode 100644
index 0000000000..016955b6a6
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownByGroupsPluginUserInterface.cs
@@ -0,0 +1,41 @@
+// Surfaces the build breakdown-by-groups command in the RDMP desktop GUI (right-click a cohort
+// identification configuration). Two entries: the SHARE preset (inputs resolved by name via
+// SharePreset, prompting only for anything it cannot resolve) and a choose-inputs variant that prompts
+// for the group, key and label columns. The optional grouping column (output ordering) is not part of
+// the preset; supply it via the CLI if wanted.
+// The same command class is auto-discovered for the CLI (`rdmp cmd ExportCohortBuildBreakDownByGroups`).
+
+using System.Collections.Generic;
+using Rdmp.Core;
+using Rdmp.Core.CommandExecution;
+using Rdmp.Core.CommandExecution.AtomicCommands;
+using Rdmp.Core.Curation.Data.Cohort;
+
+namespace RdmpCohortBuildBreakdownByGroups;
+
+public class CohortBuildBreakdownByGroupsPluginUserInterface : PluginUserInterface
+{
+    public CohortBuildBreakdownByGroupsPluginUserInterface(IBasicActivateItems itemActivator) : base(itemActivator)
+    {
+    }
+
+    public override IEnumerable<IAtomicCommand> GetAdditionalRightClickMenuItems(object o)
+    {
+        if (o is not CohortIdentificationConfiguration cic)
+            yield break;
+
+        SharePreset.TryResolve(BasicActivator.RepositoryLocator.CatalogueRepository,
+            out var groupColumn, out var lookupKey, out var lookupLabel);
+
+        yield return new ExecuteCommandExportCohortBuildBreakDownByGroups(BasicActivator, cic,
+            groupColumn, lookupKey, lookupLabel)
+        {
+            OverrideCommandName = "Export Build Breakdown By Groups (SHARE preset)"
+        };
+
+        yield return new ExecuteCommandExportCohortBuildBreakDownByGroups(BasicActivator, cic)
+        {
+            OverrideCommandName = "Export Build Breakdown By Groups (choose inputs)"
+        };
+    }
+}
diff --git a/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownByGroupsReport.cs b/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownByGroupsReport.cs
new file mode 100644
index 0000000000..356ac2ef0a
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownByGroupsReport.cs
@@ -0,0 +1,151 @@
+// Copyright (c) The University of Dundee 2024-2024
+// This file is part of the Research Data Management Platform (RDMP).
+// RDMP is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+// RDMP is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License along with RDMP. If not, see <https://www.gnu.org/licenses/>.
+
+using System.Collections.Generic;
+using System.Globalization;
+using System.IO;
+using System.Linq;
+using System.Text;
+
+namespace RdmpCohortBuildBreakdownByGroups;
+
+/// <summary>
+/// Projects a cohort build's count tree (the per-set / per-container <c>FinalCount</c> and cumulative
+/// running totals shown in the Cohort Builder) split by group into a WIDE CSV: one row per
+/// (count-point x metric), the container/set name written once, a <c>Total</c> column (RDMP's own
+/// unfiltered count), one column per group recognised by the supplied <see cref="GroupLookup"/>, an
+/// <c>Other</c> column (present codes the lookup does not recognise) and a <c>NotKnown</c> residual
+/// (patients not in the reference table / NULL group). Two bottom rows give each group's share of the
+/// final cohort and of the whole reference population (a sanity check). Groups + Other + NotKnown reconcile
+/// to Total on every row.
+/// </summary>
+public static class CohortBuildBreakdownByGroupsReport
+{
+    public const string OtherColumn = "Other";
+    public const string NotKnownColumn = "NotKnown";
+    public const string PercentMetric = "% of final cohort";
+
+    /// <summary>Label for the reference row: each group's share of the whole reference population.</summary>
+    public const string ReferencePercentMetric = "% of reference population";
+
+    /// <summary>A resolved output column (a group recognised by the lookup).</summary>
+    private sealed record GroupColumn(string Code, string Name, string Node);
+
+    /// <summary>
+    /// Splits one node's group counts into Total / recognised-groups / Other / NotKnown using
+    /// <paramref name="lookup"/>. <paramref name="byRegion"/> is the GROUP BY Region result (every present
+    /// code); <paramref name="total"/> is RDMP's own count.
+    /// </summary>
+    public static CohortBuildBreakdownBuckets Split(int total, IReadOnlyDictionary<string, int> byRegion,
+        GroupLookup lookup)
+    {
+        var groups = new Dictionary<string, int>(System.StringComparer.OrdinalIgnoreCase);
+        var other = 0;
+        foreach (var (code, n) in byRegion)
+            if (lookup.Contains(code))
+                groups[code] = n;
+            else
+                other += n; // present but not recognised by the lookup
+
+        return new CohortBuildBreakdownBuckets(total, groups, other, total - groups.Values.Sum() - other);
+    }
+
+    /// <summary>The recognised groups that appear anywhere, ordered by node (nulls last) then name.</summary>
+    private static List<GroupColumn> GroupColumns(IEnumerable<CohortBuildBreakdownNode> nodes,
+        CohortBuildBreakdownBuckets referencePopulation, GroupLookup lookup) =>
+        nodes
+            .SelectMany(n => n.FinalByGroup.Keys.Concat(n.CumulativeByGroup?.Keys ?? Enumerable.Empty<string>()))
+            .Concat(referencePopulation?.Groups.Keys ?? Enumerable.Empty<string>())
+            .Where(lookup.Contains)
+            .GroupBy(code => code, System.StringComparer.OrdinalIgnoreCase)
+            .Select(g => new GroupColumn(g.Key, lookup.LabelOf(g.Key), lookup.GroupingOf(g.Key)))
+            .OrderBy(c => string.IsNullOrEmpty(c.Node) ? 1 : 0) // ungrouped codes (grouping NULL) last
+            .ThenBy(c => c.Node, System.StringComparer.OrdinalIgnoreCase)
+            .ThenBy(c => c.Name, System.StringComparer.OrdinalIgnoreCase)
+            .ToList();
+
+    /// <summary>
+    /// Builds the wide CSV (data rows per node+metric, then a <c>% of final cohort</c> row and, when
+    /// <paramref name="referencePopulation"/> is supplied, a <c>% of reference population</c> row underneath it as
+    /// a cohort-vs-population sanity check).
+    /// </summary>
+    public static string ToCsv(IReadOnlyList<CohortBuildBreakdownNode> nodes, GroupLookup lookup,
+        CohortBuildBreakdownBuckets referencePopulation = null)
+    {
+        var ordered = nodes.OrderBy(n => n.Seq).ToList();
+        var columns = GroupColumns(ordered, referencePopulation, lookup);
+
+        var header = new List<string> { "Order", "Type", "Name", "Container", "SetOperation", "Metric", "Total" };
+        header.AddRange(columns.Select(c => c.Name));
+        header.Add(OtherColumn);
+        header.Add(NotKnownColumn);
+
+        var sb = new StringBuilder();
+        sb.AppendLine(string.Join(",", header.Select(Escape)));
+
+        foreach (var n in ordered)
+        {
+            AppendCountRow(sb, n, columns, "Final", Split(n.FinalUnfiltered, n.FinalByGroup, lookup));
+            if (n.CumulativeUnfiltered.HasValue && n.CumulativeByGroup != null)
+                AppendCountRow(sb, n, columns, "Cumulative",
+                    Split(n.CumulativeUnfiltered.Value, n.CumulativeByGroup, lookup));
+        }
+
+        // bottom: % of final cohort (root node's Final), then % of reference population, after a blank separator
+        var root = ordered.FirstOrDefault(n => string.IsNullOrEmpty(n.Container)) ?? ordered.FirstOrDefault();
+        if (root != null && root.FinalUnfiltered > 0)
+        {
+            sb.AppendLine();
+            sb.AppendLine(string.Join(",", header.Select(Escape))); // repeat header so % aligns to each group
+            AppendPercentRow(sb, PercentMetric, columns, Split(root.FinalUnfiltered, root.FinalByGroup, lookup));
+            if (referencePopulation != null)
+                AppendPercentRow(sb, ReferencePercentMetric, columns, referencePopulation);
+        }
+
+        return sb.ToString();
+    }
+
+    private static void AppendPercentRow(StringBuilder sb, string label, List<GroupColumn> columns,
+        CohortBuildBreakdownBuckets b)
+    {
+        double Pct(int v) => b.Total == 0 ? 0 : v * 100.0 / b.Total;
+        var cells = new List<string> { "", "", label, "", "", label, Fmt(b.Total == 0 ? 0 : 100.0) };
+        cells.AddRange(columns.Select(c => Fmt(Pct(b.Groups.TryGetValue(c.Code, out var v) ? v : 0))));
+        cells.Add(Fmt(Pct(b.Other)));
+        cells.Add(Fmt(Pct(b.NotKnown)));
+        sb.AppendLine(string.Join(",", cells.Select(Escape)));
+    }
+
+    private static void AppendCountRow(StringBuilder sb, CohortBuildBreakdownNode n, List<GroupColumn> columns,
+        string metric, CohortBuildBreakdownBuckets b)
+    {
+        var cells = new List<string>
+        {
+            n.DisplayOrder.ToString(CultureInfo.InvariantCulture),
+            n.Type, n.Name, n.Container, n.SetOperation, metric,
+            b.Total.ToString(CultureInfo.InvariantCulture)
+        };
+        cells.AddRange(columns.Select(c =>
+            (b.Groups.TryGetValue(c.Code, out var v) ? v : 0).ToString(CultureInfo.InvariantCulture)));
+        cells.Add(b.Other.ToString(CultureInfo.InvariantCulture));
+        cells.Add(b.NotKnown.ToString(CultureInfo.InvariantCulture));
+        sb.AppendLine(string.Join(",", cells.Select(Escape)));
+    }
+
+    public static void WriteCsv(string path, IReadOnlyList<CohortBuildBreakdownNode> nodes, GroupLookup lookup,
+        CohortBuildBreakdownBuckets referencePopulation = null) =>
+        File.WriteAllText(path, ToCsv(nodes, lookup, referencePopulation));
+
+    private static string Fmt(double d) => d.ToString("0.0", CultureInfo.InvariantCulture);
+
+    private static string Escape(string field)
+    {
+        field ??= "";
+        if (field.Contains(',') || field.Contains('"') || field.Contains('\n') || field.Contains('\r'))
+            return $"\"{field.Replace("\"", "\"\"")}\"";
+        return field;
+    }
+}
diff --git a/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownModels.cs b/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownModels.cs
new file mode 100644
index 0000000000..e427deca98
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/src/CohortBuildBreakdownModels.cs
@@ -0,0 +1,88 @@
+// Copyright (c) The University of Dundee 2024-2024
+// This file is part of the Research Data Management Platform (RDMP).
+// RDMP is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+// RDMP is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License along with RDMP. If not, see <https://www.gnu.org/licenses/>.
+
+using System.Collections.Generic;
+
+namespace RdmpCohortBuildBreakdownByGroups;
+
+/// <summary>
+/// One count point of a cohort build tree (a cohort set or a container) with the per-group counts that
+/// were computed for it. Used by <see cref="CohortBuildBreakdownByGroupsReport"/>.
+/// </summary>
+public sealed class CohortBuildBreakdownNode
+{
+    /// <summary>Tree walk order (stable, used to order rows).</summary>
+    public int Seq { get; }
+
+    /// <summary>"Cohort Set" or "Container".</summary>
+    public string Type { get; }
+
+    public string Name { get; }
+
+    /// <summary>Name of the parent container (empty for the root).</summary>
+    public string Container { get; }
+
+    /// <summary>UNION / INTERSECT / EXCEPT for containers; empty for sets.</summary>
+    public string SetOperation { get; }
+
+    public int DisplayOrder { get; }
+
+    /// <summary>RDMP's own count for this node (the unfiltered total).</summary>
+    public int FinalUnfiltered { get; }
+
+    /// <summary>RDMP's own cumulative within the parent container; null if not applicable.</summary>
+    public int? CumulativeUnfiltered { get; }
+
+    /// <summary>Group code -> final count (every present code; the GROUP BY Region result).</summary>
+    public IReadOnlyDictionary<string, int> FinalByGroup { get; }
+
+    /// <summary>Group code -> cumulative count; null when this node has no cumulative.</summary>
+    public IReadOnlyDictionary<string, int> CumulativeByGroup { get; }
+
+    public CohortBuildBreakdownNode(int seq, string type, string name, string container, string setOperation,
+        int displayOrder, int finalUnfiltered, int? cumulativeUnfiltered,
+        IReadOnlyDictionary<string, int> finalByGroup, IReadOnlyDictionary<string, int> cumulativeByGroup)
+    {
+        Seq = seq;
+        Type = type ?? "";
+        Name = name ?? "";
+        Container = container ?? "";
+        SetOperation = setOperation ?? "";
+        DisplayOrder = displayOrder;
+        FinalUnfiltered = finalUnfiltered;
+        CumulativeUnfiltered = cumulativeUnfiltered;
+        FinalByGroup = finalByGroup ?? new Dictionary<string, int>();
+        CumulativeByGroup = cumulativeByGroup;
+    }
+}
+
+/// <summary>
+/// The Total / per-group / Other / NotKnown split of one node+metric, relative to a
+/// <see cref="GroupLookup"/>. <see cref="Groups"/> holds the counts for codes present in the lookup;
+/// <see cref="Other"/> sums present codes absent from the lookup; <see cref="NotKnown"/> is the residual
+/// (not in the reference table, or NULL group).
+/// </summary>
+public sealed class CohortBuildBreakdownBuckets
+{
+    public int Total { get; }
+
+    /// <summary>Group code -> count, for codes recognised by the lookup.</summary>
+    public IReadOnlyDictionary<string, int> Groups { get; }
+
+    /// <summary>Sum of present group codes that the lookup does not recognise.</summary>
+    public int Other { get; }
+
+    /// <summary>Total - recognised - Other = not in the reference table + NULL group.</summary>
+    public int NotKnown { get; }
+
+    public CohortBuildBreakdownBuckets(int total, IReadOnlyDictionary<string, int> groups, int other, int notKnown)
+    {
+        Total = total;
+        Groups = groups ?? new Dictionary<string, int>();
+        Other = other;
+        NotKnown = notKnown;
+    }
+}
diff --git a/RdmpCohortBuildBreakdownByGroups/src/ExecuteCommandExportCohortBuildBreakDownByGroups.cs b/RdmpCohortBuildBreakdownByGroups/src/ExecuteCommandExportCohortBuildBreakDownByGroups.cs
new file mode 100644
index 0000000000..609f5f9316
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/src/ExecuteCommandExportCohortBuildBreakDownByGroups.cs
@@ -0,0 +1,492 @@
+// Copyright (c) The University of Dundee 2024-2024
+// This file is part of the Research Data Management Platform (RDMP).
+// RDMP is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+// RDMP is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License along with RDMP. If not, see <https://www.gnu.org/licenses/>.
+
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Text.RegularExpressions;
+using System.Threading;
+using FAnsi;
+using FAnsi.Discovery;
+using FAnsi.Discovery.QuerySyntax;
+using Rdmp.Core.CohortCreation.Execution;
+using Rdmp.Core.CommandExecution;
+using Rdmp.Core.CommandExecution.AtomicCommands;
+using Rdmp.Core.Curation.Data;
+using Rdmp.Core.Curation.Data.Aggregation;
+using Rdmp.Core.Curation.Data.Cohort;
+using Rdmp.Core.MapsDirectlyToDatabaseTable;
+using Rdmp.Core.QueryBuilding;
+using Rdmp.Core.QueryCaching.Aggregation;
+using Rdmp.Core.ReusableLibraryCode.DataAccess;
+
+namespace RdmpCohortBuildBreakdownByGroups;
+
+/// <summary>
+/// Reproduces the Cohort Builder's per-set / per-container count tree (the FinalCount and cumulative
+/// running totals shown as UNION/INTERSECT/EXCEPT are applied) split by an arbitrary group column
+/// (e.g. health board, GP practice, age band), using a user-supplied lookup table to label and order
+/// the groups. The cohort is built once to populate the per-set query-cache tables; every count point
+/// is then recomposed from those cache tables (the cohort-set source queries are never re-run) and
+/// split by group with one GROUP BY per node joining the reference table (all groups at once).
+///
+/// <para>Inputs are four columns; the tables are derived: <c>groupColumn</c>'s table is the reference
+/// table (which must contain exactly one IsExtractionIdentifier column, the join key to the cohort),
+/// and <c>lookupKeyColumn</c>'s table is the lookup table.</para>
+///
+/// <para>PRECONDITION: each identifier must map to AT MOST ONE group in the reference table (a
+/// single-valued identifier-to-group mapping, e.g. patient -> health board; many identifiers per
+/// group is of course fine). Multi-group membership double-counts
+/// patients across group columns, inflates the reference-population denominator and can make the
+/// NotKnown residual negative. The post-run warning (group counts exceeding the unfiltered total)
+/// is a symptom of violating this.</para>
+/// </summary>
+public class ExecuteCommandExportCohortBuildBreakDownByGroups : BasicCommandExecution
+{
+    private readonly CohortIdentificationConfiguration _cic;
+    private ColumnInfo _groupColumn;
+    private ColumnInfo _lookupKeyColumn;
+    private ColumnInfo _lookupLabelColumn;
+    private ColumnInfo _lookupGroupingColumn;
+    private readonly int _timeout;
+    private FileInfo _toFile;
+
+    private ExtractionInformation _idEi;
+    private IQuerySyntaxHelper _syntax;
+    private DiscoveredDatabase _cacheDb;
+    private CachedAggregateConfigurationResultsManager _cacheManager;
+    private GroupLookup _lookup;
+    private string _referenceTable;
+    private string _referenceId;
+    private string _groupName;
+
+    private readonly Dictionary<int, (string fqn, string col)> _setCacheTable = new();
+    private readonly Dictionary<(bool isContainer, int id), (int final, int? cumulative)> _baseline = new();
+
+    public ExecuteCommandExportCohortBuildBreakDownByGroups(IBasicActivateItems activator,
+        [DemandsInitialization("The cohort identification configuration whose build tree to break down")]
+        CohortIdentificationConfiguration cic,
+        [DemandsInitialization("The column to group the breakdown by (its table is the reference table and must contain the patient identifier)")]
+        ColumnInfo groupColumn = null,
+        [DemandsInitialization("Lookup table column holding the group code (as it appears in the group column); its table is the lookup table")]
+        ColumnInfo lookupKeyColumn = null,
+        [DemandsInitialization("Lookup table column holding the display label for each code")]
+        ColumnInfo lookupLabelColumn = null,
+        [DemandsInitialization("CSV file to write. Defaults to <cic>-build-breakdown.csv in the current directory")]
+        FileInfo toFile = null,
+        [DemandsInitialization("Optional lookup table column holding a higher grouping (used to order the output columns)")]
+        ColumnInfo lookupGroupingColumn = null,
+        [DemandsInitialization("Per-query command timeout in seconds", DefaultValue = 5000)]
+        int timeout = 5000) : base(activator)
+    {
+        _cic = cic;
+        _groupColumn = groupColumn;
+        _lookupKeyColumn = lookupKeyColumn;
+        _lookupLabelColumn = lookupLabelColumn;
+        _lookupGroupingColumn = lookupGroupingColumn;
+        _timeout = timeout;
+        _toFile = toFile;
+
+        if (_cic == null)
+        {
+            SetImpossible("No CohortIdentificationConfiguration was supplied");
+            return;
+        }
+
+        if (_cic.RootCohortAggregateContainer_ID == null)
+        {
+            SetImpossible($"'{_cic}' has no root container to run");
+            return;
+        }
+
+        if (_cic.QueryCachingServer_ID == null)
+            SetImpossible($"'{_cic}' has no query caching server - this breakdown works only on cached results");
+
+        // required columns are resolved (and prompted for, in the GUI) in Execute - the optional
+        // grouping column is never prompted - so the command can sit on a right-click menu with only
+        // the cohort selected.
+    }
+
+    /// <summary>Resolves the column inputs, prompting for any REQUIRED input not supplied (the optional
+    /// grouping column is never prompted). Returns false on cancel.</summary>
+    private bool ResolveInputs()
+    {
+        _groupColumn ??= SelectColumn("Group-by column (on the reference table, e.g. demography Region)");
+        if (_groupColumn == null)
+            return Fail("No group column was supplied");
+
+        // derive the patient identifier from the group column's table: the (single) column flagged
+        // IsExtractionIdentifier. Zero = no join key; several = ambiguous identifier domain.
+        var idEis = _groupColumn.TableInfo.ColumnInfos
+            .SelectMany(c => c.CatalogueItems.Select(ci => ci.ExtractionInformation))
+            .Where(ei => ei is { IsExtractionIdentifier: true })
+            .GroupBy(ei => ei.ColumnInfo.ID)
+            .Select(g => g.First())
+            .ToList();
+
+        if (idEis.Count != 1)
+            return Fail($"Table '{_groupColumn.TableInfo}' must have exactly one IsExtractionIdentifier column " +
+                        $"to join the cohort on (found {idEis.Count})");
+        _idEi = idEis[0];
+
+        // a TRANSFORMED identifier (e.g. UPPER(chi)) means the cohort's cached ids may not equal the
+        // raw column values, so a raw-table join would silently mismatch - refuse rather than guess
+        if (IsTransformedIdentifier(_idEi.SelectSQL, _idEi.ColumnInfo.GetRuntimeName(),
+                _groupColumn.GetQuerySyntaxHelper()))
+            return Fail($"The identifier column '{_idEi}' is a transformed expression ('{_idEi.SelectSQL}'); " +
+                        "this breakdown joins on the raw table column, so transformed identifiers are not supported");
+
+        _lookupKeyColumn ??= SelectColumn("Lookup KEY column (the group code, e.g. z_hb_lookup.Region)");
+        if (_lookupKeyColumn == null)
+            return Fail("No lookup key column was supplied");
+
+        _lookupLabelColumn ??= SelectColumn("Lookup LABEL column (display name, e.g. z_hb_lookup.HB_Name)");
+        if (_lookupLabelColumn == null)
+            return Fail("No lookup label column was supplied");
+
+        // grouping stays optional: do not prompt for it, only validate if supplied
+
+        if (_lookupLabelColumn.TableInfo_ID != _lookupKeyColumn.TableInfo_ID ||
+            (_lookupGroupingColumn != null && _lookupGroupingColumn.TableInfo_ID != _lookupKeyColumn.TableInfo_ID))
+            return Fail("The lookup key, label and grouping columns must all belong to the same table");
+
+        // co-location: the recompose + GROUP BY join runs on the cache server, so the reference table
+        // must be reachable there. Use RDMP's own single-server validation (server + DBMS type +
+        // credential compatibility) rather than a hand-rolled string comparison.
+        try
+        {
+            var points = new DataAccessPointCollection(true);
+            points.Add(_cic.QueryCachingServer);
+            points.Add(_groupColumn.TableInfo);
+        }
+        catch (InvalidOperationException ex) // co-location failure; other exceptions (e.g. credential
+        {                                    // decryption) deliberately propagate as in RDMP core
+            return Fail($"The reference table '{_groupColumn.TableInfo}' and the query cache " +
+                        $"'{_cic.QueryCachingServer}' must be on the same server: {ex.Message}");
+        }
+
+        // PostgreSQL connections are bound to a single database, so the SQL Server-style
+        // cross-database join (cache connection referencing another database's table) cannot work
+        if (_cic.QueryCachingServer.DatabaseType == DatabaseType.PostgreSql)
+        {
+            var error = PostgreSqlSameDatabaseError(_cic.QueryCachingServer.Database,
+                _groupColumn.TableInfo.Database, _cic.QueryCachingServer.GetQuerySyntaxHelper());
+            if (error != null)
+                return Fail(error);
+        }
+
+        return true;
+    }
+
+    private ColumnInfo SelectColumn(string prompt)
+    {
+        var available = BasicActivator.RepositoryLocator.CatalogueRepository.GetAllObjects<ColumnInfo>();
+        return available.Length > 0 && BasicActivator.SelectObject(prompt, available, out var selected)
+            ? selected
+            : null;
+    }
+
+    private bool Fail(string reason)
+    {
+        BasicActivator.Show(reason);
+        return false;
+    }
+
+    public override void Execute()
+    {
+        base.Execute();
+
+        if (!ResolveInputs())
+            return;
+
+        _toFile ??= BasicActivator.IsInteractive
+            ? BasicActivator.SelectFile("Path to write build breakdown to", "Build breakdown", "*.csv")
+            : new FileInfo(Path.Combine(Environment.CurrentDirectory, $"{Sanitise(_cic.Name)}-build-breakdown.csv"));
+
+        if (_toFile == null)
+            return;
+
+        _syntax = _groupColumn.GetQuerySyntaxHelper();
+        _cacheDb = _cic.QueryCachingServer.Discover(DataAccessContext.InternalDataProcessing);
+        _cacheManager = new CachedAggregateConfigurationResultsManager(_cic.QueryCachingServer);
+        // fully-qualified via the discovery API rather than trusting TableInfo.Name verbatim
+        _referenceTable = _groupColumn.TableInfo.Discover(DataAccessContext.InternalDataProcessing)
+            .GetFullyQualifiedName();
+        // join on the PHYSICAL identifier column: ExtractionInformation.GetRuntimeName() returns the
+        // alias when one exists (e.g. "chi AS PatientId"), which does not exist on the raw table
+        _referenceId = _syntax.EnsureWrapped(_idEi.ColumnInfo.GetRuntimeName());
+        _groupName = _syntax.EnsureWrapped(_groupColumn.GetRuntimeName());
+
+        // load the (user-defined) code -> label/grouping mapping from the lookup table
+        _lookup = GroupLookup.LoadFrom(
+            _lookupKeyColumn.TableInfo.Discover(DataAccessContext.InternalDataProcessing),
+            _lookupKeyColumn.GetRuntimeName(),
+            _lookupLabelColumn.GetRuntimeName(),
+            _lookupGroupingColumn?.GetRuntimeName(),
+            _timeout);
+
+        // 1. Build once: populates every per-set cache table and gives the baseline (unfiltered) counts.
+        var compiler = new CohortCompiler(BasicActivator, _cic) { IncludeCumulativeTotals = true };
+        var runner = new CohortCompilerRunner(compiler, _timeout) { RunSubcontainers = true };
+        runner.Run(new CancellationToken());
+
+        var crashed = compiler.Tasks.Keys.Where(t => t.State == CompilationState.Crashed).ToList();
+        if (crashed.Any())
+        {
+            SetImpossible($"{crashed.Count} task(s) crashed during the build - cannot produce a reliable breakdown");
+            BasicActivator.Show($"Build failed: {crashed[0].CrashMessage?.Message}");
+            return;
+        }
+
+        foreach (var task in compiler.Tasks.Keys)
+        {
+            var isContainer = task switch
+            {
+                AggregationContainerTask => true,
+                AggregationTask => false,
+                _ => (bool?)null // skip joinables / plugin tasks
+            };
+            if (isContainer == null || task.Child == null)
+                continue;
+            _baseline[(isContainer.Value, task.Child.ID)] = (task.FinalRowCount, task.CumulativeRowCount);
+        }
+
+        // 2. Walk the tree, recomposing each count point from the cache and splitting by group.
+        var nodes = new List<CohortBuildBreakdownNode>();
+        var seq = 0;
+        Walk(_cic.RootCohortAggregateContainer, null, 0, nodes, ref seq);
+
+        // reference: each group's share of the WHOLE reference population (a sanity-check row)
+        var referencePopulation = ComputeReferencePopulation();
+
+        CohortBuildBreakdownByGroupsReport.WriteCsv(_toFile.FullName, nodes, _lookup, referencePopulation);
+
+        // reconciliation note: recognised-group counts should never exceed the unfiltered total
+        var drift = nodes.Count(n =>
+            n.FinalByGroup.Where(kv => _lookup.Contains(kv.Key)).Sum(kv => kv.Value) > n.FinalUnfiltered);
+        var summary = $"Exported build breakdown to {_toFile.FullName} ({nodes.Count} count points)";
+        if (drift > 0)
+            summary += $" - WARNING: {drift} node(s) have group counts exceeding the unfiltered total (check keys)";
+        BasicActivator.Show(summary);
+    }
+
+    private void Walk(CohortAggregateContainer container, CohortAggregateContainer parent, int indexInParent,
+        List<CohortBuildBreakdownNode> nodes, ref int seq)
+    {
+        // container node row (cumulative is within its parent)
+        var (cFinal, cCum) = _baseline.TryGetValue((true, container.ID), out var cb) ? cb : (0, null);
+        IReadOnlyDictionary<string, int> cCumByGroup = null;
+        if (parent != null && indexInParent > 0 && cCum.HasValue)
+            cCumByGroup = RunGroupCounts(CumulativeSql(parent, indexInParent));
+
+        nodes.Add(new CohortBuildBreakdownNode(seq++, "Container", CleanName(container.Name),
+            CleanName(parent?.Name), container.Operation.ToString(), container.Order, cFinal,
+            parent != null && indexInParent > 0 ? cCum : null,
+            RunGroupCounts(IdSql(container)), cCumByGroup));
+
+        var kids = EnabledOrdered(container);
+        for (var i = 0; i < kids.Count; i++)
+        {
+            switch (kids[i])
+            {
+                case AggregateConfiguration agg:
+                    var (aFinal, aCum) = _baseline.TryGetValue((false, agg.ID), out var ab) ? ab : (0, null);
+                    IReadOnlyDictionary<string, int> aCumByGroup = null;
+                    if (i > 0 && aCum.HasValue)
+                        aCumByGroup = RunGroupCounts(CumulativeSql(container, i));
+
+                    nodes.Add(new CohortBuildBreakdownNode(seq++, "Cohort Set", CleanName(agg.Name),
+                        CleanName(container.Name), "", agg.Order, aFinal, i > 0 ? aCum : null,
+                        RunGroupCounts(CachedSetSql(agg)), aCumByGroup));
+                    break;
+
+                case CohortAggregateContainer sub:
+                    Walk(sub, container, i, nodes, ref seq);
+                    break;
+            }
+        }
+    }
+
+    // --- identifier-list SQL composed purely from the per-set cache tables ---
+
+    private string IdSql(IOrderable node) => node switch
+    {
+        AggregateConfiguration agg => CachedSetSql(agg),
+        CohortAggregateContainer c => Compose(c, EnabledOrdered(c)),
+        _ => throw new NotSupportedException(node.GetType().Name)
+    };
+
+    private string CumulativeSql(CohortAggregateContainer container, int upToInclusive) =>
+        Compose(container, EnabledOrdered(container).Take(upToInclusive + 1).ToList());
+
+    private string Compose(CohortAggregateContainer container, IReadOnlyList<IOrderable> children)
+    {
+        if (children.Count == 0)
+            throw new InvalidOperationException(
+                $"Container '{container.Name}' has no enabled content to compose - it should have been skipped");
+        var op = $"\n{SetOperationSql(container.Operation, _syntax.DatabaseType)}\n";
+        return string.Join(op, children.Select(ch => $"({IdSql(ch)})"));
+    }
+
+    /// <summary>
+    /// PostgreSQL-only guard: the reference table must be in the same database as the query cache
+    /// (one PostgreSQL connection cannot access another database). RDMP stores TableInfo.Database
+    /// WRAPPED (e.g. "mydb") but cache-server databases UNWRAPPED, so both names are normalized via
+    /// the syntax helper's GetRuntimeName before an EXACT comparison (quoted PostgreSQL identifiers
+    /// are case-sensitive), mirroring DataAccessPortal. Returns an error message, or null if ok.
+    /// </summary>
+    public static string PostgreSqlSameDatabaseError(string cacheDatabase, string referenceDatabase,
+        IQuerySyntaxHelper syntax)
+    {
+        if (string.IsNullOrWhiteSpace(cacheDatabase) || string.IsNullOrWhiteSpace(referenceDatabase))
+            return "On PostgreSQL both the query cache and the reference table must have a database name " +
+                   $"recorded (cache '{cacheDatabase}', reference '{referenceDatabase}').";
+
+        var cache = syntax.GetRuntimeName(cacheDatabase);
+        var reference = syntax.GetRuntimeName(referenceDatabase);
+
+        return string.Equals(cache, reference, StringComparison.Ordinal)
+            ? null
+            : "On PostgreSQL the reference table must be in the SAME DATABASE as the query cache " +
+              $"(cache '{cache}', reference '{reference}') - a PostgreSQL connection cannot access " +
+              "tables in another database.";
+    }
+
+    /// <summary>
+    /// Renders a container's set operation for the target DBMS (Oracle spells EXCEPT as MINUS) - the
+    /// same mapping RDMP uses in <c>CohortQueryBuilderResult.GetSetOperationSql</c>.
+    /// </summary>
+    public static string SetOperationSql(SetOperation operation, DatabaseType dbType) => operation switch
+    {
+        SetOperation.UNION => "UNION",
+        SetOperation.INTERSECT => "INTERSECT",
+        SetOperation.EXCEPT => dbType == DatabaseType.Oracle ? "MINUS" : "EXCEPT",
+        _ => throw new ArgumentOutOfRangeException(nameof(operation), operation, null)
+    };
+
+    private string CachedSetSql(AggregateConfiguration agg)
+    {
+        if (!_setCacheTable.TryGetValue(agg.ID, out var t))
+        {
+            var table = _cacheManager.GetLatestResultsTableUnsafe(agg,
+                AggregateOperation.IndexedExtractionIdentifierList) as DiscoveredTable;
+            if (table == null)
+                throw new Exception($"Cohort set '{agg.Name}' has no cached identifier list - the build did not cache it");
+            var col = table.DiscoverColumns()[0].GetRuntimeName();
+            t = (table.GetFullyQualifiedName(), _syntax.EnsureWrapped(col));
+            _setCacheTable[agg.ID] = t;
+        }
+
+        return $"SELECT {t.col} id FROM {t.fqn}";
+    }
+
+    private List<IOrderable> EnabledOrdered(CohortAggregateContainer container) =>
+        container.GetOrderedContents().Where(o => o switch
+        {
+            AggregateConfiguration a => !a.IsDisabled,
+            // reuse RDMP's own enabled/skip logic (disabled or empty containers) so our walk matches
+            // the baseline task set produced by CohortCompilerRunner
+            CohortAggregateContainer c => CohortQueryBuilderResult.IsEnabled(c,
+                BasicActivator.CoreChildProvider),
+            _ => true
+        }).ToList();
+
+    // --- run a GROUP BY join (on the cache server) for one count point ---
+
+    private IReadOnlyDictionary<string, int> RunGroupCounts(string idListSql)
+    {
+        var sql =
+            $"SELECT d.{_groupName} grp, COUNT(DISTINCT i.id) n\n" +
+            $"FROM (\n{idListSql}\n) i\n" +
+            $"INNER JOIN {_referenceTable} d ON d.{_referenceId} = i.id\n" +
+            $"GROUP BY d.{_groupName}";
+
+        return ReadGroupCounts(sql, out _);
+    }
+
+    /// <summary>
+    /// The whole reference population split by group (the background distribution). Total includes
+    /// NULL-group rows so <see cref="CohortBuildBreakdownBuckets.NotKnown"/> captures them.
+    /// </summary>
+    private CohortBuildBreakdownBuckets ComputeReferencePopulation()
+    {
+        var sql =
+            $"SELECT d.{_groupName} grp, COUNT(DISTINCT d.{_referenceId}) n\n" +
+            $"FROM {_referenceTable} d\n" +
+            $"GROUP BY d.{_groupName}";
+
+        var byGroup = ReadGroupCounts(sql, out var total);
+        return CohortBuildBreakdownByGroupsReport.Split(total, byGroup, _lookup);
+    }
+
+    /// <summary>Runs a "group, count" query on the cache server; returns non-null groups and the grand total.</summary>
+    private Dictionary<string, int> ReadGroupCounts(string sql, out int total)
+    {
+        var result = new Dictionary<string, int>(StringComparer.OrdinalIgnoreCase);
+        total = 0;
+        using var con = _cacheDb.Server.GetConnection();
+        con.Open();
+        using var cmd = _cacheDb.Server.GetCommand(sql, con);
+        cmd.CommandTimeout = _timeout;
+        using var r = cmd.ExecuteReader();
+        while (r.Read())
+        {
+            var n = Convert.ToInt32(r.GetValue(1));
+            total += n; // includes any NULL-group rows in the denominator
+            if (r.IsDBNull(0))
+                continue;
+            // ACCUMULATE: a case-sensitive DBMS can return 'A' and 'a' as separate rows, which our
+            // case-insensitive key would otherwise silently overwrite. TRIM so 'T ' and 'T' cannot
+            // become two identically-labelled columns; whitespace-only behaves like NULL (-> NotKnown)
+            var key = r.GetValue(0).ToString()?.Trim();
+            if (string.IsNullOrEmpty(key))
+                continue;
+            result[key] = result.TryGetValue(key, out var existing) ? existing + n : n;
+        }
+
+        return result;
+    }
+
+    // RDMP prefixes cohort set names with "cic_<ID>_" (EnsureNamingConvention); cloning a cohort across
+    // CICs stacks them (e.g. cic_18286_cic_18284_cic_17950_People in SHARE...). Strip them for display.
+    private static readonly Regex CicPrefix = new(@"^(cic_\d+_)+", RegexOptions.Compiled);
+
+    public static string CleanName(string name) => string.IsNullOrEmpty(name) ? "" : CicPrefix.Replace(name, "");
+
+    /// <summary>
+    /// True unless the identifier's SelectSQL is a plain (possibly qualified) reference to the
+    /// physical column: any alias is split off first (an alias only renames the output column, e.g.
+    /// "chi AS PatientId" still selects raw chi values), then the syntax helper's runtime name of the
+    /// UNDERLYING expression must equal the physical column's runtime name (a WHITELIST - anything
+    /// else, including expressions the helper cannot parse, is treated as transformed).
+    /// </summary>
+    public static bool IsTransformedIdentifier(string selectSql, string physicalRuntimeName,
+        IQuerySyntaxHelper syntax)
+    {
+        if (string.IsNullOrWhiteSpace(selectSql))
+            return false; // no expression stored - the column itself is used
+
+        try
+        {
+            // strip the alias so "UPPER(chi) AS chi" is judged on UPPER(chi), not on its alias
+            syntax.SplitLineIntoSelectSQLAndAlias(selectSql, out var underlying, out _);
+            return !string.Equals(syntax.GetRuntimeName(underlying), physicalRuntimeName,
+                StringComparison.OrdinalIgnoreCase);
+        }
+        catch (Exception)
+        {
+            return true; // unparseable = not a plain column reference
+        }
+    }
+
+    private static string Sanitise(string name)
+    {
+        foreach (var c in Path.GetInvalidFileNameChars())
+            name = name.Replace(c, '_');
+        return name;
+    }
+}
diff --git a/RdmpCohortBuildBreakdownByGroups/src/GroupLookup.cs b/RdmpCohortBuildBreakdownByGroups/src/GroupLookup.cs
new file mode 100644
index 0000000000..55f46c3d00
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/src/GroupLookup.cs
@@ -0,0 +1,101 @@
+// Copyright (c) The University of Dundee 2024-2024
+// This file is part of the Research Data Management Platform (RDMP).
+// RDMP is free software: you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version.
+// RDMP is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for more details.
+// You should have received a copy of the GNU General Public License along with RDMP. If not, see <https://www.gnu.org/licenses/>.
+
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using FAnsi.Discovery;
+
+namespace RdmpCohortBuildBreakdownByGroups;
+
+/// <summary>
+/// A user-defined mapping from a group code to a display label and an optional grouping node, loaded
+/// at runtime from a lookup table whose key/label/grouping columns are supplied by the caller (nothing
+/// is hard-coded). A NULL grouping is allowed (e.g. codes that have a label but no higher grouping).
+/// Codes absent from the table are treated as unmapped ("Other").
+/// </summary>
+public sealed class GroupLookup
+{
+    /// <summary>Labels that would collide with the report's fixed column headers.</summary>
+    public static readonly string[] ReservedLabels =
+        { "Order", "Type", "Name", "Container", "SetOperation", "Metric", "Total", "Other", "NotKnown" };
+
+    private readonly Dictionary<string, (string Label, string Grouping)> _map;
+
+    public GroupLookup(IReadOnlyDictionary<string, (string Label, string Grouping)> map)
+    {
+        _map = new Dictionary<string, (string, string)>(map, StringComparer.OrdinalIgnoreCase);
+        Validate(_map);
+    }
+
+    /// <summary>
+    /// Hard-stops on lookup content that would silently corrupt the report: duplicate labels (two
+    /// codes rendering as identically-named columns) or labels equal to a fixed report header.
+    /// (Duplicate keys are rejected at load time before they can collapse into one entry.)
+    /// </summary>
+    private static void Validate(Dictionary<string, (string Label, string Grouping)> map)
+    {
+        var dupLabel = map.Values.Select(v => v.Label)
+            .GroupBy(l => l, StringComparer.OrdinalIgnoreCase)
+            .FirstOrDefault(g => g.Count() > 1);
+        if (dupLabel != null)
+            throw new ArgumentException(
+                $"Lookup contains duplicate label '{dupLabel.Key}' - two group codes would render as identically named columns");
+
+        var reserved = map.Values.Select(v => v.Label)
+            .FirstOrDefault(l => ReservedLabels.Contains(l, StringComparer.OrdinalIgnoreCase));
+        if (reserved != null)
+            throw new ArgumentException(
+                $"Lookup label '{reserved}' collides with a fixed report column header - rename it in the lookup table");
+    }
+
+    /// <summary>True if the code is present in the lookup (a recognised group).</summary>
+    public bool Contains(string code) => code != null && _map.ContainsKey(code.Trim());
+
+    /// <summary>Display label for the code, or null if unmapped.</summary>
+    public string LabelOf(string code) =>
+        code != null && _map.TryGetValue(code.Trim(), out var v) ? v.Label : null;
+
+    /// <summary>Grouping node for the code (may be null even for a mapped code), or null if unmapped.</summary>
+    public string GroupingOf(string code) =>
+        code != null && _map.TryGetValue(code.Trim(), out var v) ? v.Grouping : null;
+
+    /// <summary>
+    /// Reads the mapping from a lookup <paramref name="table"/> using the supplied runtime column
+    /// names. Rows with a NULL/blank key are skipped; a NULL label falls back to the code; a NULL
+    /// grouping is preserved. <paramref name="groupingColumn"/> may be null (no grouping at all).
+    /// </summary>
+    public static GroupLookup LoadFrom(DiscoveredTable table, string keyColumn, string labelColumn,
+        string groupingColumn, int timeout)
+    {
+        var syntax = table.Database.Server.GetQuerySyntaxHelper();
+        var groupingSelect = groupingColumn == null ? "" : $", {syntax.EnsureWrapped(groupingColumn)}";
+        var sql =
+            $"SELECT {syntax.EnsureWrapped(keyColumn)}, {syntax.EnsureWrapped(labelColumn)}{groupingSelect} " +
+            $"FROM {table.GetFullyQualifiedName()}";
+
+        var map = new Dictionary<string, (string, string)>(StringComparer.OrdinalIgnoreCase);
+        using var con = table.Database.Server.GetConnection();
+        con.Open();
+        using var cmd = table.Database.Server.GetCommand(sql, con);
+        cmd.CommandTimeout = timeout;
+        using var r = cmd.ExecuteReader();
+        while (r.Read())
+        {
+            var code = r.IsDBNull(0) ? null : r.GetValue(0).ToString()?.Trim();
+            if (string.IsNullOrEmpty(code))
+                continue;
+            if (map.ContainsKey(code))
+                throw new ArgumentException(
+                    $"Lookup table '{table.GetRuntimeName()}' contains duplicate key '{code}' - one row per code is required");
+            var label = r.IsDBNull(1) ? code : r.GetValue(1).ToString();
+            var grouping = groupingColumn != null && !r.IsDBNull(2) ? r.GetValue(2).ToString() : null;
+            map[code] = (label, grouping);
+        }
+
+        return new GroupLookup(map);
+    }
+}
diff --git a/RdmpCohortBuildBreakdownByGroups/src/RdmpCohortBuildBreakdownByGroups.csproj b/RdmpCohortBuildBreakdownByGroups/src/RdmpCohortBuildBreakdownByGroups.csproj
new file mode 100644
index 0000000000..e54b03a7d2
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/src/RdmpCohortBuildBreakdownByGroups.csproj
@@ -0,0 +1,23 @@
+<Project Sdk="Microsoft.NET.Sdk">
+
+  <PropertyGroup>
+    <TargetFramework>net10.0</TargetFramework>
+    <Nullable>enable</Nullable>
+    <ImplicitUsings>disable</ImplicitUsings>
+    <AssemblyName>RdmpCohortBuildBreakdownByGroups</AssemblyName>
+    <GenerateDocumentationFile>false</GenerateDocumentationFile>
+    <!-- only this plugin's dll goes in the .rdmp; the host RDMP provides Rdmp.Core etc. -->
+    <CopyLocalLockFileAssemblies>false</CopyLocalLockFileAssemblies>
+    <!-- standalone: opt out of the host repo Central Package Management so the pinned Version applies anywhere -->
+    <ManagePackageVersionsCentrally>false</ManagePackageVersionsCentrally>
+  </PropertyGroup>
+
+  <ItemGroup>
+    <!-- Pinned released RDMP dependency: the plugin builds standalone from any checkout,
+         against exactly the version it targets (no in-tree Rdmp.Core reference). -->
+    <PackageReference Include="HIC.RDMP.Plugin" Version="9.2.3">
+      <ExcludeAssets>runtime</ExcludeAssets>
+    </PackageReference>
+  </ItemGroup>
+
+</Project>
diff --git a/RdmpCohortBuildBreakdownByGroups/src/RdmpCohortBuildBreakdownByGroups.nuspec b/RdmpCohortBuildBreakdownByGroups/src/RdmpCohortBuildBreakdownByGroups.nuspec
new file mode 100644
index 0000000000..75f0af4e9e
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/src/RdmpCohortBuildBreakdownByGroups.nuspec
@@ -0,0 +1,18 @@
+<?xml version="1.0" encoding="utf-8"?>
+<package xmlns="http://schemas.microsoft.com/packaging/2013/05/nuspec.xsd">
+  <metadata>
+    <id>RdmpCohortBuildBreakdownByGroups</id>
+    <version>0.0.2</version>
+    <authors>HIC</authors>
+    <description>Reproduces the Cohort Builder's per-set / per-container count tree (FinalCount and
+      cumulative running totals) split by an arbitrary group column (e.g. health board), labelled and
+      ordered by a user-supplied lookup table. Builds the cohort once, then recomposes every count point
+      from the cached per-set tables (cohort-set source queries are never re-run). CLI:
+      ExportCohortBuildBreakDownByGroups; GUI: right-click a cohort identification configuration
+      (SHARE preset or choose inputs).</description>
+    <dependencies>
+      <!-- major.minor must match the running RDMP (set to your release, e.g. 9.2). -->
+      <dependency id="HIC.RDMP.Plugin" version="9.2" />
+    </dependencies>
+  </metadata>
+</package>
diff --git a/RdmpCohortBuildBreakdownByGroups/src/SharePreset.cs b/RdmpCohortBuildBreakdownByGroups/src/SharePreset.cs
new file mode 100644
index 0000000000..229936d9f0
--- /dev/null
+++ b/RdmpCohortBuildBreakdownByGroups/src/SharePreset.cs
@@ -0,0 +1,79 @@
+// The SHARE deployment preset: well-known object NAMES resolved against the repository at runtime.
+// This is deliberately the ONLY place any deployment-specific name lives - the generic engine
+// (ExecuteCommandExportCohortBuildBreakDownByGroups) has no defaults at all. If a name is not found
+// (or is ambiguous) the preset returns null for that input and the command prompts for it.
+
+using System;
+using System.Linq;
+using Rdmp.Core.Curation.Data;
+using Rdmp.Core.Repositories;
+
+namespace RdmpCohortBuildBreakdownByGroups;
+
+public static class SharePreset
+{
+    public const string ReferenceCatalogueName = "SHARE_Demography";
+    public const string GroupColumnName = "Region";
+    public const string LookupTableName = "z_hb_lookup";
+    public const string LookupKeyColumnName = "Region";
+    public const string LookupLabelColumnName = "HB_Name";
+
+    /// <summary>
+    /// Resolves the preset names against the repository. Any input that cannot be resolved to exactly
+    /// one object comes back null (the command then prompts for it). When several tables share the
+    /// lookup name (e.g. copies imported from other databases), the one co-located with the reference
+    /// table wins - the command requires them on the same server anyway.
+    /// </summary>
+    public static void TryResolve(ICatalogueRepository repository,
+        out ColumnInfo groupColumn, out ColumnInfo lookupKey, out ColumnInfo lookupLabel)
+    {
+        ColumnInfo group = null;
+
+        var cata = Single(repository.GetAllObjects<Catalogue>(),
+            c => string.Equals(c.Name, ReferenceCatalogueName, StringComparison.OrdinalIgnoreCase));
+        if (cata != null)
+            group = Single(cata.GetAllExtractionInformation(ExtractionCategory.Any),
+                    e => string.Equals(e.GetRuntimeName(), GroupColumnName, StringComparison.OrdinalIgnoreCase))
+                ?.ColumnInfo;
+
+        var candidates = repository.GetAllObjects<TableInfo>()
+            .Where(t => string.Equals(t.GetRuntimeName(), LookupTableName, StringComparison.OrdinalIgnoreCase))
+            .ToArray();
+
+        // disambiguate by co-location with the reference table: same server AND database first,
+        // then same server; only give up (prompt) if still not exactly one
+        if (candidates.Length > 1 && group != null)
+        {
+            var sameServerAndDb = candidates.Where(t =>
+                    SameName(t.Server, group.TableInfo.Server) && SameName(t.Database, group.TableInfo.Database))
+                .ToArray();
+            var sameServer = candidates.Where(t => SameName(t.Server, group.TableInfo.Server)).ToArray();
+
+            candidates = sameServerAndDb.Length == 1 ? sameServerAndDb
+                : sameServer.Length == 1 ? sameServer
+                : candidates;
+        }
+
+        var lookupTable = candidates.Length == 1 ? candidates[0] : null;
+
+        groupColumn = group;
+        lookupKey = LookupColumn(lookupTable, LookupKeyColumnName);
+        lookupLabel = LookupColumn(lookupTable, LookupLabelColumnName);
+    }
+
+    private static bool SameName(string a, string b) =>
+        string.Equals(a?.Trim(), b?.Trim(), StringComparison.OrdinalIgnoreCase);
+
+    private static ColumnInfo LookupColumn(TableInfo table, string name) =>
+        table == null
+            ? null
+            : Single(table.ColumnInfos,
+                c => string.Equals(c.GetRuntimeName(), name, StringComparison.OrdinalIgnoreCase));
+
+    /// <summary>Exactly one match or null (ambiguity is treated as not found).</summary>
+    private static T Single<T>(T[] available, Func<T, bool> predicate) where T : class
+    {
+        var matches = available.Where(predicate).Take(2).ToList();
+        return matches.Count == 1 ? matches[0] : null;
+    }
+}